mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: Your GKE cluster nodes are running an older…
Your GKE cluster nodes are running an older kernel version with a known vulnerability. You need to update all nodes to use the latest node image with the patched kernel without any downtime. The cluster has a Surge Upgrade configuration of `max-surge: 1, max-unavailable: 0`. What happens during the node upgrade?
⚠ Common exam trap
Google Cloud often tests the misconception that `max-surge` and `max-unavailable` control the number of nodes upgraded simultaneously, when in fact `max-surge` controls the extra nodes provisioned and `max-unavailable` controls how many nodes can be unavailable at any time, and candidates confuse this with parallel upgrades.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
GKE provisions one new node, drains one old node, deletes it, and repeats — zero downtime.
The surge upgrade configuration `max-surge: 1, max-unavailable: 0` ensures that GKE first provisions one new node (the surge node) before draining and deleting an old node. This rolling update process maintains the desired capacity at all times, resulting in zero downtime for applications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
GKE terminates all nodes simultaneously and creates new ones — brief downtime occurs.
Why it's wrong here
Simultaneous termination of all old nodes would only happen if maxUnavailable were set to the total node count, effectively allowing all nodes to go offline at once. Here maxUnavailable: 0 explicitly prevents any existing node from being deleted or drained before a replacement node is ready. GKE performs a rolling upgrade, not a parallel replacement, so this description contradicts the configured upgrade semantics and the guarantee of zero downtime.
- ✓
GKE provisions one new node, drains one old node, deletes it, and repeats — zero downtime.
Why this is correct
This is the expected behavior for a GKE node pool upgrade configured with maxSurge: 1 and maxUnavailable: 0. GKE first provisions an extra node (the surge node) from the new node image, waits until it is Ready, then cordons and drains one old node, rescheduling its pods to the new node. Only after the old node is empty is it deleted, and the process repeats for each node — so no old node is taken offline before a replacement is available, yielding zero downtime.
- ✗
GKE upgrades nodes in-place by applying a kernel patch without rescheduling pods.
Why it's wrong here
GKE does not patch or mutate the existing node OS kernel in place; node images are immutable during an upgrade. Instead, each node is recreated from a new node image, and pods are terminated on the old node and rescheduled onto replacement nodes. Kernel patching without rescheduling would be like a live-patching mechanism, which is not how standard GKE node pool upgrades work — upgrades always involve node replacement and pod migration.
- ✗
Two nodes are upgraded simultaneously (one being the surge node and one old node going offline).
Why it's wrong here
With maxSurge: 1, exactly one additional node is created, and it does not correspond to an old node going offline at the same time. Because maxUnavailable: 0, no old node may become unavailable until the surge node is ready and pods have been rescheduled to it; only then is the old node drained and deleted. The process is strictly sequential — one replacement per cycle — not a simultaneous swap of two nodes.
Go deeper
Related to this question
Learn chapter
GKE Node Pools and Cluster Autoscaler
Key term
GKE
GKE is Google's managed Kubernetes service that automates deploying, scaling, and managing containerized applications in the cloud.
Key term
Image
An image is a complete snapshot of a system's operating system, applications, and settings, used to deploy or restore computing environments quickly.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.