Courseiva

Google Associate Cloud Engineer (ACE) — Questions 601–675

775 questions total · 11pages · All types, answers revealed

Page 8

Page 9 of 11

Page 10
601
MCQhard

Your company wants to track costs per department. Each department has its own project. You need to set up a budget alert in the billing account for each project. What is the most efficient approach?

A.Use Billing Export to BigQuery and create custom alerts using Cloud Monitoring.
B.Create one budget per project by selecting the project in the 'Scoped to' field.
C.Create a budget for each project by manually enabling billing for each project.
D.Create a single budget for the entire billing account and rely on labels.
AnswerB

Creating one budget per project and setting the 'Scoped to' field to that project is the correct, efficient approach. In the Google Cloud console, budgets are created at the billing account level but can be scoped to a specific project, which allows the budget amount and alert thresholds to apply exclusively to that project's costs. This directly enables per-department tracking if each department maps to a project, and it provides native budget alert notifications, exactly as required.

Why this answer

In GCP, a Cloud Billing budget can be scoped to a specific project using the 'Scoped to' field, allowing you to create one budget per project directly from the billing account without needing to enable billing separately or export data. This is the most efficient native approach because budgets support project-level scoping out of the box. It avoids the overhead of BigQuery export and custom monitoring setup.

Exam trap

ACE often tests the misconception that a single billing-account budget with labels is equivalent to per-project budgets, when in fact scoped budgets give cleaner per-project alerting.

How to eliminate wrong answers

Option A is wrong because Billing Export to BigQuery plus Cloud Monitoring is a heavier, custom-built solution requiring data pipeline setup and alert configuration, not the most efficient native approach. Option C is wrong because enabling billing per project is a prerequisite, not a budgeting mechanism, and it does not create budget alerts. Option D is wrong because a single billing-account-wide budget with labels cannot enforce per-project thresholds or send project-specific alerts as cleanly as scoped budgets.

602
MCQeasy

An engineer is tasked with creating a new VPC network for a production environment. The company requires the VPC to support multiple regions and allow custom IP address ranges for each subnet. Which VPC network mode should the engineer use?

A.Shared VPC
B.Custom mode VPC
C.Auto mode VPC
D.Legacy mode VPC
AnswerB

Custom mode VPC is the correct choice because it begins with no subnets and lets the engineer explicitly define each subnet's IP CIDR range and region. This provides full control over the address space, including private or publicly routable blocks, to avoid conflicts and meet design requirements. For a task that requires setting custom subnet IP ranges per region, this mode is the only way to do so natively.

Why this answer

Custom mode VPC is correct because it allows the engineer to create subnets with user-defined IP address ranges in each region, giving full control over the network topology. Unlike auto mode, custom mode does not automatically create subnets in every region, so the engineer can tailor subnet placement and CIDR blocks to production requirements. This flexibility is essential for multi-region deployments where specific IP ranges are needed for each subnet.

Exam trap

ACE often tests the distinction between auto mode and custom mode VPCs, and candidates may incorrectly assume that auto mode allows custom IP ranges or that shared VPC is a network mode rather than a sharing mechanism.

How to eliminate wrong answers

Option A is wrong because Shared VPC is a feature that allows an organization to share a VPC network across multiple projects, not a mode for defining custom IP ranges; it does not inherently provide custom subnet IP control. Option C is wrong because Auto mode VPC automatically creates one subnet per region with predefined IP ranges, offering no customization of subnet IP ranges. Option D is wrong because Legacy mode VPC is an older network type that only supports a single subnet and does not allow multiple regions or custom IP ranges.

603
MCQmedium

An application receives the error 'Permission denied on resource project [PROJECT_ID] (or it may not exist)' when making an API call with a service account. The service account has the correct IAM role. What else might be missing?

A.The service account needs the Project Owner role to make any API calls
B.The relevant GCP API is not enabled in the project
C.The service account needs to be in the same organization as the project
D.The service account email must be explicitly allow-listed in the API's configuration
AnswerB

When the relevant API is disabled in the project, any request using a service account or user credential fails with a message indicating either 'API has not been used' or that the endpoint cannot be reached. Google Cloud requires an API to be enabled per project before its methods are callable, regardless of the caller's IAM roles. Enabling the API via gcloud services enable or the Cloud Console resolves the error and does not require changing IAM roles.

Why this answer

The error 'Permission denied on resource project [PROJECT_ID] (or it may not exist)' typically occurs when the service account has the correct IAM role but the API being called is not enabled for the project. Even with proper IAM permissions, GCP requires that the specific API (e.g., Compute Engine API, Cloud Storage API) be enabled in the project before any API calls can succeed. Enabling the API activates the service and allows the service account to use it.

Exam trap

Google Cloud often tests the misconception that IAM roles alone guarantee API access, but the trap here is that candidates overlook the prerequisite of enabling the API service in the project, which is a separate step from assigning IAM permissions.

How to eliminate wrong answers

Option A is wrong because the Project Owner role is not required for making API calls; a service account only needs the specific IAM role granting the necessary permissions, and Project Owner is overly broad and unnecessary. Option C is wrong because service accounts do not need to be in the same organization as the project; they can be created in one project and used in another project within the same or different organization, as long as IAM permissions are granted. Option D is wrong because there is no concept of 'allow-listing' a service account email in an API's configuration; access is controlled entirely through IAM roles and policies, not through an explicit allow list.

604
MCQeasy

A team's GCP project is approaching its monthly budget. They want to receive an email alert when spending reaches 80% and 100% of the $500 monthly budget. Which GCP feature sends these budget alerts?

A.Cloud Monitoring alerting policy on the billing/cost metric
B.A Cloud Scheduler job that queries the Billing API and sends an email when cost exceeds thresholds
C.Cloud Billing budget with alert thresholds set at 80% and 100%
D.Cloud Logging alert on billing cost log entries
AnswerC

Cloud Billing budgets natively support multiple alert thresholds, so you can set percentage thresholds at 80% and 100% of your budget amount. When actual spending crosses each threshold, Cloud Billing automatically sends email notifications to the configured recipients, and can also publish to Pub/Sub for programmatic handling. This is the simplest and most reliable method because it requires no custom code, no external services, and no additional monitoring setup.

Why this answer

Cloud Billing budgets are the native GCP feature designed to monitor spending against a budget and send email alerts when actual or forecasted costs exceed user-defined thresholds (e.g., 80% and 100% of $500). This feature is configured directly in the Cloud Console or via the Billing API and automatically triggers notifications without requiring custom code or additional services.

Exam trap

Google Cloud often tests the distinction between native GCP services (Cloud Billing budgets) and workarounds (Cloud Scheduler + Billing API) to see if candidates recognize the built-in, no-code solution for budget alerts.

How to eliminate wrong answers

Option A is wrong because Cloud Monitoring alerting policies cannot directly use billing/cost metrics; billing data is not exposed as a Cloud Monitoring metric, and the 'billing/cost metric' does not exist in the Monitoring API. Option B is wrong because while a Cloud Scheduler job could theoretically query the Billing API and send an email, this is not a built-in GCP feature for budget alerts—it requires custom development, cron management, and is not the recommended or simplest solution. Option D is wrong because Cloud Logging alerts on billing cost log entries are not supported; billing data is not written to Cloud Logging as structured log entries that can trigger alerts, and the Billing budget feature already handles threshold-based notifications natively.

605
MCQmedium

A company runs a batch job every night that processes data from a Cloud Storage bucket and writes results to BigQuery. The job runs on a Compute Engine VM. To minimize costs, what is the best practice for the VM?

A.Use a VM with GPUs for faster processing
B.Use a VM with local SSD for temporary storage
C.Use a standard VM and commit to a 1-year commitment
D.Use a preemptible VM
AnswerD

Preemptible VMs cost up to 60–80% less than standard on-demand VMs and are explicitly designed for fault-tolerant, batch workloads that can be interrupted. Compute Engine can terminate a preemptible VM at any time, but it will always run for at least 30 seconds, and the job should be coded to handle early termination by persisting progress to durable storage. Because this nightly batch job is by nature interruptible and short-lived, preemptible VMs are the cost-optimal choice and align with Google's best practices for batch processing.

Why this answer

Preemptible VMs are up to 80% cheaper and can be terminated at any time, which is acceptable for batch jobs that can be checkpointed or restarted from the beginning.

606
MCQeasy

You need to load a CSV file from Cloud Storage into an existing BigQuery table. Which bq command should you use?

A.bq query --source_format=CSV 'SELECT * FROM mydataset.mytable'
B.bq load --source_format=CSV mydataset.mytable gs://mybucket/myfile.csv
C.bq insert mydataset.mytable gs://mybucket/myfile.csv
D.bq import mydataset.mytable gs://mybucket/myfile.csv
AnswerB

bq load is the correct BigQuery CLI command to initiate a batch load job from Cloud Storage. It creates a load job that reads the CSV file at the given URI, parses it according to the specified --source_format, and writes rows into the target table (mydataset.mytable), which can be appended to or replace. This is the standard, idempotent way to bulk-load CSV data into BigQuery.

Why this answer

The bq load command loads data into a BigQuery table. You specify the source format (CSV) and the location of the file in Cloud Storage.

607
MCQmedium

A team stores application log archives in a Cloud Storage bucket. Logs older than 90 days should automatically move to Coldline storage, and logs older than 365 days should be deleted. Which feature automates this?

A.Cloud Scheduler jobs that run gsutil rewrite and gsutil rm commands nightly
B.Cloud Storage Object Lifecycle Management rules on the bucket
C.Cloud Pub/Sub notifications triggering a Cloud Function on each object creation
D.Retention policies that lock objects in Coldline after 90 days
AnswerB

Cloud Storage Object Lifecycle Management lets you define rules at the bucket level, for example an action to set the storage class to Coldline when `age` is 90 days, and a delete action when `age` is 365 days. These rules are evaluated asynchronously by Google Cloud for all current and future objects, so you get automatic, fully managed transition and deletion behavior without any external triggers. This is the intended mechanism for exactly this requirement, and it is both simpler and more reliable than any custom event-driven or scheduler-based solution.

Why this answer

Cloud Storage Object Lifecycle Management rules allow you to automatically transition objects to Coldline storage after 90 days and delete them after 365 days based on object age conditions. This is a native, serverless feature that requires no external compute or scheduling, making it the most efficient and reliable approach for automating tiering and deletion of log archives.

Exam trap

Google Cloud often tests the misconception that custom scheduling or event-driven functions are required for automated data management, when in fact Cloud Storage's native lifecycle management handles age-based transitions and deletions without any additional services.

How to eliminate wrong answers

Option A is wrong because Cloud Scheduler jobs running gsutil rewrite and gsutil rm commands introduce unnecessary complexity, potential for human error, and additional cost for compute resources; lifecycle management handles this natively without custom scripts. Option C is wrong because Cloud Pub/Sub notifications triggering a Cloud Function on each object creation would only fire on new objects, not on existing objects, and would require custom code to implement age-based transitions and deletions, which is less efficient and more error-prone than built-in lifecycle rules. Option D is wrong because retention policies are used to prevent object deletion or modification for a specified period, not to automate transitions or deletions; locking objects in Coldline after 90 days would actually prevent the deletion at 365 days that the requirement specifies.

608
MCQmedium

A team is designing a system where two GCP projects — a shared services project and an application project — need their VMs to communicate using private IPs. Both projects are in the same organization. Which networking option best enables this with centralized network management?

A.VPC Peering between the two projects' VPCs
B.Shared VPC (XPN) with the shared services project as the host
C.Cloud VPN between the two projects' default VPCs
D.Using external IPs with TLS — private IP communication isn't necessary between GCP projects
AnswerB

With Shared VPC (XPN), the shared services project acts as the host, owning the VPC networks and subnets that service projects' VMs consume. The host project's network admin has centralized visibility and control over routing, firewall policies (including hierarchical firewall rules), and subnet allocation, while service project owners can deploy VMs without managing network infrastructure. This is the recommended pattern when multiple projects need to consume common services over private IPs because it enforces consistent governance, simplifies auditing, and scales without adding peering or VPN links per project.

Why this answer

Shared VPC (XPN) allows an organization to centrally manage networking across multiple projects from a single host project, enabling VMs in the shared services project and the application project to communicate via private IPs without needing separate peering or VPN configurations. This is the best option because it provides centralized network administration and policy enforcement, which aligns with the requirement for centralized network management.

Exam trap

The trap here is that candidates often choose VPC Peering (Option A) because it seems simpler for connecting two projects, but they overlook the explicit requirement for centralized network management, which Shared VPC uniquely provides by design.

How to eliminate wrong answers

Option A is wrong because VPC Peering requires manual configuration of each peering connection and does not provide centralized network management; each project retains separate administrative control, and routes must be managed individually. Option C is wrong because Cloud VPN is designed for connecting on-premises networks or different VPCs across regions via encrypted tunnels, but it adds complexity and latency for intra-organization communication that can be achieved more simply with Shared VPC. Option D is wrong because using external IPs with TLS violates the requirement for private IP communication and introduces security risks and egress costs, as well as bypassing the centralized management goal.

609
MCQmedium

You notice that a deployment in your GKE cluster is running an outdated image. You need to update the deployment to use the new image 'gcr.io/my-project/my-app:v2'. Which kubectl command should you use?

A.kubectl set image deployment/my-deployment my-app=gcr.io/my-project/my-app:v2
B.kubectl rollout restart deployment my-deployment --image gcr.io/my-project/my-app:v2
C.kubectl update deployment my-deployment --image gcr.io/my-project/my-app:v2
D.kubectl replace deployment my-deployment --image gcr.io/my-project/my-app:v2
AnswerA

kubectl set image deployment/my-deployment my-app=gcr.io/my-project/my-app:v2 is the correct imperative command to update a container image inside a Deployment. The container name (my-app) must exactly match the container name defined in the Deployment's pod spec, and the command updates the pod template so the Deployment controller creates a new ReplicaSet and performs a rolling update. This is the canonical kubectl syntax for changing an image without editing a manifest.

Why this answer

The correct command to update a deployment's container image is 'kubectl set image', which updates the image for a specific container within the deployment. The syntax 'deployment/my-deployment my-app=gcr.io/my-project/my-app:v2' specifies the deployment name and the container name with the new image. This triggers a rolling update.

Exam trap

The trap is confusing commands that sound similar: 'kubectl set image' is the correct one, but candidates might choose 'rollout restart' thinking it updates the image, or 'replace' thinking it's a general update command.

How to eliminate wrong answers

Option B is wrong because 'kubectl rollout restart' is used to restart a deployment (e.g., to pick up a ConfigMap change) but does not change the image; the '--image' flag is not valid for this command. Option C is wrong because 'kubectl update' is not a valid kubectl command; the correct verb is 'set image' or 'apply'. Option D is wrong because 'kubectl replace' requires a full manifest file and does not support an '--image' flag; it would replace the entire deployment configuration.

610
MCQmedium

A team builds a document processing pipeline: files are uploaded to Cloud Storage, then analyzed by Cloud Vision AI, results stored in Firestore, and a confirmation email sent. Each step depends on the previous. Which GCP service orchestrates these sequential, dependent steps reliably?

A.Cloud Pub/Sub with a subscription per step
B.Cloud Tasks with per-step queues
C.Cloud Workflows
D.Cloud Functions chained via HTTP calls
AnswerC

Cloud Workflows is a fully managed orchestration service that defines steps in a YAML specification, allowing sequential or parallel execution, conditionals (e.g., if/switch), and subworkflows. It provides built-in retry with exponential backoff, timeout policies, and automatic state persistence, so every execution is logged and auditable. Direct connectors for Google Cloud services (like Cloud Run, Cloud Functions, BigQuery) let you call APIs without writing HTTP glue code, making it the correct choice for coordinating dependent multi-step pipelines with conditional logic and centralized error handling.

Why this answer

Cloud Workflows is designed to orchestrate sequential, dependent steps with built-in retry, error handling, and state management. It directly models the pipeline as a series of steps where each step's output feeds the next, without requiring manual chaining or intermediate messaging infrastructure.

Exam trap

Google Cloud often tests the distinction between asynchronous messaging (Pub/Sub, Tasks) and synchronous orchestration (Workflows), where candidates mistakenly choose a messaging service for sequential workflows because they focus on 'reliability' rather than 'ordered dependency management'.

How to eliminate wrong answers

Option A is wrong because Cloud Pub/Sub is a publish-subscribe messaging service for asynchronous, decoupled communication, not for orchestrating sequential dependent steps; it would require additional logic to enforce order and handle failures. Option B is wrong because Cloud Tasks is a distributed task queue for executing discrete tasks asynchronously, not for defining a sequential workflow with dependencies; it lacks built-in step sequencing and state management. Option D is wrong because chaining Cloud Functions via HTTP calls creates tight coupling, requires manual error handling and retries, and does not provide a centralized view of the workflow execution or built-in step sequencing.

611
MCQmedium

A company needs to connect their on-premises data center to Google Cloud via a dedicated, high-bandwidth connection with low latency. They anticipate consistent high traffic. Which connectivity option should they use?

A.Carrier Peering
B.Cloud VPN
C.VPC peering
D.Dedicated Interconnect
AnswerD

Dedicated Interconnect provides a direct, private physical connection between an on-premises data center and Google Cloud, typically via a co-location facility with one or more 10 Gbps or 100 Gbps links. This dedicated, high-bandwidth link bypasses the public internet, delivering more consistent latency, higher throughput, and an SLA covering availability (up to 99.99% when configured with redundant connections). It is the correct choice here because it is purpose-built for hybrid cloud connectivity that requires reliable, secure, and dedicated bandwidth between a data center and Google Cloud.

Why this answer

Dedicated Interconnect provides direct physical connections between on-premises and Google Cloud, offering high bandwidth and low latency. Cloud VPN is over the internet; Carrier Peering is for enterprise customers; VPC peering is for connecting VPCs within Google Cloud.

612
Matchingmedium

Match each BigQuery feature to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Unit of compute capacity for queries

Divides tables into segments for faster queries

Sorts data within partitions for better performance

Precomputed query results for faster access

In-memory analysis service for sub-second query response

Why these pairings

Clustering sorts data by column values to improve filtering performance; Partitioning divides a table into date-based segments to reduce scanned data; Materialized Views store precomputed query results for faster access. Common confusions arise from swapping these definitions, especially between Clustering and Partitioning.

613
MCQhard

You need to drain a GKE node for maintenance. The node is running a DaemonSet and some pods with emptyDir volumes. Which kubectl command should you use to safely drain the node without causing errors?

A.kubectl drain node-name --force
B.kubectl drain node-name --ignore-daemonsets --delete-emptydir-data
C.kubectl drain node-name --ignore-daemonsets
D.kubectl cordon node-name && kubectl delete pods --all --grace-period=0
AnswerB

This is the correct drain command because --ignore-daemonsets tells kubectl to skip evicting Pods that are managed by DaemonSets (they would just be recreated on the same node), and --delete-emptydir-data lets the drain proceed even if Pods have emptyDir volumes that will be lost. The drain cordons the node, then gracefully evicts remaining workload Pods while honoring PodDisruptionBudgets, making it safe for planned maintenance. These flags are the standard pair used when a GKE node contains DaemonSets and emptyDir-backed pods.

Why this answer

The correct drain command must account for both DaemonSet-managed pods (which cannot be evicted and require --ignore-daemonsets) and pods using emptyDir volumes (which hold local data and require --delete-emptydir-data to allow eviction). Combining both flags lets kubectl drain the node without erroring on these two conditions.

Exam trap

ACE often tests whether candidates know that drain requires explicit flags for DaemonSets and emptyDir pods — candidates pick --ignore-daemonsets alone and are surprised when drain fails on emptyDir volumes.

How to eliminate wrong answers

Option A is wrong because --force alone bypasses unmanaged pods but does not handle DaemonSet pods or emptyDir data, so drain will still fail on those. Option C is wrong because --ignore-daemonsets handles DaemonSet pods but omits --delete-emptydir-data, causing drain to abort when it encounters pods with emptyDir volumes. Option D is wrong because cordon only marks the node unschedulable and does not evict pods; deleting pods with --grace-period=0 forcibly terminates them without respecting PodDisruptionBudgets or graceful shutdown, risking data loss and service disruption.

614
MCQhard

Refer to the exhibit. A user tries to delete the disk 'my-disk' but receives an error. Based on the exhibit, what is the most likely cause?

A.The disk is being used by a snapshot.
B.The disk size must be 0 to delete.
C.The disk is still attached to an instance.
D.The disk is not in the correct project.
AnswerC

The USERS column in the console output lists the instances that are currently using the disk as an attached persistent disk. When a disk is attached to an instance, it is in use and cannot be deleted until you either delete the instance or detach the disk first (if the instance is stopped). This is the correct reason the deletion fails in the exhibit.

Why this answer

A disk cannot be deleted while it is attached to a running or stopped instance. In Google Cloud, you must first detach the disk from the instance before deletion. The error message indicates the disk is in use, and the exhibit confirms it is attached to an instance.

Exam trap

Google Cloud often tests the misconception that snapshots or disk size prevent deletion, but the real blocker is the attachment state, which is a common oversight when managing persistent disks.

How to eliminate wrong answers

Option A is wrong because a disk can be deleted even if it has snapshots; snapshots are independent and do not block disk deletion. Option B is wrong because disk size does not need to be 0 for deletion; any size disk can be deleted as long as it is not attached. Option D is wrong because the disk is in the correct project, as shown in the exhibit; the error is not related to project permissions or location.

615
MCQhard

A company wants to use Google Cloud Pricing Calculator to estimate the monthly cost of running a Compute Engine instance for a web server. They plan to use a n2-standard-4 machine with a 100 GB SSD persistent disk and commit to a 1-year term. Which discount type should they include in the estimate?

A.No discount is needed; the price shown is final
B.Committed use discount (1 year)
C.Free tier discount
D.Sustained use discount only
AnswerB

Committed use discount (1 year) is the correct choice because it aligns with the scenario of running an n2-standard-4 instance consistently over a year. In the Google Cloud Pricing Calculator, selecting a 1-year CUD for compute resources like vCPUs and memory typically yields a discount of approximately 20-30% compared to on-demand pricing. The calculator has a dedicated field to add this commitment, and choosing it directly answers the question by reducing the estimated cost. This is the best option among the list since other discounts either do not apply or are automatically included.

Why this answer

Google Cloud offers committed use discounts (CUDs) for Compute Engine when you commit to a 1-year or 3-year term in exchange for significant discounts (up to 57% for 3-year, ~37% for 1-year on n2). Since the company is committing to a 1-year term, the correct discount type to include in the Pricing Calculator estimate is the 1-year committed use discount. The calculator has a specific option to apply CUDs to the estimate.

Exam trap

The trap is mixing up sustained use discounts (automatic, usage-based) with committed use discounts (contractual, term-based); candidates see '1-year term' and may still pick SUD because they forget SUD is not a term commitment.

How to eliminate wrong answers

Option A is wrong because the price shown without any discount is the on-demand rate; the question explicitly states a 1-year commitment, so a discount must be applied to reflect the actual cost. Option C is wrong because the free tier applies only to specific always-free usage limits (e.g., e2-micro in us-west1), not to an n2-standard-4 instance with a 100 GB SSD. Option D is wrong because sustained use discounts are automatic and apply to on-demand usage that runs for a significant portion of the month; they are not the same as committed use discounts and are not selected as a term-based discount in the calculator.

616
MCQmedium

A company is migrating a legacy on-premises application to Google Cloud. The application stores structured transactional data in a relational database. The database currently handles 2,000 transactions per second (TPS) and is expected to grow to 10,000 TPS over the next year. The database size is 500 GB. The application requires strong consistency and the ability to run complex JOIN queries. Which Google Cloud database service should the company choose?

A.Cloud Spanner
B.Cloud SQL for PostgreSQL
C.Cloud Bigtable
D.Cloud Firestore
AnswerA

Cloud Spanner is a globally distributed relational database that offers strong consistency and horizontal scalability, making it ideal for applications spanning multiple regions with extremely high throughput requirements. For a legacy on-premises application that likely operates at modest scale, Spanner's advanced features and associated costs are unnecessary. Migrating to Spanner would add significant operational complexity and expense without tangible benefits, making Cloud SQL for PostgreSQL a more proportionate and cost-effective choice.

Why this answer

Cloud Spanner is the correct choice because it is a fully managed relational database that provides strong global consistency, supports complex SQL joins, and scales horizontally to easily handle 10,000 TPS. Cloud SQL, while supporting joins and ACID, is limited to vertical scaling and read replicas, which do not address the write throughput required at 10,000 TPS. Therefore, Cloud Spanner meets the application's requirements for high TPS, strong consistency, and complex queries.

Exam trap

The trap is choosing Cloud SQL based on familiarity or cost, but the high TPS requirement (10,000) signals the need for Cloud Spanner's horizontal scalability. Cloud Spanner is not only for global applications; it also serves high-throughput single-region workloads.

How to eliminate wrong answers

Option A is wrong because Cloud Spanner is designed for globally distributed, horizontally scalable workloads with strong consistency, but it introduces unnecessary complexity and higher cost for a single-region workload that only needs up to 10,000 TPS and 500 GB; it also requires schema changes to use interleaved tables for optimal JOIN performance. Option C is wrong because Cloud Bigtable is a NoSQL wide-column database that does not support SQL JOINs or strong relational consistency, making it unsuitable for structured transactional data requiring complex queries. Option D is wrong because Cloud Firestore is a NoSQL document database designed for mobile and web apps with eventual consistency by default, and it lacks native support for complex JOIN operations or the transactional throughput needed for 10,000 TPS.

617
MCQhard

A company wants to deploy a containerized application on Cloud Run that is built from source code in a local directory. They want Cloud Run to automatically build the container image using Cloud Build. Which command should be used?

A.gcloud run deploy my-service --source . --region us-central1
B.gcloud app deploy --source .
C.gcloud run deploy my-service --image . --region us-central1
D.gcloud builds submit --tag gcr.io/my-project/my-image . && gcloud run deploy my-service --image gcr.io/my-project/my-image
AnswerA

The --source flag tells gcloud to treat the current directory as source code, automatically invoking Cloud Build to containerize it using buildpacks before deploying to Cloud Run in the specified region. This single command combines the build and deploy steps, which is exactly what the requirement of a one-command deployment asks for. The service name 'my-service' is provided, and the region ensures the service is created in us-central1.

Why this answer

The command gcloud run deploy my-service --source . --region us-central1 uses the --source flag to indicate that Cloud Run should build the container image from the local source code using Cloud Build, then deploy it. This is the correct way to deploy from source.

Exam trap

ACE often tests the difference between deploying from source (--source) and deploying from an image (--image); candidates may choose the manual build option because it also works, but the question specifies automatic build.

How to eliminate wrong answers

Option B is wrong because gcloud app deploy is for App Engine, not Cloud Run. Option C is wrong because --image expects a container image URL, not a local directory. Option D is wrong because it manually builds and pushes the image with gcloud builds submit, then deploys; while this works, it does not use the automatic build from source that the question asks for.

618
Multi-Selectmedium

A developer wants to automate the creation of a service account and assign it a role using the gcloud command-line tool. Which TWO commands are needed? (Choose 2 answers.)

Select 2 answers
A.gcloud projects add-iam-policy-binding
B.gcloud iam service-accounts keys create
C.gcloud projects set-iam-policy
D.gcloud iam service-accounts create
E.gcloud iam roles create
AnswersA, D

gcloud projects add-iam-policy-binding is the precise command to grant an existing service account an IAM role on a project. It performs an additive update to the project's IAM policy, leaving all other bindings intact, which is exactly what is needed when automating service account creation and subsequent access provisioning. The command requires the service account's email as the member and the role name (e.g., roles/storage.objectViewer), and it applies the binding only at the project level, matching the scenario.

Why this answer

First, you create the service account with `gcloud iam service-accounts create`. Then, you grant a role to the service account by adding an IAM policy binding to the project.

619
MCQhard

You need to ensure that a Cloud Run service can only be invoked by specific Cloud Scheduler jobs and not from the public internet, while still receiving HTTP requests. The Cloud Run service currently allows unauthenticated invocations. What configuration changes are required?

A.Add a Cloud Armor security policy to the Cloud Run service blocking all IPs except Cloud Scheduler.
B.Disable unauthenticated invocations on the Cloud Run service, grant `roles/run.invoker` to the Scheduler SA, and configure Scheduler to use OIDC authentication.
C.Deploy the Cloud Run service in a VPC and use a VPC firewall rule to block all traffic except Cloud Scheduler.
D.Add a secret header to Cloud Scheduler requests and validate it in the Cloud Run application code.
AnswerB

This is the correct approach because it leverages Cloud Run's native IAM integration. Disabling unauthenticated invocations makes the service require a valid Google-issued OAuth2/OIDC token for every request. Granting roles/run.invoker to the Cloud Scheduler service account authorizes precisely that identity to invoke the service. When Scheduler is configured with OIDC authentication, it attaches an OIDC token for that service account, which Cloud Run validates against the invoker role—thereby allowing only scheduled calls and blocking all other callers.

Why this answer

Cloud Run services that require authentication must have unauthenticated invocations disabled, and the Cloud Scheduler service account must be granted the `roles/run.invoker` role. Additionally, Cloud Scheduler must be configured to use OIDC authentication, which allows it to present an identity token signed by Google to the Cloud Run service, ensuring only authorized scheduler jobs can invoke the service.

Exam trap

Google Cloud often tests the misconception that IP-based restrictions (like Cloud Armor or VPC firewall rules) can secure serverless services, when in fact serverless services like Cloud Run require IAM-based authentication for secure, identity-aware access control.

How to eliminate wrong answers

Option A is wrong because Cloud Armor security policies operate at the HTTP(S) load balancer level and cannot be directly attached to a Cloud Run service that is not behind a load balancer; also, Cloud Scheduler does not have a fixed set of IP addresses, so blocking by IP is impractical. Option C is wrong because Cloud Run services cannot be deployed directly into a VPC; they use VPC connectors for outbound traffic, and VPC firewall rules cannot control inbound traffic to a serverless service like Cloud Run. Option D is wrong because relying on a secret header for authentication is not a secure access control mechanism; it can be easily spoofed and does not leverage Google Cloud's IAM-based authentication, which is the recommended approach.

620
MCQeasy

A media company needs to serve large video files (average 2 GB) to global users with low latency. The files are stored in Cloud Storage. What combination of services delivers the best streaming performance?

A.Cloud Storage in a multi-region bucket with direct public access
B.Cloud Storage + Cloud CDN via a Global Load Balancer backend bucket
C.Upload video files to a Compute Engine VM with nginx serving them directly
D.Cloud Filestore with NFS-mounted streaming
AnswerB

Enabling Cloud CDN on a Cloud Storage backend bucket behind a global external load balancer lets video files be cached at Google's edge points of presence (PoPs) around the world. This provides low-latency delivery because users retrieve content from a nearby edge cache rather than from the storage origin, and it offloads egress traffic from Cloud Storage. The global load balancer offers a single anycast IP, so all users are automatically routed to the closest pop, and signed URLs or IAM policies can still enforce access controls. This is the intended solution for globally distributed video delivery.

Why this answer

Cloud Storage combined with Cloud CDN via a Global Loader Balancer backend bucket is the best choice because it provides edge-caching of large video files, reducing latency for global users. The Global Load Balancer terminates HTTP(S) traffic at the closest point of presence, and Cloud CDN caches content from the multi-region bucket, minimizing origin load and improving streaming performance.

Exam trap

Google Cloud often tests the misconception that direct Cloud Storage access (Option A) is sufficient for global low-latency streaming, but the trap is that without a CDN and load balancer, users experience high latency and the bucket cannot handle global traffic efficiently.

How to eliminate wrong answers

Option A is wrong because a multi-region bucket with direct public access lacks edge caching, meaning every user request hits the bucket directly, increasing latency and egress costs for global streaming. Option C is wrong because serving large video files from a single Compute Engine VM with nginx creates a single point of failure, cannot scale to handle global traffic, and introduces unnecessary latency for users far from the VM's region. Option D is wrong because Cloud Filestore with NFS-mounted streaming is designed for high-performance file shares for compute instances, not for direct internet-facing content delivery; it lacks CDN integration and cannot serve video files with low latency to global users.

621
MCQeasy

A company wants to deploy a web application on Compute Engine. They expect variable traffic and want to automatically add or remove virtual machine instances based on CPU utilization. What is the recommended approach?

A.Use a single large instance and rely on Cloud Load Balancing
B.Use an unmanaged instance group and manually add or remove instances
C.Use a managed instance group with an autoscaling policy based on CPU utilization
D.Deploy the application on App Engine Standard environment
AnswerC

A managed instance group (MIG) automatically creates and manages instances from an instance template, and attaching an autoscaler with a CPU utilization target lets the group dynamically add or remove VMs to keep average CPU near the desired threshold. The autoscaler continually polls Cloud Monitoring metrics and can also use load balancing signals, making it appropriate for a Compute Engine web application that needs horizontal scaling. MIGs integrate with Cloud Load Balancing and instance health checks, enabling both scale-out and automatic recovery of unhealthy instances.

Why this answer

A managed instance group (MIG) with an autoscaling policy based on CPU utilization is the recommended approach because it automatically adjusts the number of VM instances in response to real-time CPU load, ensuring the application can handle variable traffic without manual intervention. This aligns with Google Cloud's best practices for elastic scaling of stateless web applications on Compute Engine.

Exam trap

Google Cloud often tests the distinction between managed and unmanaged instance groups, where candidates mistakenly think unmanaged groups can be autoscaled, but only managed instance groups support autoscaling policies.

How to eliminate wrong answers

Option A is wrong because relying on a single large instance with Cloud Load Balancing does not provide autoscaling; a single instance cannot scale out to handle increased traffic and introduces a single point of failure. Option B is wrong because an unmanaged instance group requires manual addition or removal of instances, which contradicts the requirement for automatic scaling based on CPU utilization. Option D is wrong because App Engine Standard is a fully managed platform that abstracts infrastructure, but the question specifically asks about deploying on Compute Engine, not App Engine.

622
MCQmedium

A team needs to run a containerized HTTP API that scales to zero when idle and requires zero cluster or server management. Which GCP compute platform is the best fit?

A.Compute Engine with a managed instance group
B.Google Kubernetes Engine Autopilot
C.Cloud Run
D.App Engine Flexible
AnswerC

Cloud Run executes containerised workloads on fully managed infrastructure, automatically scaling instances down to zero when no requests arrive. This eliminates cluster and server administration entirely, directly satisfying the stem's scale-to-zero and zero-management constraints for the HTTP API.

Why this answer

Cloud Run is the best fit because it is a fully managed serverless platform that automatically scales your containerized HTTP API to zero when idle, meaning you pay only for resources used during request processing. It requires no cluster or server management, as it abstracts away the underlying infrastructure entirely, unlike other options that still involve some level of node or instance management.

Exam trap

Google Cloud often tests the distinction between 'scaling to zero' and 'scaling down to a minimum of one' — candidates mistakenly think GKE Autopilot or App Engine Flexible can scale to zero, but only Cloud Run (and Cloud Functions) natively supports true zero-instance scaling without additional configuration.

How to eliminate wrong answers

Option A is wrong because Compute Engine with a managed instance group still requires you to manage virtual machine instances, and while it can scale down, it cannot scale to zero instances (minimum is 1 per zone) and involves server management. Option B is wrong because Google Kubernetes Engine Autopilot, while reducing node management, still requires you to manage a Kubernetes cluster (even if abstracted) and cannot scale to zero pods without manual configuration or third-party tools like KEDA, plus you pay for the cluster control plane. Option D is wrong because App Engine Flexible runs containers but requires at least one instance to be running at all times (cannot scale to zero), and it involves more configuration for custom runtimes compared to Cloud Run's simplicity.

623
Matchingmedium

Match each Google Kubernetes Engine (GKE) concept to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Smallest deployable unit, one or more containers

Exposes a set of pods as a network service

Declarative update for pods and ReplicaSets

A worker machine in a Kubernetes cluster

Set of nodes managed by the control plane

Why these pairings

In GKE, a Pod is the smallest unit, a Service provides stable network access to Pods, a Deployment manages Pod updates, and a Node is a worker machine. Common confusions involve swapping Pod and Service definitions.

624
MCQmedium

An organisation requires a managed relational database for an online transaction processing (OLTP) application with strong consistency, automated backups, and a 99.95% SLA. The database size is expected to be under 10 TB. Which service meets these requirements at the lowest cost?

A.Bare Metal Solution
B.Cloud Bigtable
C.Cloud SQL
D.Cloud Spanner
AnswerC

Cloud SQL is a fully managed relational database service offering MySQL, PostgreSQL, and SQL Server engines with automated backups, point-in-time recovery, and integrated high availability, making it ideal for OLTP workloads using SQL. It provides strong ACID consistency and a 99.95% SLA at a predictable price point for databases under 10 TB, which fits the stated need without over-provisioning. This combination of managed operations, relational features, and reasonable cost makes Cloud SQL the correct choice.

Why this answer

Cloud SQL is a fully managed relational database service supporting MySQL, PostgreSQL, and SQL Server, offering strong consistency (ACID), automated backups, and a 99.95% SLA on the Enterprise edition. For OLTP workloads under 10 TB, Cloud SQL provides the best price-to-performance among the listed options. Cloud Spanner and Bigtable are significantly more expensive and designed for different scales and access patterns.

Exam trap

ACE often tests the cost-versus-scale trade-off between Cloud SQL and Cloud Spanner, so candidates over-select Spanner for 'strong consistency' without weighing the 10 TB size and cost constraint.

How to eliminate wrong answers

Option A is wrong because Bare Metal Solution is for lifting-and-shifting specialised workloads (e.g., Oracle, SAP) requiring physical hardware, not a managed relational database with automated backups and an SLA. Option B is wrong because Cloud Bigtable is a NoSQL wide-column store optimised for high-throughput analytical and time-series workloads, not OLTP with strong relational consistency. Option D is wrong because Cloud Spanner, while relational and strongly consistent, is far more expensive and is designed for horizontally scalable, globally distributed workloads exceeding what a sub-10 TB OLTP app requires.

625
MCQeasy

Which IAM role should be granted to a service account to allow it to access a secret stored in Secret Manager?

A.roles/secretmanager.secretAccessor
B.roles/secretmanager.admin
C.roles/iam.serviceAccountUser
D.roles/secretmanager.viewer
AnswerA

roles/secretmanager.secretAccessor is the correct and minimal predefined role for service accounts that need to retrieve secret payloads. It includes the `secretmanager.versions.access` permission, which allows the caller to access the encryption-decrypted secret value from a specified version, and `secretmanager.versions.get` for metadata of that version. It does not permit creating, deleting, or modifying secrets, nor changing IAM policies, making it the exact role for a workload that reads a secret at runtime without administrative side effects.

Why this answer

The role 'secretmanager.secretAccessor' grants access to read secret versions.

626
Multi-Selecteasy

A company is migrating an on-premises MySQL database to Cloud SQL. Which TWO steps are necessary for setting up ongoing replication from on-premises to Cloud SQL? (Choose 2)

Select 2 answers
A.Set up a Dataflow pipeline to stream changes.
B.Use pg_dump to export the database.
C.Enable binary logging on the on-premises MySQL server.
D.Create a Cloud SQL instance to be the replica.
E.Establish a Cloud VPN connection between on-premises and Google Cloud.
AnswersC, D

Enabling binary logging is the foundational prerequisite for any MySQL replication topology, including Cloud SQL as an external replica. With binary logging enabled, the on-premises MySQL server records all changes in binary log files, and a replica reads those logs to replay transactions; additionally, the server must set a unique server-id and use row-based binary logging (binlog_format=ROW) for consistency. Without it, the Cloud SQL instance cannot receive the change stream needed to stay synchronized.

Why this answer

MySQL's native replication relies on binary logs (binlogs) to capture all changes on the primary server. Enabling binary logging on the on-premises MySQL server is essential to generate the change stream that Cloud SQL will read and apply for ongoing replication.

Exam trap

The trap here is that candidates confuse 'ongoing replication' with 'one-time migration' and select a dump tool (Option B) or a generic streaming service (Option A), missing that MySQL replication specifically requires binary logs and a Cloud SQL replica instance.

627
Multi-Selecteasy

You want to create a monitoring dashboard that shows a time-series chart of CPU utilization for a specific Compute Engine instance. Which THREE components do you need to configure? (Choose three.)

Select 3 answers
A.Choose a time aggregation function (e.g., mean, max)
B.Select the resource type: 'gce_instance' and filter by the instance ID
C.Create a log-based metric for CPU utilization
D.Select the metric: 'compute.googleapis.com/instance/cpu/utilization'
E.Set up a notification channel to send alerts
AnswersA, B, D

Choosing a time aggregation function is essential because raw metric samples arrive at irregular intervals and need to be aligned to a fixed time step for a coherent time series. The aggregation function (e.g., mean, max, sum) reduces multiple points within each alignment window into a single value, which determines the chart's shape and sensitivity to spikes. Without this step, the dashboard may render unusable, too-dense data or fail to produce a meaningful trend. For CPU utilization, 'mean' is typical for overall usage, while 'max' can highlight peak behavior.

Why this answer

In Cloud Monitoring, to create a chart you need to select a metric, a resource, and a time aggregation function.

628
MCQmedium

A team runs Apache Kafka on self-managed VMs for event streaming but wants to reduce operational overhead. Which GCP-native service is the managed alternative to Kafka for pub/sub messaging at scale?

A.Cloud Pub/Sub — Google's managed pub/sub messaging service
B.Cloud Bigtable — a managed wide-column store for streaming data
C.Cloud Dataflow — the GCP managed streaming processing service
D.Cloud Storage — use GCS notification events as a message queue
AnswerA

Cloud Pub/Sub is the fully managed, natively available messaging service on Google Cloud, providing durable, asynchronous message delivery between independently scaled publishers and subscribers. It supports global topic routing, push/pull subscriptions, at-least-once delivery with configurable ack deadlines, and automatic horizontal scaling to millions of messages per second without any broker infrastructure to patch or monitor. As the direct GCP equivalent to self-managed Kafka, it removes operational overhead while adding native IAM integration and dead-letter topics for failure handling.

Why this answer

Cloud Pub/Sub is the correct answer because it is Google Cloud's fully managed, scalable pub/sub messaging service that provides at-least-once delivery and supports both push and pull subscriptions, making it the direct managed alternative to self-managed Apache Kafka. It eliminates the operational overhead of managing Kafka clusters on VMs while offering similar event streaming capabilities with automatic scaling and global availability.

Exam trap

Google Cloud often tests the distinction between a messaging/queue service (Pub/Sub) and a data processing service (Dataflow) or a storage service (Bigtable, Cloud Storage), so candidates mistakenly choose Dataflow because it 'processes streaming data' or Bigtable because it 'handles streaming data,' missing that the question asks for a managed alternative to Kafka's pub/sub messaging, not for processing or storage.

How to eliminate wrong answers

Option B is wrong because Cloud Bigtable is a managed NoSQL wide-column database optimized for low-latency read/write access to large volumes of streaming data, not a pub/sub messaging system; it lacks the topic-based publish-subscribe model and message retention semantics of Kafka. Option C is wrong because Cloud Dataflow is a managed stream and batch processing service (based on Apache Beam) that processes data from sources like Pub/Sub, but it is not a messaging or queue service itself. Option D is wrong because Cloud Storage with GCS notification events provides object change notifications that can be used as a simple event trigger, but it does not offer the durable, ordered, partitioned message log, configurable retention, or pub/sub semantics required for a Kafka alternative.

629
MCQmedium

A company needs to store and serve user-generated content such as images and videos. The data must be accessible globally with low latency. Which Google Cloud storage service should they use?

A.Persistent Disk
B.Cloud Filestore
C.Cloud Storage
D.Local SSD
AnswerC

Cloud Storage is the correct choice because it is a durable, highly available object storage service with a global namespace and public HTTPS ingestion and serving endpoints. It provides strong consistency, configurable permissions, and can integrate with Cloud CDN for low-latency delivery of cached content, making it ideal for user-generated photos, videos, and documents. Lifecycle policies can cost-effectively archive older content, and resumable uploads support large files from mobile and web clients.

Why this answer

Cloud Storage is correct because it is Google Cloud's object storage service, designed to store and serve unstructured content like images and videos at global scale with low latency via edge caching and multi-region buckets. It offers HTTP/HTTPS access, signed URLs, and integration with Cloud CDN, making it the standard choice for user-generated media. No other listed service provides globally distributed object storage with this accessibility.

Exam trap

ACE often tests the difference between block storage (Persistent Disk, Local SSD), file storage (Filestore), and object storage (Cloud Storage) — candidates who focus on 'low latency' may wrongly pick Local SSD, ignoring the global accessibility and durability requirements.

How to eliminate wrong answers

Option A is wrong because Persistent Disk is block storage attached to a single Compute Engine VM in one zone — it is not globally accessible and is unsuitable for serving media to users worldwide. Option B is wrong because Cloud Filestore is a managed NFS file system for shared file access within a VPC, not a globally distributed object store for web-served content. Option D is wrong because Local SSD is ephemeral, high-performance block storage physically attached to a single VM; it is not durable, not shared, and not globally accessible.

630
MCQmedium

An engineer needs to view the logs generated by a Cloud Run service to troubleshoot a recent deployment. Which service should they use?

A.Cloud Monitoring
B.Cloud Logging
C.Error Reporting
D.Cloud Trace
AnswerB

Cloud Logging is the correct choice because it is the native, centralized log storage and retrieval service for Google Cloud, and Cloud Run automatically sends both request logs and platform logs to it. Application output written to stdout/stderr is also captured as structured logs. You can view these logs immediately in the Logs Explorer and filter them by resource type, severity, or labels.

Why this answer

Cloud Logging (formerly Stackdriver Logging) is the unified logging service for Google Cloud. Cloud Run logs are automatically sent to Cloud Logging.

631
MCQhard

An organization wants to enforce that all projects under a specific folder have a set of constraints, such as disabling default network creation and requiring shielded VMs. What is the most efficient way to achieve this?

A.Use Cloud Shell to run scripts in each project.
B.Create IAM roles to restrict default network creation.
C.Use a service account to enforce policies.
D.Apply organization policies at the folder level.
AnswerD

Applying organization policies at the folder level is correct because constraints are inherited by all projects and subfolders under that folder. For example, the compute.skipDefaultNetworkCreation constraint can be set at a folder to prevent any project inside it from creating the default VPC network at project creation time. This ensures consistent, centrally managed governance across an entire team or environment without needing to configure each project individually.

Why this answer

Organization policies in Google Cloud can be applied at the folder level, and they are inherited by all projects within that folder. This allows enforcing constraints like disabling default network creation and requiring shielded VMs across all projects efficiently. Applying at the folder level ensures consistent enforcement without per-project configuration.

Exam trap

ACE often tests the misconception that IAM roles or service accounts can enforce resource constraints, when organization policies are the correct tool.

How to eliminate wrong answers

Option A is wrong because running scripts in each project is manual, error-prone, and not efficient for ongoing enforcement. Option B is wrong because IAM roles control access, not resource configurations like default network creation; they cannot enforce constraints. Option C is wrong because a service account is an identity, not a policy enforcement mechanism; it cannot enforce organization policies.

632
MCQmedium

A team runs a Kubernetes CronJob that performs nightly database cleanup. The job runs at 2 AM UTC. This morning, the team notices the job failed at 2 AM but no one was alerted. How should the team configure alerting for CronJob failures?

A.Set `successfulJobsHistoryLimit: 0` — GKE sends an alert when the history is empty
B.Create a log-based metric on CronJob failure events in Cloud Logging and an alerting policy on that metric
C.Set `restartPolicy: Always` on the CronJob's Pod template — it will retry until success
D.Enable GKE's built-in CronJob alerting feature in the cluster's Notifications settings
AnswerB

This is the correct approach because GKE logs Kubernetes events, including CronJob failures (such as a Job exceeding its deadline or failing to be created), to Cloud Logging when cluster logging is enabled. A log-based metric can count only the error-level or failure-related log entries generated by the CronJob controller, and a Cloud Monitoring alerting policy can then respond to that metric crossing a threshold, sending notifications via email, Pub/Sub, or mobile app. Unlike static limits or cluster-wide notifications, this gives you a targeted, rule-based way to detect exactly when a scheduled job fails, making it the standard solution for CronJob observability on GKE.

Why this answer

Google Cloud Logging captures Kubernetes CronJob failure events, and you can create a log-based metric to count these failures. An alerting policy on that metric then triggers notifications when failures occur, providing a reliable, customizable alerting mechanism that does not depend on job history or restart policies.

Exam trap

The trap here is that candidates assume GKE has a native CronJob alerting toggle or that restart policies alone solve monitoring, when in reality you must explicitly create a log-based metric and alerting policy to detect job failures.

How to eliminate wrong answers

Option A is wrong because setting `successfulJobsHistoryLimit: 0` only removes completed job pods from history; it does not generate any alert and GKE has no built-in alert for an empty history. Option C is wrong because `restartPolicy: Always` is not valid for a CronJob's Pod template (only `Never` or `OnFailure` are allowed) and even if it were, it would retry the pod but not alert on failure. Option D is wrong because GKE does not have a built-in 'CronJob alerting feature' in cluster Notifications settings; cluster Notifications cover node and upgrade events, not CronJob failures.

633
MCQmedium

A web application uses a managed instance group. Traffic spikes sharply between 9 AM and 5 PM and drops to near zero overnight. Which autoscaling metric most directly triggers scale-out before user experience degrades?

A.Average CPU utilization of instances in the group
B.Pub/Sub subscription queue depth
C.HTTP load balancing serving capacity (requests per second per instance)
D.Disk I/O throughput
AnswerC

HTTP load balancing serving capacity, measured as requests per second per instance, directly reflects the real ingress rate seen by the load balancer. This metric is proactive because it reacts to request count in real time, allowing the managed instance group to scale out before CPU or memory saturation causes latency spikes. Since it is measured at the load balancer, it captures all client traffic destined for the web tier, making it the most accurate and responsive signal for autoscaling stateless HTTP web workloads.

Why this answer

HTTP load balancing serving capacity (requests per second per instance) is the most direct metric because it measures the actual user-facing load on each instance. When traffic spikes, this metric rises immediately, triggering scale-out before instances become saturated and response times degrade. CPU utilization can lag behind the spike due to queuing or async processing, making it less responsive for sharp traffic patterns.

Exam trap

The trap here is that candidates assume CPU utilization is the universal autoscaling metric, but the ACE exam specifically tests that for web applications with sharp traffic spikes, the HTTP load balancing serving capacity metric provides the fastest and most direct signal to prevent user experience degradation.

How to eliminate wrong answers

Option A is wrong because average CPU utilization can be a lagging indicator—instances may queue requests before CPU spikes, and some workloads (e.g., I/O-bound or async) don't correlate tightly with user-facing load, so scale-out may occur too late. Option B is wrong because Pub/Sub subscription queue depth measures backlog of asynchronous messages, not direct user requests; it is suitable for event-driven or worker-based autoscaling, not for a web application serving live traffic. Option D is wrong because disk I/O throughput is a storage-level metric unrelated to request handling capacity; it would only be relevant for data-intensive batch jobs, not for scaling a web frontend.

634
MCQhard

You are designing a data pipeline that reads from Cloud Storage, transforms data, and writes to BigQuery. The pipeline must process data exactly when new files land (event-driven), handle files up to 5 GB, and complete within 10 minutes. Which approach best meets these requirements?

A.Configure a Cloud Storage Pub/Sub notification → Cloud Function that launches a Dataflow job for each new file.
B.Use a Cloud Scheduler cron job that scans Cloud Storage every minute and processes new files with Dataflow.
C.Use Cloud Functions triggered by GCS events to read and transform the 5 GB file directly.
D.Use BigQuery Data Transfer Service to load files from Cloud Storage on a schedule.
AnswerA

GCS object notifications to Pub/Sub trigger a Cloud Function that launches a Dataflow job. Dataflow handles files up to 5 GB within 10 minutes using parallel workers, and the event-driven architecture processes files exactly when they land.

Why this answer

Cloud Storage Pub/Sub notifications provide event-driven triggers for each new file, and launching a Dataflow job via a Cloud Function allows processing of up to 5 GB files within the 10-minute window. Dataflow’s autoscaling and streaming capabilities handle large files efficiently, while the Cloud Function acts as a lightweight orchestrator without processing the data itself.

Exam trap

Google Cloud often tests the misconception that Cloud Functions can handle large data processing tasks directly, but the trap here is ignoring the 9-minute timeout and 2 GB memory limit, which make them unsuitable for files over a few hundred megabytes.

How to eliminate wrong answers

Option B is wrong because Cloud Scheduler cron jobs introduce polling latency (up to 1 minute) and are not truly event-driven, potentially missing the 10-minute completion requirement if files arrive between scans. Option C is wrong because Cloud Functions have a 9-minute timeout and 2 GB memory limit, making them incapable of processing a 5 GB file directly within the required time and resource constraints. Option D is wrong because BigQuery Data Transfer Service is designed for scheduled, batch loads from Cloud Storage, not event-driven processing triggered by new file arrivals, and it lacks the transformation capabilities needed for the pipeline.

635
MCQeasy

A developer wants to store a database password securely and make it accessible to a Compute Engine instance. Which Google Cloud service should be used?

A.Secret Manager
B.Cloud Storage
C.Cloud Filestore
D.Cloud KMS
AnswerA

Secret Manager is the correct choice because it is Google Cloud's purpose-built service for storing sensitive data such as database passwords, API keys, and certificates. It provides fine-grained IAM policies, automatic versioning, audit logging of secret access, and integration with services like Cloud Functions and GKE. Additionally, it supports secret rotation and allows you to enforce retention policies, making it the secure and native solution for managing a database password.

Why this answer

Secret Manager is Google Cloud's dedicated service for storing, managing, and accessing sensitive data such as API keys, passwords, and certificates. It provides versioning, IAM-based access control, audit logging, and automatic encryption. Applications on Compute Engine can retrieve secrets via the Secret Manager API using their attached service account.

Exam trap

The trap is confusing Cloud KMS with Secret Manager — candidates think KMS stores secrets, but KMS only manages encryption keys; Secret Manager is the correct service for storing credentials.

How to eliminate wrong answers

Option B is wrong because Cloud Storage is object storage and lacks secret-specific features like versioning, rotation, and fine-grained access auditing for credentials. Option C is wrong because Cloud Filestore is a managed NFS file system for file sharing, not a secret store. Option D is wrong because Cloud KMS manages encryption keys, not arbitrary secrets like database passwords — KMS is used to encrypt data, not to store credentials directly.

636
MCQmedium

A GCP project administrator needs to share read-only access to all resources in the project with an external auditor who has a Gmail account (auditor@gmail.com). What should the admin do?

A.Create a service account for the auditor and share the JSON key file
B.Grant the Viewer role to auditor@gmail.com in the project's IAM policy
C.Add auditor@gmail.com as a project billing admin to give them read-only access
D.Create a Cloud Identity account for the auditor — Gmail accounts cannot access GCP projects
AnswerB

Cloud IAM supports granting a role to any Google account, and a Gmail address is a valid principal identifier. The Viewer role (roles/viewer) is a predefined IAM role that encompasses read-only permissions across all services in the project, such as listing compute instances, viewing Cloud Storage buckets, and reading configurations. By assigning this role to auditor@gmail.com in the project IAM policy, the auditor gets exactly the read-only visibility needed without any write or management capabilities.

Why this answer

Granting the Viewer (roles/viewer) role to auditor@gmail.com in the project's IAM policy is correct because it provides read-only access to all resources in the project without requiring a Cloud Identity account. Gmail accounts are supported as Google Accounts and can be added directly to IAM policies, allowing them to authenticate and access resources via the GCP Console or APIs.

Exam trap

Google Cloud often tests the misconception that external users with Gmail accounts cannot be added to GCP IAM policies, leading candidates to incorrectly choose the Cloud Identity option, but in reality, any Google Account (including @gmail.com) can be granted IAM roles directly.

How to eliminate wrong answers

Option A is wrong because service accounts are intended for applications and automated workloads, not for individual users; sharing a JSON key file with a person is a security risk and violates best practices for user authentication. Option C is wrong because the Billing Admin role (roles/billing.admin) grants full billing management permissions, not read-only access to project resources, and it does not provide Viewer-level access to compute, storage, or other services. Option D is wrong because Gmail accounts are valid Google Accounts that can be used directly in IAM policies without needing a Cloud Identity account; Cloud Identity is for organizations that want to manage users without Gmail addresses.

637
MCQeasy

A company needs to store structured data with strong consistency and global distribution for a global user base. Which Google Cloud database service is best suited?

A.Bigtable
B.Cloud Spanner
C.Cloud SQL
D.Firestore
AnswerB

Cloud Spanner is Google's globally distributed relational database that combines horizontal scalability with full ACID transactions and strong consistency. It uses the TrueTime API with atomic clocks and GPS to order transactions consistently across regions, delivering external consistency. This makes it the only option here that meets both strong consistency and global distribution, so it is the correct choice.

Why this answer

Cloud Spanner is the correct choice because it provides strong consistency, horizontal scalability, and global distribution via synchronous replication across regions. It supports SQL queries and ACID transactions, making it ideal for structured data that requires both consistency and global access.

Exam trap

The trap here is that candidates often confuse Firestore's multi-region mode with strong global consistency, not realizing that Firestore sacrifices consistency for availability in that configuration, while Cloud Spanner is the only option that guarantees strong consistency across globally distributed regions.

How to eliminate wrong answers

Option A is wrong because Bigtable is a NoSQL wide-column database designed for high-throughput, low-latency analytical workloads, not for strong consistency across global regions (it offers eventual consistency). Option C is wrong because Cloud SQL is a regional relational database that cannot natively replicate across multiple global regions with strong consistency. Option D is wrong because Firestore is a NoSQL document database that offers strong consistency only within a single region; its multi-region mode provides eventual consistency, not the strong consistency required for global distribution.

638
MCQeasy

Your web application serves users globally. Static assets (images, JS, CSS) are stored in Cloud Storage. Users in Asia report slow load times for these assets. The application origin is in `us-central1`. What is the most cost-effective way to improve static asset performance for Asian users?

A.Replicate the Cloud Storage bucket to an Asia region and update DNS to route Asian users to the regional bucket.
B.Enable Cloud CDN on the Cloud Storage bucket's load balancer backend.
C.Deploy Cloud Run instances in Asia regions to serve the static assets.
D.Increase the Cloud Storage bucket's replication factor to improve throughput.
AnswerB

Enabling Cloud CDN on the load balancer backend for the Cloud Storage bucket is the correct approach because it caches static assets at Google's global edge points of presence (PoPs). When an Asian user requests a static file, the CDN serves it from the nearest PoP, avoiding a slow round trip to the us-central1 bucket. This directly reduces latency, lowers origin load, and minimizes egress costs, and it is the purpose-built, scalable solution for static content delivery.

Why this answer

Cloud CDN uses Google's global edge cache network to serve static assets from locations close to users, reducing latency for Asian users without requiring bucket replication or additional compute. It is the most cost-effective solution because it leverages existing Cloud Storage as the origin and only charges for cache egress and operations, avoiding the overhead of managing regional buckets or compute instances.

Exam trap

Google Cloud often tests the misconception that moving data closer to users requires replicating the storage or deploying compute in multiple regions, when in fact a global CDN is the simplest and most cost-effective solution for static content delivery.

How to eliminate wrong answers

Option A is wrong because replicating the Cloud Storage bucket to an Asia region and updating DNS adds complexity and cost for storage and egress, and DNS-based routing does not provide the same low-latency edge caching as Cloud CDN. Option C is wrong because deploying Cloud Run instances in Asia regions to serve static assets is over-engineered and more expensive than using Cloud CDN, as Cloud Run is designed for compute workloads, not static asset delivery. Option D is wrong because Cloud Storage buckets do not have a configurable 'replication factor' to improve throughput; throughput is handled by the underlying infrastructure, and increasing it does not address geographic latency.

639
MCQmedium

A team uses Terraform to manage GCP infrastructure. After running `terraform plan`, they see 15 resources to be created. They want to apply only the Cloud SQL instance (resource name: `google_sql_database_instance.main`) without applying all 15 changes. Which Terraform command targets a specific resource?

A.terraform apply --resource=google_sql_database_instance.main
B.terraform apply -target=google_sql_database_instance.main
C.terraform apply -only=google_sql_database_instance.main
D.terraform plan --filter=google_sql_database_instance.main && terraform apply
AnswerB

`-target=google_sql_database_instance.main` is the correct way to scope a Terraform apply to a single resource. The `-target` flag accepts a resource address in `TYPE.NAME` form (here `google_sql_database_instance.main`) and will apply that resource plus only the resources it directly or indirectly depends on. This creates the Cloud SQL instance without applying the other 14 unrelated resources in the plan. It is the standard targeted-apply pattern for isolating a specific infrastructure change.

Why this answer

Terraform uses the `-target` flag to limit the operation to a specific resource address, allowing you to apply only the `google_sql_database_instance.main` resource without affecting the other 14 resources in the plan. This is the standard Terraform syntax for targeting a single resource during `apply` or `destroy` operations.

Exam trap

Google Cloud often tests the distinction between valid Terraform flags like `-target` and common but invalid flags such as `--resource`, `-only`, or `--filter`, exploiting candidates' familiarity with other tools (e.g., `kubectl` or `gcloud`) that use similar but different syntax.

How to eliminate wrong answers

Option A is wrong because `--resource` is not a valid Terraform flag; Terraform uses `-target` for resource targeting. Option C is wrong because `-only` is not a valid Terraform flag; it does not exist in Terraform's CLI syntax. Option D is wrong because `--filter` is not a valid Terraform flag for `plan`; Terraform does not support filtering resources in `plan` output, and the proposed command chain would not achieve targeted application.

640
MCQeasy

A startup wants to create a new GCP project for development. They've already created a billing account. Which command can they use to create the project?

A.gcloud config set project PROJECT_ID
B.gcloud projects create PROJECT_ID
C.gcloud alpha projects create
D.gcloud resource-manager projects create
AnswerB

gcloud projects create PROJECT_ID is the correct command because it sends a create request to the Cloud Resource Manager API, which provisions a new project with the specified ID. This command requires the resourcemanager.projects.create permission and the PROJECT_ID must be globally unique across all Google Cloud projects. Once created, the project can be used for development and managed via gcloud.

Why this answer

The 'gcloud projects create' command creates a new project. The billing association is separate, but the project can be created without billing immediately.

641
MCQmedium

A developer accidentally exposed their gcloud application default credentials (ADC) file. They need to immediately revoke these credentials. Which command revokes the active application default credentials?

A.gcloud auth revoke [ACCOUNT_EMAIL]
B.gcloud auth application-default revoke
C.Delete the ~/.config/gcloud/application_default_credentials.json file manually
D.gcloud config unset auth/application_default_credentials
AnswerB

`gcloud auth application-default revoke` is the dedicated command that both deletes the local ADC file and sends a revocation request to Google so the underlying OAuth token is invalidated server-side. This ensures that any client library already holding the token can no longer use it, which is the only fully secure way to revoke ADC.

Why this answer

`gcloud auth application-default revoke` is the specific command designed to revoke the Application Default Credentials (ADC) that were set via `gcloud auth application-default login`. This command invalidates the OAuth 2.0 refresh token stored in the ADC file, ensuring the credentials can no longer be used for authentication to Google Cloud APIs.

Exam trap

Google Cloud often tests the distinction between user credentials (`gcloud auth`) and application credentials (`gcloud auth application-default`), and the trap here is that candidates mistakenly think deleting the file or using a general revoke command is sufficient, overlooking the need to explicitly revoke the OAuth refresh token server-side.

How to eliminate wrong answers

Option A is wrong because `gcloud auth revoke [ACCOUNT_EMAIL]` revokes user account credentials used for gcloud CLI operations, not the separate Application Default Credentials (ADC) file. Option C is wrong because simply deleting the file does not revoke the underlying OAuth 2.0 refresh token; the token remains valid until it expires or is explicitly revoked via the command, leaving a potential security gap. Option D is wrong because `gcloud config unset auth/application_default_credentials` unsets a configuration property that does not exist; ADC is managed via a credentials file, not a gcloud config property, so this command has no effect on revoking the credentials.

642
MCQmedium

You have a Cloud Run service configured with `min-instances: 0`. During load testing you notice the first request after a period of inactivity takes 3–5 seconds instead of the normal 100ms. Subsequent requests are fast. What is causing this, and what is the most cost-effective fix?

A.The Cloud Run service's container image is too large; reduce image size.
B.Set `min-instances: 1` to keep a warm instance running and eliminate the cold start latency.
C.Switch from Cloud Run to GKE, which doesn't have cold starts.
D.Increase Cloud Run's request timeout to 30 seconds to accommodate cold starts.
AnswerB

Setting `min-instances: 1` prevents Cloud Run from scaling the service to zero instances, so at least one warm container instance remains available to handle incoming requests at all times. The first request after a period of inactivity reaches an already-initialized instance, eliminating the container startup (image pull, runtime boot, and application init) latency that causes a cold start. This incurs idle-instance billing, but for a low-traffic, latency-sensitive service it is the correct cost-versus-performance trade-off.

Why this answer

With `min-instances: 0`, Cloud Run scales to zero when idle, so the first request must trigger a cold start — provisioning a container instance, pulling the image, and initializing the runtime, which accounts for the 3–5 second delay. Setting `min-instances: 1` keeps one instance warm and ready, eliminating cold start latency while still being the cheapest option compared to always-on alternatives.

Exam trap

The trap here is confusing cold start latency with timeout or image size issues — candidates often pick 'increase timeout' or 'reduce image size' instead of recognizing that scaling to zero is the root cause.

How to eliminate wrong answers

Option A is wrong because image size affects cold start duration but not the root cause of the latency; the service still scales to zero, so a cold start still occurs. Option C is wrong because migrating to GKE is a major architectural change, not a cost-effective fix, and GKE pods can also experience cold starts when scaling from zero. Option D is wrong because increasing the request timeout does not eliminate cold start latency — it only allows the request to wait longer before timing out.

643
MCQmedium

A compliance team needs a log of every time a user or service account accessed data in a BigQuery dataset — specifically read operations. Which Cloud Audit Log type captures this?

A.System event audit logs
B.Admin Activity audit logs
C.Data Access audit logs
D.VPC flow logs
AnswerC

Data Access audit logs are the only Cloud Audit Logs category that records the actual 'read' operations on user data. When enabled, they capture BigQuery jobs such as SELECT queries, table reads, and tabledata.list calls, including the identity of the caller, the queried dataset/table, and the timestamp. These logs are opt-in because they can generate enormous volume, but they are essential for security forensics to determine who accessed specific BigQuery data.

Why this answer

Data Access audit logs record API calls that read or modify user-provided data, including BigQuery read operations like SELECT queries. Since the requirement is specifically for read operations on user data, Data Access logs are the correct type. Admin Activity logs cover configuration changes, not data reads, and System Event logs cover Google-managed actions, not user-initiated reads.

Exam trap

Google Cloud often tests the distinction between Admin Activity logs (which capture resource configuration changes) and Data Access logs (which capture data reads/writes), leading candidates to mistakenly choose Admin Activity for any 'access' scenario.

How to eliminate wrong answers

Option A is wrong because System event audit logs capture Google Cloud administrative actions that change resource configurations, not user or service account data reads. Option B is wrong because Admin Activity audit logs record operations that modify metadata or configurations (e.g., creating a dataset), not read operations on the data itself. Option D is wrong because VPC flow logs capture network traffic metadata (IP addresses, ports, protocols) at the subnet level, not application-level data access like BigQuery queries.

644
MCQeasy

An engineer wants to create a regional GKE cluster with 3 nodes by default. Which command should be used?

A.gcloud container clusters create my-cluster --zone us-central1-a --num-nodes 3
B.gcloud container clusters create my-cluster --region us-central1 --num-nodes 3
C.gcloud container clusters create my-cluster --region us-central1 --nodes 3
D.gcloud compute clusters create my-cluster --region us-central1 --size 3
AnswerB

This is the standard way to create a regional GKE cluster. The --region flag designates a regional cluster where the control plane is replicated across three zones in that region, and nodes are spread across those zones (3 nodes per zone by default with --num-nodes 3). This provides higher availability and is exactly what the engineer needs.

Why this answer

The 'gcloud container clusters create' command with --region (not --zone) creates a regional cluster. --num-nodes specifies the number of nodes per zone.

645
MCQmedium

An organization is running a batch job that processes sensitive data. The job writes output to a Cloud Storage bucket. The security team requires that all data at rest be encrypted with a customer-managed key. Which key type should be used?

A.Cloud HSM
B.Default encryption (Google-managed)
C.Customer-supplied encryption keys (CSEK)
D.Cloud KMS CMEK
AnswerD

Cloud KMS customer-managed encryption keys (CMEK) give the organization direct control over the key material used to encrypt data at rest, including the ability to enable, disable, rotate, and set IAM policies on the key. With CMEK, you create the key in Cloud KMS and then specify that key as the encryption key for the batch job's storage or compute resource, ensuring that no one outside your organization's IAM policy can access the decryption key. This satisfies compliance requirements for customer-managed keys while leveraging Google's managed encryption infrastructure.

Why this answer

Cloud KMS CMEK (Customer-Managed Encryption Keys) is the correct choice because it allows the organization to control and manage the encryption keys used to protect data at rest in Cloud Storage, meeting the security team's requirement for customer-managed keys. CMEK keys are created and managed in Cloud KMS, and you can control key rotation, access, and lifecycle, ensuring compliance with regulatory mandates for customer-managed encryption.

Exam trap

Google Cloud often tests the distinction between key types (CMEK, CSEK, Google-managed) and key protection methods (Cloud HSM, Cloud KMS), so the trap here is confusing Cloud HSM (a key protection option) with a key type, or thinking CSEK is still the recommended customer-managed approach for Cloud Storage.

How to eliminate wrong answers

Option A is wrong because Cloud HSM is a hardware security module service that provides a FIPS 140-2 Level 3 certified environment for key operations, but it is a key hosting option for CMEK keys, not a key type itself; the question asks for the key type, not the key protection method. Option B is wrong because Default encryption (Google-managed) uses Google-managed keys, which do not satisfy the requirement for customer-managed keys, as the organization cannot control or audit the key material. Option C is wrong because Customer-supplied encryption keys (CSEK) are used for client-side encryption where the customer provides the key directly in API calls, but CSEK is deprecated and not recommended for Cloud Storage; moreover, CSEK keys are not managed through Cloud KMS and do not provide the same level of integration, auditing, or lifecycle management as CMEK.

646
Matchingmedium

Match each Google Cloud service to its primary purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Object storage for unstructured data

Serverless data warehouse for analytics

Asynchronous messaging service

Event-driven serverless compute

Managed relational database service

Why these pairings

Google Cloud services each have a specific purpose: Compute Engine for VMs, Cloud Storage for object storage, Cloud SQL for managed relational databases, and BigQuery for data warehousing. Distractors swap these definitions.

647
MCQmedium

A company runs an App Engine Standard application with multiple versions. They want to gradually roll out new features by sending a small percentage of traffic to a new version. How should they implement this?

A.Deploy the new version and delete the old version
B.Use Cloud Load Balancing to distribute traffic between versions
C.Create a new service for the new version and use a custom domain
D.Use App Engine's traffic splitting feature to assign a percentage of traffic to the new version
AnswerD

App Engine's traffic splitting feature lets you specify a percentage of traffic to route to each version of a service, using either a cookie-based or IP-based (or random) split. You can start by sending, say, 5% of requests to the new version, monitor error rates and latency, then gradually increase that percentage while keeping the old version available for instant rollback.

Why this answer

App Engine Standard provides built-in traffic splitting, allowing you to assign a percentage of incoming requests to different versions of the same service. This is the simplest and most direct way to gradually roll out a new feature by sending a small percentage of traffic to the new version without needing external load balancers or additional services.

Exam trap

The trap here is that candidates may confuse App Engine's internal traffic splitting with external Cloud Load Balancing, thinking they need to set up a separate load balancer when App Engine already provides this capability natively for version-level traffic distribution.

How to eliminate wrong answers

Option A is wrong because deleting the old version would immediately send 100% of traffic to the new version, which defeats the purpose of a gradual rollout. Option B is wrong because Cloud Load Balancing is used for distributing traffic across different services or regions, not for splitting traffic between versions of the same App Engine service; App Engine's traffic splitting handles this internally. Option C is wrong because creating a new service for the new version and using a custom domain would require separate scaling and routing, and it does not provide the fine-grained percentage-based traffic splitting between versions within the same service that the question requires.

648
MCQmedium

A team's application emits a custom business metric (orders per minute) via its code. They want to display this metric on a Cloud Monitoring dashboard and alert when it drops below 50 orders per minute. What must be done first?

A.Enable the Custom Metrics feature flag in the GCP Console under Cloud Monitoring settings
B.Instrument the application to write the metric to the Cloud Monitoring API using a client library or OpenTelemetry
C.Create a log-based metric that extracts the orders value from application logs
D.Custom metrics require BigQuery — store values in BigQuery and link it to Cloud Monitoring
AnswerB

Instrument the application with a client library such as google-cloud-monitoring or an OpenTelemetry exporter for Google Cloud, define a MetricDescriptor for your metric type under custom.googleapis.com/, and then call projects.timeSeries.create to push observations. After valid time series data is written, Cloud Monitoring automatically makes the metric available for charting in Metrics Explorer and for use in alerting policies. This is the standard, direct path for application-level custom metrics like orders per minute.

Why this answer

Cloud Monitoring requires metrics to be explicitly ingested via its API or through OpenTelemetry. Custom metrics are not automatically available; the application must be instrumented to write the metric data (e.g., using the `cloud.google.com/go/monitoring` client library or OpenTelemetry exporter) to the Cloud Monitoring API. Without this step, the metric does not exist in Cloud Monitoring for dashboards or alerts.

Exam trap

Google Cloud often tests the misconception that custom metrics require a feature flag or a separate storage service like BigQuery, when in reality the only prerequisite is instrumenting the application to send data to the Cloud Monitoring API.

How to eliminate wrong answers

Option A is wrong because there is no 'Custom Metrics feature flag' in Cloud Monitoring settings; custom metrics are enabled by default once you write data via the API, and no toggle is required. Option C is wrong because a log-based metric extracts values from existing log entries, but the question states the metric is emitted via code, not logs — creating a log-based metric would require the application to first write logs, which is an unnecessary extra step and not the direct method for a custom metric. Option D is wrong because custom metrics do not require BigQuery; Cloud Monitoring stores custom metric data natively in its time-series database, and BigQuery integration is optional for long-term analysis, not a prerequisite.

649
MCQmedium

A data analyst wants to import a SQL dump file from a Cloud Storage bucket into an existing Cloud SQL database. Which command should they use?

A.gcloud sql instances import my-instance gs://my-bucket/dump.sql --database=mydb
B.gcloud sql import sql my-instance gs://my-bucket/dump.sql --database=mydb
C.gcloud sql import csv my-instance gs://my-bucket/dump.sql --database=mydb
D.gcloud sql databases import my-instance gs://my-bucket/dump.sql
AnswerB

This is the correct command. 'gcloud sql import sql' explicitly tells the Cloud SQL API that the source file is a SQL dump (typically generated by mysqldump or pg_dump). The arguments specify the instance name, the Cloud Storage URI of the dump file, and the target database using the --database flag. This syntax works for both MySQL and PostgreSQL instances and is the standard way to import SQL dump files.

Why this answer

The correct command is 'gcloud sql import sql <instance> gs://<bucket>/<file> --database=<db>'. This imports a SQL dump file. The other commands either use wrong syntax or wrong import type (csv for CSV files).

650
MCQhard

A DevOps engineer needs to deploy a containerized microservice to Cloud Run that processes messages from Pub/Sub. The service must authenticate to Google Cloud APIs using a service account. Which Cloud Run deployment command should they use to ensure the service uses a specific service account?

A.gcloud run deploy my-service --image gcr.io/my-project/my-image --service-account my-sa@my-project.iam.gserviceaccount.com --platform managed
B.gcloud run deploy my-service --image gcr.io/my-project/my-image --account my-sa@my-project.iam.gserviceaccount.com
C.gcloud run deploy my-service --image gcr.io/my-project/my-image --impersonate-service-account my-sa@my-project.iam.gserviceaccount.com
D.gcloud run deploy my-service --image gcr.io/my-project/my-image
AnswerA

Using the `--service-account` flag with `gcloud run deploy` explicitly assigns the specified IAM service account as the runtime identity for the Cloud Run service. This is the correct syntax because the flag is designed to set the service account that the container will run as, and `--platform managed` ensures the command targets Cloud Run (fully managed) rather than other platforms. The deployed service will inherit the IAM permissions of `my-sa@my-project.iam.gserviceaccount.com`, which is exactly what the DevOps engineer needs.

Why this answer

Cloud Run supports the --service-account flag to attach a specific service account. The --image flag specifies the container image. The other options either use incorrect flags (--account is for gcloud CLI user, not service account) or miss required flags.

651
MCQmedium

During a gcloud CLI session, a developer runs `gcloud config list` and sees the output shows `project = old-project`. They need to work in `new-project`. Which sequence of commands correctly switches projects and verifies the change?

A.gcloud projects activate new-project; gcloud config list
B.gcloud config set project new-project; gcloud config list
C.gcloud auth login --project=new-project; gcloud config list
D.export GCLOUD_PROJECT=new-project; gcloud config list
AnswerB

Running `gcloud config set project new-project` updates the `core/project` property in the active configuration, making new-project the default project for subsequent gcloud commands. Following that with `gcloud config list` displays the configuration properties, including the newly set project value, providing immediate verification. This is the clean, targeted approach because it directly changes the persistent configuration and uses the built-in command for project selection.

Why this answer

`gcloud config set project new-project` updates the active project in the local CLI configuration, and `gcloud config list` then displays the current configuration, confirming the change. This is the standard method to switch the working project for subsequent gcloud commands.

Exam trap

Google Cloud often tests the distinction between environment variables and configuration file settings, trapping candidates who think setting `GCLOUD_PROJECT` will update the output of `gcloud config list`.

How to eliminate wrong answers

Option A is wrong because `gcloud projects activate new-project` is not a valid gcloud command; the correct command to switch projects is `gcloud config set project`. Option C is wrong because `gcloud auth login --project=new-project` authenticates the user and optionally sets a project during login, but it does not reliably change the project for the current session if a project is already configured; the `--project` flag is only a one-time override and does not persist in the config. Option D is wrong because `export GCLOUD_PROJECT=new-project` sets an environment variable that overrides the project for the current shell session, but `gcloud config list` still reads from the local configuration file and will show the old project unless the config is also updated; the environment variable is not reflected in `gcloud config list` output.

652
MCQmedium

An internal web application running on GKE must be accessible only to employees who are authenticated with the company's Google Workspace account — without exposing it to the internet or using a VPN. Which GCP service provides identity-based access without a VPN?

A.VPC Service Controls creating a perimeter around the GKE cluster
B.Cloud Identity-Aware Proxy (IAP) configured on the load balancer in front of the GKE service
C.Firebase Authentication SDK integrated into the web application frontend
D.Cloud Armor with a Google Workspace IP allowlist
AnswerB

Cloud Identity-Aware Proxy (IAP) placed in front of the load balancer enforces zero-trust access by intercepting every request, forcing employees to authenticate with a Google account, and then checking their IAM roles or groups before authorizing forwarding to the GKE backend. This occurs entirely at the infrastructure layer, so unauthenticated and unauthorized requests are rejected before reaching the application, with no code changes required. IAP provides the exact browser-based identity authentication needed for this web app.

Why this answer

Cloud Identity-Aware Proxy (IAP) is the correct choice because it enforces identity-based access control at the application layer, verifying that users are authenticated via Google Workspace before allowing traffic to reach the GKE service through an HTTPS load balancer. This eliminates the need for a VPN or public internet exposure by leveraging Google's global infrastructure to authenticate and authorize each request based on the user's identity and context.

Exam trap

The trap here is that candidates often confuse network-level controls (VPC Service Controls, Cloud Armor IP allowlists) with identity-based access, or they assume client-side authentication (Firebase) is sufficient for server-side access control, missing that IAP is the only service that combines identity verification with network edge enforcement without a VPN.

How to eliminate wrong answers

Option A is wrong because VPC Service Controls creates perimeters to prevent data exfiltration and restrict access based on network context, but it does not provide per-user authentication or authorization for individual HTTP requests; it operates at the VPC network boundary, not the application layer. Option C is wrong because Firebase Authentication SDK is designed for client-side user authentication in web and mobile apps, but it does not integrate with GKE's ingress or load balancer to control access at the network edge, and it would require exposing the application to the internet for the SDK to function. Option D is wrong because Cloud Armor with a Google Workspace IP allowlist is not feasible, as Google Workspace does not publish a static or predictable set of IP addresses for all employee connections; employees may connect from various networks, including home or mobile, making IP-based allowlisting ineffective for identity-based access.

653
Multi-Selecthard

Your Cloud Run service has a new revision that you want to gradually shift traffic to. You want to send 10% of traffic to the new revision and 90% to the current one. Which TWO steps are required? (Choose TWO.)

Select 2 answers
A.Set a new default URL for the new revision.
B.Delete the old revision.
C.Create the new revision by updating the service with a new image tag.
D.Enable VPC ingress for the new revision.
E.Use gcloud run services update-traffic to set traffic percentages.
AnswersC, E

Updating the service with a new image tag, for example via `gcloud run deploy`, is what creates a new revision. A revision cannot be manually created in isolation—it is always the result of deploying a new container image or configuration change. This step is a prerequisite because the later `update-traffic` command must reference the new revision's name to assign it a percentage of incoming requests.

Why this answer

You first create the new revision (by updating the service) and then modify traffic percentages.

654
MCQeasy

You have a Compute Engine VM that is running a critical application. You need to change its machine type from n1-standard-4 to n2-standard-8. What is the correct procedure?

A.Stop the instance, then use gcloud compute instances set-machine-type, then start the instance
B.Use gcloud compute instances update --machine-type n2-standard-8 while the instance is running
C.Delete the instance and create a new one with the desired machine type
D.Use gcloud compute instances resize --machine-type n2-standard-8 without stopping
AnswerA

Stopping the instance first moves it to the TERMINATED state, where the underlying vCPU/memory allocation can be changed. The `gcloud compute instances set-machine-type` command only works on a stopped instance, so stopping, changing, then starting is the documented, supported path. This preserves the boot disk, persistent disks, static IP, and all instance metadata.

Why this answer

To change the machine type of a running Compute Engine VM, you must stop the instance, use the set-machine-type command (or console) to change the machine type, and then start the instance. This is because the machine type determines the virtual hardware, and changing it requires the instance to be stopped.

Exam trap

ACE often tests the correct procedure for changing machine types, and candidates may think it can be done live or via a resize command, but it requires a stop/start cycle.

How to eliminate wrong answers

Option B is wrong because there is no 'update --machine-type' command for a running instance; the machine type cannot be changed while the instance is running. Option C is wrong because deleting and recreating the instance would lose the instance's configuration and potentially data unless you recreate from a disk, but it's not the correct procedure. Option D is wrong because there is no 'resize' command for machine type; the correct command is 'set-machine-type' and it requires the instance to be stopped.

655
MCQmedium

A team deploys a containerized service to Cloud Run. After deployment, requests are timing out after 60 seconds. The service sometimes needs 3 minutes to process certain long-running requests. What should the team adjust?

A.Increase the minimum number of instances to reduce cold starts
B.Increase the Cloud Run request timeout to at least 180 seconds
C.Set concurrency to 1 to ensure each instance handles only one request at a time
D.Switch to Cloud Run Jobs instead of Cloud Run Services
AnswerB

Cloud Run's default request timeout is 60 seconds, and requests that exceed it are terminated, causing the client to see a timeout error. For requests that legitimately need up to 3 minutes, you must explicitly increase the timeout to at least 180 seconds (the maximum allowed is 3600 seconds). You can set this in the Cloud Run console or via the `--timeout` flag when deploying, which directly extends the per-request handling time to cover the full duration needed.

Why this answer

Cloud Run has a default request timeout of 60 seconds. Since the service requires up to 3 minutes (180 seconds) for certain long-running requests, the timeout must be increased to at least 180 seconds. This is configured via the `--timeout` flag or the `timeout_seconds` field in the YAML configuration, and the maximum allowed value is 60 minutes (3600 seconds).

Exam trap

Google Cloud often tests the distinction between timeout-related issues and scaling or concurrency issues, so candidates mistakenly choose options that address cold starts or concurrency when the real problem is a hard timeout limit.

How to eliminate wrong answers

Option A is wrong because increasing the minimum number of instances reduces cold start latency but does not affect the request timeout; the 60-second timeout will still terminate long-running requests. Option C is wrong because setting concurrency to 1 limits the number of concurrent requests per instance but does not extend the request timeout; the request will still be terminated after 60 seconds. Option D is wrong because Cloud Run Jobs are designed for batch workloads that run to completion, not for handling HTTP requests; switching to Jobs would break the service's HTTP endpoint functionality.

656
MCQmedium

A company recently deployed a web application on a managed instance group (MIG) behind a regional external HTTP(S) load balancer. The application is a Python Flask app running on Compute Engine VMs. After a code update that caused increased response times under load, users report intermittent 503 errors. You examine the load balancer logs and see that the backend instances are periodically marked as unhealthy. The health check is configured to query the /health endpoint every 5 seconds with a healthy threshold of 2 and a timeout of 1 second. The application's /health endpoint returns 200 OK, but sometimes takes up to 1.5 seconds to respond. What is the most likely cause of the health check failures?

A.The instances are overloaded and failing health checks intermittently.
B.The health check response timeout is too low for the application's increased response time.
C.The health check firewall rule is missing or misconfigured.
D.The health check is checking the wrong port.
AnswerB

A managed instance group health check has a configurable timeout that defines how long the probe waits for a response before marking the instance unhealthy. After the change, the application's /health endpoint consistently returns 200 but only after ~1.5 seconds, which exceeds the 1-second timeout. This creates false negatives: the instance is healthy, but the probe gives up too early and the instance is removed from load balancing. Increasing the timeout (or reducing endpoint latency) resolves the issue.

Why this answer

The health check is configured with a timeout of 1 second, but the /health endpoint now takes up to 1.5 seconds to respond due to the code update. Since the health check waits only 1 second for a response, any request that takes longer than that will be considered a failure, causing the backend to be marked unhealthy and triggering 503 errors. This is a classic mismatch between health check timeout and application response time.

Exam trap

Google Cloud often tests the distinction between a health check timing out versus the instance being truly unhealthy—candidates may incorrectly attribute intermittent 503s to overload (Option A) rather than recognizing that the health check timeout value is the direct cause when the endpoint response time exceeds it.

How to eliminate wrong answers

Option A is wrong because while overloaded instances can cause health check failures, the specific evidence here is that the /health endpoint itself takes up to 1.5 seconds to respond, which directly exceeds the 1-second timeout—overload is a possible symptom but not the root cause. Option C is wrong because a missing or misconfigured firewall rule would cause health checks to fail consistently (all probes would time out or be dropped), not intermittently with some successful responses. Option D is wrong because the health check is configured to query the /health endpoint on the correct port (default HTTP 80 or the port the app listens on), and the logs show that the endpoint does respond, just slowly—so the port is not the issue.

657
MCQmedium

A developer receives a "Permission 'cloudfunctions.functions.call' denied" error when trying to invoke a Cloud Function from another service. What is the most likely cause?

A.The service account of the caller lacks the Cloud Functions Invoker role.
B.The function is not deployed to the correct region.
C.The Cloud Function has a CORS misconfiguration.
D.The VPC connector is not configured correctly.
AnswerA

Cloud Functions enforces IAM authorization at the time of invocation: the caller's identity (a user or service account) must hold the roles/cloudfunctions.invoker role on the function. If that binding is missing, the Cloud Functions API responds with HTTP 403 Permission Denied even though the function exists and is healthy. This is the standard failure when a service account is used for authentication without explicitly granting the invoker role.

Why this answer

The error 'Permission cloudfunctions.functions.call denied' indicates that the Identity and Access Management (IAM) policy does not grant the caller the required permission to invoke the function. The Cloud Functions Invoker role (roles/cloudfunctions.invoker) specifically allows the `cloudfunctions.functions.call` permission, which is necessary for HTTP-triggered functions. Without this role on the caller's service account, any invocation attempt will be denied, regardless of other configurations.

Exam trap

Google Cloud often tests the distinction between IAM permission errors and network/configuration errors, so candidates mistakenly choose CORS or VPC options because they think invocation failures are always due to networking or browser restrictions, but the specific error message points directly to a missing IAM role.

How to eliminate wrong answers

Option B is wrong because deploying to the wrong region would cause a 'function not found' or routing error, not a permission denied error; the IAM check occurs before regional routing. Option C is wrong because CORS misconfiguration affects browser-based cross-origin requests by blocking HTTP responses, not the underlying IAM authorization; the error message explicitly references a permission denial, not a CORS header issue. Option D is wrong because VPC connector misconfiguration would cause network connectivity failures (e.g., timeouts or unreachable endpoints) but does not affect IAM permission checks; the error is about authorization, not network access.

658
MCQhard

A healthcare company uses GCP to store sensitive patient data in Cloud Storage buckets. Their security policy requires that all data access be logged and that any attempt to access data from outside the corporate network is blocked. They have implemented VPC Service Controls to create a service perimeter around the projects containing the buckets. They have also enabled Data Access audit logs. However, during an audit, they find that a few access attempts from an IP address outside the corporate network succeeded. The logs show that the requests were made using service account credentials. The service account has the storage.objectViewer role on the bucket. The VPC Service Controls perimeter is configured to block all access from outside the perimeter, but the logs show that some requests were allowed. What is the most likely reason?

A.The VPC Service Controls perimeter was configured with an access level that permits certain IP ranges.
B.The bucket is outside the service perimeter.
C.The service account is a member of the perimeter.
D.The VPC Service Controls perimeter does not block requests made by service accounts.
AnswerA

VPC Service Controls access levels allow you to define context-based conditions, such as allowed IP ranges, under which requests are permitted. If the requester's external IP address falls within a range listed in the access level, the perimeter will not block the request even though it originates outside the VPC network. Thus, the configuration of an IP-based access level explains why the sensitive data was accessible.

Why this answer

VPC Service Controls can be configured with access levels that define allowed client IP ranges. If the access level permits the IP addresses from which the service account requests originated, those requests would be allowed even though they come from outside the corporate network. The logs confirm that the requests used service account credentials, and the storage.objectViewer role grants read access, so the only remaining control that could have been bypassed is the VPC Service Controls perimeter — and an overly permissive access level is the most likely cause.

Exam trap

Google Cloud often tests the misconception that VPC Service Controls blocks all traffic from outside the perimeter unconditionally, but the trap here is that access levels can create exceptions that allow specific IP ranges, including non-corporate IPs, to bypass the block.

How to eliminate wrong answers

Option B is wrong because if the bucket were outside the service perimeter, VPC Service Controls would not apply at all, and the question states the perimeter is configured around the projects containing the buckets, so the buckets are inside the perimeter. Option C is wrong because service accounts are not 'members' of a service perimeter; VPC Service Controls perimeters define boundaries around projects, not individual identities, and service accounts inside the perimeter are still subject to the same ingress/egress rules. Option D is wrong because VPC Service Controls does block requests made by service accounts when those requests originate from outside the perimeter, unless an access level or other exception is explicitly configured.

659
MCQmedium

You create a new Google Cloud project using the Cloud Console. After creating the project, you need to enable the Compute Engine API. What is the correct command to do this using the Cloud Shell?

A.gcloud projects enable compute.googleapis.com
B.gcloud compute enable compute.googleapis.com
C.gcloud api enable compute
D.gcloud services enable compute.googleapis.com
AnswerD

gcloud services enable compute.googleapis.com is the correct command to enable the Compute Engine API in the current project. It interacts with the Service Usage API to set the service's enabled state for the active project. After running this command, you can start using Compute Engine features, assuming a billing account is linked and the IAM permission serviceusage.services.enable is granted. The full service name compute.googleapis.com uniquely identifies the API.

Why this answer

The correct command to enable an API in a Google Cloud project is 'gcloud services enable <API_NAME>'. For Compute Engine, the API name is compute.googleapis.com, so the full command is 'gcloud services enable compute.googleapis.com'. This uses the Service Usage API under the hood to enable the specified service for the active project.

Exam trap

The trap is mixing up command groups — candidates pick 'gcloud projects enable' or 'gcloud compute enable' because those groups sound plausible, but the correct group is 'gcloud services' with the full API name.

How to eliminate wrong answers

Option A is wrong because 'gcloud projects enable' is not a valid gcloud command group — project management uses 'gcloud projects' for create/delete/describe, not for enabling APIs. Option B is wrong because 'gcloud compute enable' is not a valid subcommand; 'gcloud compute' manages Compute Engine resources (instances, disks, etc.), not API enablement. Option C is wrong because 'gcloud api enable' is not a valid command group — the correct group is 'gcloud services', and the API identifier must be the full service name (compute.googleapis.com), not the short name 'compute'.

660
MCQmedium

A gaming company's GKE cluster uses a mix of node pools: a standard on-demand pool for stateful database pods, and a Spot VM pool for compute-intensive but fault-tolerant game simulation pods. The simulation pods occasionally get preempted. How should the Deployment be configured to route simulation pods to the Spot pool only?

A.Set podAffinity to prefer nodes where Spot pods are running
B.Add a nodeSelector: cloud.google.com/gke-spot: 'true' to the simulation Deployment spec
C.Set requests.cpu and requests.memory to very high values — GKE will route them to Spot nodes
D.Name the simulation Deployment with a 'spot-' prefix — GKE routes prefixed deployments to Spot pools
AnswerB

Adding `nodeSelector: cloud.google.com/gke-spot: 'true'` is the precise way to ensure the Simulation pod lands on a Spot node. When a node pool is created with Spot VM settings, Google Kubernetes Engine automatically labels every node with `cloud.google.com/gke-spot=true`. A nodeSelector constrains the pod's scheduling to nodes that carry that exact label, which is a hard constraint during the scheduling decision. This directly targets the Spot pool without relying on ambiguous affinity logic or naming conventions.

Why this answer

GKE uses the node label `cloud.google.com/gke-spot` to identify Spot VMs. Adding a `nodeSelector` with that exact key-value pair ensures the simulation Deployment is scheduled exclusively on Spot nodes, which is the intended behavior for fault-tolerant, preemptible workloads.

Exam trap

The trap here is that candidates may confuse `nodeSelector` with `podAffinity` or assume GKE uses naming conventions or resource requests to determine node pool placement, when in fact it relies on node labels and taints.

How to eliminate wrong answers

Option A is wrong because `podAffinity` influences scheduling based on pod relationships, not node types; it would not restrict pods to Spot nodes. Option C is wrong because setting high resource requests does not route pods to Spot nodes; it only affects scheduling based on available capacity, and GKE does not use resource requests to determine node pool type. Option D is wrong because GKE does not route deployments to Spot pools based on naming conventions; node selection is controlled by labels, taints, and tolerations, not prefixes.

661
MCQmedium

A company has a Cloud Run service that needs to access a Cloud SQL database. What is the recommended way to connect securely?

A.Use Cloud SQL Proxy by adding the Cloud SQL instance connection name to the Cloud Run service
B.Use a public IP for the Cloud SQL instance and whitelist the Cloud Run service's IP
C.Store database credentials in environment variables
D.Use VPC peering to connect Cloud Run to Cloud SQL
AnswerA

When you bind a Cloud Run service to a Cloud SQL instance by its connection name, the platform automatically injects and runs the Cloud SQL Auth Proxy as a sidecar container. The proxy connects to the database over an encrypted channel using either a private IP or a Unix socket, and it leverages IAM permissions to authorize the connection. This pattern avoids static IP management, network whitelisting, and manual secret handling, making it the officially recommended integration.

Why this answer

The recommended way for Cloud Run to connect to Cloud SQL is to use the Cloud SQL Auth Proxy (or the built-in Cloud SQL connector) by specifying the instance connection name in the Cloud Run service configuration. This provides secure, IAM-authenticated, encrypted connectivity without exposing the database to the public internet. It is the Google-recommended pattern for serverless-to-Cloud SQL connectivity.

Exam trap

ACE often tests the misconception that VPC peering or public IP whitelisting is the way to connect Cloud Run to Cloud SQL; the correct answer is the Cloud SQL Auth Proxy with the instance connection name, which candidates overlook in favor of network-level solutions.

How to eliminate wrong answers

Option B is wrong because using a public IP and whitelisting the Cloud Run service's IP is unreliable — Cloud Run instances have dynamic egress IPs unless you configure Serverless VPC Access with a static IP, and exposing the database publicly increases attack surface. Option C is wrong because storing credentials in environment variables is a security anti-pattern; it does not address secure connectivity and risks credential leakage. Option D is wrong because VPC peering connects VPC networks, but Cloud Run is a serverless platform that requires Serverless VPC Access (not direct peering) to reach a VPC, and Cloud SQL Proxy is still the recommended secure connection method.

662
MCQmedium

A developer is deploying a containerized application on Cloud Run. The application needs to be invoked by external HTTPS requests without requiring authentication. Which flag should be included in the 'gcloud run deploy' command?

A.--invoker=public
B.--allow-unauthenticated
C.--ingress=internal
D.--no-allow-unauthenticated
AnswerB

The `--allow-unauthenticated` flag is the correct way to enable public HTTPS access to a Cloud Run service. When set at deploy time, Cloud Run binds the IAM role `roles/run.invoker` to the special `allUsers` principal, allowing any client to invoke the service without providing credentials. This directly satisfies the requirement of making the containerized app reachable from the internet.

Why this answer

The `--allow-unauthenticated` flag on `gcloud run deploy` grants the Cloud Run Invoker IAM role to `allUsers`, making the service publicly callable over HTTPS without an identity token. This is the documented way to expose a Cloud Run service to unauthenticated external traffic.

Exam trap

ACE often tests the confusion between ingress control (network reachability) and authentication (identity), leading candidates to pick `--ingress=internal` when the question is about public unauthenticated access.

How to eliminate wrong answers

Option A is wrong because `--invoker=public` is not a valid gcloud flag; invoker permissions are managed via IAM, not a deploy flag. Option C is wrong because `--ingress=internal` restricts traffic to internal sources (VPC or internal load balancer), the opposite of what is needed. Option D is wrong because `--no-allow-unauthenticated` explicitly requires authentication, which contradicts the requirement.

663
Multi-Selectmedium

A company needs to deploy a web application on Google Cloud that requires high availability across multiple regions. Select TWO services that can help achieve this.

Select 2 answers
A.Global HTTP(S) Load Balancing
B.Cloud VPN
C.Cloud SQL with cross-region replication
D.Cloud NAT
E.Cloud CDN
AnswersA, C

Global HTTP(S) Load Balancing is a correct choice because it uses a single anycast IP to route user traffic to the closest healthy backend across multiple Google Cloud regions. It automatically detects and drains unhealthy backends, supports autoscaling, and provides layer 7 content-based routing. This service delivers the required high availability for the web application's compute and network layer.

Why this answer

Global HTTP(S) Load Balancing distributes traffic across regions, and Cloud SQL with cross-region replication provides database redundancy. Compute Engine instances in multiple regions serve traffic, and load balancing handles failover.

664
MCQmedium

A company is deploying a stateful application on Google Kubernetes Engine (GKE) that requires persistent storage. Each pod needs its own dedicated persistent disk that is not shared. Which Kubernetes resource should be used to manage the deployment?

A.Job with PersistentVolume
B.DaemonSet with hostPath volumes
C.Deployment with PersistentVolumeClaim template
D.StatefulSet with volumeClaimTemplates
AnswerD

StatefulSet is purpose-built for stateful applications: each pod gets a stable, ordinal identity (e.g., web-0, web-1) and a matching PersistentVolumeClaim provisioned from the volumeClaimTemplates block. When a pod is rescheduled, the StatefulSet controller reattaches the same PVC to the same pod name, preserving the data and ensuring consistent storage across restarts. This combination of stable identity, ordered deployment, and per-pod persistent storage is exactly what a stateful service on Google Kubernetes Engine needs.

Why this answer

A StatefulSet with volumeClaimTemplates is designed for stateful applications where each pod requires its own dedicated PersistentVolume (PV) that is not shared. The volumeClaimTemplates automatically generate a unique PersistentVolumeClaim (PVC) for each pod replica, ensuring each pod gets a separate, stable persistent disk that persists across rescheduling. This matches the requirement for a stateful application on GKE where pods need dedicated, non-shared storage.

Exam trap

Google Cloud often tests the distinction between Deployments and StatefulSets, and the trap here is that candidates mistakenly choose a Deployment with a PVC template, not realizing that Deployments treat all pods as interchangeable and would share the same PVC, violating the 'dedicated disk per pod' requirement.

How to eliminate wrong answers

Option A is wrong because a Job is used for batch or one-time tasks, not for managing a long-running stateful application, and a PersistentVolume alone does not provide per-pod dedicated storage without a PVC. Option B is wrong because a DaemonSet runs one pod per node, typically for cluster-level services like logging or monitoring, and hostPath volumes use the node's local filesystem, which does not provide dedicated, persistent storage that survives pod rescheduling across nodes. Option C is wrong because a Deployment with a PersistentVolumeClaim template would share the same PVC across all replicas, leading to shared storage and potential data corruption, whereas the requirement is for each pod to have its own dedicated disk.

665
MCQmedium

An engineer creates a firewall rule allowing ingress on port 8080 from source range 10.0.0.0/8 with priority 1000. Another rule denies ingress on port 8080 from source range 10.0.0.0/24 with priority 500. What is the effective behavior for traffic from 10.0.0.1?

A.Traffic is denied only if the source is exactly 10.0.0.1; otherwise allowed.
B.Traffic is denied because the deny rule has a higher priority (lower number).
C.Traffic is allowed because the allow rule covers a larger range.
D.Traffic is allowed because both rules match and the default is to allow.
AnswerB

In Google Cloud VPC firewall rules, priority values determine evaluation order; lower numbers are evaluated first. The deny rule has a priority of 500, whereas the allow rule has 1000, so the deny rule is matched first. Because GCP applies the first matching rule and then stops, the traffic is denied before the allow rule is ever considered.

Why this answer

GCP firewall rules are evaluated by priority, where a lower number means higher priority. The deny rule has priority 500, which is lower than the allow rule's priority 1000, so the deny rule is evaluated first and matches traffic from 10.0.0.1 (which falls within 10.0.0.0/24). Therefore, the traffic is denied.

Exam trap

ACE often tests the inverted priority logic in GCP — candidates assume higher numbers mean higher priority (as in some other systems), but in GCP, lower numbers win.

How to eliminate wrong answers

Option A is wrong because the deny rule applies to the entire 10.0.0.0/24 subnet, not just the single IP 10.0.0.1, and the behavior is not conditional on the exact source. Option C is wrong because rule priority, not the size of the source range, determines which rule takes effect; a more specific deny with higher priority overrides a broader allow. Option D is wrong because GCP does not default to allow when rules conflict — the highest-priority matching rule wins, and there is no implicit allow for ingress (the implied default is deny).

666
MCQhard

A DevOps team uses Terraform to manage GCP infrastructure and wants to store Terraform state in a shared location that all team members can access securely, with state locking to prevent concurrent modifications. Which backend configuration achieves this?

A.gcs backend storing state in a Cloud Storage bucket
B.gcp backend storing state in a BigQuery table
C.remote backend connected to a Cloud SQL database
D.local backend with a path shared over Cloud Filestore
AnswerA

The `gcs` backend is the official Google Cloud Terraform backend: it stores the state file in a Cloud Storage bucket and supports state locking through the coordinated creation of a lock object using GCS object generation and precondition checks. This lock is released after the operation, preventing concurrent runs from corrupting state. It also supports bucket versioning to retain history and can use customer-managed encryption keys (CMEK) for at-rest protection, making it the correct choice for team collaboration.

Why this answer

The `gcs` backend is the correct choice because it stores Terraform state in a Google Cloud Storage bucket, which provides secure, shared access via IAM policies and supports state locking natively through object versioning and write-preconditions. This ensures that only one team member can modify the state at a time, preventing conflicts and corruption.

Exam trap

The trap here is that candidates confuse the `gcp` provider (which manages GCP resources) with a backend name, or assume that any shared filesystem (like Cloud Filestore) can provide locking, ignoring that Terraform requires atomic, server-side locking which only object storage backends like `gcs` or `s3` provide natively.

How to eliminate wrong answers

Option B is wrong because BigQuery is a data warehouse for analytics, not a state storage backend; it lacks native state locking and is not designed for the atomic write operations Terraform requires. Option C is wrong because the `remote` backend in Terraform is specifically for Terraform Cloud or Terraform Enterprise, not for connecting to a Cloud SQL database, which would require custom scripting and does not support built-in state locking. Option D is wrong because the `local` backend stores state on the local filesystem; sharing a path over Cloud Filestore does not provide state locking, as NFS does not support the atomic file locks Terraform needs, leading to race conditions and state corruption.

667
MCQhard

A GCP organization has 150 projects. A new security policy requires all projects to enable the Security Command Center API. What is the most efficient way to enable this API across all projects without manually visiting each project?

A.Manually enable the API in each of the 150 projects via the Cloud Console
B.Use a gcloud script to iterate over all projects and enable the API for each
C.Enable the API at the organization level — it inherits down to all projects
D.Create an organization policy enabling all APIs on all projects
AnswerB

Using a gcloud script to iterate over all projects is a recommended, scalable, and auditable approach. A script can call `gcloud projects list` to enumerate the project IDs and then execute `gcloud services enable <api> --project=<id>` for each one, making the operation idempotent and repeatable. This can be filtered to target only the relevant 150 projects and easily integrated into CI/CD pipelines or run as a one-time maintenance task. It is preferable because it eliminates the risk of human error, provides a clear command log, and requires minimal effort even for hundreds of projects.

Why this answer

The gcloud command-line tool allows you to script the enabling of the Security Command Center API across all projects efficiently. Using `gcloud services enable securitycenter.googleapis.com --project=<project_id>` in a loop over the list of projects automates the task without manual intervention, leveraging the Cloud SDK's programmatic access to the Service Usage API.

Exam trap

Google Cloud often tests the misconception that organization-level settings automatically propagate API enablement to all projects, but in GCP, APIs must be explicitly enabled per project, and organization policies only enforce constraints, not service activation.

How to eliminate wrong answers

Option A is wrong because manually enabling the API in each of 150 projects via the Cloud Console is time-consuming and error-prone, contradicting the requirement for the 'most efficient' method. Option C is wrong because enabling an API at the organization level does not automatically inherit down to all projects; APIs must be enabled per project, and organization-level settings only control policies, not service enablement. Option D is wrong because organization policies cannot enable APIs; they enforce constraints (e.g., resource restrictions) via the Organization Policy Service, not service activation, and there is no policy to enable all APIs.

668
MCQeasy

A GKE pod's container is frequently crashing and restarting. You need to view the logs from the previous container instance (before the last crash) to diagnose the crash cause. Which command retrieves these logs?

A.`kubectl logs POD_NAME`
B.`kubectl logs POD_NAME --previous`
C.`kubectl describe pod POD_NAME`
D.`kubectl get events --field-selector reason=OOMKilled`
AnswerB

The `--previous` flag instructs kubectl to fetch the log output from the last terminated container instance in the pod. This is exactly what's needed because when a container enters a crash loop, the current instance may be freshly restarted and have no logs, while the previous instance contains the error messages, stack traces, or panic output that caused the termination. It works for both single- and multi-container pods, though for multi-container pods you must also use `-c <container-name>` to identify the correct container.

Why this answer

The `--previous` flag in `kubectl logs` retrieves logs from the previous instance of a container in a pod, which is exactly what you need when the current container has crashed and restarted. This allows you to see the logs that led to the crash, even though the container is now running a new instance.

Exam trap

The trap here is that candidates often confuse `kubectl logs` with `kubectl describe` or `kubectl get events`, thinking those commands provide log output, when in fact only `kubectl logs` retrieves container logs and the `--previous` flag is the specific mechanism to access logs from a crashed instance.

How to eliminate wrong answers

Option A is wrong because `kubectl logs POD_NAME` only shows logs from the currently running container instance, not from the previous crashed instance, so it would not show the crash cause. Option C is wrong because `kubectl describe pod POD_NAME` shows pod metadata, status, and events, but does not retrieve container logs; it cannot show the log output from the previous container instance. Option D is wrong because `kubectl get events --field-selector reason=OOMKilled` only filters for Out-Of-Memory kill events, which is too narrow and may miss other crash reasons; it also does not retrieve the actual container logs needed for diagnosis.

669
MCQhard

An organization wants to enable Data Access audit logs for all Cloud Storage buckets in a project. Which step is necessary?

A.Use gcloud logging to create a log sink for Cloud Storage.
B.Enable Data Access logs in each bucket's settings.
C.Configure an organization policy or IAM audit config to enable Data Access logs for Cloud Storage.
D.Add an IAM binding with the roles/logging.admin role to a user.
AnswerC

This is the correct approach: Data Access audit logs for Cloud Storage are enabled by adding a Cloud Storage audit config at the project, folder, or organization level using the IAM 'Audit Logs' tab or by setting an auditConfig in the IAM policy. You can specify the service storage.googleapis.com and include the desired permission types—ADMIN_READ, DATA_READ, DATA_WRITE—or use ALL. After the audit config is applied, Cloud Logging begins recording data access events on the matching buckets automatically, with no further per-bucket steps needed.

Why this answer

To enable Data Access audit logs for all Cloud Storage buckets in a project, you must configure audit logging at the project or organization level using IAM audit configs or an organization policy. This sets the desired audit log type (DATA_READ, DATA_WRITE, ADMIN_READ) for the Cloud Storage service across all buckets, rather than configuring each bucket individually.

Exam trap

ACE often tests the misconception that Data Access logs are enabled per-resource (like a bucket) or via log sinks, when in fact they are enabled at the project/organization level through IAM audit configs.

How to eliminate wrong answers

Option A is wrong because a log sink routes logs to a destination but does not enable Data Access logs; the logs must first be enabled via audit config. Option B is wrong because Data Access logs are not enabled per-bucket in Cloud Storage settings; they are controlled at the project/organization IAM audit config level. Option D is wrong because granting roles/logging.admin to a user only provides permissions to manage logging, not the act of enabling Data Access logs for a service.

670
MCQhard

A developer is using Cloud Shell and wants to ensure that their gcloud configuration persists after the Cloud Shell session ends. They have set the compute and access settings using `gcloud config set`. What should they do to keep these settings for future sessions?

A.They need to create a startup script to apply the settings each time
B.The settings are automatically preserved because Cloud Shell's home directory persists
C.They must run `gcloud config configurations save default` before ending the session
D.They must use `gcloud config set --persist` flag
AnswerB

Cloud Shell provisions an ephemeral VM but attaches a persistent 5 GB home directory for each user. gcloud configurations are stored as files under ~/.config/gcloud, so whenever the developer runs `gcloud config set project`, the value is written to disk and remains available in future sessions. When the session ends, any new VM in a future session mounts the same home directory, preserving the settings automatically.

Why this answer

Cloud Shell provides a persistent $HOME directory backed by a 5 GB persistent disk that survives across sessions. Because gcloud configuration is stored in $HOME/.config/gcloud, any `gcloud config set` changes are written there and automatically restored when the user reconnects. No additional action is required.

Exam trap

ACE often tests the misconception that Cloud Shell is fully ephemeral, leading candidates to invent persistence flags or startup scripts when the home directory already persists by default.

How to eliminate wrong answers

Option A is wrong because a startup script is unnecessary — the home directory already persists, so re-applying settings would be redundant. Option C is wrong because `gcloud config configurations save` is not a valid gcloud subcommand; configurations are created with `gcloud config configurations create` and activated with `activate`. Option D is wrong because `--persist` is not a valid flag for `gcloud config set`; persistence is inherent to the home directory.

671
MCQmedium

An engineer wants to deploy a Python function that processes messages from a Pub/Sub topic. The function should be triggered whenever a message is published to the topic. Which command should the engineer use to deploy the function?

A.gcloud functions deploy my-function --runtime python39 --trigger-http --entry-point main --region=us-central1
B.gcloud functions deploy my-function --runtime python39 --trigger-topic my-topic --entry-points main --region=us-central1
C.gcloud functions deploy my-function --runtime python39 --trigger-topic my-topic --entry-point main --region=us-central1
D.gcloud functions deploy my-function --runtime python39 --trigger-bucket my-bucket --entry-point main --region=us-central1
AnswerC

This is the correct command because --trigger-topic my-topic binds the function to Pub/Sub, causing it to be invoked every time a message is published to that topic. The --entry-point main identifies the Python callable in the code, while --runtime python39 specifies the runtime. It correctly deploys a background Cloud Function without exposing an HTTP endpoint.

Why this answer

The correct command uses --trigger-topic my-topic to bind the function to a Pub/Sub topic, and --entry-point main (singular) to name the function entry point. This deploys a background function that Cloud Functions invokes whenever a message is published to the topic. The runtime and region flags are also correctly specified.

Exam trap

ACE often tests the exact flag spelling and trigger type — candidates confuse --entry-point with --entry-points, or pick --trigger-http/--trigger-bucket when the scenario explicitly requires Pub/Sub topic triggering.

How to eliminate wrong answers

Option A is wrong because --trigger-http creates an HTTP-triggered function, not a Pub/Sub-triggered one, so it would not fire on topic messages. Option B is wrong because the flag is --entry-point (singular), not --entry-points; the plural form is invalid and the deployment would fail. Option D is wrong because --trigger-bucket binds the function to Cloud Storage object events, not Pub/Sub messages, so it would not respond to topic publishes.

672
MCQmedium

An organization needs to import a SQL dump file from a Cloud Storage bucket into an existing Cloud SQL for PostgreSQL instance. Which command should they use?

A.gcloud sql export sql my-instance gs://bucket/dump.sql
B.gcloud sql import sql my-instance gs://bucket/dump.sql --database=mydb
C.gcloud sql instances import my-instance gs://bucket/dump.sql
D.gcloud sql import csv my-instance gs://bucket/dump.sql --database=mydb
AnswerB

The gcloud sql import sql command imports a SQL dump from a Cloud Storage URI into an existing instance, and --database=mydb directs the dump into the named database. This matches the stem's requirement to load a dump into Cloud SQL for PostgreSQL.

Why this answer

The correct command is 'gcloud sql import sql my-instance gs://bucket/dump.sql --database=mydb', which imports a SQL dump file from a Cloud Storage bucket into an existing Cloud SQL instance and specifies the target database. The 'gcloud sql import sql' subcommand is designed for importing SQL dump files, and the --database flag is required when the dump does not specify the database. This matches the requirement to import into an existing PostgreSQL instance.

Exam trap

The trap is reversing import and export commands, or using the wrong file format flag (csv vs sql); candidates must remember that 'gcloud sql import sql' is for SQL dumps and 'export sql' is for exporting.

How to eliminate wrong answers

Option A is wrong because 'gcloud sql export sql' exports data from Cloud SQL to a bucket, which is the opposite operation. Option C is wrong because 'gcloud sql instances import' is not a valid gcloud command; the correct subcommand is 'gcloud sql import sql'. Option D is wrong because 'gcloud sql import csv' imports CSV files, not SQL dump files, and would fail with a .sql file.

673
Multi-Selecthard

Which THREE configurations are required to enable Private Google Access for Compute Engine instances in a custom VPC subnet? (Select 3 correct answers)

Select 3 answers
A.Create a Cloud Router to advertise routes to Google.
B.Create a subnet with the --enable-private-ip-google-access flag.
C.Create a VPC network.
D.Launch Compute Engine instances in the subnet.
E.Configure Cloud NAT to route traffic to Google APIs.
AnswersB, C, D

Enabling the --enable-private-ip-google-access flag on the subnet is the core requirement because it tells Google Cloud to allow instances in that subnet to reach Google APIs using only their internal IP addresses. After this flag is set, the VPC's routing table automatically includes a route for Google's API ranges that sends traffic over the internal Google network instead of the public internet. This flag must be present on every subnet where you want Private Google Access to work; enabling it on the VPC or a single instance is not possible.

Why this answer

Private Google Access is enabled on a subnet. Instances in that subnet can reach Google APIs using internal IPs. It does not require Cloud NAT, Cloud VPN, or internet access.

The three required elements are: a VPC network, a subnet with Private Google Access enabled, and instances in that subnet.

674
MCQmedium

A Cloud SQL instance's disk is at 95% capacity. The application is experiencing write failures. You need to resolve this immediately with no downtime. What should you do?

A.Take a snapshot of the instance, create a new larger instance from the snapshot, then update the connection string.
B.Increase the disk size via the Cloud SQL console or `gcloud sql instances patch` — this occurs with no instance restart.
C.Delete old database tables to free up space.
D.Switch the instance to SSD storage, which has higher throughput and allows more writes.
AnswerB

Cloud SQL supports increasing the configured disk size without restarting the instance, either through the Cloud Console or the `gcloud sql instances patch INSTANCE --storage-size=NEW_SIZE` command. This online operation allocates additional persistent storage while the instance continues serving traffic, directly resolving the disk-full condition and satisfying the no-downtime requirement. Remember that storage size can only be increased, not decreased, so choose the new size based on projected growth.

Why this answer

Cloud SQL supports dynamic disk resizing without requiring an instance restart. When you increase the disk size via the console or `gcloud sql instances patch`, the change takes effect immediately, allowing the database to continue serving writes without downtime. This directly resolves the write failures caused by disk-full conditions.

Exam trap

The trap here is that candidates often assume any disk change requires a restart or migration, but Cloud SQL's online disk resize is a key differentiator that allows immediate resolution without downtime.

How to eliminate wrong answers

Option A is wrong because taking a snapshot and creating a new instance introduces significant downtime while the snapshot is taken, the new instance is provisioned, and the connection string is updated — violating the 'no downtime' requirement. Option C is wrong because deleting tables is a destructive, time-consuming operation that may not free enough space quickly, and it risks data loss; it also does not address the root cause of insufficient disk capacity. Option D is wrong because switching to SSD storage requires recreating the instance or migrating data, which causes downtime, and SSD does not increase disk capacity — it only improves I/O performance, so it would not resolve the disk-full write failures.

675
MCQmedium

Refer to the exhibit. A user runs `gcloud compute instances list` in Cloud Shell and gets the output 'Listed 0 items.' The user expects to see the VM they just created via the Console. What is the most likely cause?

A.The VM was created in a different region
B.The Cloud Shell is in a different project
C.The VM is stopping
D.The user does not have compute.instances.list permission
AnswerB

The Cloud Shell is in a different project. Cloud Shell operates using the project configured in its gcloud settings, which is often the 'Cloud Shell' project or the last project set via `gcloud config set project`, and this may differ from the project you are viewing in the Google Cloud Console. When you run `gcloud compute instances list` in Cloud Shell, it queries only the currently configured project, not the Console-selected project. Thus, if the VM exists in the Console project but not in the Cloud Shell's configured project, the list will be empty.

Why this answer

The `gcloud compute instances list` command lists VM instances in the currently configured project (set via `gcloud config set project`). If the Cloud Shell is pointing to a different project than the one where the VM was created via the Console, the command will return 'Listed 0 items' even though the VM exists. This is the most likely cause because the user expects to see the VM but the command is scoped to a different project context.

Exam trap

Google Cloud often tests the distinction between project-level scope and regional scope, trapping candidates who assume region mismatch is the cause when the real issue is the Cloud Shell being configured to a different project.

How to eliminate wrong answers

Option A is wrong because the `gcloud compute instances list` command by default lists instances across all regions in the current project; a region mismatch would not cause 'Listed 0 items' unless the instance was in a different project. Option C is wrong because a VM in 'stopping' state is still listed by `gcloud compute instances list` (it appears with status 'STOPPING'), so it would not result in zero items. Option D is wrong because if the user lacked `compute.instances.list` permission, the command would return a permission denied error, not 'Listed 0 items'.

Page 8

Page 9 of 11

Page 10

All pages