Google ACE Configuring Access and Security Practice Test 3 — 15 Questions

Question 1

A financial institution needs to ensure that all data written to Cloud Storage buckets in a specific project is encrypted with a customer-managed encryption key (CMEK) that they control. They want to enforce this automatically for any new bucket created in the project. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an Organization Policy constraint to require CMEK for all Cloud Storage buckets in the project.. The Organization Policy constraint constraints/gcp.restrictNonCmekServices allows administrators to specify which services must use CMEK. By applying this constraint to the project and listing Cloud Storage, any attempt to create a bucket without CMEK will be denied. This provides automatic enforcement for new buckets and ensures compliance with the financial institution's requirement.

Answer

Apply a bucket-level IAM policy that requires the use of CMEK for all objects.

Answer

Enable default encryption with Google-managed keys and rotate them regularly.

Answer

Create a Cloud KMS key and manually configure each bucket to use it.

Question 2

A security team wants to ensure that all Compute Engine instances in a project automatically use a custom service account with minimal permissions. What must the engineer do when creating new instances?

Accepted Answer

Use gcloud compute instances create with the --service-account flag pointing to the custom service account.. The --service-account flag on gcloud compute instances create explicitly attaches the specified custom service account to the new instance at creation time, ensuring the VM uses minimal-permission credentials instead of the default Compute Engine service account. This is the correct declarative way to enforce per-instance identity in GCP.

Answer

Create a custom role and assign it to the instance's service account through the instance metadata.

Answer

Set the project-wide default service account to the custom service account in the project settings.

Answer

Create a startup script that configures the instance to use the custom service account after boot.

Question 3

An engineer needs to view the current IAM policy for a project in JSON format. Which gcloud command should they use?

Accepted Answer

gcloud projects get-iam-policy PROJECT_ID --format json. The `gcloud projects get-iam-policy` command retrieves the IAM policy attached to a project and returns it in the requested format. Adding `--format json` outputs the policy as a JSON document, which is exactly what the engineer needs. This is the standard read-only command for inspecting project-level IAM bindings.

Answer

gcloud iam projects describe-iam-policy PROJECT_ID --format json

Answer

gcloud projects add-iam-policy-binding PROJECT_ID --format json

Answer

gcloud projects set-iam-policy PROJECT_ID --format json

Question 4

A developer created a service account with the roles/storage.admin role and wants to use it from a Compute Engine instance without downloading a key file. What is the best practice?

Accepted Answer

Attach the service account to the instance using the --service-account flag when creating the instance.. The best practice is to attach the service account to the Compute Engine instance at creation time using the --service-account flag. This allows the instance to automatically obtain credentials via the metadata server, avoiding the need to download and manage a service account key file. Downloading keys should be avoided due to security risks.

Answer

Download the service account key and store it on the instance's persistent disk.

Answer

Use gcloud auth activate-service-account on the instance with the service account email.

Answer

Store the service account email in an instance metadata and use gcloud commands.

Question 5

Which Google Cloud service provides a managed, scalable, and secure way to store API keys, passwords, and certificates?

Accepted Answer

Secret Manager. Secret Manager is a fully managed Google Cloud service designed specifically for storing, managing, and accessing sensitive data such as API keys, passwords, and certificates. It provides versioning, fine-grained IAM access control, automatic replication, and audit logging, making it the ideal choice for secret storage. Unlike Cloud KMS, which manages encryption keys, Secret Manager stores the secrets themselves. Cloud IAM handles identity and access management, not secret storage, and Cloud Storage is a general object store not optimized for secrets.

Answer

Cloud Key Management Service (Cloud KMS)

Answer

Cloud IAM

Answer

Cloud Storage

Question 6

A company has a VPC with a subnet that has Private Google Access enabled. They want their Compute Engine instances to access Google APIs and services through internal IP addresses. Which additional configuration is required?

Accepted Answer

No additional configuration is required.. Private Google Access allows Compute Engine instances with only internal IP addresses to reach Google APIs and services (such as Cloud Storage, BigQuery, and Pub/Sub) using internal IP addresses, without requiring an external IP or Cloud NAT. Once the subnet-level setting is enabled, no additional routing, NAT, or peering configuration is needed because Google APIs are reachable via the default route to the private Google access VIP (199.36.153.8/30 or the restricted.googleapis.com VIPs).

Answer

Configure Cloud NAT to enable access to Google APIs.

Answer

Set up Cloud VPN tunnels to Google APIs.

Answer

Create a VPC peering connection with the Google APIs VPC.

Question 7

An organization needs to audit all data access (read/write) to a Cloud Storage bucket for compliance. Which type of audit log should they enable?

Accepted Answer

Data Access audit logs. Data Access audit logs record read and write operations on user data, including Cloud Storage object reads (e.g., storage.objects.get) and writes (e.g., storage.objects.create). They are specifically designed for auditing data access, unlike Admin Activity logs which capture configuration changes. Therefore, to audit all data access to a bucket, Data Access audit logs must be enabled.

Answer

System Event audit logs

Answer

Access Transparency logs

Answer

Admin Activity audit logs

Question 8

An engineer wants to create a Google-managed SSL certificate for a domain and attach it to an HTTPS load balancer. Which gcloud command should they use to create the certificate?

Accepted Answer

gcloud compute ssl-certificates create --domains example.com. The gcloud command 'gcloud compute ssl-certificates create --domains example.com' creates a Google-managed SSL certificate, which is automatically provisioned and renewed by Google Cloud. The --domains flag specifies the domain names for which the certificate should be issued, and Google handles the certificate lifecycle without requiring the user to provide a private key or certificate file. This is the correct command for creating a Google-managed certificate to attach to an HTTPS load balancer.

Answer

gcloud compute target-https-proxies create --ssl-certificates

Answer

gcloud compute ssl-policies create

Answer

gcloud compute ssl-certificates create --certificate example.crt --private-key example.key

Question 9

Which THREE configurations are required to enable Private Google Access for Compute Engine instances in a custom VPC subnet? (Select 3 correct answers)

Accepted Answer

Create a subnet with the --enable-private-ip-google-access flag.. Private Google Access is enabled on a subnet. Instances in that subnet can reach Google APIs using internal IPs. It does not require Cloud NAT, Cloud VPN, or internet access. The three required elements are: a VPC network, a subnet with Private Google Access enabled, and instances in that subnet.

Answer

Create a Cloud Router to advertise routes to Google.

Answer

Configure Cloud NAT to route traffic to Google APIs.

Question 10

A security team wants to audit all Data Access attempts in a project for a specific Cloud Storage bucket, including who accessed which object and when. Which configuration is required?

Accepted Answer

Enable Data Access audit logs for Cloud Storage in the project's IAM audit config. To audit data access attempts on a Cloud Storage bucket, including who accessed which object and when, you must enable Data Access audit logs for Cloud Storage in the project's IAM audit configuration. Data Access logs record read and write operations on objects, whereas Admin Activity logs only record configuration changes. Enabling Data Access logs at the project level ensures all bucket access is captured.

Answer

Configure VPC Flow Logs on the VPC network

Answer

Set up Cloud Monitoring alerts on the bucket

Answer

Enable Admin Activity audit logs for Cloud Storage in the project

Question 11

You need to create a service account for a Compute Engine instance to allow it to access Cloud Storage objects. The service account should have minimal permissions. What is the recommended approach?

Accepted Answer

Create a service account, grant it the required roles, and specify it when creating the instance using the --service-account flag. The recommended approach is to create a dedicated service account, grant it only the required roles (e.g., roles/storage.objectViewer for read access), and attach it to the instance at creation time using the --service-account flag. This ensures the instance uses the least-privilege identity from the start and avoids the risks of default accounts or downloaded keys.

Answer

Create a service account and assign it to the instance using gcloud compute instances set-service-account after creation

Answer

Use the default compute engine service account and grant it roles/storage.objectAdmin

Answer

Create a service account, download a JSON key, and store it on the instance's local disk

Question 12

An organization has multiple projects under a folder. They want to grant a network admin the ability to create firewall rules in all projects in the folder. Which IAM policy binding achieves this with least privilege?

Accepted Answer

Grant roles/compute.securityAdmin at the folder level. Grant the roles/compute.securityAdmin role at the folder level. This allows managing firewall rules across all projects under that folder. Granting at project level would require adding the role to each project individually. The compute.networkAdmin role does not include firewall rule management.

Answer

Grant roles/owner at the folder level

Answer

Grant roles/compute.admin at the project level for each project

Answer

Grant roles/compute.networkAdmin at the folder level

Question 13

You are configuring a Cloud NAT to allow private Compute Engine instances to access the internet for updates. What other resource is required to set up Cloud NAT?

Accepted Answer

A Cloud Router. Cloud NAT requires a Cloud Router to provide the control plane for NAT translation. The Cloud Router is used to program the NAT gateway with translation rules and to manage the IP addresses used for NAT. Without a Cloud Router, you cannot configure Cloud NAT.

Answer

A Cloud VPN tunnel

Answer

An interconnect attachment

Answer

A VPC peering connection

Question 14

To meet compliance requirements, a company must encrypt all data at rest in Cloud SQL using customer-managed encryption keys (CMEK). What is required to enable CMEK on a Cloud SQL instance?

Accepted Answer

Specify the key during instance creation using --disk-encryption-key, and ensure the Cloud SQL service account has encryption/decryption permissions on the key. CMEK on Cloud SQL requires the key to be specified at instance creation time via the --disk-encryption-key flag (or the equivalent API/console field), and the Cloud SQL service account for the project must be granted roles/cloudkms.cryptoKeyEncrypterDecrypter on the key. Without both, the instance creation fails or falls back to Google-managed encryption.

Answer

Create the instance without encryption, then use gcloud sql instances patch to add CMEK later

Answer

Enable CMEK by setting an organization policy that requires CMEK for all Cloud SQL instances

Answer

Use the default encryption; CMEK is not supported for Cloud SQL

Question 15

An engineer created a VPC with a subnet in us-central1 and enabled Private Google Access on that subnet. Compute Engine instances in that subnet can reach Google APIs and services using internal IPs. However, the instances cannot reach external IP addresses on the internet. What should the engineer configure to allow internet access while minimizing cost and management overhead?

Accepted Answer

Create a Cloud NAT gateway using a Cloud Router. Cloud NAT on a Cloud Router provides managed, outbound-only internet access for instances with internal IPs, without assigning external IPs or running a NAT VM. It integrates with the VPC and scales automatically, minimizing cost and operational overhead. Private Google Access can remain enabled alongside Cloud NAT.

Answer

Disable Private Google Access and assign external IPs to the instances

Answer

Add a NAT instance (a Compute Engine VM configured as a NAT gateway)

Answer

Create a Cloud VPN tunnel to a third-party NAT service