Google ACE Ensuring successful operation of a cloud solution Practice Test 3 — 15 Questions

Question 1

A production GKE service processes payments and must maintain at least 3 replicas running at all times, even during node upgrades or Pod evictions. How should this be enforced?

Accepted Answer

Create a PodDisruptionBudget with minAvailable: 3 targeting the payment service Pods. A PodDisruptionBudget (PDB) with `minAvailable: 3` ensures that at least 3 replicas of the payment service remain available during voluntary disruptions like node upgrades or Pod evictions. The Kubernetes scheduler respects the PDB by blocking evictions that would drop the number of healthy Pods below the specified threshold, guaranteeing continuous service availability even when nodes are being drained.

Answer

Set the Deployment replica count to 6 — node upgrades will only affect half at a time

Answer

Add node affinity rules pinning all 3 replicas to specific long-lived nodes

Answer

Enable cluster autoscaler with minNodeCount=3 — this preserves Pod availability

Question 2

A team discovers their Cloud Logging costs are unexpectedly high. The majority of costs come from verbose DEBUG-level logs from a development service in production. They want to stop storing DEBUG logs without modifying the application. What is the solution?

Accepted Answer

Create a Cloud Logging exclusion filter to discard DEBUG-level log entries from the service. Option B is correct because Cloud Logging exclusion filters allow you to discard log entries based on criteria such as severity level, log name, or resource labels before they are ingested and stored. By creating an exclusion filter that matches DEBUG-level log entries from the specific development service, you can stop storing those logs without modifying the application code. This approach directly reduces storage costs because excluded logs are not indexed or retained.

Answer

Set the application's log level to INFO — this is the only way to reduce log volume

Answer

Move the development service to a separate GCP project with a lower logging tier

Answer

Delete old DEBUG log entries manually — Cloud Logging charges for stored volume

Question 3

A GKE node pool has auto-repair enabled. A node becomes unresponsive (not ready) for 10 minutes. What action does GKE's auto-repair feature take?

Accepted Answer

GKE drains the node, recreates it, and rejoins it to the cluster automatically. B is correct because GKE's auto-repair feature periodically performs health checks on nodes. When a node is in a 'NotReady' state for the default timeout of 10 minutes, GKE automatically initiates a repair: it drains the node (evicting pods gracefully), recreates it from the node pool's instance template, and rejoins it to the cluster. This ensures minimal disruption without requiring manual intervention.

Answer

GKE alerts the team and waits for manual intervention

Answer

GKE terminates the node permanently and adds a replacement from the node pool's minimum size

Answer

GKE migrates all Pods to other nodes but leaves the unresponsive node running

Question 4

A Cloud SQL production instance experiences a spike in connections during business hours, causing 'too many connections' errors. The application uses 50 microservices each maintaining 10 connections. What is the recommended solution to reduce connection count without rewriting the application?

Accepted Answer

Deploy a connection pooler (e.g., PgBouncer) between the microservices and Cloud SQL. Option B is correct because deploying a connection pooler like PgBouncer between the microservices and Cloud SQL allows many application connections to be multiplexed over a smaller number of actual database connections. This directly reduces the total connection count on the Cloud SQL instance without requiring any application code changes, as the pooler transparently manages the connection lifecycle and reuses idle connections.

Answer

Increase the Cloud SQL instance's max_connections database flag to 10,000

Answer

Enable Cloud SQL HA — the standby will handle the connection overflow

Answer

Add a read replica — microservices can connect to the replica instead of the primary

Question 5

A DevOps team deploys a MIG (Managed Instance Group) with autohealing configured. The health check probes `/health` on port 8080 with a 30-second initial delay. After deployment, new VMs are failing the health check and being immediately recreated — causing a restart loop. What is the most likely cause?

Accepted Answer

The initial delay is too short — the application hasn't finished starting before the health check probes begin. Option B is correct because the 30-second initial delay is too short for the application to complete its startup sequence. When the health check begins probing before the application is ready, it immediately fails, causing the MIG autohealing mechanism to treat the VM as unhealthy and recreate it, leading to a restart loop. The initial delay must be set to a value that exceeds the application's typical startup time.

Answer

The health check HTTP path `/health` doesn't exist — the application uses `/healthz`

Answer

Autohealing is incompatible with autoscaling — they cannot be used together

Answer

The MIG does not support HTTP health checks — TCP checks must be used instead

Question 6

A team's Cloud SQL for PostgreSQL instance is running out of disk space. Automated storage increase is disabled. A monitoring alert fires at 90% disk usage. What is the fastest safe action to increase storage?

Accepted Answer

Increase storage capacity using `gcloud sql instances patch --storage-size=[NEW_SIZE]` without downtime. Option B is correct because Cloud SQL for PostgreSQL supports online storage resizing without downtime. Using `gcloud sql instances patch --storage-size=[NEW_SIZE]` allows you to increase the allocated disk capacity while the instance remains fully operational, making it the fastest safe action when automated storage increase is disabled.

Answer

Delete old records from the database to free space — no instance changes needed

Answer

Create a new larger Cloud SQL instance and migrate data with Cloud Database Migration Service

Answer

Enable automatic storage increase and wait — Cloud SQL will expand the disk retroactively

Question 7

A Kubernetes namespace is shared by multiple teams. The platform team wants to ensure no single team's workloads can consume more than 10 CPU cores and 20 GB memory in that namespace. Which Kubernetes resource enforces this constraint?

Accepted Answer

ResourceQuota scoped to the namespace. ResourceQuota is the Kubernetes resource that enforces aggregate resource consumption limits at the namespace level. By configuring a ResourceQuota with spec.hard.cpu: 10 and spec.hard.memory: 20Gi, the platform team can cap the total CPU and memory usage across all Pods in the namespace, preventing any single team from exceeding those limits.

Answer

LimitRange — sets per-Pod CPU and memory limits

Answer

PodDisruptionBudget limiting the number of running Pods

Answer

Network Policy restricting namespace traffic to avoid resource contention

Question 8

A team stores sensitive configuration files in Cloud Storage that internal services download at startup. External partners occasionally need time-limited access to specific files without creating GCP accounts. Which feature grants temporary access without modifying bucket permissions?

Accepted Answer

Generate a Signed URL for the specific files with the required expiration time. Option B is correct because Signed URLs provide time-limited, granular access to specific Cloud Storage objects without altering the underlying bucket permissions. The partner receives a URL that embeds authentication information and an expiration time, enabling secure, temporary downloads without requiring a GCP account or IAM role.

Answer

Make the specific files publicly readable and share the direct URL

Answer

Create a temporary GCP service account for the partner and share its JSON key

Answer

Enable uniform bucket-level access and create a public IAM binding for 24 hours

Question 9

A Cloud CDN cache is serving stale content after a website update. New files were deployed to Cloud Storage but CDN is still serving the old versions to some users. What is the fastest way to force CDN to serve the updated content?

Accepted Answer

Run a CDN cache invalidation for the affected URL paths. Option B is correct because Cloud CDN supports cache invalidation, which immediately removes cached objects from edge caches for specified URL paths. This forces the CDN to fetch fresh content from the origin (Cloud Storage) on the next request, providing the fastest way to serve updated content without waiting for TTL expiry.

Answer

Wait for the CDN TTL to expire — cached content automatically refreshes

Answer

Delete and recreate the Cloud Storage bucket — CDN will detect the new bucket as a fresh origin

Answer

Disable Cloud CDN temporarily — all users will hit the origin until CDN is re-enabled

Question 10

A team's GKE application is running out of memory due to a memory leak. Pods are restarting with OOMKilled status. As an immediate measure before a code fix is available, what kubectl action provides the most insight into which container is leaking?

Accepted Answer

kubectl top pods --containers -n [NAMESPACE]. Option B is correct because `kubectl top pods --containers` shows per-container CPU and memory usage for each pod in the namespace. This allows you to identify which specific container within a pod is consuming excessive memory and triggering the OOMKilled status, even before a code fix is deployed. It provides immediate, real-time insight into resource consumption at the container level, which is essential for diagnosing a memory leak in a multi-container pod.

Answer

kubectl get events --field-selector=reason=OOMKilling

Answer

kubectl delete pod [POD_NAME] -- force=true to clear the memory leak

Answer

gcloud container clusters describe [CLUSTER] --memory-usage

Question 11

A team needs to roll out a configuration change to a MIG (Managed Instance Group) — updating the instance template to set a new environment variable. They want to validate the change on 1 VM before rolling it out to all 20 VMs. Which MIG update type supports this?

Accepted Answer

Canary update — update 1 VM to the new template, verify, then roll out to all. A canary update in a Managed Instance Group (MIG) allows you to specify a target size (e.g., 1 VM) to update to the new instance template first. After validating the change on that single VM, you can then promote the canary to roll out the new template to the remaining 19 VMs. This matches the requirement to test on 1 VM before full rollout.

Answer

Opportunistic update — the new template applies only when VMs are naturally replaced

Answer

Recreate update — terminate all 20 VMs and recreate with the new template simultaneously

Answer

Snapshot the existing VMs and restore 1 with the new environment variable to test

Question 12

Your GKE application's pods are being evicted frequently during periods of high traffic. You notice that pods without resource requests are being evicted first. The nodes are running at ~85% memory utilization. What should you do to reduce pod eviction?

Accepted Answer

Set memory requests and limits for all pods to match their actual memory usage.. Setting memory requests and limits for all pods to match their actual memory usage ensures that the Kubernetes scheduler can accurately allocate resources and make informed scheduling decisions. Without requests, pods are treated as BestEffort QoS class, making them the first candidates for eviction under memory pressure (when nodes exceed ~85% utilization). By defining requests, pods are classified as Burstable or Guaranteed, which gives them higher priority during eviction and prevents unnecessary disruptions.

Answer

Increase the node machine type to have more memory.

Answer

Configure pod disruption budgets (PDBs) to prevent eviction.

Answer

Enable cluster autoscaler to add nodes before memory pressure occurs.

Question 13

You need to check the CPU and memory utilization of all pods running in the `production` namespace. Which command provides this information?

Accepted Answer

`kubectl top pods -n production`. The `kubectl top pods` command retrieves real-time CPU and memory utilization metrics from the metrics server for pods in a specified namespace. This is the correct tool for monitoring resource usage, as it directly queries the resource metrics API.

Answer

`kubectl describe pods -n production`

Answer

`kubectl get pods -n production -o wide`

Answer

`kubectl logs -n production --all-pods`

Question 14

Your application running on GKE is experiencing intermittent 500 errors. You want to create an alert that fires when the 99th percentile latency exceeds 2 seconds OR when the error rate (5xx responses) exceeds 1% of all requests over a 5-minute window. You have Cloud Monitoring configured with the application exporting metrics via OpenTelemetry. What should you create in Cloud Monitoring?

Accepted Answer

A single alerting policy with two conditions (p99 latency and error rate) joined with OR logic.. Option B is correct because Cloud Monitoring alerting policies support multiple conditions combined with AND/OR logic, allowing you to trigger a single alert when either the 99th percentile latency exceeds 2 seconds or the error rate exceeds 1% over a 5-minute window. This directly matches the requirement without needing separate policies or relying on log-based detection.

Answer

Two separate alerting policies — one for latency and one for error rate — each with their own notification channel.

Answer

A log-based alert using Cloud Logging to detect 5xx response codes in access logs.

Answer

An SLO with error budget burn rate alerts configured in Cloud Monitoring.

Question 15

A Cloud SQL instance's disk is at 95% capacity. The application is experiencing write failures. You need to resolve this immediately with no downtime. What should you do?

Accepted Answer

Increase the disk size via the Cloud SQL console or `gcloud sql instances patch` — this occurs with no instance restart.. Option B is correct because Cloud SQL supports dynamic disk resizing without requiring an instance restart. When you increase the disk size via the console or `gcloud sql instances patch`, the change takes effect immediately, allowing the database to continue serving writes without downtime. This directly resolves the write failures caused by disk-full conditions.

Answer

Take a snapshot of the instance, create a new larger instance from the snapshot, then update the connection string.

Answer

Delete old database tables to free up space.

Answer

Switch the instance to SSD storage, which has higher throughput and allows more writes.