Google ACE Deploying and Implementing a Cloud Solution Practice Test 4 — 15 Questions

Question 1

An engineer needs to create a Cloud Storage bucket for storing sensitive financial data that must be encrypted at rest using a customer-managed encryption key (CMEK) stored in Cloud KMS. Which three actions are required? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use gcloud storage buckets create with --encryption-key flag pointing to the KMS key.. To use CMEK for Cloud Storage, you must first create a key ring and cryptographic key in Cloud KMS (Option B). Then, grant the Cloud Storage service account the Cloud KMS CryptoKey Encrypter/Decrypter role (Option D) to allow Cloud Storage to use the key. Finally, when creating the bucket, use the gcloud storage buckets create command with the --encryption-key flag pointing to that key (Option A). Option C is incorrect because gsutil mb does not support CMEK. Option E sets default encryption on an existing bucket, not CMEK.

Answer

Use gsutil mb -o default_encryption_key=...

Answer

Set default encryption on the bucket using gsutil defaulte encryption set.

Question 2

A DevOps engineer is setting up a CI/CD pipeline that deploys a containerized application to Cloud Run. The application source code is in a Cloud Source Repository. Which three steps are required to deploy from source? (Choose THREE.)

Accepted Answer

Use gcloud run deploy with the --source flag pointing to the source code.. To deploy from source to Cloud Run, you can use Cloud Build to build the container image from source (option E), push it to Container Registry (option C), and then deploy using gcloud run deploy with the --source flag (option B). Option A is incorrect because Cloud Run is serverless and does not require a GKE cluster. Option D is for deploying from an existing image, not from source.

Answer

Create a GKE cluster to host the application.

Answer

Use gcloud run deploy --image to deploy the container image.

Question 3

A company has a Cloud SQL for MySQL instance that needs to be replicated to a different region for disaster recovery. Which two actions should they take? (Choose TWO.)

Accepted Answer

Create a read replica of the primary instance in the target region.. To replicate a Cloud SQL for MySQL instance to a different region for disaster recovery, you should create a read replica of the primary instance in the target region (option C). During a disaster, you can promote the read replica to become the new primary instance (option D). Option A (configure an external replica) is not a supported feature for Cloud SQL. Option B (enable binary logging) is necessary for MySQL replication but not a sufficient action on its own; it's a prerequisite, not an action to set up cross-region replication. Option E (failover replica in same zone) does not provide cross-region failover.

Answer

Configure an external replica from the primary instance.

Answer

Enable binary logging on the primary instance.

Answer

Set up a failover replica in the same zone.

Question 4

An engineer needs to create a Compute Engine VM instance with the following specifications: 4 vCPUs, 16 GB memory, running the latest Debian 11 image, a 50 GB boot disk, and attached to a specific subnet. Which command should be used?

Accepted Answer

gcloud compute instances create my-vm --machine-type=n1-standard-4 --image-family=debian-11 --image-project=debian-cloud --boot-disk-size=50GB --subnet=my-subnet --zone=us-central1-a. Includes all required flags: --machine-type (n1-standard-4 for 4 vCPUs and 16 GB memory), --image-family and --image-project (debian-11 and debian-cloud for latest Debian 11), --boot-disk-size=50GB, --subnet to attach to a specific subnet, and --zone (required when specifying a subnet). Option B is missing --zone, which is required for subnet attachment. Option C uses --machine-type=custom-4-16384, which is incorrect; custom machine types require --custom-cpu and --custom-memory flags. Option D uses --image-project=debian, which is incorrect; the correct project is debian-cloud.

Answer

gcloud compute instances create my-vm --machine-type=n1-standard-4 --image-family=debian-11 --image-project=debian-cloud --boot-disk-size=50GB --subnet=my-subnet

Answer

gcloud compute instances create my-vm --machine-type=custom-4-16384 --image-family=debian-11 --image-project=debian-cloud --boot-disk-size=50GB --subnet=my-subnet --zone=us-central1-a

Answer

gcloud compute instances create my-vm --machine-type=n1-standard-4 --image-family=debian-11 --image-project=debian --boot-disk-size=50GB --subnet=my-subnet --zone=us-central1-a

Question 5

An organization wants to migrate on-premises databases to Cloud SQL. They have a PostgreSQL database and a MySQL database. They require high availability with automatic failover and regional resilience. Which THREE steps should they take?

Accepted Answer

Use gcloud sql import sql to import data into the Cloud SQL instances after creation. Option C is correct because creating the MySQL instance with --availability-type=regional enables a regional HA configuration with a standby in a different zone and automatic failover, and --database-version=MYSQL_8_0 matches the required MySQL engine. Option D is correct for the same reason on the PostgreSQL side: --availability-type=regional provides regional resilience and automatic failover, while --database-version=POSTGRES_15 specifies the PostgreSQL engine. Option A is correct because after the instances are created, gcloud sql import sql is the supported way to load SQL dump data into the Cloud SQL instances. Option B is incorrect because --zone=us-central1-a creates a single-zone (zonal) instance, which does not provide automatic failover or regional resilience. Option E is incorrect because --zone and --secondary-zone are not the parameters that define a regional HA instance; regional availability is set with --availability-type=regional, and the secondary zone is managed automatically.

Answer

Create a Cloud SQL instance for MySQL with --tier=db-standard-1 and --zone=us-central1-a

Answer

Create a Cloud SQL instance for PostgreSQL with --zone=us-central1-a and --secondary-zone=us-central1-c

Question 6

You have a managed instance group (MIG) with instances that need to run a startup script to configure monitoring agents. You created the instance template without a startup script. Which action should you take to add the startup script?

Accepted Answer

Create a new instance template with the startup script, then update the MIG to use the new template via a rolling update.. Instance templates are immutable; you cannot modify them. You must create a new instance template with the startup script and update the MIG to use it via rolling update or by setting the template.

Answer

Use gcloud compute instances add-metadata to add the startup script to each running instance.

Answer

Delete the MIG and recreate it with a new template; you cannot change the template of an existing MIG.

Answer

Edit the existing instance template and add the startup script under 'metadata'.

Question 7

You deployed a Cloud Run service with gcloud run deploy --image gcr.io/my-project/my-image --platform managed --region us-central1 --allow-unauthenticated. Users report intermittent 503 errors. What is the most likely cause?

Accepted Answer

The service is hitting the maximum number of concurrent requests per container instance (default 80) and needs more instances.. Cloud Run scales based on concurrent requests per container instance, with a default concurrency limit of 80. When a container instance reaches this limit, additional requests are queued or rejected; if the service cannot scale out fast enough (e.g., due to cold starts or instance limits), users experience intermittent 503 errors. The most likely cause is that the service is hitting this concurrency limit and needs more instances or a higher concurrency setting.

Answer

The region us-central1 does not support Cloud Run.

Answer

The container image is not compatible with the managed platform.

Answer

The --allow-unauthenticated flag causes IAM permission errors.

Question 8

You are managing a Cloud Functions deployment that processes messages from a Pub/Sub topic. You need to ensure the function can read messages from the topic and acknowledge them. Which IAM role should you assign to the function's service account?

Accepted Answer

roles/pubsub.subscriber. The Pub/Sub Subscriber role (roles/pubsub.subscriber) grants permission to pull messages and acknowledge them. The function's service account needs this role on the topic or subscription.

Answer

roles/pubsub.publisher

Answer

roles/pubsub.viewer

Answer

roles/iam.serviceAccountUser

Question 9

You need to deploy an application that requires a regional MySQL database with automated backups, high availability, and failover. You also need to store static assets that are publicly accessible. Which TWO Google Cloud services should you use?

Accepted Answer

Cloud SQL (MySQL). Cloud SQL with MySQL provides managed MySQL with high availability (regional) and automated backups. Cloud Storage can host static assets publicly.

Answer

Bigtable

Answer

Cloud Filestore

Answer

Cloud Spanner

Question 10

You need to allow SSH access to a Compute Engine instance. Which method is the recommended way to manage SSH keys for multiple users?

Accepted Answer

Enable OS Login and assign IAM roles to users.. OS Login is the recommended method for managing SSH access to Compute Engine instances, as it links SSH keys to user accounts and integrates with IAM.

Answer

Add SSH keys to the instance metadata.

Answer

Use gcloud compute ssh with the --ssh-key-file flag.

Answer

Create a custom image with preconfigured SSH keys.

Question 11

You are deploying a high-traffic web application on GKE. You need to automatically scale the number of pods based on CPU utilization. Which THREE steps are required to set up Horizontal Pod Autoscaling (HPA)?

Accepted Answer

Install the metrics-server in the cluster.. To use HPA, you need a deployment (or other scalable resource), you need to apply the HPA resource (e.g., via kubectl autoscale), and you must have metrics-server installed to provide metrics. Creating a service is optional.

Answer

Enable Stackdriver Monitoring for the cluster.

Answer

Expose the Deployment as a Service of type LoadBalancer.

Question 12

You need to deploy a Cloud Function that is triggered by HTTP requests. You want to pass configuration parameters to the function at deployment time. Which approach should you use?

Accepted Answer

Use the --set-env-vars flag with gcloud functions deploy.. You can set environment variables at deployment time using the --set-env-vars flag with the gcloud functions deploy command. This allows passing configuration parameters without modifying the code. Option C is correct.

Answer

Store parameters in a Cloud Storage bucket and read them at runtime.

Answer

Edit the function code to hardcode the parameters.

Answer

Include the parameters in the HTTP request body.

Question 13

You are managing a Cloud SQL for PostgreSQL instance. You need to import a SQL dump file stored in a Cloud Storage bucket. The file is 10GB. Which command should you use?

Accepted Answer

gcloud sql import sql my-instance gs://bucket/file.sql --database=db. The correct command to import a SQL dump from Cloud Storage into a Cloud SQL instance is `gcloud sql import sql --database=`. The `sql` subcommand specifies the file format, and the instance name and GCS URI are positional arguments. Option B matches this exact syntax.

Answer

Use psql command from a Compute Engine instance to connect and import the file.

Answer

gcloud sql instances import my-instance gs://bucket/file.sql --database=db

Answer

gcloud sql import csv my-instance gs://bucket/file.sql --database=db

Question 14

A developer is deploying a containerized application on Cloud Run. The application needs to be invoked by external HTTPS requests without requiring authentication. Which flag should be included in the 'gcloud run deploy' command?

Accepted Answer

--allow-unauthenticated. The `--allow-unauthenticated` flag on `gcloud run deploy` grants the Cloud Run Invoker IAM role to `allUsers`, making the service publicly callable over HTTPS without an identity token. This is the documented way to expose a Cloud Run service to unauthenticated external traffic.

Answer

--invoker=public

Answer

--ingress=internal

Answer

--no-allow-unauthenticated

Question 15

A team is using Terraform to manage infrastructure. They want to store the Terraform state file remotely in a GCS bucket for team collaboration. Which Terraform backend configuration is correct?

Accepted Answer

terraform {
  backend "gcs" {
    bucket = "my-terraform-state"
  }
}. Both options A and B are valid Terraform backend configurations for GCS. Option A uses the minimal required argument 'bucket'. Option B adds the optional 'prefix' argument to organize state files within the bucket. The 'gcs' backend supports both. Options C and D are invalid because 'storage' and 'gcloud' are not valid backend types.

Answer

terraform {
  backend "storage" {
    bucket = "my-terraform-state"
  }
}

Answer

terraform {
  backend "gcloud" {
    bucket = "my-terraform-state"
  }
}