Google ACE Deploying and Implementing a Cloud Solution Practice Test 5 — 15 Questions

Question 1

You are managing a Cloud Functions deployment that processes messages from a Pub/Sub topic. You need to ensure the function can read messages from the topic and acknowledge them. Which IAM role should you assign to the function's service account?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

roles/pubsub.subscriber. The Pub/Sub Subscriber role (roles/pubsub.subscriber) grants permission to pull messages and acknowledge them. The function's service account needs this role on the topic or subscription.

Answer

roles/pubsub.publisher

Answer

roles/pubsub.viewer

Answer

roles/iam.serviceAccountUser

Question 2

You need to deploy an application that requires a regional MySQL database with automated backups, high availability, and failover. You also need to store static assets that are publicly accessible. Which TWO Google Cloud services should you use?

Accepted Answer

Cloud SQL (MySQL). Cloud SQL with MySQL provides managed MySQL with high availability (regional) and automated backups. Cloud Storage can host static assets publicly.

Answer

Bigtable

Answer

Cloud Filestore

Answer

Cloud Spanner

Question 3

You need to allow SSH access to a Compute Engine instance. Which method is the recommended way to manage SSH keys for multiple users?

Accepted Answer

Enable OS Login and assign IAM roles to users.. OS Login is the recommended method for managing SSH access to Compute Engine instances, as it links SSH keys to user accounts and integrates with IAM.

Answer

Add SSH keys to the instance metadata.

Answer

Use gcloud compute ssh with the --ssh-key-file flag.

Answer

Create a custom image with preconfigured SSH keys.

Question 4

You are deploying a high-traffic web application on GKE. You need to automatically scale the number of pods based on CPU utilization. Which THREE steps are required to set up Horizontal Pod Autoscaling (HPA)?

Accepted Answer

Install the metrics-server in the cluster.. To use HPA, you need a deployment (or other scalable resource), you need to apply the HPA resource (e.g., via kubectl autoscale), and you must have metrics-server installed to provide metrics. Creating a service is optional.

Answer

Enable Stackdriver Monitoring for the cluster.

Answer

Expose the Deployment as a Service of type LoadBalancer.

Question 5

A developer is deploying a containerized application on Cloud Run. The application needs to be invoked by external HTTPS requests without requiring authentication. Which flag should be included in the 'gcloud run deploy' command?

Accepted Answer

--allow-unauthenticated. The --allow-unauthenticated flag makes the Cloud Run service publicly accessible. By default, Cloud Run requires authentication via IAM. Adding this flag grants the 'run.invoker' role to allUsers.

Answer

--invoker=public

Answer

--ingress=internal

Answer

--no-allow-unauthenticated

Question 6

A Cloud Function needs to be triggered whenever a message is published to a Pub/Sub topic. Which 'gcloud functions deploy' command flag is required to set the trigger?

Accepted Answer

--trigger-topic. The --trigger-topic flag configures a Cloud Function to be triggered by Pub/Sub messages.

Answer

--trigger-http

Answer

--trigger-event

Answer

--trigger-bucket

Question 7

An organization has strict security policies requiring that all Compute Engine instances use OS Login for SSH access instead of metadata-based SSH keys. Which two actions must be taken to enforce this for all new instances? (Choose two.)

Accepted Answer

Remove all SSH keys from project metadata. To enforce OS Login, you enable it at the project level project-wide (enabled by a specific metadata key) and ensure instances have no metadata-based SSH keys. The other options are incorrect.

Answer

Use 'gcloud compute ssh' with the --tunnel-through-iap flag

Answer

Set metadata 'enable-oslogin=FALSE' at the instance level

Answer

Set metadata 'block-project-ssh-keys=TRUE' at the instance level

Question 8

A company wants to deploy a microservice on GKE. The deployment requires 3 replicas, and the service must be accessible via a fixed public IP address. Which Kubernetes resource should be used to expose the deployment?

Accepted Answer

Service of type LoadBalancer. A LoadBalancer service provisions a Google Cloud TCP/UDP Load Balancer with a public IP. NodePort exposes on node ports but not a fixed IP. ClusterIP is internal only. Ingress is a more advanced option but not the simplest for a fixed IP.

Answer

Ingress resource

Answer

Service of type ClusterIP

Answer

Service of type NodePort

Question 9

Which gcloud command creates a regional GKE cluster named 'my-cluster' with 3 nodes per zone in the 'us-central1' region?

Accepted Answer

gcloud container clusters create my-cluster --region us-central1 --num-nodes 3. To create a regional cluster, use --region (not --zone). The --num-nodes flag sets nodes per zone.

Answer

gcloud container clusters create my-cluster --zone us-central1 --num-nodes 3

Answer

gcloud container clusters create my-cluster --zone us-central1-a --num-nodes 3

Answer

gcloud container clusters create my-cluster --region us-central1 --nodes 3

Question 10

An engineer needs to migrate a large on-premises database to Cloud SQL for PostgreSQL. The database is 500 GB and can tolerate a few hours of downtime. The migration must minimize manual intervention. Which approach should the engineer use?

Accepted Answer

Use Database Migration Service (DMS). Database Migration Service supports homogeneous migrations (including PostgreSQL to Cloud SQL) and automates the process. It supports continuous replication and minimal downtime. The others are not ideal: pg_dump requires manual steps and downtime; gcloud sql import is for file import; Compute Engine with pg_dump involves manual steps.

Answer

Use pg_dump to export and pg_restore to import

Answer

Use gcloud sql import to import a dump file

Answer

Set up a Compute Engine instance to run pg_dump and then gcloud sql import

Question 11

A developer is using Cloud Functions with HTTP trigger. The function needs to process a request payload and return a response. What is the correct way to send a JSON response from the function?

Accepted Answer

res.send({ 'status': 'ok' }). In Cloud Functions (Node.js runtime), the response is sent via the res (response) object. The correct method is res.send() or res.json(). res.send() can send JSON directly.

Answer

response.end(JSON.stringify({ 'status': 'ok' }))

Answer

return { 'status': 'ok' }

Answer

context.done(null, { 'status': 'ok' })

Question 12

An organization wants to use Cloud Storage to host a static website. The bucket name must match the domain name. They already own the domain 'example.com' and want to serve the site from 'www.example.com'. Which bucket name should they create?

Accepted Answer

www.example.com. To host a website with a custom domain using Cloud Storage, you must use a bucket name that matches the domain (or subdomain). For 'www.example.com', the bucket must be named 'www.example.com'. For the apex domain, it would be 'example.com'.

Answer

example.com

Answer

www_example_com

Answer

example-com-bucket

Question 13

Which kubectl command is used to view the logs of a specific pod named 'my-pod'?

Accepted Answer

kubectl logs my-pod. The 'kubectl logs' command streams logs from a pod. 'kubectl describe' shows metadata, 'kubectl get' shows status, and 'kubectl exec' runs commands inside the pod.

Answer

kubectl exec my-pod -- logs

Answer

kubectl get pod my-pod

Answer

kubectl describe pod my-pod

Question 14

A team is deploying a web application on Cloud Run. The application needs to be available globally with low latency, and the team wants to use a custom domain with an SSL certificate. Which TWO actions are required to achieve this?

Accepted Answer

Configure a custom domain mapping on the Cloud Run service. Cloud Run services are regional; to serve globally, you need a global load balancer (e.g., using an external HTTPS load balancer with serverless NEG). Mapping a custom domain to the service is also required.

Answer

Set the --ingress=all flag on the Cloud Run service

Answer

Use Cloud CDN to cache content

Answer

Deploy the service as a Cloud Run for Anthos on GKE

Question 15

An engineer needs to allow an external IP address (203.0.113.5) to access a Compute Engine instance that only has an internal IP. The instance is in a VPC with Cloud NAT. Which TWO steps are necessary to enable this access?

Accepted Answer

Grant the user the roles/iap.tunnelResourceAccessor IAM role on the instance. To access an internal-only instance from the internet, you need an IAP TCP forwarding tunnel (gcloud compute start-iap-tunnel) and the appropriate IAM role (roles/iap.tunnelResourceAccessor) to use IAP. Alternatively, you could use a bastion host, but IAP is cleaner.

Answer

Set a firewall rule allowing ingress from the IP 203.0.113.5 to port 22

Answer

Modify the Cloud NAT to allow the external IP

Answer

Assign a public IP to the instance