Google ACE Planning and Configuring a Cloud Solution — 10 Questions

Question 1

A company runs a batch analytics workload on Compute Engine that runs for 3 hours every night. The workload is fault-tolerant and can be disrupted. Which pricing model should the engineer use to minimize cost?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Spot VMs. Spot VMs are significantly cheaper than regular VMs and can be terminated at any time, suitable for fault-tolerant batch workloads. They are ideal for short-lived, interruptible jobs.

Answer

Committed use discounts

Answer

On-demand VMs

Answer

Sustained use discounts

Question 2

A company runs a critical application on Compute Engine that requires static IP addresses and must be highly available across zones. The application uses a stateful backend. Which TWO steps should the engineer take to meet these requirements? (Choose 2)

Accepted Answer

Configure an external TCP/UDP load balancer with a static IP address. To achieve high availability across zones with static IPs, use a managed instance group with multiple zones enabled (option C) to distribute instances across zones. An external TCP/UDP load balancer with a static IP address (option A) provides a single static IP and routes traffic to healthy instances via health checks. This combination ensures fault tolerance and a stable IP endpoint.

Answer

Assign each VM a static external IP address

Answer

Use Cloud DNS with geo-routing

Answer

Use a single-zone managed instance group with a snapshot schedule

Question 3

A company is using Cloud Functions (2nd gen) to process high-volume events from Pub/Sub. The function needs to write results to a Cloud Storage bucket. The security team requires that the function uses a service account with the least privilege. Which THREE roles should the engineer assign to the function's service account? (Choose 3)

Accepted Answer

roles/pubsub.subscriber. For a Cloud Function (2nd gen) processing Pub/Sub events and writing to Cloud Storage, the function's runtime service account requires:
1.  'roles/pubsub.subscriber' on the Pub/Sub subscription to receive and acknowledge messages.
2.  'roles/storage.objectCreator' on the Cloud Storage bucket to write results.

The 'roles/cloudfunctions.invoker' role is for the entity that *triggers* the function, not for the function's own service account. For event-driven functions, the Eventarc service account (which mediates 2nd gen triggers) needs 'roles/run.invoker' (which is included in 'cloudfunctions.invoker') on the Cloud Run service backing the function. The function's service account does not invoke itself. Therefore, 'roles/cloudfunctions.invoker' should not be assigned to the function's service account. The question asks for three roles, but only two are clearly applicable to the function's service account based on the problem description and least privilege principles.

Answer

roles/cloudfunctions.invoker

Answer

roles/iam.serviceAccountUser

Answer

roles/pubsub.publisher

Question 4

A developer needs to creare a Cloud Storage bucket with the storage class that automatically moves objects to a lower-cost storage class after 30 days. Which storage class should be used?

Accepted Answer

Autoclass. Autoclass is a feature that automatically transitions objects to appropriate storage classes based on access patterns. The other options (Standard, Nearline, Coldline) are actual storage classes but require manual lifecycle rules to achieve automatic transitions. While Autoclass is not a 'storage class', it is the correct mechanism among the options to fulfill the requirement of automatic object movement to lower-cost storage after 30 days.

Answer

Coldline

Answer

Standard

Answer

Nearline

Question 5

A company wants to migrate a monolithic application to run on Google Cloud. The application consists of multiple services that communicate via REST APIs. The company wants to use managed services and minimize operational overhead. Which two compute services should they consider? (Choose two.)

Accepted Answer

App Engine. App Engine and Cloud Run are fully managed, serverless (or highly abstracted PaaS), and designed for hosting web applications and APIs, making them excellent choices for migrating a monolithic application into multiple REST API services with minimal operational overhead. Cloud Functions are typically best for event-driven, fine-grained microservices, while GKE and Compute Engine require significantly more operational management.

Answer

Cloud Functions

Answer

Google Kubernetes Engine (GKE)

Answer

Compute Engine

Question 6

A company has a Compute Engine VM instance that needs to access a Cloud Storage bucket. The VM uses a service account with the Storage Object Admin role. However, the VM is unable to upload objects. Which two possible causes should be investigated? (Choose two.)

Accepted Answer

The VM's service account does not have the required IAM permission on the bucket. The service account must have the required IAM permission on the bucket (Storage Object Admin grants this at the project level, but bucket-level IAM can override). However, the question asks for two possible causes. The most common causes are that the service account lacks the necessary IAM permission on the bucket (A) or that the VM's access scopes are not configured to allow Cloud Storage API access (D). Option C is essentially the same as A from the bucket side and redundant; if the service account has the role at the project level, the bucket's IAM policy is not the issue unless an explicit deny exists. Option B is incorrect because firewall rules do not block API calls to Cloud Storage. Option E is incorrect because Cloud Storage is global and region mismatch does not affect access.

Answer

A firewall rule is blocking outbound HTTPS traffic

Answer

The bucket's IAM policy does not include the service account

Answer

The VM is not in the same region as the bucket

Question 7

A company needs to store petabytes of time-series IoT sensor data and query it with single-digit millisecond latency at millions of reads per second. The data has a simple key-value structure with timestamps. Which Google Cloud database is MOST appropriate?

Accepted Answer

Cloud Bigtable. Cloud Bigtable is designed for exactly this use case — petabyte-scale, low-latency (single-digit ms), high-throughput NoSQL storage for time-series, IoT, and financial data. It scales horizontally by adding nodes. BigQuery is optimised for analytics (seconds-to-minutes latency) and not for operational reads. Cloud Spanner is a globally distributed relational database with strong consistency, which introduces overhead making it less optimal than Bigtable for pure high-throughput, low-latency key-value reads of time-series data at this scale. Firestore is a document database suitable for application backends, but it is not designed for petabyte-scale time-series data with millions of reads per second.

Answer

BigQuery

Answer

Cloud Spanner

Answer

Firestore

Question 8

A company runs a containerized web application on Google Kubernetes Engine (GKE). The application experiences unpredictable traffic spikes. The team wants to minimize costs by scaling down to zero when idle, but also needs to handle burst traffic quickly. Which GKE mode should they choose?

Accepted Answer

GKE Autopilot. GKE Autopilot is a fully managed GKE mode that handles burst traffic quickly through rapid pod scaling and node provisioning. While it does not scale to zero, it is the best GKE mode for minimizing management and handling traffic spikes. Cloud Run is not a GKE mode, so it is not the correct answer for this question. GKE Standard with node auto-provisioning requires manual configuration and does not scale as quickly, and Compute Engine with managed instance groups is not a GKE mode.

Answer

Cloud Run

Answer

Compute Engine with managed instance groups and autoscaling

Answer

GKE Standard with node auto-provisioning

Question 9

A company is deploying a multi-region application on Compute Engine and needs to configure network security. Which two steps should they take to restrict access to only required traffic? (Choose 2)

Accepted Answer

Use service accounts to restrict traffic between instances. GCP VPC networks have an implicit deny all ingress rule, but also include explicit default allow rules (e.g., for SSH, RDP, internal traffic). To restrict access to only required traffic, you must create specific ingress firewall rules (E) that define allowed sources (IP ranges) and apply them to target instances using network tags. Service accounts (D) provide a robust way to restrict traffic between instances based on identity. Shared VPC (A) is for cross-project networking, not direct traffic restriction. Cloud NAT (C) is for outbound internet access, not inbound. While deleting default allow rules (B) is a good security practice to achieve a least-privilege posture, options D and E are the primary methods for actively defining and applying rules for 'required traffic'.

Answer

Configure Shared VPC to isolate network traffic

Answer

Delete the default allow rules that allow all traffic

Answer

Use Cloud NAT to allow inbound traffic from the internet

Question 10

A development team wants to deploy a containerized microservice that requires GPU acceleration for inference. They want to minimize cost while maintaining the ability to scale to zero when not in use. Which two services meet these requirements? (Choose TWO.)

Accepted Answer

GKE Standard cluster with GPU node pool and cluster autoscaler. GKE Standard with a GPU node pool and cluster autoscaler allows the cluster to scale down to zero nodes when no pods require GPU resources, minimizing cost. The cluster autoscaler automatically removes idle nodes and adds GPU nodes only when GPU-accelerated pods are scheduled, meeting the requirement for scaling to zero.

Answer

Cloud Run

Answer

Cloud Functions with GPU

Answer

Compute Engine with GPUs in a managed instance group