ACE Practice Questions

Question 1

An organization policy at the organization level sets `constraints/compute.requireOsLogin` to enforced (true) on all projects. A specific project needs an exception — VMs there should not require OS Login. How can this exception be configured?

Accepted Answer

Set a project-level organization policy overriding `compute.requireOsLogin` to not enforced (if the constraint allows override). Organization policies can be overridden at a lower level (project, folder) if the constraint's `inheritFromParent` setting allows it. The `compute.requireOsLogin` boolean constraint supports per-project override, so setting it to `false` at the project level exempts that project's VMs from requiring OS Login while the organization-level policy remains enforced for all other projects.

Answer

Removing the VM from the VPC will bypass the organization policy

Answer

Grant the VM's service account the OS Login Admin role to bypass the policy

Answer

Move the project to a folder that doesn't inherit the organization policy

Question 2

Order the steps to set up a VPC network with a subnet, firewall rule allowing SSH, and a Compute Engine instance in that subnet.

Accepted Answer

Create VPC network and subnet first, then create firewall rule allowing SSH, then create Compute Engine instance in the subnet.. The correct sequence is to first create the VPC network and subnet, then create the firewall rule allowing SSH, and finally create the Compute Engine instance. This ensures that the network infrastructure is ready before the instance is launched, and SSH access is available immediately.

Answer

Create VPC network and subnet first, then create Compute Engine instance, then create firewall rule allowing SSH.

Answer

Create firewall rule allowing SSH first, then create VPC network and subnet, then create Compute Engine instance.

Answer

Create VPC network and subnet first, then create Compute Engine instance in the default subnet, then create a firewall rule allowing SSH for that subnet.

Question 3

You need to enforce that all new Cloud Storage buckets in your organization use Uniform Bucket-Level Access (UBLA) and are created in one of three approved regions: `us-central1`, `us-east1`, or `europe-west1`. What is the most efficient way to enforce both constraints?

Accepted Answer

Apply `storage.uniformBucketLevelAccess` and `gcp.resourceLocations` org policies at the organization level.. Organization policies are the most efficient way to enforce constraints across all new Cloud Storage buckets because they are evaluated at resource creation time by the Cloud Resource Manager. The `storage.uniformBucketLevelAccess` policy enforces UBLA, and `gcp.resourceLocations` restricts the allowed locations, both applied at the organization level to cover all projects without per-bucket overhead.

Answer

Write a Cloud Function triggered by bucket creation events to check and delete non-compliant buckets.

Answer

Create a custom IAM role that removes the `storage.buckets.create` permission for disallowed regions.

Answer

Use Terraform to provision all buckets and include validation in the Terraform plan step.

Question 4

A team manages multiple Kubernetes Engine clusters across different projects. They need to enforce that all clusters have the same security policies, including private cluster settings and workload identity. Which approach is most scalable?

Accepted Answer

Use Terraform with a module that defines the standard cluster configuration, and apply it to each project.. Terraform, combined with a reusable module, provides an Infrastructure as Code (IaC) approach that enforces consistent cluster configurations across multiple projects declaratively. This method is scalable as it allows you to define the standard security policies (private cluster settings, Workload Identity) once in a module and apply it to any number of clusters, ensuring drift is prevented and changes are auditable.

Answer

Use Cloud Asset Inventory to compare configurations and alert on differences.

Answer

Retrieve cluster configuration for each cluster using gcloud container clusters describe and apply changes manually.

Answer

Use Config Connector with deployment scripts to manage cluster resources as Kubernetes custom resources.

Question 5

A company runs a multi-tier web application on Compute Engine: a frontend instance group (us-east1) and a backend instance group (us-east1) that stores data on persistent disks. They recently experienced a zone failure in us-east1-b, causing all instances in that zone to go down. The application was unavailable for 2 hours. The team is now required to design a solution that provides high availability across multiple zones within the us-east1 region and minimizes data loss. The frontend is stateless, but the backend holds critical state data on persistent disks. Which option best meets the requirements?

Accepted Answer

Use regional persistent disks for backend data and deploy a regional managed instance group for backend instances across us-east1-a and us-east1-b. It uses regional persistent disks (which replicate data synchronously across two zones in the same region) combined with a regional managed instance group (MIG) that distributes backend instances across us-east1-a and us-east1-b. This architecture ensures that if one zone fails, the backend instances in the other zone can immediately attach the same regional persistent disk, minimizing data loss and providing high availability without requiring manual snapshot recovery.

Answer

Replace backend Compute Engine instances with Cloud SQL for data storage and keep frontend as is

Answer

Move all instances to a single zone in us-central1 with larger machine types

Answer

Keep the backend in a zonal MIG in us-east1-b but take hourly snapshots of persistent disks to a different zone

Question 6

A company has an e-commerce application deployed on Compute Engine instances in a managed instance group (MIG) behind an external HTTP load balancer. The application stores session data in an in-memory cache on each instance. Recently, the team noticed that users are being logged out unexpectedly and losing their shopping cart contents. The MIG is configured with autoscaling based on CPU utilization. The team suspects the issue is related to session persistence. They have considered the following options: A) Switch to an internal TCP/UDP load balancer with session affinity; B) Enable sticky sessions (session affinity) on the existing load balancer; C) Move session storage to a centralized service like Memorystore; D) Increase the instance size and disable autoscaling. Which solution permanently resolves the issue while maintaining scalability and fault tolerance?

Accepted Answer

Move session storage to a centralized service like Memorystore. Storing session data in a centralized service like Memorystore (Redis) decouples session state from individual Compute Engine instances. This ensures that any instance in the managed instance group can serve any user request without losing session data, even as the MIG autoscales up or down. This approach permanently resolves the issue while maintaining scalability and fault tolerance, as Memorystore provides a highly available, in-memory data store that persists across instance lifecycle events.

Answer

Switch to an internal TCP/UDP load balancer with session affinity

Answer

Enable sticky sessions (session affinity) on the existing load balancer

Answer

Increase the instance size and disable autoscaling

Question 7

Your on-premises data center needs a dedicated, private connection to GCP with a guaranteed 10 Gbps bandwidth and SLA-backed availability. Internet-based VPN is not acceptable due to compliance requirements. Which connectivity option should you choose?

Accepted Answer

Cloud Interconnect Dedicated (10 Gbps). Dedicated Interconnect provides a direct, private physical connection between your on-premises network and GCP, offering up to 10 Gbps per circuit with a 99.99% SLA. Since internet-based VPN is not acceptable due to compliance requirements, this option meets the need for dedicated bandwidth and SLA-backed availability without traversing the public internet.

Answer

Cloud VPN with multiple tunnels for redundancy

Answer

Partner Interconnect via a carrier partner

Answer

Cloud Router with BGP peering over the public internet

Question 8

A new engineer joins the team and needs access to GCP. The company uses Google Workspace for identity management. The GCP admin needs to add the engineer and grant them access to one project. What is the correct order of steps?

Accepted Answer

Create the user in Google Workspace Admin Console, then grant their account IAM roles on the GCP project. Google Workspace is the identity provider (IdP) for the organization, so the engineer must first be created as a user in the Google Workspace Admin Console. Once the user exists, the GCP admin can then grant IAM roles (e.g., roles/viewer, roles/editor) on the specific project, which maps the Workspace user identity to GCP permissions. This follows the principle that GCP IAM relies on existing identities from the Cloud Identity or Workspace domain, not on separate user creation within GCP.

Answer

Create a service account for the engineer in GCP, then share the key file

Answer

Create a GCP project for the engineer, then add their personal Gmail as a project owner

Answer

Create an API key for the engineer in the GCP Console and share it securely

Question 9

You need to deploy a Cloud Function that is triggered by HTTP requests. You want to pass configuration parameters to the function at deployment time. Which approach should you use?

Accepted Answer

Use the --set-env-vars flag with gcloud functions deploy.. You can set environment variables at deployment time using the --set-env-vars flag with the gcloud functions deploy command. This allows passing configuration parameters without modifying the code. Option C is correct.

Answer

Store parameters in a Cloud Storage bucket and read them at runtime.

Answer

Edit the function code to hardcode the parameters.

Answer

Include the parameters in the HTTP request body.

Question 10

An engineer needs to audit all Data Access logs for a project to detect unauthorized access to sensitive data. The engineer must ensure that logs are retained for 5 years and are immutable. Which THREE steps should the engineer take?

Accepted Answer

Configure the Cloud Storage bucket with a retention policy and enable object versioning. To achieve this, the engineer must: 1. Enable Data Access audit logs for the required services (e.g., Cloud Storage, BigQuery) in the project's IAM audit config. 2. Create a log sink that exports the logs to a Cloud Storage bucket (which provides cost-effective long-term retention). 3. Configure the bucket with retention policy and object versioning to make logs immutable and protect against deletion. Using Logging's default retention is only 30 days, not 5 years. Cloud Monitoring does not store logs. BigQuery is not ideal for immutable storage.

Answer

Use the default Logging retention of 30 days

Answer

Set up a Cloud Monitoring alert for any Data Access log entries

Question 11

An organization wants to separate its development and production environments using Google Cloud resource hierarchy. What is the recommended approach?

Accepted Answer

Create two folders under the organization node, one for dev and one for prod.. Google Cloud resource hierarchy is Organization > Folders > Projects > Resources. Creating two folders under the organization node — one for dev and one for prod — is the recommended way to separate environments because IAM policies and organization policies applied at the folder level are inherited by all projects beneath them. This provides clean isolation and centralized governance without duplicating the organization.

Answer

Create a single project and use separate VPC networks for dev and prod.

Answer

Create two separate organizations, one for dev and one for prod.

Answer

Create two projects under the same folder and use labels to differentiate dev and prod.

Question 12

A company runs a batch job every night that processes data from a Cloud Storage bucket and writes results to BigQuery. The job runs on a Compute Engine VM. To minimize costs, what is the best practice for the VM?

Accepted Answer

Use a preemptible VM. Preemptible VMs are up to 80% cheaper and can be terminated at any time, which is acceptable for batch jobs that can be checkpointed or restarted from the beginning.

Answer

Use a VM with GPUs for faster processing

Answer

Use a VM with local SSD for temporary storage

Answer

Use a standard VM and commit to a 1-year commitment

Question 13

You need to drain a GKE node for maintenance. The node runs DaemonSet pods and pods using emptyDir volumes. Which kubectl drain command correctly handles these pods without causing disruption to critical system components?

Accepted Answer

kubectl drain NODE --ignore-daemonsets --delete-emptydir-data. The kubectl drain command evicts pods from a node. To handle DaemonSet pods (which should be ignored because they are managed by the DaemonSet controller) and pods with emptyDir volumes (which may need --delete-emptydir-data to force eviction), you use --ignore-daemonsets and --delete-emptydir-data.

Answer

kubectl drain NODE --force

Answer

kubectl drain NODE --ignore-daemonsets

Answer

kubectl drain NODE --delete-emptydir-data

Question 14

A financial services company needs to run analytics queries on transaction data that arrives in real-time. The queries must return results within 2 seconds and the dataset grows by ~100 GB per day. The company also needs to retain all data for 7 years for regulatory compliance. Which architecture best satisfies these requirements?

Accepted Answer

Stream transactions through Pub/Sub → Dataflow → BigQuery; run analytics on BigQuery.. It uses Pub/Sub for real-time ingestion, Dataflow for stream processing, and BigQuery for analytics, which can handle 100 GB/day growth and return queries within 2 seconds using BigQuery's columnar storage and automatic sharding. BigQuery's 7-year retention is supported by its time-based partitioning and long-term storage at reduced cost, meeting regulatory compliance without manual intervention.

Answer

Write transactions to Cloud Spanner; run analytics queries directly against Spanner.

Answer

Store transactions in Cloud Bigtable and use Dataproc/Spark for analytics queries.

Answer

Use Cloud SQL for storage and Cloud Dataprep for analytics transformations.

Question 15

A company organizes its GCP projects by business unit — Finance, Engineering, and Sales. Which resource is best suited to group these projects while applying shared IAM policies to all projects in each group?

Accepted Answer

Create GCP Folders for each business unit and add the relevant projects. C is correct because GCP Folders are the hierarchical resource designed to group projects under an organization node, allowing you to apply shared IAM policies at the folder level that automatically propagate to all projects within that folder. This aligns with the requirement to organize projects by business unit and enforce consistent access controls across each group.

Answer

Apply labels to each project to identify the business unit

Answer

Apply resource tags to each project for policy enforcement

Answer

Create a Shared VPC host project for each business unit

Google Associate Cloud Engineer ACE practice test

Three ways to study

Study ACE by domain

Study ACE by topic

Deploying and Implementing a Cloud Solution practice questions

Setting Up a Cloud Solution Environment practice questions

Planning and Configuring a Cloud Solution practice questions

Ensuring Successful Operation of a Cloud Solution practice questions

Configuring Access and Security practice questions

ACE fundamentals practice questions

ACE scenario practice questions

ACE troubleshooting practice questions

Top ACE questions

Google Associate Cloud Engineer practice questions