Google ACE Planning and Configuring a Cloud Solution Practice Test 2 — 15 Questions

Question 1

A solutions architect is designing a disaster recovery plan for a Cloud SQL for PostgreSQL instance. The primary instance is in us-central1. They need to automate failover to a different region with a Recovery Point Objective (RPO) of less than 5 seconds. Which configuration should they choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a cross-region read replica in us-west1. A cross-region read replica in us-west1 provides asynchronous replication from the primary instance in us-central1, enabling automated failover to a different region. Cloud SQL supports promoting a cross-region read replica to a primary instance during a regional outage, and the asynchronous replication lag is typically under 5 seconds, satisfying the RPO requirement. This is the only option that provides cross-region disaster recovery with automated failover capability.

Answer

Use Cloud SQL external replication with a Compute Engine instance

Answer

Deploy a high-availability (HA) configuration within the same region

Answer

Enable automatic backups and point-in-time recovery

Question 2

A developer is deploying a Cloud Function that processes messages from a Pub/Sub topic. The function takes 10 minutes to complete each message. The developer needs to ensure that messages are not lost if the function fails. Which Cloud Function generation and configuration should they use?

Accepted Answer

Cloud Functions (2nd gen) with an event-driven trigger from Pub/Sub and retry on failure. Cloud Functions (2nd gen) supports event-driven triggers from Pub/Sub and provides built-in retry on failure, which ensures messages are not lost if the function fails. The 2nd gen also has a longer maximum execution timeout (up to 60 minutes) compared to 1st gen (9 minutes), making it suitable for 10-minute processing. This combination meets the requirement for reliable message processing.

Answer

Cloud Functions (1st gen) with an HTTP trigger and a Pub/Sub push subscription

Answer

Cloud Functions (2nd gen) with an HTTP trigger

Answer

Cloud Functions (1st gen) with a background function and retry on failure

Question 3

A company is deploying a multi-region application on Compute Engine and needs to configure network security. Which two steps should they take to restrict access to only required traffic? (Choose 2)

Accepted Answer

Use service accounts to restrict traffic between instances. GCP VPC networks have an implicit deny all ingress rule, but also include explicit default allow rules (e.g., for SSH, RDP, internal traffic). To restrict access to only required traffic, you must create specific ingress firewall rules (E) that define allowed sources (IP ranges) and apply them to target instances using network tags. Service accounts (D) provide a robust way to restrict traffic between instances based on identity. Shared VPC (A) is for cross-project networking, not direct traffic restriction. Cloud NAT (C) is for outbound internet access, not inbound. While deleting default allow rules (B) is a good security practice to achieve a least-privilege posture, options D and E are the primary methods for actively defining and applying rules for 'required traffic'.

Answer

Configure Shared VPC to isolate network traffic

Answer

Delete the default allow rules that allow all traffic

Answer

Use Cloud NAT to allow inbound traffic from the internet

Question 4

An organization wants to migrate a 5 TB on-premises MongoDB database to Google Cloud. They need to minimize latency for write operations and support global users with strong consistency. Which three services or tools should they consider for this migration? (Choose 3)

Accepted Answer

Transfer Appliance. Transfer Appliance (C) is correct because moving a 5 TB on-premises MongoDB dataset over the network can be slow and costly, so Google's physical transfer appliance lets you ship the data to Google Cloud and load it into the target database efficiently. MongoDB Atlas on Google Cloud (D) is correct because it runs the MongoDB-compatible database close to Google Cloud compute, minimizing write latency while providing replica-set strong consistency and global distribution options for users. Cloud Spanner (E) is correct because it is a globally distributed, strongly consistent, horizontally scalable database that minimizes write latency across regions and supports global users with external consistency. Database Migration Service (A) is not the best fit here because it primarily targets migrations to Cloud SQL, AlloyDB, or Spanner rather than a native MongoDB target, and Cloud Bigtable (B) is not appropriate because it is a wide-column NoSQL store with eventual consistency and no MongoDB compatibility, so it does not meet the strong-consistency MongoDB migration requirement.

Answer

Database Migration Service

Answer

Cloud Bigtable

Question 5

A company has a VPC in auto mode and wants to create a VPN connection to an on-premises network using HA VPN. The on-premises VPN gateway supports only a single public IP address. Which configuration step is required to establish a functional HA VPN tunnel?

Accepted Answer

Create the HA VPN gateway with two interfaces, then establish only one tunnel from one interface to the on-premises peer gateway. HA VPN gateways in Google Cloud always have two interfaces, each with an external IP address. You cannot create one with only a single interface or disable the second interface. For a peer device that supports only one public IP, the required configuration is to use one tunnel from one HA VPN interface to the peer, leaving the second tunnel/interface unused. This still works but does not meet the 99.99% HA SLA.

Answer

Configure the HA VPN gateway with two interfaces and use BGP to load balance traffic

Answer

Use a Cloud Router with custom route advertisements to the on-premises network

Answer

Create a Classic VPN tunnel instead of HA VPN

Question 6

An application running on Compute Engine needs to be accessible from the internet on port 443. The instance has an internal IP only. Which steps are necessary to allow internet traffic?

Accepted Answer

Use Cloud Load Balancing with an HTTPS load balancer to forward traffic to the instance. Because the Compute Engine instance has only an internal IP, it cannot receive inbound connections from the internet directly. A Cloud Load Balancer with an external IP and an HTTPS frontend can accept internet traffic on port 443 and forward it to the instance's internal IP over the VPC, which is the supported architecture for exposing internal-only backends. This satisfies the requirement without exposing the VM itself.

Answer

Configure a VPN from the internet to the VPC

Answer

Create a Cloud NAT gateway and a firewall rule allowing ingress on port 443

Answer

Assign an external IP to the VM and create a firewall rule allowing ingress from 0.0.0.0/0 on port 443

Question 7

A company uses Cloud SQL for PostgreSQL and wants to reduce costs for a development environment that is only used for 8 hours a day (Monday-Friday). The database is under 100 GB and does not require high availability. Which action is the most cost-effective?

Accepted Answer

Change the activation policy to ON_DEMAND. Changing the Cloud SQL instance's activation policy to ON_DEMAND allows the instance to be stopped and started on a schedule, so you only pay for storage while it is off, which is ideal for a dev database used 8 hours a day, 5 days a week. This is the native, supported mechanism for pausing a Cloud SQL instance and directly reduces compute costs without manual intervention or architectural changes.

Answer

Use a smaller machine type and add a read replica

Answer

Migrate to Cloud Spanner for better cost efficiency

Answer

Enable deletion protection and manually stop the instance after hours, start it before hours

Question 8

A company has a GKE Autopilot cluster and wants to run a stateful application that requires persistent volumes with high read/write throughput. The application is deployed in a single region and does not require multi-region redundancy. Which storage option is the best choice for the persistent volumes?

Accepted Answer

Compute Engine persistent disks (SSD) using the 'premium-rwo' StorageClass (backed by pd-ssd). Compute Engine persistent disks (SSD) provide high-throughput block storage with ReadWriteOnce semantics, ideal for stateful workloads like databases on GKE Autopilot. They are zonal/regional (single-region) and don't require multi-region redundancy, matching the stated requirement. On GKE Autopilot, SSD-backed persistent disks are provisioned via the built-in 'premium-rwo' StorageClass (backed by pd-ssd); 'standard-rwo' is backed by pd-standard.

Answer

Cloud Filestore (NFS)

Answer

Bigtable

Answer

Cloud Storage FUSE

Question 9

An organization wants to set up a hybrid cloud connection between their on-premises data center and Google Cloud VPC. They need high availability (99.99% SLA) and support for dynamic routing. Which connection method should they use?

Accepted Answer

HA VPN with BGP. HA VPN with BGP is the correct choice because it provides a 99.99% availability SLA when configured with two interfaces and two tunnels, and it natively supports dynamic routing via BGP. This meets both the high availability and dynamic routing requirements for a hybrid cloud connection.

Answer

Cloud NAT

Answer

Dedicated Interconnect

Answer

Classic VPN with static routing

Question 10

A development team wants to deploy a containerized microservice that requires GPU acceleration for inference. They want to minimize cost while maintaining the ability to scale to zero when not in use. Which two services meet these requirements? (Choose TWO.)

Accepted Answer

GKE Standard cluster with GPU node pool and cluster autoscaler. Option C is correct because a GKE Standard cluster with a GPU node pool and cluster autoscaler can scale the GPU nodes down to zero when there is no workload, and it supports GPU-accelerated containerized inference workloads. Option E is correct because GKE Autopilot supports GPU workloads and can scale pods and nodes down to zero when idle, while reducing operational overhead and cost. Option A is not correct because Cloud Run does not support GPU acceleration for this scenario. Option B is not correct because Cloud Functions does not offer GPU-backed execution. Option D is not correct because a Compute Engine managed instance group with GPUs does not natively scale to zero while preserving the required GPU inference capability.

Answer

Cloud Run

Answer

Cloud Functions with GPU

Answer

Compute Engine with GPUs in a managed instance group

Question 11

A company needs to store petabytes of time-series IoT sensor data and query it with single-digit millisecond latency at millions of reads per second. The data has a simple key-value structure with timestamps. Which Google Cloud database is MOST appropriate?

Accepted Answer

Cloud Bigtable. Cloud Bigtable is the most appropriate choice because it is a fully managed, scalable NoSQL database designed for large analytical and operational workloads, handling petabytes of data with consistent single-digit millisecond latency for high-throughput read and write operations. Its key-value store with timestamp-based versioning is ideal for time-series IoT sensor data, and it supports millions of reads per second via its integration with Bigtable's HBase API and automatic sharding.

Answer

Cloud Spanner

Answer

BigQuery

Answer

Firestore

Question 12

A company has a VPC with an auto-mode network and wants to connect two on-premises data centers to their Google Cloud environment using Cloud VPN tunnels. They need high availability and must use the same VPC network. Which architecture meets these requirements?

Accepted Answer

Create two separate HA VPN gateways in the same region, each connected to a different on-premises gateway. Creating two separate HA VPN gateways in the same region provides gateway-level redundancy. Each HA VPN gateway has two interfaces connected to separate on-premises VPN devices, ensuring that if one gateway or tunnel fails, traffic can still flow through the other. This architecture uses the same VPC network and supports dynamic routing (BGP) for automatic failover. Option D is invalid because a single HA VPN gateway has both interfaces in the same region; it cannot span two different regions. Options A and B do not provide high availability as they rely on single tunnels or gateways.

Answer

Create two classic VPN tunnels from the same gateway to each on-premises gateway

Answer

Use Cloud VPN with dynamic routing and a single tunnel to each site

Answer

Create one HA VPN gateway with two interfaces in two different regions, each connected to a separate on-premises VPN device

Question 13

A development team needs to create a Cloud Storage bucket that will store sensitive financial data. The bucket must be encrypted with a customer-managed encryption key (CMEK) and must have versioning enabled. Which command correctly creates this bucket?

Accepted Answer

gcloud beta storage buckets create gs://my-bucket --cmek=projects/my-project/locations/us-central1/keyRings/my-ring/cryptoKeys/my-key --enable-versioning. The correct command is D because it uses `gcloud beta storage buckets create` with `--cmek` for CMEK and `--enable-versioning` to enable versioning. Option A is incorrect because `--versioning` is not a valid flag; the correct flag is `--enable-versioning`. The beta command in D properly supports both CMEK and versioning.

Answer

gcloud storage buckets create gs://my-bucket --location=us-central1 --encryption-key=projects/my-project/locations/us-central1/keyRings/my-ring/cryptoKeys/my-key --versioning

Answer

gsutil mb -c regional -l us-central1 gs://my-bucket

Answer

gsutil mb -c regional -l us-central1 --cmek=projects/my-project/locations/us-central1/keyRings/my-ring/cryptoKeys/my-key gs://my-bucket

Question 14

A company needs to run a batch job every hour on a Compute Engine VM. The VM should be terminated after the job completes to save costs. The job is run from a script inside a custom container image stored in Container Registry. Which approach is the most cost-effective?

Accepted Answer

Create a VM with a preemptible instance setting and a startup script that runs the container, then shuts down the VM. A preemptible VM with a startup script that pulls the container from Container Registry, runs the batch job, and then shuts itself down is the cheapest option because preemptible instances cost up to 80% less than standard VMs and the VM only exists for the duration of the job. The startup script handles the container execution and the shutdown, so no external scheduler or always-on infrastructure is required. This matches the requirement of running hourly and terminating after completion.

Answer

Use a managed instance group with autoscaling and a target CPU load of 0%

Answer

Use a regular VM and stop it manually when the job finishes

Answer

Use Cloud Run with a scheduled job

Question 15

A company has a Cloud Storage bucket that stores sensitive files. They want to ensure that objects are automatically deleted after 30 days to comply with data retention policies. Additionally, they need to keep a copy of all object deletions for audit purposes. Which combination of bucket settings should they use?

Accepted Answer

Enable object versioning and add a lifecycle rule with condition 'Age: 30 days' and action 'Delete' for the current version. To automatically delete objects after 30 days and keep a copy of all deletions for audit, enable object versioning and add a lifecycle rule with condition 'Age: 30 days' and action 'Delete' for the current version. Object versioning retains noncurrent versions when the current version is deleted, thus preserving a copy for audit.

Answer

Enable bucket lock and use object holds

Answer

Enable object versioning and set a retention policy with a retention period of 30 days

Answer

Enable a lifecycle rule with condition 'Age: 30 days' and action 'Delete'