Google ACE Deploying and implementing a cloud solution Practice Test 2 — 15 Questions

Question 1

A team wants to roll back a GKE Deployment to its previous revision because the new version introduced a regression. Which kubectl command performs this rollback?

Accepted Answer

kubectl rollout undo deployment/my-app. Option B is correct because `kubectl rollout undo deployment/my-app` is the standard Kubernetes command to roll back a Deployment to the previous revision. This command leverages the Deployment's revision history, which is automatically maintained by the Kubernetes controller, to revert the desired state to the prior revision without needing to manually reapply an old manifest.

Answer

kubectl revert deployment/my-app --to-previous

Answer

kubectl apply -f previous-deployment.yaml

Answer

kubectl delete deployment/my-app && kubectl create -f deployment.yaml

Question 2

A team wants to configure a Cloud Scheduler job to invoke a Cloud Run service endpoint every hour using HTTP POST. The Cloud Run service requires authentication. How should the Scheduler job be configured to authenticate?

Accepted Answer

Configure the Cloud Scheduler job with OIDC authentication using a service account that has Cloud Run Invoker permission. Cloud Scheduler can authenticate to Cloud Run using OIDC (OpenID Connect) by attaching a service account to the job. The scheduler obtains an OIDC token for that service account and includes it as a Bearer token in the Authorization header. The service account must have the `run.invoker` IAM role on the Cloud Run service to authorize the invocation.

Answer

Include a Bearer token in the Authorization header of the scheduled HTTP request

Answer

Make the Cloud Run service publicly accessible and use Cloud Armor to restrict access to Cloud Scheduler IPs

Answer

Configure an API key for the Cloud Run service and include it in the scheduled request URL

Question 3

A team runs a Kubernetes Deployment with 3 replicas behind a Service. They want to expose it externally with HTTPS and route traffic based on URL paths (/api → backend service, / → frontend service). Which Kubernetes resource handles path-based routing at Layer 7?

Accepted Answer

A Kubernetes Ingress resource with path rules. A Kubernetes Ingress resource is the native API object designed for Layer 7 (HTTP/HTTPS) routing, including path-based routing. It allows you to define rules that map URL paths (e.g., /api, /) to different backend Services, and it typically works with an Ingress controller (e.g., NGINX, HAProxy) that terminates TLS and performs the routing. This directly meets the requirement for external HTTPS exposure and path-based traffic splitting.

Answer

A LoadBalancer Service with path routing rules

Answer

A NodePort Service with iptables path routing rules

Answer

Multiple ClusterIP Services with DNS SRV records for path routing

Question 4

A team needs to build a CI/CD pipeline that automatically tests and deploys to GKE when code is pushed to the main branch. Which GCP-native service builds and deploys the code automatically based on source code repository events?

Accepted Answer

Cloud Build with a trigger configured on the repository's main branch. Cloud Build is the correct GCP-native service for building and deploying code automatically based on source code repository events. By configuring a Cloud Build trigger on the main branch, any push to that branch automatically initiates a build and deployment to GKE, fulfilling the CI/CD pipeline requirement without additional orchestration.

Answer

Cloud Composer with a Git polling DAG

Answer

Cloud Run jobs triggered by a Pub/Sub subscription on the repository

Answer

Cloud Functions triggered by Cloud Source Repositories push events

Question 5

A team has a Docker container image locally and wants to push it to Google Artifact Registry. They've already authenticated Docker with GCP. The registry host is 'us-central1-docker.pkg.dev'. Which commands correctly tag and push the image?

Accepted Answer

docker tag myimage us-central1-docker.pkg.dev/myproject/myrepo/myimage:v1 && docker push us-central1-docker.pkg.dev/myproject/myrepo/myimage:v1. Option A is correct because it uses the standard Docker CLI workflow: first tagging the local image with the full Artifact Registry path (including the registry host, project, repository, and image name with tag), then pushing it. Since the team has already authenticated Docker with GCP, the `docker push` command will authenticate via the Docker credential helper and upload the image to the specified Artifact Registry repository.

Answer

gcloud artifacts docker push myimage --location=us-central1 --repository=myrepo

Answer

docker push gcr.io/myproject/myimage:v1

Answer

gcloud container images push myimage:v1 --region=us-central1

Question 6

A team uses Cloud Build to build Docker images and push them to Artifact Registry. The cloudbuild.yaml has a step that requires a secret API key to call an external service during build. How should the secret be provided securely?

Accepted Answer

Reference the API key from Secret Manager using the availableSecrets field in cloudbuild.yaml. Option B is correct because Cloud Build's `availableSecrets` field allows you to securely inject secrets from Secret Manager into build steps as environment variables or files, without exposing them in the build configuration or logs. This approach ensures the API key is encrypted at rest and in transit, and access can be controlled via IAM permissions, making it the only secure method among the options.

Answer

Pass the API key as a build substitution variable in the gcloud builds submit command

Answer

Store the API key in a Cloud Storage bucket and download it in a build step

Answer

Hardcode the API key in the cloudbuild.yaml and store it in the source repository

Question 7

A developer needs to run an interactive shell inside a running GKE Pod named 'api-pod-7d4f9' in the 'production' namespace to investigate a runtime issue. Which kubectl command opens an interactive shell?

Accepted Answer

kubectl exec -it api-pod-7d4f9 -n production -- /bin/bash. Option B is correct because `kubectl exec -it` attaches an interactive terminal to a running container in a Pod, with `-i` for stdin and `-t` for a TTY. The `-- /bin/bash` launches a Bash shell inside the container, allowing the developer to investigate runtime issues. This is the standard Kubernetes method for interactive shell access.

Answer

kubectl ssh api-pod-7d4f9 -n production

Answer

kubectl run debug --image=busybox --attach=api-pod-7d4f9

Answer

gcloud container exec api-pod-7d4f9 --namespace=production -- bash

Question 8

A deployment pipeline runs `kubectl logs` to capture output from a crashed Pod's previous container instance. Which flag retrieves logs from the previous (terminated) container instance rather than the current one?

Accepted Answer

kubectl logs api-pod --previous. The `--previous` flag in `kubectl logs` retrieves logs from the previous (terminated) container instance of a Pod. This is essential for debugging crashes where the current container has restarted, as the logs from the failed instance are preserved and accessible only with this flag.

Answer

kubectl logs api-pod --terminated

Answer

kubectl logs api-pod --all-containers --since-crash

Answer

kubectl describe pod api-pod | grep -A 50 'Last State'

Question 9

A platform team needs a Kubernetes workload that runs exactly one Pod on every node in a GKE cluster — including nodes added in the future. The workload collects host-level metrics. Which Kubernetes resource type should they use?

Accepted Answer

DaemonSet. A DaemonSet ensures that exactly one Pod runs on every node in the cluster, including nodes added after creation. This is the correct resource for host-level metrics collection because it automatically scales with the node pool and guarantees one Pod per node without manual intervention.

Answer

Deployment with replicas set equal to the node count

Answer

StatefulSet with one replica per node

Answer

CronJob running every minute to check and restore missing Pods

Question 10

A distributed database running on GKE requires stable, persistent hostnames (pod-0, pod-1, pod-2) and ordered startup/shutdown for proper cluster initialization. Pods must retain their identity across restarts. Which Kubernetes resource is designed for this?

Accepted Answer

StatefulSet with a headless Service. StatefulSet is the correct resource because it provides stable, unique network identifiers (e.g., pod-0, pod-1, pod-2) via a headless Service, ordered startup and shutdown (pod-0 starts first, pod-2 terminates first), and persistent pod identity that survives restarts. These features are essential for distributed databases like Cassandra or ZooKeeper that require consistent hostnames and initialization order.

Answer

Deployment with pod affinity rules

Answer

DaemonSet with a unique hostname label on each node

Answer

ReplicaSet with a fixed replica count

Question 11

A GKE Deployment runs a web application with 6 replicas across a 3-node cluster. To ensure no two replicas land on the same node (maximizing availability), which Pod spec configuration should be applied?

Accepted Answer

Set podAntiAffinity with requiredDuringSchedulingIgnoredDuringExecution and topologyKey: kubernetes.io/hostname. Option A is correct because `podAntiAffinity` with `requiredDuringSchedulingIgnoredDuringExecution` and `topologyKey: kubernetes.io/hostname` forces the scheduler to place each replica on a different node. This ensures that no two pods of the same Deployment run on the same Kubernetes node, maximizing availability by preventing a single node failure from taking down more than one replica.

Answer

Set podAffinity with requiredDuringSchedulingIgnoredDuringExecution and topologyKey: kubernetes.io/hostname

Answer

Set topologySpreadConstraints with maxSkew: 1 and topologyKey: kubernetes.io/hostname

Answer

Set nodeSelector to a specific node for each replica

Question 12

A team packages their Kubernetes application as a Helm chart. They need to install it into a GKE cluster with the release name 'webapp' in the 'production' namespace, overriding the default image tag to 'v2.1'. Which Helm command achieves this?

Accepted Answer

helm install webapp ./chart -n production --set image.tag=v2.1. Option B is correct because `helm install` is the standard Helm command to deploy a chart into a cluster, and the `--set` flag overrides default values like `image.tag`. The `-n` flag specifies the namespace, and the release name 'webapp' is given as the first argument. This matches the Helm CLI syntax exactly.

Answer

helm deploy webapp ./chart -n production --set image.tag=v2.1

Answer

kubectl apply -f helm-chart.yaml -n production --image-tag=v2.1

Answer

helm apply webapp -n production --chart=./chart --tag=v2.1

Question 13

A team's Cloud Build pipeline must: (1) run unit tests, (2) build a Docker image only if tests pass, (3) push the image to Artifact Registry. Which cloudbuild.yaml structure correctly enforces this sequential dependency?

Accepted Answer

Define all three steps in a single `steps` list — they run sequentially by default and stop on failure. Option A is correct because Cloud Build executes steps in a `steps` list sequentially by default, and any step that exits with a non-zero status (e.g., test failure) immediately stops the entire pipeline. This enforces the required dependency: unit tests must pass before the Docker image is built, and the image must be built before it is pushed to Artifact Registry.

Answer

Use `waitFor` with step IDs to create a dependency graph between all three steps

Answer

Define the steps in three separate cloudbuild.yaml files and chain them with Cloud Composer

Answer

Set `parallel: false` at the top level of cloudbuild.yaml to enforce sequential execution

Question 14

A development team stores Docker images in Artifact Registry. A new team member needs to pull images to their local machine using Docker. Which command authenticates Docker to pull from a specific Artifact Registry repository in us-central1?

Accepted Answer

gcloud auth configure-docker us-central1-docker.pkg.dev. Option B is correct because `gcloud auth configure-docker` is the official Google Cloud command that configures Docker to authenticate to Artifact Registry. When you specify the registry location (e.g., `us-central1-docker.pkg.dev`), it updates Docker's configuration file with the appropriate credential helper, enabling Docker to automatically obtain and refresh short-lived access tokens for pulling images from that specific repository.

Answer

docker login us-central1-docker.pkg.dev --username=_json_key --password-stdin < key.json

Answer

kubectl create secret docker-registry artifactregistry --server=us-central1-docker.pkg.dev

Answer

gcloud artifacts docker auth --region=us-central1

Question 15

A GKE application Pod needs a sidecar container that proxies all outbound network requests through an audit logger before they reach the internet. Both containers share the same network namespace. Which Kubernetes pattern implements this?

Accepted Answer

Add the audit logger as a second container in the same Pod spec (sidecar pattern). Option B is correct because the sidecar pattern allows two containers to share the same network namespace within a single Pod, enabling the audit logger to intercept all outbound traffic from the application container before it reaches the internet. This is achieved by configuring the application container to route its outbound requests through the sidecar (e.g., via a localhost proxy or iptables rules), ensuring all traffic is logged without external network hops.

Answer

Run the audit logger as a separate Deployment and route traffic via a Service

Answer

Use a DaemonSet for the audit logger on each node to intercept node-level traffic

Answer

Add an initContainer to start the audit logger before the main application