Google ACE Configuring Access and Security Practice Test 2 — 15 Questions

Question 1

An engineer needs to grant a service account the ability to impersonate another service account when making API calls. Which IAM role should be assigned to the impersonating service account?

Accepted Answer

roles/iam.serviceAccountTokenCreator. roles/iam.serviceAccountTokenCreator grants the iam.serviceAccounts.getAccessToken permission (and related token-signing permissions) that let a principal, including a service account, impersonate another service account by minting short-lived OAuth2 access tokens for API calls. roles/iam.serviceAccountUser only grants iam.serviceAccounts.actAs, which allows attaching a service account to a resource, not directly obtaining credentials for API calls.

Answer

roles/iam.serviceAccountAdmin

Answer

roles/serviceusage.serviceUsageConsumer

Answer

roles/iam.serviceAccountUser

Question 2

A security team wants to enable audit logging for all Data Access (ADMIN_READ, DATA_READ, DATA_WRITE) on a specific Google Cloud project. They plan to use gcloud commands to configure this. What is the correct approach?

Accepted Answer

Use gcloud projects set-iam-policy to set the auditConfig on the project.. To enable audit logging for Data Access logs (ADMIN_READ, DATA_READ, DATA_WRITE) on a project, you must modify the project's IAM policy to include an auditConfig that specifies the log types. The command 'gcloud projects set-iam-policy' allows you to set the entire IAM policy, including auditConfigs, from a JSON file. This is the correct approach.

Answer

Use gcloud compute firewall-rules update to enable logging on firewall rules.

Answer

Use gcloud logging sinks to export data access logs to a BigQuery dataset.

Answer

Use gcloud services enable to enable the Cloud Audit Logs API.

Question 3

A company wants to use Customer-Managed Encryption Keys (CMEK) for encrypting data in a Cloud Storage bucket. They have created a key in Cloud KMS. Which step is required when creating the bucket to use CMEK?

Accepted Answer

Specify the key using the --default-encryption-key flag in gsutil mb.. To enable CMEK on a Cloud Storage bucket, you must specify the Cloud KMS key at bucket creation time using the --default-encryption-key flag in gsutil mb (or the equivalent --default-encryption-key in gcloud storage buckets create). This sets the bucket's default KMS key so all objects written to it are encrypted with the customer-managed key.

Answer

Use the --encryption-key flag in gcloud compute instances create.

Answer

No additional steps; Cloud Storage automatically uses CMEK if a key exists in the project.

Answer

Enable CMEK by setting the bucket's IAM policy.

Question 4

A developer created a service account for an application running on a Compute Engine instance. The instance was started without specifying the service account. What must the developer do to make the application use the service account?

Accepted Answer

Stop the instance, update it with the --service-account flag using gcloud compute instances set-service-account, then start it.. A Compute Engine instance's service account is set at instance creation and cannot be changed while the instance is running. To attach a service account to an existing instance, the developer must stop the instance, use gcloud compute instances set-service-account (or the equivalent API) to update it, then start the instance again. This is the supported method for retrofitting a service account.

Answer

Use gcloud iam service-accounts add-iam-policy-binding to grant the instance access.

Answer

Use gcloud compute instances add-iam-policy-binding to assign the service account to the instance.

Answer

Create a new instance with the service account and migrate the application.

Question 5

An organization requires that all Compute Engine instances be created with a specific service account. Which organization policy can enforce this?

Accepted Answer

constraints/compute.setServiceAccount. The organization policy constraint constraints/compute.setServiceAccount restricts which service accounts can be assigned to Compute Engine instances, allowing administrators to enforce that all new VMs use a specific service account. This is the exact constraint designed for controlling service account assignment at the organization level. It ensures compliance by denying instance creation if a different service account is specified.

Answer

constraints/compute.vmExternalIpAccess

Answer

constraints/iam.allowedPolicyMemberDomains

Answer

constraints/compute.restrictCreateOnFirewall

Question 6

A company needs to enable Private Google Access for a subnet in a VPC so that Compute Engine instances without external IPs can access Google APIs and services. Which two steps are required? (Choose TWO.)

Accepted Answer

Ensure the subnet has a default route (0.0.0.0/0) to the default internet gateway.. Private Google Access allows Compute Engine instances without external IPs to reach Google APIs and services using internal IP addresses. Two requirements must be met: (1) Enable Private Google Access on the subnet using the '--enable-private-ip-google-access' flag (option E). (2) Ensure the subnet has a default route (0.0.0.0/0) to the default internet gateway (option D) so that traffic can be routed appropriately. Cloud NAT (option A) is not required because traffic to Google APIs uses internal addressing through Private Google Access; Cloud NAT would only be necessary for outbound internet access to non-Google destinations, which is not the scope of this scenario.

Answer

Create a Cloud NAT gateway.

Answer

Add a firewall rule allowing egress to 0.0.0.0/0.

Answer

Assign the instances a network tag.

Question 7

A security engineer wants to audit all actions that modify VPC firewall rules in their project. They need to enable the appropriate audit logs. Which three steps should they take? (Choose THREE.)

Accepted Answer

Ensure Admin Activity audit logs are enabled (default setting).. Modifying VPC firewall rules generates Admin Activity audit logs. These logs are *always enabled* by default in Google Cloud and cannot be disabled. Therefore, there are no 'steps to enable' them. The question's premise is fundamentally flawed.

If the question intends to ask about the overall process of *auditing* firewall rule changes (rather than 'enabling' logs), the relevant steps would typically include:
1.  **Understanding that Admin Activity logs capture these changes and are always enabled.** (Option B, rephrased, could fit as a verification/knowledge step).
2.  **Configuring log sinks** to export these logs to a long-term storage solution (e.g., Cloud Storage, BigQuery) or a security information and event management (SIEM) system for retention and advanced analysis. (Option A, rephrased to 'Configure a log sink at the project level to export Admin Activity logs', would fit as a configuration step for the *auditing solution*).
3.  **Querying and viewing the logs** in Logs Explorer or your chosen SIEM. (Option D is a correct query for viewing these logs).

Given the current options and the flawed premise of 'enabling' Admin Activity logs:
*   **A: Configure the audit configuration at the project level using IAM policy.** This option is primarily relevant for enabling Data Access logs, not Admin Activity logs. While IAM policies define permissions for managing logs or sinks, they don't 'enable' Admin Activity logs themselves.
*   **B: Ensure Admin Activity audit logs are enabled (default setting).** This is a verification of a default state, not an action to 'enable' something.
*   **D: View the firewall rule changes in the Logs Explorer using the query 'resource.type=gce_firewall_rule AND operation=write'.** This is a post-enabling/post-generation step, focused on viewing, not enabling.

To make this question valid, it would need to be rephrased to ask about *auditing* or *configuring log exports* for firewall changes, rather than *enabling* the logs themselves.

Answer

Configure the audit configuration at the project level using IAM policy.

Answer

Enable Data Access audit logs for the firewall service.

Answer

Use gcloud logging logs list to verify the log entries.

Question 8

A company needs to allow a group of external auditors to view Cloud Audit Logs for a project but not modify any resources. Which two steps should be taken? (Choose 2)

Accepted Answer

Create a log sink to forward logs to a bucket the auditors can access.. Granting the `roles/logging.viewer` role (C) allows auditors to view logs directly within the Cloud Logging interface for the project. Additionally, for external auditors who should not modify any resources, creating a log sink to export logs to a dedicated Cloud Storage bucket (B) and granting them `storage.objectViewer` on that bucket provides a secure and isolated way to access a complete copy of the logs for their analysis, without requiring direct access to the project's live environment.

Answer

Grant the auditors the roles/iam.securityReviewer role.

Answer

Grant the auditors the roles/logging.logWriter role.

Answer

Enable Data Access audit logs.

Question 9

An engineer needs to create a service account and grant it the ability to impersonate other service accounts. Which two permissions are required? (Choose 2)

Accepted Answer

iam.serviceAccounts.setIamPolicy. To create a service account, the `iam.serviceAccounts.create` permission (included in `roles/iam.serviceAccountAdmin`) is required. To grant the newly created service account the ability to impersonate *other* service accounts, the engineer needs `iam.serviceAccounts.setIamPolicy` on the target service accounts (or their parent project/folder/organization) to assign the `roles/iam.serviceAccountUser` role (which contains `iam.serviceAccounts.actAs`) to the new service account.

Answer

resourcemanager.projects.setIamPolicy

Answer

iam.serviceAccounts.getAccessToken

Answer

iam.serviceAccounts.actAs

Question 10

An engineer needs to grant a service account the ability to impersonate another service account when making API calls. Which IAM role should be assigned to the impersonating service account?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

roles/compute.instanceAdmin.v1. The role roles/compute.instanceAdmin.v1 grants permissions to manage Compute Engine instances, including starting and stopping them, but does not include permissions to delete instances or modify other resources like networks or IAM policies. This aligns with the principle of least privilege.

Answer

roles/compute.viewer

Answer

roles/compute.admin

Answer

roles/compute.osAdminLogin

Question 11

A company is migrating a legacy application to Compute Engine. The application requires access to a Cloud Storage bucket for storing logs. The application runs on a VM with a service account attached. Which TWO steps should the engineer take to grant the application access to the bucket?

Accepted Answer

Attach the service account to the Compute Engine instance at creation time using the --service-account flag.. The correct approach involves two steps: (C) Attach a service account to the Compute Engine instance using the --service-account flag at creation time (or later by stopping and modifying the instance). This allows the instance to authenticate as the service account automatically. (E) Grant the service account the 'Storage Object Admin' (or 'Storage Object Creator') role on the specific bucket using IAM. This provides the least-privilege access needed for the application to store logs. Options A and B are incorrect because they involve storing keys or secrets, which is insecure and unnecessary when using a service account attached to the instance. Option D is incorrect because granting the role at the project level is too broad and violates the principle of least privilege.

Answer

Store the bucket's access key and secret in instance metadata and have the application read them.

Answer

Download a service account key and store it securely on the VM, then configure the application to use the key.

Answer

Grant the service account the 'Storage Admin' role on the project.

Question 12

An organization has a VPC with several subnets. They want Compute Engine instances in one subnet to have outbound internet access for updates but not be reachable from the internet. The instances have no external IP addresses. Which THREE components must be configured?

Accepted Answer

Cloud Router. Cloud NAT allows outbound internet access for private instances. Cloud Router is required to manage NAT gateway routing. A firewall rule allowing egress traffic to the internet (e.g., to 0.0.0.0/0) is essential to permit the outbound connections initiated by the instances. The internet gateway is not needed because Cloud NAT provides the translation. Private Google Access is for Google APIs, not general internet.

Answer

Private Google Access enabled on the subnet

Answer

An internet gateway attached to the VPC

Question 13

A security engineer needs to ensure that all secrets stored in Secret Manager are encrypted with a customer-managed encryption key (CMEK). Which TWO actions are required?

Accepted Answer

Create a key ring and key in Cloud KMS.. To use CMEK with Secret Manager, you must create a key ring and key in Cloud KMS, and then use that key when creating or updating secrets by specifying the key name using the --kms-key flag. Additionally, the Secret Manager service account must be granted the 'Cloud KMS CryptoKey Encrypter/Decrypter' role on the key to be able to use it. Enabling CMEK at the project level is not a valid setting. The other options are incorrect or insufficient.

Answer

Enable CMEK for the project in the Secret Manager settings.

Answer

Enable automatic replication for the secret.

Question 14

A security team at an organization wants to enforce that all new Compute Engine instances in a project use Shielded VM features (Secure Boot, vTPM, and Integrity Monitoring) and that this requirement is enforced across the entire organization, regardless of who creates the instances. They also want to prevent project owners from disabling this requirement. Which approach should they take?

Accepted Answer

Create an organization policy constraint with compute.requireShieldedVm set to true and apply it at the organization level.. Organization Policy constraints provide centralized, hierarchical enforcement that project-level controls cannot match. Applying compute.requireShieldedVm at the organization level ensures all projects inherit the requirement and project owners cannot override it. IAM conditions and reactive functions do not prevent non-compliant instance creation, so the organization policy is the only approach that meets the preventive, organization-wide requirement.

Answer

Use a custom IAM role that includes compute.instances.create with a condition that checks for Shielded VM configuration.

Answer

Create a project-level organization policy constraint with compute.requireShieldedVm set to true in each project.

Answer

Create a Cloud Function triggered by Cloud Audit Logs that detects non-Shielded VM instances and stops them.

Question 15

A security team wants to enforce that all newly created service accounts in a project cannot be granted the Owner role, and they want to apply this restriction across the entire organization. They plan to use Organization Policy constraints. Which constraint should they enable?

Accepted Answer

constraints/iam.disableServiceAccountRoleGrant. The correct constraint is designed to block specific IAM roles from being granted to service accounts. By configuring it at the organization level, the policy applies to all projects and prevents the Owner role from being assigned to any service account. This enforces least privilege and reduces the risk of a compromised service account gaining full control over resources.

Answer

constraints/iam.disableServiceAccountKeyUpload

Answer

constraints/iam.disableServiceAccountKeyCreation

Answer

constraints/iam.allowedPolicyMemberDomains