Google ACE Ensuring Successful Operation of a Cloud Solution Practice Test 2 — 15 Questions

Question 1

A GKE cluster is running a critical workload. An engineer needs to perform maintenance on a node without disrupting the pods. They plan to use 'kubectl drain'. Which additional flags are typically required to safely drain a node?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

--ignore-daemonsets --delete-emptydir-data. The '--ignore-daemonsets' flag tells kubectl to ignore DaemonSet-managed pods, meaning these pods will not be evicted from the node during the drain operation. This is typically desired as DaemonSets are designed to run on specific nodes and their eviction is usually not part of a node drain. The '--delete-emptydir-data' flag allows draining nodes with pods using emptyDir volumes (data is ephemeral). Both are commonly required for safe draining.

Answer

--dry-run --now

Answer

--force --grace-period=0

Answer

--all-namespaces --selector

Question 2

Your organization runs a critical application on Compute Engine VMs. You have created a snapshot schedule, but you need to ensure that snapshots of disks attached to running instances are crash-consistent. What must you do before taking the snapshot?

Accepted Answer

Stop the VM before taking the snapshot. GCP snapshots are crash-consistent by default, even for disks attached to running instances. This means that a snapshot captures the state of the disk as if the VM instance crashed at the moment the snapshot was taken, without requiring the VM to be stopped or disk caches to be manually flushed for crash consistency. The provided explanation incorrectly states that for running instances, one 'must stop the VM or flush disk caches to ensure crash consistency.' Actions like stopping the VM or enabling guest OS features (with the --guest-flush flag) are typically used to achieve a higher level of consistency, such as application consistency, which ensures applications have flushed their buffers to disk.

Answer

Detach the disk from the instance

Answer

Enable guest OS features for the instance

Answer

Use the --no-pause flag when creating the snapshot

Question 3

A team needs to analyze application logs to find errors from the last 24 hours. The logs are stored in Cloud Logging. Which query language filters would select log entries where the severity is ERROR and the resource type is a GCE VM instance?

Accepted Answer

resource.type = 'gce_instance' AND severity = 'ERROR'. Cloud Logging query language uses field names like `resource.type` and `severity`. For exact matches, the `=` operator is used, and string values are enclosed in single quotes. Logical operators like `AND` are used to combine conditions.

Answer

resource.type:gce_instance AND severity:ERROR

Answer

resource.type == 'gce_instance' && severity == 'ERROR'

Answer

type='gce_instance' AND level='ERROR'

Question 4

You are designing a disaster recovery plan for a stateful application running on Compute Engine. You need to create crash-consistent backups of persistent disks every hour and store them in a different region for at least 30 days. Which TWO steps should you take? (Choose two.)

Accepted Answer

Copy the snapshot to a different region using gcloud compute snapshots create --source-snapshot --region. For 'crash-consistent backups of persistent disks every hour and store them in a different region for at least 30 days':

1.  **Automated Frequency and Retention**: The most appropriate step for creating backups 'every hour' and ensuring 'at least 30 days' retention is to create a snapshot schedule using `gcloud compute resource-policies` (Option D). Google Cloud persistent disk snapshots are inherently block-level crash-consistent, meaning they can be taken while the VM is running. Stopping the VM (Option A) is not required for this level of consistency and is typically done for filesystem or application consistency.

2.  **Cross-region Storage**: Snapshot schedules create snapshots in the same region as the source disk. To store these backups in a 'different region', you must copy the snapshots. This is achieved by creating a new snapshot from an existing one and specifying the desired `storage-location`. The correct command syntax for this would be `gcloud compute snapshots create NEW_SNAPSHOT_NAME --source-snapshot SOURCE_SNAPSHOT_NAME --storage-location TARGET_REGION`. Option B attempts to describe this, but its command syntax (`--region` instead of `--storage-location`) is incorrect for specifying the destination region.

Therefore, the most accurate steps to fulfill all requirements are to use a snapshot schedule (D) and then copy the snapshots to a different region (a corrected version of B).

Answer

Stop the VM before taking each snapshot

Answer

Use gcloud compute images create to create a custom image from the snapshot, then export to a different region

Answer

Use gcloud compute snapshots create with the --source-disk flag while the VM is running

Question 5

You need to drain a GKE node for maintenance without disrupting running workloads that are managed by a DaemonSet. Which TWO flags should you use with kubectl drain? (Choose two.)

Accepted Answer

--delete-emptydir-data. Option D (--ignore-daemonsets) is correct because DaemonSet-managed pods are not evicted by kubectl drain by default; without this flag, drain will refuse to proceed since it cannot evict pods that are not backed by a controller it can reschedule, so this flag lets the drain continue while leaving DaemonSet pods running on the node. Option A (--delete-emptydir-data) is correct because draining a node requires evicting pods that use emptyDir volumes, and kubectl drain will abort unless this flag is supplied to acknowledge that the emptyDir data will be permanently deleted. Option B (--grace-period=0) is not required and would force immediate termination rather than graceful eviction, which risks disruption. Option C (--disable-eviction) is wrong because it bypasses the Eviction API and deletes pods directly, which can violate PodDisruptionBudgets and disrupt workloads. Option E (--force) is not needed here; it only allows deletion of pods not managed by a controller, which is unrelated to the DaemonSet requirement.

Answer

--grace-period=0

Answer

--disable-eviction

Answer

--force

Question 6

Your organization runs a stateful workload on a Compute Engine VM with a 500 GB persistent disk. You need to resize the VM to a machine type with more CPUs and memory, while minimizing downtime. You also need to ensure the disk is backed up before the change. What is the correct sequence of steps?

Accepted Answer

1. gcloud compute instances stop VM_NAME
2. gcloud compute disks snapshot DISK_NAME --snapshot-names backup-snapshot
3. gcloud compute instances set-machine-type VM_NAME --machine-type n1-standard-8
4. gcloud compute instances start VM_NAME. To change the machine type of a Compute Engine VM, the VM must be stopped. Option A correctly sequences: stop the VM first, then create a disk snapshot for backup, then change the machine type, then start the VM. Option C uses a valid snapshot command but the order is the same as A; however, option A is marked correct. Option B fails because it attempts to change the machine type without stopping the VM first, which is not allowed. Option D also changes the machine type without stopping and creates a snapshot after starting, which is incorrect.

Answer

1. gcloud compute snapshots create backup-snapshot --disk DISK_NAME
2. gcloud compute instances set-machine-type VM_NAME --machine-type n1-standard-8
3. gcloud compute instances start VM_NAME

Answer

1. gcloud compute instances stop VM_NAME
2. gcloud compute snapshots create backup-snapshot --source-disk DISK_NAME --source-disk-zone ZONE
3. gcloud compute instances set-machine-type VM_NAME --machine-type n1-standard-8
4. gcloud compute instances start VM_NAME

Answer

1. gcloud compute instances set-machine-type VM_NAME --machine-type n1-standard-8
2. gcloud compute snapshots create backup-snapshot --disk DISK_NAME
3. gcloud compute instances start VM_NAME

Question 7

Your GKE cluster has a node pool that is underutilized. You want to enable cluster autoscaling to automatically adjust the number of nodes based on workload demand. Which TWO steps are required? (Choose two.)

Accepted Answer

Specify --min-nodes and --max-nodes parameters. Option B is correct because enabling cluster autoscaling on a GKE node pool requires defining the minimum and maximum node count boundaries via --min-nodes and --max-nodes, which bound how far the autoscaler can scale the pool up or down. Option E is correct because the actual command to turn on autoscaling for an existing node pool is gcloud container node-pools update POOL_NAME --enable-autoscaling --cluster CLUSTER_NAME, which modifies the node pool's autoscaling configuration. Option A is not required since cluster autoscaling does not depend on running the latest control plane version. Option C is incorrect because gcloud container clusters update targets cluster-level settings and does not enable per-node-pool autoscaling with --node-pool/--enable-autoscaling in this manner. Option D is incorrect because --autoscaling-profile is an optional optimization setting for the cluster autoscaler, not a required step to enable autoscaling.

Answer

Upgrade the control plane to the latest version

Answer

Run gcloud container clusters update CLUSTER_NAME --node-pool POOL_NAME --enable-autoscaling

Answer

Set the --autoscaling-profile option to 'optimize-utilization'

Question 8

You are managing a Cloud Run service that has two revisions: v1 (serving 100% traffic) and v2 (new revision). You want to shift 10% of traffic to v2 gradually. Which TWO steps should you take? (Choose two.)

Accepted Answer

Run gcloud run services update-traffic SERVICE_NAME --to-revisions v2=10. To shift 10% of traffic to revision v2, you can use the gcloud run services update-traffic command with the --to-revisions flag. Option A sets v2 to 10% and implicitly assigns the remaining 90% to v1. Option C explicitly sets both v1=90% and v2=10%. Both achieve the desired 10% traffic shift. Option B assigns 100% to the latest revision, not 10%. Option D deploys the new revision without traffic. Option E only lists revisions.

Answer

Run gcloud run services update-traffic SERVICE_NAME --to-latest

Answer

Run gcloud run deploy --image gcr.io/project/v2 --no-traffic

Answer

Run gcloud run revisions list to confirm revision names

Question 9

You need to set up an alert that triggers when the 99th percentile latency of your HTTP(S) load balancer exceeds 5 seconds for 5 minutes. Which THREE resources must you create or configure? (Choose three.)

Accepted Answer

An alerting policy. Option B, an alerting policy, is required because in Cloud Monitoring an alert is defined by an alerting policy that specifies the conditions to evaluate and the notifications to send; without it no alert can fire. Option C, a notification channel (e.g., email, Slack, PagerDuty), is required because an alerting policy must reference at least one notification channel for the alert to actually notify anyone when it triggers. Option E, a metric threshold condition in the alerting policy, is required because the trigger is a numeric threshold (99th percentile HTTP(S) load balancer latency > 5 seconds sustained for 5 minutes), which is expressed as a metric threshold condition using the load balancer's latency metric and a 5-minute alignment/duration. Option A, an uptime check, is not needed because uptime checks test endpoint availability/probe success, not percentile latency. Option D, a log-based metric for latency, is not needed because load balancer latency is already exposed as a built-in Cloud Monitoring metric, so no log-based metric must be created.

Answer

An uptime check

Answer

A log-based metric for latency

Question 10

Your BigQuery dataset contains a table with sensitive customer data. You want to allow a data analyst to query the table but prevent them from viewing the data directly. You also need to ensure they cannot export the data. Which TWO IAM roles should you grant the analyst? (Choose two.)

Accepted Answer

roles/bigquery.jobUser. To allow the analyst to query the table without viewing data directly, you should grant the bigquery.jobUser role, which provides permission to run queries (bigquery.jobs.create). To prevent direct viewing, you must not grant bigquery.dataViewer on the table, as that allows direct data access. Instead, create an authorized view that exposes only the necessary columns/rows, and grant bigquery.dataViewer on that view. For export prevention, bigquery.jobUser alone does not allow export; additional roles like storage.objectViewer or bigquery.dataEditor would be required for export, so they are not needed. Thus, the only IAM role needed from the options is roles/bigquery.jobUser.

Answer

roles/bigquery.dataViewer

Answer

roles/bigquery.admin

Answer

roles/storage.objectViewer

Answer

roles/bigquery.dataEditor

Question 11

You need to update a deployment in your GKE cluster from image version 1.0 to 2.0. You have already updated the manifest file. Which THREE kubectl commands should you use in sequence? (Choose three in the correct order.)

Accepted Answer

kubectl set image deployment/myapp myapp-container=gcr.io/myproject/myapp:2.0. Option B is correct because `kubectl set image deployment/myapp myapp-container=gcr.io/myproject/myapp:2.0` is the imperative command that triggers the rolling update by changing the container image in the Deployment's pod template to version 2.0. Option D is correct because `kubectl rollout history deployment/myapp` lets you inspect the revision history of the Deployment, confirming the new revision was recorded and providing the revision numbers needed for tracking or rollback. Option E is correct because `kubectl rollout status deployment/myapp` blocks and reports the progress of the rolling update until all replicas are updated and available, verifying the deployment succeeded. Option A is not part of the required sequence because listing pods with a label selector is only a diagnostic step and does not perform or verify the update. Option C is incorrect because `kubectl rollout undo deployment/myapp` reverts to a previous revision, which is the opposite of the intended upgrade to 2.0.

Answer

kubectl get pods -l app=myapp

Answer

kubectl rollout undo deployment/myapp

Question 12

Your team manages a Cloud SQL for MySQL instance that supports a production web application. During a recent incident, a developer accidentally ran a DELETE statement without a WHERE clause, removing critical data. You need to recover the database to a point in time just before the deletion occurred. The instance has automated backups enabled and binary logging turned on. What should you do?

Accepted Answer

Restore the instance from the most recent automated backup, then apply the binary logs up to the point in time before the deletion.. Point-in-time recovery (PITR) on Cloud SQL for MySQL requires restoring from a backup and then replaying binary logs to a specific timestamp. This allows recovery to the exact moment before the accidental deletion. The other options either restore only to the backup time or involve manual, imprecise methods that do not leverage binary logs.

Answer

Export the current instance to a SQL dump file, then import it into a new instance, and manually reapply the missing data from application logs.

Answer

Create a clone of the instance from the most recent automated backup, and then promote the clone to a standalone instance.

Answer

Use the gcloud sql instances restore-backup command to restore the backup to the existing instance, overwriting the current data.

Question 13

You have a Cloud Run service that occasionally receives a burst of requests. You want to ensure that the service can handle the load without over-provisioning resources during idle periods. Which feature should you configure?

Accepted Answer

Configure concurrency.. Concurrency in Cloud Run defines how many requests a single container instance can handle at the same time. By tuning concurrency, you can maximize the utilization of each instance, allowing Cloud Run to handle bursts by scaling out only when necessary. This avoids over-provisioning because instances are added dynamically based on load, and scaled down to zero when idle. The other options either do not directly control scaling efficiency or lead to unnecessary costs.

Answer

Set the minimum number of instances to a value greater than zero.

Answer

Set the maximum number of instances to a high value.

Answer

Enable CPU throttling.

Question 14

You need to monitor the uptime of an external HTTPS endpoint that is critical to your application. Which Google Cloud service should you use to create an uptime check?

Accepted Answer

Cloud Monitoring. Cloud Monitoring provides uptime checks that can monitor HTTP, HTTPS, and TCP endpoints from multiple locations.

Answer

Cloud Debugger

Answer

Cloud Trace

Answer

Cloud Logging

Question 15

You have a Compute Engine VM instance that is currently running. You need to resize it to a different machine type. What must you do first?

Accepted Answer

Stop the instance, then use gcloud compute instances set-machine-type, then start the instance.. Changing the machine type requires the VM to be in a stopped state. You must stop the instance, change the machine type, then start it.

Answer

Use gcloud compute instances update --machine-type while the instance is running.

Answer

Detach all disks, change machine type, then reattach disks.

Answer

Create a snapshot of the disk and use it to create a new instance with the desired machine type.