Google ACE Ensuring successful operation of a cloud solution Practice Test 6 — 15 Questions

Question 1

Refer to the exhibit. An engineer runs this command and sees the output. The instance is unable to reach the internet. What is the most likely reason?

Accepted Answer

The instance does not have a public IP address.. The instance cannot reach the internet because it lacks a public IP address. In Google Cloud, an instance without an external IP address cannot initiate outbound connections to the internet unless a Cloud NAT or a VM with a public IP is used as a proxy. The command output likely shows that the instance only has an internal IP, confirming this as the root cause.

Answer

VPC firewall rules are blocking egress traffic.

Answer

The instance needs a Cloud NAT gateway for outbound connectivity.

Answer

The subnetwork is misconfigured.

Question 2

Refer to the exhibit. The Terraform plan above returns the error: Error: "member" is required. What is the issue?

Accepted Answer

The member argument should be 'member' (singular) not 'members'.. The Terraform error 'Error: "member" is required' indicates that the resource block is using the plural argument 'members' instead of the singular 'member'. In the Google Cloud Terraform provider, the google_project_iam_member resource expects a single 'member' argument (e.g., 'user:email@example.com'), not a list. The correct syntax is 'member = "user:email@example.com"', not 'members = ["user:email@example.com"]'. This is a common syntax error when transitioning from other IAM resources that accept lists.

Answer

The Terraform provider version is outdated.

Answer

The project ID is incorrect.

Answer

The member argument must be a service account, not a user.

Question 3

Which TWO actions should be taken to reduce latency for users accessing a global application hosted on Compute Engine? (Choose two.)

Accepted Answer

Deploy instances in multiple regions behind a global load balancer.. Deploying instances in multiple regions behind a global load balancer (Option B) reduces latency by directing user traffic to the closest healthy backend, minimizing network round-trip time. Using Cloud CDN with a backend bucket (Option E) caches static content at edge locations worldwide, serving users from a nearby cache and offloading origin requests. Together, these actions ensure both dynamic and static content are delivered with minimal latency across a global user base.

Answer

Use a single region with more instances.

Answer

Enable Cloud Armor to filter traffic.

Answer

Use Cloud Interconnect for connectivity.

Question 4

Which THREE configurations are required to allow a Compute Engine instance in VPC A (without external IP) to send emails through a third-party SMTP server on the internet? (Choose three.)

Accepted Answer

A Cloud NAT gateway attached to VPC A.. Option A is correct because a Cloud NAT gateway allows instances without external IP addresses to initiate outbound connections to the internet, translating their private IPs to a public IP for the SMTP server. Without Cloud NAT, the instance in VPC A cannot reach the third-party SMTP server on the internet because it lacks a public IP and the VPC has no outbound internet path.

Answer

A VPC firewall rule allowing ingress from the SMTP server.

Answer

An external IP address on the instance.

Question 5

Which TWO practices help ensure the reliability of a Cloud Functions deployment? (Choose two.)

Accepted Answer

Use Cloud Tasks to decouple function invocations.. Option D is correct because Cloud Tasks decouples function invocations by queuing requests and delivering them asynchronously, which improves reliability by handling spikes in traffic without dropping requests and providing automatic retries on failure. Option E is correct because implementing retry policies for background functions (e.g., Cloud Functions triggered by Pub/Sub or Cloud Storage) ensures that transient failures are automatically retried, increasing the overall reliability of the deployment.

Answer

Deploy functions in a single region to minimize latency.

Answer

Configure a VPC connector for all functions.

Answer

Set maximum instances to 1 to avoid resource contention.

Question 6

A DevOps team notices that a Compute Engine instance running a critical application has been terminated unexpectedly. The team wants to ensure the instance restarts automatically if it stops. Which configuration should they use?

Accepted Answer

Enable the 'Automatic restart' flag on the instance template.. Option C is correct because enabling the 'Automatic restart' flag on the instance template ensures that Compute Engine automatically restarts the VM if it terminates due to a non-user-initiated failure (e.g., hardware failure, system crash). This is the native mechanism for automatic recovery without requiring external scripts or manual intervention.

Answer

Configure a startup script that checks for termination and restarts the instance.

Answer

Set the 'On host maintenance' policy to 'Migrate VM instance'.

Answer

Create a firewall rule to allow health check traffic from the load balancer.

Question 7

A company is using Cloud Storage to store sensitive data. They want to enforce that objects are automatically deleted after 90 days. Which configuration should they use?

Accepted Answer

Configure Object Lifecycle Management with a Delete action after 90 days.. Object Lifecycle Management allows you to set rules that automatically perform actions on objects after a specified number of days. By configuring a rule with a Delete action set to trigger after 90 days, objects in the bucket will be automatically removed, meeting the requirement without manual intervention.

Answer

Set a retention policy on the bucket for 90 days.

Answer

Enable bucket locking with a retention period of 90 days.

Answer

Enable object versioning and set a lifecycle rule to delete noncurrent versions.

Question 8

A company's Google Kubernetes Engine cluster has experienced a sudden increase in latency. The team suspects a misconfigured node pool is causing resource contention. They want to verify the node's resource usage. Which command or tool should they use?

Accepted Answer

Run 'kubectl top nodes'.. B is correct because 'kubectl top nodes' directly displays real-time CPU and memory usage for each node in the cluster, which is the fastest way to identify resource contention causing latency. This command leverages the metrics-server to aggregate resource metrics from kubelets, giving immediate insight into node-level utilization without additional overhead.

Answer

Run 'gcloud container clusters describe cluster-name'.

Answer

Use the Cloud Console Monitoring page to view node metrics.

Answer

Run 'kubectl describe node node-name'.

Question 9

A developer has deployed a Cloud Run service but receives a 503 error when accessing it. The service logs show 'The request was aborted because there was no available instance.' What is the most likely cause?

Accepted Answer

The service is experiencing a spike in traffic and the max instances are too low.. The 503 error with the message 'The request was aborted because there was no available instance' indicates that all current instances are saturated and Cloud Run cannot scale up quickly enough to handle the incoming requests. This occurs when traffic spikes exceed the configured maximum number of instances, causing new requests to be rejected until an instance becomes free. Option C correctly identifies that the max instances setting is too low for the traffic spike.

Answer

The minimum number of instances is set too high.

Answer

The container health checks are failing.

Answer

The service's memory limit is set too low.

Question 10

A small business is deploying a web application on Compute Engine and wants to ensure high availability. They have set up two instances in different zones behind a TCP load balancer. What should they also configure to detect and route traffic away from unhealthy instances?

Accepted Answer

Configure a health check on the load balancer.. A health check is required for the TCP load balancer to monitor the backend instances. It periodically probes the instances on a specified port and path, marking them as unhealthy if they fail to respond. The load balancer then stops routing new traffic to unhealthy instances, ensuring high availability by directing traffic only to healthy backends.

Answer

Set a firewall rule to allow traffic only on port 80.

Answer

Use a global HTTP(S) load balancer instead.

Answer

Create a snapshot schedule for the persistent disks.

Question 11

A company runs a batch job on Compute Engine that processes large files from Cloud Storage. The job is taking longer than expected. The instances are using standard persistent disks. Which change would most likely improve I/O performance?

Accepted Answer

Replace standard persistent disks with SSD persistent disks.. Standard persistent disks (pd-standard) are backed by HDDs and have lower IOPS and throughput compared to SSD persistent disks (pd-ssd). Since the batch job processes large files from Cloud Storage, the bottleneck is likely disk I/O performance. Upgrading to SSD persistent disks provides higher IOPS and throughput, directly improving I/O performance for read/write operations.

Answer

Use regional persistent disks instead of zonal.

Answer

Increase the machine type to have more vCPUs.

Answer

Add local SSDs to the instances.

Question 12

A developer is using Cloud Build to deploy a containerized application to Cloud Run. The deployment fails with an error 'Permission denied' when pulling the container from Container Registry. What is the most likely cause?

Accepted Answer

The Cloud Build service account lacks the Storage Object Viewer role on the container registry bucket.. Option C is correct because Cloud Build needs the Storage Object Viewer role to pull images from Container Registry. Option A is wrong because the Cloud Run service agent is for runtime, not build time. Option B is wrong because Cloud Run Invoker is for invoking services. Option D is wrong because Container Registry Service Agent is a different role but not typically granted to Cloud Build.

Answer

The Cloud Build service account lacks the Cloud Run Invoker role.

Answer

The Cloud Run service agent does not have the Cloud Run Invoker role.

Answer

The Container Registry is not configured to work with Cloud Run.

Question 13

A company wants to monitor the CPU utilization of their Compute Engine instances and receive an alert if utilization exceeds 80% for 5 minutes. Which services should they combine?

Accepted Answer

Cloud Monitoring and Cloud Pub/Sub.. Cloud Monitoring collects CPU utilization metrics from Compute Engine instances and can evaluate them against a threshold-based alerting policy. When the condition (CPU > 80% for 5 minutes) is met, the alert fires and sends a notification to a Cloud Pub/Sub topic, which can then trigger downstream actions such as sending emails or invoking serverless functions. This combination provides the metric ingestion, alert evaluation, and event-driven notification pipeline required for the use case.

Answer

Cloud Functions and Cloud Tasks.

Answer

Cloud Audit Logs and Cloud Storage.

Answer

Cloud Logging and Cloud Functions.

Question 14

A team is using Terraform to manage infrastructure in Google Cloud. After running terraform apply, they receive an error: 'Error 409: Resource already exists'. The team needs to resolve this without deleting and recreating the resource. What should they do?

Accepted Answer

Import the existing resource into Terraform state with 'terraform import'.. Option B is correct because the 'Error 409: Resource already exists' indicates that the resource was created outside of Terraform or the state file lost track of it. Running 'terraform import' brings the existing resource under Terraform management by adding its current attributes to the state file, allowing subsequent operations without deletion or recreation.

Answer

Run 'terraform refresh' to update the state file.

Answer

Set the 'create_before_destroy' lifecycle rule on the resource.

Answer

Change the resource name in the Terraform configuration.

Question 15

Which TWO actions should a DevOps engineer take to reduce egress costs when transferring large amounts of data from Compute Engine to Cloud Storage in the same region?

Accepted Answer

Use internal IP addresses for the Compute Engine instances.. Option A is correct because using internal IP addresses for Compute Engine instances ensures that traffic to Cloud Storage stays within Google's internal network, avoiding internet egress charges. When instances communicate with Cloud Storage using external IPs, the traffic is routed over the public internet, incurring egress costs. Internal IPs keep the data transfer on Google's backbone, which is free for same-region transfers.

Answer

Set up a VPN between the instances and Cloud Storage.

Answer

Use a multi-regional Cloud Storage bucket.

Answer

Configure a Cloud NAT gateway.