Google ACE Configuring Access and Security Practice Test 7 — 15 Questions

Question 1

A developer wants to allow a Compute Engine instance to access Cloud Storage without using a service account key file. What is the recommended approach?

Accepted Answer

Create a service account, grant it the required roles, and attach it to the instance using the --service-account flag.. The recommended approach is to create a service account, grant it the required roles, and attach it to the instance using the --service-account flag. This allows the instance to use the service account's credentials via the metadata server, eliminating the need for key files and providing secure, short-lived credentials.

Answer

Use Application Default Credentials with a user account.

Answer

Download a service account key and store it on the instance.

Answer

Set up a VPN connection to Cloud Storage.

Question 2

A security engineer needs to ensure that all VMs in a subnet use Private Google Access to reach Google APIs without external IP addresses. What must be enabled?

Accepted Answer

Private Google Access on the subnet.. Private Google Access allows VMs without external IP addresses to reach Google APIs and services using internal IP addresses. Enabling it on the subnet is the correct configuration to meet the requirement.

Answer

A firewall rule allowing egress to 0.0.0.0/0.

Answer

VPC Flow Logs on the subnet.

Answer

Cloud NAT on the VPC.

Question 3

Which IAM role should be granted to a service account to allow it to access a secret stored in Secret Manager?

Accepted Answer

roles/secretmanager.secretAccessor. The role 'secretmanager.secretAccessor' grants access to read secret versions.

Answer

roles/secretmanager.admin

Answer

roles/iam.serviceAccountUser

Answer

roles/secretmanager.viewer

Question 4

An organization has a folder hierarchy with multiple projects. They want to grant a support team the ability to view all IAM policies across the entire folder. What is the most efficient way?

Accepted Answer

Grant roles/iam.securityReviewer at the folder level.. Granting roles/iam.securityReviewer at the folder level is the most efficient approach because IAM policies in Google Cloud are hierarchical and inherited. A single binding at the folder level automatically applies to every project and resource beneath it, so the support team gains visibility into all IAM policies across all projects without per-project configuration. This follows the principle of least privilege while minimizing administrative overhead.

Answer

Grant roles/iam.securityReviewer on each project individually.

Answer

Grant roles/owner at the folder level.

Answer

Grant roles/viewer at the folder level.

Question 5

A company wants to use Customer-Managed Encryption Keys (CMEK) for a Cloud SQL instance. What must be done first?

Accepted Answer

Create a Cloud KMS key ring and key, and grant the Cloud SQL service account the cloudkms.cryptoKeyEncrypterDecrypter role.. To use Customer-Managed Encryption Keys (CMEK) with Cloud SQL, you must first create a Cloud KMS key ring and key, then grant the Cloud SQL service account the cloudkms.cryptoKeyEncrypterDecrypter role. This allows Cloud SQL to use the key to encrypt the instance's data at rest. The service account must have permission to use the key for encryption and decryption operations.

Answer

Create a bucket and upload a key file.

Answer

Enable Cloud KMS API and use default encryption.

Answer

Set the --disk-encryption-key flag to an existing key in Cloud KMS.

Question 6

What is the purpose of creating a Cloud NAT gateway?

Accepted Answer

To enable private instances to reach the internet for updates and patches.. Cloud NAT allows instances without external IP addresses to access the internet for outbound connections, while preventing inbound connections from the internet.

Answer

To allow VPN connections to on-premises networks.

Answer

To provide a static IP address for inbound traffic.

Answer

To provide DNS resolution for VPC networks.

Question 7

An engineer wants to view the current IAM policy for a project in JSON format. Which command should they use?

Accepted Answer

gcloud projects get-iam-policy my-project --format json. The command 'gcloud projects get-iam-policy my-project --format json' retrieves the IAM policy bound to a project and outputs it in JSON. This is the correct gcloud command for viewing a project's IAM policy, which lists bindings between members and roles. The --format json flag ensures machine-readable JSON output.

Answer

gcloud resource-manager folders get-iam-policy my-project --format json

Answer

gcloud projects describe my-project --format json

Answer

gcloud iam policies get my-project --format json

Question 8

A company has multiple firewall rules. Rule A (priority 1000) allows TCP 80 from 0.0.0.0/0. Rule B (priority 500) denies TCP 80 from 10.0.0.0/8. An instance with IP 10.0.0.1 tries to connect to TCP 80. What happens?

Accepted Answer

Traffic is denied because Rule B has higher priority.. GCP firewall rules are evaluated by priority, where a lower number means higher priority; Rule B has priority 500, which is lower than Rule A's 1000, so Rule B is evaluated first. Because Rule B denies TCP 80 from 10.0.0.0/8 and the instance's IP 10.0.0.1 falls in that range, the traffic is denied. The matching deny rule wins before the allow rule is ever considered.

Answer

The result depends on the order of creation.

Answer

Traffic is allowed because Rule A allows all sources.

Answer

Both rules are applied and traffic is allowed.

Question 9

A DevOps team needs to grant a CI/CD service account the ability to create secrets in Secret Manager. Which role should be assigned?

Accepted Answer

roles/secretmanager.admin. The roles/secretmanager.admin role grants full control, including creating secrets. roles/secretmanager.secretCreator does not exist; the admin role includes create permission.

Answer

roles/secretmanager.secretCreator

Answer

roles/secretmanager.secretAccessor

Answer

roles/secretmanager.viewer

Question 10

A security team wants to restrict access to a Cloud Storage bucket so that only objects encrypted with a specific CMEK key can be uploaded. Which three actions are needed? (Choose 3)

Accepted Answer

Grant authorized users the roles/cloudkms.cryptoKeyEncrypterDecrypter role.. Setting the CMEK key on the bucket, creating a bucket-level policy denying uploads without the key, and granting the encrypt/decrypt role to users are required.

Answer

Grant all users the roles/cloudkms.cryptoKeyEncrypterDecrypter role.

Answer

Enable Uniform Bucket-Level Access.

Question 11

A company has an organization with multiple folders and projects. They want to audit all IAM policy changes across the entire organization. Which approach meets the requirement with minimal effort?

Accepted Answer

View Admin Activity audit logs in Logs Explorer, which are enabled by default.. Admin Activity audit logs are enabled by default for all Google Cloud projects and organizations, and they automatically capture IAM policy changes (e.g., SetIamPolicy calls) at the organization, folder, and project levels. Because they are always on and aggregated at the organization level, you can view them in Logs Explorer without enabling anything or configuring per-project sinks. This meets the audit requirement with minimal effort.

Answer

Use Organization Policy to deny IAM policy changes and monitor violations.

Answer

Enable Data Access audit logs for all services in the organization.

Answer

Enable audit logging on each project individually using gcloud logging sinks.

Question 12

An engineer wants to allow HTTP traffic from the internet to a set of Compute Engine instances that have the network tag 'web-server'. Which firewall rule should they create?

Accepted Answer

gcloud compute firewall-rules create allow-http --allow tcp:80 --source-ranges 0.0.0.0/0 --target-tags web-server. To allow HTTP traffic from the internet to instances with the network tag 'web-server', the firewall rule must specify --allow tcp:80, --source-ranges 0.0.0.0/0 (to allow all internet IPs), and --target-tags web-server (to apply to instances with that tag). This correctly defines an ingress rule allowing TCP port 80 from any source to the tagged instances.

Answer

gcloud compute firewall-rules create allow-http --allow tcp:80 --source-tags web-server

Answer

gcloud compute firewall-rules create allow-http --allow tcp:80 --source-tags web-server --target-ranges 0.0.0.0/0

Answer

gcloud compute firewall-rules create allow-http --direction egress --allow tcp:80 --destination-ranges 0.0.0.0/0 --target-tags web-server

Question 13

An engineer wants to view the current IAM policy for a project. Which TWO commands will accomplish this?

Accepted Answer

gcloud projects get-iam-policy my-project --format json. The gcloud projects get-iam-policy command retrieves the IAM policy for a project. The gcloud projects get-ancestors-iam-policy retrieves policies from ancestors, not the project itself. The other commands are for different purposes.

Answer

gcloud resource-manager folders get-iam-policy my-folder

Answer

gcloud iam service-accounts get-iam-policy my-sa@my-project.iam.gserviceaccount.com

Answer

gcloud projects get-ancestors-iam-policy my-project

Question 14

A developer needs to allow a Compute Engine instance to access a Cloud Storage bucket without using a service account key file. The instance runs in a project that has the necessary APIs enabled. What should the developer do?

Accepted Answer

Attach a service account to the instance and grant it the necessary IAM roles.. Attaching a service account to the instance allows the instance to obtain short-lived credentials from the metadata server, eliminating the need for key files. Granting that service account the necessary IAM roles ensures it has the required permissions to access the Cloud Storage bucket. This is the recommended secure and manageable approach for Compute Engine workloads.

Answer

Use the instance's default Compute Engine service account and grant it the Editor role.

Answer

Create a service account key and store it on the instance's persistent disk.

Answer

Enable Cloud Storage API access on the instance's network interface.

Question 15

An organization has a requirement that all Compute Engine instances must be able to access only a specific set of Google Cloud APIs, and no others. The security team wants to enforce this using IAM and access scopes. Which combination should they use?

Accepted Answer

Set the instance's access scopes to the specific APIs needed and grant the service account only the necessary IAM roles.. Access scopes and IAM roles together control what APIs an instance can access. Scopes set the maximum allowed APIs, while IAM roles grant specific permissions. To restrict an instance to a specific set of APIs, set the scopes to only those APIs and grant the service account only the IAM roles needed for those APIs. This layered approach ensures least privilege and meets the security requirement.

Answer

Disable all access scopes and rely solely on IAM roles to control API access.

Answer

Set the instance's access scopes to cloud-platform and grant the service account the Editor role.

Answer

Use the default access scopes and grant the service account the Viewer role.