Google ACE Configuring Access and Security Practice Test 6 — 15 Questions

Question 1

A company uses Cloud SQL with Customer-Managed Encryption Keys (CMEK). The security team wants to rotate the encryption key. What is the impact on the Cloud SQL instance?

Accepted Answer

The instance must be stopped and restarted after the key rotation.. When rotating a CMEK for Cloud SQL, the instance must be restarted to use the new key version. Data remains encrypted at all times.

Answer

The instance becomes unavailable until the key rotation is complete.

Answer

All data in the instance is re-encrypted immediately.

Answer

There is no impact; the instance automatically uses the new key version.

Question 2

You need to store a database password securely in Google Cloud. The password will be used by a Compute Engine instance. Which service should you use?

Accepted Answer

Secret Manager. Google Cloud Secret Manager is designed to store, manage, and access sensitive data like passwords, API keys, and certificates. It provides versioning, IAM-based access control, and audit logging, making it the correct choice for storing a database password used by a Compute Engine instance.

Answer

Cloud Storage

Answer

Cloud KMS

Answer

Cloud Firestore

Question 3

A company needs to audit all actions that modify a Cloud Storage bucket. Which TWO steps should they take to enable this? (Choose 2 answers.)

Accepted Answer

Use Log Explorer to filter logs by the Cloud Storage service and the 'data_access' log type.. To audit data access modifications, you need to enable Data Access audit logs for the storage service and then view those logs in Log Explorer. Admin Activity logs record configuration changes (like creating a bucket), but data modifications (like uploading objects) require Data Access logs.

Answer

Create a VPC Service Controls perimeter.

Answer

Enable Admin Activity audit logs for the Cloud Storage service.

Answer

Assign the roles/logging.viewer role to the security team.

Question 4

A developer wants to automate the creation of a service account and assign it a role using the gcloud command-line tool. Which TWO commands are needed? (Choose 2 answers.)

Accepted Answer

gcloud projects add-iam-policy-binding. First, you create the service account with `gcloud iam service-accounts create`. Then, you grant a role to the service account by adding an IAM policy binding to the project.

Answer

gcloud iam service-accounts keys create

Answer

gcloud projects set-iam-policy

Answer

gcloud iam roles create

Question 5

Which command creates a Google-managed SSL certificate for the domain 'example.com'?

Accepted Answer

gcloud compute ssl-certificates create my-cert --domains example.com. Google-managed certificates are created with 'gcloud compute ssl-certificates create' with the '--domains' flag. The other commands are for different purposes.

Answer

gcloud compute addresses create my-cert --global

Answer

gcloud compute ssl-policies create my-policy

Answer

gcloud compute target-https-proxies create my-proxy --ssl-certificates my-cert

Question 6

An engineer needs to allow HTTP traffic from the internet to a set of Compute Engine instances that have the network tag 'web-server'. The instances are in a VPC with a default firewall rule that denies all ingress. Which command creates the required firewall rule?

Accepted Answer

gcloud compute firewall-rules create allow-http --allow tcp:80 --source-ranges 0.0.0.0/0 --target-tags web-server. The rule must allow TCP port 80 from source 0.0.0.0/0 to instances with target tag 'web-server'. The correct command uses '--allow tcp:80', '--source-ranges 0.0.0.0/0', and '--target-tags web-server'. Priority can be default (1000).

Answer

gcloud compute firewall-rules create allow-http --allow tcp:80 --source-tags web-server

Answer

gcloud compute firewall-rules create allow-http --allow tcp:80 --source-ranges web-server

Answer

gcloud compute firewall-rules create allow-http --allow http --target-tags web-server

Question 7

Which IAM role should be granted to a user to allow them to create and manage secrets in Secret Manager?

Accepted Answer

roles/secretmanager.admin. roles/secretmanager.admin provides full control over secrets, including creation, deletion, and granting access. roles/secretmanager.secretAccessor only allows reading secret payloads. roles/editor is too broad and not specific. roles/viewer is read-only.

Answer

roles/secretmanager.secretAccessor

Answer

roles/editor

Answer

roles/secretmanager.viewer

Question 8

A company has multiple VPC networks in their project. They want Compute Engine instances in one VPC to communicate with instances in another VPC using internal IP addresses. Which feature should they use?

Accepted Answer

VPC Network Peering. VPC Peering allows connectivity between two VPC networks using internal IPs. VPN is for on-premises connectivity. Cloud NAT is for outbound internet access. Firewall rules control traffic but do not enable routing between VPCs.

Answer

Cloud NAT

Answer

Cloud VPN

Answer

Firewall rules

Question 9

An engineer is configuring a Cloud NAT to allow private Compute Engine instances to access the internet. After creating the Cloud Router and NAT gateway, the instances still cannot connect to the internet. What is the most likely missing configuration?

Accepted Answer

The VPC does not have a default route (0.0.0.0/0) to the default internet gateway.. Cloud NAT requires that the subnet has Private Google Access enabled for certain Google APIs, but for general internet access, the instances must have a default route to the internet gateway (0.0.0.0/0 next hop to default internet gateway). If this route is missing, traffic won't be sent to NAT. The other options are possible but less common.

Answer

The firewall rules do not allow egress traffic.

Answer

The Cloud Router is in a different region.

Answer

The instances are not assigned a network tag used by the NAT.

Question 10

Which command is used to view the current IAM policy for a Google Cloud project in JSON format?

Accepted Answer

gcloud projects get-iam-policy [PROJECT_ID] --format json. The 'gcloud projects get-iam-policy' command retrieves the IAM policy for a project. The '--format json' flag outputs it in JSON. The other options are for other resources or wrong scope.

Answer

gcloud compute instances get-iam-policy [INSTANCE]

Answer

gcloud organizations get-iam-policy [ORG_ID]

Answer

gcloud iam service-accounts get-iam-policy [SERVICE_ACCOUNT]

Question 11

A developer needs to store a database password in Secret Manager and then allow a Compute Engine instance to access it. The instance uses the default compute engine service account. Which role should be granted to the service account?

Accepted Answer

roles/secretmanager.secretAccessor. To access the secret version's payload, the service account needs the 'secretmanager.secretAccessor' role on the secret (or project). That role allows accessing secret versions. roles/secretmanager.admin is too broad. roles/cloudsql.client is for Cloud SQL, not Secret Manager. roles/viewer does not allow access to secret payloads.

Answer

roles/cloudsql.client

Answer

roles/secretmanager.admin

Answer

roles/viewer

Question 12

An engineer wants to create a VPC with a custom subnet mode and then create a subnet with Private Google Access enabled. Which two commands should they use? (Choose TWO.)

Accepted Answer

gcloud compute networks subnets create my-subnet --network my-vpc --region us-central1 --range 10.0.0.0/24 --enable-private-ip-google-access. Option B is correct because creating a VPC in custom subnet mode requires the command `gcloud compute networks create my-vpc --subnet-mode custom`, which prevents Google Cloud from automatically creating subnets in each region and is the necessary first step for the scenario. Option A is correct because `gcloud compute networks subnets create my-subnet --network my-vpc --region us-central1 --range 10.0.0.0/24 --enable-private-ip-google-access` creates the subnet with the `--enable-private-ip-google-access` flag, which turns on Private Google Access so instances without external IPs can reach Google APIs and services. Option C is incorrect because it creates the subnet without the `--enable-private-ip-google-access` flag, so Private Google Access would remain disabled. Option D is incorrect because it creates a firewall rule for HTTP traffic, which is unrelated to subnet mode or Private Google Access. Option E is incorrect because `--subnet-mode auto` creates an auto mode VPC, which contradicts the requirement for a custom subnet mode VPC.

Answer

gcloud compute networks subnets create my-subnet --network my-vpc --region us-central1 --range 10.0.0.0/24

Answer

gcloud compute firewall-rules create allow-http --allow tcp:80

Answer

gcloud compute networks create my-vpc --subnet-mode auto

Question 13

An engineer needs to create a firewall rule that allows incoming HTTPS traffic only from a specific IP range to instances tagged 'web-server'. Which command should they use?

Accepted Answer

gcloud compute firewall-rules create allow-https --allow tcp:443 --source-ranges 192.168.0.0/16 --target-tags web-server. The correct command uses --allow tcp:443 to permit HTTPS, --source-ranges 192.168.0.0/16 to restrict the source IP range, and --target-tags web-server to apply the rule only to instances tagged 'web-server'. This matches all three requirements: protocol/port, source restriction, and target selection. The gcloud compute firewall-rules create syntax requires --allow with protocol:port and uses --target-tags (not --source-tags) to select destination instances.

Answer

gcloud compute firewall-rules create allow-https --allow tcp:443 --source-tags web-server

Answer

gcloud compute firewall-rules create allow-https --allow udp:443 --source-ranges 192.168.0.0/16 --target-tags web-server

Answer

gcloud compute firewall-rules create allow-https --allow tcp:443 --source-ranges 0.0.0.0/0 --target-tags web-server

Question 14

What is the primary benefit of using a Google-managed SSL certificate for an HTTPS Load Balancer?

Accepted Answer

It automatically renews the certificate before expiration.. Google-managed SSL certificates are provisioned and renewed automatically by Google, eliminating the operational burden of manual renewal and reducing the risk of expiration-related outages. The primary benefit is this automated lifecycle management, which ensures the certificate stays valid without intervention.

Answer

It is free of charge.

Answer

It can be used with any type of load balancer.

Answer

It provides stronger encryption than self-managed certificates.

Question 15

An organization wants to enable Data Access audit logs for all Cloud Storage buckets in a project. Which step is necessary?

Accepted Answer

Configure an organization policy or IAM audit config to enable Data Access logs for Cloud Storage.. To enable Data Access audit logs for all Cloud Storage buckets in a project, you must configure audit logging at the project or organization level using IAM audit configs or an organization policy. This sets the desired audit log type (DATA_READ, DATA_WRITE, ADMIN_READ) for the Cloud Storage service across all buckets, rather than configuring each bucket individually.

Answer

Use gcloud logging to create a log sink for Cloud Storage.

Answer

Enable Data Access logs in each bucket's settings.

Answer

Add an IAM binding with the roles/logging.admin role to a user.