Google ACE Configuring Access and Security Practice Test 4 — 15 Questions

Question 1

An engineer needs to allow a set of Compute Engine instances (with tag 'web-server') to receive traffic on port 443 from the internet. The VPC has a default network with default firewall rules. Which TWO actions should the engineer take? (Choose TWO)

Accepted Answer

Create a firewall rule allowing ingress from 0.0.0.0/0 on port 443 with target tag 'web-server' and priority 1000.. To allow ingress on port 443 to instances with tag 'web-server', the engineer must create a firewall rule allowing that traffic. The default rules are already there but may not include port 443; the default-allow-https rule exists but only for instances with tag 'https-server', not 'web-server'. So a new rule is needed. The engineer should not modify the default rule (cannot be modified) or delete it. Creating a rule with priority 1000 is appropriate.

Answer

Create a firewall rule allowing ingress from 0.0.0.0/0 on port 443 with target tag 'https-server' and priority 1000.

Answer

Modify the default-allow-https rule to change the target tag to 'web-server'.

Answer

Delete the default-allow-https rule to avoid conflicts.

Question 2

A company wants to implement a least-privilege security model for a service account that needs to read secrets from Secret Manager and publish messages to Pub/Sub. Which TWO IAM roles should be granted? (Choose TWO)

Accepted Answer

roles/pubsub.publisher. The minimum roles needed are: roles/secretmanager.secretAccessor for reading secret versions, and roles/pubsub.publisher for publishing messages. roles/secretmanager.admin is too broad, roles/pubsub.admin is too broad, and roles/secretmanager.viewer only allows viewing metadata, not accessing secret values.

Answer

roles/secretmanager.viewer

Answer

roles/pubsub.admin

Answer

roles/secretmanager.admin

Question 3

A security engineer wants to audit all attempts to access a specific Cloud Storage bucket, including successful and failed read requests. Which THREE steps should they take? (Choose THREE)

Accepted Answer

Enable Data Access audit logs for the Cloud Storage service.. To audit data access, Data Access audit logs must be enabled for the bucket. Admin Activity logs only record configuration changes. Using Log Explorer allows filtering and analyzing logs. Granting the logging viewer role is necessary to view the logs. Creating a sink is for exporting logs, not necessary for auditing.

Answer

Create a log sink to BigQuery for the bucket's admin activity logs.

Answer

Enable Admin Activity audit logs for the bucket.

Question 4

An engineer needs to grant an external auditor read-only access to view IAM policies on a GCP project. The auditor should not have access to any other resources. Which IAM role should be assigned?

Accepted Answer

roles/iam.securityReviewer. The `roles/iam.securityReviewer` role grants permission to view IAM policies without granting access to other resources. It is specifically designed for security auditors.

Answer

roles/iam.roleAdmin

Answer

roles/iam.serviceAccountAdmin

Answer

roles/viewer

Question 5

A security team wants to ensure that all Compute Engine instances in a project are created with a specific custom service account attached. What is the most effective way to enforce this?

Accepted Answer

Configure an organization policy with the constraint `compute.setServiceAccount` to restrict the service accounts that can be used.. Using an organization policy with a constraint on `compute.requireOsLogin` is unrelated. The best approach is to use a custom IAM role that includes the `compute.instances.create` permission with a condition requiring the service account, or use an organization policy with the `constraints/compute.setServiceAccount` constraint to enforce that instances use a specific service account.

Answer

Use a firewall rule to block instances without the required service account.

Answer

Enable Shielded VMs on the project.

Answer

Create a custom role with `compute.instances.create` and assign it to all users.

Question 6

You need to allow inbound HTTP traffic to a set of Compute Engine instances that have the tag 'web-server'. All other inbound traffic should be denied. Which firewall rule configuration should you create?

Accepted Answer

Create an allow rule for tcp:80 with source range 0.0.0.0/0 and target tags 'web-server'. No deny rule is needed.. Firewall rules are stateful; you should create an allow rule for HTTP (tcp:80) with source range 0.0.0.0/0 and target tag 'web-server'. Implicit deny all inbound traffic is the default, so no explicit deny is needed.

Answer

Create an allow rule for tcp:80 with target tags 'web-server' and source range 0.0.0.0/0, and a deny rule for all other traffic.

Answer

Create an allow rule for tcp:80 with source range 0.0.0.0/0 and apply to all instances.

Answer

Create a deny rule for all ports except tcp:80 with target tags 'web-server'.

Question 7

A company is using Cloud NAT to allow private Compute Engine instances to access the internet. They notice that traffic from some instances is not being NATed. What is the most likely cause?

Accepted Answer

The instances have external IP addresses assigned.. Cloud NAT only applies to instances that do not have external IP addresses. If an instance has an external IP, it will use that IP for outbound traffic and bypass Cloud NAT.

Answer

The Cloud Router is not configured correctly.

Answer

The firewall rules block egress traffic.

Answer

The instances are in a different region than the Cloud NAT gateway.

Question 8

You are creating a new service account for an application that needs to read from a Cloud Storage bucket and write to Cloud Pub/Sub. What is the most secure way to grant these permissions?

Accepted Answer

Grant the roles/storage.objectViewer and roles/pubsub.publisher roles to the service account.. The principle of least privilege dictates granting only the specific roles needed. The Storage Object Viewer role provides read-only access to objects, and Pub/Sub Publisher allows publishing messages.

Answer

Grant the roles/storage.admin and roles/pubsub.admin roles to the service account.

Answer

Create a custom role with storage.objects.get and pubsub.topics.publish, then grant it to the service account.

Answer

Grant the roles/editor role to the service account.

Question 9

You want to view the current IAM policy for a project in JSON format using the gcloud command-line tool. Which command should you run?

Accepted Answer

gcloud projects get-iam-policy --format json. The correct command is `gcloud projects get-iam-policy --format json`. This retrieves the IAM policy and formats it as JSON.

Answer

gcloud iam service-accounts get-iam-policy <service-account> --format json

Answer

gcloud iam policies get <project-id> --format json

Answer

gcloud projects describe <project-id> --format json

Question 10

An organization wants to enforce encryption at rest for all data in Cloud Storage using Customer-Managed Encryption Keys (CMEK). They have created a Cloud KMS key ring and key. What additional step is required when creating a new bucket to use CMEK?

Accepted Answer

Use the `--default-encryption-key` flag with the KMS key resource ID in the `gsutil mb` command.. When creating a bucket with CMEK, you must specify the `--default-encryption-key` flag with the KMS key resource ID. This sets the default encryption key for objects stored in the bucket.

Answer

Use the `--encryption-key` flag in the `gsutil mb` command.

Answer

Assign the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Storage service account.

Answer

Enable CMEK in the Cloud Console under the bucket's encryption settings after creation.

Question 11

You need to allow a Compute Engine instance to securely access a Cloud Storage bucket without managing service account keys. The instance already has a service account attached. What is the best practice to grant access?

Accepted Answer

Grant the necessary IAM roles to the service account attached to the instance.. The best practice is to grant the appropriate IAM role (e.g., Storage Object Viewer) to the service account attached to the instance. This avoids the need to download and manage service account keys.

Answer

Download a service account key file and store it on the instance.

Answer

Create a new service account and use its key on the instance.

Answer

Use the default compute engine service account and grant it Storage Admin.

Question 12

An engineer needs to enable Private Google Access for a subnet to allow instances without external IPs to access Google APIs and services. Which flag should be used when creating or updating the subnet?

Accepted Answer

--enable-private-ip-google-access. Private Google Access is enabled on a subnet using the `--enable-private-ip-google-access` flag. This allows instances in the subnet to reach Google APIs via the default route.

Answer

--enable-google-access

Answer

--private-google-access

Answer

--enable-private-ip

Question 13

You need to add an IAM binding for a user to a project using the gcloud command. Which command should you use?

Accepted Answer

gcloud projects add-iam-policy-binding. The command `gcloud projects add-iam-policy-binding --member user: --role ` adds an IAM policy binding to a project.

Answer

gcloud iam service-accounts add-iam-policy-binding

Answer

gcloud projects set-iam-policy

Answer

gcloud iam roles update

Question 14

A company uses Cloud SQL with Customer-Managed Encryption Keys (CMEK). The security team wants to rotate the encryption key. What is the impact on the Cloud SQL instance?

Accepted Answer

The instance must be stopped and restarted after the key rotation.. When rotating a CMEK for Cloud SQL, the instance must be restarted to use the new key version. Data remains encrypted at all times.

Answer

The instance becomes unavailable until the key rotation is complete.

Answer

All data in the instance is re-encrypted immediately.

Answer

There is no impact; the instance automatically uses the new key version.

Question 15

You need to store a database password securely in Google Cloud. The password will be used by a Compute Engine instance. Which service should you use?

Accepted Answer

Secret Manager. Secret Manager is the correct service for storing secrets like database passwords. It provides encryption, access control, and versioning.

Answer

Cloud Storage

Answer

Cloud KMS

Answer

Cloud Firestore