Google ACE Timed Hard Questions — 25 Difficult Questions

Question 1

A company runs a stable production workload on 20 n2-standard-8 VMs that run continuously year-round. Which pricing commitment maximizes cost savings on these VMs?

Accepted Answer

3-year committed use discount (CUD). The 3-year committed use discount (CUD) offers the highest discount rate (up to 57% for compute-optimized machine types) compared to 1-year CUDs (up to 20%) or sustained use discounts (up to 30% for running a VM the entire month). Since the workload runs 20 n2-standard-8 VMs continuously year-round, a 3-year CUD locks in the maximum savings for this predictable, steady-state usage.

Answer

Sustained use discounts (automatically applied)

Answer

1-year committed use discount (CUD)

Answer

Switching to Spot VMs

Question 2

An organization has a policy requiring all new GCP projects to be created within specific folders and linked to approved billing accounts only. Which combination of features enforces this at scale?

Accepted Answer

Organization policies to restrict allowed billing accounts + granting Project Creator role only at approved folder level. Option B is correct because it combines two enforcement mechanisms: Organization policies (specifically the `constraints/compute.restrictBillingAccounts` constraint) to limit which billing accounts can be attached to projects, and granting the Project Creator role (`roles/resourcemanager.projectCreator`) only at the folder level (not the organization level). This ensures that new projects can only be created within the approved folders and must use an approved billing account, enforcing the policy at scale across the entire organization.

Answer

IAM deny policies on the organization + VPC Service Controls

Answer

Cloud Asset Inventory alerts + manual review of new projects

Answer

Requiring multi-factor authentication for all project creators

Question 3

A platform team is deploying a multi-tier application on GKE: a frontend Deployment, a backend Deployment, and a Redis StatefulSet. The backend must be reachable by name from the frontend, but not from outside the cluster. Which Kubernetes resource enables internal name-based service discovery?

Accepted Answer

A ClusterIP Service for the backend. A ClusterIP Service exposes the backend Pods on a stable, internal IP address that is only reachable from within the GKE cluster. The frontend can resolve the backend by the Service's DNS name (e.g., `backend.default.svc.cluster.local`) using the cluster's internal DNS (CoreDNS), enabling name-based service discovery without exposing the backend to external traffic.

Answer

A NodePort Service for the backend

Answer

A LoadBalancer Service for the backend

Answer

A Kubernetes Ingress resource for the backend

Question 4

An enterprise stores sensitive customer data in Cloud Storage. Regulatory requirements mandate that the company controls its own encryption keys — Google must not be able to decrypt data unilaterally. Which encryption configuration satisfies this?

Accepted Answer

Customer-managed encryption keys (CMEK) using Cloud KMS. Option B is correct because Customer-Managed Encryption Keys (CMEK) with Cloud KMS allow the enterprise to control and manage their own encryption keys, ensuring that Google cannot unilaterally decrypt the data. With CMEK, the encryption keys are stored in Cloud KMS under the customer's control, and Google only has access to the key material for encryption/decryption operations as authorized by the customer. This satisfies the regulatory requirement that the company retains sole control over key material, preventing Google from decrypting data without explicit permission.

Answer

Google-managed encryption keys (the default)

Answer

Client-side encryption before uploading to Cloud Storage, without using Cloud KMS

Answer

Shielded VM with vTPM enabled on the storage backend

Question 5

A DevOps team uses Terraform to manage GCP infrastructure and wants to store Terraform state in a shared location that all team members can access securely, with state locking to prevent concurrent modifications. Which backend configuration achieves this?

Accepted Answer

gcs backend storing state in a Cloud Storage bucket. The `gcs` backend is the correct choice because it stores Terraform state in a Google Cloud Storage bucket, which provides secure, shared access via IAM policies and supports state locking natively through object versioning and write-preconditions. This ensures that only one team member can modify the state at a time, preventing conflicts and corruption.

Answer

gcp backend storing state in a BigQuery table

Answer

remote backend connected to a Cloud SQL database

Answer

local backend with a path shared over Cloud Filestore

Question 6

A managed instance group serves production traffic. During a rolling update to a new VM template, 30% of instances become unhealthy (failing health checks). The update has not completed yet. What should the team do to immediately restore service?

Accepted Answer

Pause the rolling update, then roll back using `gcloud compute instance-groups managed rolling-action rollback`. Option B is correct because the `gcloud compute instance-groups managed rolling-action rollback` command immediately reverts all instances in the managed instance group (MIG) to the previous template, restoring the known-good configuration. Pausing the update first stops the rollout from continuing to affect more instances, and the rollback command then replaces the unhealthy instances with the old template, allowing health checks to pass again.

Answer

Delete all unhealthy instances manually; the MIG will recreate them with the old template

Answer

Increase the target size of the MIG to dilute the unhealthy instances

Answer

Disable autohealing temporarily to prevent the MIG from restarting instances

Question 7

A SaaS company serves 200 enterprise customers, each requiring complete data isolation in separate databases. The company needs to provision a new customer database within minutes and manage 200 databases with minimal overhead. Which GCP approach scales most efficiently?

Accepted Answer

A single Cloud SQL instance with a separate schema (database) per customer, provisioned via API automation. Option B is correct because it uses a single Cloud SQL instance with separate schemas (databases) per customer, which allows you to achieve complete data isolation while minimizing overhead. Provisioning a new schema via API automation takes seconds, and managing 200 schemas on one instance is far more efficient than managing 200 separate instances. This approach scales efficiently because Cloud SQL supports up to 10,000 databases per instance, and you can leverage connection pooling and shared resources without sacrificing isolation.

Answer

200 separate Cloud SQL instances, one per customer

Answer

Storing all customer data in a single shared database with customer_id as a discriminator column

Answer

Using BigQuery with a separate dataset per customer

Question 8

A compliance requirement mandates that all VM-to-VM traffic within a GCP project must be encrypted in transit, even for internal VPC traffic. Which feature enforces this for Compute Engine?

Accepted Answer

Mutual TLS (mTLS) enforced at the application layer between VMs. Mutual TLS (mTLS) is the correct answer because it enforces encryption in transit for all VM-to-VM traffic within a GCP project, including internal VPC traffic, by requiring both sides to present certificates and establishing a TLS-encrypted session. GCP's internal mTLS feature, when enabled on a VPC network, automatically encrypts traffic between Compute Engine VMs using TLS 1.2 or higher, regardless of the application layer, ensuring compliance with encryption mandates without requiring application changes.

Answer

Shielded VMs with Secure Boot enabled

Answer

VPC firewall rules denying all non-encrypted traffic

Answer

Enabling VPC Flow Logs on all subnets

Question 9

A security team discovers that a service account key was accidentally committed to a public GitHub repository 48 hours ago. What should be the immediate steps to remediate this incident?

Accepted Answer

Delete the leaked key immediately, audit Cloud Audit Logs for unauthorized activity using the key, then create a new key or switch to keyless authentication. Option B is correct because the immediate priority is to revoke the compromised key's access by deleting it, which invalidates it instantly. Auditing Cloud Audit Logs is essential to detect any unauthorized usage that occurred during the 48-hour exposure window. Finally, creating a new key or switching to keyless authentication (e.g., workload identity federation) restores secure access without relying on long-lived static credentials.

Answer

Rotate the service account key to generate a new one, keeping the old key active briefly for transition

Answer

Change the service account's display name and email to invalidate the leaked key

Answer

Remove all IAM roles from the service account to deny all actions until the investigation completes

Question 10

A team runs a Kubernetes Deployment with 3 replicas behind a Service. They want to expose it externally with HTTPS and route traffic based on URL paths (/api → backend service, / → frontend service). Which Kubernetes resource handles path-based routing at Layer 7?

Accepted Answer

A Kubernetes Ingress resource with path rules. A Kubernetes Ingress resource is the native API object designed for Layer 7 (HTTP/HTTPS) routing, including path-based routing. It allows you to define rules that map URL paths (e.g., /api, /) to different backend Services, and it typically works with an Ingress controller (e.g., NGINX, HAProxy) that terminates TLS and performs the routing. This directly meets the requirement for external HTTPS exposure and path-based traffic splitting.

Answer

A LoadBalancer Service with path routing rules

Answer

A NodePort Service with iptables path routing rules

Answer

Multiple ClusterIP Services with DNS SRV records for path routing

Question 11

A CI/CD pipeline running outside GCP (on GitHub Actions) needs to authenticate to GCP to push images to Artifact Registry, without storing any long-lived service account key files. Which authentication mechanism achieves this?

Accepted Answer

Workload Identity Federation with GitHub Actions as the identity provider. Workload Identity Federation allows a GitHub Actions workflow to exchange a GitHub-issued OIDC token for a GCP access token, enabling authentication to Artifact Registry without storing any long-lived service account keys. This is the recommended approach for non-GCP CI/CD systems because it eliminates the security risk of managing static credentials while still granting fine-grained, short-lived access to GCP resources.

Answer

Store a service account JSON key as a GitHub Actions secret and use it in the workflow

Answer

OAuth 2.0 user credentials from a developer's Google account

Answer

API keys created for the Artifact Registry service

Question 12

A healthcare company stores patient data in Cloud Storage. Compliance requires that even GCP (Google) cannot decrypt this data. The company manages encryption keys entirely on their own infrastructure. Which encryption option satisfies this?

Accepted Answer

Customer-Supplied Encryption Keys (CSEK) provided with each API request. Option B is correct because Customer-Supplied Encryption Keys (CSEK) allow the customer to provide their own AES-256 encryption key with each API request to Cloud Storage. Google does not store the key; it is used only in memory to encrypt/decrypt the data and then discarded, ensuring that even Google cannot access the plaintext. This meets the compliance requirement that the customer retains exclusive control over the encryption keys.

Answer

Customer-Managed Encryption Keys (CMEK) stored in Cloud KMS

Answer

Google-managed encryption keys (default) with restricted IAM policies

Answer

Shielded VM with confidential computing for the VMs that access the data

Question 13

A team builds a GKE application that processes healthcare data. Regulatory requirements mandate that data in transit between GKE nodes must be encrypted. GKE is running on GCP. What provides encrypted node-to-node traffic within the cluster?

Accepted Answer

GCP automatically encrypts all VM-to-VM traffic in transit within its network. GCP automatically encrypts all VM-to-VM traffic in transit at the network layer, including traffic between GKE nodes, using a combination of MACsec (IEEE 802.1AE) and IPsec. This encryption is enabled by default for all traffic within a VPC and between VPCs, without any configuration required. Therefore, node-to-node traffic within a GKE cluster is already encrypted, satisfying the regulatory requirement.

Answer

GKE node traffic is unencrypted by default — mTLS must be manually configured on every Pod

Answer

Enable VPC Flow Logs — they activate encryption for logged traffic

Answer

Install a TLS termination proxy on each GKE node — it encrypts intranode traffic

Question 14

A Cloud Run service requires access to a private Cloud SQL instance in the same VPC. The Cloud SQL instance is not publicly accessible. How should the Cloud Run service connect to Cloud SQL without using the Cloud SQL Auth Proxy separately?

Accepted Answer

Configure the Cloud Run service with `--add-cloudsql-instances` to connect via the built-in Auth Proxy. Option B is correct because the Cloud Run service can use the `--add-cloudsql-instances` flag, which automatically deploys a built-in Cloud SQL Auth Proxy sidecar container within the same pod. This proxy establishes a secure, encrypted connection to the private Cloud SQL instance using the instance's private IP, without requiring the instance to have a public IP or the user to manage a separate proxy. The proxy authenticates via the service account attached to the Cloud Run service, enabling seamless and secure connectivity.

Answer

Use the Cloud SQL public IP with SSL required — Cloud Run can reach public IPs

Answer

Deploy a separate Cloud SQL Auth Proxy container in the same Cloud Run service as a sidecar

Answer

Enable Serverless VPC Access connector to route Cloud Run traffic to the private Cloud SQL IP

Question 15

A Cloud Build pipeline builds a container image and pushes it to Artifact Registry. The next step needs to deploy the image to Cloud Run. The pipeline runs as the Cloud Build service account. What minimum permission does the Cloud Build SA need for the deployment step?

Accepted Answer

`roles/run.admin` and `roles/iam.serviceAccountUser` on the Cloud Run runtime service account.. The Cloud Build service account needs `roles/run.admin` to deploy services to Cloud Run, but it also requires `roles/iam.serviceAccountUser` on the Cloud Run runtime service account (the identity the Cloud Run service runs as) because the deployment step impersonates that runtime service account to create or update the service. Without the `iam.serviceAccountUser` permission, the deployment fails with a permission denied error, even if the Cloud Build SA has full Cloud Run admin rights.

Answer

`roles/run.admin` only.

Answer

`roles/owner` to ensure all necessary permissions are covered.

Answer

`roles/cloudbuild.builds.editor` on the Cloud Run project.

Question 16

A team runs `gcloud organizations list` and sees no output even though they know their company has a GCP organization. What is the most likely cause, and how should they resolve it?

Accepted Answer

The user lacks org-level IAM permissions such as Organization Viewer.. The `gcloud organizations list` command retrieves organizations from the GCP Resource Manager API. If no output is returned despite the organization existing, the most likely cause is that the authenticated user lacks the `resourcemanager.organizations.get` permission, which is granted by roles like Organization Viewer (`roles/resourcemanager.organizationViewer`) or Organization Administrator (`roles/resourcemanager.organizationAdmin`). Without this IAM permission at the organization level, the API call returns an empty list rather than an error, which is a common source of confusion.

Answer

The organization does not exist yet; run `gcloud organizations create` to create it.

Answer

The gcloud SDK does not support the organizations command; use the Cloud Console instead.

Answer

The project must be linked to the organization using `gcloud projects move`.

Question 17

You are managing a GKE cluster that runs a mixed workload: latency-sensitive web services and batch data processing jobs. The batch jobs run for hours and consume significant CPU/memory. During batch peaks, the web services experience CPU throttling. What is the best configuration to prevent batch jobs from impacting web service latency?

Accepted Answer

Assign web service pods a higher PriorityClass and run batch jobs on a separate node pool with taints.. Option B is correct because it uses PriorityClass to ensure web service pods are scheduled and maintained over batch pods during resource contention, while placing batch jobs on a separate node pool with taints isolates their resource consumption. This prevents batch jobs from causing CPU throttling on latency-sensitive web services by guaranteeing that web pods have priority access to CPU cycles and that batch workloads do not share nodes with web pods.

Answer

Set CPU requests and limits on batch job pods to be lower than web service pods.

Answer

Use Horizontal Pod Autoscaler for batch jobs so they scale down during peak web traffic.

Answer

Enable Cluster Autoscaler so new nodes are added when batch jobs demand more resources.

Question 18

You need to ensure that a Cloud Run service can only be invoked by specific Cloud Scheduler jobs and not from the public internet, while still receiving HTTP requests. The Cloud Run service currently allows unauthenticated invocations. What configuration changes are required?

Accepted Answer

Disable unauthenticated invocations on the Cloud Run service, grant `roles/run.invoker` to the Scheduler SA, and configure Scheduler to use OIDC authentication.. Option B is correct because Cloud Run services that require authentication must have unauthenticated invocations disabled, and the Cloud Scheduler service account must be granted the `roles/run.invoker` role. Additionally, Cloud Scheduler must be configured to use OIDC authentication, which allows it to present an identity token signed by Google to the Cloud Run service, ensuring only authorized scheduler jobs can invoke the service.

Answer

Add a Cloud Armor security policy to the Cloud Run service blocking all IPs except Cloud Scheduler.

Answer

Deploy the Cloud Run service in a VPC and use a VPC firewall rule to block all traffic except Cloud Scheduler.

Answer

Add a secret header to Cloud Scheduler requests and validate it in the Cloud Run application code.

Question 19

You need to configure a GCP organization so that when new projects are created, a specific set of default IAM bindings is automatically applied (e.g., the security team's group gets Security Reviewer on every new project). Which approach achieves this without requiring manual post-creation steps?

Accepted Answer

Trigger a Cloud Function via Eventarc on project creation audit log events to automatically apply the IAM bindings.. Option B is correct because it uses Eventarc to capture audit log events for 'google.cloud.resourcemanager.v3.CreateProject' and triggers a Cloud Function that programmatically applies IAM bindings to the new project. This ensures the bindings are applied automatically without manual steps, leveraging serverless event-driven architecture.

Answer

Set an org policy constraint that applies default IAM bindings to all new projects.

Answer

Require all project creators to use a Terraform module that includes the IAM binding in its configuration.

Question 20

An e-commerce application has a read-heavy database workload: 95% reads, 5% writes. The primary Cloud SQL instance is experiencing CPU saturation during peak read traffic. What is the most appropriate GCP-native solution that minimizes changes to application code?

Accepted Answer

Create Cloud SQL read replicas and route read queries to the replica endpoint.. B is correct because Cloud SQL read replicas are designed to offload read traffic from the primary instance, directly addressing CPU saturation during peak reads without requiring application code changes—simply route SELECT queries to the read replica's IP address. This is the most appropriate GCP-native solution for a read-heavy (95% reads) workload, as it horizontally scales read capacity while keeping writes on the primary.

Answer

Enable Cloud SQL high availability; the standby replica will serve read traffic.

Answer

Scale the primary Cloud SQL instance vertically to a larger machine type.

Answer

Migrate from Cloud SQL to Cloud Spanner for unlimited horizontal read scalability.