Google ACE Configuring Access and Security Practice Test 3 — 15 Questions

Question 1

Which TWO of the following are valid ways to grant IAM roles to a service account for accessing a Cloud Storage bucket? (Select 2 correct answers)

Accepted Answer

Use gcloud storage buckets add-iam-policy-binding to grant the role directly on the bucket.. IAM roles can be granted at the bucket level using gcloud storage buckets add-iam-policy-binding (or gsutil iam ch) or at the project level which applies to all buckets in the project. The other options are incorrect: gcloud iam roles create creates a custom role definition, not a grant; gcloud iam service-accounts add-iam-policy-binding grants roles on the service account itself; and gcloud projects set-iam-policy replaces the entire policy, not a granular add.

Answer

Use gcloud projects set-iam-policy with a policy file that includes the binding.

Answer

Use gcloud iam roles create to assign the role to the service account.

Answer

Use gcloud iam service-accounts add-iam-policy-binding.

Question 2

A security team wants to audit all Data Access attempts in a project for a specific Cloud Storage bucket, including who accessed which object and when. Which configuration is required?

Accepted Answer

Enable Data Access audit logs for Cloud Storage in the project's IAM audit config. Data Access audit logs must be enabled for Cloud Storage at the project level via IAM audit config. Admin Activity logs are always enabled but only record configuration changes, not data access. VPC Flow Logs record network metadata, not object-level access. Cloud Monitoring does not provide audit logs.

Answer

Configure VPC Flow Logs on the VPC network

Answer

Set up Cloud Monitoring alerts on the bucket

Answer

Enable Admin Activity audit logs for Cloud Storage in the project

Question 3

You need to create a service account for a Compute Engine instance to allow it to access Cloud Storage objects. The service account should have minimal permissions. What is the recommended approach?

Accepted Answer

Create a service account, grant it the required roles, and specify it when creating the instance using the --service-account flag. Create a service account with only the necessary roles (e.g., roles/storage.objectViewer) and attach it to the instance at creation time. Avoid downloading service account keys; use instance metadata-based credentials instead.

Answer

Create a service account and assign it to the instance using gcloud compute instances set-service-account after creation

Answer

Use the default compute engine service account and grant it roles/storage.objectAdmin

Answer

Create a service account, download a JSON key, and store it on the instance's local disk

Question 4

An organization has multiple projects under a folder. They want to grant a network admin the ability to create firewall rules in all projects in the folder. Which IAM policy binding achieves this with least privilege?

Accepted Answer

Grant roles/compute.securityAdmin at the folder level. Grant the roles/compute.securityAdmin role at the folder level. This allows managing firewall rules across all projects under that folder. Granting at project level would require adding the role to each project individually. The compute.networkAdmin role does not include firewall rule management.

Answer

Grant roles/owner at the folder level

Answer

Grant roles/compute.admin at the project level for each project

Answer

Grant roles/compute.networkAdmin at the folder level

Question 5

You are configuring a Cloud NAT to allow private Compute Engine instances to access the internet for updates. What other resource is required to set up Cloud NAT?

Accepted Answer

A Cloud Router. Cloud NAT requires a Cloud Router to manage dynamic routing and NAT configurations. The Cloud Router is created in the same region and VPC network as the NAT gateway.

Answer

A Cloud VPN tunnel

Answer

An interconnect attachment

Answer

A VPC peering connection

Question 6

To meet compliance requirements, a company must encrypt all data at rest in Cloud SQL using customer-managed encryption keys (CMEK). What is required to enable CMEK on a Cloud SQL instance?

Accepted Answer

Specify the key during instance creation using --disk-encryption-key, and ensure the Cloud SQL service account has encryption/decryption permissions on the key. When creating the Cloud SQL instance, you must specify a Cloud KMS key using the --disk-encryption-key flag. The Cloud SQL service account must be granted the Cloud KMS CryptoKey Encrypter/Decrypter role. The key must be in the same region as the Cloud SQL instance.

Answer

Create the instance without encryption, then use gcloud sql instances patch to add CMEK later

Answer

Enable CMEK by setting an organization policy that requires CMEK for all Cloud SQL instances

Answer

Use the default encryption; CMEK is not supported for Cloud SQL

Question 7

An engineer created a VPC with a subnet in us-central1 and enabled Private Google Access on that subnet. Compute Engine instances in that subnet can reach Google APIs and services using internal IPs. However, the instances cannot reach external IP addresses on the internet. What should the engineer configure to allow internet access while minimizing cost and management overhead?

Accepted Answer

Create a Cloud NAT gateway using a Cloud Router. Since the instances need to access the internet (not just Google APIs), a Cloud NAT is the appropriate solution. It allows outbound internet traffic from private instances without assigning external IPs. Private Google Access only covers Google APIs. A NAT gateway instance would be more expensive and require management. A VPN is unnecessary.

Answer

Disable Private Google Access and assign external IPs to the instances

Answer

Add a NAT instance (a Compute Engine VM configured as a NAT gateway)

Answer

Create a Cloud VPN tunnel to a third-party NAT service

Question 8

An organization uses Secret Manager to store database credentials. A new application runs on Compute Engine and needs to access a secret. The application uses the default compute engine service account. What is the most secure way to grant access to the secret?

Accepted Answer

Grant the roles/secretmanager.secretAccessor role to the compute engine default service account. The most secure approach is to grant the secretmanager.secretAccessor role to the compute engine service account. This avoids downloading keys or hardcoding secrets. The role provides access to secrets without granting broader permissions.

Answer

Hardcode the secret in the application configuration file

Answer

Create a new service account with the secretAccessor role, create a key, and store it on the instance

Answer

Grant the roles/editor role to the default compute engine service account

Question 9

A company has a Google Cloud organization with multiple folders and projects. The security team wants to audit all actions that create or modify IAM policies across the entire organization. Which type of audit log should they examine?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs record all API calls that modify the configuration or metadata of resources, including IAM policy changes. These logs are enabled by default and cannot be disabled. Data Access logs record read operations and are not enabled by default. System Event logs cover GCP infrastructure events, not IAM changes.

Answer

System Event audit logs

Answer

Data Access audit logs

Answer

VPC Flow Logs

Question 10

You need to create a Google-managed SSL certificate for an external HTTPS load balancer. The domain is 'www.example.com'. Which command creates the certificate?

Accepted Answer

gcloud compute ssl-certificates create my-cert --domains www.example.com. The correct command is gcloud compute ssl-certificates create with the --domains flag. This creates a Google-managed certificate that will be provisioned and renewed automatically.

Answer

gcloud compute ssl-certificates create my-cert --certificate example.crt --private-key example.key

Answer

gcloud compute ssl-certificates create my-cert --certificate example.crt

Answer

gcloud compute ssl-certificates create my-cert --domains www.example.com --managed

Question 11

An engineer needs to view the current IAM policy for a project in JSON format to analyze bindings. Which command should be used?

Accepted Answer

gcloud projects get-iam-policy my-project --format json. The command gcloud projects get-iam-policy PROJECT_ID --format json retrieves the IAM policy for the project in JSON format. Other commands either get policies for different resources or use a different format.

Answer

gcloud resource-manager folders get-iam-policy my-project --format json

Answer

gcloud projects get-iam-policy my-project --format yaml

Answer

gcloud iam policies get my-project --format json

Question 12

An organization wants to enforce that all Compute Engine instances in a project use customer-managed encryption keys (CMEK) for their boot disks. Which TWO steps should the security team take?

Accepted Answer

Set an organization policy constraint that requires CMEK for Compute Engine disks. To enforce CMEK, you can set an organization policy constraint (e.g., constraints/compute.requireCmek) to prevent creation of instances without CMEK. Additionally, you must grant the compute engine service account permission to use the KMS key so it can encrypt disks. Simply specifying the key in the instance template does not enforce the policy, and the Cloud KMS Admin role is too broad.

Answer

Specify the CMEK key in each instance template used for managed instance groups

Answer

Grant the Cloud KMS Admin role to the project's compute service account

Answer

Create a Cloud Audit Logs sink to monitor instances without CMEK

Question 13

A company wants to allow developers to create and manage secrets in Secret Manager, but prevent them from viewing secret values. Which TWO predefined roles should be combined to achieve this?

Accepted Answer

roles/secretmanager.secretManager. The roles/secretmanager.admin role includes permissions to create and manage secrets but not to access secret versions (i.e., view values). However, it includes the permission to access versions. Actually, the admin role includes secretmanager.versions.access, so it can view values. To separate manage from view, you need roles/secretmanager.secretVersionManager (manage versions without access) and roles/secretmanager.secretManager (manage secrets). Wait, the correct combination is roles/secretmanager.secretVersionManager (create/disable/destroy versions) and roles/secretmanager.secretManager (create/update/delete secrets). Neither includes secretmanager.versions.access. The roles/secretmanager.viewer allows viewing metadata but not values. The roles/secretmanager.secretAccessor allows accessing versions. To manage without viewing, combine roles that exclude access. Check accurate roles: roles/secretmanager.admin includes all permissions including access. roles/secretmanager.secretManager includes manage secrets but not access versions? Let's verify: roles/secretmanager.secretManager has permissions: secretmanager.secrets.create, secretmanager.secrets.delete, secretmanager.secrets.get, secretmanager.secrets.update, secretmanager.secrets.list. It does NOT include secretmanager.versions.access. roles/secretmanager.secretVersionManager has permissions: secretmanager.versions.create, secretmanager.versions.disable, secretmanager.versions.destroy, secretmanager.versions.enable, secretmanager.versions.get, secretmanager.versions.list. It does NOT include secretmanager.versions.access. So combining these two roles allows managing secrets and versions but not accessing the payload. roles/secretmanager.viewer allows viewing metadata but not accessing payload. roles/secretmanager.secretAccessor allows accessing payload. So the correct two are secretManager and secretVersionManager.

Answer

roles/secretmanager.admin

Answer

roles/secretmanager.secretAccessor

Answer

roles/secretmanager.viewer

Question 14

An engineer needs to audit all Data Access logs for a project to detect unauthorized access to sensitive data. The engineer must ensure that logs are retained for 5 years and are immutable. Which THREE steps should the engineer take?

Accepted Answer

Configure the Cloud Storage bucket with a retention policy and enable object versioning. To achieve this, the engineer must: 1. Enable Data Access audit logs for the required services (e.g., Cloud Storage, BigQuery) in the project's IAM audit config. 2. Create a log sink that exports the logs to a Cloud Storage bucket (which provides cost-effective long-term retention). 3. Configure the bucket with retention policy and object versioning to make logs immutable and protect against deletion. Using Logging's default retention is only 30 days, not 5 years. Cloud Monitoring does not store logs. BigQuery is not ideal for immutable storage.

Answer

Use the default Logging retention of 30 days

Answer

Set up a Cloud Monitoring alert for any Data Access log entries

Question 15

A DevOps engineer needs to grant a service account the ability to pull images from a specific Container Registry repository in project 'my-project'. The service account is in project 'other-project'. Which command should the engineer use?

Accepted Answer

gcloud projects add-iam-policy-binding my-project --member serviceAccount:sa@other-project.iam.gserviceaccount.com --role roles/storage.objectViewer. Cross-project IAM bindings require the resource owner project (my-project) to grant access to the service account principal. The correct command is 'gcloud projects add-iam-policy-binding' on the resource project.

Answer

gcloud projects add-iam-policy-binding my-project --member user:admin@other-project.com --role roles/storage.objectViewer

Answer

gcloud iam service-accounts add-iam-policy-binding sa@other-project.iam.gserviceaccount.com --member serviceAccount:sa@other-project.iam.gserviceaccount.com --role roles/storage.objectViewer

Answer

gcloud projects add-iam-policy-binding other-project --member serviceAccount:sa@other-project.iam.gserviceaccount.com --role roles/storage.objectViewer