Google ACE Configuring Access and Security Practice Test 2 — 15 Questions

Question 1

An organization has a VPC with several subnets. They want Compute Engine instances in one subnet to have outbound internet access for updates but not be reachable from the internet. The instances have no external IP addresses. Which THREE components must be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Router. Cloud NAT allows outbound internet access for private instances. Cloud Router is required to manage NAT gateway routing. A firewall rule allowing egress traffic to the internet (e.g., to 0.0.0.0/0) is essential to permit the outbound connections initiated by the instances. The internet gateway is not needed because Cloud NAT provides the translation. Private Google Access is for Google APIs, not general internet.

Answer

Private Google Access enabled on the subnet

Answer

An internet gateway attached to the VPC

Question 2

A security engineer needs to ensure that all secrets stored in Secret Manager are encrypted with a customer-managed encryption key (CMEK). Which TWO actions are required?

Accepted Answer

Create a key ring and key in Cloud KMS.. To use CMEK with Secret Manager, you must create a key ring and key in Cloud KMS, and then use that key when creating or updating secrets by specifying the key name using the --kms-key flag. Additionally, the Secret Manager service account must be granted the 'Cloud KMS CryptoKey Encrypter/Decrypter' role on the key to be able to use it. Enabling CMEK at the project level is not a valid setting. The other options are incorrect or insufficient.

Answer

Enable CMEK for the project in the Secret Manager settings.

Answer

Enable automatic replication for the secret.

Question 3

An engineer needs to grant an external auditor read-only access to a subset of Cloud Storage buckets in a project. The auditor's identity is a Google account. Which IAM approach should the engineer use?

Accepted Answer

Add the auditor's email as a member with the Storage Object Viewer role on the project, and use IAM Conditions to restrict access to specific bucket resources.. The best practice is to grant the Storage Object Viewer role at the project level and then use IAM Conditions to restrict access to specific bucket resources. This avoids managing multiple bindings per bucket while ensuring the auditor only sees the intended buckets. Granting at the bucket level is possible but less scalable; granting Storage Admin is too permissive; using ACLs is legacy and more complex to audit.

Answer

Add the auditor's email as a member with the Storage Admin role on the project.

Answer

Use a signed URL for each object the auditor needs to see.

Answer

Add the auditor's email as a member with the Storage Object Viewer role on each individual bucket.

Question 4

A security team wants to ensure that all Compute Engine instances in a project automatically use a custom service account with minimal permissions. What must the engineer do when creating new instances?

Accepted Answer

Use gcloud compute instances create with the --service-account flag pointing to the custom service account.. When creating a Compute Engine instance, you can specify a custom service account using the --service-account flag. This attaches the service account to the instance and grants the associated IAM roles. The instance will use the custom service account instead of the default compute engine service account.

Answer

Create a custom role and assign it to the instance's service account through the instance metadata.

Answer

Set the project-wide default service account to the custom service account in the project settings.

Answer

Create a startup script that configures the instance to use the custom service account after boot.

Question 5

A company wants to use Cloud NAT to allow private instances in a VPC to send outbound traffic to the internet and to receive inbound responses. Which two resources must be configured to set up Cloud NAT?

Accepted Answer

Cloud Router and NAT gateway. Cloud NAT requires a Cloud Router (to manage dynamic routing and NAT IP allocation) and a NAT gateway (the actual NAT service). The Cloud Router is a separate resource that must be created in the same region as the NAT gateway. The NAT gateway configuration includes the Cloud Router name.

Answer

Cloud Router only

Answer

Cloud VPN and Cloud NAT

Answer

Cloud Interconnect and Cloud NAT

Question 6

An engineer needs to view the current IAM policy for a project in JSON format. Which gcloud command should they use?

Accepted Answer

gcloud projects get-iam-policy PROJECT_ID --format json. The gcloud projects get-iam-policy command retrieves the IAM policy for a project. The --format flag allows you to specify the output format, such as JSON. The other commands are for different purposes: set-iam-policy sets the policy, add-iam-policy-binding adds a binding, and describe-iam-policy does not exist.

Answer

gcloud iam projects describe-iam-policy PROJECT_ID --format json

Answer

gcloud projects add-iam-policy-binding PROJECT_ID --format json

Answer

gcloud projects set-iam-policy PROJECT_ID --format json

Question 7

A developer created a service account with the roles/storage.admin role and wants to use it from a Compute Engine instance without downloading a key file. What is the best practice?

Accepted Answer

Attach the service account to the instance using the --service-account flag when creating the instance.. The best practice is to attach the service account to the Compute Engine instance at creation time using the --service-account flag. This allows the instance to automatically obtain credentials via the metadata server, avoiding the need to download and manage a service account key file. Downloading keys should be avoided due to security risks.

Answer

Download the service account key and store it on the instance's persistent disk.

Answer

Use gcloud auth activate-service-account on the instance with the service account email.

Answer

Store the service account email in an instance metadata and use gcloud commands.

Question 8

Which Google Cloud service provides a managed, scalable, and secure way to store API keys, passwords, and certificates?

Accepted Answer

Secret Manager. Secret Manager is the correct service for storing secrets such as API keys, passwords, and certificates. It provides encryption, access control, and versioning. Cloud KMS is for managing encryption keys, Cloud IAM is for access management, and Cloud Storage is for object storage.

Answer

Cloud Key Management Service (Cloud KMS)

Answer

Cloud IAM

Answer

Cloud Storage

Question 9

A company has a VPC with a subnet that has Private Google Access enabled. They want their Compute Engine instances to access Google APIs and services through internal IP addresses. Which additional configuration is required?

Accepted Answer

No additional configuration is required.. Private Google Access on a subnet allows instances in that subnet to reach Google APIs and services using internal IP addresses. No additional configuration is needed if the instances are in that subnet. Cloud NAT is for outbound internet access, not for Google API access. Cloud VPN and Cloud Interconnect are for hybrid connectivity.

Answer

Configure Cloud NAT to enable access to Google APIs.

Answer

Set up Cloud VPN tunnels to Google APIs.

Answer

Create a VPC peering connection with the Google APIs VPC.

Question 10

An organization needs to audit all data access (read/write) to a Cloud Storage bucket for compliance. Which type of audit log should they enable?

Accepted Answer

Data Access audit logs. Data Access audit logs record who accessed what data, including read and write operations. Admin Activity logs record changes to configurations, not data access. To enable Data Access logs, they need to configure the audit policy at the organization, folder, or project level for the specific service (storage.googleapis.com).

Answer

System Event audit logs

Answer

Access Transparency logs

Answer

Admin Activity audit logs

Question 11

A company has a VPC with two subnets: subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). They want to allow traffic from instances in subnet-a to reach a specific instance in subnet-b only on TCP port 443. What is the most specific firewall rule to achieve this?

Accepted Answer

Create a rule with source range 10.0.1.0/24, allow tcp:443, and target tag 'https-server' applied to the specific instance.. Firewall rules can specify source ranges (IP addresses or CIDR blocks) and target tags or service accounts. The most specific rule would use the subnet-a CIDR block (10.0.1.0/24) as the source, allow TCP port 443, and target the specific instance using a target tag. Using a tag makes the rule apply only to instances with that tag, avoiding impact on other instances in subnet-b.

Answer

Create a rule with source tag 'subnet-a-instances', allow tcp:443, and target tag 'https-server'.

Answer

Create a rule with source range 0.0.0.0/0, allow tcp:443, and target the specific instance.

Answer

Create a rule with source range 10.0.1.0/24, allow tcp:443, and apply to all instances in subnet-b.

Question 12

An engineer wants to create a Google-managed SSL certificate for a domain and attach it to an HTTPS load balancer. Which gcloud command should they use to create the certificate?

Accepted Answer

gcloud compute ssl-certificates create --domains example.com. The gcloud compute ssl-certificates create command with the --domains flag creates a Google-managed SSL certificate. The other commands are for creating SSL policies, self-managed certificates, or target HTTPS proxies.

Answer

gcloud compute target-https-proxies create --ssl-certificates

Answer

gcloud compute ssl-policies create

Answer

gcloud compute ssl-certificates create --certificate example.crt --private-key example.key

Question 13

A team needs to create a new service account and grant it the roles/storage.objectViewer role on a project. Which two gcloud commands are required?

Accepted Answer

gcloud iam service-accounts create and gcloud projects add-iam-policy-binding. First, create the service account with gcloud iam service-accounts create. Then grant the role on the project using gcloud projects add-iam-policy-binding with the service account as member. The commands in other options are either missing steps or incorrect.

Answer

gcloud iam service-accounts create and gcloud iam service-accounts add-iam-policy-binding

Answer

gcloud projects add-iam-policy-binding only

Answer

gcloud iam service-accounts create and gcloud iam roles create

Question 14

A company wants to ensure that a Compute Engine instance can access only a specific Cloud Storage bucket and no other resources in the project. Which TWO steps should the engineer take? (Select 2 correct answers)

Accepted Answer

Attach the service account to the Compute Engine instance at creation.. To restrict an instance to a specific bucket, create a custom service account with the Storage Object Viewer role only on that bucket (via IAM binding on the bucket), then attach that service account to the instance. Granting role at project level is too broad. Using the default service account gives broader permissions.

Answer

Grant the roles/storage.admin role at the bucket level.

Answer

Grant the roles/storage.objectViewer role at the project level to the service account.

Answer

Use the default Compute Engine service account.

Question 15

Which THREE configurations are required to enable Private Google Access for Compute Engine instances in a custom VPC subnet? (Select 3 correct answers)

Accepted Answer

Create a subnet with the --enable-private-ip-google-access flag.. Private Google Access is enabled on a subnet. Instances in that subnet can reach Google APIs using internal IPs. It does not require Cloud NAT, Cloud VPN, or internet access. The three required elements are: a VPC network, a subnet with Private Google Access enabled, and instances in that subnet.

Answer

Create a Cloud Router to advertise routes to Google.

Answer

Configure Cloud NAT to route traffic to Google APIs.