🔍

ACE — questions

Page 16 of 17 · 334 total questions.

ACE Question 301

Single page →
Topic 1 · Question 301

You are deploying an application to Google Kubernetes Engine (GKE). The application needs to make API calls to a private Cloud Storage bucket. You need to configure your application Pods to authenticate to the Cloud Storage API, but your organization policy prevents the usage of service account keys. You want to follow Google-recommended practices. What should you do?

  • ACreate the GKE cluster with Workload Identity Federation. Configure the default node service account to access the bucket. Deploy the application into the cluster so the application can use the node service account permissions. Use Identity and Access Management (IAM) to grant the service account access to the bucket.
  • BCreate the GKE cluster with Workload Identity Federation. Create a Google service account and a Kubernetes ServiceAccount, and configure both service accounts to use Workload Identity Federation. Attach the Kubernetes ServiceAccount to the application Pods and configure the Google service account to access the bucket with Identity and Access Management (IAM). (correct answer)
  • CCreate the GKE cluster and deploy the application. Request a security exception to create a Google service account key. Set the constraints/iam.serviceAccountKeyExpiryHours organization policy to 24 hours.
  • DCreate the GKE cluster and deploy the application. Request a security exception to create a Google service account key. Set the constraints/iam.serviceAccountKeyExpiryHours organization policy to 8 hours.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create the GKE cluster with Workload Identity Federation. Create a Google service account and a Kubernetes ServiceAccount, and configure both service accounts to use Workload Identity Federation. Attach the Kubernetes...

Explanation

Google Kubernetes Engine runs managed Kubernetes for containerized, portable workloads. Workload Identity Federation lets workloads access Google Cloud without long-lived service account keys. A service account provides an identity for workloads to access Google Cloud APIs securely.

ACE Question 302

Single page →
Topic 1 · Question 302

You are managing the security configuration of your company’s Google Cloud organization. The Operations team needs specific permissions on both a Google Kubernetes Engine (GKE) cluster and a Cloud SQL instance. Two predefined Identity and Access Management (IAM) roles exist that contain a subset of the permissions needed by the team. You need to configure the necessary IAM permissions for this team while following Google-recommended practices. What should you do?

  • ACreate a custom IAM role that combines the permissions from the two relevant predefined roles.
  • BGrant the team the two predefined IAM roles.
  • CCreate a custom IAM role that includes only the required permissions from the predefined roles. (correct answer)
  • DGrant the team the IAM roles of Kubernetes Engine Admin and Cloud SQL Admin.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create a custom IAM role that includes only the required permissions from the predefined roles.

Explanation

Cloud IAM grants fine-grained, least-privilege access to Google Cloud resources.

ACE Question 303

Single page →
Topic 1 · Question 303

You are planning to deploy an application to Google Cloud. Your application processes asynchronous events from Google services and must be accessible from the public Internet. You need to identify how to deploy your application. You want to follow a standardized process while minimizing development costs. You also want to have no costs when your workloads are not in use. What should you do?

  • ADeploy your code to GKE. Use Pub/Sub for event delivery.
  • BDeploy your code to Compute Engine. Use Pub/Sub for event delivery.
  • CDeploy your code to GKE. Use Eventarc for event delivery.
  • DDeploy your code to Cloud Run. Use Eventarc for event delivery. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Deploy your code to Cloud Run. Use Eventarc for event delivery.

Explanation

Cloud Run runs stateless containers serverlessly and scales to zero, minimizing operational overhead. This option decouples the components so they scale independently and absorb load spikes.

ACE Question 304

Single page →
Topic 1 · Question 304

You are migrating your company’s on-premises compute resources to Google Cloud. You need to deploy batch processing jobs that run every night. The jobs require significant CPU and memory for several hours but can tolerate interruptions. You must ensure that the deployment is cost-effective. What should you do?

  • AUse the M1 machine series on Compute Engine.
  • BContainerize the batch processing jobs and deploy them on Compute Engine.
  • CUse Spot VMs on Compute Engine. (correct answer)
  • DUse custom machine types on Compute Engine.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use Spot VMs on Compute Engine.

Explanation

Spot VMs use spare capacity at a large discount for fault-tolerant, interruptible workloads. Compute Engine provides configurable virtual machines when you need full control of the OS. This option delivers the requirement at the lowest cost.

ACE Question 305

Single page →
Topic 1 · Question 305

Your company has a rapidly growing social media platform and a user base primarily located in North America. Due to increasing demand, your current on-premises PostgreSQL database, hosted in your United States headquarters data center, no longer meets your needs. You need to identify a cloud-based database solution that offers automatic scaling, multi-region support for future expansion, and maintains low latency. What should you do?

  • AUse BigQuery.
  • BUse Spanner. (correct answer)
  • CUse Cloud SQL for PostgreSQL.
  • DUse Bigtable.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Use Spanner.

Explanation

Cloud Spanner is a horizontally scalable, strongly consistent relational database with global reach. This option meets the real-time / low-latency performance requirement.

ACE Question 306

Single page →
Topic 1 · Question 306

You are migrating your on-premises workload to Google Cloud. Your company is implementing its Cloud Billing configuration and requires access to a granular breakdown of its Google Cloud costs. You need to ensure that the Cloud Billing datasets are available in BigQuery so you can conduct a detailed analysis of costs. What should you do?

  • AEnable Cloud Billing data export to BigQuery when you create a Cloud Billing account. (correct answer)
  • BEnable Cloud Billing on the project, and link a Cloud Billing account. Then view the billing data table in the BigQuery dataset.
  • CCreate a Cloud Billing account. Enable the BigQuery Data Transfer Service API to export pricing data.
  • DEnable the BigQuery API, and ensure that the BigQuery User IAM role is selected. Change the BigQuery dataset to select a data location.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Enable Cloud Billing data export to BigQuery when you create a Cloud Billing account.

Explanation

BigQuery is a serverless, petabyte-scale data warehouse for fast SQL analytics with no infrastructure to manage.

ACE Question 307

Single page →
Topic 1 · Question 307

You need to migrate multiple PostgreSQL databases from your on-premises data center to Google Cloud. You want to significantly improve the performance of your databases while minimizing changes to your data schema and application code. You expect to exceed 150 TB of data per geographical region. You want to follow Google-recommended practices and minimize your operational costs. What should you do?

  • AMigrate your data to AlloyDB. (correct answer)
  • BMigrate your data to Spanner.
  • CMigrate your data to Firebase.
  • DMigrate your data to Bigtable.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Migrate your data to AlloyDB.

Explanation

AlloyDB is a managed PostgreSQL-compatible database for demanding transactional and analytical workloads.

ACE Question 308

Single page →
Topic 1 · Question 308

Your company's machine learning team requires a scalable and flexible platform to fine-tune large language models utilizing a large volume of proprietary data on Google Cloud. You are tasked with building a solution for this team. What should you do?

  • AUse Dataflow as a platform to run the fine-tuning jobs
  • BUse a Compute Engine managed instance group as a platform to deploy Jupyter Notebooks and run fine-tuning jobs.
  • CUse Cloud Run and GPU as a platform to run the fine-tuning jobs.
  • DUse Google Kubernetes Engine (GKE) and hardware accelerators as a platform to run the fine-tuning jobs. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use Google Kubernetes Engine (GKE) and hardware accelerators as a platform to run the fine-tuning jobs.

Explanation

Google Kubernetes Engine runs managed Kubernetes for containerized, portable workloads. Google Kubernetes Engine runs managed Kubernetes for containerized workloads.

ACE Question 309

Single page →
Topic 1 · Question 309

You recently discovered an issue with your rolling update in Google Kubernetes Engine (GKE). You now need to roll back a rolling update. What should you do?

  • ADelete the deployment.
  • BUse the kubectl rollout restart command to revert the deployment.
  • CUse the kubectl rollout undo command. (correct answer)
  • DManually scale down the new Pods and scale up the old Pods.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use the kubectl rollout undo command.

ACE Question 310

Single page →
Topic 1 · Question 310

You are deploying an application to Google Kubernetes Engine (GKE) that needs to call an external third-party API. You need to provide the external API vendor with a list of IP addresses for their firewall to allow traffic from your application. You want to follow Google-recommended practices and avoid any risk of interrupting traffic to the API due to IP address changes. What should you do?

  • AConfigure your GKE cluster with one node, and set the node to have a static external IP address. Ensure that the GKE cluster autoscaler is off. Send the external IP address of the node to the vendor to be added to the allowlist.
  • BConfigure your GKE cluster with private nodes. Configure a Cloud NAT instance with static IP addresses. Provide these IP addresses to the vendor to be added to the allowlist. (correct answer)
  • CConfigure your GKE cluster with private nodes. Configure a Cloud NAT instance with dynamic IP addresses. Provide these IP addresses to the vendor to be added to the allowlist.
  • DConfigure your GKE cluster with public nodes. Write a Cloud Function that pulls the public IP addresses of each node in the cluster, Trigger the function to run every day with Cloud Scheduler. Send the list to the vendor by email every day.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Configure your GKE cluster with private nodes. Configure a Cloud NAT instance with static IP addresses. Provide these IP addresses to the vendor to be added to the allowlist.

Explanation

Google Kubernetes Engine runs managed Kubernetes for containerized, portable workloads. Cloud NAT lets private instances reach the internet for outbound traffic without external IPs.

ACE Question 311

Single page →
Topic 1 · Question 311

You are planning to migrate your on-premises VMs to Google Cloud. You need to set up a landing zone in Google Cloud before migrating the VMs. You must ensure that all VM in your production environment can communicate with each other through private IP addresses. You need to allow all VMs in your Google Cloud organization to accept connections on specific TCP ports. You want to follow Google-recommended practices, and you need to minimize your operational costs. What should you do?

  • ACreate individual VPCs per Google Cloud project. Peer all he VPC together. Apply organization policies on the organization level.
  • BCreate individual VPCs for each Google Cloud project. Peer ail ne VPCs together. Apply hierarchical firewall policies on the organization level.
  • CCreate a host VPC project with each production project as its service project. Apply organization policies on the organization level.
  • DCreate a host VPC project with each production project as its service project. Apply hierarchical firewall policies on the organization level. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Create a host VPC project with each production project as its service project. Apply hierarchical firewall policies on the organization level.

Explanation

A VPC provides a global, software-defined private network for your Google Cloud resources.

ACE Question 312

Single page →
Topic 1 · Question 312

You assist different engineering teams in deploying their infrastructure on Google Cloud. Your company has defined certain practices required for all workloads. You need to provide the engineering teams with a solution that enables teams to deploy their infrastructure independently without having to know all implementation details of the company’s required practices. What should you do?

  • AConfigure organization policies to enforce your company's required practices. Ask the teams to provision their infrastructure by using the Google Cloud console.
  • BCreate a service account per team, and grant the service account the Project Editor role. Ask the teams to provision their infrastructure through the Google Cloud CLI (gcloud CL), while impersonating their dedicated service account.
  • CWrite Terraform modules for each component that are compliant with the company's required practices, and ask teams to implement their infrastructure through these modules. (correct answer)
  • DProvide training for all engineering teams you work with to understand the company’s required practices. Allow the engineering teams to provision the infrastructure to best meet their needs.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Write Terraform modules for each component that are compliant with the company's required practices, and ask teams to implement their infrastructure through these modules.

Explanation

Terraform provisions Google Cloud infrastructure as code repeatably.

ACE Question 313

Single page →
Topic 1 · Question 313

You ate managing an application deployed on Cloud Run. The development team has released a new version of the application. You want to deploy and redirect traffic to this new version of the application. To ensure traffic to the new version of the application is served with no startup time, you want to ensure that there are two idle instances available for incoming traffic before adjusting the traffic flow. You also want to minimize administrative overhead. What should you do?

  • AEnsure the checkbox “Serve this revision immediately” is unchecked when deploying the new revision. Before changing the traffic rules, use a traffic simulation tool to send load to the new revision.
  • BConfigure service autoscaling and set the minimum number of instances to 2.
  • CConfigure revision autoscaling for the new revision and set the minimum number of instances to 2. (correct answer)
  • DConfigure revision autoscaling for the existing revision and set the minimum number of instances to 2.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Configure revision autoscaling for the new revision and set the minimum number of instances to 2.

ACE Question 314

Single page →
Topic 1 · Question 314

Your digital media company stores a large number of video files on-premises. Each video file ranges from 100 MB to 100 GB. You are currently storing 150 TB of video data in your on-premises network, with no room for expansion. You need to migrate all infrequently accessed video files older than one year to Cloud Storage to ensure that on-premises storage remains available for new files. You must also minimize costs and control bandwidth usage. What should you do?

  • AUse Storage Transfer Service to move the data from the selected on-premises file storage systems to a Cloud Storage bucket.
  • BUse Transfer Appliance to request an appliance. Load the data locally, and ship the appliance back to Google for ingestion into Cloud Storage. (correct answer)
  • CSet up a Cloud Interconnect connection between the on-premises network and Google Cloud. Establish a private endpoint for Filestore access. Transfer the data from the existing Network File System (NFS) to Filestore.
  • DCreate a Cloud Storage bucket. Establish an Identity and Access Management (IAM) role with write permissions to the bucket. Use the gsutil tool to directly copy files over the network to Cloud Storage.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Use Transfer Appliance to request an appliance. Load the data locally, and ship the appliance back to Google for ingestion into Cloud Storage.

Explanation

Cloud Storage provides durable, scalable object storage that is fully managed. Transfer Appliance physically ships large datasets to Google Cloud when bandwidth is limited. This option delivers the requirement at the lowest cost.

ACE Question 315

Single page →
Topic 1 · Question 315

You are implementing a company-wide standard to control SSH access for your Google Cloud projects. You want to simplify SSH access management to your Compute Engine instances while maintaining audit compliance and eliminating as many manual steps as possible. What should you do?

  • AConfigure a service account to add SSH keys for all VMs.
  • BConfigure metadata SSH keys to manage sudo access to instances.
  • CEnable OS Login by using an organization policy for each Google Cloud project.
  • DEnable OS Login with two-factor authentication for the domain. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Enable OS Login with two-factor authentication for the domain.

ACE Question 316

Single page →
Topic 1 · Question 316 · Select all that apply

You need to create and manage service accounts for your workloads running on Google Cloud. You want to follow Google-recommended practices. What should you do? (Choose two.)

  • ACreate as few service accounts as possible.
  • BDelete any unused service accounts immediately.
  • CCreate single-purpose service accounts. (correct answer)
  • DManage service accounts as resources. (correct answer)
  • EUse random names for the service accounts.
Reveal answer & explanation
Correct answer: C, D

The correct answer is C, D. Option C: Create single-purpose service accounts. Option D: Manage service accounts as resources.

Explanation

A service account provides an identity for workloads to access Google Cloud APIs securely.

ACE Question 317

Single page →
Topic 1 · Question 317

Your company wants to migrate your data from an on-premises relational database to Google Cloud. Your current database can no longer scale with respect to the growth of your users, and you expect the number of users to rapidly grow. You need to choose a relational database that allows you to globally scale while minimizing your management and administration efforts. You also want to follow Google-recommended practices. What should you do?

  • AUse Cloud SQL.
  • BUse Spanner. (correct answer)
  • CUse Firestore.
  • DUse BigQuery.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Use Spanner.

Explanation

Cloud Spanner is a horizontally scalable, strongly consistent relational database with global reach.

ACE Question 318

Single page →
Topic 1 · Question 318

You are the Google Cloud systems administrator for your organization. User A reports that they received an error when attempting to access the Cloud SQL database in their Google Cloud project, while User B can access the database. You need to troubleshoot the issue for User A, while following Google-recommended practices. What should you do first?

  • AConfirm that network firewall rules are not blocking traffic for User A.
  • BVerify that User A has the Identity and Access Management (IAM) Project Owner role assigned.
  • CReview recent configuration changes that may have caused unintended modifications to permissions. (correct answer)
  • DReview the error message that User A received.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Review recent configuration changes that may have caused unintended modifications to permissions.

ACE Question 319

Single page →
Topic 1 · Question 319

You are writing a shell script that includes a few gcloud CLI commands to access some Google Cloud resources. You want to test the script in your local development environment with a service account in the most secure way. What should you do?

  • AGenerate an ID token for the service account. Use the token with the gcloud CLI commands.
  • BEnable service account impersonation, and use the gcloud config set command to use it by default. (correct answer)
  • CDownload the service account key file and save it in a secure location. Set the GOOGLE_APPLICATION_CREDENTIALS environment variable to the key file.
  • DDownload the service account key file, and use it to generate an access token. Use the token with the gcloud CLI commands.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Enable service account impersonation, and use the gcloud config set command to use it by default.

Explanation

A service account provides an identity for workloads to access Google Cloud APIs securely.

ACE Question 320

Single page →
Topic 1 · Question 320

Your company is active in the European Economic Area (EEA), and will adopt Google Cloud for its workloads. Projects are currently structured within different folders. You need to ensure any resources that will be deployed are using Google Cloud locations within the EEA by using the Organization Policy Service resource locations constraint. What should you do?

  • AConfigure the policy at the folder level, and add all allowed locations to the policy.
  • BConfigure the policy at the organization level, and add all allowed locations to the policy. (correct answer)
  • CConfigure the policy at the folder level, and add all disallowed locations to the policy.
  • DConfigure the policy at the organization level, and add all disallowed locations to the policy.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Configure the policy at the organization level, and add all allowed locations to the policy.

Showing questions 301–320 of 334 · Page 16 of 17