Google ACE Configuring Access and Security Practice Test 5 — 15 Questions

Question 1

A security engineer wants to audit all attempts to access a specific Cloud Storage bucket, including successful and failed read requests. Which THREE steps should they take? (Choose THREE)

Accepted Answer

Enable Data Access audit logs for the Cloud Storage service.. To audit data access, Data Access audit logs must be enabled for the bucket. Admin Activity logs only record configuration changes. Using Log Explorer allows filtering and analyzing logs. Granting the logging viewer role is necessary to view the logs. Creating a sink is for exporting logs, not necessary for auditing.

Answer

Create a log sink to BigQuery for the bucket's admin activity logs.

Answer

Enable Admin Activity audit logs for the bucket.

Question 2

An engineer needs to grant an external auditor read-only access to view IAM policies on a GCP project. The auditor should not have access to any other resources. Which IAM role should be assigned?

Accepted Answer

roles/iam.securityReviewer. The `roles/iam.securityReviewer` role grants permission to view IAM policies without granting access to other resources. It is specifically designed for security auditors.

Answer

roles/iam.roleAdmin

Answer

roles/iam.serviceAccountAdmin

Answer

roles/viewer

Question 3

You need to allow inbound HTTP traffic to a set of Compute Engine instances that have the tag 'web-server'. All other inbound traffic should be denied. Which firewall rule configuration should you create?

Accepted Answer

Create an allow rule for tcp:80 with source range 0.0.0.0/0 and target tags 'web-server'. No deny rule is needed.. Firewall rules are stateful; you should create an allow rule for HTTP (tcp:80) with source range 0.0.0.0/0 and target tag 'web-server'. Implicit deny all inbound traffic is the default, so no explicit deny is needed.

Answer

Create an allow rule for tcp:80 with target tags 'web-server' and source range 0.0.0.0/0, and a deny rule for all other traffic.

Answer

Create an allow rule for tcp:80 with source range 0.0.0.0/0 and apply to all instances.

Answer

Create a deny rule for all ports except tcp:80 with target tags 'web-server'.

Question 4

A company is using Cloud NAT to allow private Compute Engine instances to access the internet. They notice that traffic from some instances is not being NATed. What is the most likely cause?

Accepted Answer

The instances have external IP addresses assigned.. Cloud NAT only applies to instances that do not have external IP addresses. If an instance has an external IP, it will use that IP for outbound traffic and bypass Cloud NAT.

Answer

The Cloud Router is not configured correctly.

Answer

The firewall rules block egress traffic.

Answer

The instances are in a different region than the Cloud NAT gateway.

Question 5

You want to view the current IAM policy for a project in JSON format using the gcloud command-line tool. Which command should you run?

Accepted Answer

gcloud projects get-iam-policy --format json. The correct command is `gcloud projects get-iam-policy --format json`. This retrieves the IAM policy and formats it as JSON.

Answer

gcloud iam service-accounts get-iam-policy <service-account> --format json

Answer

gcloud iam policies get <project-id> --format json

Answer

gcloud projects describe <project-id> --format json

Question 6

An organization wants to enforce encryption at rest for all data in Cloud Storage using Customer-Managed Encryption Keys (CMEK). They have created a Cloud KMS key ring and key. What additional step is required when creating a new bucket to use CMEK?

Accepted Answer

Use the `--default-encryption-key` flag with the KMS key resource ID in the `gsutil mb` command.. When creating a bucket with CMEK, you must specify the `--default-encryption-key` flag with the KMS key resource ID. This sets the default encryption key for objects stored in the bucket.

Answer

Use the `--encryption-key` flag in the `gsutil mb` command.

Answer

Assign the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Storage service account.

Answer

Enable CMEK in the Cloud Console under the bucket's encryption settings after creation.

Question 7

An engineer needs to enable Private Google Access for a subnet to allow instances without external IPs to access Google APIs and services. Which flag should be used when creating or updating the subnet?

Accepted Answer

--enable-private-ip-google-access. Private Google Access is enabled on a subnet using the `--enable-private-ip-google-access` flag. This allows instances in the subnet to reach Google APIs via the default route.

Answer

--enable-google-access

Answer

--private-google-access

Answer

--enable-private-ip

Question 8

You need to add an IAM binding for a user to a project using the gcloud command. Which command should you use?

Accepted Answer

gcloud projects add-iam-policy-binding. The command `gcloud projects add-iam-policy-binding --member user: --role ` adds an IAM policy binding to a project.

Answer

gcloud iam service-accounts add-iam-policy-binding

Answer

gcloud projects set-iam-policy

Answer

gcloud iam roles update

Question 9

A company uses Cloud SQL with Customer-Managed Encryption Keys (CMEK). The security team wants to rotate the encryption key. What is the impact on the Cloud SQL instance?

Accepted Answer

The instance must be stopped and restarted after the key rotation.. When rotating a CMEK for Cloud SQL, the instance must be restarted to use the new key version. Data remains encrypted at all times.

Answer

The instance becomes unavailable until the key rotation is complete.

Answer

All data in the instance is re-encrypted immediately.

Answer

There is no impact; the instance automatically uses the new key version.

Question 10

You need to store a database password securely in Google Cloud. The password will be used by a Compute Engine instance. Which service should you use?

Accepted Answer

Secret Manager. Secret Manager is the correct service for storing secrets like database passwords. It provides encryption, access control, and versioning.

Answer

Cloud Storage

Answer

Cloud KMS

Answer

Cloud Firestore

Question 11

A company needs to audit all actions that modify a Cloud Storage bucket. Which TWO steps should they take to enable this? (Choose 2 answers.)

Accepted Answer

Use Log Explorer to filter logs by the Cloud Storage service and the 'data_access' log type.. To audit data access modifications, you need to enable Data Access audit logs for the storage service and then view those logs in Log Explorer. Admin Activity logs record configuration changes (like creating a bucket), but data modifications (like uploading objects) require Data Access logs.

Answer

Create a VPC Service Controls perimeter.

Answer

Enable Admin Activity audit logs for the Cloud Storage service.

Answer

Assign the roles/logging.viewer role to the security team.

Question 12

A developer wants to automate the creation of a service account and assign it a role using the gcloud command-line tool. Which TWO commands are needed? (Choose 2 answers.)

Accepted Answer

gcloud projects add-iam-policy-binding. First, you create the service account with `gcloud iam service-accounts create`. Then, you grant a role to the service account by adding an IAM policy binding to the project.

Answer

gcloud iam service-accounts keys create

Answer

gcloud projects set-iam-policy

Answer

gcloud iam roles create

Question 13

An engineer needs to grant a service account the ability to impersonate another service account when making API calls. Which IAM role should be assigned to the impersonating service account?

Accepted Answer

roles/iam.serviceAccountUser. The roles/iam.serviceAccountUser role allows a principal to impersonate a service account (by getting an access token for that account). roles/iam.serviceAccountTokenCreator allows creating tokens but not full impersonation. roles/serviceusage.serviceUsageConsumer is for service usage, not impersonation. roles/iam.serviceAccountAdmin allows administrative actions but not impersonation.

Answer

roles/iam.serviceAccountAdmin

Answer

roles/serviceusage.serviceUsageConsumer

Answer

roles/iam.serviceAccountTokenCreator

Question 14

A security team wants to enable audit logging for all Data Access (ADMIN_READ, DATA_READ, DATA_WRITE) on a specific Google Cloud project. They plan to use gcloud commands to configure this. What is the correct approach?

Accepted Answer

Use gcloud projects set-iam-policy to set the auditConfig on the project.. Audit log configuration is set at the organization, folder, or project level using the 'gcloud projects get-iam-policy' and 'gcloud projects set-iam-policy' commands with audit configs. The correct method is to modify the IAM policy to include auditConfigs. The other options either use wrong commands or wrong scopes.

Answer

Use gcloud compute firewall-rules update to enable logging on firewall rules.

Answer

Use gcloud logging sinks to export data access logs to a BigQuery dataset.

Answer

Use gcloud services enable to enable the Cloud Audit Logs API.

Question 15

Which command creates a Google-managed SSL certificate for the domain 'example.com'?

Accepted Answer

gcloud compute ssl-certificates create my-cert --domains example.com. Google-managed certificates are created with 'gcloud compute ssl-certificates create' with the '--domains' flag. The other commands are for different purposes.

Answer

gcloud compute addresses create my-cert --global

Answer

gcloud compute ssl-policies create my-policy

Answer

gcloud compute target-https-proxies create my-proxy --ssl-certificates my-cert