Google ACE Ensuring Successful Operation of a Cloud Solution — 50 Questions

Question 1

You have a BigQuery table with billions of rows. You need to create a new table with the same schema and copy all data from the original table. Which approach is most efficient?

Accepted Answer

Use bq cp (copy) command.. (bq cp) is the most efficient method because it copies the table entirely within BigQuery's backend, avoiding any data egress or transformation. It is a fast, server-side operation. Option C (bq query with destination table) also works but is less efficient as it triggers a full table scan (reading all rows) and rewrites the data, which can incur query costs and take longer for large tables. Option A is inefficient due to row-by-row inserts, and Option B requires an unnecessary export/load cycle to Cloud Storage.

Answer

Use bq load with an empty file to create the table, then insert data row by row.

Answer

Export the original table to Cloud Storage as Avro, then load into the new table.

Answer

Use bq query --destination_table mydataset.newtable 'SELECT * FROM mydataset.original'

Question 2

You need to query logs in Cloud Logging to find errors from a specific Compute Engine instance. The instance ID is 'my-instance'. Which query language filter should you use?

Accepted Answer

resource.type="gce_instance" AND resource.labels.instance_id="my-instance" AND severity>=ERROR. For Cloud Logging queries. The `resource.type` must be `"gce_instance"` (not the full URI) and the instance ID is stored in `resource.labels.instance_id`. Using `severity>=ERROR` ensures you capture all logs with severity ERROR, CRITICAL, ALERT, or EMERGENCY. Option A uses an incorrect `resource.type` and the wrong field name for instance ID. Option B uses `severity="ERROR"` which excludes higher severity logs. Option D uses `labels.instance_id` instead of `resource.labels.instance_id`.

Answer

resource.type="compute.googleapis.com/Instance" AND instance="my-instance" AND severity="ERROR"

Answer

resource.type="gce_instance" AND resource.labels.instance_id="my-instance" AND severity="ERROR"

Answer

resource.type="gce_instance" AND labels."instance_id"="my-instance" AND severity="ERROR"

Question 3

You need to drain a GKE node for maintenance. Which THREE steps should you perform? (Select 3)

Accepted Answer

Use kubectl drain --ignore-daemonsets --delete-emptydir-data. To drain a GKE node for maintenance, first use `kubectl drain ` (Option B). This command cordons the node to prevent new pods from being scheduled and evicts existing pods. The `--ignore-daemonsets` flag is crucial as DaemonSets are designed to run on every node and would otherwise prevent the drain from completing. The `--delete-emptydir-data` flag is necessary if pods on the node use `emptyDir` volumes, as this data is local to the node and will be lost. After the node is successfully drained, you can perform the necessary maintenance or delete the node (Option D). Finally, if the node is to be reused, it must be uncordoned using `kubectl uncordon ` (Option E) to allow the scheduler to place new pods on it.

Answer

Cordon the node to prevent new pods

Answer

Use gcloud container clusters upgrade to upgrade the node

Question 4

You want to view recent errors from your Compute Engine instances using Cloud Logging. Which query language statement would you use in the Log Explorer?

Accepted Answer

resource.type = "gce_instance" AND severity = "ERROR". In Cloud Logging, Compute Engine instances are identified by `resource.type = "gce_instance"`. Errors are filtered using the `severity` field with the value `"ERROR"`. String values in Cloud Logging queries, such as resource types and severity levels, must be enclosed in double quotes. Option D correctly uses `resource.type = "gce_instance"` and `severity = "ERROR"`.

Answer

resource.type = "compute.googleapis.com/Instance" AND severity = "ERROR"

Answer

type = "gce_instance" AND level = "ERROR"

Answer

resource.type=gce_instance AND severity=error

Question 5

You want to create a snapshot of a persistent disk named 'my-disk' in zone us-central1-a. Which command should you use?

Accepted Answer

gcloud compute snapshots create my-snapshot --source-disk my-disk --zone us-central1-a. The correct command to create a snapshot of a persistent disk is `gcloud compute snapshots create`. You specify the snapshot name as a positional argument or with `--snapshot-name`, the source disk with `--source-disk`, and its zone with `--source-disk-zone` or `--zone` if the disk is in the same zone as the command is run from, or if it's a regional disk. Option A correctly uses `gcloud compute snapshots create` with the appropriate flags.

Answer

gcloud compute disks snapshot my-disk --snapshot-names my-snapshot --zone us-central1-a

Answer

gcloud compute images create my-snapshot --source-disk my-disk --zone us-central1-a

Answer

gcloud compute disks create-snapshot my-disk --snapshot-name my-snapshot --zone us-central1-a

Question 6

You need to find all log entries from the past hour where a Compute Engine instance failed to start. Which Cloud Logging query language filter should you use?

Accepted Answer

resource.type="gce_instance" AND severity="ERROR" AND "Could not start instance" AND timestamp>="-1h". The query correctly identifies Compute Engine instances (`resource.type="gce_instance"`) with an error severity (`severity="ERROR"`). The specific phrase `"Could not start instance"` targets logs indicating a failure to start, and `timestamp>="-1h"` filters for entries within the last hour. Other options are either too broad (e.g., using just "instance" or "startup") or miss critical components like severity or time.

Answer

resource.type="gce_instance" AND severity="ERROR" AND "instance" AND timestamp>="-1h"

Answer

resource.type="gce_instance" AND "instance" AND timestamp>="-1h"

Answer

resource.type="gce_instance" AND severity="ERROR" AND "startup"

Question 7

You want to stop a Compute Engine instance to reduce costs. It will be started again in a few hours. Which command should you use?

Accepted Answer

gcloud compute instances stop. The `gcloud compute instances stop` command deallocates the instance's CPU and memory resources, stopping billing for these components while preserving the persistent disk and its data. This allows the instance to be restarted later, making it suitable for cost reduction when the instance is not needed for a period. Unlike `suspend`, `stop` does not incur charges for preserving the instance's memory state.

Answer

gcloud compute instances suspend

Answer

gcloud compute instances delete

Answer

gcloud compute instances reset

Question 8

You are configuring a log sink to export logs to Cloud Storage for compliance. Which TWO permissions are required for the sink's destination bucket? (Choose TWO.)

Accepted Answer

storage.objectCreator. The sink's writer identity requires the `storage.objectCreator` permission to create log objects in the destination Cloud Storage bucket. The `storage.objectViewer` permission is not required for the sink to perform its export function, as its role is to write, not to view existing objects.

Answer

storage.objectViewer

Answer

storage.legacyBucketReader

Answer

storage.admin

Answer

storage.legacyBucketWriter

Question 9

You need to split traffic between two revisions of your Cloud Run service: revision-1 (stable) should receive 90% of traffic, and revision-2 (canary) should receive 10%. Which command should you run?

Accepted Answer

gcloud run services update SERVICE --to-revisions=revision-1=90,revision-2=10. The `gcloud run services update` command, using the `--to-revisions` flag, allows you to specify traffic percentages per revision for your Cloud Run service.

Answer

gcloud run revisions update revision-2 --traffic=10

Answer

gcloud run services set-iam-policy SERVICE policy.yaml

Answer

gcloud run deploy SERVICE --image=IMAGE --no-traffic

Question 10

You need to drain a GKE node for maintenance. The node runs DaemonSet pods and pods using emptyDir volumes. Which kubectl drain command correctly handles these pods without causing disruption to critical system components?

Accepted Answer

kubectl drain NODE --ignore-daemonsets --delete-emptydir-data. The kubectl drain command evicts pods from a node. To handle DaemonSet pods (which should be ignored because they are managed by the DaemonSet controller) and pods with emptyDir volumes (which may need --delete-emptydir-data to force eviction), you use --ignore-daemonsets and --delete-emptydir-data.

Answer

kubectl drain NODE --force

Answer

kubectl drain NODE --ignore-daemonsets

Answer

kubectl drain NODE --delete-emptydir-data

Question 11

You are managing a GKE cluster and need to upgrade the node pool to a newer Kubernetes version. Which THREE steps should you perform as part of the upgrade process?

Accepted Answer

Upgrade the cluster control plane using gcloud container clusters upgrade. To upgrade a node pool, you typically first ensure the control plane is at the desired version (if not already upgraded), then initiate the node pool upgrade. Option A, `gcloud container clusters upgrade`, is used to upgrade the cluster control plane. Option C, `gcloud container node-pools upgrade`, is the direct command to upgrade the node pool itself. After any upgrade, it is crucial to verify the node pool status and the health of applications running on the nodes, as stated in Option D, to ensure the upgrade was successful and did not introduce issues. Option B, draining nodes manually, is generally not required as GKE's upgrade mechanisms handle pod eviction. Option E describes an alternative strategy rather than a direct upgrade step.

Answer

Drain all nodes in the node pool using kubectl drain

Answer

Create a new node pool and migrate workloads

Question 12

A DevOps team wants to be notified in Slack when a specific error log appears in Cloud Logging. They set up a log-based alert with a notification channel to a Slack webhook. However, notifications are not arriving. What is the most likely cause?

Accepted Answer

The Slack webhook URL is outdated. Cloud Monitoring supports direct Slack integration using a webhook URL as a notification channel. When notifications are not arriving, the most common cause for a configured webhook is that the URL itself is invalid, outdated, revoked by Slack, or mistyped, preventing the messages from being delivered successfully. While an incorrect log query or metric threshold (options B and C) would prevent the alert from firing, an invalid webhook URL (option D) directly addresses the failure of the notification channel to deliver messages, even if the alert condition is met.

Answer

The notification channel is not configured to use a Pub/Sub topic

Answer

The log-based alert is not using a valid metric threshold

Answer

The log query is case-sensitive and mismatched

Question 13

A Cloud Run service needs to be updated to increase CPU and memory limits. Which command should the engineer use?

Accepted Answer

gcloud run services update. 'gcloud run services update' is specifically designed to modify service-level configuration properties, such as CPU and memory limits, for an existing Cloud Run service. This command directly targets the service's configuration. 'gcloud run deploy' is primarily used for deploying a new container image or a new revision of a service; while it can also update configuration parameters, 'gcloud run services update' is the more direct and semantically appropriate command when the primary intent is to adjust existing service settings without necessarily deploying a new container image. 'gcloud functions deploy' is for Cloud Functions, not Cloud Run. 'gcloud run revisions update' does not exist, as Cloud Run revisions are immutable.

Answer

gcloud functions deploy

Answer

gcloud run deploy

Answer

gcloud run revisions update

Question 14

A GKE cluster is running a critical workload. An engineer needs to perform maintenance on a node without disrupting the pods. They plan to use 'kubectl drain'. Which additional flags are typically required to safely drain a node?

Accepted Answer

--ignore-daemonsets --delete-emptydir-data. The '--ignore-daemonsets' flag tells kubectl to ignore DaemonSet-managed pods, meaning these pods will not be evicted from the node during the drain operation. This is typically desired as DaemonSets are designed to run on specific nodes and their eviction is usually not part of a node drain. The '--delete-emptydir-data' flag allows draining nodes with pods using emptyDir volumes (data is ephemeral). Both are commonly required for safe draining.

Answer

--dry-run --now

Answer

--force --grace-period=0

Answer

--all-namespaces --selector

Question 15

Your organization runs a critical application on Compute Engine VMs. You have created a snapshot schedule, but you need to ensure that snapshots of disks attached to running instances are crash-consistent. What must you do before taking the snapshot?

Accepted Answer

Stop the VM before taking the snapshot. GCP snapshots are crash-consistent by default, even for disks attached to running instances. This means that a snapshot captures the state of the disk as if the VM instance crashed at the moment the snapshot was taken, without requiring the VM to be stopped or disk caches to be manually flushed for crash consistency. The provided explanation incorrectly states that for running instances, one 'must stop the VM or flush disk caches to ensure crash consistency.' Actions like stopping the VM or enabling guest OS features (with the --guest-flush flag) are typically used to achieve a higher level of consistency, such as application consistency, which ensures applications have flushed their buffers to disk.

Answer

Detach the disk from the instance

Answer

Enable guest OS features for the instance

Answer

Use the --no-pause flag when creating the snapshot

Question 16

A team needs to analyze application logs to find errors from the last 24 hours. The logs are stored in Cloud Logging. Which query language filters would select log entries where the severity is ERROR and the resource type is a GCE VM instance?

Accepted Answer

resource.type = 'gce_instance' AND severity = 'ERROR'. Cloud Logging query language uses field names like `resource.type` and `severity`. For exact matches, the `=` operator is used, and string values are enclosed in single quotes. Logical operators like `AND` are used to combine conditions.

Answer

resource.type:gce_instance AND severity:ERROR

Answer

resource.type == 'gce_instance' && severity == 'ERROR'

Answer

type='gce_instance' AND level='ERROR'

Question 17

You are designing a disaster recovery plan for a stateful application running on Compute Engine. You need to create crash-consistent backups of persistent disks every hour and store them in a different region for at least 30 days. Which TWO steps should you take? (Choose two.)

Accepted Answer

Copy the snapshot to a different region using gcloud compute snapshots create --source-snapshot --region. For 'crash-consistent backups of persistent disks every hour and store them in a different region for at least 30 days':

1.  **Automated Frequency and Retention**: The most appropriate step for creating backups 'every hour' and ensuring 'at least 30 days' retention is to create a snapshot schedule using `gcloud compute resource-policies` (Option D). Google Cloud persistent disk snapshots are inherently block-level crash-consistent, meaning they can be taken while the VM is running. Stopping the VM (Option A) is not required for this level of consistency and is typically done for filesystem or application consistency.

2.  **Cross-region Storage**: Snapshot schedules create snapshots in the same region as the source disk. To store these backups in a 'different region', you must copy the snapshots. This is achieved by creating a new snapshot from an existing one and specifying the desired `storage-location`. The correct command syntax for this would be `gcloud compute snapshots create NEW_SNAPSHOT_NAME --source-snapshot SOURCE_SNAPSHOT_NAME --storage-location TARGET_REGION`. Option B attempts to describe this, but its command syntax (`--region` instead of `--storage-location`) is incorrect for specifying the destination region.

Therefore, the most accurate steps to fulfill all requirements are to use a snapshot schedule (D) and then copy the snapshots to a different region (a corrected version of B).

Answer

Stop the VM before taking each snapshot

Answer

Use gcloud compute images create to create a custom image from the snapshot, then export to a different region

Answer

Use gcloud compute snapshots create with the --source-disk flag while the VM is running

Question 18

A developer needs to check the latest logs from a Compute Engine instance to debug a failed startup script. They want to filter logs from the last hour with severity ERROR or higher. Which Cloud Logging query language filter should they use?

Accepted Answer

resource.type="gce_instance"
timestamp>="-1h"
severity>=ERROR. The correct filter is A. It uses `resource.type="gce_instance"` to target Compute Engine instances, `timestamp>="-1h"` to get logs from the last hour, and `severity>=ERROR` to capture ERROR, CRITICAL, ALERT, and EMERGENCY levels. Option B is incorrect because `severity=ERROR` matches only ERROR, not higher severities. Option C uses a wrong resource type and `timestamp<"-1h"` which is before the last hour. Option D uses `resource.labels.instance_id="*"` which is not a valid wildcard syntax for instance IDs.

Answer

resource.type="gce_instance"
severity=ERROR
timestamp>="-1h"

Answer

resource.type="compute.googleapis.com/Instance"
severity>=ERROR
timestamp<"-1h"

Answer

resource.labels.instance_id="*"
severity>=ERROR
timestamp>="-3600s"

Question 19

Your organization runs a stateful workload on a Compute Engine VM with a 500 GB persistent disk. You need to resize the VM to a machine type with more CPUs and memory, while minimizing downtime. You also need to ensure the disk is backed up before the change. What is the correct sequence of steps?

Accepted Answer

1. gcloud compute instances stop VM_NAME
2. gcloud compute disks snapshot DISK_NAME --snapshot-names backup-snapshot
3. gcloud compute instances set-machine-type VM_NAME --machine-type n1-standard-8
4. gcloud compute instances start VM_NAME. To change the machine type of a Compute Engine VM, the VM must be stopped. Option A correctly sequences: stop the VM first, then create a disk snapshot for backup, then change the machine type, then start the VM. Option C uses a valid snapshot command but the order is the same as A; however, option A is marked correct. Option B fails because it attempts to change the machine type without stopping the VM first, which is not allowed. Option D also changes the machine type without stopping and creates a snapshot after starting, which is incorrect.

Answer

1. gcloud compute snapshots create backup-snapshot --disk DISK_NAME
2. gcloud compute instances set-machine-type VM_NAME --machine-type n1-standard-8
3. gcloud compute instances start VM_NAME

Answer

1. gcloud compute instances stop VM_NAME
2. gcloud compute snapshots create backup-snapshot --source-disk DISK_NAME --source-disk-zone ZONE
3. gcloud compute instances set-machine-type VM_NAME --machine-type n1-standard-8
4. gcloud compute instances start VM_NAME

Answer

1. gcloud compute instances set-machine-type VM_NAME --machine-type n1-standard-8
2. gcloud compute snapshots create backup-snapshot --disk DISK_NAME
3. gcloud compute instances start VM_NAME

Question 20

Your GKE cluster has a node pool that is underutilized. You want to enable cluster autoscaling to automatically adjust the number of nodes based on workload demand. Which TWO steps are required? (Choose two.)

Accepted Answer

Specify --min-nodes and --max-nodes parameters. To enable cluster autoscaling on a GKE node pool, you need to specify minimum and maximum node limits (option B) and enable autoscaling on the specific node pool using `gcloud container node-pools update` with the `--enable-autoscaling` flag (option E). Option A is incorrect because upgrading the control plane is unrelated to autoscaling. Option C is incorrect because `gcloud container clusters update` does not accept a `--node-pool` flag for enabling autoscaling on a pool. Option D is incorrect because `--autoscaling-profile` is an optional tuning parameter, not a required step.

Answer

Upgrade the control plane to the latest version

Answer

Run gcloud container clusters update CLUSTER_NAME --node-pool POOL_NAME --enable-autoscaling

Answer

Set the --autoscaling-profile option to 'optimize-utilization'