Google ACE Configuring Access and Security Practice Test 4 — 15 Questions

Question 1

An organization uses Organization Policies to restrict the use of certain IAM roles. The security team wants to audit all modifications to IAM policies across the organization, including at the project level. Which log type should be enabled and analyzed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs record all modifications to IAM policies. Data Access logs record reads of data, not policy changes. To audit IAM policy changes, Admin Activity logs must be enabled and analyzed.

Answer

System Event audit logs

Answer

Data Access audit logs (READ)

Answer

Data Access audit logs (WRITE)

Question 2

A company wants to automate the rotation of encryption keys for Cloud Storage buckets every 30 days. Which key type should be used?

Accepted Answer

Customer-Managed Encryption Keys (CMEK). Customer-Managed Encryption Keys (CMEK) allow you to control the key lifecycle, including rotation. Google-Managed keys rotate automatically but you cannot schedule or force rotation. CSEK requires manual rotation. Key Access Justification is a feature of CMEK for access transparency.

Answer

Google-managed encryption keys

Answer

Key Access Justification

Answer

Customer-Supplied Encryption Keys (CSEK)

Question 3

A security engineer needs to ensure that Compute Engine instances in a VPC can only communicate with each other on port 443 and cannot receive traffic from the internet. The VPC has a default network with default firewall rules. What should the engineer do?

Accepted Answer

Delete all default firewall rules and create a rule allowing ingress from the VPC's subnet range (e.g., 10.0.0.0/16) on port 443.. The default VPC includes default firewall rules that allow ingress from the internet and allow all internal traffic. To restrict communication, the engineer must first delete the default ingress rule that allows all traffic from the internet (allow-ssh, allow-icmp, allow-rdp, and allow-http/https can be deleted), then create a new rule that allows ingress only from the VPC's IP range on port 443. The default internal rule allows all traffic within the network; to restrict to port 443, a new rule with higher priority can override it, or the default rule can be deleted and a new one created.

Answer

Create a firewall rule with priority 2000 denying ingress from 0.0.0.0/0 and a rule allowing ingress from 10.0.0.0/16 on port 443 with priority 1000.

Answer

Create a firewall rule with priority 1000 allowing ingress from 0.0.0.0/0 on port 443 and deny all other traffic.

Answer

Modify the default-allow-internal rule to only allow port 443.

Question 4

An organization wants to use Cloud NAT to allow private Compute Engine instances to access the internet for updates. They have a VPC with a custom subnet and a Cloud Router configured. However, instances cannot reach the internet. What is the most likely cause?

Accepted Answer

The Cloud NAT gateway has not been created on the Cloud Router.. Cloud NAT requires a Cloud Router and a NAT gateway configuration on the router. If the NAT gateway is not created, instances cannot use NAT. Other issues like missing routes or firewall rules are possible but less likely when Cloud NAT is set up correctly.

Answer

The instances do not have external IP addresses.

Answer

The firewall rules block egress traffic.

Answer

The subnet does not have Private Google Access enabled.

Question 5

You need to grant a user the ability to view audit logs for a project but not modify any resources. Which predefined IAM role should you assign?

Accepted Answer

roles/logging.viewer. The roles/logging.viewer role provides read-only access to logs, including audit logs. roles/iam.securityReviewer provides read access to IAM policies but not logs. roles/viewer is too broad. roles/owner is administrative.

Answer

roles/iam.securityReviewer

Answer

roles/owner

Answer

roles/viewer

Question 6

A company has a Cloud SQL instance with CMEK enabled. The Cloud KMS key used for encryption is accidentally disabled. What is the impact on the Cloud SQL instance?

Accepted Answer

The instance becomes unavailable and cannot be started until the key is re-enabled.. When a CMEK key is disabled, the Cloud SQL instance becomes unavailable because the database cannot encrypt or decrypt data. The instance cannot be started or used until the key is re-enabled.

Answer

The instance will be automatically deleted after 30 days.

Answer

A read replica can be promoted to replace the primary.

Answer

The instance continues to operate normally, but new data cannot be encrypted.

Question 7

An engineer wants to create a Google-managed SSL certificate for an HTTPS load balancer. Which command should they use?

Accepted Answer

gcloud compute ssl-certificates create my-cert --domains example.com. To create a Google-managed SSL certificate, use 'gcloud compute ssl-certificates create' with the '--domains' flag. The other commands are for other purposes or require manual certificate provisioning.

Answer

gcloud compute ssl-policies create my-policy --profile MODERN

Answer

gcloud compute ssl-certificates create my-cert --certificate cert.pem --private-key key.pem

Answer

gcloud compute target-https-proxies create my-proxy --ssl-certificates my-cert

Question 8

You need to view the current IAM policy for a project named 'my-project' in JSON format. Which command should you use?

Accepted Answer

gcloud projects get-iam-policy my-project --format json. The correct command is 'gcloud projects get-iam-policy my-project --format json'. The 'add-iam-policy-binding' command is for adding bindings, 'set-iam-policy' is for setting from a file, and 'list' is not a valid subcommand for IAM policies.

Answer

gcloud projects add-iam-policy-binding my-project --format json

Answer

gcloud iam service-accounts list --project my-project

Answer

gcloud projects set-iam-policy my-project policy.json

Question 9

An organization has a hierarchy: Organization -> Folder A -> Project 1. An IAM policy at the organization level grants roles/editor to user@example.com. A policy at Folder A denies roles/editor to the same user. What is the effective role for the user in Project 1?

Accepted Answer

The user does not have the editor role in Project 1 because the deny policy at the folder level blocks it.. IAM policies are additive, but deny policies can override allow policies. If a deny policy is set at a higher level and applies to the user, it denies the permission even if granted at a lower level. However, if the deny policy is at the folder level, it denies the role in all resources under that folder, including Project 1.

Answer

The user has the editor role only in resources directly under the organization, not under Folder A.

Answer

The user has the editor role because organization-level grants override folder-level denials.

Answer

The user has the editor role in Project 1 unless there is a specific project-level deny.

Question 10

A developer wants to create a service account for an application running on Compute Engine. The application needs to access Cloud Storage. What is the best practice for granting this access?

Accepted Answer

Create a service account, grant it the Cloud Storage roles, and attach it to the instance using the --service-account flag.. The best practice is to create a service account, grant it the necessary roles, and attach it to the Compute Engine instance using the '--service-account' flag. Downloading keys is discouraged. Workload Identity is for on-premises or non-GCP workloads.

Answer

Use Workload Identity Federation to grant access.

Answer

Use the default Compute Engine service account and grant it Cloud Storage roles.

Answer

Create a service account, download its key, and store it on the instance.

Question 11

An engineer creates a firewall rule allowing ingress on port 8080 from source range 10.0.0.0/8 with priority 1000. Another rule denies ingress on port 8080 from source range 10.0.0.0/24 with priority 500. What is the effective behavior for traffic from 10.0.0.1?

Accepted Answer

Traffic is denied because the deny rule has a higher priority (lower number).. Firewall rules are evaluated in order of priority; lower numbers have higher priority. The deny rule (priority 500) has higher priority than the allow rule (priority 1000), so traffic from 10.0.0.1 (within 10.0.0.0/24) will be denied.

Answer

Traffic is denied only if the source is exactly 10.0.0.1; otherwise allowed.

Answer

Traffic is allowed because the allow rule covers a larger range.

Answer

Traffic is allowed because both rules match and the default is to allow.

Question 12

Which of the following is required to enable Private Google Access on a subnet?

Accepted Answer

Configuring the subnet with --enable-private-ip-google-access. Private Google Access is enabled at the subnet level using the '--enable-private-ip-google-access' flag. A Cloud NAT is not required for Private Google Access, though it is commonly used together. Cloud Router and VPC peering are not prerequisites.

Answer

A Cloud Router in the same region

Answer

A Cloud NAT gateway

Answer

VPC peering with a Google-managed network

Question 13

A developer wants to store a database password securely and make it accessible to a Compute Engine instance. Which Google Cloud service should be used?

Accepted Answer

Secret Manager. Secret Manager is designed for storing secrets like passwords, API keys, and certificates. Cloud KMS is for encryption key management. Cloud Storage is not secure for secrets. Cloud Filestore is for file storage.

Answer

Cloud Storage

Answer

Cloud Filestore

Answer

Cloud KMS

Question 14

An engineer needs to allow a set of Compute Engine instances (with tag 'web-server') to receive traffic on port 443 from the internet. The VPC has a default network with default firewall rules. Which TWO actions should the engineer take? (Choose TWO)

Accepted Answer

Create a firewall rule allowing ingress from 0.0.0.0/0 on port 443 with target tag 'web-server' and priority 1000.. To allow ingress on port 443 to instances with tag 'web-server', the engineer must create a firewall rule allowing that traffic. The default rules are already there but may not include port 443; the default-allow-https rule exists but only for instances with tag 'https-server', not 'web-server'. So a new rule is needed. The engineer should not modify the default rule (cannot be modified) or delete it. Creating a rule with priority 1000 is appropriate.

Answer

Create a firewall rule allowing ingress from 0.0.0.0/0 on port 443 with target tag 'https-server' and priority 1000.

Answer

Modify the default-allow-https rule to change the target tag to 'web-server'.

Answer

Delete the default-allow-https rule to avoid conflicts.

Question 15

A company wants to implement a least-privilege security model for a service account that needs to read secrets from Secret Manager and publish messages to Pub/Sub. Which TWO IAM roles should be granted? (Choose TWO)

Accepted Answer

roles/pubsub.publisher. The minimum roles needed are: roles/secretmanager.secretAccessor for reading secret versions, and roles/pubsub.publisher for publishing messages. roles/secretmanager.admin is too broad, roles/pubsub.admin is too broad, and roles/secretmanager.viewer only allows viewing metadata, not accessing secret values.

Answer

roles/secretmanager.viewer

Answer

roles/pubsub.admin

Answer

roles/secretmanager.admin