Google ACE Planning and configuring a cloud solution Practice Test 6 — 15 Questions

Question 1

A company is designing a globally distributed application with a web tier and a database tier that requires low-latency communication within the same region but can tolerate eventual consistency across regions. The database must be fully managed and scale globally. Which combination of networking and database is most appropriate?

Accepted Answer

Global VPC with Cloud Bigtable. Cloud Bigtable is a fully managed, globally scalable NoSQL database that provides low-latency access within a region and eventual consistency across regions, making it ideal for the described workload. A Global VPC allows the web and database tiers to communicate privately and with low latency within the same region, while Bigtable's native replication handles cross-region eventual consistency without application complexity.

Answer

Global VPC with Cloud Spanner

Answer

VPC peering with Cloud SQL

Answer

Shared VPC with Cloud Datastore

Question 2

Which feature of Cloud SQL provides automated backups and enables point-in-time recovery?

Accepted Answer

All Cloud SQL tiers. Cloud SQL provides automated backups and point-in-time recovery (PITR) for all tiers, including Cloud SQL Enterprise, Enterprise Plus, and even the basic (non-HA) configurations. This is because the backup and PITR functionality is a core feature of the Cloud SQL service itself, not tied to a specific tier or high-availability setup. Automated backups are enabled by default, and PITR uses binary log (binlog) files to allow restoration to any point within the backup retention window.

Answer

Only Cloud SQL Enterprise

Answer

Only Cloud SQL High Availability configuration

Answer

Only Cloud SQL Enterprise Plus

Question 3

A batch processing job runs on preemptible VMs in a managed instance group. The job frequently fails due to preemption. Which design change would most effectively improve the job's resilience?

Accepted Answer

Use a managed instance group with distribution across multiple zones and enable autoscaling.. Option D is correct because distributing the managed instance group across multiple zones and enabling autoscaling ensures that when preemptible VMs are terminated in one zone, the autoscaler can provision replacement VMs in another zone that still has capacity. This architecture leverages the fact that preemption events are often zone-specific, so multi-zone distribution combined with autoscaling provides resilience without requiring persistent resources.

Answer

Use committed use discounts (1-year or 3-year).

Answer

Add GPUs to the instances.

Answer

Use sole-tenant nodes.

Question 4

An organization with multiple teams needs to provision separate, isolated environments (e.g., development, test, production) while sharing common services like Cloud NAT and VPC firewall rules. Which VPC networking pattern is most suitable?

Accepted Answer

Shared VPC (XPN). Shared VPC (XPN) allows an organization to create a single, centrally managed VPC network that hosts common services like Cloud NAT and firewall rules, while enabling multiple project teams to provision their own isolated environments (dev, test, prod) within that same VPC. This pattern meets the requirement for separate, isolated environments with shared services without needing individual VPCs for each team.

Answer

Network Service Tiers (Premium vs Standard)

Answer

VPC Network Peering between team VPCs

Answer

Single VPC with per-team firewall rules

Question 5

A company wants to migrate an on-premises MySQL database to Cloud SQL with minimal downtime. Which service should they use?

Accepted Answer

Database Migration Service. Database Migration Service (DMS) is the correct choice because it is specifically designed to migrate on-premises MySQL databases to Cloud SQL with minimal downtime using continuous replication. It handles schema conversion, data transfer, and ongoing sync until you cut over, ensuring near-zero downtime without manual intervention.

Answer

Cloud SQL for MySQL

Answer

Cloud SQL with external replicas

Answer

Compute Engine with MySQL installed

Question 6

A developer wants to deploy a containerized application that can scale to zero when not in use and only pay for resources consumed during request processing. Which compute option should they choose?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless compute platform that automatically scales your containerized applications from zero instances up to handle traffic, and scales back down to zero when there are no requests. You only pay for the resources (CPU, memory, and networking) consumed during request processing, with no charges when the service is idle. This makes it the ideal choice for the described use case of scaling to zero and pay-per-request billing.

Answer

App Engine Flexible Environment

Answer

Compute Engine with managed instance groups

Answer

Google Kubernetes Engine

Question 7

A company needs to store structured data with strong consistency and global distribution for a global user base. Which Google Cloud database service is best suited?

Accepted Answer

Cloud Spanner. Cloud Spanner is the correct choice because it provides strong consistency, horizontal scalability, and global distribution via synchronous replication across regions. It supports SQL queries and ACID transactions, making it ideal for structured data that requires both consistency and global access.

Answer

Bigtable

Answer

Cloud SQL

Answer

Firestore

Question 8

An organization is running a batch job that processes sensitive data. The job writes output to a Cloud Storage bucket. The security team requires that all data at rest be encrypted with a customer-managed key. Which key type should be used?

Accepted Answer

Cloud KMS CMEK. Cloud KMS CMEK (Customer-Managed Encryption Keys) is the correct choice because it allows the organization to control and manage the encryption keys used to protect data at rest in Cloud Storage, meeting the security team's requirement for customer-managed keys. CMEK keys are created and managed in Cloud KMS, and you can control key rotation, access, and lifecycle, ensuring compliance with regulatory mandates for customer-managed encryption.

Answer

Cloud HSM

Answer

Default encryption (Google-managed)

Answer

Customer-supplied encryption keys (CSEK)

Question 9

A company wants to set up a cost-effective disaster recovery solution for a critical application running on Compute Engine. The primary region is us-east1. The recovery point objective (RPO) is 1 hour, and recovery time objective (RTO) is 4 hours. Which strategy is most cost-effective?

Accepted Answer

Cross-region replica of persistent disks using snapshot schedules every hour. Option C is the most cost-effective because it uses snapshot schedules to create cross-region replicas of persistent disks every hour, meeting the 1-hour RPO without requiring always-on compute resources. This approach minimizes costs by only storing incremental snapshots in Cloud Storage, while automated restore procedures can spin up instances in the secondary region within the 4-hour RTO.

Answer

Regular backups to Cloud Storage with automated scripts to restore in a different region

Answer

Use managed instance groups in two regions with autoscaling

Answer

Active-active multi-region deployment with HTTP load balancer

Question 10

A team is using Cloud Deployment Manager to define infrastructure as code. They need to ensure that a Cloud Storage bucket is created before a Compute Engine instance that uses the bucket. How should they accomplish this?

Accepted Answer

Set a dependency using the 'dependsOn' field in the instance resource definition. In Cloud Deployment Manager, you can define explicit dependencies between resources using the `dependsOn` field within the resource definition. This ensures that the Cloud Storage bucket is fully created before the Compute Engine instance that references it, preventing race conditions or deployment failures. The `dependsOn` field accepts a list of resource names or selfLinks, and Deployment Manager waits for the depended-on resource to reach a DONE state before creating the dependent resource.

Answer

Use a dependsOn metadata annotation in the instance template

Answer

Reference the bucket's selfLink in the instance template metadata

Answer

Create the bucket and instance in separate deployments and run them sequentially

Question 11

A company is using Cloud NAT to allow private instances to access the internet. However, they notice that traffic from different instances appears to come from the same external IP address. What is the reason?

Accepted Answer

Cloud NAT uses a single external IP by default unless you specify multiple.. Cloud NAT uses a source network address translation (SNAT) configuration that, by default, maps all outbound traffic from instances in a VPC network to a single external IP address. This is the expected behavior unless you explicitly configure multiple NAT IP addresses in a NAT gateway or use a Cloud Router with custom SNAT settings. Option B correctly identifies that Cloud NAT defaults to a single external IP unless you specify multiple.

Answer

Cloud NAT is not configured correctly; traffic should come from different IPs.

Answer

The instances are using a shared VPC so NAT IP is shared.

Answer

Each instance is assigned a unique external IP by Cloud NAT.

Question 12

An organization requires that all Compute Engine instances be created with a specific service account that has minimal permissions. They also want to prevent users from creating instances with a different service account. Which IAM policy should they implement?

Accepted Answer

Organization policy with constraint compute.setServiceAccount. The organization policy constraint `compute.setServiceAccount` is the correct choice because it allows administrators to restrict which service accounts can be used when creating Compute Engine instances. By setting this constraint to only permit a specific service account, users are prevented from launching instances with any other service account, ensuring minimal permissions are enforced at the organization level.

Answer

Organization policy with constraint compute.disableUserServiceAccountCreation

Answer

IAM condition that restricts instances to only use the authorized service account

Answer

Custom role with permission compute.instances.setServiceAccount only for authorized users

Question 13

A company uses Cloud CDN to accelerate content delivery. They notice that some requests are not being cached, despite the cache-control headers being set correctly. The origin is a Compute Engine instance behind an HTTP load balancer. What is a likely cause?

Accepted Answer

The origin returns a Set-Cookie header, which prevents caching by default.. Cloud CDN will not cache responses that include a Set-Cookie header by default, even if Cache-Control headers are correctly set. This is because Set-Cookie indicates user-specific or session-specific content, and caching it could lead to serving private data to other users. The origin (Compute Engine behind an HTTP load balancer) returning Set-Cookie effectively disables caching for those responses.

Answer

The cache key includes the query string, causing too many variations.

Answer

The load balancer is using HTTP/2, which disables caching.

Answer

The content type is not supported by Cloud CDN.

Question 14

A company is implementing cost optimization for their Google Cloud resources. Which two practices are recommended? (Choose two.)

Accepted Answer

Use committed use discounts for predictable workloads.. Committed use discounts (CUDs) are recommended for cost optimization because they provide significant discounts (up to 70% for vCPUs and memory) in exchange for a commitment to use a minimum level of resources (e.g., 1-year or 3-year term) for predictable workloads. This aligns costs with actual usage patterns, reducing waste from on-demand pricing. Deleting unused static external IP addresses is also recommended because each static IP incurs a small hourly charge (e.g., $0.005/hour for a regional IP) even when not attached to a resource, so removing them eliminates unnecessary costs.

Answer

Keep all resources in a single region to avoid data transfer costs.

Answer

Always use premium-tier networking for all traffic.

Answer

Use preemptible VMs for all batch jobs irrespective of fault tolerance.

Question 15

A company needs to securely store secrets (API keys, passwords) used by applications running on Compute Engine. Which three methods are secure and recommended? (Choose three.)

Accepted Answer

Use a third-party secrets vault like HashiCorp Vault running on GKE.. Option A is correct because HashiCorp Vault is a widely adopted, enterprise-grade secrets management solution that can be deployed on Google Kubernetes Engine (GKE) to securely store, access, and audit API keys and passwords. It provides dynamic secrets, encryption as a service, and fine-grained access policies, making it a recommended approach for Compute Engine applications when integrated via its API or sidecar patterns.

Answer

Store secrets as environment variables in plain text in the instance metadata.

Answer

Encrypt secrets with Cloud KMS and store them in a file on the instance.