Google ACE Deploying and Implementing a Cloud Solution Practice Test 6 — 15 Questions

Question 1

A DevOps engineer is responsible for deploying a new microservice to GKE. They need to expose the service externally on a static IP address and scale based on HTTP request load. Which THREE resources must be created? (Choose 3 correct answers.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deployment. To expose a microservice externally with a static IP and load-based scaling, you typically create a Deployment, a Service of type LoadBalancer (which provisions a TCP load balancer with a static IP), and a HorizontalPodAutoscaler to scale based on CPU (or custom metrics). Ingress is not required if using LoadBalancer, but it's another option. ConfigMap is not needed for this.

Answer

Ingress

Answer

ConfigMap

Question 2

A company wants to migrate an on-premises MySQL database to Cloud SQL with minimal downtime. The database is 500 GB. Which TWO steps should be taken? (Choose 2 correct answers.)

Accepted Answer

Create a Cloud SQL instance to serve as the target for the migration.. To minimize downtime, you can perform a Database Migration Service (DMS) continuous migration or export/import with a consistent snapshot. DMS supports MySQL and provides continuous sync. Alternatively, you can export the database using mysqldump, then import, but this requires downtime. However, for minimal downtime, DMS is best. Another approach is to create a read replica then promote, but Cloud SQL does not support external read replicas directly. The correct two are: use DMS for continuous migration, and optionally create a clone for testing, but the question asks for migration steps. The best two from the options: use DMS migration job and create a Cloud SQL instance.

Answer

Export the database using gcloud sql export sql, then import to Cloud SQL.

Answer

Create a Cloud SQL instance and configure it as an external replica of the on-premises database.

Answer

Use mysqldump to backup the database and restore into Cloud SQL.

Question 3

A company wants to deploy a containerized application on Google Cloud that automatically scales to zero when not in use, and they want to minimize operational overhead. They also need to avoid managing any underlying infrastructure such as Kubernetes clusters or VMs. Which service should they use?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless platform that runs containerized applications and automatically scales to zero when there is no traffic, eliminating costs during idle periods. It abstracts away all infrastructure management, including Kubernetes clusters and VMs, so the company can focus solely on their container image. This directly satisfies the requirements of containerized deployment, scale-to-zero, and minimal operational overhead.

Answer

Google Kubernetes Engine (GKE)

Answer

App Engine Standard Environment

Answer

Compute Engine with managed instance groups

Question 4

A DevOps engineer is configuring a managed instance group (MIG) for a stateless web application. They want to ensure that when new instances are created via rolling update or autoscaling, a startup script runs to install security patches and deploy the latest application code from a Cloud Storage bucket. What is the BEST way to achieve this?

Accepted Answer

Add the script to the instance template using the metadata key 'startup-script'. The best way to ensure a startup script runs on every new instance in a MIG is to embed it in the instance template using the metadata key 'startup-script'. The template is the blueprint for all instances created by the MIG, so any instance launched by autoscaling or rolling update automatically executes the script on boot.

Answer

Create a custom image with pre-installed patches and code, and use that image in the template

Answer

After the MIG is created, use gcloud compute ssh to run the script on each instance

Answer

Store the script in Cloud Storage and use gcloud compute instances add-metadata on each instance

Question 5

A developer needs to create a zonal GKE cluster with 3 nodes of type e2-standard-4 in zone us-central1-a. Which command should they use?

Accepted Answer

gcloud container clusters create my-cluster --zone=us-central1-a --num-nodes=3 --machine-type=e2-standard-4. The correct command creates a zonal cluster (single zone) with specified node count and machine type. The --region flag creates a regional cluster, which is not required.

Answer

gcloud compute instances create my-cluster --zone=us-central1-a --machine-type=e2-standard-4 --num-nodes=3

Answer

gcloud container clusters create my-cluster --zone=us-central1-a --num-nodes=1 --machine-type=e2-standard-4

Answer

gcloud container clusters create my-cluster --region=us-central1 --num-nodes=3 --machine-type=e2-standard-4

Question 6

After deploying a Kubernetes Deployment named 'web-app', a developer wants to expose it externally on a static IP address. Which kubectl command should they use?

Accepted Answer

kubectl expose deployment web-app --type=LoadBalancer --port=80 --target-port=8080. The `kubectl expose deployment` command creates a Service from an existing Deployment, and `--type=LoadBalancer` provisions an external load balancer with a stable, externally reachable IP (on GKE, a Google Cloud network load balancer). The `--port=80` sets the Service port and `--target-port=8080` maps traffic to the container's listening port, which is exactly what's needed to expose the app externally on a static IP.

Answer

kubectl create service clusterip web-app --tcp=80:8080

Answer

gcloud compute forwarding-rules create web-app --port=80

Answer

kubectl expose deployment web-app --type=NodePort --port=80

Question 7

A team is deploying a microservice to Cloud Run that needs to process messages from Pub/Sub. The service should only be invocable by Pub/Sub push deliveries, not by unauthenticated HTTP requests. What should the team do?

Accepted Answer

Deploy with --no-allow-unauthenticated and configure the Pub/Sub subscription to use a service account that has the roles/run.invoker role on the Cloud Run service. Deploying Cloud Run with `--no-allow-unauthenticated` enforces IAM authentication on the service, and configuring the Pub/Sub push subscription to use a service account with `roles/run.invoker` on that service lets Pub/Sub present a valid OIDC token that Cloud Run accepts. This ensures only Pub/Sub push deliveries can invoke the service.

Answer

Deploy with --allow-unauthenticated and set up a Pub/Sub subscription with OIDC token audience

Answer

Deploy with --no-allow-unauthenticated and create a VPC connector to allow Pub/Sub internal traffic

Answer

Use Cloud Functions instead, which is more secure for Pub/Sub triggers

Question 8

You want to deploy a Cloud Function triggered by HTTP requests. The function is written in Node.js and the entry point function is named 'helloHttp'. Which command should you use?

Accepted Answer

gcloud functions deploy my-function --runtime nodejs16 --trigger-http --entry-point=helloHttp --region=us-central1. The correct command uses `gcloud functions deploy` with the required positional NAME argument (`my-function`), specifies `--runtime nodejs16`, uses `--trigger-http` for an HTTP-triggered function, and sets `--entry-point=helloHttp` to match the exported Node.js function name. The `--region` flag is also valid and commonly required for deterministic deployment. This combination satisfies all requirements stated in the question.

Answer

gcloud functions deploy --source . --runtime nodejs16 --trigger-http --entry-point=helloHttp

Answer

gcloud run deploy my-function --source . --runtime nodejs16 --entry-point=helloHttp

Answer

gcloud functions deploy my-function --runtime nodejs16 --trigger-topic my-topic --entry-point=helloHttp

Question 9

A company wants to migrate an on-premises MySQL database to Cloud SQL. They need to import an existing SQL dump file stored in a Cloud Storage bucket. Which command should they use?

Accepted Answer

gcloud sql import sql my-instance gs://my-bucket/dump.sql --database=mydb. The correct command is gcloud sql import sql, which imports a SQL dump file from a Cloud Storage bucket into a Cloud SQL instance. It requires the instance name, the gs:// URI, and optionally --database to specify the target database.

Answer

gcloud compute ssh my-instance --command='mysql < dump.sql'

Answer

gcloud sql databases create mydb --instance=my-instance --import=gs://my-bucket/dump.sql

Answer

gsutil cp gs://my-bucket/dump.sql | mysql -h my-instance -u root -p

Question 10

An engineer is using Terraform to manage GCP resources. They want to store the Terraform state file remotely so that the team can collaborate. Which backend configuration should they use?

Accepted Answer

backend "gcs" { bucket = "my-terraform-state" }. Terraform supports storing state in GCS by using the 'gcs' backend. The bucket must be created before configuration. The 'local' backend stores state locally, which does not enable collaboration. 'cloud' is not a valid backend type. 'consul' is not GCP-native.

Answer

backend "cloud" { bucket = "my-terraform-state" }

Answer

backend "local" { path = "terraform.tfstate" }

Answer

backend "consul" { address = "consul.example.com" }

Question 11

A company is deploying a microservice on Cloud Run. They want to ensure that the service can handle high traffic spikes by allowing multiple concurrent requests per container instance. They also want to minimize cold starts. Which two settings should they configure? (Choose two.)

Accepted Answer

Set min-instances to a value greater than 0 (e.g., 1). Setting concurrency to a higher value (e.g., 80) allows each container instance to handle multiple requests simultaneously, improving throughput. Setting min-instances to a value greater than 0 keeps instances warm to reduce cold starts. Max-instances limits scaling but does not help with cold starts. CPU always on keeps CPU allocated but does not directly affect cold starts. Timeout affects request duration, not concurrency or cold starts.

Answer

Set the timeout to 900 seconds

Answer

Set CPU always on to true

Answer

Set max-instances to a high value

Question 12

A DevOps engineer is creating a GKE cluster for a production workload that requires high availability and resilience to zone failures. They also need to deploy a stateless application that can scale based on CPU usage. Which two actions should they take? (Choose two.)

Accepted Answer

Enable horizontal pod autoscaling on the deployment with CPU target utilization. Option E is correct because a regional GKE cluster spreads its control plane and node pools across multiple zones within a region, which provides resilience to zone failures and satisfies the high-availability requirement. Option D is correct because a Horizontal Pod Autoscaler (HPA) targeting CPU utilization automatically adjusts the number of pod replicas based on observed CPU usage, which is exactly what the stateless application needs to scale. Option A is not required for the stated goals: node auto-repair only restarts unhealthy nodes and does not by itself provide zone-failure resilience or CPU-based scaling. Option B is wrong because a zonal cluster in a single zone is a single point of failure and cannot survive a zone outage. Option C is wrong because setting replicas to 1 prevents scaling and creates a single point of failure for the stateless workload.

Answer

Enable node auto-repair on the node pool

Answer

Create a zonal cluster in a single zone

Answer

Set the deployment replicas to 1

Question 13

A developer needs to create a Compute Engine VM with 4 vCPUs, 15 GB of memory, and a Debian 10 boot disk. Which gcloud compute instances create command is correct?

Accepted Answer

gcloud compute instances create my-vm --machine-type=n1-standard-4 --image-family=debian-10 --image-project=debian-cloud. The `n1-standard-4` machine type provides exactly 4 vCPUs and 15 GB of memory, matching the requirement. Combined with `--image-family=debian-10` and `--image-project=debian-cloud`, this command creates a Debian 10 VM with the correct specs. The `n1-standard` family is the general-purpose line with a 1:3.75 vCPU-to-memory ratio.

Answer

gcloud compute instances create my-vm --machine-type=n1-highmem-4 --image-family=debian-10 --image-project=debian-cloud

Answer

gcloud compute instances create my-vm --machine-type=n1-standard-4 --image-family=ubuntu-1804 --image-project=ubuntu-os-cloud

Answer

gcloud compute instances create my-vm --machine-type=n1-standard-4

Question 14

An organization wants to deploy a containerized web application on Google Cloud with minimum operational overhead. The application should scale to zero when not in use and only incur costs when serving requests. Which service should they choose?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless container platform that scales to zero when there is no traffic and charges only for resources consumed during request handling. It abstracts away cluster management, making it the lowest-operational-overhead choice for a containerized web app that must scale to zero.

Answer

App Engine Flexible Environment

Answer

Google Kubernetes Engine (GKE)

Answer

Compute Engine with container-optimized OS

Question 15

A DevOps engineer needs to deploy a containerized microservice to Cloud Run that processes messages from Pub/Sub. The service must authenticate to Google Cloud APIs using a service account. Which Cloud Run deployment command should they use to ensure the service uses a specific service account?

Accepted Answer

gcloud run deploy my-service --image gcr.io/my-project/my-image --service-account my-sa@my-project.iam.gserviceaccount.com --platform managed. Cloud Run supports the --service-account flag to attach a specific service account. The --image flag specifies the container image. The other options either use incorrect flags (--account is for gcloud CLI user, not service account) or miss required flags.

Answer

gcloud run deploy my-service --image gcr.io/my-project/my-image --account my-sa@my-project.iam.gserviceaccount.com

Answer

gcloud run deploy my-service --image gcr.io/my-project/my-image --impersonate-service-account my-sa@my-project.iam.gserviceaccount.com

Answer

gcloud run deploy my-service --image gcr.io/my-project/my-image