Google ACE Practice Test 29 — 15 Questions

Question 1

A security team wants to centrally identify misconfigured GCP resources across their organization — such as publicly accessible Cloud Storage buckets, unencrypted disks, and overly permissive firewall rules. Which GCP service provides these findings?

Accepted Answer

Security Command Center (SCC) with Security Health Analytics enabled. Security Command Center (SCC) with Security Health Analytics enabled is the correct service because it provides built-in, automated scanning for common misconfigurations such as publicly accessible Cloud Storage buckets, unencrypted disks, and overly permissive firewall rules. Security Health Analytics uses a set of pre-defined detectors (e.g., `PUBLIC_BUCKET_ACL`, `DISK_ENCRYPTION_DISABLED`, `FIREWALL_RULE_OPEN`) to continuously assess resources and surface findings in the SCC dashboard, without requiring custom code or manual queries.

Answer

Cloud Asset Inventory — query for all resources and write custom checks

Answer

Cloud Monitoring alert policies with metric conditions for firewall rule changes

Answer

Cloud Logging audit log analysis for admin activity changes

Question 2

Match each Google Cloud service to its primary purpose.

Question 3

Match each Google Cloud deployment tool to its purpose.

Question 4

A team runs a critical production project and wants to prevent anyone — including project owners and organization admins — from accidentally deleting it. Which mechanism provides this protection?

Accepted Answer

Create a project lien using the Cloud Resource Manager API or gcloud. A project lien is the correct mechanism because it explicitly prevents the deletion of a Google Cloud project by blocking the `resourcemanager.projects.delete` operation until the lien is removed. This protection works regardless of the user's role, including project owners and organization admins, and is managed via the Cloud Resource Manager API or `gcloud` command. It is designed specifically for accidental deletion prevention, not for access control.

Answer

Remove the Owner role from all users in the project

Answer

Set an organization policy denying the resourcemanager.projects.delete permission

Answer

Enable deletion protection in the project's IAM settings in the Console

Question 5

A developer is running a batch process on a Compute Engine instance that needs to write logs to Cloud Logging. The instance uses the default Compute Engine service account. What must be done?

Accepted Answer

Ensure the instance's access scopes include logging.write. The default Compute Engine service account has the `logging.logWriter` role by default, but access scopes act as an additional permission layer on Compute Engine instances. Even if the IAM role is present, the instance must have the `logging.write` access scope enabled to allow the service account to write logs to Cloud Logging. Option A is correct because explicitly setting the access scope ensures the API call to `logging.write` is permitted at the instance level.

Answer

No action needed, the default service account has logging write access

Answer

Create a custom service account with the required roles

Answer

Add the Logging Admin role to the service account

Question 6

A developer creates a Cloud Storage bucket and sets a uniform bucket-level access policy. What is the implication?

Accepted Answer

Object ACLs are disabled. When uniform bucket-level access is enabled on a Cloud Storage bucket, all access control is managed exclusively through IAM policies at the bucket level. Object ACLs are disabled, meaning individual object permissions cannot be set or evaluated. This ensures consistent access control across all objects in the bucket.

Answer

Only object ACLs are used

Answer

Bucket permissions override object ACLs

Answer

Both bucket IAM and object ACLs are used

Question 7

Refer to the exhibit. An application running on this instance is unable to write to a Cloud Storage bucket. What is the most likely cause?

Accepted Answer

The access scopes only allow read access to Cloud Storage. When an instance is created with access scopes, these scopes restrict the API methods that the instance's credentials can use, regardless of the IAM permissions granted to the attached service account. The exhibit shows that the access scopes are set to 'Read Only' for Cloud Storage, which means the application can only call read methods (e.g., storage.objects.get) and cannot perform write operations (e.g., storage.objects.insert). This overrides any IAM role that would otherwise allow write access.

Answer

The application is using the wrong authentication method

Answer

The Cloud Storage bucket is in a different project

Answer

The service account does not have the storage.objectAdmin IAM role

Question 8

A company's security team wants to enforce that all service account keys in production projects are rotated every 30 days and prevent creation of keys that never expire. Which single solution should they implement?

Accepted Answer

Set the organization policy constraint iam.restrictServiceAccountKeyExpiryHours to 720 hours and use the Service Account Key Manager to schedule automatic rotation.. Option C is correct because the organization policy constraint `iam.restrictServiceAccountKeyExpiryHours` enforces a maximum key lifetime (720 hours = 30 days), and the Service Account Key Manager can automate rotation before expiry. This combination ensures all service account keys are rotated every 30 days and prevents creation of keys that never expire, meeting both requirements with a single solution.

Answer

Use Cloud Audit Logs to detect keys older than 30 days and manually delete them.

Answer

Set the organization policy constraint iam.disableServiceAccountKeyCreation.

Answer

Use IAM conditions to require that key creation only succeeds if an expiration time is set.

Question 9

A user needs to view the list of firewall rules in a project but should not be able to create or modify them. Which predefined IAM role should you grant?

Accepted Answer

roles/compute.viewer. The roles/compute.viewer role grants read-only access to Compute Engine resources, including the ability to list firewall rules, without permitting create, update, or delete operations. This aligns with the principle of least privilege for a user who only needs to view firewall configurations.

Answer

roles/editor

Answer

roles/compute.securityAdmin

Answer

roles/owner

Question 10

Your company runs a microservices application on Google Kubernetes Engine (GKE) with a shared VPC. The security team requires that all pod-to-pod traffic be encrypted using TLS. Additionally, you need to restrict which pods can communicate with each other. The application uses a service mesh with Istio. You have enabled Istio mTLS in STRICT mode, but you notice that some pods are still able to communicate with other pods without TLS. You have verified that all pods have the Istio sidecar injected. What should you do to fix the issue?

Accepted Answer

Apply a Kubernetes Network Policy to deny all non-mTLS traffic.. Option C is correct because Istio mTLS in STRICT mode only enforces encryption between sidecars that are properly configured and have discovered each other via the Istio control plane. However, if a pod bypasses the sidecar (e.g., by using a hostNetwork or a non-sidecar port), or if the sidecar is not enforcing the policy due to a misconfiguration, plaintext traffic can still flow. Applying a Kubernetes Network Policy that explicitly denies all non-mTLS traffic (e.g., by blocking TCP port 80 and allowing only port 443 or the Istio mTLS port) provides a defense-in-depth layer that blocks any unencrypted communication at the network layer, regardless of sidecar behavior.

Answer

Enable VPC Flow Logs to identify the unencrypted traffic.

Answer

Restart all pods to force re-injection of the sidecar.

Answer

Ensure that the GKE cluster has the Istio add-on enabled for all node pools.

Question 11

A security team wants to restrict access to a Google Cloud project such that only virtual machines with a specific tag 'web' can connect to a Compute Engine instance on port 443. Which configuration is required?

Accepted Answer

Create a firewall rule allowing ingress from instances with tag 'web' to the target instance on port 443.. Option B is correct because firewall rules in Google Cloud are stateful and control ingress traffic at the network level. To allow only VMs with tag 'web' to connect to the target instance on port 443, you must create an ingress firewall rule that specifies the source tag 'web', the target instance (or its network tag), and the protocol/port tcp:443. This rule permits incoming HTTPS traffic from any VM that has the 'web' tag, regardless of its IP address.

Answer

Create a firewall rule allowing egress from instances with tag 'web' to the target instance on port 443.

Answer

Set an IAM condition on the instance to only allow calls from instances with tag 'web'.

Answer

Use Cloud Armor to filter traffic based on tags.

Question 12

You are configuring Identity-Aware Proxy (IAP) for a web application running on Compute Engine. Users authenticate through IAP and are granted access based on their email addresses. However, some users report that they are prompted to sign in multiple times during the same session. What is the most likely cause?

Accepted Answer

The IAP session timeout is set too low.. Option A is correct because IAP has a configurable session timeout; if set too low, users will need to re-authenticate frequently. Option B (HTTPS) is required for IAP but not the cause. Option C (different browsers) is not a common cause. Option D (cookie validation) is handled by IAP.

Answer

The backend service is missing the IAP session cookie validation.

Answer

The users are accessing the application via different browsers.

Answer

The backend service does not support HTTPS.

Question 13

You need to audit all IAM policy changes in your project. You want to ensure that every change is logged with the identity of the user who made the change. Which type of audit log should you enable?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs (also known as Cloud Audit Logs) record all API calls that modify the configuration or metadata of resources, including IAM policy changes. These logs capture the identity of the user who made the change, the time of the change, and the specific modification, ensuring full accountability for administrative actions.

Answer

Data Access audit logs

Answer

Policy Denied audit logs

Answer

System Event audit logs

Question 14

A company manages a production GKE cluster with node auto-upgrade enabled. They want to ensure that during a node upgrade, the workloads are rescheduled gracefully without downtime. What Kubernetes resource should be configured on their Deployments?

Accepted Answer

PodDisruptionBudget. PodDisruptionBudget (PDB) allows you to specify the minimum available or maximum unavailable pods during voluntary disruptions like node upgrades. Without a PDB, a node upgrade could evict all pods at once, causing downtime. ResourceQuota and HorizontalPodAutoscaler do not control disruption.

Answer

HorizontalPodAutoscaler

Answer

ResourceQuota

Answer

Node affinity rules

Question 15

A developer wants to deploy a Cloud Function that processes images uploaded to a Cloud Storage bucket. The function should be triggered automatically when an object is created. What is the best practice for setting up this trigger?

Accepted Answer

Create a Cloud Function with a Cloud Storage trigger and specify the bucket and event type. Option B is correct because Cloud Functions natively supports Cloud Storage triggers via the `google.storage.object.finalize` event type, which fires when a new object is created in the specified bucket. This is the simplest and most reliable approach, as it eliminates the need for intermediate services and ensures low-latency, event-driven invocation directly from the storage layer.

Answer

Use a Pub/Sub topic and a push subscription to invoke the Cloud Function

Answer

Use a Compute Engine instance to watch the bucket and call the function

Answer

Set up a Cloud Scheduler job to periodically scan the bucket and invoke the function