GCP ACE Practice / Study guide / Domain 4
GCP ACE Domain 4: Ensuring Successful Operation
Roughly ~20% of the Google Cloud Associate Cloud Engineer exam. What it
actually covers, the traps to know, and 8 free sample questions with full explanations.
Domain 4 is about keeping a deployed system healthy, visible, and affordable — the "day 2" operations work. Cloud Monitoring and Cloud Logging are the backbone: know how to build an alerting policy on a metric threshold, set up an uptime check, and use log-based metrics to alert on something that isn't a built-in metric. A recurring trap is confusing "an alert exists" with "someone gets notified" — alerting policies need a notification channel to actually reach a human.
Expect questions on managing compute resources day-to-day: resizing a managed instance group manually versus letting an autoscaler do it, changing a running instance's machine type (it has to be stopped first for most machine type changes), and live migration versus instance restart during host maintenance. For storage and databases, know snapshot scheduling for persistent disks, Cloud SQL automated backups and point-in-time recovery, and object lifecycle rules that transition or delete GCS objects automatically by age.
Cost questions are common here too: reading a billing export, acting on Recommender's rightsizing suggestions, and knowing that committed use discounts and sustained use discounts are different mechanisms (one requires a commitment up front, the other applies automatically to steady usage within a month). Finally, patch management via OS Config and basic maintenance windows round out the domain.
Exam tips for this domain
- An alerting policy without a notification channel fires silently — always check that a channel (email, SMS, Pub/Sub) is actually attached.
- Changing a running Compute Engine instance's machine type normally requires stopping it first; that's a common "why did this fail" wrong-answer setup.
- Sustained use discounts apply automatically to steady month-long usage; committed use discounts require you to commit to 1 or 3 years up front for a deeper discount — don't mix these up.
Sample questions — Domain 4
These 8 questions are drawn from our full bank of 658 to show the style and
depth you'll get in the app. Each comes with the full explanation you'd see after answering
in a real practice session.
Audit logs
Which audit log type is ALWAYS on and cannot be disabled?
- Admin Activity audit logsCorrect
- Data Access audit logs for all services
- VPC Flow Logs
- Ops Agent logs
Why: Admin Activity (and System Event) audit logs are always written, free, and undisable-able. Data Access logs are mostly opt-in (BigQuery being a notable always-on exception), and flow/agent logs are features you enable.
Cloud SQL ops
Your team wants the ability to restore Cloud SQL to any moment in time in case a migration goes bad. Which prerequisites does point-in-time recovery require?
- Automated backups AND binary/write-ahead logging enabledCorrect
- Nothing; it's always on
- An HA standby
- A read replica
Why: PITR replays logs on top of a backup to reach a moment in time — both features must be on beforehand. HA and replicas serve availability/reads, not historical recovery.
Compute ops
A Linux VM stopped responding to SSH entirely. Which built-in tool lets you see boot/kernel output and even log in for debugging?
- The serial console (view serial port output / enable interactive serial console)Correct
- Cloud Trace
- VPC Flow Logs
- The billing report
Why: Serial port output shows boot logs even when networking is broken, and the interactive serial console permits emergency login. Trace and flow logs won't show a hung boot.
Cost ops
Recommender suggests 'resize VM to e2-small: idle CPU'. Where does this insight come from and what should you do?
- Usage-based machine right-sizing recommendations; review and apply if the workload profile agreesCorrect
- Random suggestions; ignore always
- Marketing; upgrade instead
- It means the VM is compromised
Why: Recommenders analyze actual utilization to propose savings (idle VMs, oversized machines, idle disks/IPs). Validate against known peaks before applying — then apply; that's free money.
DR
Your CEO read about a cloud region outage and asks what would happen to your single-region (us-central1) architecture. The honest RTO today is 'days'. The business decides customer data may lose at most 1 hour (RPO) and service must return within 4 hours (RTO), at reasonable cost. Which DR strategy fits?
- Warm standby: replicate data continuously (or near-continuously) to a second region, keep minimal infrastructure there defined as IaC, and scale it up during failoverCorrect
- Multi-region active-active with global databases regardless of cost
- Nightly backups shipped to the same region
- A printed disaster manual
Why: 1h RPO / 4h RTO sits squarely in warm-standby territory: continuous data replication meets RPO, and IaC-driven scale-up meets a 4-hour RTO at a fraction of active-active cost (which the requirement explicitly bounds). Same-region backups die with the region, and paper doesn't run failovers.
Databases ops
Your team needs nightly logical backups of a Cloud SQL database written to a bucket, for retention beyond the automated backups. How is this done?
- gcloud sql export sql INSTANCE gs://bucket/backup.sql --database=app (scheduled via Scheduler + Cloud Run job or similar)Correct
- Copying /var/lib/mysql via SSH
- Filestore snapshots
- BigQuery
Why: Exports write SQL/CSV dumps to GCS on your schedule — complementing (not replacing) automated backups. There is no OS access to managed instances; Filestore/BigQuery are different products.
Error Reporting
Which service automatically groups and counts application exceptions/stack traces and notifies you of NEW error types?
- Error ReportingCorrect
- Cloud Trace
- Cloud Profiler
- Cloud Scheduler
Why: Error Reporting deduplicates crashes into issues with first/last seen and alerts on new ones. Trace measures request latency; Profiler samples CPU/memory usage.
Flow logs
VPC Flow Logs are used to:
- Record sampled network flows to/from VM interfaces for security analysis, forensics, and traffic understandingCorrect
- Speed up the network
- Replace firewalls
- Log SSH keystrokes
Why: Flow logs (enabled per subnet) capture 5-tuple flow records with metadata — feed them to Logging/BigQuery for analysis. They observe; they don't enforce or accelerate.
Practice this domain for real
The app has dozens more Domain 4 questions with instant scoring, spaced
repetition of what you get wrong, and progress tracking across sessions.
Start Domain 4 practice →
Other exam domains