Google ACE Deploying and implementing a cloud solution — Timed 20 Questions

Question 1

Which gcloud command creates a Compute Engine VM named 'web-01' using the e2-medium machine type in zone us-central1-a?

Accepted Answer

gcloud compute instances create web-01 --zone=us-central1-a --machine-type=e2-medium. Option B is correct because the `gcloud compute instances create` command is the proper syntax for creating a Compute Engine VM, and it requires the `--machine-type` flag (not `--machine`) to specify the machine type. The zone is specified with `--zone`, and the VM name is provided as a positional argument.

Answer

gcloud vm create web-01 --zone=us-central1-a --machine=e2-medium

Answer

gcloud instances create web-01 --region=us-central1 --type=e2-medium

Answer

gcloud compute create-instance web-01 --zone=us-central1-a --size=e2-medium

Question 2

A developer has a Kubernetes Deployment manifest in a file named 'api-deployment.yaml'. Which command creates the Deployment if it doesn't exist, or updates it if it does?

Accepted Answer

kubectl apply -f api-deployment.yaml. Option C is correct because `kubectl apply -f api-deployment.yaml` uses a declarative approach: it creates the Deployment if it does not exist, or performs a rolling update if it already exists, by applying the desired state defined in the YAML manifest. This command leverages the Kubernetes API's server-side apply logic, merging changes without requiring the resource to be deleted first.

Answer

kubectl create -f api-deployment.yaml

Answer

kubectl run api-deployment.yaml

Answer

kubectl deploy -f api-deployment.yaml

Question 3

A team wants to deploy a container image at 'gcr.io/myproject/api:v2' as a Cloud Run service named 'api-service' in us-east1, accessible without authentication. Which command is correct?

Accepted Answer

gcloud run deploy api-service --image=gcr.io/myproject/api:v2 --region=us-east1 --allow-unauthenticated. Option A is correct because it uses the `gcloud run deploy` command with the `--image` flag to specify the container image, `--region=us-east1` to target the correct region, and `--allow-unauthenticated` to make the service publicly accessible without authentication. This matches the exact requirements for deploying a Cloud Run service with public access.

Answer

gcloud run create api-service --image=gcr.io/myproject/api:v2 --zone=us-east1 --public

Answer

gcloud cloud-run deploy api-service --container=gcr.io/myproject/api:v2 --region=us-east1

Answer

gcloud run deploy --name=api-service --image=gcr.io/myproject/api:v2 --region=us-east1 --no-auth

Question 4

A team needs a GKE cluster named 'prod-cluster' in the us-central1 region with cluster autoscaling enabled, scaling between 3 and 10 nodes. Which command achieves this?

Accepted Answer

gcloud container clusters create prod-cluster --region=us-central1 --num-nodes=3 --enable-autoscaling --min-nodes=3 --max-nodes=10. Option A is correct because it uses the `gcloud container clusters create` command with the `--enable-autoscaling` flag, which enables cluster autoscaler for the GKE cluster. The `--min-nodes=3` and `--max-nodes=10` flags define the scaling range, while `--num-nodes=3` sets the initial node count, ensuring the cluster starts with 3 nodes and can scale up to 10 as needed. The `--region=us-central1` specifies a regional cluster, which is appropriate for production workloads requiring high availability across zones.

Answer

gcloud kubernetes clusters create prod-cluster --location=us-central1 --autoscale=3:10

Answer

gcloud container cluster create prod-cluster --zone=us-central1 --scaling=3-10

Answer

kubectl create cluster prod-cluster --region=us-central1 --autoscale --min=3 --max=10

Question 5

Which command creates a Cloud Storage bucket named 'my-archive-bucket' in the US multi-region using the modern gcloud CLI?

Accepted Answer

gcloud storage buckets create gs://my-archive-bucket --location=US. Option B is correct because the modern gcloud CLI uses the `gcloud storage buckets create` command to create a Cloud Storage bucket, and the `--location=US` flag specifies the US multi-region. This command is part of the newer, unified `gcloud storage` command group that replaces the older `gsutil` tool for bucket management.

Answer

gcloud storage mk gs://my-archive-bucket --location=US

Answer

gcloud cloud-storage create my-archive-bucket --region=US

Answer

gsutil mk -l US gs://my-archive-bucket

Question 6

A Cloud Function must execute automatically every time a new object is written to a specific Cloud Storage bucket. Which trigger type should be configured for the function?

Accepted Answer

Cloud Storage trigger (object finalized event). The Cloud Storage trigger (object finalized event) is the correct choice because Cloud Functions natively supports Cloud Storage events via the `google.storage.object.finalize` event type, which fires when a new object is created or an existing object is overwritten in a bucket. This trigger automatically invokes the function without requiring any intermediary service, directly binding the function to the bucket's notification system.

Answer

HTTP trigger

Answer

Pub/Sub trigger

Answer

Cloud Scheduler trigger

Question 7

A developer has an App Engine Standard application ready to deploy. The app.yaml file is in the current working directory. Which command deploys the application?

Accepted Answer

gcloud app deploy. The `gcloud app deploy` command is the correct way to deploy an App Engine Standard application when the `app.yaml` file is present in the current working directory. This command automatically detects the configuration file and uploads the application code to the specified App Engine service, handling the deployment process including staging, versioning, and traffic migration.

Answer

gcloud app create --config=app.yaml

Answer

gcloud appengine deploy app.yaml

Answer

gcloud run deploy --platform=appengine

Question 8

A network team is creating a new VPC and must decide between auto mode and custom mode. Why would they choose custom mode?

Accepted Answer

Custom mode allows full control over which regions have subnets and what CIDR ranges are used. Custom mode VPCs give the network team full control over the IP address range (CIDR block) and the ability to create subnets in any region, unlike auto mode VPCs which automatically create subnets in every region with a fixed /20 range per region. This is essential when you need to avoid overlapping CIDRs with on-premises networks or other VPCs, or when you want to restrict subnets to specific regions for compliance or cost reasons.

Answer

Auto mode VPCs cost more per subnet than custom mode

Answer

Auto mode VPCs cannot be used with GKE clusters

Answer

Custom mode VPCs support more IP addresses per subnet than auto mode

Question 9

A team has a streaming pipeline built with Apache Beam that reads from Cloud Pub/Sub and writes transformed data to BigQuery. Which GCP service executes this pipeline with managed autoscaling?

Accepted Answer

Cloud Dataflow. Cloud Dataflow is the correct service because it is a fully managed, autoscaling service specifically designed to execute Apache Beam pipelines. It handles the reading from Cloud Pub/Sub and writing to BigQuery, automatically scaling worker resources based on the pipeline's processing demands.

Answer

Cloud Composer

Answer

Cloud Dataproc

Answer

Cloud Data Fusion

Question 10

A DevOps team uses Terraform to manage GCP infrastructure and wants to store Terraform state in a shared location that all team members can access securely, with state locking to prevent concurrent modifications. Which backend configuration achieves this?

Accepted Answer

gcs backend storing state in a Cloud Storage bucket. The `gcs` backend is the correct choice because it stores Terraform state in a Google Cloud Storage bucket, which provides secure, shared access via IAM policies and supports state locking natively through object versioning and write-preconditions. This ensures that only one team member can modify the state at a time, preventing conflicts and corruption.

Answer

gcp backend storing state in a BigQuery table

Answer

remote backend connected to a Cloud SQL database

Answer

local backend with a path shared over Cloud Filestore

Question 11

A DevOps engineer needs to deploy a new GKE Pod that mounts a ConfigMap named 'app-config' as environment variables. The ConfigMap already exists in the cluster. Which YAML snippet correctly references it?

Accepted Answer

envFrom: - configMapRef: name: app-config. Option A is correct because the `envFrom` field with a `configMapRef` allows a Pod to load all key-value pairs from a ConfigMap as environment variables. This is the standard Kubernetes syntax for injecting ConfigMap data into a container's environment without specifying individual keys.

Answer

volumes: - name: config / configMap: name: app-config

Answer

env: - name: CONFIG / valueFrom: secretKeyRef: name: app-config

Answer

envFrom: - secretRef: name: app-config

Question 12

A team deploys a containerized service to Cloud Run. After deployment, requests are timing out after 60 seconds. The service sometimes needs 3 minutes to process certain long-running requests. What should the team adjust?

Accepted Answer

Increase the Cloud Run request timeout to at least 180 seconds. Cloud Run has a default request timeout of 60 seconds. Since the service requires up to 3 minutes (180 seconds) for certain long-running requests, the timeout must be increased to at least 180 seconds. This is configured via the `--timeout` flag or the `timeout_seconds` field in the YAML configuration, and the maximum allowed value is 60 minutes (3600 seconds).

Answer

Increase the minimum number of instances to reduce cold starts

Answer

Set concurrency to 1 to ensure each instance handles only one request at a time

Answer

Switch to Cloud Run Jobs instead of Cloud Run Services

Question 13

A platform team is deploying a multi-tier application on GKE: a frontend Deployment, a backend Deployment, and a Redis StatefulSet. The backend must be reachable by name from the frontend, but not from outside the cluster. Which Kubernetes resource enables internal name-based service discovery?

Accepted Answer

A ClusterIP Service for the backend. A ClusterIP Service exposes the backend Pods on a stable, internal IP address that is only reachable from within the GKE cluster. The frontend can resolve the backend by the Service's DNS name (e.g., `backend.default.svc.cluster.local`) using the cluster's internal DNS (CoreDNS), enabling name-based service discovery without exposing the backend to external traffic.

Answer

A NodePort Service for the backend

Answer

A LoadBalancer Service for the backend

Answer

A Kubernetes Ingress resource for the backend

Question 14

A team is deploying a Cloud Function that requires a private environment variable containing an API key. They want the key stored securely and automatically injected at runtime. Which approach follows GCP best practices?

Accepted Answer

Store the key in Secret Manager and reference it as a secret environment variable in the function deployment. Option C is correct because Secret Manager is the GCP-native service designed to securely store API keys and other sensitive data. By referencing a secret as an environment variable in the Cloud Function deployment configuration, the key is automatically decrypted and injected at runtime without exposing it in source code or configuration files. This follows the principle of least privilege and ensures the secret is encrypted at rest and in transit.

Answer

Hardcode the API key in the function source code

Answer

Pass the API key as a plain-text environment variable in the function configuration

Answer

Store the API key in a Cloud Storage bucket and download it at function startup

Question 15

A team is migrating a stateful application with local disk writes to GKE. The application requires a dedicated persistent disk that follows the Pod if it's rescheduled to a different node. Which Kubernetes resource provides this?

Accepted Answer

A PersistentVolumeClaim backed by a GCE persistent disk StorageClass. A PersistentVolumeClaim (PVC) backed by a GCE persistent disk StorageClass is the correct choice because it provides a durable, network-attached block storage volume that persists independently of the Pod's lifecycle. When the Pod is rescheduled to a different node, the PVC ensures the GCE persistent disk is detached from the old node and reattached to the new node, preserving the application's state. This meets the requirement for a dedicated persistent disk that follows the Pod across rescheduling events.

Answer

A HostPath volume pointing to a directory on the node

Answer

A ConfigMap mounted as a volume

Answer

An emptyDir volume scoped to the Pod

Question 16

A team wants to roll back a GKE Deployment to its previous revision because the new version introduced a regression. Which kubectl command performs this rollback?

Accepted Answer

kubectl rollout undo deployment/my-app. Option B is correct because `kubectl rollout undo deployment/my-app` is the standard Kubernetes command to roll back a Deployment to the previous revision. This command leverages the Deployment's revision history, which is automatically maintained by the Kubernetes controller, to revert the desired state to the prior revision without needing to manually reapply an old manifest.

Answer

kubectl revert deployment/my-app --to-previous

Answer

kubectl apply -f previous-deployment.yaml

Answer

kubectl delete deployment/my-app && kubectl create -f deployment.yaml

Question 17

A team wants to configure a Cloud Scheduler job to invoke a Cloud Run service endpoint every hour using HTTP POST. The Cloud Run service requires authentication. How should the Scheduler job be configured to authenticate?

Accepted Answer

Configure the Cloud Scheduler job with OIDC authentication using a service account that has Cloud Run Invoker permission. Cloud Scheduler can authenticate to Cloud Run using OIDC (OpenID Connect) by attaching a service account to the job. The scheduler obtains an OIDC token for that service account and includes it as a Bearer token in the Authorization header. The service account must have the `run.invoker` IAM role on the Cloud Run service to authorize the invocation.

Answer

Include a Bearer token in the Authorization header of the scheduled HTTP request

Answer

Make the Cloud Run service publicly accessible and use Cloud Armor to restrict access to Cloud Scheduler IPs

Answer

Configure an API key for the Cloud Run service and include it in the scheduled request URL

Question 18

A team runs a Kubernetes Deployment with 3 replicas behind a Service. They want to expose it externally with HTTPS and route traffic based on URL paths (/api → backend service, / → frontend service). Which Kubernetes resource handles path-based routing at Layer 7?

Accepted Answer

A Kubernetes Ingress resource with path rules. A Kubernetes Ingress resource is the native API object designed for Layer 7 (HTTP/HTTPS) routing, including path-based routing. It allows you to define rules that map URL paths (e.g., /api, /) to different backend Services, and it typically works with an Ingress controller (e.g., NGINX, HAProxy) that terminates TLS and performs the routing. This directly meets the requirement for external HTTPS exposure and path-based traffic splitting.

Answer

A LoadBalancer Service with path routing rules

Answer

A NodePort Service with iptables path routing rules

Answer

Multiple ClusterIP Services with DNS SRV records for path routing

Question 19

A team needs to build a CI/CD pipeline that automatically tests and deploys to GKE when code is pushed to the main branch. Which GCP-native service builds and deploys the code automatically based on source code repository events?

Accepted Answer

Cloud Build with a trigger configured on the repository's main branch. Cloud Build is the correct GCP-native service for building and deploying code automatically based on source code repository events. By configuring a Cloud Build trigger on the main branch, any push to that branch automatically initiates a build and deployment to GKE, fulfilling the CI/CD pipeline requirement without additional orchestration.

Answer

Cloud Composer with a Git polling DAG

Answer

Cloud Run jobs triggered by a Pub/Sub subscription on the repository

Answer

Cloud Functions triggered by Cloud Source Repositories push events

Question 20

A team has a Docker container image locally and wants to push it to Google Artifact Registry. They've already authenticated Docker with GCP. The registry host is 'us-central1-docker.pkg.dev'. Which commands correctly tag and push the image?

Accepted Answer

docker tag myimage us-central1-docker.pkg.dev/myproject/myrepo/myimage:v1 && docker push us-central1-docker.pkg.dev/myproject/myrepo/myimage:v1. Option A is correct because it uses the standard Docker CLI workflow: first tagging the local image with the full Artifact Registry path (including the registry host, project, repository, and image name with tag), then pushing it. Since the team has already authenticated Docker with GCP, the `docker push` command will authenticate via the Docker credential helper and upload the image to the specified Artifact Registry repository.

Answer

gcloud artifacts docker push myimage --location=us-central1 --repository=myrepo

Answer

docker push gcr.io/myproject/myimage:v1

Answer

gcloud container images push myimage:v1 --region=us-central1