Google ACE Configuring Access and Security — 20 Questions

Question 1

An engineer created a firewall rule to allow inbound HTTP traffic on port 80 from the internet to instances with the tag 'web-server'. However, after applying the rule, a test instance with the tag 'web-server' is still not reachable on port 80. What is a likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The instance does not have the 'web-server' network tag.. The explanation incorrectly asserts that the instance lacks the tag, contradicting the stem. A likely cause not listed would be a higher-priority deny rule or the rule being attached to the wrong VPC network.

Answer

The firewall rule has a priority lower than 65535.

Answer

The instance is using a VPC with a custom subnet.

Answer

The firewall rule is denying outbound traffic.

Question 2

An engineer needs to grant a user the ability to create and manage service accounts in a project, but not delete them. Which predefined IAM role should be assigned?

Accepted Answer

roles/iam.serviceAccountCreator. The roles/iam.serviceAccountCreator predefined role grants the permissions iam.serviceAccounts.create, iam.serviceAccounts.get, and iam.serviceAccounts.list. This allows a user to create service accounts and view them, but not delete them (since delete permission is not included). roles/iam.serviceAccountAdmin includes the delete permission, so it does not meet the requirement. roles/iam.serviceAccountDeleter does not exist as a predefined role. roles/iam.serviceAccountUser allows users to use service accounts but not create them.

Answer

roles/iam.serviceAccountAdmin

Answer

roles/iam.serviceAccountDeleter

Answer

roles/iam.serviceAccountUser

Question 3

You want to allow HTTP traffic from the internet to a set of Compute Engine instances tagged 'web-server'. Which gcloud command creates the appropriate firewall rule?

Accepted Answer

gcloud compute firewall-rules create allow-http --allow tcp:80 --source-ranges 0.0.0.0/0 --target-tags web-server. The command uses gcloud compute firewall-rules create with --allow tcp:80, --source-ranges 0.0.0.0/0, and --target-tags web-server to allow HTTP traffic from anywhere to instances with that tag.

Answer

gcloud compute firewall-rules create allow-http --allow tcp:80 --source-tags web-server --target-ranges 0.0.0.0/0

Answer

gcloud compute firewall-rules create allow-http --allow tcp:80 --source-ranges 0.0.0.0/0 --target-tags default

Question 4

A security team wants to ensure that all new projects in an organization automatically have Data Access audit logs enabled for all services. What is the most efficient way to achieve this?

Accepted Answer

Use the Organization Policy service to define a constraint that enables Data Access audit logs.. Using the Organization Policy service, you can configure audit log settings at the organization level. This configuration automatically applies to all new projects, ensuring Data Access audit logs are enabled without manual intervention. This is the most efficient method compared to per-project enablement or using Deployment Manager scripts.

Answer

Create a script using Deployment Manager to enable audit logs in all projects.

Answer

Enable Data Access audit logs in each project individually using gcloud logging.

Answer

Enable Admin Activity audit logs at the organization level, which automatically enables Data Access logs.

Question 5

A security team wants to ensure that all Compute Engine instances in a project are created with a specific custom service account attached. What is the most effective way to enforce this?

Accepted Answer

Configure an organization policy with the constraint `compute.setServiceAccount` to restrict the service accounts that can be used.. Organization policies with the `constraints/compute.restrictServiceAccounts` constraint are designed to enforce which service accounts can be attached to Compute Engine instances at the project, folder, or organization level. This ensures that all new instances are created with only the specified service accounts, directly addressing the requirement for project-wide enforcement. Other options do not provide this level of comprehensive and declarative enforcement for service accounts during instance creation.

Answer

Use a firewall rule to block instances without the required service account.

Answer

Enable Shielded VMs on the project.

Answer

Create a custom role with `compute.instances.create` and assign it to all users.

Question 6

You are creating a new service account for an application that needs to read from a Cloud Storage bucket and write to Cloud Pub/Sub. What is the most secure way to grant these permissions?

Accepted Answer

Create a custom role with storage.objects.get and pubsub.topics.publish, then grant it to the service account.. The principle of least privilege dictates granting only the specific permissions needed. A custom role with `storage.objects.get` and `pubsub.topics.publish` provides the most granular and restrictive set of permissions directly corresponding to the application's requirements: reading specific objects from Cloud Storage and publishing messages to Cloud Pub/Sub. Predefined roles like `roles/storage.objectViewer` include additional permissions (e.g., listing objects/buckets, getting IAM policies) that might not be strictly necessary for the stated task, making the custom role the most secure option by minimizing potential attack surface.

Answer

Grant the roles/storage.objectViewer and roles/pubsub.publisher roles to the service account.

Answer

Grant the roles/storage.admin and roles/pubsub.admin roles to the service account.

Answer

Grant the roles/editor role to the service account.

Question 7

You need to allow a Compute Engine instance to securely access a Cloud Storage bucket without managing service account keys. The instance already has a service account attached. What is the best practice to grant access?

Accepted Answer

Grant the necessary IAM roles to the service account attached to the instance.. The best practice is to grant the appropriate IAM role (e.g., Storage Object Viewer) to the service account attached to the instance. This avoids the need to download and manage service account keys.

Answer

Download a service account key file and store it on the instance.

Answer

Create a new service account and use its key on the instance.

Answer

Use the default compute engine service account and grant it Storage Admin.

Question 8

An organization is designing a VPC with multiple subnets. They want instances in a private subnet to access the internet for updates. They also need to allow SSH access from a bastion host. Which THREE components must they configure? (Choose 3 answers.)

Accepted Answer

Firewall rule allowing ingress tcp:22 from the bastion host's subnet. To allow outbound internet access from private instances, you need a Cloud NAT gateway. To allow inbound SSH from a bastion host, you need firewall rules allowing SSH from the bastion's IP range. The bastion host must have an external IP address to allow administrators to connect to it from the internet.

Answer

Cloud Router with BGP session

Answer

VPC peering with the internet

Question 9

A company wants to use Customer-Managed Encryption Keys (CMEK) for encrypting data in a Cloud Storage bucket. They have created a key in Cloud KMS. Which step is required when creating the bucket to use CMEK?

Accepted Answer

Specify the key using the --default-encryption-key flag in gsutil mb.. To use Customer-Managed Encryption Keys (CMEK) on a Cloud Storage bucket, you must specify the default encryption key when creating the bucket. This is done using the '--default-encryption-key' flag with 'gsutil mb' or 'gcloud storage buckets create'. Option A correctly uses this flag.

Answer

Use the --encryption-key flag in gcloud compute instances create.

Answer

No additional steps; Cloud Storage automatically uses CMEK if a key exists in the project.

Answer

Enable CMEK by setting the bucket's IAM policy.

Question 10

A company needs to enable Private Google Access for a subnet in a VPC so that Compute Engine instances without external IPs can access Google APIs and services. Which two steps are required? (Choose TWO.)

Accepted Answer

Ensure the subnet has a default route (0.0.0.0/0) to the default internet gateway.. Private Google Access allows Compute Engine instances without external IPs to reach Google APIs and services using internal IP addresses. Two requirements must be met: (1) Enable Private Google Access on the subnet using the '--enable-private-ip-google-access' flag (option E). (2) Ensure the subnet has a default route (0.0.0.0/0) to the default internet gateway (option D) so that traffic can be routed appropriately. Cloud NAT (option A) is not required because traffic to Google APIs uses internal addressing through Private Google Access; Cloud NAT would only be necessary for outbound internet access to non-Google destinations, which is not the scope of this scenario.

Answer

Create a Cloud NAT gateway.

Answer

Add a firewall rule allowing egress to 0.0.0.0/0.

Answer

Assign the instances a network tag.

Question 11

A security engineer wants to audit all actions that modify VPC firewall rules in their project. They need to enable the appropriate audit logs. Which three steps should they take? (Choose THREE.)

Accepted Answer

Ensure Admin Activity audit logs are enabled (default setting).. Modifying VPC firewall rules generates Admin Activity audit logs. These logs are *always enabled* by default in Google Cloud and cannot be disabled. Therefore, there are no 'steps to enable' them. The question's premise is fundamentally flawed.

If the question intends to ask about the overall process of *auditing* firewall rule changes (rather than 'enabling' logs), the relevant steps would typically include:
1.  **Understanding that Admin Activity logs capture these changes and are always enabled.** (Option B, rephrased, could fit as a verification/knowledge step).
2.  **Configuring log sinks** to export these logs to a long-term storage solution (e.g., Cloud Storage, BigQuery) or a security information and event management (SIEM) system for retention and advanced analysis. (Option A, rephrased to 'Configure a log sink at the project level to export Admin Activity logs', would fit as a configuration step for the *auditing solution*).
3.  **Querying and viewing the logs** in Logs Explorer or your chosen SIEM. (Option D is a correct query for viewing these logs).

Given the current options and the flawed premise of 'enabling' Admin Activity logs:
*   **A: Configure the audit configuration at the project level using IAM policy.** This option is primarily relevant for enabling Data Access logs, not Admin Activity logs. While IAM policies define permissions for managing logs or sinks, they don't 'enable' Admin Activity logs themselves.
*   **B: Ensure Admin Activity audit logs are enabled (default setting).** This is a verification of a default state, not an action to 'enable' something.
*   **D: View the firewall rule changes in the Logs Explorer using the query 'resource.type=gce_firewall_rule AND operation=write'.** This is a post-enabling/post-generation step, focused on viewing, not enabling.

To make this question valid, it would need to be rephrased to ask about *auditing* or *configuring log exports* for firewall changes, rather than *enabling* the logs themselves.

Answer

Configure the audit configuration at the project level using IAM policy.

Answer

Enable Data Access audit logs for the firewall service.

Answer

Use gcloud logging logs list to verify the log entries.

Question 12

A company needs to allow a group of external auditors to view Cloud Audit Logs for a project but not modify any resources. Which two steps should be taken? (Choose 2)

Accepted Answer

Create a log sink to forward logs to a bucket the auditors can access.. Granting the `roles/logging.viewer` role (C) allows auditors to view logs directly within the Cloud Logging interface for the project. Additionally, for external auditors who should not modify any resources, creating a log sink to export logs to a dedicated Cloud Storage bucket (B) and granting them `storage.objectViewer` on that bucket provides a secure and isolated way to access a complete copy of the logs for their analysis, without requiring direct access to the project's live environment.

Answer

Grant the auditors the roles/iam.securityReviewer role.

Answer

Grant the auditors the roles/logging.logWriter role.

Answer

Enable Data Access audit logs.

Question 13

An engineer needs to create a service account and grant it the ability to impersonate other service accounts. Which two permissions are required? (Choose 2)

Accepted Answer

iam.serviceAccounts.setIamPolicy. To create a service account, the `iam.serviceAccounts.create` permission (included in `roles/iam.serviceAccountAdmin`) is required. To grant the newly created service account the ability to impersonate *other* service accounts, the engineer needs `iam.serviceAccounts.setIamPolicy` on the target service accounts (or their parent project/folder/organization) to assign the `roles/iam.serviceAccountUser` role (which contains `iam.serviceAccounts.actAs`) to the new service account.

Answer

resourcemanager.projects.setIamPolicy

Answer

iam.serviceAccounts.getAccessToken

Answer

iam.serviceAccounts.actAs

Question 14

An engineer wants to allow HTTP traffic from the internet to a set of Compute Engine instances that have the network tag 'web-server'. Which firewall rule should they create?

Accepted Answer

gcloud compute firewall-rules create allow-http --allow tcp:80 --source-ranges 0.0.0.0/0 --target-tags web-server. The correct command (option D) creates an ingress firewall rule allowing TCP port 80 from any source IP (0.0.0.0/0) to instances with target tag 'web-server'. Options A and B incorrectly use --source-tags (which filters by source tag, not source IP), so they would allow traffic only if the source has the tag, not from the internet. Option C specifies egress direction, which is for outbound traffic, not inbound.

Answer

gcloud compute firewall-rules create allow-http --allow tcp:80 --source-tags web-server

Answer

gcloud compute firewall-rules create allow-http --allow tcp:80 --source-tags web-server --target-ranges 0.0.0.0/0

Answer

gcloud compute firewall-rules create allow-http --direction egress --allow tcp:80 --destination-ranges 0.0.0.0/0 --target-tags web-server

Question 15

A company is migrating a legacy application to Compute Engine. The application requires access to a Cloud Storage bucket for storing logs. The application runs on a VM with a service account attached. Which TWO steps should the engineer take to grant the application access to the bucket?

Accepted Answer

Attach the service account to the Compute Engine instance at creation time using the --service-account flag.. The correct approach involves two steps: (C) Attach a service account to the Compute Engine instance using the --service-account flag at creation time (or later by stopping and modifying the instance). This allows the instance to authenticate as the service account automatically. (E) Grant the service account the 'Storage Object Admin' (or 'Storage Object Creator') role on the specific bucket using IAM. This provides the least-privilege access needed for the application to store logs. Options A and B are incorrect because they involve storing keys or secrets, which is insecure and unnecessary when using a service account attached to the instance. Option D is incorrect because granting the role at the project level is too broad and violates the principle of least privilege.

Answer

Store the bucket's access key and secret in instance metadata and have the application read them.

Answer

Download a service account key and store it securely on the VM, then configure the application to use the key.

Answer

Grant the service account the 'Storage Admin' role on the project.

Question 16

An organization has a VPC with several subnets. They want Compute Engine instances in one subnet to have outbound internet access for updates but not be reachable from the internet. The instances have no external IP addresses. Which THREE components must be configured?

Accepted Answer

Cloud Router. Cloud NAT allows outbound internet access for private instances. Cloud Router is required to manage NAT gateway routing. A firewall rule allowing egress traffic to the internet (e.g., to 0.0.0.0/0) is essential to permit the outbound connections initiated by the instances. The internet gateway is not needed because Cloud NAT provides the translation. Private Google Access is for Google APIs, not general internet.

Answer

Private Google Access enabled on the subnet

Answer

An internet gateway attached to the VPC

Question 17

A security engineer needs to ensure that all secrets stored in Secret Manager are encrypted with a customer-managed encryption key (CMEK). Which TWO actions are required?

Accepted Answer

Create a key ring and key in Cloud KMS.. To use CMEK with Secret Manager, you must create a key ring and key in Cloud KMS, and then use that key when creating or updating secrets by specifying the key name using the --kms-key flag. Additionally, the Secret Manager service account must be granted the 'Cloud KMS CryptoKey Encrypter/Decrypter' role on the key to be able to use it. Enabling CMEK at the project level is not a valid setting. The other options are incorrect or insufficient.

Answer

Enable CMEK for the project in the Secret Manager settings.

Answer

Enable automatic replication for the secret.

Question 18

An engineer needs to grant an external auditor read-only access to a subset of Cloud Storage buckets in a project. The auditor's identity is a Google account. Which IAM approach should the engineer use?

Accepted Answer

Add the auditor's email as a member with the Storage Object Viewer role on the project, and use IAM Conditions to restrict access to specific bucket resources.. The best practice is to grant the Storage Object Viewer role at the project level and then use IAM Conditions to restrict access to specific bucket resources. This avoids managing multiple bindings per bucket while ensuring the auditor only sees the intended buckets. Granting at the bucket level is possible but less scalable; granting Storage Admin is too permissive; using ACLs is legacy and more complex to audit.

Answer

Add the auditor's email as a member with the Storage Admin role on the project.

Answer

Use a signed URL for each object the auditor needs to see.

Answer

Add the auditor's email as a member with the Storage Object Viewer role on each individual bucket.

Question 19

A security team wants to ensure that all Compute Engine instances in a project automatically use a custom service account with minimal permissions. What must the engineer do when creating new instances?

Accepted Answer

Use gcloud compute instances create with the --service-account flag pointing to the custom service account.. When creating a Compute Engine instance, you can specify a custom service account using the --service-account flag. This attaches the service account to the instance and grants the associated IAM roles. The instance will use the custom service account instead of the default compute engine service account.

Answer

Create a custom role and assign it to the instance's service account through the instance metadata.

Answer

Set the project-wide default service account to the custom service account in the project settings.

Answer

Create a startup script that configures the instance to use the custom service account after boot.

Question 20

A company wants to use Cloud NAT to allow private instances in a VPC to send outbound traffic to the internet and to receive inbound responses. Which two resources must be configured to set up Cloud NAT?

Accepted Answer

Cloud Router and NAT gateway. Cloud NAT requires a Cloud Router (to manage dynamic routing and NAT IP allocation) and a NAT gateway (the actual NAT service). The Cloud Router is a separate resource that must be created in the same region as the NAT gateway. The NAT gateway configuration includes the Cloud Router name.

Answer

Cloud Router only

Answer

Cloud VPN and Cloud NAT

Answer

Cloud Interconnect and Cloud NAT