Ensuring successful operation of a cloud solution — ACE Practice Quiz

Question 1

Your security team needs to retain and analyze all Cloud Audit Logs from a production project for at least two years, and they want to run SQL queries against the log data to investigate access patterns. By default, admin activity logs are only retained for 400 days in Cloud Logging. What should you configure to meet these requirements?

Accepted Answer

Create a log sink in Cloud Logging that exports the audit logs to a BigQuery dataset.

Answer

Increase the retention period of the _Default log bucket to 730 days.

Answer

Create a log-based metric for the audit logs and build a Cloud Monitoring dashboard.

Answer

Enable Data Access audit logs and download the entries manually each month.

Question 2

Your compliance team requires that application logs for a production project be retained for 400 days, but the default _Default log bucket in Cloud Logging keeps logs for only 30 days. You want to meet the requirement with the least ongoing operational effort and without exporting logs to another service. What should you do?

Accepted Answer

Edit the retention period of the _Default log bucket (or create a custom log bucket) and set it to 400 days.

Answer

Create a Pub/Sub sink that streams all logs to a Cloud Function that writes them to a Cloud Storage bucket with a 400-day lifecycle rule.

Answer

Create a scheduled Cloud Run job that copies logs from Cloud Logging to BigQuery every night and deletes them after 400 days.

Answer

Enable Data Access audit logs on the project so that logs are automatically retained for one year.

Question 3

Your team runs a fleet of Compute Engine VMs and needs Cloud Monitoring dashboards to show detailed guest-level metrics such as disk I/O and process-level CPU usage. Currently the dashboards only display default hypervisor-level metrics like network traffic and disk throughput reported by the VM instance. What should you do to collect the additional guest-level metrics?

Accepted Answer

Install and configure the Ops Agent on each VM instance.

Answer

Enable Cloud Monitoring at the project level in the Cloud Console.

Answer

Create a log-based metric that extracts disk I/O values from the system logs.

Answer

Grant the Monitoring Viewer role to the VM service account.

Question 4

Your team runs a fleet of IoT gateway devices that push a custom metric named 'device/heartbeat' to Cloud Monitoring every 60 seconds. Operations wants to be paged automatically if any device stops reporting its heartbeat entirely, indicating the gateway has gone offline. What is the most appropriate way to configure this alerting policy in Cloud Monitoring?

Accepted Answer

Create an alerting policy with a metric-absence condition on 'device/heartbeat', grouped by device, that triggers when data is missing for a chosen duration.

Answer

Create a metric-threshold alerting policy that fires when 'device/heartbeat' is greater than 0 for 5 minutes.

Answer

Create an uptime check pointed at each device's IP address and alert when the check fails.

Answer

Create a log-based metric that counts heartbeat log entries and alert when the count exceeds a threshold.

Question 5

You operate a fleet of Compute Engine VMs behind a load balancer. Operations wants to be paged only when BOTH average CPU utilization exceeds 85% AND request latency exceeds 500ms for a sustained 5-minute window, to avoid noisy alerts during isolated spikes. Using Cloud Monitoring, what is the correct way to configure this?

Accepted Answer

Create a single alerting policy with two conditions and set the policy trigger to fire only when all conditions are met (combined with AND logic).

Answer

Create two separate alerting policies, one for CPU and one for latency, each with its own notification channel.

Answer

Create a single alerting policy with two conditions and set the trigger to fire when any condition is met (OR logic).

Answer

Create a log-based metric that counts high-CPU log entries and alert when the count exceeds a threshold.

Question 6

Your team runs a fleet of Compute Engine VMs behind Cloud Monitoring. You created an alerting policy on CPU utilization that fires every time a brief scheduled cron job spikes CPU above 90% for a few seconds, generating dozens of false pages each night. You want to reduce these transient alerts without raising the threshold value. What should you configure on the alerting condition?

Accepted Answer

Increase the retest window (duration) so the condition must remain violated for a sustained period before the alert triggers

Answer

Change the notification channel from PagerDuty to email so alerts arrive less urgently

Answer

Add a log-based metric that counts cron job executions and alert on that instead

Answer

Reduce the alerting policy's auto-close duration so alerts resolve faster

Question 7

Your team runs a fleet of Compute Engine VMs hosting a memory-intensive application. In Cloud Monitoring you can see CPU utilization for each VM, but you cannot find any memory usage metrics to build a dashboard chart. What must you do to collect and visualize per-VM memory utilization?

Accepted Answer

Install the Ops Agent on the VMs so that memory metrics are collected and reported to Cloud Monitoring.

Answer

Enable the Compute Engine API in the project to expose additional built-in memory metrics.

Answer

Create a log-based metric that parses memory values from the serial console output.

Answer

Grant the Monitoring Viewer role to the VM service account so it can publish memory data.

Question 8

Your operations team manages hundreds of Compute Engine VMs across several environments. VMs are tagged with a label 'env' set to values like 'prod', 'staging', or 'dev'. You want a single Cloud Monitoring construct that automatically includes any new VM tagged 'env:prod' so dashboards and alerting policies always reflect the current production fleet without manual updates. What should you configure?

Accepted Answer

Create a Monitoring group with a membership criterion that matches the label 'env = prod'.

Answer

Create a static list of resource names in each alerting policy and update it whenever a VM is added.

Answer

Create a log-based metric filtered on the 'env' label and build the dashboard from that metric.

Answer

Create separate custom dashboards per VM and use dashboard folders to organize them.

Question 9

Your company runs three separate Google Cloud projects: a shared monitoring project called 'ops-central', plus 'app-prod' and 'app-staging' that host workloads. The operations team wants to view Compute Engine and log-based metrics from both workload projects in a single set of dashboards inside 'ops-central', without duplicating agents or copying data. What should you do?

Accepted Answer

In the 'ops-central' project, configure a metrics scope and add 'app-prod' and 'app-staging' as monitored projects.

Answer

Create a logging sink in each workload project that exports metrics to a Pub/Sub topic in 'ops-central'.

Answer

Enable VPC Network Peering between the three projects so metrics can be shared over the internal network.

Answer

Install the Ops Agent in 'ops-central' and point each workload VM's agent configuration to write to 'ops-central'.

Question 10

Your team runs a customer-facing service on Compute Engine behind an HTTP(S) load balancer. Customers complain about occasional slow responses, but the average latency shown on your existing dashboard looks fine. You need to investigate whether a small percentage of requests are experiencing high latency. In Cloud Monitoring Metrics Explorer, what should you do to surface this behavior?

Accepted Answer

Chart the load balancer total latency metric and apply a 95th percentile aligner/reducer to view tail latency

Answer

Chart the load balancer request count metric and apply a sum aggregation across all backends

Answer

Chart the load balancer latency metric and apply a mean aligner grouped by backend zone

Answer

Create an uptime check against the load balancer frontend and view its latency graph

Question 11

Your operations team uses PagerDuty for on-call incident management. You have created an alerting policy in Cloud Monitoring that detects high error rates on a production Cloud Run service. You need incidents to automatically open PagerDuty tickets when the alert fires, with the least operational overhead. What should you do?

Accepted Answer

Configure a PagerDuty notification channel in Cloud Monitoring using the PagerDuty integration key, then attach it to the alerting policy.

Answer

Create a Pub/Sub notification channel in Cloud Monitoring and write a Cloud Function that forwards messages to the PagerDuty API.

Answer

Export the alerting policy logs to BigQuery and schedule a query that calls the PagerDuty API when new error rows appear.

Answer

Add an email notification channel that sends to the team's shared inbox, which PagerDuty polls for new alerts.

Question 12

Your team runs a stateless web application on a single Compute Engine instance. Occasionally the application process hangs, and you must manually SSH in and restart the VM. You want Cloud Monitoring to automatically detect when the HTTP endpoint stops responding and immediately notify your on-call engineer's email, with the least operational effort. Which combination should you configure?

Accepted Answer

Create an uptime check against the HTTP endpoint, then create an alerting policy that triggers on the uptime check failure and sends to an email notification channel.

Answer

Install the Ops Agent and create a log-based metric that counts HTTP 500 errors, then alert when the count exceeds zero.

Answer

Create a Cloud Scheduler job that curls the endpoint every minute and writes results to a Pub/Sub topic subscribed by a Cloud Function that emails the team.

Answer

Enable the Compute Engine autohealing health check on a managed instance group and configure email alerts from the instance group.

Question 13

Your team runs a payment API on Cloud Run and has defined a Cloud Monitoring service with a 99.9% availability SLO over a rolling 28-day window. On-call engineers complain they receive too many alerts for tiny, temporary error blips that never threaten the monthly target, yet they still want to be paged quickly when a real outage is rapidly consuming the error budget. Which Cloud Monitoring feature should you configure to meet both needs?

Accepted Answer

An SLO burn-rate alerting policy that pages only when the error budget is being consumed faster than a defined threshold over a lookback window

Answer

A metric-threshold alerting policy that fires whenever the request error rate exceeds 0.1% for 1 minute

Answer

An uptime check against the Cloud Run URL with a notification channel to the on-call PagerDuty service

Answer

A log-based metric counting 5xx responses with an alert on every non-zero value

Question 14

You operate a set of Compute Engine VMs running a web application. Operations reports that a snapshot schedule attached to the boot disks is not producing new snapshots, and you need to quickly confirm whether the schedule is actually executing. Using only Cloud Console, what is the fastest way to verify recent snapshot creation activity for these disks?

Accepted Answer

Open Compute Engine > Snapshots and check the creation timestamps of recent snapshots to see if they match the schedule interval.

Answer

Create a Cloud Monitoring uptime check against the VMs to detect whether the disks are reachable.

Answer

Enable the Cloud Monitoring agent on each VM and build a dashboard that plots disk I/O throughput.

Answer

Request a quota increase for persistent disk snapshots in the affected region.

Question 15

Your team runs a public-facing web application served from a Compute Engine instance behind a global HTTP(S) load balancer at https://shop.example.com. Operations wants to be notified within a few minutes whenever the site becomes unreachable from multiple geographic regions. Using the least operational effort, what should you configure in Cloud Monitoring?

Accepted Answer

Create an uptime check targeting the URL https://shop.example.com with checks from multiple regions, then attach an alerting policy that fires when the check fails.

Answer

Install the Ops Agent on the VM and create a log-based metric that counts HTTP 500 responses, then alert on that metric.

Answer

Create a dashboard widget showing the load balancer request count and manually review it during business hours.

Answer

Write a Cloud Run job that curls the URL every minute and writes results to Cloud Logging, then create an alert on the log entries.

Question 16

Your company runs three separate Google Cloud projects: one for production, one for staging, and one for development. The operations team wants to view Compute Engine and application metrics from all three projects in a single set of Cloud Monitoring dashboards and configure alerting policies that span them. What should you do?

Accepted Answer

Create a metrics scope in one project (the scoping project) and add the other two projects as monitored projects.

Answer

Enable the Cloud Monitoring API separately in each project and manually copy dashboard configurations between them.

Answer

Export metrics from all three projects to BigQuery and build dashboards using Looker Studio.

Answer

Move all three projects into the same folder so that Cloud Monitoring automatically aggregates their metrics.

Question 17

Your team has deployed a customer-facing API to Cloud Run in the us-central1 region. The service currently responds at its default run.app URL, but the marketing team wants it served from api.example.com with a valid TLS certificate that is automatically provisioned and renewed. You own the example.com domain and can edit its DNS records. What is the recommended way to achieve this with the least ongoing maintenance?

Accepted Answer

Create a Cloud Run domain mapping for api.example.com, verify domain ownership, and add the DNS records Cloud Run provides so Google manages the certificate automatically.

Answer

Purchase a TLS certificate from a third-party CA, upload it to Cloud Run as a secret, and mount it into the container to terminate HTTPS.

Answer

Add a CNAME record pointing api.example.com directly to the run.app URL and rely on the existing run.app certificate to cover the custom domain.

Answer

Reserve a static external IP, attach it to the Cloud Run service, and configure the certificate manually on the container's web server.

Question 18

You deployed a new revision of a Cloud Run service, but users immediately begin reporting errors. The previous revision was working correctly and is still listed in the service's revision history. You need to restore service availability as quickly as possible using the least effort. What should you do?

Accepted Answer

Route 100% of traffic to the previous known-good revision using 'gcloud run services update-traffic --to-revisions'.

Answer

Delete the broken revision so Cloud Run automatically serves the earlier revision.

Answer

Rebuild the container image from the previous source commit and deploy it as a new revision.

Answer

Redeploy the service with '--no-traffic' and manually restart all running instances.

Question 19

Your team runs a lightweight REST API on Cloud Run. Each container can safely handle many simultaneous requests because most time is spent waiting on downstream calls. During load tests, you notice Cloud Run is spinning up far more instances than expected, increasing cost. You want to reduce the number of instances by allowing each instance to process more requests at once. Which action should you take?

Accepted Answer

Increase the per-instance concurrency setting for the service

Answer

Increase the maximum number of instances on the service

Answer

Increase the CPU and memory allocated to each instance

Answer

Set a minimum number of instances to keep containers warm

Question 20

Your team runs a public-facing REST API on Cloud Run. During an unexpected traffic surge, Cloud Run scaled out to hundreds of container instances, causing a large unexpected bill and exhausting your downstream Cloud SQL connection pool. You need to cap how many instances the service can create while keeping the deployment otherwise unchanged. What should you do?

Accepted Answer

Deploy a new revision with the --max-instances flag set to an appropriate ceiling on the Cloud Run service.

Answer

Set the --concurrency flag to 1 so that each instance handles only one request at a time.

Answer

Request a lower quota for the Cloud Run API in the project via a quota decrease request.

Answer

Add a Cloud Monitoring alerting policy on instance count and manually delete instances when it fires.

More ACE practice