Google ACE Planning and Configuring a Cloud Solution — 40 Questions

Question 1

A company is migrating a legacy monolithic application to Google Cloud. The application has unpredictable traffic patterns and long-running connections. The team wants to minimize operational overhead and only pay for resources when the application is processing requests. Which compute option should they choose?

Accepted Answer

Cloud Run. Cloud Run is a serverless compute platform that scales to zero when not in use, has a per-request billing model, and supports HTTP-triggered container workloads. It can handle long-running connections as long as they stay within the request timeout limit. Cloud Run minimizes operational overhead by eliminating server management and scaling automatically.

Answer

Google Kubernetes Engine (GKE) Autopilot cluster

Answer

Compute Engine with managed instance groups and autoscaling

Answer

Google Kubernetes Engine (GKE) Standard cluster with node autoscaling

Question 2

An engineer needs to create a Cloud Storage bucket for storing archival data that will be accessed less than once a year. The data must be stored durably and cost-effectively. Which storage class should the engineer use?

Accepted Answer

Archive. Archive storage class is designed for data accessed less than once a year, with the lowest storage cost but higher retrieval costs and a 365-day minimum storage duration. It is ideal for long-term archival.

Answer

Coldline

Answer

Standard

Answer

Nearline

Question 3

A company plans to run a stateful application on Compute Engine that requires high random I/O performance and the ability to resize the persistent disk without downtime. The application is running on a Linux VM. Which persistent disk type and configuration should the engineer choose?

Accepted Answer

Extreme persistent disk (pd-extreme). Extreme persistent disks are designed for high random I/O workloads, offering up to 120,000 IOPS and the ability to resize without downtime. They are SSD-based and suitable for databases.

Answer

Balanced persistent disk (pd-balanced)

Answer

SSD persistent disk (pd-ssd)

Answer

Standard persistent disk (pd-standard)

Question 4

A company uses Cloud SQL for MySQL to host a database. The database must be accessible from a Compute Engine VM in the same region but in a different VPC network (VPC-A). The company does not want to use public IP addresses or VPN. What should the engineer do to enable connectivity?

Accepted Answer

Set up VPC Network Peering between VPC-A and the VPC where Cloud SQL is deployed, and configure Cloud SQL with a private IP. Cloud SQL private services access requires the Cloud SQL instance to be in a VPC network. For connectivity across VPCs, VPC Network Peering can be used, as both VPCs are in the same project or across projects. Private services access connects Cloud SQL to a VPC, and peering allows another VPC to access it.

Answer

Export the Cloud SQL instance as a dump and recreate it in VPC-A

Answer

Configure the Cloud SQL instance with a public IP and allow the VM's IP in authorized networks

Answer

Use Cloud VPN to connect VPC-A to the VPC where Cloud SQL is deployed

Question 5

An engineer needs to deploy a containerized web application that receives HTTP requests and should scale to zero when not in use. The application is stateless and has a lightweight container image. Which Google Cloud compute service should be used?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless platform that scales to zero when no requests are coming in, and bills per request. It is ideal for stateless HTTP-triggered container workloads.

Answer

Compute Engine with a single VM

Answer

Cloud Functions

Answer

Google Kubernetes Engine (GKE) Standard cluster

Question 6

A company wants to set up a hybrid network between their on-premises data center and Google Cloud. They need a highly available VPN connection with 99.99% SLA. Which VPN solution should they choose?

Accepted Answer

HA VPN. HA VPN offers a 99.99% SLA (with certain conditions) when configured with two interfaces and two tunnels to two on-premises VPN gateways. Classic VPN does not provide an SLA.

Answer

Classic VPN

Answer

Cloud Interconnect

Answer

Cloud NAT

Question 7

A company runs a batch analytics workload on Compute Engine that runs for 3 hours every night. The workload is fault-tolerant and can be disrupted. Which pricing model should the engineer use to minimize cost?

Accepted Answer

Preemptible VMs. Preemptible VMs are significantly cheaper than regular VMs and can be terminated at any time, suitable for fault-tolerant batch workloads. They are ideal for short-lived, interruptible jobs.

Answer

Committed use discounts

Answer

Spot VMs

Answer

Sustained use discounts

Question 8

An engineer is designing a VPC for a multi-tier application. The application has web servers that need direct internet access, and a private database tier that must not have public IP addresses. The database tier needs outbound internet access to download updates. Which network configuration should the engineer implement?

Accepted Answer

Place web servers in a subnet with public IPs, and database servers in a separate subnet with Cloud NAT and no public IP. Web servers should be in a subnet with public IPs or a Cloud NAT for outbound. The database tier must be in a private subnet without public IP, but needs outbound internet via Cloud NAT. This allows secure outbound without public exposure.

Answer

Place web servers in a subnet with Cloud NAT, and database servers in the same subnet without public IP

Answer

Place both tiers in the same subnet with no public IPs and use Cloud NAT for all outbound traffic

Answer

Place web servers in a subnet with Cloud NAT, and database servers in a subnet with public IPs and firewall rules to restrict inbound

Question 9

A company needs to run a MongoDB database on Compute Engine. The database requires high-throughput, low-latency storage that can survive VM failures. Which disk type and configuration is most appropriate?

Accepted Answer

SSD persistent disks with snapshots. SSD persistent disks (pd-ssd) provide high IOPS and low latency for databases. For survival of VM failures, the disk should be set to non-deletable or use snapshots. Regional persistent disks replicate data across zones for higher availability, but the question asks for survival of VM failures, which can be achieved with zonal disks if the VM is recreated and the disk is detached. However, regional persistent disks are better for durability across zone failures. The best answer is pd-ssd with snapshots for backup.

Answer

Standard persistent disks with snapshots

Answer

Extreme persistent disks with snapshots

Answer

Local SSDs

Question 10

A company wants to use Cloud Functions to process events from Cloud Storage when new objects are uploaded. They need the function to run in a specific VPC network for tight security. Which Cloud Functions generation supports VPC connectivity?

Accepted Answer

Cloud Functions (2nd gen) with VPC connector. Cloud Functions (2nd gen) is built on Cloud Run and supports VPC connectivity via connectors or direct VPC. 1st gen does not support VPC connectors for ingress/egress in the same way. 2nd gen is recommended for VPC network integration.

Answer

Cloud Functions (1st gen) with VPC connector

Answer

Cloud Functions (2nd gen) with Cloud VPN

Answer

Cloud Functions (1st gen) with Cloud NAT

Question 11

An organization needs a NoSQL document database with real-time synchronization across multiple client devices. Which Google Cloud service should they use?

Accepted Answer

Firestore. Firestore is a NoSQL document database that provides real-time listeners for syncing data across devices, making it ideal for mobile and web applications requiring live updates.

Answer

Cloud SQL

Answer

Cloud Bigtable

Answer

Cloud Datastore

Question 12

A company is running a stateful application on a Compute Engine instance with a 200 GB persistent disk. They want to reduce costs by moving the disk to a lower-cost storage class, but the disk is currently in use. They plan to take a snapshot of the disk and create a new disk from the snapshot with the new storage class. However, they need minimal downtime. What is the correct approach?

Accepted Answer

Take a snapshot of the disk, create a new disk from the snapshot with the new storage class, then detach the old disk and attach the new disk to the same VM. To change the storage class of a persistent disk, you cannot directly change it; you must create a new disk from a snapshot. To minimize downtime, you can create a snapshot while the VM is running (crash-consistent if on a live instance), then create a new disk with the desired storage class, stop the VM, detach the old disk, attach the new disk, and start the VM. This results in a brief downtime but is the standard method.

Answer

Use the 'gcloud compute disks update' command to change the storage class while the disk is attached to a running VM

Answer

Create a new disk with the new storage class and use rsync to copy data from the old disk while both are attached to the same VM

Answer

Stop the VM, take a snapshot, create a new disk with the new storage class, and start the VM with the new disk

Question 13

A company runs a critical application on Compute Engine that requires static IP addresses and must be highly available across zones. The application uses a stateful backend. Which TWO steps should the engineer take to meet these requirements? (Choose 2)

Accepted Answer

Configure an external TCP/UDP load balancer with a static IP address. To achieve high availability across zones with static IPs, a managed instance group with a multi-zone configuration (A) can distribute instances across zones. A load balancer (B) provides a static IP and routes traffic to healthy instances. Stateful workloads can use persistent disks or other state preservation strategies.

Answer

Assign each VM a static external IP address

Answer

Use Cloud DNS with geo-routing

Answer

Use a single-zone managed instance group with a snapshot schedule

Question 14

A company is using Cloud Functions (2nd gen) to process high-volume events from Pub/Sub. The function needs to write results to a Cloud Storage bucket. The security team requires that the function uses a service account with the least privilege. Which THREE roles should the engineer assign to the function's service account? (Choose 3)

Accepted Answer

roles/cloudfunctions.invoker. The service account needs permissions to pull messages from Pub/Sub (roles/pubsub.subscriber), write to Cloud Storage (roles/storage.objectCreator), and be able to invoke the function (roles/cloudfunctions.invoker) if the function is triggered via HTTP; however, for event-driven functions, the trigger is Pub/Sub, so the invoker role might not be needed. But to be safe, the invoker role allows the function to be called. The correct three are the essential ones: Pub/Sub subscriber, Cloud Storage object creator, and Cloud Functions invoker (for the function to be invoked by the event). Actually, for event-driven functions, the Pub/Sub subscription can push to the function without the invoker role if the function's auth is set to allow unauthenticated invocations, but best practice is to use a service account. However, the invoker role is often required when the function uses a service account for authentication. The typical least privilege roles are: roles/pubsub.subscriber (to acknowledge messages), roles/storage.objectCreator (to write objects), and roles/cloudfunctions.invoker (to allow the Pub/Sub push to invoke the function). Alternatively, roles/iam.serviceAccountUser might be needed to attach the service account. But based on common exam questions, the three are: pubsub.subscriber, storage.objectCreator, cloudfunctions.invoker.

Answer

roles/iam.serviceAccountUser

Answer

roles/pubsub.publisher

Question 15

A company wants to analyze terabytes of structured data using SQL queries. The data is stored in CSV files in Cloud Storage. Which TWO Google Cloud services can be used together to query the data directly without loading it into a database? (Choose 2)

Accepted Answer

BigQuery. BigQuery can query external data sources using external tables or federated queries, including Cloud Storage. Cloud Storage is the storage location for the CSV files. BigQuery can directly query files in Cloud Storage using an external table or a federated query.

Answer

Cloud SQL

Answer

Dataproc

Answer

Dataflow

Question 16

A company wants to run a stateless containerized web application that scales to zero when not in use. The application receives HTTP requests and must be billed only for the resources consumed during request processing. Which Google Cloud compute service is most appropriate?

Accepted Answer

Cloud Run. Cloud Run is a serverless container platform that scales to zero and charges per request, CPU, and memory used during request processing. It is ideal for stateless HTTP-triggered workloads.

Answer

Google Kubernetes Engine (GKE) Standard

Answer

Cloud Functions

Answer

Compute Engine

Question 17

A developer needs to creare a Cloud Storage bucket with the storage class that automatically moves objects to a lower-cost storage class after 30 days. Which storage class should be used?

Accepted Answer

Autoclass. Autoclass is a feature that automatically transitions objects to appropriate storage classes based on access patterns. The other options require manual lifecycle rules.

Answer

Coldline

Answer

Standard

Answer

Nearline

Question 18

An organization has a VPC with instances in two subnets: subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). They want to allow HTTP traffic from any instance in subnet-a to any instance in subnet-b. What firewall rule should be created?

Accepted Answer

An ingress rule on subnet-b allowing traffic from 10.0.1.0/24 on TCP port 80. Firewall rules are defined with direction and source/target. To allow inbound traffic to subnet-b from subnet-a, an ingress rule with source range 10.0.1.0/24 is needed.

Answer

An egress rule on subnet-b allowing traffic to 10.0.1.0/24 on TCP port 80

Answer

An ingress rule on subnet-a allowing traffic to 10.0.2.0/24 on TCP port 80

Answer

An egress rule on subnet-a allowing traffic to 10.0.2.0/24 on TCP port 80

Question 19

A company runs a batch job every night that processes data from a Cloud Storage bucket and writes results to BigQuery. The job runs on a Compute Engine VM. To minimize costs, what is the best practice for the VM?

Accepted Answer

Use a preemptible VM. Preemptible VMs are up to 80% cheaper and can be terminated at any time, which is acceptable for batch jobs that can be checkpointed or restarted from the beginning.

Answer

Use a VM with GPUs for faster processing

Answer

Use a VM with local SSD for temporary storage

Answer

Use a standard VM and commit to a 1-year commitment

Question 20

A developer is using Cloud Functions (Gen 2) which is based on Cloud Run. They need to handle events from Cloud Storage when a new object is uploaded. Which event type should they use?

Accepted Answer

google.cloud.storage.object.v1.finalized. In Cloud Functions Gen 2, the event type for Cloud Storage object finalization is 'google.cloud.storage.object.v1.finalized'.

Answer

google.cloud.storage.object.v1.metadataUpdated

Answer

google.cloud.storage.object.v1.deleted

Answer

google.cloud.storage.object.v1.archived