Google ACE Planning and Configuring a Cloud Solution Practice Test 3 — 15 Questions

Question 1

A company is deploying a new three-tier web application on Google Cloud. The web and application tiers run on Compute Engine managed instance groups, and the database tier runs on Cloud SQL for PostgreSQL. The security team requires that the database only accept connections from the application tier's instances, and that no instance can reach the database over the public internet. The application tier instances are in the us-central1 region and use a single VPC network named prod-vpc. What should the company do to meet these requirements with the least administrative effort?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the Cloud SQL instance with a private IP address using Private Service Connect, and connect the application tier using the private IP over the VPC network.. Private Service Connect gives the Cloud SQL instance an internal IP address that is only routable inside the consumer VPC, so application instances connect privately without proxies or public addresses. This satisfies the security requirement that no instance can reach the database over the public internet and keeps administration minimal because the existing VPC routing and firewall model applies.

Answer

Configure the Cloud SQL instance with a public IP address and create a firewall rule in prod-vpc that allows traffic on port 5432 only from the application tier's instance group.

Answer

Create a separate VPC network for the database tier, peer it with prod-vpc, and configure the Cloud SQL instance with a public IP that is only advertised to the peered network.

Answer

Keep the Cloud SQL public IP and install the Cloud SQL Auth Proxy on each application instance, then restrict access using Cloud SQL authorized networks to the instances' external IPs.

Question 2

A company is migrating a legacy monolithic application to Google Cloud. The application has unpredictable traffic patterns and long-running connections. The team wants to minimize operational overhead and only pay for resources when the application is processing requests. Which compute option should they choose?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless container platform that scales to zero when idle and bills only for actual request processing time (down to 100ms granularity). It handles unpredictable traffic and long-running HTTP/gRPC connections natively, with no cluster or node management. This matches the requirements of minimal operational overhead and pay-per-use.

Answer

Google Kubernetes Engine (GKE) Autopilot cluster

Answer

Compute Engine with managed instance groups and autoscaling

Answer

Google Kubernetes Engine (GKE) Standard cluster with node autoscaling

Question 3

An engineer needs to create a Cloud Storage bucket for storing archival data that will be accessed less than once a year. The data must be stored durably and cost-effectively. Which storage class should the engineer use?

Accepted Answer

Archive. Archive is the correct choice because it is Google Cloud's lowest-cost storage class, designed for data accessed less than once per year. It offers the same 99.999999999% (11 nines) durability as other Cloud Storage classes, so the archival data remains highly durable. Its retrieval costs and minimum storage duration (365 days) align with the infrequent access pattern, making it the most cost-effective option for this use case.

Answer

Coldline

Answer

Standard

Answer

Nearline

Question 4

An engineer needs to deploy a containerized web application that receives HTTP requests and should scale to zero when not in use. The application is stateless and has a lightweight container image. Which Google Cloud compute service should be used?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless platform that scales to zero when no requests are coming in, and bills per request. It is ideal for stateless HTTP-triggered container workloads.

Answer

Compute Engine with a single VM

Answer

Cloud Functions

Answer

Google Kubernetes Engine (GKE) Standard cluster

Question 5

A company wants to set up a hybrid network between their on-premises data center and Google Cloud. They need a highly available VPN connection with 99.99% SLA. Which VPN solution should they choose?

Accepted Answer

HA VPN. HA VPN is the only Google Cloud VPN solution that provides a 99.99% availability SLA when configured with two or more tunnels across two interfaces. It uses two or more external IP addresses on the Cloud VPN gateway, and each tunnel connects to a separate on-premises peer, enabling active-active or active-passive redundancy. Classic VPN offers only 99.9% SLA and does not support the same high-availability topology.

Answer

Classic VPN

Answer

Cloud Interconnect

Answer

Cloud NAT

Question 6

An engineer is designing a VPC for a multi-tier application. The application has web servers that need direct internet access, and a private database tier that must not have public IP addresses. The database tier needs outbound internet access to download updates. Which network configuration should the engineer implement?

Accepted Answer

Place web servers in a subnet with public IPs, and database servers in a separate subnet with Cloud NAT and no public IP. The correct design places web servers in a public subnet with public IPs (or an internet gateway) for direct inbound access, and database servers in a private subnet with no public IPs but with Cloud NAT for outbound-only internet access. This satisfies both requirements: web servers are reachable from the internet, and database servers can download updates without being publicly addressable.

Answer

Place web servers in a subnet with Cloud NAT, and database servers in the same subnet without public IP

Answer

Place both tiers in the same subnet with no public IPs and use Cloud NAT for all outbound traffic

Answer

Place web servers in a subnet with Cloud NAT, and database servers in a subnet with public IPs and firewall rules to restrict inbound

Question 7

An organization needs a NoSQL document database with real-time synchronization across multiple client devices. Which Google Cloud service should they use?

Accepted Answer

Firestore. Firestore is a NoSQL document database with real-time synchronization across client devices, making it ideal for mobile and web apps that need live updates. It provides SDKs for offline support and automatic data sync.

Answer

Cloud SQL

Answer

Cloud Bigtable

Answer

Cloud Datastore

Question 8

A company is running a stateful application on a Compute Engine instance with a 200 GB persistent disk. They want to reduce costs by moving the disk to a lower-cost storage class, but the disk is currently in use. They plan to take a snapshot of the disk and create a new disk from the snapshot with the new storage class. However, they need minimal downtime. What is the correct approach?

Accepted Answer

Take a snapshot of the disk, create a new disk from the snapshot with the new storage class, then detach the old disk and attach the new disk to the same VM. To change the storage class of a persistent disk, you cannot directly change it; you must create a new disk from a snapshot. To minimize downtime, you can create a snapshot while the VM is running (crash-consistent if on a live instance), then create a new disk with the desired storage class, stop the VM, detach the old disk, attach the new disk, and start the VM. This results in a brief downtime but is the standard method.

Answer

Use the 'gcloud compute disks update' command to change the storage class while the disk is attached to a running VM

Answer

Create a new disk with the new storage class and use rsync to copy data from the old disk while both are attached to the same VM

Answer

Stop the VM, take a snapshot, create a new disk with the new storage class, and start the VM with the new disk

Question 9

A company wants to run a stateless containerized web application that scales to zero when not in use. The application receives HTTP requests and must be billed only for the resources consumed during request processing. Which Google Cloud compute service is most appropriate?

Accepted Answer

Cloud Run. Cloud Run is a serverless container platform that scales to zero and charges per request, CPU, and memory used during request processing. It is ideal for stateless HTTP-triggered workloads.

Answer

Google Kubernetes Engine (GKE) Standard

Answer

Cloud Functions

Answer

Compute Engine

Question 10

An organization has a VPC with instances in two subnets: subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). They want to allow HTTP traffic from any instance in subnet-a to any instance in subnet-b. What firewall rule should be created?

Accepted Answer

An ingress rule on subnet-b allowing traffic from 10.0.1.0/24 on TCP port 80. Firewall rules are defined with direction and source/target. To allow inbound traffic to subnet-b from subnet-a, an ingress rule with source range 10.0.1.0/24 is needed.

Answer

An egress rule on subnet-b allowing traffic to 10.0.1.0/24 on TCP port 80

Answer

An ingress rule on subnet-a allowing traffic to 10.0.2.0/24 on TCP port 80

Answer

An egress rule on subnet-a allowing traffic to 10.0.2.0/24 on TCP port 80

Question 11

A company runs a batch job every night that processes data from a Cloud Storage bucket and writes results to BigQuery. The job runs on a Compute Engine VM. To minimize costs, what is the best practice for the VM?

Accepted Answer

Use a preemptible VM. Preemptible VMs are up to 80% cheaper and can be terminated at any time, which is acceptable for batch jobs that can be checkpointed or restarted from the beginning.

Answer

Use a VM with GPUs for faster processing

Answer

Use a VM with local SSD for temporary storage

Answer

Use a standard VM and commit to a 1-year commitment

Question 12

A developer is using Cloud Functions (Gen 2) which is based on Cloud Run. They need to handle events from Cloud Storage when a new object is uploaded. Which event type should they use?

Accepted Answer

google.cloud.storage.object.v1.finalized. In Cloud Functions Gen 2, the event type for Cloud Storage object finalization is 'google.cloud.storage.object.v1.finalized'.

Answer

google.cloud.storage.object.v1.metadataUpdated

Answer

google.cloud.storage.object.v1.deleted

Answer

google.cloud.storage.object.v1.archived

Question 13

A company needs to provide outbound internet access to private Compute Engine instances that do not have external IP addresses. The instances must be able to download updates from the internet. Which service should be configured?

Accepted Answer

Cloud NAT. Cloud NAT enables private instances to access the internet for outbound connections while blocking inbound connections from the internet.

Answer

VPC peering

Answer

Cloud VPN

Answer

Private Google Access

Question 14

A DevOps engineer is using the Google Cloud Pricing Calculator to estimate the monthly cost of a Compute Engine VM running 24/7 for one month. The engineer selects a machine type and adds sustained use discounts. What is the correct way to apply sustained use discounts in the calculator?

Accepted Answer

The calculator automatically applies sustained use discounts based on monthly usage. Sustained use discounts are automatically applied by Google Cloud based on the number of hours a VM runs per month. The calculator includes them automatically when you specify the monthly usage.

Answer

Manually enter a discount percentage

Answer

Select 'Sustained Use Discount' checkbox

Answer

Sustained use discounts are not applicable to Compute Engine

Question 15

A company runs a global web application with a Cloud SQL (MySQL) database in the us-east1 region. To improve read performance for users in Europe, they want to offload read traffic to a replica in europe-west1. The replica must be kept in sync with the primary within seconds. Which Cloud SQL configuration should be used?

Accepted Answer

Create a cross-region read replica in europe-west1. A cross-region read replica in europe-west1 is the correct configuration because it creates a replica of the primary Cloud SQL instance in a different region, allowing read traffic to be served locally in Europe. Cloud SQL supports cross-region read replicas for MySQL, which are kept in sync with the primary via asynchronous replication, typically within seconds. This improves read performance for European users by reducing latency.

Answer

Enable automatic failover to a replica in europe-west1

Answer

Configure Cloud SQL for multi-region deployment

Answer

Create an external replica in europe-west1