Google ACE Configuring Access and Security Practice Test 6 — 15 Questions

Question 1

An engineer needs to allow HTTP traffic from the internet to a set of Compute Engine instances that have the network tag 'web-server'. The instances are in a VPC with a default firewall rule that denies all ingress. Which command creates the required firewall rule?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

gcloud compute firewall-rules create allow-http --allow tcp:80 --source-ranges 0.0.0.0/0 --target-tags web-server. The rule must allow TCP port 80 from source 0.0.0.0/0 to instances with target tag 'web-server'. The correct command uses '--allow tcp:80', '--source-ranges 0.0.0.0/0', and '--target-tags web-server'. Priority can be default (1000).

Answer

gcloud compute firewall-rules create allow-http --allow tcp:80 --source-tags web-server

Answer

gcloud compute firewall-rules create allow-http --allow tcp:80 --source-ranges web-server

Answer

gcloud compute firewall-rules create allow-http --allow http --target-tags web-server

Question 2

A developer created a service account for an application running on a Compute Engine instance. The instance was started without specifying the service account. What must the developer do to make the application use the service account?

Accepted Answer

Stop the instance, update it with the --service-account flag using gcloud compute instances set-service-account, then start it.. If an instance is created without a service account, it uses the default compute engine service account. To use a custom service account, the instance must be created with '--service-account' flag. If already running, the instance must be stopped and the service account can be changed (attached) by updating the instance. The correct approach is to stop the instance, attach the service account, and restart.

Answer

Use gcloud iam service-accounts add-iam-policy-binding to grant the instance access.

Answer

Use gcloud compute instances add-iam-policy-binding to assign the service account to the instance.

Answer

Create a new instance with the service account and migrate the application.

Question 3

Which IAM role should be granted to a user to allow them to create and manage secrets in Secret Manager?

Accepted Answer

roles/secretmanager.admin. roles/secretmanager.admin provides full control over secrets, including creation, deletion, and granting access. roles/secretmanager.secretAccessor only allows reading secret payloads. roles/editor is too broad and not specific. roles/viewer is read-only.

Answer

roles/secretmanager.secretAccessor

Answer

roles/editor

Answer

roles/secretmanager.viewer

Question 4

A company has multiple VPC networks in their project. They want Compute Engine instances in one VPC to communicate with instances in another VPC using internal IP addresses. Which feature should they use?

Accepted Answer

VPC Network Peering. VPC Peering allows connectivity between two VPC networks using internal IPs. VPN is for on-premises connectivity. Cloud NAT is for outbound internet access. Firewall rules control traffic but do not enable routing between VPCs.

Answer

Cloud NAT

Answer

Cloud VPN

Answer

Firewall rules

Question 5

An engineer is configuring a Cloud NAT to allow private Compute Engine instances to access the internet. After creating the Cloud Router and NAT gateway, the instances still cannot connect to the internet. What is the most likely missing configuration?

Accepted Answer

The VPC does not have a default route (0.0.0.0/0) to the default internet gateway.. Cloud NAT requires that the subnet has Private Google Access enabled for certain Google APIs, but for general internet access, the instances must have a default route to the internet gateway (0.0.0.0/0 next hop to default internet gateway). If this route is missing, traffic won't be sent to NAT. The other options are possible but less common.

Answer

The firewall rules do not allow egress traffic.

Answer

The Cloud Router is in a different region.

Answer

The instances are not assigned a network tag used by the NAT.

Question 6

Which command is used to view the current IAM policy for a Google Cloud project in JSON format?

Accepted Answer

gcloud projects get-iam-policy [PROJECT_ID] --format json. The 'gcloud projects get-iam-policy' command retrieves the IAM policy for a project. The '--format json' flag outputs it in JSON. The other options are for other resources or wrong scope.

Answer

gcloud compute instances get-iam-policy [INSTANCE]

Answer

gcloud organizations get-iam-policy [ORG_ID]

Answer

gcloud iam service-accounts get-iam-policy [SERVICE_ACCOUNT]

Question 7

An organization requires that all Compute Engine instances be created with a specific service account. Which organization policy can enforce this?

Accepted Answer

constraints/compute.setServiceAccount. The 'constraints/compute.setServiceAccount' constraint can be used to restrict which service accounts can be used when creating instances. It can be set at the organization or project level. The other constraints are not related to service accounts.

Answer

constraints/compute.vmExternalIpAccess

Answer

constraints/iam.allowedPolicyMemberDomains

Answer

constraints/compute.restrictCreateOnFirewall

Question 8

A developer needs to store a database password in Secret Manager and then allow a Compute Engine instance to access it. The instance uses the default compute engine service account. Which role should be granted to the service account?

Accepted Answer

roles/secretmanager.secretAccessor. To access the secret version's payload, the service account needs the 'secretmanager.secretAccessor' role on the secret (or project). That role allows accessing secret versions. roles/secretmanager.admin is too broad. roles/cloudsql.client is for Cloud SQL, not Secret Manager. roles/viewer does not allow access to secret payloads.

Answer

roles/cloudsql.client

Answer

roles/secretmanager.admin

Answer

roles/viewer

Question 9

An engineer wants to create a VPC with a custom subnet mode and then create a subnet with Private Google Access enabled. Which two commands should they use? (Choose TWO.)

Accepted Answer

gcloud compute networks subnets create my-subnet --network my-vpc --region us-central1 --range 10.0.0.0/24 --enable-private-ip-google-access. To create a custom mode VPC, use 'gcloud compute networks create' with '--subnet-mode custom'. Then add a subnet with 'gcloud compute networks subnets create' including '--enable-private-ip-google-access'. The other commands are incorrect: one creates an auto mode VPC, another is for firewall rules.

Answer

gcloud compute networks subnets create my-subnet --network my-vpc --region us-central1 --range 10.0.0.0/24

Answer

gcloud compute firewall-rules create allow-http --allow tcp:80

Answer

gcloud compute networks create my-vpc --subnet-mode auto

Question 10

An engineer needs to create a firewall rule that allows incoming HTTPS traffic only from a specific IP range to instances tagged 'web-server'. Which command should they use?

Accepted Answer

gcloud compute firewall-rules create allow-https --allow tcp:443 --source-ranges 192.168.0.0/16 --target-tags web-server. The correct command creates a firewall rule allowing TCP port 443 from the specified source range to instances with the target tag 'web-server'.

Answer

gcloud compute firewall-rules create allow-https --allow tcp:443 --source-tags web-server

Answer

gcloud compute firewall-rules create allow-https --allow udp:443 --source-ranges 192.168.0.0/16 --target-tags web-server

Answer

gcloud compute firewall-rules create allow-https --allow tcp:443 --source-ranges 0.0.0.0/0 --target-tags web-server

Question 11

What is the primary benefit of using a Google-managed SSL certificate for an HTTPS Load Balancer?

Accepted Answer

It automatically renews the certificate before expiration.. Google-managed certificates automatically provision and renew SSL/TLS certificates, reducing manual effort and preventing expiration issues.

Answer

It is free of charge.

Answer

It can be used with any type of load balancer.

Answer

It provides stronger encryption than self-managed certificates.

Question 12

An organization wants to enable Data Access audit logs for all Cloud Storage buckets in a project. Which step is necessary?

Accepted Answer

Configure an organization policy or IAM audit config to enable Data Access logs for Cloud Storage.. Data Access audit logs must be enabled at the organization or project level using IAM audit config, and can be scoped to specific services like Cloud Storage.

Answer

Use gcloud logging to create a log sink for Cloud Storage.

Answer

Enable Data Access logs in each bucket's settings.

Answer

Add an IAM binding with the roles/logging.admin role to a user.

Question 13

A developer wants to allow a Compute Engine instance to access Cloud Storage without using a service account key file. What is the recommended approach?

Accepted Answer

Create a service account, grant it the required roles, and attach it to the instance using the --service-account flag.. The recommended approach is to create a service account, grant it the necessary roles, and attach it to the instance. The instance can then use the service account via the metadata server without needing keys.

Answer

Use Application Default Credentials with a user account.

Answer

Download a service account key and store it on the instance.

Answer

Set up a VPN connection to Cloud Storage.

Question 14

A security engineer needs to ensure that all VMs in a subnet use Private Google Access to reach Google APIs without external IP addresses. What must be enabled?

Accepted Answer

Private Google Access on the subnet.. Private Google Access on a subnet allows VMs with only internal IP addresses to reach Google APIs and services through the default internet gateway.

Answer

A firewall rule allowing egress to 0.0.0.0/0.

Answer

VPC Flow Logs on the subnet.

Answer

Cloud NAT on the VPC.

Question 15

Which IAM role should be granted to a service account to allow it to access a secret stored in Secret Manager?

Accepted Answer

roles/secretmanager.secretAccessor. The role 'secretmanager.secretAccessor' grants access to read secret versions.

Answer

roles/secretmanager.admin

Answer

roles/iam.serviceAccountUser

Answer

roles/secretmanager.viewer