Google ACE Practice Test 21 — 15 Questions

Question 1

A company uses VPC Service Controls to protect Cloud Storage. They have a service perimeter that includes the storage API and the project where the stored data resides. Users inside the perimeter can access the data, but users outside cannot. However, a group of users outside the perimeter are able to access the data using a signed URL generated by a service inside the perimeter. Why does this happen?

Accepted Answer

VPC Service Controls do not apply to signed URLs.. VPC Service Controls are designed to restrict access to Google Cloud resources based on the network origin of requests, but they do not evaluate or block requests made using signed URLs. Signed URLs are authenticated via cryptographic signatures, not IAM or network context, so they bypass the perimeter check entirely. This is by design, as signed URLs are intended for temporary, out-of-band access.

Answer

Signed URLs bypass VPC Service Controls.

Answer

The service perimeter is misconfigured, missing signed URL restrictions.

Answer

The users have been granted IAM roles that override the perimeter.

Question 2

Which gcloud CLI command authenticates a developer's local environment with their Google account?

Accepted Answer

gcloud auth login. Option B, `gcloud auth login`, is correct because it initiates the OAuth 2.0 flow to authenticate the gcloud CLI with a user's Google account, storing the resulting credentials locally for subsequent API calls. This command is the standard way to authorize a developer's local environment for the first time or when switching users.

Answer

gcloud config set account [EMAIL]

Answer

gcloud init --authenticate

Answer

gcloud accounts activate

Question 3

A company wants to allow developers to create Compute Engine instances with a specific set of persistent disk types (e.g., only pd-ssd). Which TWO methods can be used to enforce this? (Choose two.)

Accepted Answer

Organization policy with constraint compute.restrictDiskTypes. Option C is correct because the `compute.restrictDiskTypes` organization policy constraint allows administrators to define a list of allowed persistent disk types (e.g., pd-ssd) at the project, folder, or organization level. When set, any Compute Engine instance creation request that specifies a disk type not on the allowed list will be denied by the policy engine, enforcing the restriction without requiring changes to individual IAM roles or scripts.

Answer

Organization policy with constraint compute.requireShieldedVm

Answer

VPC custom firewall rules

Answer

Service account permissions

Question 4

You are configuring a VPC with multiple subnets. You need to allow traffic from the internet to a specific instance on port 80, but only if the traffic originates from a set of known IP addresses. Which three resources must be configured? (Choose three.)

Accepted Answer

A load balancer with Cloud Armor.. Option A is correct because Cloud Armor is a web application firewall that can be attached to a load balancer to allow or deny traffic based on IP address ranges. This enables you to restrict inbound HTTP traffic on port 80 to only the known IP addresses, while the load balancer distributes traffic to the instance. Without Cloud Armor, a load balancer alone cannot filter by source IP; it relies on backend firewall rules or Cloud Armor policies for such granular access control.

Answer

A route to the internet gateway.

Answer

A Cloud Router.

Question 5

A security analyst needs to retrieve all Cloud Logging entries with severity ERROR or higher across all resource types in the current project. Which log query correctly filters these entries?

Accepted Answer

severity >= "ERROR". Option C is correct because Cloud Logging's query language supports comparison operators like `>=` for severity levels, where `ERROR` is a recognized severity level. The query `severity >= "ERROR"` retrieves all entries with severity ERROR, CRITICAL, ALERT, or EMERGENCY, as these are considered higher severity than ERROR. This matches the requirement to filter for severity ERROR or higher across all resource types without restricting the time range or resource type.

Answer

severity >= ERROR AND timestamp > now() - 24h

Answer

severity="ERROR" AND resource.type="gce_instance"

Answer

logName="projects/my-project/logs/stderr" AND severity > "WARNING"

Question 6

A company wants to ensure that only users from a specific domain (@example.com) can access Cloud Storage buckets in a project. Which two steps should be taken? (Choose two.)

Accepted Answer

Set an organization policy to restrict allowed domains for IAM.. Option C is correct because the organization policy constraint `iam.allowedPolicyMemberDomains` restricts which domains can be used as members in IAM policies across the entire project. This ensures that only principals from @example.com can be granted access to any resource, including Cloud Storage buckets. Option E is correct because a Cloud Identity group containing only @example.com users can be granted IAM roles on the bucket, and membership in the group is controlled by the domain, effectively limiting access to that domain.

Answer

Use VPC Service Controls to restrict access.

Answer

Enable domain restricted sharing in Cloud Storage settings.

Answer

Add an IAM condition to the bucket policy to require that the user's domain is @example.com.

Question 7

A developer has an App Engine Standard application ready to deploy. The app.yaml file is in the current working directory. Which command deploys the application?

Accepted Answer

gcloud app deploy. The `gcloud app deploy` command is the correct way to deploy an App Engine Standard application when the `app.yaml` file is present in the current working directory. This command automatically detects the configuration file and uploads the application code to the specified App Engine service, handling the deployment process including staging, versioning, and traffic migration.

Answer

gcloud app create --config=app.yaml

Answer

gcloud appengine deploy app.yaml

Answer

gcloud run deploy --platform=appengine

Question 8

A data science team needs a VM with 96 vCPUs and 624 GB of RAM. No predefined GCP machine type matches these exact specifications. What is the recommended approach?

Accepted Answer

Create a custom machine type with exactly 96 vCPUs and 624 GB RAM. Option B is correct because Google Cloud allows you to create custom machine types when predefined machine types do not meet your exact requirements. Custom machine types let you specify the exact number of vCPUs (up to 96) and memory (up to 624 GB) for a VM, providing flexibility without over-provisioning resources.

Answer

Select the closest larger predefined N2 machine type

Answer

Split the workload across multiple smaller VMs and coordinate manually

Answer

Contact Google Cloud support to request a new predefined machine type

Question 9

A financial trading platform must support globally distributed, strongly consistent SQL transactions at thousands of writes per second, with no downtime for planned maintenance. Which GCP database service meets all these requirements?

Accepted Answer

Cloud Spanner. Cloud Spanner is the only GCP database service that provides globally distributed, strongly consistent SQL transactions with horizontal scaling, supporting thousands of writes per second. It uses synchronous replication across regions and TrueTime-based clock synchronization to ensure external consistency, while also offering 99.999% availability with no planned downtime for maintenance.

Answer

Cloud SQL with synchronous read replicas

Answer

Cloud Bigtable

Answer

Cloud Firestore

Question 10

Refer to the exhibit. A user attempts to create a Deployment Manager deployment that references a service account. What is the most likely issue?

Accepted Answer

The user does not have the roles/iam.serviceAccountUser role on the service account. When a Deployment Manager deployment references a service account, the user must have the `roles/iam.serviceAccountUser` role on that service account to impersonate it. Without this role, the deployment fails even if the user has `deploymentmanager.deployments.create` permission, because the service account is used to execute the deployment's resources. Option B correctly identifies this missing IAM binding as the most likely issue.

Answer

The user does not have deploymentmanager.deployments.create permission

Answer

The service account is disabled

Answer

The service account does not exist

Question 11

Where in the Google Cloud Console can a user view all APIs currently enabled for their project and monitor their usage?

Accepted Answer

APIs & Services > Dashboard. Option C is correct because the 'APIs & Services > Dashboard' page in the Google Cloud Console provides a centralized view of all enabled APIs for a project, along with real-time usage metrics such as requests per second, error rates, and latency. This dashboard is the primary interface for monitoring API consumption and identifying throttling or quota issues.

Answer

Cloud Shell > Active Sessions

Answer

IAM & Admin > Service Accounts

Answer

Monitoring > Metrics Explorer

Question 12

A security team wants to prevent authorized users from copying BigQuery query results to a dataset in a different GCP project that is outside the team's security boundary — even if the user has valid IAM permissions. Which control enforces this?

Accepted Answer

VPC Service Controls with a perimeter enclosing BigQuery. VPC Service Controls (VPC-SC) create a security perimeter around Google Cloud services, including BigQuery, that prevents data exfiltration to projects outside the perimeter regardless of IAM permissions. By configuring a service perimeter that includes BigQuery and the authorized project, any attempt to copy query results to a dataset in a project outside the perimeter is blocked, even if the user has valid IAM roles. This enforces a data boundary that overrides IAM-based access.

Answer

IAM deny policies restricting cross-project BigQuery operations

Answer

An organization policy preventing resource creation outside specific projects

Answer

Cloud Armor rules blocking outbound API requests to BigQuery in other projects

Question 13

A developer wants to configure a firewall rule to allow HTTP traffic from the internet to a specific Compute Engine instance tagged 'web-server'. Which TWO conditions must be true? (Choose two.)

Accepted Answer

The firewall rule must be of type ingress. Option B is correct because an ingress firewall rule controls incoming traffic to instances. Since the developer wants to allow HTTP traffic from the internet to reach the instance, the rule must be of type ingress to permit inbound connections on port 80.

Answer

The instance must have a public IP address

Answer

The firewall rule must be applied to the VPC network

Answer

The firewall rule must specify the source IP range 0.0.0.0/0

Question 14

An enterprise requires a private connection between its on-premises data center and Google Cloud VPC that does NOT traverse the public internet and provides dedicated 10 Gbps bandwidth. Which connectivity option meets these requirements?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct, private physical connection between your on-premises network and Google Cloud VPC, offering bandwidth up to 10 Gbps per circuit (or 100 Gbps with multiple circuits) without traversing the public internet. This meets the requirement for a private connection with dedicated 10 Gbps bandwidth, as it uses a colocation facility and a Google-supported router.

Answer

Cloud VPN with high-availability configuration

Answer

Partner Interconnect

Answer

Direct Peering

Question 15

A security team wants to prevent every project in the organization from creating VM instances with external IP addresses — without requiring configuration in each individual project. What is the most scalable solution?

Accepted Answer

Set the organization policy constraint compute.vmExternalIpAccess to Deny All at the organization level. Option B is correct because the organization policy constraint `compute.vmExternalIpAccess` can be applied at the organization level to deny all VM instances from having external IP addresses, enforcing this rule across all projects without per-project configuration. This is the most scalable approach as it uses Google Cloud's hierarchical policy engine to centrally control resource creation, overriding any project-level settings.

Answer

Create a firewall rule in every project blocking outbound traffic on port 80 and 443

Answer

Remove the Compute Engine Admin role from all project owners

Answer

Use Cloud Armor to block all traffic destined for public IPs in the organization