Google ACE Configuring Access and Security — 25 Questions

Question 1

An engineer needs to grant an external auditor read-only access to a subset of Cloud Storage buckets in a project. The auditor's identity is a Google account. Which IAM approach should the engineer use?

Accepted Answer

Add the auditor's email as a member with the Storage Object Viewer role on the project, and use IAM Conditions to restrict access to specific bucket resources.. The best practice is to grant the Storage Object Viewer role at the project level and then use IAM Conditions to restrict access to specific bucket resources. This avoids managing multiple bindings per bucket while ensuring the auditor only sees the intended buckets. Granting at the bucket level is possible but less scalable; granting Storage Admin is too permissive; using ACLs is legacy and more complex to audit.

Answer

Add the auditor's email as a member with the Storage Admin role on the project.

Answer

Use a signed URL for each object the auditor needs to see.

Answer

Add the auditor's email as a member with the Storage Object Viewer role on each individual bucket.

Question 2

A security team wants to ensure that all Compute Engine instances in a project automatically use a custom service account with minimal permissions. What must the engineer do when creating new instances?

Accepted Answer

Use gcloud compute instances create with the --service-account flag pointing to the custom service account.. When creating a Compute Engine instance, you can specify a custom service account using the --service-account flag. This attaches the service account to the instance and grants the associated IAM roles. The instance will use the custom service account instead of the default compute engine service account.

Answer

Create a custom role and assign it to the instance's service account through the instance metadata.

Answer

Set the project-wide default service account to the custom service account in the project settings.

Answer

Create a startup script that configures the instance to use the custom service account after boot.

Question 3

An engineer created a firewall rule to allow inbound HTTP traffic on port 80 from the internet to instances with the tag 'web-server'. However, after applying the rule, a test instance with the tag 'web-server' is still not reachable on port 80. What is a likely cause?

Accepted Answer

The instance does not have the 'web-server' network tag.. Firewall rules are stateful, meaning return traffic is automatically allowed, but only if the inbound connection is permitted. A common misconfiguration is that the rule targets the wrong network tag, the instance does not have the tag, or the rule is not applied to the correct VPC network. Another possible issue is a higher-priority deny rule blocking the traffic. However, the most direct cause is that the instance lacks the tag specified in the rule.

Answer

The firewall rule has a priority lower than 65535.

Answer

The instance is using a VPC with a custom subnet.

Answer

The firewall rule is denying outbound traffic.

Question 4

A company wants to use Cloud NAT to allow private instances in a VPC to send outbound traffic to the internet and to receive inbound responses. Which two resources must be configured to set up Cloud NAT?

Accepted Answer

Cloud Router and NAT gateway. Cloud NAT requires a Cloud Router (to manage dynamic routing and NAT IP allocation) and a NAT gateway (the actual NAT service). The Cloud Router is a separate resource that must be created in the same region as the NAT gateway. The NAT gateway configuration includes the Cloud Router name.

Answer

Cloud Router only

Answer

Cloud VPN and Cloud NAT

Answer

Cloud Interconnect and Cloud NAT

Question 5

An engineer needs to view the current IAM policy for a project in JSON format. Which gcloud command should they use?

Accepted Answer

gcloud projects get-iam-policy PROJECT_ID --format json. The gcloud projects get-iam-policy command retrieves the IAM policy for a project. The --format flag allows you to specify the output format, such as JSON. The other commands are for different purposes: set-iam-policy sets the policy, add-iam-policy-binding adds a binding, and describe-iam-policy does not exist.

Answer

gcloud iam projects describe-iam-policy PROJECT_ID --format json

Answer

gcloud projects add-iam-policy-binding PROJECT_ID --format json

Answer

gcloud projects set-iam-policy PROJECT_ID --format json

Question 6

A developer created a service account with the roles/storage.admin role and wants to use it from a Compute Engine instance without downloading a key file. What is the best practice?

Accepted Answer

Attach the service account to the instance using the --service-account flag when creating the instance.. The best practice is to attach the service account to the Compute Engine instance at creation time using the --service-account flag. This allows the instance to automatically obtain credentials via the metadata server, avoiding the need to download and manage a service account key file. Downloading keys should be avoided due to security risks.

Answer

Download the service account key and store it on the instance's persistent disk.

Answer

Use gcloud auth activate-service-account on the instance with the service account email.

Answer

Store the service account email in an instance metadata and use gcloud commands.

Question 7

Which Google Cloud service provides a managed, scalable, and secure way to store API keys, passwords, and certificates?

Accepted Answer

Secret Manager. Secret Manager is the correct service for storing secrets such as API keys, passwords, and certificates. It provides encryption, access control, and versioning. Cloud KMS is for managing encryption keys, Cloud IAM is for access management, and Cloud Storage is for object storage.

Answer

Cloud Key Management Service (Cloud KMS)

Answer

Cloud IAM

Answer

Cloud Storage

Question 8

A company has a VPC with a subnet that has Private Google Access enabled. They want their Compute Engine instances to access Google APIs and services through internal IP addresses. Which additional configuration is required?

Accepted Answer

No additional configuration is required.. Private Google Access on a subnet allows instances in that subnet to reach Google APIs and services using internal IP addresses. No additional configuration is needed if the instances are in that subnet. Cloud NAT is for outbound internet access, not for Google API access. Cloud VPN and Cloud Interconnect are for hybrid connectivity.

Answer

Configure Cloud NAT to enable access to Google APIs.

Answer

Set up Cloud VPN tunnels to Google APIs.

Answer

Create a VPC peering connection with the Google APIs VPC.

Question 9

An organization needs to audit all data access (read/write) to a Cloud Storage bucket for compliance. Which type of audit log should they enable?

Accepted Answer

Data Access audit logs. Data Access audit logs record who accessed what data, including read and write operations. Admin Activity logs record changes to configurations, not data access. To enable Data Access logs, they need to configure the audit policy at the organization, folder, or project level for the specific service (storage.googleapis.com).

Answer

System Event audit logs

Answer

Access Transparency logs

Answer

Admin Activity audit logs

Question 10

A company has a VPC with two subnets: subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). They want to allow traffic from instances in subnet-a to reach a specific instance in subnet-b only on TCP port 443. What is the most specific firewall rule to achieve this?

Accepted Answer

Create a rule with source range 10.0.1.0/24, allow tcp:443, and target tag 'https-server' applied to the specific instance.. Firewall rules can specify source ranges (IP addresses or CIDR blocks) and target tags or service accounts. The most specific rule would use the subnet-a CIDR block (10.0.1.0/24) as the source, allow TCP port 443, and target the specific instance using a target tag. Using a tag makes the rule apply only to instances with that tag, avoiding impact on other instances in subnet-b.

Answer

Create a rule with source tag 'subnet-a-instances', allow tcp:443, and target tag 'https-server'.

Answer

Create a rule with source range 0.0.0.0/0, allow tcp:443, and target the specific instance.

Answer

Create a rule with source range 10.0.1.0/24, allow tcp:443, and apply to all instances in subnet-b.

Question 11

An engineer wants to create a Google-managed SSL certificate for a domain and attach it to an HTTPS load balancer. Which gcloud command should they use to create the certificate?

Accepted Answer

gcloud compute ssl-certificates create --domains example.com. The gcloud compute ssl-certificates create command with the --domains flag creates a Google-managed SSL certificate. The other commands are for creating SSL policies, self-managed certificates, or target HTTPS proxies.

Answer

gcloud compute target-https-proxies create --ssl-certificates

Answer

gcloud compute ssl-policies create

Answer

gcloud compute ssl-certificates create --certificate example.crt --private-key example.key

Question 12

A team needs to create a new service account and grant it the roles/storage.objectViewer role on a project. Which two gcloud commands are required?

Accepted Answer

gcloud iam service-accounts create and gcloud projects add-iam-policy-binding. First, create the service account with gcloud iam service-accounts create. Then grant the role on the project using gcloud projects add-iam-policy-binding with the service account as member. The commands in other options are either missing steps or incorrect.

Answer

gcloud iam service-accounts create and gcloud iam service-accounts add-iam-policy-binding

Answer

gcloud projects add-iam-policy-binding only

Answer

gcloud iam service-accounts create and gcloud iam roles create

Question 13

A company wants to ensure that a Compute Engine instance can access only a specific Cloud Storage bucket and no other resources in the project. Which TWO steps should the engineer take? (Select 2 correct answers)

Accepted Answer

Attach the service account to the Compute Engine instance at creation.. To restrict an instance to a specific bucket, create a custom service account with the Storage Object Viewer role only on that bucket (via IAM binding on the bucket), then attach that service account to the instance. Granting role at project level is too broad. Using the default service account gives broader permissions.

Answer

Grant the roles/storage.admin role at the bucket level.

Answer

Grant the roles/storage.objectViewer role at the project level to the service account.

Answer

Use the default Compute Engine service account.

Question 14

Which THREE configurations are required to enable Private Google Access for Compute Engine instances in a custom VPC subnet? (Select 3 correct answers)

Accepted Answer

Create a subnet with the --enable-private-ip-google-access flag.. Private Google Access is enabled on a subnet. Instances in that subnet can reach Google APIs using internal IPs. It does not require Cloud NAT, Cloud VPN, or internet access. The three required elements are: a VPC network, a subnet with Private Google Access enabled, and instances in that subnet.

Answer

Create a Cloud Router to advertise routes to Google.

Answer

Configure Cloud NAT to route traffic to Google APIs.

Question 15

Which TWO of the following are valid ways to grant IAM roles to a service account for accessing a Cloud Storage bucket? (Select 2 correct answers)

Accepted Answer

Use gcloud storage buckets add-iam-policy-binding to grant the role directly on the bucket.. IAM roles can be granted at the bucket level using gcloud storage buckets add-iam-policy-binding (or gsutil iam ch) or at the project level which applies to all buckets in the project. The other options are incorrect: gcloud iam roles create creates a custom role definition, not a grant; gcloud iam service-accounts add-iam-policy-binding grants roles on the service account itself; and gcloud projects set-iam-policy replaces the entire policy, not a granular add.

Answer

Use gcloud projects set-iam-policy with a policy file that includes the binding.

Answer

Use gcloud iam roles create to assign the role to the service account.

Answer

Use gcloud iam service-accounts add-iam-policy-binding.

Question 16

An engineer needs to grant a user the ability to create and manage service accounts in a project, but not delete them. Which predefined IAM role should be assigned?

Accepted Answer

roles/iam.serviceAccountAdmin. The roles/iam.serviceAccountAdmin role grants permissions to create, update, and manage service accounts, but not delete them. roles/iam.serviceAccountUser allows using service accounts but not creating them. roles/iam.serviceAccountCreator is not a predefined role. roles/iam.serviceAccountDeleter does not exist.

Answer

roles/iam.serviceAccountDeleter

Answer

roles/iam.serviceAccountCreator

Answer

roles/iam.serviceAccountUser

Question 17

You want to allow HTTP traffic from the internet to a set of Compute Engine instances tagged 'web-server'. Which gcloud command creates the appropriate firewall rule?

Accepted Answer

gcloud compute firewall-rules create allow-http --allow tcp:80 --source-ranges 0.0.0.0/0 --target-tags web-server. The command uses gcloud compute firewall-rules create with --allow tcp:80, --source-ranges 0.0.0.0/0, and --target-tags web-server to allow HTTP traffic from anywhere to instances with that tag.

Answer

gcloud compute firewall-rules create allow-http --allow tcp:80 --source-tags web-server --target-ranges 0.0.0.0/0

Answer

gcloud compute firewall-rules create allow-http --allow tcp:80 --source-ranges 0.0.0.0/0 --target-tags default

Answer

gcloud compute firewall-rules create allow-http --allow http --source-ranges 0.0.0.0/0 --target-tags web-server

Question 18

A security team wants to audit all Data Access attempts in a project for a specific Cloud Storage bucket, including who accessed which object and when. Which configuration is required?

Accepted Answer

Enable Data Access audit logs for Cloud Storage in the project's IAM audit config. Data Access audit logs must be enabled for Cloud Storage at the project level via IAM audit config. Admin Activity logs are always enabled but only record configuration changes, not data access. VPC Flow Logs record network metadata, not object-level access. Cloud Monitoring does not provide audit logs.

Answer

Configure VPC Flow Logs on the VPC network

Answer

Set up Cloud Monitoring alerts on the bucket

Answer

Enable Admin Activity audit logs for Cloud Storage in the project

Question 19

You need to create a service account for a Compute Engine instance to allow it to access Cloud Storage objects. The service account should have minimal permissions. What is the recommended approach?

Accepted Answer

Create a service account, grant it the required roles, and specify it when creating the instance using the --service-account flag. Create a service account with only the necessary roles (e.g., roles/storage.objectViewer) and attach it to the instance at creation time. Avoid downloading service account keys; use instance metadata-based credentials instead.

Answer

Create a service account and assign it to the instance using gcloud compute instances set-service-account after creation

Answer

Use the default compute engine service account and grant it roles/storage.objectAdmin

Answer

Create a service account, download a JSON key, and store it on the instance's local disk

Question 20

An organization has multiple projects under a folder. They want to grant a network admin the ability to create firewall rules in all projects in the folder. Which IAM policy binding achieves this with least privilege?

Accepted Answer

Grant roles/compute.securityAdmin at the folder level. Grant the roles/compute.securityAdmin role at the folder level. This allows managing firewall rules across all projects under that folder. Granting at project level would require adding the role to each project individually. The compute.networkAdmin role does not include firewall rule management.

Answer

Grant roles/owner at the folder level

Answer

Grant roles/compute.admin at the project level for each project

Answer

Grant roles/compute.networkAdmin at the folder level