Google ACE Hard Questions — 25 Difficult Questions

Question 1

An organization policy at the organization level sets `constraints/compute.requireOsLogin` to enforced (true) on all projects. A specific project needs an exception — VMs there should not require OS Login. How can this exception be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set a project-level organization policy overriding `compute.requireOsLogin` to not enforced (if the constraint allows override). Organization policies can be overridden at a lower level (project, folder) if the constraint's `inheritFromParent` setting allows it. The `compute.requireOsLogin` boolean constraint supports per-project override, so setting it to `false` at the project level exempts that project's VMs from requiring OS Login while the organization-level policy remains enforced for all other projects.

Answer

Removing the VM from the VPC will bypass the organization policy

Answer

Grant the VM's service account the OS Login Admin role to bypass the policy

Answer

Move the project to a folder that doesn't inherit the organization policy

Question 2

A team wants to use Cloud Run to deploy a container that processes messages from a Pub/Sub topic. The container is stateless and the workload is expected to have irregular traffic spikes with high concurrency. Which scaling configuration is most appropriate?

Accepted Answer

Set min-instances to 0 and max-instances to 100 with concurrency of 80. Cloud Run can set a maximum number of concurrent requests per container instance. For Pub/Sub processing, setting max-instances can control cost, and the CPU is always allocated during request processing. The key is to allow multiple concurrent requests to handle spikes efficiently.

Answer

Set min-instances to 0 and max-instances to 1000 with concurrency of 1

Answer

Set min-instances to 10 and max-instances to 100 with concurrency of 1

Answer

Set min-instances to 1 and max-instances to 100 with concurrency of 1

Question 3

Your on-premises data center needs a dedicated, private connection to GCP with a guaranteed 10 Gbps bandwidth and SLA-backed availability. Internet-based VPN is not acceptable due to compliance requirements. Which connectivity option should you choose?

Accepted Answer

Cloud Interconnect Dedicated (10 Gbps). Dedicated Interconnect provides a direct, private physical connection between your on-premises network and GCP, offering up to 10 Gbps per circuit with a 99.99% SLA. Since internet-based VPN is not acceptable due to compliance requirements, this option meets the need for dedicated bandwidth and SLA-backed availability without traversing the public internet.

Answer

Cloud VPN with multiple tunnels for redundancy

Answer

Partner Interconnect via a carrier partner

Answer

Cloud Router with BGP peering over the public internet

Question 4

An engineer needs to audit all Data Access logs for a project to detect unauthorized access to sensitive data. The engineer must ensure that logs are retained for 5 years and are immutable. Which THREE steps should the engineer take?

Accepted Answer

Configure the Cloud Storage bucket with a retention policy and enable object versioning. To achieve this, the engineer must: 1. Enable Data Access audit logs for the required services (e.g., Cloud Storage, BigQuery) in the project's IAM audit config. 2. Create a log sink that exports the logs to a Cloud Storage bucket (which provides cost-effective long-term retention). 3. Configure the bucket with retention policy and object versioning to make logs immutable and protect against deletion. Using Logging's default retention is only 30 days, not 5 years. Cloud Monitoring does not store logs. BigQuery is not ideal for immutable storage.

Answer

Use the default Logging retention of 30 days

Answer

Set up a Cloud Monitoring alert for any Data Access log entries

Question 5

A team is designing a data pipeline: Cloud Storage → Pub/Sub → Dataflow → BigQuery. They expect 50 GB of data per hour. Dataflow jobs must automatically scale workers based on pipeline backlog. Which Dataflow feature provides automatic horizontal scaling of worker VMs?

Accepted Answer

Dataflow Horizontal Autoscaling — automatically adds/removes workers based on pipeline lag. Dataflow Horizontal Autoscaling is the correct feature because it automatically adds or removes worker VMs based on the pipeline's backlog (lag), which directly matches the requirement for automatic horizontal scaling. This feature uses the Cloud Monitoring service to track the number of unprocessed elements and adjusts worker count accordingly, ensuring efficient resource usage without manual intervention.

Answer

Vertical scaling — Dataflow automatically increases worker machine types under load

Answer

GKE cluster autoscaler — Dataflow runs on GKE and inherits its autoscaling

Answer

Cloud Monitoring alerting policy that triggers worker additions via gcloud

Question 6

A financial services company needs to run analytics queries on transaction data that arrives in real-time. The queries must return results within 2 seconds and the dataset grows by ~100 GB per day. The company also needs to retain all data for 7 years for regulatory compliance. Which architecture best satisfies these requirements?

Accepted Answer

Stream transactions through Pub/Sub → Dataflow → BigQuery; run analytics on BigQuery.. It uses Pub/Sub for real-time ingestion, Dataflow for stream processing, and BigQuery for analytics, which can handle 100 GB/day growth and return queries within 2 seconds using BigQuery's columnar storage and automatic sharding. BigQuery's 7-year retention is supported by its time-based partitioning and long-term storage at reduced cost, meeting regulatory compliance without manual intervention.

Answer

Write transactions to Cloud Spanner; run analytics queries directly against Spanner.

Answer

Store transactions in Cloud Bigtable and use Dataproc/Spark for analytics queries.

Answer

Use Cloud SQL for storage and Cloud Dataprep for analytics transformations.

Question 7

A Cloud KMS key used to encrypt a Cloud Storage bucket's data is being destroyed. What happens to the data in the bucket when the KMS key is destroyed?

Accepted Answer

The encrypted data becomes permanently inaccessible (cryptographic erasure) since the decryption key no longer exists.. When a Cloud KMS key is destroyed, the encrypted data in Cloud Storage becomes permanently inaccessible because the cryptographic key material is irrecoverably deleted. This is known as cryptographic erasure: without the key, the ciphertext cannot be decrypted, even though the raw encrypted bytes still exist in the bucket. Cloud Storage does not store a copy of the KMS key, and there is no fallback mechanism to re-encrypt or recover the data.

Answer

The data in Cloud Storage is automatically deleted along with the key.

Answer

Cloud Storage automatically re-encrypts the data using Google-managed keys as a fallback.

Answer

The key enters a 'disabled' state where data can still be decrypted by Google support.

Question 8

A Cloud Run service requires access to a private Cloud SQL instance in the same VPC. The Cloud SQL instance is not publicly accessible. How should the Cloud Run service connect to Cloud SQL without using the Cloud SQL Auth Proxy separately?

Accepted Answer

Configure the Cloud Run service with `--add-cloudsql-instances` to connect via the built-in Auth Proxy. The Cloud Run service can use the `--add-cloudsql-instances` flag, which automatically deploys a built-in Cloud SQL Auth Proxy sidecar container within the same pod. This proxy establishes a secure, encrypted connection to the private Cloud SQL instance using the instance's private IP, without requiring the instance to have a public IP or the user to manage a separate proxy. The proxy authenticates via the service account attached to the Cloud Run service, enabling seamless and secure connectivity.

Answer

Use the Cloud SQL public IP with SSL required — Cloud Run can reach public IPs

Answer

Deploy a separate Cloud SQL Auth Proxy container in the same Cloud Run service as a sidecar

Answer

Enable Serverless VPC Access connector to route Cloud Run traffic to the private Cloud SQL IP

Question 9

A team's Cloud SQL for PostgreSQL instance is running out of disk space. Automated storage increase is disabled. A monitoring alert fires at 90% disk usage. What is the fastest safe action to increase storage?

Accepted Answer

Increase storage capacity using `gcloud sql instances patch --storage-size=[NEW_SIZE]` without downtime. Cloud SQL for PostgreSQL supports online storage resizing without downtime. Using `gcloud sql instances patch --storage-size=[NEW_SIZE]` allows you to increase the allocated disk capacity while the instance remains fully operational, making it the fastest safe action when automated storage increase is disabled.

Answer

Delete old records from the database to free space — no instance changes needed

Answer

Create a new larger Cloud SQL instance and migrate data with Cloud Database Migration Service

Answer

Enable automatic storage increase and wait — Cloud SQL will expand the disk retroactively

Question 10

You are designing a data pipeline that reads from Cloud Storage, transforms data, and writes to BigQuery. The pipeline must process data exactly when new files land (event-driven), handle files up to 5 GB, and complete within 10 minutes. Which approach best meets these requirements?

Accepted Answer

Configure a Cloud Storage Pub/Sub notification → Cloud Function that launches a Dataflow job for each new file.. Cloud Storage Pub/Sub notifications provide event-driven triggers for each new file, and launching a Dataflow job via a Cloud Function allows processing of up to 5 GB files within the 10-minute window. Dataflow’s autoscaling and streaming capabilities handle large files efficiently, while the Cloud Function acts as a lightweight orchestrator without processing the data itself.

Answer

Use a Cloud Scheduler cron job that scans Cloud Storage every minute and processes new files with Dataflow.

Answer

Use Cloud Functions triggered by GCS events to read and transform the 5 GB file directly.

Answer

Use BigQuery Data Transfer Service to load files from Cloud Storage on a schedule.

Question 11

An e-commerce application has a read-heavy database workload: 95% reads, 5% writes. The primary Cloud SQL instance is experiencing CPU saturation during peak read traffic. What is the most appropriate GCP-native solution that minimizes changes to application code?

Accepted Answer

Create Cloud SQL read replicas and route read queries to the replica endpoint.. B is correct because Cloud SQL read replicas offload read traffic from the primary instance, directly addressing CPU saturation during peak reads. Although this solution requires minimal changes to application code (e.g., configuring the application to use the replica endpoint for SELECT queries), it is the most GCP-native and appropriate approach for a read-heavy workload. HA standby replicas are passive and cannot serve reads, vertical scaling is limited, and migrating to Spanner is excessive.

Answer

Enable Cloud SQL high availability; the standby replica will serve read traffic.

Answer

Scale the primary Cloud SQL instance vertically to a larger machine type.

Answer

Migrate from Cloud SQL to Cloud Spanner for unlimited horizontal read scalability.

Question 12

A regulated financial company must ensure that all GCP API calls made by employees are logged with full request and response payloads for audit purposes. Which combination of Cloud Audit Log types captures this?

Accepted Answer

Admin Activity logs + Data Access logs (DATA_READ and DATA_WRITE). Admin Activity logs capture administrative actions like creating or modifying resources, but not the data within API calls. Data Access logs (DATA_READ and DATA_WRITE) capture the request and response payloads for API calls that read or write data, which is required for full audit logging. Together, they cover both the administrative context and the data-level payloads mandated for regulated financial companies.

Answer

Admin Activity logs only

Answer

VPC Flow Logs + Cloud Monitoring metrics

Answer

System event logs + Data Access logs

Question 13

An organization has a policy requiring all new GCP projects to be created within specific folders and linked to approved billing accounts only. Which combination of features enforces this at scale?

Accepted Answer

Organization policies to restrict allowed billing accounts + granting Project Creator role only at approved folder level. It combines two enforcement mechanisms: Organization policies (specifically the `constraints/compute.restrictBillingAccounts` constraint) to limit which billing accounts can be attached to projects, and granting the Project Creator role (`roles/resourcemanager.projectCreator`) only at the folder level (not the organization level). This ensures that new projects can only be created within the approved folders and must use an approved billing account, enforcing the policy at scale across the entire organization.

Answer

IAM deny policies on the organization + VPC Service Controls

Answer

Cloud Asset Inventory alerts + manual review of new projects

Answer

Requiring multi-factor authentication for all project creators

Question 14

You are on-call and receive a PagerDuty alert: `Cloud SQL CPU utilization > 90% for 15 minutes`. Checking `pg_stat_activity`, you find 200 connections with many in `idle` state and 15 queries running for > 5 minutes each. The long queries are table scans on a 500 GB unindexed table. What should you do IMMEDIATELY to restore service, and what is the root cause fix?

Accepted Answer

Terminate the long-running table scan queries immediately, then add indexes on the frequently queried columns as the root cause fix.. Terminating the long-running table scans immediately stops the CPU-intensive queries, restoring service. The root cause is the missing index on the 500 GB table, which forces sequential scans and high CPU usage. Adding indexes on frequently queried columns eliminates the need for full table scans, preventing recurrence.

Answer

Restart the Cloud SQL instance to clear all connections and queries.

Answer

Increase Cloud SQL's CPU to a larger machine type to handle the current load.

Answer

Reduce `max_connections` to prevent new connections from adding load.

Question 15

A security team discovers that a service account key was accidentally committed to a public GitHub repository 48 hours ago. What should be the immediate steps to remediate this incident?

Accepted Answer

Delete the leaked key immediately, audit Cloud Audit Logs for unauthorized activity using the key, then create a new key or switch to keyless authentication. The immediate priority is to revoke the compromised key's access by deleting it, which invalidates it instantly. Auditing Cloud Audit Logs is essential to detect any unauthorized usage that occurred during the 48-hour exposure window. Finally, creating a new key or switching to keyless authentication (e.g., workload identity federation) restores secure access without relying on long-lived static credentials.

Answer

Rotate the service account key to generate a new one, keeping the old key active briefly for transition

Answer

Change the service account's display name and email to invalidate the leaked key

Answer

Remove all IAM roles from the service account to deny all actions until the investigation completes

Question 16

Refer to the exhibit. A user tries to delete the disk 'my-disk' but receives an error. Based on the exhibit, what is the most likely cause?

Accepted Answer

The disk is still attached to an instance.. A disk cannot be deleted while it is attached to a running or stopped instance. In Google Cloud, you must first detach the disk from the instance before deletion. The error message indicates the disk is in use, and the exhibit confirms it is attached to an instance.

Answer

The disk is being used by a snapshot.

Answer

The disk size must be 0 to delete.

Answer

The disk is not in the correct project.

Question 17

You are planning a GCP network for a company with offices in three regions: `us-central1`, `europe-west1`, and `asia-east1`. All three regions must communicate with each other, and traffic must NOT traverse the public internet. Each region has its own subnet. Which network design achieves this with the least management overhead?

Accepted Answer

Use a single global VPC with subnets in each region; traffic between subnets stays on Google's private network.. A single global VPC allows you to create subnets in multiple regions, and traffic between those subnets stays on Google's private backbone network without traversing the public internet. This design requires no additional connectivity configuration, peering, or VPN tunnels, making it the simplest to manage while meeting all requirements.

Answer

Create three separate VPCs (one per region) and connect them with VPC Network Peering.

Answer

Set up Cloud VPN tunnels between each pair of regions.

Answer

Use Cloud Interconnect dedicated connections in each region and configure BGP routing between them.

Question 18

A security team wants to prevent every project in the organization from creating VM instances with external IP addresses — without requiring configuration in each individual project. What is the most scalable solution?

Accepted Answer

Set the organization policy constraint compute.vmExternalIpAccess to Deny All at the organization level. The organization policy constraint `compute.vmExternalIpAccess` can be applied at the organization level to deny all VM instances from having external IP addresses, enforcing this rule across all projects without per-project configuration. This is the most scalable approach as it uses Google Cloud's hierarchical policy engine to centrally control resource creation, overriding any project-level settings.

Answer

Create a firewall rule in every project blocking outbound traffic on port 80 and 443

Answer

Remove the Compute Engine Admin role from all project owners

Answer

Use Cloud Armor to block all traffic destined for public IPs in the organization

Question 19

A company has 50+ Compute Engine instances running a stateful application in the us-central1 region. The instances are part of a managed instance group behind an internal load balancer. The application stores data on zonal persistent disks. The company wants to migrate the entire application stack to the europe-west1 region to reduce latency for European users. They have a Cloud VPN tunnel between their on-premises data center and us-central1. They want to extend connectivity to europe-west1 with minimal downtime. The current on-premises router uses BGP to advertise a specific CIDR block (10.0.0.0/8) to Google Cloud. The VPC is in custom mode with subnets in us-central1 and europe-west1 already created. The Cloud VPN gateway in us-central1 is attached to a Cloud Router with a BGP session to the on-premises router. Which course of action should the company take to achieve the migration with minimal downtime?

Accepted Answer

Create a new Cloud VPN gateway in europe-west1, attach it to a Cloud Router, and establish a BGP session with the on-premises router. Use route priority or metrics to gradually shift traffic to europe-west1.. Adding a second Cloud VPN gateway in europe-west1 and configuring a new BGP session to the on-premises router allows the on-premises router to learn routes for europe-west1 subnets and route traffic accordingly. This can be done without modifying existing sessions, and traffic can be shifted gradually by adjusting route priority (MED) or using BGP metrics. Option A is wrong because a second VPN tunnel on the same gateway would still be in us-central1 and might not provide optimal routing. Option B is wrong because VPC Network Peering does not extend on-premises connectivity; it only connects VPC networks, and the on-premises router would still only have a BGP session to the us-central1 Cloud Router. Option D is wrong because Dedicated Interconnect is a dedicated physical connection that requires significant provisioning time and may not be suitable for a quick migration, and it does not inherently allow gradual traffic shifting without additional BGP configuration.

Answer

Create a second Cloud VPN tunnel on the existing Cloud VPN gateway to Europe with a new BGP session, and update the on-premises router to accept the new route advertisement.

Answer

Set up VPC Network Peering between the us-central1 and europe-west1 VPCs to allow cross-region communication.

Answer

Provision a Dedicated Interconnect connection to europe-west1 and attach a new Cloud Router. Remove the existing Cloud VPN gateway.

Question 20

A financial trading platform must support globally distributed, strongly consistent SQL transactions at thousands of writes per second, with no downtime for planned maintenance. Which GCP database service meets all these requirements?

Accepted Answer

Cloud Spanner. Cloud Spanner is the only GCP database service that provides globally distributed, strongly consistent SQL transactions with horizontal scaling, supporting thousands of writes per second. It uses synchronous replication across regions and TrueTime-based clock synchronization to ensure external consistency, while also offering 99.999% availability with no planned downtime for maintenance.

Answer

Cloud SQL with synchronous read replicas

Answer

Cloud Bigtable

Answer

Cloud Firestore