Google ACE Practice Test 35 — 15 Questions

Question 1

An organization has a hierarchy: Organization -> Folder A -> Project 1. An IAM policy at the organization level grants roles/editor to user@example.com. A policy at Folder A denies roles/editor to the same user. What is the effective role for the user in Project 1?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user does not have the editor role in Project 1 because the deny policy at the folder level blocks it.. In Google Cloud IAM, deny policies take precedence over allow policies in the resource hierarchy. A deny policy at Folder A blocks the roles/editor grant even though the organization-level allow policy grants it, because the deny is evaluated first and overrides any inherited allow for that principal and permission. Therefore the user has no editor role in Project 1.

Answer

The user has the editor role only in resources directly under the organization, not under Folder A.

Answer

The user has the editor role because organization-level grants override folder-level denials.

Answer

The user has the editor role in Project 1 unless there is a specific project-level deny.

Question 2

What is the basic role that grants full control over all resources in a GCP project?

Accepted Answer

Owner. The Owner role (roles/owner) in Google Cloud Platform includes all Editor permissions plus the ability to manage roles and permissions for a project, and to set up billing. It provides full control over all resources in the project, including the ability to grant access to others. This is the most powerful basic role available at the project level.

Answer

Editor

Answer

Viewer

Answer

Admin

Question 3

You need to view the current IAM policy for a project named 'my-project' in JSON format. Which command should you use?

Accepted Answer

gcloud projects get-iam-policy my-project --format json. The `gcloud projects get-iam-policy` command retrieves the existing IAM policy bindings for a project and returns them in the requested format. Adding `--format json` outputs the policy as a JSON document, which is exactly what is needed to view the current policy. This is a read-only operation that does not modify any bindings.

Answer

gcloud projects add-iam-policy-binding my-project --format json

Answer

gcloud iam service-accounts list --project my-project

Answer

gcloud projects set-iam-policy my-project policy.json

Question 4

You are using Cloud Shell and need to access a file you created two weeks ago. What is the persistence behavior of Cloud Shell home directories?

Accepted Answer

Cloud Shell home directories persist across sessions, with 5 GB of storage.. Cloud Shell home directories are persistent across sessions and provide 5 GB of storage per user. This means files created in the home directory remain available even after the session ends, as long as the user's Cloud Shell environment is not deleted. The 5 GB limit is a key characteristic of Cloud Shell's persistent storage.

Answer

Cloud Shell home directories are stored in Cloud Storage and are always available.

Answer

Cloud Shell home directories persist for 30 days after last use.

Answer

Cloud Shell home directories are temporary and are deleted after each session.

Question 5

A Cloud Function needs to be triggered whenever a message is published to a Pub/Sub topic. Which 'gcloud functions deploy' command flag is required to set the trigger?

Accepted Answer

--trigger-topic. For a Cloud Function triggered by Pub/Sub messages, the required flag is --trigger-topic, which specifies the Pub/Sub topic name. This flag automatically wires the function as a subscriber to that topic and sets the correct event type.

Answer

--trigger-http

Answer

--trigger-event

Answer

--trigger-bucket

Question 6

An engineer needs to create a firewall rule that allows incoming HTTPS traffic only from a specific IP range to instances tagged 'web-server'. Which command should they use?

Accepted Answer

gcloud compute firewall-rules create allow-https --allow tcp:443 --source-ranges 192.168.0.0/16 --target-tags web-server. The correct command uses --allow tcp:443 to permit HTTPS, --source-ranges 192.168.0.0/16 to restrict the source IP range, and --target-tags web-server to apply the rule only to instances tagged 'web-server'. This matches all three requirements: protocol/port, source restriction, and target selection. The gcloud compute firewall-rules create syntax requires --allow with protocol:port and uses --target-tags (not --source-tags) to select destination instances.

Answer

gcloud compute firewall-rules create allow-https --allow tcp:443 --source-tags web-server

Answer

gcloud compute firewall-rules create allow-https --allow udp:443 --source-ranges 192.168.0.0/16 --target-tags web-server

Answer

gcloud compute firewall-rules create allow-https --allow tcp:443 --source-ranges 0.0.0.0/0 --target-tags web-server

Question 7

An engineer needs to enable the Compute Engine API for a project using the CLI. Which command should they run?

Accepted Answer

gcloud services enable compute.googleapis.com. The correct command to enable a Google Cloud API for a project using the CLI is 'gcloud services enable compute.googleapis.com'. This command uses the 'gcloud services' command group, which manages API enablement, and requires the full service name (e.g., compute.googleapis.com). This is the standard and documented way to enable APIs.

Answer

gcloud compute enable

Answer

gcloud services enable compute

Answer

gcloud api enable compute.googleapis.com

Question 8

A company has a Google Cloud organization with multiple folders and projects. The security team wants to audit all actions that create or modify IAM policies across the entire organization. Which type of audit log should they examine?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs in Google Cloud record all API calls that modify resource configurations, including IAM policy changes (e.g., setIamPolicy). They are enabled by default, cannot be disabled, and are the correct log type for auditing who created or modified IAM policies across the organization.

Answer

System Event audit logs

Answer

Data Access audit logs

Answer

VPC Flow Logs

Question 9

You need to add an IAM binding for a user to a project using the gcloud command. Which command should you use?

Accepted Answer

gcloud projects add-iam-policy-binding. The correct command to add an IAM binding for a user to a project is gcloud projects add-iam-policy-binding, which modifies the project's IAM policy by granting a role to a member. This command is the standard way to manage project-level IAM bindings using gcloud. It requires the project ID, the member (user, group, or service account), and the role.

Answer

gcloud iam service-accounts add-iam-policy-binding

Answer

gcloud projects set-iam-policy

Answer

gcloud iam roles update

Question 10

A security team wants to audit all Data Access attempts in a project for a specific Cloud Storage bucket, including who accessed which object and when. Which configuration is required?

Accepted Answer

Enable Data Access audit logs for Cloud Storage in the project's IAM audit config. To audit data access attempts on a Cloud Storage bucket, including who accessed which object and when, you must enable Data Access audit logs for Cloud Storage in the project's IAM audit configuration. Data Access logs record read and write operations on objects, whereas Admin Activity logs only record configuration changes. Enabling Data Access logs at the project level ensures all bucket access is captured.

Answer

Configure VPC Flow Logs on the VPC network

Answer

Set up Cloud Monitoring alerts on the bucket

Answer

Enable Admin Activity audit logs for Cloud Storage in the project

Question 11

You need to perform a rolling update of a GKE deployment and ensure that during the update, the new pods are ready before terminating the old ones. You have already set the update strategy to RollingUpdate. Which kubectl command sequence should you use to update the image and monitor the rollout?

Accepted Answer

kubectl set image deployment/myapp myapp=gcr.io/myproject/myapp:v2; kubectl rollout status deployment/myapp. `kubectl set image` updates the container image on the deployment, which triggers the RollingUpdate strategy to create new pods and only terminate old ones once the new pods pass readiness probes. `kubectl rollout status` then blocks and reports the progress of that rollout until it completes or fails. Together they satisfy both the update and monitoring requirements.

Answer

gcloud container clusters upgrade my-cluster; kubectl get deployments

Answer

kubectl edit deployment myapp; kubectl get pods; kubectl delete pod old-pod

Answer

kubectl apply -f deployment.yaml; kubectl rollout undo deployment/myapp

Question 12

A team is using Cloud Shell to manage resources. They notice that their home directory is persistent across sessions, but they want to ensure that configuration files and scripts are also available after they stop and restart Cloud Shell. What should they do?

Accepted Answer

Store files in the home directory (~). Cloud Shell provides a persistent 5 GB home directory ($HOME) that survives across sessions, so storing configuration files and scripts in ~ ensures they are available after stopping and restarting Cloud Shell. The home directory is backed by a persistent disk that is reattached to each new ephemeral VM instance. This is the simplest and intended mechanism for persistence.

Answer

Use gcloud config configurations and save scripts in a Cloud Storage bucket

Answer

Create a startup script that runs every time Cloud Shell starts

Answer

Store files in /tmp

Question 13

An organization wants to enforce that all projects under a specific folder have a set of constraints, such as disabling default network creation and requiring shielded VMs. What is the most efficient way to achieve this?

Accepted Answer

Apply organization policies at the folder level.. Organization policies in Google Cloud can be applied at the folder level, and they are inherited by all projects within that folder. This allows enforcing constraints like disabling default network creation and requiring shielded VMs across all projects efficiently. Applying at the folder level ensures consistent enforcement without per-project configuration.

Answer

Use Cloud Shell to run scripts in each project.

Answer

Create IAM roles to restrict default network creation.

Answer

Use a service account to enforce policies.

Question 14

Instead of granting IAM roles to 50 individual developer email addresses, a team wants to manage access by team membership. When a developer joins or leaves, access updates automatically. What is the recommended approach?

Accepted Answer

Grant IAM roles to a Google Group containing all team members. Google Groups act as identity containers that can be granted IAM roles at the project or resource level. When developers are added to or removed from the group, their IAM permissions automatically update without requiring manual role changes for each individual user. This aligns with the principle of least privilege and simplifies access management at scale.

Answer

Create a service account shared by all developers on the team

Answer

Create a GCP project per developer and use cross-project IAM bindings

Answer

Use Cloud Identity-Aware Proxy to manage team membership

Question 15

You are setting up a new organization in Google Cloud. You want to restrict the regions where resources can be created to comply with data residency requirements. What should you do?

Accepted Answer

Set an organization policy with a constraint on allowed resource locations. Organization policies in Google Cloud are the native mechanism for enforcing constraints across all projects in an organization, including resource location restrictions. The `constraints/gcp.resourceLocations` constraint (part of the Location Restriction constraint family) lets you define an allowlist of regions/zones where resources can be created, and it is enforced at the org, folder, or project level regardless of a user's IAM permissions. This directly satisfies data residency requirements because it blocks resource creation outside approved locations even for project owners.

Answer

Create a service account with limited permissions

Answer

Set a budget alert that notifies when resources are created outside allowed regions

Answer

Use IAM roles to restrict which users can create resources in specific regions