Google ACE Configuring Access and Security Practice Test 4 — 15 Questions

Question 1

An organization uses Secret Manager to store database credentials. A new application runs on Compute Engine and needs to access a secret. The application uses the default compute engine service account. What is the most secure way to grant access to the secret?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Grant the roles/secretmanager.secretAccessor role to the compute engine default service account. The most secure way is to grant the roles/secretmanager.secretAccessor role directly to the Compute Engine default service account, leveraging the instance's attached identity. This avoids long-lived credentials, uses IAM for least-privilege access, and lets the application call the Secret Manager API via the metadata server. No keys are stored on disk, and access is auditable.

Answer

Hardcode the secret in the application configuration file

Answer

Create a new service account with the secretAccessor role, create a key, and store it on the instance

Answer

Grant the roles/editor role to the default compute engine service account

Question 2

A company has a Google Cloud organization with multiple folders and projects. The security team wants to audit all actions that create or modify IAM policies across the entire organization. Which type of audit log should they examine?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs in Google Cloud record all API calls that modify resource configurations, including IAM policy changes (e.g., setIamPolicy). They are enabled by default, cannot be disabled, and are the correct log type for auditing who created or modified IAM policies across the organization.

Answer

System Event audit logs

Answer

Data Access audit logs

Answer

VPC Flow Logs

Question 3

You need to create a Google-managed SSL certificate for an external HTTPS load balancer. The domain is 'www.example.com'. Which command creates the certificate?

Accepted Answer

gcloud compute ssl-certificates create my-cert --domains www.example.com. The correct command is gcloud compute ssl-certificates create with the --domains flag. This creates a Google-managed certificate that will be provisioned and renewed automatically.

Answer

gcloud compute ssl-certificates create my-cert --certificate example.crt --private-key example.key

Answer

gcloud compute ssl-certificates create my-cert --certificate example.crt

Answer

gcloud compute ssl-certificates create my-cert --domains www.example.com --managed

Question 4

An engineer needs to view the current IAM policy for a project in JSON format to analyze bindings. Which command should be used?

Accepted Answer

gcloud projects get-iam-policy my-project --format json. The command gcloud projects get-iam-policy PROJECT_ID --format json retrieves the IAM policy for the project in JSON format. Other commands either get policies for different resources or use a different format.

Answer

gcloud resource-manager folders get-iam-policy my-project --format json

Answer

gcloud projects get-iam-policy my-project --format yaml

Answer

gcloud iam policies get my-project --format json

Question 5

An organization wants to enforce that all Compute Engine instances in a project use customer-managed encryption keys (CMEK) for their boot disks. Which TWO steps should the security team take?

Accepted Answer

Set an organization policy constraint that requires CMEK for Compute Engine disks. To enforce CMEK, you can set an organization policy constraint (e.g., constraints/compute.requireCmek) to prevent creation of instances without CMEK. Additionally, you must grant the compute engine service account permission to use the KMS key so it can encrypt disks. Simply specifying the key in the instance template does not enforce the policy, and the Cloud KMS Admin role is too broad.

Answer

Specify the CMEK key in each instance template used for managed instance groups

Answer

Grant the Cloud KMS Admin role to the project's compute service account

Answer

Create a Cloud Audit Logs sink to monitor instances without CMEK

Question 6

A company wants to allow developers to create and manage secrets in Secret Manager, but prevent them from viewing secret values. Which TWO predefined roles should be combined to achieve this?

Accepted Answer

roles/secretmanager.secretManager. The roles/secretmanager.admin role includes permissions to create and manage secrets but not to access secret versions (i.e., view values). However, it includes the permission to access versions. Actually, the admin role includes secretmanager.versions.access, so it can view values. To separate manage from view, you need roles/secretmanager.secretVersionManager (manage versions without access) and roles/secretmanager.secretManager (manage secrets). Wait, the correct combination is roles/secretmanager.secretVersionManager (create/disable/destroy versions) and roles/secretmanager.secretManager (create/update/delete secrets). Neither includes secretmanager.versions.access. The roles/secretmanager.viewer allows viewing metadata but not values. The roles/secretmanager.secretAccessor allows accessing versions. To manage without viewing, combine roles that exclude access. Check accurate roles: roles/secretmanager.admin includes all permissions including access. roles/secretmanager.secretManager includes manage secrets but not access versions? Let's verify: roles/secretmanager.secretManager has permissions: secretmanager.secrets.create, secretmanager.secrets.delete, secretmanager.secrets.get, secretmanager.secrets.update, secretmanager.secrets.list. It does NOT include secretmanager.versions.access. roles/secretmanager.secretVersionManager has permissions: secretmanager.versions.create, secretmanager.versions.disable, secretmanager.versions.destroy, secretmanager.versions.enable, secretmanager.versions.get, secretmanager.versions.list. It does NOT include secretmanager.versions.access. So combining these two roles allows managing secrets and versions but not accessing the payload. roles/secretmanager.viewer allows viewing metadata but not accessing payload. roles/secretmanager.secretAccessor allows accessing payload. So the correct two are secretManager and secretVersionManager.

Answer

roles/secretmanager.admin

Answer

roles/secretmanager.secretAccessor

Answer

roles/secretmanager.viewer

Question 7

An engineer needs to audit all Data Access logs for a project to detect unauthorized access to sensitive data. The engineer must ensure that logs are retained for 5 years and are immutable. Which THREE steps should the engineer take?

Accepted Answer

Configure the Cloud Storage bucket with a retention policy and enable object versioning. To achieve this, the engineer must: 1. Enable Data Access audit logs for the required services (e.g., Cloud Storage, BigQuery) in the project's IAM audit config. 2. Create a log sink that exports the logs to a Cloud Storage bucket (which provides cost-effective long-term retention). 3. Configure the bucket with retention policy and object versioning to make logs immutable and protect against deletion. Using Logging's default retention is only 30 days, not 5 years. Cloud Monitoring does not store logs. BigQuery is not ideal for immutable storage.

Answer

Use the default Logging retention of 30 days

Answer

Set up a Cloud Monitoring alert for any Data Access log entries

Question 8

A DevOps engineer needs to grant a service account the ability to pull images from a specific Container Registry repository in project 'my-project'. The service account is in project 'other-project'. Which command should the engineer use?

Accepted Answer

gcloud projects add-iam-policy-binding my-project --member serviceAccount:sa@other-project.iam.gserviceaccount.com --role roles/storage.objectViewer. To grant a service account from 'other-project' permission to pull images from a repository in 'my-project', the IAM policy binding must be applied to the resource-owning project ('my-project') with the service account as the member. Option D does exactly this: it binds roles/storage.objectViewer on my-project to the service account from other-project.

Answer

gcloud projects add-iam-policy-binding my-project --member user:admin@other-project.com --role roles/storage.objectViewer

Answer

gcloud iam service-accounts add-iam-policy-binding sa@other-project.iam.gserviceaccount.com --member serviceAccount:sa@other-project.iam.gserviceaccount.com --role roles/storage.objectViewer

Answer

gcloud projects add-iam-policy-binding other-project --member serviceAccount:sa@other-project.iam.gserviceaccount.com --role roles/storage.objectViewer

Question 9

An organization uses Organization Policies to restrict the use of certain IAM roles. The security team wants to audit all modifications to IAM policies across the organization, including at the project level. Which log type should be enabled and analyzed?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs record all API calls or other actions that modify the configuration or metadata of resources, including IAM policy changes. They are enabled by default and cannot be disabled. To audit modifications to IAM policies at the organization and project level, Admin Activity logs are the correct choice.

Answer

System Event audit logs

Answer

Data Access audit logs (READ)

Answer

Data Access audit logs (WRITE)

Question 10

A company wants to automate the rotation of encryption keys for Cloud Storage buckets every 30 days. Which key type should be used?

Accepted Answer

Customer-Managed Encryption Keys (CMEK). Customer-Managed Encryption Keys (CMEK) allow the customer to control the key lifecycle, including rotation, through Cloud KMS. Because the customer owns and manages the key in KMS, they can set a rotation schedule (e.g., every 30 days) and automate it. Google-managed keys are rotated automatically by Google on a schedule the customer cannot control, and CSEK keys are supplied per-request and cannot be rotated by a schedule.

Answer

Google-managed encryption keys

Answer

Key Access Justification

Answer

Customer-Supplied Encryption Keys (CSEK)

Question 11

An organization wants to use Cloud NAT to allow private Compute Engine instances to access the internet for updates. They have a VPC with a custom subnet and a Cloud Router configured. However, instances cannot reach the internet. What is the most likely cause?

Accepted Answer

The Cloud NAT gateway has not been created on the Cloud Router.. Cloud NAT requires a NAT gateway to be explicitly created and associated with a Cloud Router and a subnet/region. If the Cloud Router exists but no NAT gateway has been configured on it, private instances have no translation path to the internet, which is the most likely cause of the failure. Creating the NAT gateway on the Cloud Router resolves the issue.

Answer

The instances do not have external IP addresses.

Answer

The firewall rules block egress traffic.

Answer

The subnet does not have Private Google Access enabled.

Question 12

You need to grant a user the ability to view audit logs for a project but not modify any resources. Which predefined IAM role should you assign?

Accepted Answer

roles/logging.viewer. The roles/logging.viewer role provides read-only access to logs, including audit logs. roles/iam.securityReviewer provides read access to IAM policies but not logs. roles/viewer is too broad. roles/owner is administrative.

Answer

roles/iam.securityReviewer

Answer

roles/owner

Answer

roles/viewer

Question 13

A company has a Cloud SQL instance with CMEK enabled. The Cloud KMS key used for encryption is accidentally disabled. What is the impact on the Cloud SQL instance?

Accepted Answer

The instance becomes unavailable and cannot be started until the key is re-enabled.. When a Cloud KMS key used for CMEK is disabled, the Cloud SQL instance cannot access the key to decrypt its data. As a result, the instance becomes unavailable and cannot be started until the key is re-enabled. This is because the instance requires the key for both read and write operations.

Answer

The instance will be automatically deleted after 30 days.

Answer

A read replica can be promoted to replace the primary.

Answer

The instance continues to operate normally, but new data cannot be encrypted.

Question 14

An engineer wants to create a Google-managed SSL certificate for an HTTPS load balancer. Which command should they use?

Accepted Answer

gcloud compute ssl-certificates create my-cert --domains example.com. Google-managed SSL certificates are created with `gcloud compute ssl-certificates create` and only require the `--domains` flag; Google provisions and renews the certificate automatically. The absence of `--certificate` and `--private-key` is what distinguishes a Google-managed cert from a self-managed one. The resulting certificate resource can then be attached to a target HTTPS proxy.

Answer

gcloud compute ssl-policies create my-policy --profile MODERN

Answer

gcloud compute ssl-certificates create my-cert --certificate cert.pem --private-key key.pem

Answer

gcloud compute target-https-proxies create my-proxy --ssl-certificates my-cert

Question 15

You need to view the current IAM policy for a project named 'my-project' in JSON format. Which command should you use?

Accepted Answer

gcloud projects get-iam-policy my-project --format json. The `gcloud projects get-iam-policy` command retrieves the existing IAM policy bindings for a project and returns them in the requested format. Adding `--format json` outputs the policy as a JSON document, which is exactly what is needed to view the current policy. This is a read-only operation that does not modify any bindings.

Answer

gcloud projects add-iam-policy-binding my-project --format json

Answer

gcloud iam service-accounts list --project my-project

Answer

gcloud projects set-iam-policy my-project policy.json