ACE sample questions

Question 1

You deployed an App Engine application using gcloud app deploy, but it did not deploy to the intended project. You want to find out why this happened and where the application deployed. What should you do?

Accepted Answer

Check the app.yaml file for your application and check project settings.

Answer

Check the web-application.xml file for your application and check project settings.

Answer

Go to Deployment Manager and review settings for deployment of applications.

Answer

Go to Cloud Shell and run gcloud config list to review the Google Cloud configuration used for deployment.

Question 2

You are using multiple configurations for gcloud. You want to review the configured Kubernetes Engine cluster of an inactive configuration using the fewest possible steps. What should you do?

Accepted Answer

Use kubectl config use-context and kubectl config view to review the output.

Answer

Use gcloud config configurations describe to review the output.

Answer

Use gcloud config configurations activate and gcloud config list to review the output.

Answer

Use kubectl config get-contexts to review the output.

Question 3

An application generates daily reports in a Compute Engine virtual machine (VM). The VM is in the project corp-iot-insights. Your team operates only in the project corp-aggregate-reports and needs a copy of the daily exports in the bucket corp-aggregate-reports-storage. You want to configure access so that the daily reports from the VM are available in the bucket corp-aggregate-reports-storage and use as few steps as possible while following Google-recommended practices. What should you do?

Accepted Answer

Move both projects under the same folder.

Answer

Grant the VM Service Account the role Storage Object Creator on corp-aggregate-reports-storage.

Answer

Create a Shared VPC network between both projects. Grant the VM Service Account the role Storage Object Creator on corp-iot-insights.

Answer

Make corp-aggregate-reports-storage public and create a folder with a pseudo-randomized suffix name. Share the folder with the loT team.

Question 4

You need to update a deployment in Deployment Manager without any resource downtime in the deployment. Which command should you use?

Accepted Answer

gcloud deployment-manager deployments update --config

Answer

gcloud deployment-manager deployments create --config

Answer

gcloud deployment-manager resources create --config

Answer

gcloud deployment-manager resources update --config

Question 5

You are tasked with setting up a network for a new project that will host a three-tier web application (web, app, database). The security policy requires that the database instances can only accept traffic from the application tier instances, and the application tier can only accept traffic from the web tier. Internet traffic should only reach the web tier. All instances are in the same VPC. How should you implement this policy using firewall rules and network tags? ```mermaid graph TD Internet -->|HTTPS| Web_Tier[Web Tier Instances (Tag: web-server)]; Web_Tier -->|TCP:8080| App_Tier[App Tier Instances (Tag: app-server)]; App_Tier -->|TCP:5432| DB_Tier[Database Tier Instances (Tag: db-server)]; ```

Accepted Answer

Create three ingress firewall rules: one allowing 0.0.0.0/0 to the `web-server` tag, one allowing the `web-server` tag to the `app-server` tag, and one allowing the `app-server` tag to the `db-server` tag.

Answer

Create three egress firewall rules: one for web-server to app-server, one for app-server to db-server, and one for web-server to the internet.

Answer

Create one ingress rule allowing traffic from 0.0.0.0/0 to all three tags (`web-server`, `app-server`, `db-server`) on their respective ports.

Answer

Create a service account for each tier and create firewall rules that use source service accounts instead of tags.

Question 6

You significantly changed a complex Deployment Manager template and want to confirm that the dependencies of all defined resources are properly met before committing it to the project. You want the most rapid feedback on your changes. What should you do?

Accepted Answer

Execute the Deployment Manager template using the -preview option in the same project, and observe the state of interdependent resources.

Answer

Use granular logging statements within a Deployment Manager template authored in Python.

Answer

Monitor activity of the Deployment Manager execution on the Stackdriver Logging page of the GCP Console.

Answer

Execute the Deployment Manager template against a separate project with the same configuration, and monitor for failures.

Question 7

You need to set up a policy so that videos stored in a specific Cloud Storage Regional bucket are moved to Coldline after 90 days, and then deleted after one year from their creation. How should you set up the policy?

Accepted Answer

Use Cloud Storage Object Lifecycle Management using Age conditions with SetStorageClass and Delete actions. Set the SetStorageClass action to 90 days and the Delete action to 275 days (365 - 90)

Answer

Use Cloud Storage Object Lifecycle Management using Age conditions with SetStorageClass and Delete actions. Set the SetStorageClass action to 90 days and the Delete action to 365 days.

Answer

Use gsutil rewrite and set the Delete action to 275 days (365-90).

Answer

Use gsutil rewrite and set the Delete action to 365 days.

Question 8

You need to grant access for three users so that they can view and edit table data on a Cloud Spanner instance. What should you do?

Accepted Answer

Run gcloud iam roles describe roles/spanner.databaseUser. Add the users to the role.

Answer

Run gcloud iam roles describe roles/spanner.databaseUser. Add the users to a new group. Add theg roup to the role.

Answer

Run gcloud iam roles describe roles/spanner.viewer -project my-project. Add the users to the role.

Answer

Run gcloud iam roles describe roles/spanner.viewer -project my-project. Add the users to a new group. Add the group to the role.

Question 9

Your company uses a large number of Google Cloud services centralized in a single project. All teams have specific projects for testing and development. The DevOps team needs access to all of the production services in order to perform their job. You want to prevent Google Cloud product changes from broadening their permissions in the future. You want to follow Google-recommended practices. What should you do?

Accepted Answer

Grant all members of the DevOps team the role of Project Editor on the production project.

Answer

Grant all members of the DevOps team the role of Project Editor on the organization level.

Answer

Create a custom role that combines the required permissions. Grant the DevOps team the custom role on the production project.

Answer

Create a custom role that combines the required permissions. Grant the DevOps team the custom role on the organization level.

Question 10

Your finance team wants to view the billing report for your projects. You want to make sure that the finance team does not get additional permissions to the project. What should you do?

Accepted Answer

Add the group for the finance team to roles/billing viewer role.

Answer

Add the group for the finance team to roles/bi I ling user role.

Answer

Add the group for the finance team to roles/bi 11 ing admin role.

Answer

Add the group for the finance team to roles/billing project/Manager role.

ACE Practice Questions

Unlock the full exam and previous versions

Create an account to continue.

Create an account to continue.

Related exams