Google ACE Deploying and Implementing a Cloud Solution Practice Test 4 — 15 Questions

Question 1

A developer wants to deploy a containerized application to Cloud Run that should be publicly accessible over the internet. The container image is stored in Container Registry. Which gcloud command should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

gcloud run deploy my-service --image gcr.io/my-project/my-image --region us-central1 --platform managed --allow-unauthenticated. The correct command is B: 'gcloud run deploy my-service --image gcr.io/my-project/my-image --region us-central1 --platform managed --allow-unauthenticated'. Option A uses '--platform cloud-run', which is invalid for Cloud Run (should be 'managed'). Option C uses '--platform gke', which deploys to GKE, not Cloud Run. Option D omits '--allow-unauthenticated', so the service would not be publicly accessible.

Answer

gcloud run deploy my-service --image gcr.io/my-project/my-image --region us-central1 --platform cloud-run --allow-unauthenticated

Answer

gcloud run deploy my-service --image gcr.io/my-project/my-image --region us-central1 --platform gke --allow-unauthenticated

Answer

gcloud run deploy my-service --image gcr.io/my-project/my-image --region us-central1 --platform managed

Question 2

A team is using Terraform to manage Google Cloud resources. They want to store the Terraform state file in a Cloud Storage bucket with versioning enabled. Which backend configuration should they use?

Accepted Answer

terraform {
  backend "gcs" {
    bucket = "my-terraform-state-bucket"
    prefix = "terraform/state"
  }
}. The correct backend for Terraform with Google Cloud Storage is 'gcs'. Option B correctly uses 'gcs' with the bucket name (without 'gs://') and a prefix. Option A uses 'cloud', which is not a valid Terraform backend. Option C includes 'gs://' in the bucket name, which is incorrect. Option D uses 'remote' for Terraform Cloud, not for Google Cloud Storage.

Answer

terraform {
  backend "cloud" {
    bucket = "my-terraform-state-bucket"
    prefix = "terraform/state"
  }
}

Answer

terraform {
  backend "gcs" {
    bucket = "gs://my-terraform-state-bucket"
    prefix = "terraform/state"
  }
}

Answer

terraform {
  backend "remote" {
    hostname = "app.terraform.io"
    organization = "my-org"
    workspaces { name = "my-workspace" }
  }
}

Question 3

An organization needs to deploy a Cloud Function that processes messages from a Pub/Sub topic and writes results to BigQuery. The function must be triggered by every message published to the topic. Which deployment command is correct?

Accepted Answer

gcloud functions deploy process-messages --runtime python310 --trigger-topic my-topic --entry-point process --region us-central1 --memory 256MB. The correct command uses --trigger-topic my-topic, runtime python310, entry point process, region us-central1, and memory 256MB. Option B is correct because it includes all required parameters. Option A is incorrect because it uses --trigger-http instead of --trigger-topic. Option C is incorrect because it omits the --memory parameter, which is required for Cloud Functions (2nd gen) or recommended for consistent performance. Option D is incorrect because it uses runtime nodejs18, but the function is written in Python as indicated by the entry point and typical exam context.

Answer

gcloud functions deploy process-messages --runtime python310 --trigger-http --entry-point process --region us-central1 --memory 256MB

Answer

gcloud functions deploy process-messages --runtime python310 --trigger-topic my-topic --entry-point process --region us-central1

Answer

gcloud functions deploy process-messages --runtime nodejs18 --trigger-topic my-topic --entry-point process --region us-central1 --memory 256MB

Question 4

A developer needs to upload a large number of files from their local machine to a Cloud Storage bucket. Which command should they use?

Accepted Answer

gsutil cp /local/dir/* gs://my-bucket/. The correct command to upload files to a Cloud Storage bucket is `gsutil cp`. Option B is correct. Option A (`gcloud storage ls`) lists objects in a bucket, not uploads. Option C (`gcloud storage buckets create`) creates a new bucket. Option D (`gsutil rsync -r`) synchronizes directories, which is more complex and not necessary for a simple upload of a large number of files; `gsutil cp` is the standard upload command.

Answer

gcloud storage ls gs://my-bucket

Answer

gcloud storage buckets create gs://my-bucket

Answer

gsutil rsync -r /local/dir gs://my-bucket/

Question 5

A DevOps engineer needs to create a GKE cluster with 3 nodes per zone in us-central1-a and us-central1-b, with nodes of type e2-standard-2. The cluster should be regional. Which command is correct?

Accepted Answer

gcloud container clusters create my-cluster --region us-central1 --node-locations us-central1-a,us-central1-b --num-nodes 3 --machine-type e2-standard-2. The correct command uses --region to create a regional cluster, --node-locations to specify the zones, --num-nodes to set nodes per zone, and --machine-type for the node type. Option A meets all requirements. Option B is missing --node-locations and --num-nodes, so it creates a cluster with default nodes per zone (usually 3, but not explicit) and only in the region's default zones. Option C incorrectly combines --zone and --region; --zone is for zonal clusters. Option D creates a zonal cluster (only in one zone) with --zone.

Answer

gcloud container clusters create my-cluster --region us-central1 --machine-type e2-standard-2

Answer

gcloud container clusters create my-cluster --zone us-central1-a --region us-central1 --num-nodes 3 --machine-type e2-standard-2

Answer

gcloud container clusters create my-cluster --zone us-central1-a --num-nodes 3 --machine-type e2-standard-2

Question 6

An organization needs to import a SQL dump file from a Cloud Storage bucket into an existing Cloud SQL for PostgreSQL instance. Which command should they use?

Accepted Answer

gcloud sql import sql my-instance gs://bucket/dump.sql --database=mydb. The correct command is `gcloud sql import sql`. Option B is correct because it uses the proper subcommand (`import sql`) and specifies the database name with `--database=mydb`. Option A is for exporting, not importing. Option C uses an incorrect subcommand (`instances import` does not exist). Option D is for importing CSV files, not SQL dumps.

Answer

gcloud sql export sql my-instance gs://bucket/dump.sql

Answer

gcloud sql instances import my-instance gs://bucket/dump.sql

Answer

gcloud sql import csv my-instance gs://bucket/dump.sql --database=mydb

Question 7

A company runs a web application on Compute Engine instances behind a load balancer. They want to automatically scale the number of instances based on CPU utilization. Which two resources must they create? (Choose TWO.)

Accepted Answer

Managed instance group (MIG) with autoscaling policy. To auto-scale Compute Engine instances based on CPU utilization, you need an instance template (E) to define the VM configuration and a managed instance group (MIG) with an autoscaling policy (C). The instance template specifies the machine type, boot disk, and other settings, while the MIG manages the instances and scales them based on the defined policy. The other options are not relevant: Cloud Storage bucket (A) is for object storage, Cloud SQL instance (B) is for managed databases, and Cloud Function (D) is serverless compute.

Answer

Cloud Storage bucket

Answer

Cloud SQL instance

Answer

Cloud Function

Question 8

A developer wants to deploy a containerized application to GKE and expose it externally via a load balancer. Which three kubectl commands are needed? (Choose THREE.)

Accepted Answer

kubectl create deployment my-app --image=gcr.io/my-project/my-app. To deploy a containerized application to GKE and expose it externally via a load balancer, you need to create a deployment, expose it as a LoadBalancer service, and verify the external IP. Option B (`kubectl create deployment`) creates the deployment. Option C (`kubectl expose deployment --type=LoadBalancer`) creates a service of type LoadBalancer. Option E (`kubectl get service`) is used to retrieve the external IP assigned to the service. Option A (`kubectl autoscale`) configures horizontal pod autoscaling, which is not required for basic deployment and exposure. Option D (`kubectl run`) creates a pod directly rather than a deployment, which is not the recommended approach for managing containerized applications. Therefore, the correct three commands are B, C, and E.

Answer

kubectl autoscale deployment my-app --cpu-percent=50 --min=1 --max=10

Answer

kubectl run my-app --image=gcr.io/my-project/my-app

Question 9

An engineer needs to create a Cloud Storage bucket for storing sensitive financial data that must be encrypted at rest using a customer-managed encryption key (CMEK) stored in Cloud KMS. Which three actions are required? (Choose THREE.)

Accepted Answer

Use gcloud storage buckets create with --encryption-key flag pointing to the KMS key.. To use CMEK for Cloud Storage, you must first create a key ring and cryptographic key in Cloud KMS (Option B). Then, grant the Cloud Storage service account the Cloud KMS CryptoKey Encrypter/Decrypter role (Option D) to allow Cloud Storage to use the key. Finally, when creating the bucket, use the gcloud storage buckets create command with the --encryption-key flag pointing to that key (Option A). Option C is incorrect because gsutil mb does not support CMEK. Option E sets default encryption on an existing bucket, not CMEK.

Answer

Use gsutil mb -o default_encryption_key=...

Answer

Set default encryption on the bucket using gsutil defaulte encryption set.

Question 10

A DevOps engineer is setting up a CI/CD pipeline that deploys a containerized application to Cloud Run. The application source code is in a Cloud Source Repository. Which three steps are required to deploy from source? (Choose THREE.)

Accepted Answer

Use gcloud run deploy with the --source flag pointing to the source code.. To deploy from source to Cloud Run, you can use Cloud Build to build the container image from source (option E), push it to Container Registry (option C), and then deploy using gcloud run deploy with the --source flag (option B). Option A is incorrect because Cloud Run is serverless and does not require a GKE cluster. Option D is for deploying from an existing image, not from source.

Answer

Create a GKE cluster to host the application.

Answer

Use gcloud run deploy --image to deploy the container image.

Question 11

A company has a Cloud SQL for MySQL instance that needs to be replicated to a different region for disaster recovery. Which two actions should they take? (Choose TWO.)

Accepted Answer

Create a read replica of the primary instance in the target region.. To replicate a Cloud SQL for MySQL instance to a different region for disaster recovery, you should create a read replica of the primary instance in the target region (option C). During a disaster, you can promote the read replica to become the new primary instance (option D). Option A (configure an external replica) is not a supported feature for Cloud SQL. Option B (enable binary logging) is necessary for MySQL replication but not a sufficient action on its own; it's a prerequisite, not an action to set up cross-region replication. Option E (failover replica in same zone) does not provide cross-region failover.

Answer

Configure an external replica from the primary instance.

Answer

Enable binary logging on the primary instance.

Answer

Set up a failover replica in the same zone.

Question 12

An engineer needs to create a Compute Engine VM instance with the following specifications: 4 vCPUs, 16 GB memory, running the latest Debian 11 image, a 50 GB boot disk, and attached to a specific subnet. Which command should be used?

Accepted Answer

gcloud compute instances create my-vm --machine-type=n1-standard-4 --image-family=debian-11 --image-project=debian-cloud --boot-disk-size=50GB --subnet=my-subnet --zone=us-central1-a. Includes all required flags: --machine-type (n1-standard-4 for 4 vCPUs and 16 GB memory), --image-family and --image-project (debian-11 and debian-cloud for latest Debian 11), --boot-disk-size=50GB, --subnet to attach to a specific subnet, and --zone (required when specifying a subnet). Option B is missing --zone, which is required for subnet attachment. Option C uses --machine-type=custom-4-16384, which is incorrect; custom machine types require --custom-cpu and --custom-memory flags. Option D uses --image-project=debian, which is incorrect; the correct project is debian-cloud.

Answer

gcloud compute instances create my-vm --machine-type=n1-standard-4 --image-family=debian-11 --image-project=debian-cloud --boot-disk-size=50GB --subnet=my-subnet

Answer

gcloud compute instances create my-vm --machine-type=custom-4-16384 --image-family=debian-11 --image-project=debian-cloud --boot-disk-size=50GB --subnet=my-subnet --zone=us-central1-a

Answer

gcloud compute instances create my-vm --machine-type=n1-standard-4 --image-family=debian-11 --image-project=debian --boot-disk-size=50GB --subnet=my-subnet --zone=us-central1-a

Question 13

An organization wants to migrate on-premises databases to Cloud SQL. They have a PostgreSQL database and a MySQL database. They require high availability with automatic failover and regional resilience. Which THREE steps should they take?

Accepted Answer

Use gcloud sql import sql to import data into the Cloud SQL instances after creation. To achieve high availability with automatic failover and regional resilience, create Cloud SQL instances in HA configuration using the --availability-type=regional flag. Option C correctly creates a MySQL instance with --availability-type=regional and --database-version=MYSQL_8_0, enabling regional HA. Option D correctly creates a PostgreSQL instance with --availability-type=regional and --database-version=POSTGRES_15. Option A is correct for importing data using gcloud sql import sql. Option B is incorrect because it uses a standard tier (db-standard-1) that does not support HA and lacks the --availability-type=regional flag. Option E is incorrect because it specifies --zone and --secondary-zone without --availability-type=regional, so it does not enable HA.

Answer

Create a Cloud SQL instance for MySQL with --tier=db-standard-1 and --zone=us-central1-a

Answer

Create a Cloud SQL instance for PostgreSQL with --zone=us-central1-a and --secondary-zone=us-central1-c

Question 14

You have a managed instance group (MIG) with instances that need to run a startup script to configure monitoring agents. You created the instance template without a startup script. Which action should you take to add the startup script?

Accepted Answer

Create a new instance template with the startup script, then update the MIG to use the new template via a rolling update.. Instance templates are immutable; you cannot modify them. You must create a new instance template with the startup script and update the MIG to use it via rolling update or by setting the template.

Answer

Use gcloud compute instances add-metadata to add the startup script to each running instance.

Answer

Delete the MIG and recreate it with a new template; you cannot change the template of an existing MIG.

Answer

Edit the existing instance template and add the startup script under 'metadata'.

Question 15

You deployed a Cloud Run service with gcloud run deploy --image gcr.io/my-project/my-image --platform managed --region us-central1 --allow-unauthenticated. Users report intermittent 503 errors. What is the most likely cause?

Accepted Answer

The service is hitting the maximum number of concurrent requests per container instance (default 80) and needs more instances.. Cloud Run services have a default maximum number of concurrent requests per container instance (default 80). If traffic exceeds that, new instances are created, but if there is a sudden spike or the container takes too long to start, requests may be dropped with 503. Increasing max instances or concurrency settings can help.

Answer

The region us-central1 does not support Cloud Run.

Answer

The container image is not compatible with the managed platform.

Answer

The --allow-unauthenticated flag causes IAM permission errors.