Google ACE Ensuring Successful Operation of a Cloud Solution — 30 Questions

Question 1

You need to query logs in Cloud Logging to find errors from a specific Compute Engine instance. The instance ID is 'my-instance'. Which query language filter should you use?

Accepted Answer

resource.type="gce_instance" AND resource.labels.instance_id="my-instance" AND severity>=ERROR. For Cloud Logging queries. The `resource.type` must be `"gce_instance"` (not the full URI) and the instance ID is stored in `resource.labels.instance_id`. Using `severity>=ERROR` ensures you capture all logs with severity ERROR, CRITICAL, ALERT, or EMERGENCY. Option A uses an incorrect `resource.type` and the wrong field name for instance ID. Option B uses `severity="ERROR"` which excludes higher severity logs. Option D uses `labels.instance_id` instead of `resource.labels.instance_id`.

Answer

resource.type="compute.googleapis.com/Instance" AND instance="my-instance" AND severity="ERROR"

Answer

resource.type="gce_instance" AND resource.labels.instance_id="my-instance" AND severity="ERROR"

Answer

resource.type="gce_instance" AND labels."instance_id"="my-instance" AND severity="ERROR"

Question 2

You need to drain a GKE node for maintenance. Which THREE steps should you perform? (Select 3)

Accepted Answer

Use kubectl drain --ignore-daemonsets --delete-emptydir-data. To drain a GKE node for maintenance, first use `kubectl drain ` (Option B). This command cordons the node to prevent new pods from being scheduled and evicts existing pods. The `--ignore-daemonsets` flag is crucial as DaemonSets are designed to run on every node and would otherwise prevent the drain from completing. The `--delete-emptydir-data` flag is necessary if pods on the node use `emptyDir` volumes, as this data is local to the node and will be lost. After the node is successfully drained, you can perform the necessary maintenance or delete the node (Option D). Finally, if the node is to be reused, it must be uncordoned using `kubectl uncordon ` (Option E) to allow the scheduler to place new pods on it.

Answer

Cordon the node to prevent new pods

Answer

Use gcloud container clusters upgrade to upgrade the node

Question 3

You are deploying a new revision of a Cloud Run service. You want to gradually shift traffic from the old revision to the new one, starting with 10% traffic to the new revision. Which command should you use?

Accepted Answer

gcloud run services update-traffic my-service --to-revision new-revision --percent 10. The correct command to gradually shift traffic to a new revision in Cloud Run is 'gcloud run services update-traffic', which allows specifying the revision and percentage. This command updates the traffic allocation without redeploying the service, enabling canary deployments. The syntax '--to-revision new-revision --percent 10' correctly sets 10% of traffic to the new revision.

Answer

gcloud run revisions traffic my-service --to-revision new-revision --percent 10

Answer

gcloud run services update my-service --image gcr.io/my-project/my-image:new

Answer

gcloud run deploy my-service --image gcr.io/my-project/my-image:new --traffic new-revision=10

Question 4

You want to view recent errors from your Compute Engine instances using Cloud Logging. Which query language statement would you use in the Log Explorer?

Accepted Answer

resource.type = "gce_instance" AND severity = "ERROR". In Cloud Logging, Compute Engine instances are identified by `resource.type = "gce_instance"`. Errors are filtered using the `severity` field with the value `"ERROR"`. String values in Cloud Logging queries, such as resource types and severity levels, must be enclosed in double quotes. Option D correctly uses `resource.type = "gce_instance"` and `severity = "ERROR"`.

Answer

resource.type = "compute.googleapis.com/Instance" AND severity = "ERROR"

Answer

type = "gce_instance" AND level = "ERROR"

Answer

resource.type=gce_instance AND severity=error

Question 5

You want to create a snapshot of a persistent disk named 'my-disk' in zone us-central1-a. Which command should you use?

Accepted Answer

gcloud compute snapshots create my-snapshot --source-disk my-disk --zone us-central1-a. The correct command to create a snapshot of a persistent disk is `gcloud compute snapshots create`. You specify the snapshot name as a positional argument or with `--snapshot-name`, the source disk with `--source-disk`, and its zone with `--source-disk-zone` or `--zone` if the disk is in the same zone as the command is run from, or if it's a regional disk. Option A correctly uses `gcloud compute snapshots create` with the appropriate flags.

Answer

gcloud compute disks snapshot my-disk --snapshot-names my-snapshot --zone us-central1-a

Answer

gcloud compute images create my-snapshot --source-disk my-disk --zone us-central1-a

Answer

gcloud compute disks create-snapshot my-disk --snapshot-name my-snapshot --zone us-central1-a

Question 6

Your team wants to send Cloud Monitoring alerts to a Slack channel. You have created a Pub/Sub topic and subscription. Which notification channel type should you configure in Cloud Monitoring?

Accepted Answer

Slack. Cloud Monitoring includes a native Slack notification channel (configured with a Slack webhook). To send alerts to a Slack channel, select Slack as the notification channel type. A Pub/Sub notification channel is used when you specifically want to publish alert payloads to a Pub/Sub topic for downstream processing or custom forwarding; it is not the correct choice for direct Slack delivery simply because a Pub/Sub topic and subscription exist.

Answer

Pub/Sub

Answer

PagerDuty

Answer

Email

Question 7

You need to find all log entries from the past hour where a Compute Engine instance failed to start. Which Cloud Logging query language filter should you use?

Accepted Answer

resource.type="gce_instance" AND severity="ERROR" AND "Could not start instance" AND timestamp>="-1h". The query correctly identifies Compute Engine instances (`resource.type="gce_instance"`) with an error severity (`severity="ERROR"`). The specific phrase `"Could not start instance"` targets logs indicating a failure to start, and `timestamp>="-1h"` filters for entries within the last hour. Other options are either too broad (e.g., using just "instance" or "startup") or miss critical components like severity or time.

Answer

resource.type="gce_instance" AND severity="ERROR" AND "instance" AND timestamp>="-1h"

Answer

resource.type="gce_instance" AND "instance" AND timestamp>="-1h"

Answer

resource.type="gce_instance" AND severity="ERROR" AND "startup"

Question 8

You want to stop a Compute Engine instance to reduce costs. It will be started again in a few hours. Which command should you use?

Accepted Answer

gcloud compute instances stop. The `gcloud compute instances stop` command deallocates the instance's CPU and memory resources, stopping billing for these components while preserving the persistent disk and its data. This allows the instance to be restarted later, making it suitable for cost reduction when the instance is not needed for a period. Unlike `suspend`, `stop` does not incur charges for preserving the instance's memory state.

Answer

gcloud compute instances suspend

Answer

gcloud compute instances delete

Answer

gcloud compute instances reset

Question 9

You need to update the container image of a deployment named 'my-app' in GKE to a new version. Which command should you use?

Accepted Answer

kubectl set image deployment/my-app my-app-container=my-image:v2. The 'kubectl set image' command is the correct imperative command to update the container image of a deployment. The syntax 'kubectl set image deployment/my-app my-app-container=my-image:v2' specifies the deployment, the container name, and the new image, triggering a rolling update. This is the standard way to update an image without editing the full manifest.

Answer

kubectl apply -f updated-deployment.yaml

Answer

kubectl update deployment my-app --image=my-image:v2

Answer

kubectl edit deployment my-app --image=my-image:v2

Question 10

You are configuring a log sink to export logs to Cloud Storage for compliance. Which TWO permissions are required for the sink's destination bucket? (Choose TWO.)

Accepted Answer

storage.objectCreator. The sink's writer identity requires the `storage.objectCreator` permission to create log objects in the destination Cloud Storage bucket. The `storage.objectViewer` permission is not required for the sink to perform its export function, as its role is to write, not to view existing objects.

Answer

storage.objectViewer

Answer

storage.legacyBucketReader

Answer

storage.admin

Answer

storage.legacyBucketWriter

Question 11

You need to update a deployment in your GKE cluster from image version v1 to v2 gradually, ensuring that only a small percentage of pods run v2 initially. After the rollout, you want to verify the rollout status. Which commands should you use?

Accepted Answer

kubectl set image deployment/my-deployment my-container=gcr.io/my-project/my-image:v2 --record && kubectl rollout status deployment/my-deployment. The command 'kubectl set image deployment/my-deployment my-container=gcr.io/my-project/my-image:v2' updates the container image in the deployment, triggering a rolling update. The '--record' flag records the change for rollback. Then 'kubectl rollout status deployment/my-deployment' monitors the rollout progress until completion.

Answer

kubectl apply -f updated-deployment.yaml and kubectl rollout undo

Answer

kubectl edit deployment and kubectl rollout history

Answer

kubectl run my-deployment --image=gcr.io/my-project/my-image:v2 and kubectl get pods

Question 12

You need to split traffic between two revisions of your Cloud Run service: revision-1 (stable) should receive 90% of traffic, and revision-2 (canary) should receive 10%. Which command should you run?

Accepted Answer

gcloud run services update SERVICE --to-revisions=revision-1=90,revision-2=10. The `gcloud run services update` command, using the `--to-revisions` flag, allows you to specify traffic percentages per revision for your Cloud Run service.

Answer

gcloud run revisions update revision-2 --traffic=10

Answer

gcloud run services set-iam-policy SERVICE policy.yaml

Answer

gcloud run deploy SERVICE --image=IMAGE --no-traffic

Question 13

You are managing a GKE cluster and need to upgrade the node pool to a newer Kubernetes version. Which THREE steps should you perform as part of the upgrade process?

Accepted Answer

Upgrade the cluster control plane using gcloud container clusters upgrade. To upgrade a node pool, you typically first ensure the control plane is at the desired version (if not already upgraded), then initiate the node pool upgrade. Option A, `gcloud container clusters upgrade`, is used to upgrade the cluster control plane. Option C, `gcloud container node-pools upgrade`, is the direct command to upgrade the node pool itself. After any upgrade, it is crucial to verify the node pool status and the health of applications running on the nodes, as stated in Option D, to ensure the upgrade was successful and did not introduce issues. Option B, draining nodes manually, is generally not required as GKE's upgrade mechanisms handle pod eviction. Option E describes an alternative strategy rather than a direct upgrade step.

Answer

Drain all nodes in the node pool using kubectl drain

Answer

Create a new node pool and migrate workloads

Question 14

A DevOps team wants to be notified in Slack when a specific error log appears in Cloud Logging. They set up a log-based alert with a notification channel to a Slack webhook. However, notifications are not arriving. What is the most likely cause?

Accepted Answer

The Slack webhook URL is outdated. Cloud Monitoring supports direct Slack integration using a webhook URL as a notification channel. When notifications are not arriving, the most common cause for a configured webhook is that the URL itself is invalid, outdated, revoked by Slack, or mistyped, preventing the messages from being delivered successfully. While an incorrect log query or metric threshold (options B and C) would prevent the alert from firing, an invalid webhook URL (option D) directly addresses the failure of the notification channel to deliver messages, even if the alert condition is met.

Answer

The notification channel is not configured to use a Pub/Sub topic

Answer

The log-based alert is not using a valid metric threshold

Answer

The log query is case-sensitive and mismatched

Question 15

A Cloud Run service needs to be updated to increase CPU and memory limits. Which command should the engineer use?

Accepted Answer

gcloud run services update. 'gcloud run services update' is specifically designed to modify service-level configuration properties, such as CPU and memory limits, for an existing Cloud Run service. This command directly targets the service's configuration. 'gcloud run deploy' is primarily used for deploying a new container image or a new revision of a service; while it can also update configuration parameters, 'gcloud run services update' is the more direct and semantically appropriate command when the primary intent is to adjust existing service settings without necessarily deploying a new container image. 'gcloud functions deploy' is for Cloud Functions, not Cloud Run. 'gcloud run revisions update' does not exist, as Cloud Run revisions are immutable.

Answer

gcloud functions deploy

Answer

gcloud run deploy

Answer

gcloud run revisions update

Question 16

A GKE cluster is running a critical workload. An engineer needs to perform maintenance on a node without disrupting the pods. They plan to use 'kubectl drain'. Which additional flags are typically required to safely drain a node?

Accepted Answer

--ignore-daemonsets --delete-emptydir-data. The '--ignore-daemonsets' flag tells kubectl to ignore DaemonSet-managed pods, meaning these pods will not be evicted from the node during the drain operation. This is typically desired as DaemonSets are designed to run on specific nodes and their eviction is usually not part of a node drain. The '--delete-emptydir-data' flag allows draining nodes with pods using emptyDir volumes (data is ephemeral). Both are commonly required for safe draining.

Answer

--dry-run --now

Answer

--force --grace-period=0

Answer

--all-namespaces --selector

Question 17

Your organization runs a critical application on Compute Engine VMs. You have created a snapshot schedule, but you need to ensure that snapshots of disks attached to running instances are crash-consistent. What must you do before taking the snapshot?

Accepted Answer

Stop the VM before taking the snapshot. GCP snapshots are crash-consistent by default, even for disks attached to running instances. This means that a snapshot captures the state of the disk as if the VM instance crashed at the moment the snapshot was taken, without requiring the VM to be stopped or disk caches to be manually flushed for crash consistency. The provided explanation incorrectly states that for running instances, one 'must stop the VM or flush disk caches to ensure crash consistency.' Actions like stopping the VM or enabling guest OS features (with the --guest-flush flag) are typically used to achieve a higher level of consistency, such as application consistency, which ensures applications have flushed their buffers to disk.

Answer

Detach the disk from the instance

Answer

Enable guest OS features for the instance

Answer

Use the --no-pause flag when creating the snapshot

Question 18

A team needs to analyze application logs to find errors from the last 24 hours. The logs are stored in Cloud Logging. Which query language filters would select log entries where the severity is ERROR and the resource type is a GCE VM instance?

Accepted Answer

resource.type = 'gce_instance' AND severity = 'ERROR'. Cloud Logging query language uses field names like `resource.type` and `severity`. For exact matches, the `=` operator is used, and string values are enclosed in single quotes. Logical operators like `AND` are used to combine conditions.

Answer

resource.type:gce_instance AND severity:ERROR

Answer

resource.type == 'gce_instance' && severity == 'ERROR'

Answer

type='gce_instance' AND level='ERROR'

Question 19

You are designing a disaster recovery plan for a stateful application running on Compute Engine. You need to create crash-consistent backups of persistent disks every hour and store them in a different region for at least 30 days. Which TWO steps should you take? (Choose two.)

Accepted Answer

Copy the snapshot to a different region using gcloud compute snapshots create --source-snapshot --region. For 'crash-consistent backups of persistent disks every hour and store them in a different region for at least 30 days':

1.  **Automated Frequency and Retention**: The most appropriate step for creating backups 'every hour' and ensuring 'at least 30 days' retention is to create a snapshot schedule using `gcloud compute resource-policies` (Option D). Google Cloud persistent disk snapshots are inherently block-level crash-consistent, meaning they can be taken while the VM is running. Stopping the VM (Option A) is not required for this level of consistency and is typically done for filesystem or application consistency.

2.  **Cross-region Storage**: Snapshot schedules create snapshots in the same region as the source disk. To store these backups in a 'different region', you must copy the snapshots. This is achieved by creating a new snapshot from an existing one and specifying the desired `storage-location`. The correct command syntax for this would be `gcloud compute snapshots create NEW_SNAPSHOT_NAME --source-snapshot SOURCE_SNAPSHOT_NAME --storage-location TARGET_REGION`. Option B attempts to describe this, but its command syntax (`--region` instead of `--storage-location`) is incorrect for specifying the destination region.

Therefore, the most accurate steps to fulfill all requirements are to use a snapshot schedule (D) and then copy the snapshots to a different region (a corrected version of B).

Answer

Stop the VM before taking each snapshot

Answer

Use gcloud compute images create to create a custom image from the snapshot, then export to a different region

Answer

Use gcloud compute snapshots create with the --source-disk flag while the VM is running

Question 20

You need to drain a GKE node for maintenance without disrupting running workloads that are managed by a DaemonSet. Which TWO flags should you use with kubectl drain? (Choose two.)

Accepted Answer

--delete-emptydir-data. Option D (--ignore-daemonsets) is correct because DaemonSet-managed pods are not evicted by kubectl drain by default; without this flag, drain will refuse to proceed since it cannot evict pods that are not backed by a controller it can reschedule, so this flag lets the drain continue while leaving DaemonSet pods running on the node. Option A (--delete-emptydir-data) is correct because draining a node requires evicting pods that use emptyDir volumes, and kubectl drain will abort unless this flag is supplied to acknowledge that the emptyDir data will be permanently deleted. Option B (--grace-period=0) is not required and would force immediate termination rather than graceful eviction, which risks disruption. Option C (--disable-eviction) is wrong because it bypasses the Eviction API and deletes pods directly, which can violate PodDisruptionBudgets and disrupt workloads. Option E (--force) is not needed here; it only allows deletion of pods not managed by a controller, which is unrelated to the DaemonSet requirement.

Answer

--grace-period=0

Answer

--disable-eviction

Answer

--force