Google ACE Practice Test 28 — 15 Questions

Question 1

An engineer needs to allow HTTP traffic from the internet to a set of Compute Engine instances that have the network tag 'web-server'. The instances are in a VPC with a default firewall rule that denies all ingress. Which command creates the required firewall rule?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

gcloud compute firewall-rules create allow-http --allow tcp:80 --source-ranges 0.0.0.0/0 --target-tags web-server. The rule must allow TCP port 80 from source 0.0.0.0/0 to instances with target tag 'web-server'. The correct command uses '--allow tcp:80', '--source-ranges 0.0.0.0/0', and '--target-tags web-server'. Priority can be default (1000).

Answer

gcloud compute firewall-rules create allow-http --allow tcp:80 --source-tags web-server

Answer

gcloud compute firewall-rules create allow-http --allow tcp:80 --source-ranges web-server

Answer

gcloud compute firewall-rules create allow-http --allow http --target-tags web-server

Question 2

A company has multiple VPC networks in their project. They want Compute Engine instances in one VPC to communicate with instances in another VPC using internal IP addresses. Which feature should they use?

Accepted Answer

VPC Network Peering. VPC Peering allows connectivity between two VPC networks using internal IPs. VPN is for on-premises connectivity. Cloud NAT is for outbound internet access. Firewall rules control traffic but do not enable routing between VPCs.

Answer

Cloud NAT

Answer

Cloud VPN

Answer

Firewall rules

Question 3

Which command is used to view the current IAM policy for a Google Cloud project in JSON format?

Accepted Answer

gcloud projects get-iam-policy [PROJECT_ID] --format json. The 'gcloud projects get-iam-policy' command retrieves the IAM policy for a project. The '--format json' flag outputs it in JSON. The other options are for other resources or wrong scope.

Answer

gcloud compute instances get-iam-policy [INSTANCE]

Answer

gcloud organizations get-iam-policy [ORG_ID]

Answer

gcloud iam service-accounts get-iam-policy [SERVICE_ACCOUNT]

Question 4

A developer needs to store a database password in Secret Manager and then allow a Compute Engine instance to access it. The instance uses the default compute engine service account. Which role should be granted to the service account?

Accepted Answer

roles/secretmanager.secretAccessor. To access the secret version's payload, the service account needs the 'secretmanager.secretAccessor' role on the secret (or project). That role allows accessing secret versions. roles/secretmanager.admin is too broad. roles/cloudsql.client is for Cloud SQL, not Secret Manager. roles/viewer does not allow access to secret payloads.

Answer

roles/cloudsql.client

Answer

roles/secretmanager.admin

Answer

roles/viewer

Question 5

You need to deploy an application that requires a regional MySQL database with automated backups, high availability, and failover. You also need to store static assets that are publicly accessible. Which TWO Google Cloud services should you use?

Accepted Answer

Cloud SQL (MySQL). Cloud SQL with MySQL provides managed MySQL with high availability (regional) and automated backups. Cloud Storage can host static assets publicly.

Answer

Bigtable

Answer

Cloud Filestore

Answer

Cloud Spanner

Question 6

A DevOps team needs to grant a CI/CD service account the ability to create secrets in Secret Manager. Which role should be assigned?

Accepted Answer

roles/secretmanager.admin. The roles/secretmanager.admin role grants full control, including creating secrets. roles/secretmanager.secretCreator does not exist; the admin role includes create permission.

Answer

roles/secretmanager.secretCreator

Answer

roles/secretmanager.secretAccessor

Answer

roles/secretmanager.viewer

Question 7

A company wants to organize their GCP resources into a hierarchy to separate development, staging, and production environments. Which THREE resources can be used to create this separation?

Accepted Answer

Folders. GCP resource hierarchy includes Organization, Folders, Projects, and Resources. Folders can be used to group projects (e.g., dev folder, prod folder). Projects are the containers for resources. Labels are metadata tags but not part of the hierarchy. Billing accounts are separate from the hierarchy. IAM policy is not a resource for separation.

Answer

Billing accounts

Answer

Labels

Question 8

Match each Google Cloud service to its primary purpose.

Accepted Answer

Compute Engine: Provides virtual machines for running workloads.. Google Cloud services each have a specific purpose: Compute Engine for VMs, Cloud Storage for object storage, Cloud SQL for managed relational databases, and BigQuery for data warehousing. Distractors swap these definitions.

Answer

Compute Engine: Managed relational database service.

Answer

Cloud Storage: Data warehousing for analytics.

Question 9

Match each IAM role to its typical access level.

Accepted Answer

Viewer: Read-only access to resources. IAM roles in GCP have predefined permissions: Viewer (read-only), Editor (read/write but no IAM), Owner (full control). Security Admin is a separate role for managing security policies.

Answer

Security Admin: Read-only access to resources

Answer

Viewer: Full access including IAM management

Question 10

You need to view the current gcloud configuration settings, including the active account, project, and compute region. Which TWO commands can you use? (Choose two.)

Accepted Answer

gcloud config list. gcloud config list displays all configuration properties. gcloud info provides detailed information, including configuration.

Answer

gcloud config describe

Answer

gcloud projects list

Answer

gcloud auth list

Question 11

An organization has a VPC with instances in two subnets: subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). They want to allow HTTP traffic from any instance in subnet-a to any instance in subnet-b. What firewall rule should be created?

Accepted Answer

An ingress rule on subnet-b allowing traffic from 10.0.1.0/24 on TCP port 80. Firewall rules are defined with direction and source/target. To allow inbound traffic to subnet-b from subnet-a, an ingress rule with source range 10.0.1.0/24 is needed.

Answer

An egress rule on subnet-b allowing traffic to 10.0.1.0/24 on TCP port 80

Answer

An ingress rule on subnet-a allowing traffic to 10.0.2.0/24 on TCP port 80

Answer

An egress rule on subnet-a allowing traffic to 10.0.2.0/24 on TCP port 80

Question 12

You are setting up a new GCP project for a microservices application. You need to select which APIs to enable. Which THREE APIs are likely required? (Choose 3)

Accepted Answer

cloudbuild.googleapis.com. For a microservices application on Kubernetes, you need the Kubernetes Engine API (container.googleapis.com), and often the Cloud Build API (cloudbuild.googleapis.com) for CI/CD and Compute Engine API (compute.googleapis.com) as a dependency for GKE. Cloud Storage API is not necessarily required unless using Cloud Storage. BigQuery is for analytics.

Answer

storage.googleapis.com

Answer

bigquery.googleapis.com

Question 13

A company wants to set up a new GCP project and ensure that only approved APIs can be used. Which two steps should they take? (Choose TWO)

Accepted Answer

Use an organization policy to restrict the set of allowed APIs. To restrict API usage, you can disable unapproved APIs and use organization policies to enforce restrictions.

Answer

Create a custom role with permissions to enable APIs

Answer

Set a budget to limit API usage costs

Answer

Assign the Owner role to the project

Question 14

Your company has a production project and a development project. You want to ensure that no one can delete the production project accidentally. Which TWO actions should you take? (Choose 2)

Accepted Answer

Apply an organization policy constraint that blocks project deletion.. To prevent accidental deletion, you can set a deletion protection policy at the project level. Additionally, using an organization policy constraint 'constraints/resourcemanager.projectDelete' at the folder or organization level can block deletion. Labels don't prevent deletion. Removing the Owner role from all users would break management. Budget alerts don't prevent deletion.

Answer

Set a budget alert at 100% of projected spend.

Answer

Remove the Owner role from all users and grant only Editor.

Answer

Add a label to the project indicating it is production.

Question 15

An engineer is setting up a new GCP project for a containerized application. They need to enable the required APIs. Which TWO APIs must be enabled to deploy and manage a Kubernetes cluster and build container images?

Accepted Answer

cloudbuild.googleapis.com. Kubernetes Engine API and Cloud Build API are needed for cluster management and building images.

Answer

compute.googleapis.com

Answer

bigquery.googleapis.com

Answer

cloudfunctions.googleapis.com