Google ACE Deploying and implementing a cloud solution Practice Test 4 — 15 Questions

Question 1

You are deploying a stateful application to GKE that requires each pod to have its own dedicated persistent disk, and each disk must persist data even if the pod is rescheduled to a different node. Which Kubernetes object type should you use?

Accepted Answer

StatefulSet with volumeClaimTemplates to provision individual PVCs per pod.. A StatefulSet with volumeClaimTemplates is the correct choice because it automatically provisions a unique PersistentVolumeClaim (PVC) for each pod replica, ensuring each pod gets its own dedicated persistent disk. When a pod is rescheduled to a different node, the PVC remains bound to its original PersistentVolume (PV), allowing the new pod to mount the same disk and retain the data. This meets the requirement for both per-pod dedicated storage and data persistence across rescheduling events.

Answer

Deployment with a shared PersistentVolumeClaim mounted by all pods.

Answer

DaemonSet with a hostPath volume on each node.

Answer

Deployment with an emptyDir volume for each pod.

Question 2

You need to deploy a new version of an App Engine standard environment application. The new version should receive 10% of traffic while the current version continues to receive 90%. Which command achieves this?

Accepted Answer

`gcloud app services set-traffic default --splits v1=0.9,v2=0.1`. Option B is correct because the `gcloud app services set-traffic` command explicitly splits traffic between versions of an App Engine service. By specifying `--splits v1=0.9,v2=0.1`, you direct 90% of requests to version v1 and 10% to version v2, without deploying a new version or promoting it. This is the standard method for gradual traffic migration in App Engine standard environment.

Answer

`gcloud app deploy --version=v2 --no-promote`

Answer

`gcloud app versions migrate v2`

Answer

`gcloud app deploy --version=v2 --promote --stop-previous-version`

Question 3

A Cloud Build pipeline builds a container image and pushes it to Artifact Registry. The next step needs to deploy the image to Cloud Run. The pipeline runs as the Cloud Build service account. What minimum permission does the Cloud Build SA need for the deployment step?

Accepted Answer

`roles/run.admin` and `roles/iam.serviceAccountUser` on the Cloud Run runtime service account.. The Cloud Build service account needs `roles/run.admin` to deploy services to Cloud Run, but it also requires `roles/iam.serviceAccountUser` on the Cloud Run runtime service account (the identity the Cloud Run service runs as) because the deployment step impersonates that runtime service account to create or update the service. Without the `iam.serviceAccountUser` permission, the deployment fails with a permission denied error, even if the Cloud Build SA has full Cloud Run admin rights.

Answer

`roles/run.admin` only.

Answer

`roles/owner` to ensure all necessary permissions are covered.

Answer

`roles/cloudbuild.builds.editor` on the Cloud Run project.

Question 4

You deploy a Cloud Function (gen1) that calls an external API. During testing you find the function times out after 60 seconds even though you set `--timeout=540`. You also notice the function logs show execution completing in 45 seconds before the timeout. What is the most likely cause of the external timeout?

Accepted Answer

The HTTP client library used in the function has a default 60-second socket/connection timeout.. Option B is correct because the external API call is timing out due to the HTTP client library's default socket/connection timeout, which is often set to 60 seconds. Even though the Cloud Function's overall timeout is configured to 540 seconds, the HTTP request itself has its own timeout that expires before the function completes. The function logs show execution finishing in 45 seconds, indicating the function code completes, but the external API call fails silently or the response is not received within the client's timeout window.

Answer

Cloud Functions gen1 has a hard maximum timeout of 60 seconds regardless of configuration.

Answer

Cloud VPC restricts outbound connections to 60 seconds.

Answer

The function's service account lacks permission to make outbound HTTP calls.

Question 5

You need to run a database migration script once before deploying a new version of an application to GKE. The migration must complete before any application pods start. Which Kubernetes feature enables this pattern?

Accepted Answer

A Kubernetes init container in the Pod spec that runs the migration script.. Init containers run sequentially before the main application containers in a Pod start, ensuring the migration script completes before any application pods become ready. This guarantees the migration runs exactly once per Pod lifecycle, which aligns with the requirement that the migration must finish before deployment.

Answer

A Kubernetes CronJob scheduled to run the migration before deployment.

Answer

A readiness probe that runs the migration script before marking the pod as ready.

Answer

A Kubernetes Job that runs the migration, with the Deployment configured to start only after the Job completes.

Question 6

You run `kubectl get pods` and see a pod in `ImagePullBackOff` state. What are the two most common causes of this error?

Accepted Answer

Incorrect image name/tag, or missing pull credentials for a private registry.. The `ImagePullBackOff` state indicates that the kubelet is unable to pull the container image from the registry. The two most common causes are an incorrect image name or tag (e.g., a typo or a non-existent tag), which results in a `404 Not Found` from the registry, and missing or invalid pull credentials for a private registry, which results in a `401 Unauthorized` or `403 Forbidden` response. Both prevent the image from being downloaded, causing the pod to enter a backoff loop.

Answer

Insufficient CPU/memory on the node, or the pod's resource requests are too high.

Answer

The pod's liveness probe is failing, causing the container to restart.

Answer

The container's entrypoint command is failing, causing the image pull to abort.

Question 7

Your Cloud Build pipeline needs to reference environment-specific configuration: `PROJECT_ID`, `REGION`, and `IMAGE_TAG` (generated from the Git commit SHA). Where should you define these values in `cloudbuild.yaml`?

Accepted Answer

Use built-in substitutions (`$PROJECT_ID`, `$COMMIT_SHA`) and define custom substitutions (`$_REGION`) in the trigger or `--substitutions` flag.. Option B is correct because Cloud Build provides built-in substitutions like `$PROJECT_ID` and `$COMMIT_SHA` that automatically resolve to the current project ID and the Git commit SHA, respectively. Custom substitutions like `$_REGION` can be defined in the trigger configuration or passed via the `--substitutions` flag, allowing environment-specific values to be injected without hardcoding. This approach keeps the `cloudbuild.yaml` reusable across environments and avoids exposing sensitive or variable data in the build file.

Answer

Hardcode the values directly in each build step's `args` field.

Answer

Store all values in Cloud Secret Manager and retrieve them in each build step.

Answer

Use a `.env` file committed to the repository and source it in build steps.

Question 8

You have pushed a new container image to Artifact Registry. The image is tagged `us-central1-docker.pkg.dev/my-project/my-repo/app:v2.0`. You need to deploy this specific image version to Cloud Run in production. Which command deploys this exact image?

Accepted Answer

`gcloud run deploy app --image us-central1-docker.pkg.dev/my-project/my-repo/app:v2.0 --region us-central1`. Option A is correct because the `gcloud run deploy` command with the `--image` flag explicitly specifies the exact container image URI from Artifact Registry, including the tag `v2.0`. This ensures that Cloud Run deploys that precise version of the image, and the `--region` flag targets the correct regional service. The full URI is required because Cloud Run must pull the image from the exact repository path and tag.

Answer

`gcloud run services update app --tag v2.0 --region us-central1`

Answer

`docker push us-central1-docker.pkg.dev/my-project/my-repo/app:v2.0` followed by a Cloud Run auto-deploy.

Answer

`gcloud run deploy app --image app:v2.0 --region us-central1`

Question 9

You are managing Terraform state for a GCP infrastructure project shared by a team of 5 engineers. You need to prevent simultaneous `terraform apply` operations from causing state corruption. What is the recommended backend configuration?

Accepted Answer

Configure the `gcs` backend in Terraform, pointing to a Cloud Storage bucket with versioning enabled.. Option B is correct because the `gcs` backend with versioning enabled provides both remote state storage and built-in state locking via Cloud Storage's object-level consistency model. When one engineer runs `terraform apply`, the backend acquires a lock by writing a lock file to the bucket; other concurrent operations are blocked until the lock is released, preventing state corruption. Versioning further protects against accidental state deletion or corruption by allowing rollback to previous state versions.

Answer

Store state locally on each engineer's machine and merge state files manually after each apply.

Answer

Use Terraform Cloud (HashiCorp) as the backend for state locking.

Answer

Use a Cloud Source Repository to store state files with branch-based locking.

Question 10

You need to deploy a containerized application to GKE that stores user session data. The application has 3 replicas. Session data must not be lost if a replica is restarted. All replicas share the same session store. Which architecture handles this correctly?

Accepted Answer

Store sessions in Cloud Memorystore (Redis) shared by all replicas.. Option B is correct because Cloud Memorystore (Redis) provides a centralized, persistent, and highly available session store that all replicas can access. This ensures session data survives pod restarts and is shared across all replicas, meeting the requirement for no data loss and shared access.

Answer

Store sessions in each pod's memory; use session affinity on the load balancer to route users to the same pod.

Answer

Use an emptyDir volume shared between replicas for session storage.

Answer

Store sessions in a Cloud SQL table with a connection pool per replica.

Question 11

A GKE node pool needs to be upgraded to a new node version. The cluster has 10 nodes. You need to minimize disruption to running workloads — no more than 2 nodes should be unavailable simultaneously. Which upgrade strategy should you configure?

Accepted Answer

Configure surge upgrade with `max-surge: 0, max-unavailable: 2`.. Option A is correct because configuring `max-surge: 0` and `max-unavailable: 2` ensures that during the upgrade, no additional nodes are created (surge), and at most 2 nodes can be unavailable at any time. This directly satisfies the requirement of minimizing disruption by keeping at least 8 nodes available, while allowing the upgrade to proceed in controlled batches.

Answer

Configure surge upgrade with `max-surge: 10, max-unavailable: 10`.

Answer

Manually cordon and drain 2 nodes, upgrade them, then repeat.

Answer

Enable GKE Auto-upgrade with default settings.

Question 12

You have an Artifact Registry repository for Python packages (`format: python`). A developer needs to publish a new Python package to this repository. Which tool and configuration allows them to publish?

Accepted Answer

Use `twine upload` with the Artifact Registry Python repository URL as the repository target.. B is correct because `twine` is the standard tool for uploading Python packages to package indices, and Artifact Registry's Python repositories are compatible with the PyPI API. By specifying the Artifact Registry repository URL as the `--repository-url` target in `twine upload`, the developer can authenticate via a service account or OAuth token and publish the package directly.

Answer

Use `pip install` pointing to the Artifact Registry URL to upload the package.

Answer

Use `docker push` to push the Python package as a container layer.

Answer

Use `gsutil cp` to copy the wheel file to the Artifact Registry bucket.

Question 13

You are deploying a Cloud Run service revision that should initially receive 0% of traffic (for testing via a direct URL), while the existing revision continues to serve 100% of production traffic. Which `gcloud run deploy` flag achieves this?

Accepted Answer

`--no-traffic`. The `--no-traffic` flag on `gcloud run deploy` deploys a new revision but directs 0% of traffic to it, leaving the existing revision serving 100% of production traffic. This allows you to test the new revision via its direct URL without impacting live users. It is the correct and explicit way to achieve a zero-traffic deployment in Cloud Run.

Answer

`--traffic=0`

Answer

`--revision-suffix=canary` with no traffic configuration

Answer

`--min-instances=0 --max-instances=0`

Question 14

You want to use Kustomize to manage environment-specific Kubernetes configurations (dev, staging, prod) from a single base set of manifests. How does Kustomize achieve environment customization without duplicating YAML files?

Accepted Answer

Kustomize uses overlays that patch a shared base: environment-specific differences are expressed as patches without duplicating base manifests.. Kustomize uses a base set of Kubernetes manifests and applies environment-specific overlays that contain patches. These patches modify only the differences (e.g., replicas, image tags, namespaces) without copying or altering the original base YAML files. This approach avoids duplication and keeps the base clean, with each overlay representing a distinct environment.

Answer

Kustomize duplicates all YAML files per environment, then applies find-and-replace on values.

Answer

Kustomize uses Helm charts with values files per environment for templating.

Answer

Kustomize requires a separate Git branch per environment where manifests are committed.

Question 15

A Cloud Function (gen2) is triggered by Pub/Sub messages. The function processes each message by calling three external APIs sequentially. The total processing time is 25 seconds per message. The Pub/Sub subscription's ack deadline is 10 seconds. What will happen, and how should you fix it?

Accepted Answer

Messages will be redelivered before processing completes; extend the Pub/Sub subscription ack deadline to exceed 25 seconds.. The Pub/Sub subscription has a 10-second ack deadline, but the Cloud Function takes 25 seconds to process each message. Since the function does not acknowledge the message within the deadline, Pub/Sub considers the message unacknowledged and redelivers it, causing duplicate processing. The fix is to increase the ack deadline to exceed 25 seconds, ensuring the function has enough time to complete processing and send an acknowledgment.

Answer

Pub/Sub will wait indefinitely for the function to acknowledge; no issue occurs.

Answer

The Cloud Function will automatically extend its own ack deadline via the Pub/Sub client library.

Answer

Increase the Cloud Function's memory to process faster and complete within 10 seconds.