🔍

ACE — questions

Page 11 of 17 · 334 total questions.

ACE Question 201

Single page →
Topic 1 · Question 201

Your company has multiple projects linked to a single billing account in Google Cloud. You need to visualize the costs with specific metrics that should be dynamically calculated based on company-specific criteria. You want to automate the process. What should you do?

  • AIn the Google Cloud console, visualize the costs related to the projects in the Reports section.
  • BIn the Google Cloud console, visualize the costs related to the projects in the Cost breakdown section.
  • CIn the Google Cloud console, use the export functionality of the Cost table. Create a Looker Studio dashboard on top of the CSV export.
  • DConfigure Cloud Billing data export to BigQuery for the billing account. Create a Looker Studio dashboard on top of the BigQuery export. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Configure Cloud Billing data export to BigQuery for the billing account. Create a Looker Studio dashboard on top of the BigQuery export.

Explanation

BigQuery is a serverless, petabyte-scale data warehouse for fast SQL analytics with no infrastructure to manage. Looker provides governed business intelligence, dashboards, and data modeling.

ACE Question 202

Single page →
Topic 1 · Question 202

You have an application that runs on Compute Engine VM instances in a custom Virtual Private Cloud (VPC). Your company’s security policies only allow the use of internal IP addresses on VM instances and do not let VM instances connect to the internet. You need to ensure that the application can access a file hosted in a Cloud Storage bucket within your project. What should you do?

  • AEnable Private Service Access on the Cloud Storage Bucket.
  • BAdd storage.googleapis.com to the list of restricted services in a VPC Service Controls perimeter and add your project to the list of protected projects.
  • CEnable Private Google Access on the subnet within the custom VPC. (correct answer)
  • DDeploy a Cloud NAT instance and route the traffic to the dedicated IP address of the Cloud Storage bucket.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Enable Private Google Access on the subnet within the custom VPC.

Explanation

Private Google Access lets internal instances reach Google APIs without external IPs. A VPC provides a global, software-defined private network for your Google Cloud resources.

ACE Question 203

Single page →
Topic 1 · Question 203

Your company completed the acquisition of a startup and is now merging the IT systems of both companies. The startup had a production Google Cloud project in their organization. You need to move this project into your organization and ensure that the project is billed to your organization. You want to accomplish this task with minimal effort. What should you do?

  • AUse the projects.move method to move the project to your organization. Update the billing account of the project to that of your organization. (correct answer)
  • BEnsure that you have an Organization Administrator Identity and Access Management (IAM) role assigned to you in both organizations. Navigate to the Resource Manager in the startup’s Google Cloud organization, and drag the project to your company's organization.
  • CCreate a Private Catalog for the Google Cloud Marketplace, and upload the resources of the startup's production project to the Catalog. Share the Catalog with your organization, and deploy the resources in your company’s project.
  • DCreate an infrastructure-as-code template for all resources in the project by using Terraform, and deploy that template to a new project in your organization. Delete the project from the startup’s Google Cloud organization.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Use the projects.move method to move the project to your organization. Update the billing account of the project to that of your organization.

ACE Question 204

Single page →
Topic 1 · Question 204

All development (dev) teams in your organization are located in the United States. Each dev team has its own Google Cloud project. You want to restrict access so that each dev team can only create cloud resources in the United States (US). What should you do?

  • ACreate a folder to contain all the dev projects. Create an organization policy to limit resources in US locations. (correct answer)
  • BCreate an organization to contain all the dev projects. Create an Identity and Access Management (IAM) policy to limit the resources in US regions.
  • CCreate an Identity and Access Management (IAM) policy to restrict the resources locations in the US. Apply the policy to all dev projects.
  • DCreate an Identity and Access Management (IAM) policy to restrict the resources locations in all dev projects. Apply the policy to all dev roles.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a folder to contain all the dev projects. Create an organization policy to limit resources in US locations.

Explanation

Organization Policy sets guardrails that constrain how resources can be configured across the org.

ACE Question 205

Single page →
Topic 1 · Question 205

You are configuring Cloud DNS. You want to create DNS records to point home.mydomain.com, mydomain.com, and www.mydomain.com to the IP address of your Google Cloud load balancer. What should you do?

  • ACreate one CNAME record to point mydomain.com to the load balancer, and create two A records to point WWW and HOME to mydomain.com respectively.
  • BCreate one CNAME record to point mydomain.com to the load balancer, and create two AAAA records to point WWW and HOME to mydomain.com respectively.
  • CCreate one A record to point mydomain.com to the load balancer, and create two CNAME records to point WWW and HOME to mydomain.com respectively. (correct answer)
  • DCreate one A record to point mydomain.com to the load balancer, and create two NS records to point WWW and HOME to mydomain.com respectively.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create one A record to point mydomain.com to the load balancer, and create two CNAME records to point WWW and HOME to mydomain.com respectively.

Explanation

A load balancer distributes traffic across healthy backends in multiple zones for availability and scale.

ACE Question 206

Single page →
Topic 1 · Question 206

You have two subnets (subnet-a and subnet-b) in the default VPC. Your database servers are running in subnet-a. Your application servers and web servers are running in subnet-b. You want to configure a firewall rule that only allows database traffic from the application servers to the database servers. What should you do?

  • A• Create service accounts sa-app and sa-db.• Associate service account sa-app with the application servers and the service account sa-db with the database servers.• Create an ingress firewall rule to allow network traffic from source service account sa-app to target service account sa-db. (correct answer)
  • B• Create network tags app-server and db-server.• Add the app-server tag to the application servers and the db-server tag to the database servers.• Create an egress firewall rule to allow network traffic from source network tag app-server to target network tag db-server.
  • C• Create a service account sa-app and a network tag db-server.• Associate the service account sa-app with the application servers and the network tag db-server with the database servers.• Create an ingress firewall rule to allow network traffic from source VPC IP addresses and target the subnet-a IP addresses.
  • D• Create a network tag app-server and service account sa-db.• Add the tag to the application servers and associate the service account with the database servers.• Create an egress firewall rule to allow network traffic from source network tag app-server to target service account sa-db.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: • Create service accounts sa-app and sa-db.• Associate service account sa-app with the application servers and the service account sa-db with the database servers.• Create an ingress firewall rule to allow network tra...

Explanation

A service account provides an identity for workloads to access Google Cloud APIs securely.

ACE Question 207

Single page →
Topic 1 · Question 207

Your team wants to deploy a specific content management system (CMS) solution to Google Cloud. You need a quick and easy way to deploy and install the solution. What should you do?

  • ASearch for the CMS solution in Google Cloud Marketplace. Use gcloud CLI to deploy the solution.
  • BSearch for the CMS solution in Google Cloud Marketplace. Deploy the solution directly from Cloud Marketplace. (correct answer)
  • CSearch for the CMS solution in Google Cloud Marketplace. Use Terraform and the Cloud Marketplace ID to deploy the solution with the appropriate parameters.
  • DUse the installation guide of the CMS provider. Perform the installation through your configuration management system.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Search for the CMS solution in Google Cloud Marketplace. Deploy the solution directly from Cloud Marketplace.

ACE Question 208

Single page →
Topic 1 · Question 208

You are working for a startup that was officially registered as a business 6 months ago. As your customer base grows, your use of Google Cloud increases. You want to allow all engineers to create new projects without asking them for their credit card information. What should you do?

  • ACreate a Billing account, associate a payment method with it, and provide all project creators with permission to associate that billing account with their projects. (correct answer)
  • BGrant all engineers permission to create their own billing accounts for each new project.
  • CApply for monthly invoiced billing, and have a single invoice for the project paid by the finance team.
  • DCreate a billing account, associate it with a monthly purchase order (PO), and send the PO to Google Cloud.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a Billing account, associate a payment method with it, and provide all project creators with permission to associate that billing account with their projects.

ACE Question 209

Single page →
Topic 1 · Question 209

Your continuous integration and delivery (CI/CD) server can’t execute Google Cloud actions in a specific project because of permission issues. You need to validate whether the used service account has the appropriate roles in the specific project. What should you do?

  • AOpen the Google Cloud console, and check the Identity and Access Management (IAM) roles assigned to the service account at the project or inherited from the folder or organization levels. (correct answer)
  • BOpen the Google Cloud console, and check the organization policies.
  • COpen the Google Cloud console, and run a query to determine which resources this service account can access.
  • DOpen the Google Cloud console, and run a query of the audit logs to find permission denied errors for this service account.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Open the Google Cloud console, and check the Identity and Access Management (IAM) roles assigned to the service account at the project or inherited from the folder or organization levels.

Explanation

A service account provides an identity for workloads to access Google Cloud APIs securely. Cloud IAM grants fine-grained, least-privilege access to Google Cloud resources.

ACE Question 210

Single page →
Topic 1 · Question 210

Your team is using Linux instances on Google Cloud. You need to ensure that your team logs in to these instances in the most secure and cost efficient way. What should you do?

  • AAttach a public IP to the instances and allow incoming connections from the internet on port 22 for SSH.
  • BUse the gcloud compute ssh command with the --tunnel-through-iap flag. Allow ingress traffic from the IP range 35.235.240.0/20 on port 22. (correct answer)
  • CUse a third party tool to provide remote access to the instances.
  • DCreate a bastion host with public internet access. Create the SSH tunnel to the instance through the bastion host.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Use the gcloud compute ssh command with the --tunnel-through-iap flag. Allow ingress traffic from the IP range 35.235.240.0/20 on port 22.

Explanation

Identity-Aware Proxy enforces per-request access control to apps without a VPN.

ACE Question 211

Single page →
Topic 1 · Question 211

An external member of your team needs list access to compute images and disks in one of your projects. You want to follow Google-recommended practices when you grant the required permissions to this user. What should you do?

  • ACreate a custom role, and add all the required compute.disks.list and compute.images.list permissions as includedPermissions. Grant the custom role to the user at the project level. (correct answer)
  • BCreate a custom role based on the Compute Image User role. Add the compute.disks.list to the includedPermissions field. Grant the custom role to the user at the project level.
  • CCreate a custom role based on the Compute Storage Admin role. Exclude unnecessary permissions from the custom role. Grant the custom role to the user at the project level.
  • DGrant the Compute Storage Admin role at the project level.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a custom role, and add all the required compute.disks.list and compute.images.list permissions as includedPermissions. Grant the custom role to the user at the project level.

ACE Question 212

Single page →
Topic 1 · Question 212

You are running a web application on Cloud Run for a few hundred users. Some of your users complain that the initial web page of the application takes much longer to load than the following pages. You want to follow Google’s recommendations to mitigate the issue. What should you do?

  • ASet the minimum number of instances for your Cloud Run service to 3. (correct answer)
  • BSet the concurrency number to 1 for your Cloud Run service.
  • CSet the maximum number of instances for your Cloud Run service to 100.
  • DUpdate your web application to use the protocol HTTP/2 instead of HTTP/1.1.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Set the minimum number of instances for your Cloud Run service to 3.

Explanation

Cloud Run runs stateless containers serverlessly and scales to zero, minimizing operational overhead.

ACE Question 213

Single page →
Topic 1 · Question 213

You are building a data lake on Google Cloud for your Internet of Things (IoT) application. The IoT application has millions of sensors that are constantly streaming structured and unstructured data to your backend in the cloud. You want to build a highly available and resilient architecture based on Google-recommended practices. What should you do?

  • AStream data to Pub/Sub, and use Dataflow to send data to Cloud Storage. (correct answer)
  • BStream data to Pub/Sub, and use Storage Transfer Service to send data to BigQuery.
  • CStream data to Dataflow, and use Dataprep by Trifacta to send data to Bigtable.
  • DStream data to Dataflow, and use Storage Transfer Service to send data to BigQuery.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Stream data to Pub/Sub, and use Dataflow to send data to Cloud Storage.

Explanation

Cloud Storage provides durable, scalable object storage that is fully managed. Dataflow runs serverless Apache Beam pipelines for stream and batch data processing with autoscaling. Pub/Sub is a serverless, global messaging service that decouples services and ingests high-volume event streams. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

ACE Question 214

Single page →
Topic 1 · Question 214

You are running out of primary internal IP addresses in a subnet for a custom mode VPC. The subnet has the IP range 10.0.0.0/20, and the IP addresses are primarily used by virtual machines in the project. You need to provide more IP addresses for the virtual machines. What should you do?

  • AAdd a secondary IP range 10.1.0.0/20 to the subnet.
  • BChange the subnet IP range from 10.0.0.0/20 to 10.0.0.0/18. (correct answer)
  • CChange the subnet IP range from 10.0.0.0/20 to 10.0.0.0/22.
  • DConvert the subnet IP range from IPv4 to IPv6.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Change the subnet IP range from 10.0.0.0/20 to 10.0.0.0/18.

ACE Question 215

Single page →
Topic 1 · Question 215

Your company requires all developers to have the same permissions, regardless of the Google Cloud project they are working on. Your company’s security policy also restricts developer permissions to Compute Engine, Cloud Functions, and Cloud SQL. You want to implement the security policy with minimal effort. What should you do?

  • A• Create a custom role with Compute Engine, Cloud Functions, and Cloud SQL permissions in one project within the Google Cloud organization.• Copy the role across all projects created within the organization with the gcloud iam roles copy command.• Assign the role to developers in those projects.
  • B• Add all developers to a Google group in Google Groups for Workspace.• Assign the predefined role of Compute Admin to the Google group at the Google Cloud organization level.
  • C• Add all developers to a Google group in Cloud Identity.• Assign predefined roles for Compute Engine, Cloud Functions, and Cloud SQL permissions to the Google group for each project in the Google Cloud organization.
  • D• Add all developers to a Google group in Cloud Identity.• Create a custom role with Compute Engine, Cloud Functions, and Cloud SQL permissions at the Google Cloud organization level.• Assign the custom role to the Google group. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: • Add all developers to a Google group in Cloud Identity.• Create a custom role with Compute Engine, Cloud Functions, and Cloud SQL permissions at the Google Cloud organization level.• Assign the custom role to the Go...

Explanation

Cloud Functions runs event-driven code without managing servers and scales automatically. Compute Engine provides configurable virtual machines when you need full control of the OS. Cloud SQL is a managed relational database (MySQL/PostgreSQL/SQL Server) that handles patching, backups, and failover.

ACE Question 216

Single page →
Topic 1 · Question 216

You are working for a hospital that stores its medical images in an on-premises data room. The hospital wants to use Cloud Storage for archival storage of these images. The hospital wants an automated process to upload any new medical images to Cloud Storage. You need to design and implement a solution. What should you do?

  • ACreate a Pub/Sub topic, and enable a Cloud Storage trigger for the Pub/Sub topic. Create an application that sends all medical images to the Pub/Sub topic.
  • BCreate a script that uses the gcloud storage command to synchronize the on-premises storage with Cloud Storage, Schedule the script as a cron job. (correct answer)
  • CCreate a Pub/Sub topic, and create a Cloud Function connected to the topic that writes data to Cloud Storage. Create an application that sends all medical images to the Pub/Sub topic.
  • DIn the Google Cloud console, go to Cloud Storage. Upload the relevant images to the appropriate bucket.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create a script that uses the gcloud storage command to synchronize the on-premises storage with Cloud Storage, Schedule the script as a cron job.

Explanation

Cloud Storage provides durable, scalable object storage that is fully managed.

ACE Question 217

Single page →
Topic 1 · Question 217

Your company has an internal application for managing transactional orders. The application is used exclusively by employees in a single physical location. The application requires strong consistency, fast queries, and ACID guarantees for multi-table transactional updates. The first version of the application is implemented in PostgreSQL, and you want to deploy it to the cloud with minimal code changes. Which database is most appropriate for this application?

  • ABigtable
  • BBigQuery
  • CCloud SQL (correct answer)
  • DFirestore
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Cloud SQL

Explanation

Cloud SQL is a managed relational database (MySQL/PostgreSQL/SQL Server) that handles patching, backups, and failover. This option needs the least custom development effort.

ACE Question 218

Single page →
Topic 1 · Question 218

Your company runs one batch process in an on-premises server that takes around 30 hours to complete. The task runs monthly, can be performed offline, and must be restarted if interrupted. You want to migrate this workload to the cloud while minimizing cost. What should you do?

  • ACreate an Instance Template with Spot VMs On. Create a Managed Instance Group from the template and adjust Target CPU Utilization. Migrate the workload.
  • BMigrate the workload to a Compute Engine VM. Start and stop the instance as needed. (correct answer)
  • CMigrate the workload to a Google Kubernetes Engine cluster with Spot nodes.
  • DMigrate the workload to a Compute Engine Spot VM.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Migrate the workload to a Compute Engine VM. Start and stop the instance as needed.

Explanation

Compute Engine provides configurable virtual machines when you need full control of the OS.

ACE Question 219

Single page →
Topic 1 · Question 219

You are planning to migrate the following on-premises data management solutions to Google Cloud: • One MySQL cluster for your main database • Apache Kafka for your event streaming platform • One Cloud SQL for PostgreSQL database for your analytical and reporting needs You want to implement Google-recommended solutions for the migration. You need to ensure that the new solutions provide global scalability and require minimal operational and infrastructure management. What should you do?

  • AMigrate from MySQL to Cloud SQL, from Kafka to Pub/Sub, and from Cloud SQL for PostgreSQL to BigQuery.
  • BMigrate from MySQL to Cloud Spanner, from Kafka to Pub/Sub, and from Cloud SQL for PostgreSQL to BigQuery. (correct answer)
  • CMigrate from MySQL to Cloud Spanner, from Kafka to Memorystore, and from Cloud SQL for PostgreSQL to Cloud SQL.
  • DMigrate from MySQL to Cloud SQL, from Kafka to Memorystore, and from Cloud SQL for PostgreSQL to Cloud SQL.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Migrate from MySQL to Cloud Spanner, from Kafka to Pub/Sub, and from Cloud SQL for PostgreSQL to BigQuery.

Explanation

Cloud SQL is a managed relational database (MySQL/PostgreSQL/SQL Server) that handles patching, backups, and failover. Cloud Spanner is a horizontally scalable, strongly consistent relational database with global reach. BigQuery is a serverless, petabyte-scale data warehouse for fast SQL analytics with no infrastructure to manage. This option meets the real-time / low-latency performance requirement.

ACE Question 220

Single page →
Topic 1 · Question 220

During a recent audit of your existing Google Cloud resources, you discovered several users with email addresses outside of your Google Workspace domain. You want to ensure that your resources are only shared with users whose email addresses match your domain. You need to remove any mismatched users, and you want to avoid having to audit your resources to identify mismatched users. What should you do?

  • ACreate a Cloud Scheduler task to regularly scan your projects and delete mismatched users.
  • BCreate a Cloud Scheduler task to regularly scan your resources and delete mismatched users.
  • CSet an organizational policy constraint to limit identities by domain to automatically remove mismatched users.
  • DSet an organizational policy constraint to limit identities by domain, and then retroactively remove the existing mismatched users (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Set an organizational policy constraint to limit identities by domain, and then retroactively remove the existing mismatched users.

Showing questions 201–220 of 334 · Page 11 of 17