Google ACE Planning and Configuring a Cloud Solution — Timed 40 Questions

Question 1

A company runs a batch analytics workload on Compute Engine that runs for 3 hours every night. The workload is fault-tolerant and can be disrupted. Which pricing model should the engineer use to minimize cost?

40 minute time limit — choose an answer to begin.

Accepted Answer

Spot VMs. Spot VMs are significantly cheaper than regular VMs and can be terminated at any time, suitable for fault-tolerant batch workloads. They are ideal for short-lived, interruptible jobs.

Answer

Committed use discounts

Answer

On-demand VMs

Answer

Sustained use discounts

Question 2

A company runs a critical application on Compute Engine that requires static IP addresses and must be highly available across zones. The application uses a stateful backend. Which TWO steps should the engineer take to meet these requirements? (Choose 2)

Accepted Answer

Configure an external TCP/UDP load balancer with a static IP address. To achieve high availability across zones with static IPs, use a managed instance group with multiple zones enabled (option C) to distribute instances across zones. An external TCP/UDP load balancer with a static IP address (option A) provides a single static IP and routes traffic to healthy instances via health checks. This combination ensures fault tolerance and a stable IP endpoint.

Answer

Assign each VM a static external IP address

Answer

Use Cloud DNS with geo-routing

Answer

Use a single-zone managed instance group with a snapshot schedule

Question 3

A company is using Cloud Functions (2nd gen) to process high-volume events from Pub/Sub. The function needs to write results to a Cloud Storage bucket. The security team requires that the function uses a service account with the least privilege. Which THREE roles should the engineer assign to the function's service account? (Choose 3)

Accepted Answer

roles/pubsub.subscriber. For a Cloud Function (2nd gen) processing Pub/Sub events and writing to Cloud Storage, the function's runtime service account requires:
1.  'roles/pubsub.subscriber' on the Pub/Sub subscription to receive and acknowledge messages.
2.  'roles/storage.objectCreator' on the Cloud Storage bucket to write results.

The 'roles/cloudfunctions.invoker' role is for the entity that *triggers* the function, not for the function's own service account. For event-driven functions, the Eventarc service account (which mediates 2nd gen triggers) needs 'roles/run.invoker' (which is included in 'cloudfunctions.invoker') on the Cloud Run service backing the function. The function's service account does not invoke itself. Therefore, 'roles/cloudfunctions.invoker' should not be assigned to the function's service account. The question asks for three roles, but only two are clearly applicable to the function's service account based on the problem description and least privilege principles.

Answer

roles/cloudfunctions.invoker

Answer

roles/iam.serviceAccountUser

Answer

roles/pubsub.publisher

Question 4

A developer needs to creare a Cloud Storage bucket with the storage class that automatically moves objects to a lower-cost storage class after 30 days. Which storage class should be used?

Accepted Answer

Autoclass. Autoclass is a feature that automatically transitions objects to appropriate storage classes based on access patterns. The other options (Standard, Nearline, Coldline) are actual storage classes but require manual lifecycle rules to achieve automatic transitions. While Autoclass is not a 'storage class', it is the correct mechanism among the options to fulfill the requirement of automatic object movement to lower-cost storage after 30 days.

Answer

Coldline

Answer

Standard

Answer

Nearline

Question 5

A company wants to migrate a monolithic application to run on Google Cloud. The application consists of multiple services that communicate via REST APIs. The company wants to use managed services and minimize operational overhead. Which two compute services should they consider? (Choose two.)

Accepted Answer

App Engine. App Engine and Cloud Run are fully managed, serverless (or highly abstracted PaaS), and designed for hosting web applications and APIs, making them excellent choices for migrating a monolithic application into multiple REST API services with minimal operational overhead. Cloud Functions are typically best for event-driven, fine-grained microservices, while GKE and Compute Engine require significantly more operational management.

Answer

Cloud Functions

Answer

Google Kubernetes Engine (GKE)

Answer

Compute Engine

Question 6

A company has a Compute Engine VM instance that needs to access a Cloud Storage bucket. The VM uses a service account with the Storage Object Admin role. However, the VM is unable to upload objects. Which two possible causes should be investigated? (Choose two.)

Accepted Answer

The VM's service account does not have the required IAM permission on the bucket. The service account must have the required IAM permission on the bucket (Storage Object Admin grants this at the project level, but bucket-level IAM can override). However, the question asks for two possible causes. The most common causes are that the service account lacks the necessary IAM permission on the bucket (A) or that the VM's access scopes are not configured to allow Cloud Storage API access (D). Option C is essentially the same as A from the bucket side and redundant; if the service account has the role at the project level, the bucket's IAM policy is not the issue unless an explicit deny exists. Option B is incorrect because firewall rules do not block API calls to Cloud Storage. Option E is incorrect because Cloud Storage is global and region mismatch does not affect access.

Answer

A firewall rule is blocking outbound HTTPS traffic

Answer

The bucket's IAM policy does not include the service account

Answer

The VM is not in the same region as the bucket

Question 7

A company needs to store petabytes of time-series IoT sensor data and query it with single-digit millisecond latency at millions of reads per second. The data has a simple key-value structure with timestamps. Which Google Cloud database is MOST appropriate?

Accepted Answer

Cloud Bigtable. Cloud Bigtable is designed for exactly this use case — petabyte-scale, low-latency (single-digit ms), high-throughput NoSQL storage for time-series, IoT, and financial data. It scales horizontally by adding nodes. BigQuery is optimised for analytics (seconds-to-minutes latency) and not for operational reads. Cloud Spanner is a globally distributed relational database with strong consistency, which introduces overhead making it less optimal than Bigtable for pure high-throughput, low-latency key-value reads of time-series data at this scale. Firestore is a document database suitable for application backends, but it is not designed for petabyte-scale time-series data with millions of reads per second.

Answer

BigQuery

Answer

Cloud Spanner

Answer

Firestore

Question 8

A company runs a containerized web application on Google Kubernetes Engine (GKE). The application experiences unpredictable traffic spikes. The team wants to minimize costs by scaling down to zero when idle, but also needs to handle burst traffic quickly. Which GKE mode should they choose?

Accepted Answer

GKE Autopilot. GKE Autopilot is a fully managed GKE mode that handles burst traffic quickly through rapid pod scaling and node provisioning. While it does not scale to zero, it is the best GKE mode for minimizing management and handling traffic spikes. Cloud Run is not a GKE mode, so it is not the correct answer for this question. GKE Standard with node auto-provisioning requires manual configuration and does not scale as quickly, and Compute Engine with managed instance groups is not a GKE mode.

Answer

Cloud Run

Answer

Compute Engine with managed instance groups and autoscaling

Answer

GKE Standard with node auto-provisioning

Question 9

A company is deploying a multi-region application on Compute Engine and needs to configure network security. Which two steps should they take to restrict access to only required traffic? (Choose 2)

Accepted Answer

Use service accounts to restrict traffic between instances. GCP VPC networks have an implicit deny all ingress rule, but also include explicit default allow rules (e.g., for SSH, RDP, internal traffic). To restrict access to only required traffic, you must create specific ingress firewall rules (E) that define allowed sources (IP ranges) and apply them to target instances using network tags. Service accounts (D) provide a robust way to restrict traffic between instances based on identity. Shared VPC (A) is for cross-project networking, not direct traffic restriction. Cloud NAT (C) is for outbound internet access, not inbound. While deleting default allow rules (B) is a good security practice to achieve a least-privilege posture, options D and E are the primary methods for actively defining and applying rules for 'required traffic'.

Answer

Configure Shared VPC to isolate network traffic

Answer

Delete the default allow rules that allow all traffic

Answer

Use Cloud NAT to allow inbound traffic from the internet

Question 10

A development team wants to deploy a containerized microservice that requires GPU acceleration for inference. They want to minimize cost while maintaining the ability to scale to zero when not in use. Which two services meet these requirements? (Choose TWO.)

Accepted Answer

GKE Standard cluster with GPU node pool and cluster autoscaler. GKE Standard with a GPU node pool and cluster autoscaler allows the cluster to scale down to zero nodes when no pods require GPU resources, minimizing cost. The cluster autoscaler automatically removes idle nodes and adds GPU nodes only when GPU-accelerated pods are scheduled, meeting the requirement for scaling to zero.

Answer

Cloud Run

Answer

Cloud Functions with GPU

Answer

Compute Engine with GPUs in a managed instance group

Question 11

A company needs to store petabytes of time-series IoT sensor data and query it with single-digit millisecond latency at millions of reads per second. The data has a simple key-value structure with timestamps. Which Google Cloud database is MOST appropriate?

Accepted Answer

Cloud Bigtable. Cloud Bigtable is the most appropriate choice because it is a fully managed, scalable NoSQL database designed for large analytical and operational workloads, handling petabytes of data with consistent single-digit millisecond latency for high-throughput read and write operations. Its key-value store with timestamp-based versioning is ideal for time-series IoT sensor data, and it supports millions of reads per second via its integration with Bigtable's HBase API and automatic sharding.

Answer

Cloud Spanner

Answer

BigQuery

Answer

Firestore

Question 12

A company has a VPC with an auto-mode network and wants to connect two on-premises data centers to their Google Cloud environment using Cloud VPN tunnels. They need high availability and must use the same VPC network. Which architecture meets these requirements?

Accepted Answer

Create two separate HA VPN gateways in the same region, each connected to a different on-premises gateway. Creating two separate HA VPN gateways in the same region provides gateway-level redundancy. Each HA VPN gateway has two interfaces connected to separate on-premises VPN devices, ensuring that if one gateway or tunnel fails, traffic can still flow through the other. This architecture uses the same VPC network and supports dynamic routing (BGP) for automatic failover. Option D is invalid because a single HA VPN gateway has both interfaces in the same region; it cannot span two different regions. Options A and B do not provide high availability as they rely on single tunnels or gateways.

Answer

Create two classic VPN tunnels from the same gateway to each on-premises gateway

Answer

Use Cloud VPN with dynamic routing and a single tunnel to each site

Answer

Create one HA VPN gateway with two interfaces in two different regions, each connected to a separate on-premises VPN device

Question 13

A development team needs to create a Cloud Storage bucket that will store sensitive financial data. The bucket must be encrypted with a customer-managed encryption key (CMEK) and must have versioning enabled. Which command correctly creates this bucket?

Accepted Answer

gcloud beta storage buckets create gs://my-bucket --cmek=projects/my-project/locations/us-central1/keyRings/my-ring/cryptoKeys/my-key --enable-versioning. The correct command is D because it uses `gcloud beta storage buckets create` with `--cmek` for CMEK and `--enable-versioning` to enable versioning. Option A is incorrect because `--versioning` is not a valid flag; the correct flag is `--enable-versioning`. The beta command in D properly supports both CMEK and versioning.

Answer

gcloud storage buckets create gs://my-bucket --location=us-central1 --encryption-key=projects/my-project/locations/us-central1/keyRings/my-ring/cryptoKeys/my-key --versioning

Answer

gsutil mb -c regional -l us-central1 gs://my-bucket

Answer

gsutil mb -c regional -l us-central1 --cmek=projects/my-project/locations/us-central1/keyRings/my-ring/cryptoKeys/my-key gs://my-bucket

Question 14

An organization needs to run a batch analytics job on BigQuery every night that processes terabytes of data. The job is critical and must complete within a specific time window. To optimize costs, they are considering using flat-rate pricing but want to minimize commitment risk. Which THREE factors should they evaluate?

Accepted Answer

The cost of on-demand query pricing for the same workload. Comparing the cost of on-demand query pricing for the same workload provides a baseline to evaluate whether flat-rate pricing is more economical. Flat-rate pricing is cost-effective for predictable, high-volume workloads, but without understanding the on-demand cost, the organization cannot assess potential savings or commitment risk.

Answer

The number of Cloud Storage buckets used for data staging

Answer

The cost of reserving dedicated hardware for Compute Engine

Question 15

A developer needs to run a one-time SQL query against a large dataset stored in Cloud Storage in Parquet format. The query result will be used for ad-hoc analysis. They want to minimize cost and avoid provisioning any servers. Which service should they use?

Accepted Answer

BigQuery external table query. BigQuery external table query allows you to query data stored in Cloud Storage (including Parquet) directly without loading it, using BigQuery's serverless infrastructure. This minimizes cost because you only pay for the data scanned by the query, and you avoid provisioning any servers. It is ideal for one-time ad-hoc analysis of large datasets.

Answer

Cloud SQL import

Answer

Dataproc cluster

Answer

Compute Engine with Apache Spark installed

Question 16

A company plans to deploy a containerized application on GKE Autopilot. They want to ensure high availability by running multiple replicas across different zones. They also need to expose the application via a load balancer with SSL termination. Which THREE resources should they create?

Accepted Answer

Service. To achieve high availability with multiple replicas across zones and expose the application via a load balancer with SSL termination in GKE Autopilot, the three required resources are: a Deployment to manage replica pods and ensure they run across zones, a Service (typically of type ClusterIP or NodePort) to provide internal connectivity, and an Ingress resource to handle external HTTP/S traffic with SSL termination. A Service of type LoadBalancer creates a TCP/UDP load balancer that does not natively terminate SSL; for SSL termination, an Ingress is the standard approach. Therefore, the correct answers are A (Service), C (Ingress), and E (Deployment).

Answer

StatefulSet

Answer

ConfigMap

Question 17

An organization has a VPC with private instances that need outbound internet access for software updates. The instances have no external IP addresses. Which Google Cloud service should be configured?

Accepted Answer

Cloud NAT. To enable outbound internet access for private VM instances that have no external IP addresses, you configure Cloud NAT. Cloud NAT uses a NAT gateway to provide source network address translation (SNAT) so that instances can reach the internet for updates while remaining unreachable from the internet.

Answer

VPC firewall rules

Answer

Cloud Load Balancing

Answer

Cloud VPN

Question 18

A company is migrating a legacy monolithic application to Google Cloud. The application has unpredictable traffic patterns and long-running connections. The team wants to minimize operational overhead and only pay for resources when the application is processing requests. Which compute option should they choose?

Accepted Answer

Cloud Run. Cloud Run is a serverless compute platform that scales to zero when not in use, has a per-request billing model, and supports HTTP-triggered container workloads. It can handle long-running connections as long as they stay within the request timeout limit. Cloud Run minimizes operational overhead by eliminating server management and scaling automatically.

Answer

Google Kubernetes Engine (GKE) Autopilot cluster

Answer

Compute Engine with managed instance groups and autoscaling

Answer

Google Kubernetes Engine (GKE) Standard cluster with node autoscaling

Question 19

An engineer needs to create a Cloud Storage bucket for storing archival data that will be accessed less than once a year. The data must be stored durably and cost-effectively. Which storage class should the engineer use?

Accepted Answer

Archive. Archive storage class is designed for data accessed less than once a year, with the lowest storage cost but higher retrieval costs and a 365-day minimum storage duration. It is ideal for long-term archival.

Answer

Coldline

Answer

Standard

Answer

Nearline

Question 20

A company plans to run a stateful application on Compute Engine that requires high random I/O performance and the ability to resize the persistent disk without downtime. The application is running on a Linux VM. Which persistent disk type and configuration should the engineer choose?

Accepted Answer

Extreme persistent disk (pd-extreme). Extreme persistent disks are designed for high random I/O workloads, offering up to 120,000 IOPS and the ability to resize without downtime. They are SSD-based and suitable for databases.

Answer

Balanced persistent disk (pd-balanced)

Answer

SSD persistent disk (pd-ssd)

Answer

Standard persistent disk (pd-standard)