I85PREP
⌘ K
ACE-Specialist study materials
ACE-Specialist study resources

ACE-Specialist practice questions

One question at a time. Build your ACE-Specialist understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Solution architecture and design

A team needs to run a stateless containerized API that scales to zero when idle and requires minimal operational overhead. Which Google Cloud compute service best fits?

  1. Cloud Run Correct answer.
  2. App Engine standard environment
  3. Compute Engine managed instance group
  4. Google Kubernetes Engine Autopilot

Explanation

Cloud Run is a serverless platform for stateless containers; it scales to zero and bills only for request processing. Managed instance groups and GKE require more VM or cluster operations, and App Engine standard is runtime-constrained. The need for custom containers with minimal ops points to Cloud Run.

Question 2Solution architecture and design

An application stores compliance audit logs that must be retained for seven years and are rarely accessed after the first month. Cost is the primary concern, and retrieval latency of several hours is acceptable. Which Cloud Storage option is most appropriate?

  1. Standard storage with Object Lifecycle Management to Nearline
  2. Coldline storage with a bucket lock
  3. Archive storage with a bucket retention policy Correct answer.
  4. Multi-Regional Standard storage

Explanation

Archive storage has the lowest storage price and is designed for long-term retention with retrieval times measured in hours. A bucket retention policy enforces the seven-year retention requirement. Standard, Nearline, and Coldline cost more for data that is rarely accessed.

Question 3Solution architecture and design

A company wants to isolate development and production workloads in separate virtual networks while allowing centralized control of firewall rules and subnet IP ranges. Which design should the architect recommend?

  1. A single VPC with one subnet per environment
  2. Shared VPC host and service projects Correct answer.
  3. Two VPC networks connected with VPC peering
  4. Two VPC networks connected with Cloud VPN

Explanation

Shared VPC lets a host project own network resources while service projects attach workloads, centralizing subnet and firewall administration. Peering and VPN connect separate networks but do not centralize policy control in the same way. Separate VPCs with peering still require each side to manage its own rules.

Question 4Solution architecture and design

An auditor needs to review IAM policies across a project but must not be able to change them. Which predefined role should be granted?

  1. roles/editor
  2. roles/iam.securityReviewer Correct answer.
  3. roles/iam.securityAdmin
  4. roles/owner

Explanation

The security reviewer role grants read-only access to IAM policies and related security settings. Owner and editor can modify resources, and security admin can change IAM policies. Least privilege therefore points to the reviewer role.

Question 5Solution architecture and design

A public web application runs on Compute Engine instances in two regions and needs a single global anycast IP address with automatic failover. Which load balancer should be used?

  1. TCP proxy external load balancer
  2. Global external Application Load Balancer Correct answer.
  3. Regional external passthrough Network Load Balancer
  4. Internal regional Application Load Balancer

Explanation

The global external Application Load Balancer provides a single anycast IP and routes HTTP(S) traffic across regional backends with health-based failover. Regional and internal load balancers do not provide a global anycast frontend. A TCP proxy load balancer is not the best fit for HTTP(S) application routing.

Question 6Solution architecture and design

An application runs on Compute Engine and must automatically replace unhealthy instances and spread them across zones. Which feature should be configured?

  1. An instance template with preemptible VMs
  2. An unmanaged instance group with health-check policies
  3. A sole-tenant node group
  4. Regional managed instance group with autohealing Correct answer.

Explanation

A regional managed instance group spreads instances across zones and can use autohealing to recreate unhealthy instances. Unmanaged groups do not provide automatic healing or regional distribution. Sole-tenant nodes and preemptible VMs address isolation and cost, not health-based replacement.

Question 7Solution architecture and design

A production Cloud SQL for PostgreSQL instance must survive a zonal failure with automatic failover and minimal application changes. Which configuration should be used?

  1. Read replicas in two zones
  2. Cross-region replica promotion
  3. A single-zone instance with automated backups
  4. A regional high-availability instance Correct answer.

Explanation

A regional Cloud SQL high-availability instance maintains a standby in another zone and automatically fails over during a zonal outage. Read replicas and backups do not provide automatic zonal failover. Cross-region promotion addresses regional disasters rather than a single zone failure.

Question 8Solution architecture and design

A finance team wants to be notified when monthly Google Cloud spending for a project exceeds 80 percent of a planned amount. Which service should be configured?

  1. Security Command Center
  2. Cloud Monitoring uptime check
  3. Cloud Audit Logs
  4. Cloud Billing budget with alerts Correct answer.

Explanation

Cloud Billing budgets track spending against a target amount and send alerts at configured thresholds such as 80 percent. Audit Logs, uptime checks, and Security Command Center address auditing, availability, and security findings. They do not provide budget threshold notifications.

Question 9Solution architecture and design

An application writes objects to Cloud Storage and needs reads from several cities across the United States to be served from the nearest location with a single bucket name. Which location type should be selected?

  1. Regional
  2. Zonal
  3. Dual-region
  4. Multi-region Correct answer.

Explanation

A multi-region bucket stores data redundantly across a broad geographic area and can serve reads from the nearest location within that area. Dual-region and regional buckets have narrower placement. Zonal is not a Cloud Storage bucket location type.

Question 10Solution architecture and design

A company needs a dedicated, private connection between its on-premises data center and a Google Cloud VPC with predictable latency and a 10 Gbps circuit. Which service should be recommended?

  1. Cloud NAT with static IP addresses
  2. Cloud Interconnect dedicated connection Correct answer.
  3. VPC peering with on-premises routers
  4. Cloud VPN with high-availability VPN tunnels

Explanation

Dedicated Interconnect provides a private, high-bandwidth connection between on-premises networks and Google Cloud with predictable performance. Cloud VPN runs over the public internet and is better for lower-bandwidth or backup paths. VPC peering and Cloud NAT do not connect on-premises networks to Google Cloud.

Question 11Solution architecture and design

Instances in a private subnet without external IP addresses must reach Google APIs such as Cloud Storage without traversing the public internet. Which configuration should be enabled?

  1. Cloud NAT with a static external IP
  2. A firewall rule allowing egress to 0.0.0.0/0
  3. Private Google Access on the subnet Correct answer.
  4. An external HTTP(S) load balancer

Explanation

Private Google Access allows instances with only internal IP addresses to reach Google APIs and services through Google's network. Cloud NAT enables outbound internet access but is not required for Google API access. Firewall rules alone do not provide the private API path.

Question 12Solution architecture and design

A startup wants to deploy a small number of microservices with per-request billing, automatic TLS, and no cluster management, while retaining the ability to run custom containers. Which service is the best fit?

  1. App Engine standard environment
  2. Cloud Run services Correct answer.
  3. GKE Standard with node auto-provisioning
  4. Compute Engine with a managed instance group

Explanation

Cloud Run runs custom containers in a fully managed serverless model with per-request billing and automatic TLS. GKE and managed instance groups require more infrastructure management. App Engine standard does not support arbitrary custom containers.

Question 13Solution architecture and design

An order service must asynchronously notify inventory, billing, and shipping services without coupling to their availability. Which architecture should be used?

  1. Publish order events to Pub/Sub with separate subscriptions Correct answer.
  2. Write orders to a Cloud SQL table polled by each service
  3. Use a single Cloud Function that calls all services in sequence
  4. Call each service synchronously through a load balancer

Explanation

Pub/Sub decouples producers from consumers; each downstream service can use its own subscription and process events independently. Synchronous calls and sequential function calls couple the order service to downstream availability. Polling a database is less scalable and still couples services to a shared schema.

Question 14Solution architecture and design

A BigQuery table stores five years of event data and most queries filter on event_date for the last seven days. Queries scan the full table and costs are high. What should be done first?

  1. Create a materialized view for every possible query
  2. Add a clustering key on user_id
  3. Export the table to Cloud Storage and query external tables
  4. Partition the table by event_date Correct answer.

Explanation

Partitioning by event_date allows BigQuery to prune partitions that do not match the date filter, reducing bytes scanned and cost. Clustering on user_id does not help date-filtered scans as directly. External tables and many materialized views add complexity without addressing the main pruning opportunity.

Question 15Solution architecture and design

A team needs to process unbounded clickstream data with exactly-once semantics and windowed aggregations before writing to BigQuery. Which service is designed for this?

  1. Cloud Functions with a Pub/Sub trigger
  2. BigQuery scheduled queries
  3. Dataflow streaming pipelines Correct answer.
  4. Cloud Dataproc with a nightly Spark batch job

Explanation

Dataflow supports streaming pipelines with windowing, exactly-once processing semantics, and built-in BigQuery sinks. Dataproc batch jobs and scheduled queries are batch-oriented. Cloud Functions can handle events but is not designed for stateful windowed stream processing at scale.

Question 16Solution architecture and design

An image uploaded to a Cloud Storage bucket must trigger a small Python function that creates a thumbnail. Which trigger should be configured?

  1. A Pub/Sub topic published by an external system
  2. An HTTP trigger exposed publicly
  3. Eventarc object-finalized trigger Correct answer.
  4. A Cloud Scheduler cron job

Explanation

Eventarc can deliver Cloud Storage object-finalized events to a Cloud Run function, which is the direct event-driven trigger for an uploaded object. Scheduler and HTTP triggers are time- or request-based, not storage-event-based. An external Pub/Sub publisher would require extra glue.

Question 17Solution architecture and design

A central networking team must manage subnets and firewall rules for multiple application projects, while application teams deploy resources into their own projects. Which design meets this requirement?

  1. A single project with all resources and IAM roles
  2. VPC peering between all application projects
  3. Shared VPC host and service projects Correct answer.
  4. Separate VPCs connected by Cloud VPN

Explanation

Shared VPC separates network administration from workload ownership: the host project owns subnets and firewall rules, while service projects deploy resources into shared networks. Peering and VPN connect networks but leave administration distributed. A single project does not preserve project-level workload separation.

Question 18Solution architecture and design

An organization must prevent any project from creating VM instances with external IP addresses. Which mechanism should be used?

  1. VPC Service Controls around the perimeter
  2. An organization policy constraint on external IPs Correct answer.
  3. IAM roles that remove compute.instances.create
  4. A firewall rule denying egress on all VPCs

Explanation

An organization policy constraint such as disabling external IP access prevents VM creation with external addresses across projects. Firewall rules control traffic but do not stop external IP assignment. Removing create permission blocks all VM creation, and VPC Service Controls addresses API data exfiltration boundaries.

Question 19Solution architecture and design

An application has an RPO of five minutes and an RTO of one hour. It runs on Cloud SQL for MySQL and must survive a regional outage. Which approach best meets these targets?

  1. A regional high-availability instance only
  2. A cross-region read replica promoted during failover Correct answer.
  3. A single-zone instance with binary logging enabled
  4. Nightly automated backups restored to a new instance

Explanation

A cross-region read replica continuously replicates changes to another region and can be promoted during a regional outage, supporting a short RPO and an RTO within an hour. Nightly backups cannot meet a five-minute RPO. Regional high availability protects against zonal, not regional, failure.

Question 20Solution architecture and design

Multiple engineers use Terraform to manage the same Google Cloud infrastructure. They need state locking and a shared source of truth. Which backend configuration should be used?

  1. Terraform state committed to the application Git repository
  2. Local state files stored in each engineer's home directory
  3. A Cloud Storage bucket with versioning disabled
  4. A Cloud Storage backend with object versioning and locking Correct answer.

Explanation

A Cloud Storage backend provides a shared remote state location and supports state locking so concurrent applies do not corrupt state. Object versioning preserves state history. Local files and Git-committed state do not provide safe locking.

Question 21Solution architecture and design

An application runs on a regional managed instance group. Traffic spikes are predictable each weekday at 9 AM, but unpredictable microbursts also occur. The team wants to scale ahead of the daily spike while still reacting to microbursts. Which combination should be used?

  1. A fixed instance count sized for the daily peak
  2. Only load balancing utilization autoscaling
  3. Scheduled scaling plus CPU utilization autoscaling Correct answer.
  4. Only CPU utilization autoscaling with a low target

Explanation

A scheduled scaling policy adds capacity before the known 9 AM spike, while a CPU utilization policy reacts to unexpected microbursts. A single reactive policy may lag the predictable spike, and a fixed count wastes capacity outside peak periods. Combining scheduled and reactive policies addresses both patterns.

Question 22Solution architecture and design

A three-tier application has a public web tier, an application tier, and a database tier. The application tier must accept traffic only from the web tier, and the database tier only from the application tier. Which design should be used?

  1. Rely only on database authentication
  2. Separate subnets and service-account firewall rules Correct answer.
  3. Place all tiers in one subnet and rely on IAM conditions
  4. Use one firewall rule allowing 10.0.0.0/8

Explanation

Placing tiers in separate subnets and using firewall rules with source and target service accounts enforces least-privilege tier-to-tier access. IAM conditions govern API permissions, not network paths. A broad CIDR rule would allow far more than the intended tier relationships.

Question 23Solution architecture and design

A global external Application Load Balancer serves traffic from two regional backend services. The primary region must handle all traffic unless its health check fails, then traffic must go to the secondary region. Which configuration should be used?

  1. DNS round-robin records for each regional load balancer
  2. A failover backend policy Correct answer.
  3. A single backend service with both regional groups
  4. Equal weighted traffic splitting between both backends

Explanation

A failover backend policy designates a primary and backup backend group, sending traffic to the primary until health checks fail. Equal weighting splits traffic rather than providing standby behavior. DNS round-robin does not integrate with load balancer health checks as required.

Question 24Solution architecture and design

A workload runs steadily on Compute Engine for at least three years, and the finance team wants the lowest committed cost while retaining the ability to change machine types within the same family. Which purchase option should be recommended?

  1. On-demand instances with sustained use discounts
  2. Preemptible VMs with a restart policy
  3. A three-year committed use discount with a flexible family Correct answer.
  4. A one-year committed use discount for each exact machine type

Explanation

A three-year committed use discount provides the deepest commitment discount for steady workloads. A flexible family commitment allows machine type changes within the committed family, preserving operational flexibility. One-year commitments and on-demand pricing cost more over the three-year horizon.

Question 25Solution architecture and design

A legacy application cannot be retired immediately, but the company wants to move it to Google Cloud with minimal changes and then modernize incrementally. Which migration approach should be recommended first?

  1. Lift and shift to Compute Engine, then refactor Correct answer.
  2. Move to BigQuery and expose SQL endpoints
  3. Retire the application and rebuild from scratch
  4. Rewrite as microservices on GKE before migration

Explanation

Rehosting the application on Compute Engine minimizes changes and lets the team migrate first, then modernize components incrementally. A full rewrite before migration increases risk and delays the move. Retiring or replacing the application contradicts the requirement to keep it running.

Question 26Solution architecture and design

A compliance dataset is written once and then read about once per quarter for reporting. The objects must stay retrievable for three years with millisecond access, and storage cost should be minimized. Which Cloud Storage class should be used?

  1. Archive
  2. Standard
  3. Coldline Correct answer.
  4. Nearline

Explanation

Cloud Storage classes trade storage price against retrieval cost and minimum storage duration. Coldline targets data accessed less than once per month and has a 90-day minimum, which matches quarterly reads over a three-year retention. Archive has a 365-day minimum and higher retrieval costs, while Nearline is priced for roughly monthly access.

Question 27Solution architecture and design

A public web application sits behind an external Application Load Balancer. The security team must block SQL injection and cross-site scripting attempts before requests reach the backends. Which control should be configured?

  1. Cloud IDS with threat signatures on the subnet
  2. IAP access levels restricted by source IP
  3. Cloud Armor with preconfigured WAF rules Correct answer.
  4. VPC firewall rules that inspect SQL payloads

Explanation

Cloud Armor security policies are enforced at the external Application Load Balancer, where preconfigured WAF rules evaluate HTTP request payloads for signatures such as SQL injection and XSS. Attaching the policy to the backend service makes those rules apply before traffic reaches the VMs.

Question 28Solution architecture and design

A platform team builds container images with Cloud Build and deploys them to GKE. The team needs a regional private registry with per-repository IAM and integrated vulnerability scanning. Which service should be used?

  1. A Cloud Storage bucket with object versioning
  2. Container Registry in the same project
  3. Artifact Registry Correct answer.
  4. A private Docker Hub organization

Explanation

Artifact Registry is the regional container and package registry that supports per-repository IAM, vulnerability scanning, and native integration with Cloud Build and GKE. Container Registry is the legacy service and does not provide repository-level IAM.

Question 29Solution architecture and design

A regulated customer requires that BigQuery data at rest be encrypted with keys the customer can rotate and disable. Which configuration meets this requirement?

  1. Customer-supplied keys on every query
  2. Client-side encryption after upload
  3. Google-managed default encryption
  4. Customer-managed keys in Cloud KMS Correct answer.

Explanation

Customer-managed encryption keys (CMEK) let the customer control the Cloud KMS key used for data at rest, including rotation and disabling. BigQuery supports CMEK on datasets and tables, while default encryption uses keys the customer does not control.

Question 30Solution architecture and design

A security team must stop BigQuery datasets in a set of projects from being copied to any project outside that set, even by principals who hold broad IAM permissions. Which control should be implemented?

  1. CMEK applied to every dataset
  2. A VPC Service Controls perimeter around the projects Correct answer.
  3. An IAM deny policy on the bigquery.tables.export permission
  4. A Cloud Armor policy attached to the datasets

Explanation

VPC Service Controls creates a security perimeter around projects and supported services such as BigQuery, blocking API-level operations that would move data across the perimeter boundary. It is the control designed to mitigate data exfiltration even when a principal has IAM permissions.

Question 31Solution architecture and design

A Pub/Sub subscriber repeatedly fails on malformed messages and retries them indefinitely, reducing throughput. Failed messages must be retried a bounded number of times and then retained for inspection. What should be configured?

  1. A dead-letter topic with a delivery attempt limit Correct answer.
  2. A message retention duration of 7 days
  3. An ack deadline of 600 seconds
  4. Exactly-once delivery on the subscription

Explanation

A dead-letter topic with a maximum delivery attempt count causes Pub/Sub to stop redelivering a message after the limit and forward it to the dead-letter topic. This bounds retries and preserves poison messages for later inspection.

Question 32Solution architecture and design

A payments ledger requires a relational schema, SQL, and globally consistent ACID transactions for users in North America, Europe, and Asia. The service must remain available during a regional failure. Which database should be selected?

  1. Bigtable with multi-cluster routing
  2. Spanner with a multi-region instance configuration Correct answer.
  3. Cloud SQL for PostgreSQL with cross-region read replicas
  4. Firestore in Datastore mode with a multi-region location

Explanation

Spanner multi-region configurations keep synchronously replicated copies in several regions and provide external consistency, so transactions and reads observe a single serial order globally. Multi-region instances carry a 99.999% availability SLA and support SQL with strong ACID semantics, which fits a ledger.

Question 33Solution architecture and design

A Cloud Run service must call a VM that has only a private RFC 1918 address in the same project's VPC. The traffic must not traverse the public internet. Which configuration should be used?

  1. Private Google Access on the subnet
  2. Direct VPC egress on the service Correct answer.
  3. A Cloud NAT gateway in the VPC
  4. Assign the service an external IP address

Explanation

Direct VPC egress lets a Cloud Run service send traffic from an internal IP address in a VPC subnet, so it can reach private RFC 1918 destinations without the public internet. A Serverless VPC Access connector is the older alternative for the same requirement.

Question 34Solution architecture and design

An organization wants a firewall rule that denies SSH from the internet to apply to all current and future projects, while still letting project owners add their own rules. Which approach should be used?

  1. A Cloud Armor policy on each project's load balancer
  2. An IAM deny policy on the compute.instances.ssh permission
  3. A hierarchical firewall policy deny rule at the organization Correct answer.
  4. A VPC firewall rule in every project's default network

Explanation

Hierarchical firewall policies attach at the organization or folder level and are evaluated before VPC firewall rules, so a deny rule applies to all current and future projects. Project-level rules can still be added but cannot override the higher-level deny.

Question 35Solution architecture and design

An order process calls three APIs in sequence, retries failed steps with backoff, waits up to 24 hours for a manual approval callback, and then calls a final API. The team wants minimal infrastructure to manage. Which service should be used?

  1. Workflows with HTTP callbacks and retry policies Correct answer.
  2. A Dataflow streaming pipeline
  3. A Cloud Function with polling and a 9-minute timeout
  4. A Pub/Sub topic with three subscriptions

Explanation

Workflows is a serverless orchestrator that executes steps in a defined order, applies retry policies with backoff, and can pause on HTTP callbacks for long approvals without running compute. This fits multi-step, long-running coordination with minimal infrastructure.

Question 36Solution architecture and design

A team deploys a containerized service to GKE and needs an automated canary release to a small percentage of pods, verification, promotion to full rollout, and rollback on failure. Which service should be used?

  1. Cloud Build with a single kubectl apply step
  2. Artifact Registry vulnerability scanning
  3. GKE Autopilot
  4. Cloud Deploy with a canary strategy Correct answer.

Explanation

Cloud Deploy models a delivery pipeline and release progression, and supports canary strategies that shift a percentage of traffic or replicas, run verification, and promote or roll back. It integrates with GKE and Cloud Build to automate the release lifecycle.

Question 37Solution architecture and design

Contractors from a partner company must sign in to the Google Cloud console with their own identity provider and must not receive Google Accounts. Which capability should be used?

  1. IAP with a signed header
  2. Workforce Identity Federation with the partner IdP Correct answer.
  3. Cloud Identity groups synchronized by GCDS
  4. Service account keys issued to each contractor

Explanation

Workforce Identity Federation lets an external workforce authenticate with its own OIDC or SAML identity provider and receive Google Cloud access without Google Accounts. It is intended for contractors, partners, and other non-Google identities.

Question 38Solution architecture and design

VPC A is peered with VPC B, and VPC B is peered with VPC C. No other connectivity exists. An instance in A must reach an instance in C. What must be added?

  1. A firewall rule in B that allows forwarded traffic
  2. Private Google Access enabled in A, B, and C
  3. A direct peering between A and C Correct answer.
  4. Reliance on peering route propagation through B

Explanation

VPC Network Peering is non-transitive: routes learned from one peer are not advertised to another peer, so A cannot reach C through B. Connectivity requires a direct peering between A and C or a transit architecture such as Network Connectivity Center or VPN.

Question 39Solution architecture and design

A SaaS provider exposes an API from its own VPC. A customer wants private IP access from its VPC without coordinating non-overlapping CIDR ranges or building a peering relationship. Which approach should the customer use?

  1. A Private Service Connect endpoint to the provider's service attachment Correct answer.
  2. An external load balancer with IP allowlisting
  3. VPC Network Peering between the two VPCs
  4. A Cloud VPN tunnel with BGP between the VPCs

Explanation

Private Service Connect lets a producer publish a service attachment and a consumer create an endpoint in its own VPC, providing private IP access without peering and without requiring non-overlapping CIDR ranges. It is the standard pattern for cross-organization private service consumption.

Question 40Solution architecture and design

A Bigtable table stores IoT readings with row keys formed as timestamp followed by device ID. Writes concentrate on the last tablet and time-range scans per device are slow. What key design change should be made?

  1. Increase the number of Bigtable nodes
  2. Enable multi-cluster routing on the instance
  3. Prefix keys with device ID, then timestamp Correct answer.
  4. Add a random suffix to every row key

Explanation

Bigtable stores rows in lexicographic order and splits them into tablets, so a monotonically increasing key prefix such as a timestamp sends all new writes to the last tablet. Leading with high-cardinality device ID distributes writes across ranges while keeping each device's readings contiguous for time scans.

Question 41Deployment and implementation

You need to create a Compute Engine VM named web-1 in zone us-central1-a by using the gcloud CLI. Which command should you run?

  1. gcloud compute instances add web-1 --zone=us-central1-a --machine-type=e2-medium
  2. gcloud compute instances deploy web-1 --zone=us-central1-a --image-family=debian-12
  3. gcloud compute instances create web-1 --zone=us-central1-a Correct answer.
  4. gcloud compute vms create web-1 --region=us-central1 --size=e2-medium

Explanation

The gcloud compute instances create command provisions a new VM and accepts --zone to place it in a specific zone. The other commands are not valid Compute Engine creation commands or use the wrong resource group.

Question 42Deployment and implementation

A team stores compliance records that are accessed about once or twice a year and must be retrievable within hours. They want the lowest storage cost that still meets the retrieval requirement. Which Cloud Storage class should they use?

  1. Coldline
  2. Archive Correct answer.
  3. Nearline
  4. Standard

Explanation

Archive storage has the lowest storage price and is designed for data accessed less than once a year, with retrieval typically available within hours. It enforces a 365-day minimum storage duration, which fits long-term compliance records.

Question 43Deployment and implementation

You have built a container image at us-docker.pkg.dev/acme/payments/api:1.0 and want to deploy it to Cloud Run as a service named payments. Which command should you use?

  1. gcloud app deploy us-docker.pkg.dev/acme/payments/api:1.0
  2. gcloud run deploy payments --image=us-docker.pkg.dev/acme/payments/api:1.0 Correct answer.
  3. kubectl run payments --image=us-docker.pkg.dev/acme/payments/api:1.0
  4. gcloud functions deploy payments --image=us-docker.pkg.dev/acme/payments/api:1.0

Explanation

Cloud Run services are deployed with gcloud run deploy and the container image is supplied through the --image flag. The command creates or updates the named service and routes traffic to the new revision.

Question 44Deployment and implementation

An application on a Compute Engine VM must read objects from a Cloud Storage bucket. You want to avoid embedding long-lived credentials in the VM. What should you do?

  1. Create an HMAC key for a storage service account and store it in the VM's metadata
  2. Attach a user-managed service account with roles/storage.objectViewer to the VM Correct answer.
  3. Grant roles/editor to the Compute Engine default service account for the project
  4. Download a JSON key for the Compute Engine default service account and place it on the VM

Explanation

A VM attached to a service account obtains short-lived credentials from the metadata server, so no key file is needed. Granting only roles/storage.objectViewer follows least privilege for reading objects.

Question 45Deployment and implementation

You want all subsequent gcloud commands in your shell session to target the project acme-prod. Which command should you run?

  1. gcloud config set account acme-prod
  2. gcloud init --project-only acme-prod
  3. gcloud config set project acme-prod Correct answer.
  4. gcloud projects activate acme-prod --global

Explanation

gcloud config set project changes the active project in the current gcloud configuration, so later commands use acme-prod by default. The setting persists in the active configuration until it is changed again.

Question 46Deployment and implementation

You need to deploy a second-generation Cloud Function named hello that responds to HTTP requests and allows unauthenticated callers. Which command accomplishes this?

  1. gcloud functions deploy hello --gen2 --runtime=nodejs20 --trigger-bucket=assets
  2. gcloud functions deploy hello --gen2 --runtime=nodejs20 --trigger-event=providers/cloud.storage/eventTypes/object.finalize
  3. gcloud functions deploy hello --gen2 --runtime=nodejs20 --trigger-topic=events
  4. gcloud functions deploy hello --gen2 --runtime=nodejs20 --trigger-http --allow-unauthenticated Correct answer.

Explanation

The --trigger-http flag creates an HTTP-triggered function, and --allow-unauthenticated permits invocation without an identity token. The --gen2 flag selects the second-generation runtime environment.

Question 47Deployment and implementation

You need to create a Cloud Storage bucket named acme-logs in the us-east1 region. Which command should you run?

  1. gcloud storage buckets describe gs://acme-logs --location=us-east1
  2. gcloud storage buckets add gs://acme-logs --location=us-east1 --public
  3. gcloud storage buckets create gs://acme-logs --location=us-east1 Correct answer.
  4. gcloud storage buckets update gs://acme-logs --location=us-east1

Explanation

gcloud storage buckets create provisions a new bucket, and --location sets its location. Bucket names are supplied as gs:// URLs in this command group.

Question 48Deployment and implementation

A managed instance group must create identical, repeatable VM instances from a single definition. Which resource should the group reference?

  1. An instance template Correct answer.
  2. A custom machine image
  3. A persistent disk snapshot
  4. A Cloud Storage bucket

Explanation

A managed instance group uses an instance template to define the machine type, image, disks, network, and metadata for each VM it creates. Changing the template requires a new template and a group update.

Question 49Deployment and implementation

You manage a zonal managed instance group named web-mig and want it to scale between 2 and 10 instances based on a target CPU utilization of 60%. Which configuration achieves this?

  1. Set the autoscaler target CPU utilization to 60% and the maximum replicas to 10 Correct answer.
  2. Set the autoscaler target CPU utilization to 10% and the maximum replicas to 60
  3. Set the autoscaler scale-in control to 60% and the maximum replicas to 10
  4. Set the autoscaler target load balancing utilization to 60% and the minimum replicas to 10

Explanation

CPU-based autoscaling uses a target CPU utilization signal, and maxNumReplicas caps the group size. The minimum replicas should also be set to 2 to satisfy the lower bound.

Question 50Deployment and implementation

You configured an external HTTP(S) load balancer with a managed instance group backend, but all backends are reported unhealthy even though the application responds on port 8080. What should you do?

  1. Allow ingress from 0.0.0.0/0 to the health check port on all backends
  2. Disable the health check and rely on the load balancer's connection draining
  3. Allow ingress from the load balancer's external IP address only to port 80
  4. Allow ingress from 130.211.0.0/22 and 35.191.0.0/16 to the health check port Correct answer.

Explanation

Google Cloud health checks originate from the documented probe ranges 130.211.0.0/22 and 35.191.0.0/16. A firewall rule must permit those sources to the backend port, which in this case is 8080.