Google ACE Ensuring successful operation of a cloud solution Practice Test 5 — 15 Questions

Question 1

You are on-call and receive a PagerDuty alert: `Cloud SQL CPU utilization > 90% for 15 minutes`. Checking `pg_stat_activity`, you find 200 connections with many in `idle` state and 15 queries running for > 5 minutes each. The long queries are table scans on a 500 GB unindexed table. What should you do IMMEDIATELY to restore service, and what is the root cause fix?

Accepted Answer

Terminate the long-running table scan queries immediately, then add indexes on the frequently queried columns as the root cause fix.. Option B is correct because terminating the long-running table scans immediately stops the CPU-intensive queries, restoring service. The root cause is the missing index on the 500 GB table, which forces sequential scans and high CPU usage. Adding indexes on frequently queried columns eliminates the need for full table scans, preventing recurrence.

Answer

Restart the Cloud SQL instance to clear all connections and queries.

Answer

Increase Cloud SQL's CPU to a larger machine type to handle the current load.

Answer

Reduce `max_connections` to prevent new connections from adding load.

Question 2

Order the steps to set up a VPC network with a subnet, firewall rule allowing SSH, and a Compute Engine instance in that subnet.

Question 3

Arrange the steps to create a Cloud Pub/Sub topic, subscription, and publish a message.

Question 4

Match each GCP networking concept to its description.

Question 5

Match each Cloud Monitoring resource to its purpose.

Question 6

A company is using Cloud Run for a stateless application. The application sometimes fails with HTTP 503 errors when traffic spikes. Which action should the team take to improve reliability?

Accepted Answer

Increase the maximum number of container instances.. HTTP 503 errors during traffic spikes indicate that Cloud Run is scaling out but hitting the maximum number of container instances limit, causing new requests to be rejected. Increasing the maximum number of container instances allows Cloud Run to spin up more concurrent containers to handle the burst, directly improving reliability under load.

Answer

Configure a liveness probe with a higher initial delay.

Answer

Use Cloud Functions instead of Cloud Run.

Answer

Enable HTTP load balancing with Cloud CDN.

Question 7

You need to monitor the CPU utilization across all instances in a managed instance group. What is the most efficient way to create an alerting policy?

Accepted Answer

Create an alerting policy in Cloud Monitoring for the metric 'compute.googleapis.com/instance/cpu/utilization'.. Option D is correct because Cloud Monitoring provides a pre-built metric, 'compute.googleapis.com/instance/cpu/utilization', which directly measures CPU usage for VM instances. Creating an alerting policy based on this metric is the most efficient approach, as it requires no custom scripting or external scheduling, and integrates natively with managed instance groups to aggregate data across all instances.

Answer

Create an alerting policy using the Logs Explorer to parse instance logs.

Answer

Use Cloud Scheduler to call the monitoring API periodically.

Answer

Set up a cron job to run gcloud compute instances list and check CPU.

Question 8

A developer deployed a new version of a Compute Engine instance but the startup script fails to run. The developer needs to debug the startup script. Which step should be taken first?

Accepted Answer

Review the serial port 1 output in the Google Cloud console.. Serial port 1 output in the Google Cloud console captures the instance's serial console logs, including startup script execution output and any errors. This is the first and most direct step to debug a failing startup script because it shows the script's stdout, stderr, and any system messages during boot, without requiring network access or additional tools.

Answer

RDP into the instance and check the system logs.

Answer

Check the instance's metadata for startup script errors.

Answer

Recreate the instance with a new image.

Question 9

An organization has a VPC with subnets in us-central1 and europe-west1. They want to allow traffic from a specific on-premises IP range to reach a Compute Engine instance in europe-west1, but only through a single Cloud VPN tunnel attached to the us-central1 gateway. What configuration is required?

Accepted Answer

Create a route in us-central1 with the on-premises range and next hop set to the VPN tunnel. Add a firewall rule allowing the traffic.. Option A is correct because the VPN tunnel is attached to the us-central1 gateway, and a static route in us-central1 with the on-premises IP range as the destination and the VPN tunnel as the next hop directs traffic from the on-premises network to the VPC. Since the VPC is global, the route applies to all regions, and the Compute Engine instance in europe-west1 is reachable as long as the traffic enters the VPC through the us-central1 tunnel. A firewall rule is required to allow the inbound traffic from the on-premises range to the instance.

Answer

Use policy-based routing on the Cloud VPN gateway to route the traffic to europe-west1.

Answer

Create a static route for the on-premises range in the europe-west1 subnet pointing to the VPN tunnel in us-central1.

Answer

Configure the VPN tunnel with BGP to advertise the on-premises range to both regions.

Question 10

A company is using BigQuery for analytics. They notice that queries are slow and expensive. The data is loaded daily into a single table. Which action would most improve performance and reduce cost?

Accepted Answer

Partition the table by date and cluster by frequently filtered columns.. Partitioning the table by date allows BigQuery to prune partitions during query execution, scanning only the relevant daily data instead of the entire table. Clustering on frequently filtered columns further reduces the data scanned by sorting data within partitions. This directly reduces both query cost (pay-per-byte) and latency, addressing the core issue of slow, expensive queries on a large daily-loaded table.

Answer

Use a flat-rate reservation to improve query concurrency.

Answer

Denormalize the table to reduce joins.

Answer

Increase the number of slots available for the project.

Question 11

A developer receives a "Permission 'cloudfunctions.functions.call' denied" error when trying to invoke a Cloud Function from another service. What is the most likely cause?

Accepted Answer

The service account of the caller lacks the Cloud Functions Invoker role.. The error 'Permission cloudfunctions.functions.call denied' indicates that the Identity and Access Management (IAM) policy does not grant the caller the required permission to invoke the function. The Cloud Functions Invoker role (roles/cloudfunctions.invoker) specifically allows the `cloudfunctions.functions.call` permission, which is necessary for HTTP-triggered functions. Without this role on the caller's service account, any invocation attempt will be denied, regardless of other configurations.

Answer

The function is not deployed to the correct region.

Answer

The Cloud Function has a CORS misconfiguration.

Answer

The VPC connector is not configured correctly.

Question 12

A team manages multiple Kubernetes Engine clusters across different projects. They need to enforce that all clusters have the same security policies, including private cluster settings and workload identity. Which approach is most scalable?

Accepted Answer

Use Terraform with a module that defines the standard cluster configuration, and apply it to each project.. Option D is correct because Terraform, combined with a reusable module, provides an Infrastructure as Code (IaC) approach that enforces consistent cluster configurations across multiple projects declaratively. This method is scalable as it allows you to define the standard security policies (private cluster settings, Workload Identity) once in a module and apply it to any number of clusters, ensuring drift is prevented and changes are auditable.

Answer

Use Cloud Asset Inventory to compare configurations and alert on differences.

Answer

Retrieve cluster configuration for each cluster using gcloud container clusters describe and apply changes manually.

Answer

Use Config Connector with deployment scripts to manage cluster resources as Kubernetes custom resources.

Question 13

A company uses Cloud DNS for internal DNS resolution. They recently added a new VPC and need to ensure that instances in this VPC can resolve private DNS names that are hosted in another project. What must be configured?

Accepted Answer

Set up a DNS peering zone between the new VPC and the VPC that hosts the private zone.. Option C is correct because Cloud DNS peering allows a VPC in one project to resolve private DNS names hosted in a private zone in another project without requiring the zones to be shared or exported. DNS peering establishes a direct query path between the peered VPCs, enabling the new VPC to resolve names in the private zone as if they were local, while the zone remains private and managed in its original project.

Answer

Use Cloud DNS inbound server policy to forward queries to the other VPC.

Answer

Export the private zone as a public zone and create a delegation.

Answer

Create a Private DNS zone in the new project with forwarding to the on-premises DNS.

Question 14

An application running on Compute Engine writes logs to a local file. The operations team wants to centralize these logs in Cloud Logging with minimal code changes. What is the recommended approach?

Accepted Answer

Install and configure the Cloud Logging agent on the instance.. Option B is correct because the Cloud Logging agent automatically collects local log files and sends them to Cloud Logging without code changes. Option A requires code changes. Option C and D are manual and not recommended.

Answer

Use Cloud Scheduler to tail the log file and send entries to Logging.

Answer

Set up a scheduled cron job to upload the log file via gcloud logging write.

Answer

Modify the application to use the Cloud Logging client library.

Question 15

Refer to the exhibit. A team has this IAM policy on a Cloud Storage bucket. The bucket contains sensitive data. Which action should the team take immediately?

Accepted Answer

Remove allUsers from the objectViewer binding.. Option B is correct because the IAM policy grants `allUsers` (anyone on the internet) the `objectViewer` role on the bucket, which allows unauthenticated read access to all objects. Since the bucket contains sensitive data, this is a critical security exposure that must be removed immediately by deleting the `allUsers` principal from the binding.

Answer

Add a condition to the objectViewer binding to restrict access.

Answer

Remove the entire objectViewer binding.

Answer

Change the objectViewer role to objectAdmin for allUsers.