Google ACE Configuring Access and Security Practice Test 5 — 15 Questions

Question 1

An organization has a hierarchy: Organization -> Folder A -> Project 1. An IAM policy at the organization level grants roles/editor to user@example.com. A policy at Folder A denies roles/editor to the same user. What is the effective role for the user in Project 1?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user does not have the editor role in Project 1 because the deny policy at the folder level blocks it.. In Google Cloud IAM, deny policies take precedence over allow policies in the resource hierarchy. A deny policy at Folder A blocks the roles/editor grant even though the organization-level allow policy grants it, because the deny is evaluated first and overrides any inherited allow for that principal and permission. Therefore the user has no editor role in Project 1.

Answer

The user has the editor role only in resources directly under the organization, not under Folder A.

Answer

The user has the editor role because organization-level grants override folder-level denials.

Answer

The user has the editor role in Project 1 unless there is a specific project-level deny.

Question 2

A developer wants to create a service account for an application running on Compute Engine. The application needs to access Cloud Storage. What is the best practice for granting this access?

Accepted Answer

Create a service account, grant it the Cloud Storage roles, and attach it to the instance using the --service-account flag.. The best practice is to create a dedicated user-managed service account, grant it only the required Cloud Storage IAM roles (e.g., roles/storage.objectViewer), and attach it directly to the Compute Engine instance via the --service-account flag. This follows the principle of least privilege and avoids long-lived credentials. Attaching the service account to the instance lets the application obtain short-lived access tokens automatically from the metadata server.

Answer

Use Workload Identity Federation to grant access.

Answer

Use the default Compute Engine service account and grant it Cloud Storage roles.

Answer

Create a service account, download its key, and store it on the instance.

Question 3

An engineer creates a firewall rule allowing ingress on port 8080 from source range 10.0.0.0/8 with priority 1000. Another rule denies ingress on port 8080 from source range 10.0.0.0/24 with priority 500. What is the effective behavior for traffic from 10.0.0.1?

Accepted Answer

Traffic is denied because the deny rule has a higher priority (lower number).. GCP firewall rules are evaluated by priority, where a lower number means higher priority. The deny rule has priority 500, which is lower than the allow rule's priority 1000, so the deny rule is evaluated first and matches traffic from 10.0.0.1 (which falls within 10.0.0.0/24). Therefore, the traffic is denied.

Answer

Traffic is denied only if the source is exactly 10.0.0.1; otherwise allowed.

Answer

Traffic is allowed because the allow rule covers a larger range.

Answer

Traffic is allowed because both rules match and the default is to allow.

Question 4

Which of the following is required to enable Private Google Access on a subnet?

Accepted Answer

Configuring the subnet with --enable-private-ip-google-access. Private Google Access is enabled per-subnet using the gcloud flag --enable-private-ip-google-access (or the equivalent 'Private Google Access: On' setting in the console). This allows VM instances that only have internal IP addresses to reach Google APIs and services (such as Cloud Storage, BigQuery, and the metadata server) using Google's internal routing, without requiring an external IP or NAT. The setting is scoped to the subnet, so each subnet must be configured individually.

Answer

A Cloud Router in the same region

Answer

A Cloud NAT gateway

Answer

VPC peering with a Google-managed network

Question 5

A developer wants to store a database password securely and make it accessible to a Compute Engine instance. Which Google Cloud service should be used?

Accepted Answer

Secret Manager. Secret Manager is Google Cloud's dedicated service for storing, managing, and accessing sensitive data such as API keys, passwords, and certificates. It provides versioning, IAM-based access control, audit logging, and automatic encryption. Applications on Compute Engine can retrieve secrets via the Secret Manager API using their attached service account.

Answer

Cloud Storage

Answer

Cloud Filestore

Answer

Cloud KMS

Question 6

An engineer needs to allow a set of Compute Engine instances (with tag 'web-server') to receive traffic on port 443 from the internet. The VPC has a default network with default firewall rules. Which TWO actions should the engineer take? (Choose TWO)

Accepted Answer

Create a firewall rule allowing ingress from 0.0.0.0/0 on port 443 with target tag 'web-server' and priority 1000.. Option D is correct because a VPC firewall rule must explicitly match the instances it protects via a target tag, so creating an ingress rule from 0.0.0.0/0 on tcp:443 with target tag 'web-server' and a priority (1000) permits the desired HTTPS traffic to exactly those instances. Option E is correct because firewall target tags only apply to instances that actually carry the matching network tag, so the Compute Engine instances must have the 'web-server' tag applied for the rule to take effect. Option A is wrong because its target tag 'https-server' does not match the instances tagged 'web-server', so the rule would not apply to them. Option B is wrong because the default network's default-allow-https rule targets 'https-server', and modifying it to 'web-server' would affect all instances with that tag rather than cleanly scoping the change, and it is not the required action here. Option C is wrong because deleting the default-allow-https rule is unnecessary and would remove existing HTTPS access for instances tagged 'https-server' without solving the tagging mismatch.

Answer

Create a firewall rule allowing ingress from 0.0.0.0/0 on port 443 with target tag 'https-server' and priority 1000.

Answer

Modify the default-allow-https rule to change the target tag to 'web-server'.

Answer

Delete the default-allow-https rule to avoid conflicts.

Question 7

A company wants to implement a least-privilege security model for a service account that needs to read secrets from Secret Manager and publish messages to Pub/Sub. Which TWO IAM roles should be granted? (Choose TWO)

Accepted Answer

roles/pubsub.publisher. Option A, roles/pubsub.publisher, is correct because it grants exactly the permission needed to publish messages to a Pub/Sub topic (pubsub.topics.publish) without granting administrative capabilities, which fits the least-privilege requirement. Option C, roles/secretmanager.secretAccessor, is correct because it provides the minimal permission to access the payload of a secret (secretmanager.versions.access), which is precisely what the service account needs to read secrets. Option B, roles/secretmanager.viewer, is not appropriate because it allows viewing secret metadata but not accessing the secret payload, so it would not satisfy the read-secrets requirement. Option D, roles/pubsub.admin, is too broad since it grants full control over Pub/Sub resources, violating least privilege. Option E, roles/secretmanager.admin, is also overly permissive, granting full administrative control over Secret Manager rather than just read access.

Answer

roles/secretmanager.viewer

Answer

roles/pubsub.admin

Answer

roles/secretmanager.admin

Question 8

A security engineer wants to audit all attempts to access a specific Cloud Storage bucket, including successful and failed read requests. Which THREE steps should they take? (Choose THREE)

Accepted Answer

Enable Data Access audit logs for the Cloud Storage service.. Option B is correct because Cloud Storage read requests (both successful and failed) are recorded only in Data Access audit logs, which are disabled by default and must be explicitly enabled for the Cloud Storage service. Option C is correct because once Data Access logs are enabled, they can be queried in Log Explorer using filters such as resource.type="gcs_bucket" and the bucket name to isolate the relevant read attempts. Option D is correct because the auditor needs the roles/logging.viewer role (or equivalent) on the project to view and filter those audit logs in Log Explorer. Option A is not needed because BigQuery sinks are for exporting/analyzing logs, not for auditing access attempts directly, and Admin Activity logs do not capture data reads. Option E is incorrect because Admin Activity audit logs are always enabled and record administrative/config changes, not successful or failed object read requests.

Answer

Create a log sink to BigQuery for the bucket's admin activity logs.

Answer

Enable Admin Activity audit logs for the bucket.

Question 9

An engineer needs to grant an external auditor read-only access to view IAM policies on a GCP project. The auditor should not have access to any other resources. Which IAM role should be assigned?

Accepted Answer

roles/iam.securityReviewer. The `roles/iam.securityReviewer` role grants permission to view IAM policies without granting access to other resources. It is specifically designed for security auditors.

Answer

roles/iam.roleAdmin

Answer

roles/iam.serviceAccountAdmin

Answer

roles/viewer

Question 10

You need to allow inbound HTTP traffic to a set of Compute Engine instances that have the tag 'web-server'. All other inbound traffic should be denied. Which firewall rule configuration should you create?

Accepted Answer

Create an allow rule for tcp:80 with source range 0.0.0.0/0 and target tags 'web-server'. No deny rule is needed.. In Google Cloud VPC firewall rules, you create an allow rule for tcp:80 with source range 0.0.0.0/0 and target tags 'web-server'. GCP firewall rules are stateful and use an implied deny-all ingress rule at the lowest priority (65535), so no explicit deny rule is needed — all traffic not matching an allow rule is automatically denied. This satisfies the requirement to allow HTTP to tagged instances while denying everything else.

Answer

Create an allow rule for tcp:80 with target tags 'web-server' and source range 0.0.0.0/0, and a deny rule for all other traffic.

Answer

Create an allow rule for tcp:80 with source range 0.0.0.0/0 and apply to all instances.

Answer

Create a deny rule for all ports except tcp:80 with target tags 'web-server'.

Question 11

A company is using Cloud NAT to allow private Compute Engine instances to access the internet. They notice that traffic from some instances is not being NATed. What is the most likely cause?

Accepted Answer

The instances have external IP addresses assigned.. Cloud NAT only applies to instances that do not have external IP addresses. If an instance has an external IP, it will use that IP for outbound traffic and bypass Cloud NAT.

Answer

The Cloud Router is not configured correctly.

Answer

The firewall rules block egress traffic.

Answer

The instances are in a different region than the Cloud NAT gateway.

Question 12

You want to view the current IAM policy for a project in JSON format using the gcloud command-line tool. Which command should you run?

Accepted Answer

gcloud projects get-iam-policy --format json. The command 'gcloud projects get-iam-policy --format json' retrieves the IAM policy for a project in JSON format. This command directly fetches the policy bindings and audit configs for the specified project.

Answer

gcloud iam service-accounts get-iam-policy <service-account> --format json

Answer

gcloud iam policies get <project-id> --format json

Answer

gcloud projects describe <project-id> --format json

Question 13

You need to allow a Compute Engine instance to securely access a Cloud Storage bucket without managing service account keys. The instance already has a service account attached. What is the best practice to grant access?

Accepted Answer

Grant the necessary IAM roles to the service account attached to the instance.. Granting the necessary IAM roles to the service account attached to the instance is the best practice because it allows the instance to authenticate to Cloud Storage using the service account's credentials automatically, without managing keys. This leverages the instance's metadata server to obtain access tokens, ensuring secure and seamless access.

Answer

Download a service account key file and store it on the instance.

Answer

Create a new service account and use its key on the instance.

Answer

Use the default compute engine service account and grant it Storage Admin.

Question 14

An engineer needs to enable Private Google Access for a subnet to allow instances without external IPs to access Google APIs and services. Which flag should be used when creating or updating the subnet?

Accepted Answer

--enable-private-ip-google-access. Private Google Access is enabled on a subnet using the `--enable-private-ip-google-access` flag. This allows instances in the subnet to reach Google APIs via the default route.

Answer

--enable-google-access

Answer

--private-google-access

Answer

--enable-private-ip

Question 15

You need to add an IAM binding for a user to a project using the gcloud command. Which command should you use?

Accepted Answer

gcloud projects add-iam-policy-binding. The correct command to add an IAM binding for a user to a project is gcloud projects add-iam-policy-binding, which modifies the project's IAM policy by granting a role to a member. This command is the standard way to manage project-level IAM bindings using gcloud. It requires the project ID, the member (user, group, or service account), and the role.

Answer

gcloud iam service-accounts add-iam-policy-binding

Answer

gcloud projects set-iam-policy

Answer

gcloud iam roles update