Google ACE Practice Test 33 — 15 Questions

Question 1

You have a Cloud Run service that experiences intermittent high latency. You want to analyze the latency of specific request paths to identify bottlenecks. You enable Cloud Trace and instrument your application with OpenTelemetry. Which tool or feature should you use to view a waterfall diagram of latencies across services for a single request?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Trace Trace List and Trace Details. Cloud Trace provides distributed tracing capabilities, including waterfall diagrams that show the latency of each span in a request. Cloud Logging shows logs, not trace details. Error Reporting aggregates errors. Metrics Explorer shows aggregated metrics, not per-request traces.

Answer

Error Reporting

Answer

Cloud Monitoring Metrics Explorer

Answer

Cloud Logging Logs Explorer

Question 2

Which Google Cloud service provides a managed, scalable, and secure way to store API keys, passwords, and certificates?

Accepted Answer

Secret Manager. Secret Manager is the correct service for storing secrets such as API keys, passwords, and certificates. It provides encryption, access control, and versioning. Cloud KMS is for managing encryption keys, Cloud IAM is for access management, and Cloud Storage is for object storage.

Answer

Cloud Key Management Service (Cloud KMS)

Answer

Cloud IAM

Answer

Cloud Storage

Question 3

An organization needs to audit all data access (read/write) to a Cloud Storage bucket for compliance. Which type of audit log should they enable?

Accepted Answer

Data Access audit logs. Data Access audit logs record who accessed what data, including read and write operations. Admin Activity logs record changes to configurations, not data access. To enable Data Access logs, they need to configure the audit policy at the organization, folder, or project level for the specific service (storage.googleapis.com).

Answer

System Event audit logs

Answer

Access Transparency logs

Answer

Admin Activity audit logs

Question 4

A team needs to create a new service account and grant it the roles/storage.objectViewer role on a project. Which two gcloud commands are required?

Accepted Answer

gcloud iam service-accounts create and gcloud projects add-iam-policy-binding. First, create the service account with gcloud iam service-accounts create. Then grant the role on the project using gcloud projects add-iam-policy-binding with the service account as member. The commands in other options are either missing steps or incorrect.

Answer

gcloud iam service-accounts create and gcloud iam service-accounts add-iam-policy-binding

Answer

gcloud projects add-iam-policy-binding only

Answer

gcloud iam service-accounts create and gcloud iam roles create

Question 5

An organization uses Organization Policies to restrict the use of certain IAM roles. The security team wants to audit all modifications to IAM policies across the organization, including at the project level. Which log type should be enabled and analyzed?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs record all modifications to IAM policies. Data Access logs record reads of data, not policy changes. To audit IAM policy changes, Admin Activity logs must be enabled and analyzed.

Answer

System Event audit logs

Answer

Data Access audit logs (READ)

Answer

Data Access audit logs (WRITE)

Question 6

A company wants to automate the rotation of encryption keys for Cloud Storage buckets every 30 days. Which key type should be used?

Accepted Answer

Customer-Managed Encryption Keys (CMEK). Customer-Managed Encryption Keys (CMEK) allow you to control the key lifecycle, including rotation. Google-Managed keys rotate automatically but you cannot schedule or force rotation. CSEK requires manual rotation. Key Access Justification is a feature of CMEK for access transparency.

Answer

Google-managed encryption keys

Answer

Key Access Justification

Answer

Customer-Supplied Encryption Keys (CSEK)

Question 7

A company has a Cloud SQL instance with CMEK enabled. The Cloud KMS key used for encryption is accidentally disabled. What is the impact on the Cloud SQL instance?

Accepted Answer

The instance becomes unavailable and cannot be started until the key is re-enabled.. When a CMEK key is disabled, the Cloud SQL instance becomes unavailable because the database cannot encrypt or decrypt data. The instance cannot be started or used until the key is re-enabled.

Answer

The instance will be automatically deleted after 30 days.

Answer

A read replica can be promoted to replace the primary.

Answer

The instance continues to operate normally, but new data cannot be encrypted.

Question 8

An engineer needs to grant a service account the ability to start and stop Compute Engine instances in a specific project. The service account should not have permissions to delete instances or modify other resources. Which IAM role should be assigned?

Accepted Answer

roles/compute.instanceAdmin.v1. The Compute Instance Admin (roles/compute.instanceAdmin.v1) role provides permissions to create, start, stop, and reset instances, but does not include delete permissions. The Compute Admin role is too broad, and Compute Viewer is read-only. Compute OS Admin Login is for OS login, not instance lifecycle.

Answer

roles/compute.viewer

Answer

roles/compute.admin

Answer

roles/compute.osAdminLogin

Question 9

Match each Google Kubernetes Engine (GKE) concept to its definition.

Accepted Answer

Pod: Smallest deployable unit that runs one or more containers.. In GKE, a Pod is the smallest unit, a Service provides stable network access to Pods, a Deployment manages Pod updates, and a Node is a worker machine. Common confusions involve swapping Pod and Service definitions.

Answer

Pod: An abstraction that defines a logical set of Pods and a policy to access them.

Answer

Service: Smallest deployable unit that runs one or more containers.

Question 10

A developer wants to create a service account for an application running on Compute Engine. The application needs to access Cloud Storage. What is the best practice for granting this access?

Accepted Answer

Create a service account, grant it the Cloud Storage roles, and attach it to the instance using the --service-account flag.. The best practice is to create a service account, grant it the necessary roles, and attach it to the Compute Engine instance using the '--service-account' flag. Downloading keys is discouraged. Workload Identity is for on-premises or non-GCP workloads.

Answer

Use Workload Identity Federation to grant access.

Answer

Use the default Compute Engine service account and grant it Cloud Storage roles.

Answer

Create a service account, download its key, and store it on the instance.

Question 11

A developer wants to store a database password securely and make it accessible to a Compute Engine instance. Which Google Cloud service should be used?

Accepted Answer

Secret Manager. Secret Manager is designed for storing secrets like passwords, API keys, and certificates. Cloud KMS is for encryption key management. Cloud Storage is not secure for secrets. Cloud Filestore is for file storage.

Answer

Cloud Storage

Answer

Cloud Filestore

Answer

Cloud KMS

Question 12

You want to view the current IAM policy for a project in JSON format using the gcloud command-line tool. Which command should you run?

Accepted Answer

gcloud projects get-iam-policy --format json. The correct command is `gcloud projects get-iam-policy --format json`. This retrieves the IAM policy and formats it as JSON.

Answer

gcloud iam service-accounts get-iam-policy <service-account> --format json

Answer

gcloud iam policies get <project-id> --format json

Answer

gcloud projects describe <project-id> --format json

Question 13

A security team wants to enable audit logging for all Data Access (ADMIN_READ, DATA_READ, DATA_WRITE) on a specific Google Cloud project. They plan to use gcloud commands to configure this. What is the correct approach?

Accepted Answer

Use gcloud projects set-iam-policy to set the auditConfig on the project.. Audit log configuration is set at the organization, folder, or project level using the 'gcloud projects get-iam-policy' and 'gcloud projects set-iam-policy' commands with audit configs. The correct method is to modify the IAM policy to include auditConfigs. The other options either use wrong commands or wrong scopes.

Answer

Use gcloud compute firewall-rules update to enable logging on firewall rules.

Answer

Use gcloud logging sinks to export data access logs to a BigQuery dataset.

Answer

Use gcloud services enable to enable the Cloud Audit Logs API.

Question 14

A company wants to use Customer-Managed Encryption Keys (CMEK) for a Cloud SQL instance. What must be done first?

Accepted Answer

Create a Cloud KMS key ring and key, and grant the Cloud SQL service account the cloudkms.cryptoKeyEncrypterDecrypter role.. CMEK requires a Cloud KMS key ring and key to be created, and the Cloud SQL service account must be granted the Encrypter/Decrypter role on that key.

Answer

Create a bucket and upload a key file.

Answer

Enable Cloud KMS API and use default encryption.

Answer

Set the --disk-encryption-key flag to an existing key in Cloud KMS.

Question 15

A company has an organization with multiple folders and projects. They want to audit all IAM policy changes across the entire organization. Which approach meets the requirement with minimal effort?

Accepted Answer

View Admin Activity audit logs in Logs Explorer, which are enabled by default.. Admin Activity audit logs capture all IAM policy changes by default and are enabled for all projects. Data Access audit logs do not capture IAM changes. Organization policies don't capture changes. Enabling logs per project would be more effort.

Answer

Use Organization Policy to deny IAM policy changes and monitor violations.

Answer

Enable Data Access audit logs for all services in the organization.

Answer

Enable audit logging on each project individually using gcloud logging sinks.