Google ACE Quick Quiz — 10 Questions

Question 1

A team's Cloud Build pipeline must: (1) run unit tests, (2) build a Docker image only if tests pass, (3) push the image to Artifact Registry. Which cloudbuild.yaml structure correctly enforces this sequential dependency?

Accepted Answer

Define all three steps in a single `steps` list — they run sequentially by default and stop on failure. Option A is correct because Cloud Build executes steps in a `steps` list sequentially by default, and any step that exits with a non-zero status (e.g., test failure) immediately stops the entire pipeline. This enforces the required dependency: unit tests must pass before the Docker image is built, and the image must be built before it is pushed to Artifact Registry.

Answer

Use `waitFor` with step IDs to create a dependency graph between all three steps

Answer

Define the steps in three separate cloudbuild.yaml files and chain them with Cloud Composer

Answer

Set `parallel: false` at the top level of cloudbuild.yaml to enforce sequential execution

Question 2

A team needs a database backup job to run every day at 2 AM UTC. The job calls an HTTP endpoint to trigger the backup. The endpoint requires no complex orchestration — just a timed HTTP call. Which GCP service handles this most simply?

Accepted Answer

Cloud Scheduler with an HTTP target pointing to the backup endpoint. Cloud Scheduler is the simplest GCP service for a recurring HTTP call because it is a fully managed cron job service that directly supports HTTP targets. You configure a schedule (e.g., '0 2 * * *' for daily at 2 AM UTC) and point it to the backup endpoint URL. No additional code, queue, or orchestration is needed, making it the most straightforward solution for this use case.

Answer

Cloud Tasks with a daily task enqueued by a Cloud Function

Answer

Cloud Composer DAG running at 2 AM UTC

Answer

Cloud Run Jobs triggered by a Cloud Monitoring alert at 2 AM

Question 3

A team wants to receive an email alert when the average CPU utilization of VMs in a managed instance group exceeds 80% for more than 5 minutes. What should they create in Cloud Monitoring?

Accepted Answer

An alerting policy with a CPU utilization threshold condition. B is correct because Cloud Monitoring alerting policies allow you to define conditions based on metric thresholds, such as average CPU utilization exceeding 80% for a specified duration (5 minutes). This directly meets the requirement to trigger an email alert when the condition is met.

Answer

A dashboard with a CPU utilization chart

Answer

A log-based metric filter for high-CPU events

Answer

An uptime check targeting the managed instance group

Question 4

A Go service is consuming significantly more CPU than expected. The team suspects an inefficient function but doesn't know which one. Which Cloud Operations tool identifies CPU hotspots in production code?

Accepted Answer

Cloud Profiler. Cloud Profiler is the correct tool because it continuously gathers CPU and heap usage data from production services using statistical sampling, then presents a flame graph or call tree that pinpoints which functions consume the most CPU. Unlike debugging or tracing tools, Profiler is designed specifically for identifying performance bottlenecks like CPU hotspots with minimal overhead, making it ideal for diagnosing an inefficient function in a Go service running in production.

Answer

Cloud Debugger

Answer

Cloud Trace

Answer

Cloud Monitoring custom dashboards

Question 5

A network team is creating a new VPC and must decide between auto mode and custom mode. Why would they choose custom mode?

Accepted Answer

Custom mode allows full control over which regions have subnets and what CIDR ranges are used. Custom mode VPCs give the network team full control over the IP address range (CIDR block) and the ability to create subnets in any region, unlike auto mode VPCs which automatically create subnets in every region with a fixed /20 range per region. This is essential when you need to avoid overlapping CIDRs with on-premises networks or other VPCs, or when you want to restrict subnets to specific regions for compliance or cost reasons.

Answer

Auto mode VPCs cost more per subnet than custom mode

Answer

Auto mode VPCs cannot be used with GKE clusters

Answer

Custom mode VPCs support more IP addresses per subnet than auto mode

Question 6

A company organizes its GCP projects by business unit — Finance, Engineering, and Sales. Which resource is best suited to group these projects while applying shared IAM policies to all projects in each group?

Accepted Answer

Create GCP Folders for each business unit and add the relevant projects. C is correct because GCP Folders are the hierarchical resource designed to group projects under an organization node, allowing you to apply shared IAM policies at the folder level that automatically propagate to all projects within that folder. This aligns with the requirement to organize projects by business unit and enforce consistent access controls across each group.

Answer

Apply labels to each project to identify the business unit

Answer

Apply resource tags to each project for policy enforcement

Answer

Create a Shared VPC host project for each business unit

Question 7

A GKE Pod needs to call the Cloud Storage API. The team wants to avoid creating and managing service account key files. What is the recommended approach?

Accepted Answer

Enable Workload Identity on the GKE cluster and bind a Kubernetes ServiceAccount to a GCP IAM ServiceAccount. Workload Identity is the recommended approach because it allows a Kubernetes ServiceAccount in GKE to authenticate as a GCP IAM ServiceAccount without managing or storing any service account key files. This eliminates the security risk of key leakage and simplifies credential rotation. By binding the Kubernetes ServiceAccount to a GCP IAM ServiceAccount, Pods can directly call Cloud Storage APIs using the IAM permissions of the linked service account, with automatic token exchange via the GKE metadata server.

Answer

Mount a service account JSON key file as a Kubernetes Secret and set GOOGLE_APPLICATION_CREDENTIALS

Answer

Rely on the GKE node's Compute Engine service account for all Pod authentication

Answer

Grant the GKE node pool's service account the Storage Admin role to cover all Pod needs

Question 8

A company runs a stable production workload on 20 n2-standard-8 VMs that run continuously year-round. Which pricing commitment maximizes cost savings on these VMs?

Accepted Answer

3-year committed use discount (CUD). The 3-year committed use discount (CUD) offers the highest discount rate (up to 57% for compute-optimized machine types) compared to 1-year CUDs (up to 20%) or sustained use discounts (up to 30% for running a VM the entire month). Since the workload runs 20 n2-standard-8 VMs continuously year-round, a 3-year CUD locks in the maximum savings for this predictable, steady-state usage.

Answer

Sustained use discounts (automatically applied)

Answer

1-year committed use discount (CUD)

Answer

Switching to Spot VMs

Question 9

An organization has a policy requiring all new GCP projects to be created within specific folders and linked to approved billing accounts only. Which combination of features enforces this at scale?

Accepted Answer

Organization policies to restrict allowed billing accounts + granting Project Creator role only at approved folder level. Option B is correct because it combines two enforcement mechanisms: Organization policies (specifically the `constraints/compute.restrictBillingAccounts` constraint) to limit which billing accounts can be attached to projects, and granting the Project Creator role (`roles/resourcemanager.projectCreator`) only at the folder level (not the organization level). This ensures that new projects can only be created within the approved folders and must use an approved billing account, enforcing the policy at scale across the entire organization.

Answer

IAM deny policies on the organization + VPC Service Controls

Answer

Cloud Asset Inventory alerts + manual review of new projects

Answer

Requiring multi-factor authentication for all project creators

Question 10

A DevOps team monitors a Cloud SQL instance and notices its CPU is consistently above 85% for several hours. The instance handles a critical production database. What should be the team's immediate action?

Accepted Answer

Scale up the Cloud SQL instance machine type to add more vCPUs. Scaling up the Cloud SQL instance to a larger machine type with more vCPUs directly addresses sustained high CPU utilization by providing additional compute capacity. This is the immediate corrective action for a critical production database because it increases the instance's processing power without requiring architectural changes or downtime (if using a rolling update). Read replicas help with read-heavy workloads but do not reduce CPU load from write operations or complex queries on the primary instance.

Answer

Enable read replicas to distribute query load

Answer

Restart the Cloud SQL instance to clear CPU-intensive processes

Answer

Delete and recreate the instance with a larger machine type