Google ACE Setting Up a Cloud Solution Environment — 20 Questions

Question 1

A new engineer needs to set up the gcloud CLI on their local machine and authenticate with a user account. Which command should they run after installing the SDK?

Accepted Answer

gcloud init. The 'gcloud init' command initializes the SDK, sets properties, and runs auth login. Alternatively, 'gcloud auth login' only authenticates without setting project/defaults.

Answer

gcloud auth application-default login

Answer

gcloud config set account

Answer

gcloud auth login

Question 2

A startup wants to create a new GCP project for development. They've already created a billing account. Which command can they use to create the project?

Accepted Answer

gcloud projects create PROJECT_ID. The 'gcloud projects create' command creates a new project. The billing association is separate, but the project can be created without billing immediately.

Answer

gcloud config set project PROJECT_ID

Answer

gcloud alpha projects create

Answer

gcloud resource-manager projects create

Question 3

An organization wants to enforce a policy that disables the creation of VMs with external IPs across all projects. Which resource hierarchy level should the policy be attached to for maximum coverage?

Accepted Answer

Organization. Organization policies can be applied at the organization level to affect all projects and folders underneath. This ensures the policy covers all resources.

Answer

Project

Answer

Resource (VM)

Answer

Folder

Question 4

A company wants to track costs for each department by using labels on resources. What is the next step after labeling resources to view costs per label?

Accepted Answer

View billing reports filtered by label. Labels are key-value pairs attached to resources. To view cost breakdown, you can use billing reports or export to BigQuery and query by label.

Answer

Export billing to Cloud Storage and analyze

Answer

Create a billing account budget

Answer

Use the Cost Table in Cloud Console

Question 5

An engineer needs to enable the Compute Engine API for a project using the CLI. Which command should they run?

Accepted Answer

gcloud services enable compute.googleapis.com. The 'gcloud services enable' command enables APIs in a project. The service name for Compute Engine is compute.googleapis.com.

Answer

gcloud compute enable

Answer

gcloud services enable compute

Answer

gcloud api enable compute.googleapis.com

Question 6

A team is using gcloud configurations to manage multiple projects. They want to create a new configuration for a production project. How can they achieve this?

Accepted Answer

Run 'gcloud config configurations create prod' then 'gcloud config set project prod-project'. Manage configurations with 'gcloud config configurations create' and then set properties. Switching is done with 'gcloud config configurations activate'.

Answer

Run 'gcloud init' and select 'Create a new configuration'

Answer

Run 'gcloud config set project prod-project' with a flag to create new config

Answer

Edit the gcloud config file manually

Question 7

A junior engineer accidentally deleted a project. Later, they realize they need to restore it. What must be true for project deletion to be reversible?

Accepted Answer

The billing account must have been disabled before deletion. Deleted projects are retained for 30 days and can be recovered if the billing account is not disabled. However, deletion requires billing to be disabled first as a safety measure.

Answer

The user must have the Owner role at the organization level

Answer

The project must be within the first 7 days of creation

Answer

The project must not have any active resources

Question 8

An organization needs to separate development, staging, and production environments using the GCP resource hierarchy. Which approach is most effective?

Accepted Answer

Create folders for dev, staging, and prod under the organization, then place projects in each folder. Using folders under the organization node allows isolating environments, and organization policies can be applied at the folder level for governance.

Answer

Use labels on projects to denote environment, but keep all in one folder

Answer

Create separate projects for each environment without folders

Answer

Create a single project and use separate VPC networks per environment

Question 9

A Cloud Shell user wants to persist Terraform state files across sessions. What is the best approach?

Accepted Answer

Store them in the home directory ($HOME). Cloud Shell provides a persistent 5GB home directory. Storing state files there ensures they persist across sessions.

Answer

Store them in /tmp

Answer

Store them in a Cloud Storage bucket and mount via gcsfuse

Answer

Store them on the instance's local SSD

Question 10

An administrator wants to set up a budget alert that triggers at 50%, 90%, and 100% of the monthly spending limit. What is the correct way to configure this?

Accepted Answer

Create one budget with three threshold rules: 50%, 90%, 100%. Budget alerts can have multiple threshold rules with different percentages. You can create a single budget with three threshold rules.

Answer

Create a budget with a single threshold of 100% and rely on Cloud Monitoring

Answer

Use Cloud Billing reports to manually track

Answer

Create three separate budgets, each with a single threshold

Question 11

An engineer is setting up Cloud Identity for a new domain. What is a prerequisite for creating a Cloud Identity account?

Accepted Answer

Domain verification. Cloud Identity requires domain verification to prove ownership. This is done via DNS TXT record or other methods.

Answer

A G Suite account

Answer

A billing account

Answer

An existing Google Cloud project

Question 12

A company wants to grant a contractor read-only access to all Compute Engine instances in a specific project, but no other resources. Which IAM role should be assigned?

Accepted Answer

roles/compute.viewer. Predefined roles like 'compute.viewer' provide read-only access to Compute Engine resources. The basic 'Viewer' role would also grant read access to other services, which is not desired.

Answer

roles/compute.instanceAdmin.v1

Answer

roles/viewer

Answer

roles/iam.securityReviewer

Question 13

A company wants to set up a new GCP project and ensure that only approved APIs can be used. Which two steps should they take? (Choose TWO)

Accepted Answer

Use an organization policy to restrict the set of allowed APIs. To restrict API usage, you can disable unapproved APIs and use organization policies to enforce restrictions.

Answer

Create a custom role with permissions to enable APIs

Answer

Set a budget to limit API usage costs

Answer

Assign the Owner role to the project

Question 14

An engineer needs to choose a location for a new GCP project's resources to maximize availability and minimize latency for users in Europe and Asia. Which three actions should they take? (Choose THREE)

Accepted Answer

Use a global load balancer to distribute traffic. Using multiple regions, load balancing, and a global resource like Cloud CDN can help achieve high availability and low latency.

Answer

Set the project default region to us-central1

Answer

Use a single zone in europe-west1 for simplicity

Question 15

A team wants to export GCP billing data for detailed analysis using SQL. Which three steps are necessary? (Choose THREE)

Accepted Answer

Create a BigQuery dataset. Billing export to BigQuery requires enabling BigQuery, creating a dataset, and configuring the export from billing.

Answer

Enable Cloud Billing API

Answer

Create a Cloud Storage bucket

Question 16

A new engineer wants to set up their local environment to interact with Google Cloud. Which command initializes the gcloud CLI and configures the project, region, and zone?

Accepted Answer

gcloud init. The 'gcloud init' command initializes the SDK, sets default project, region, and zone interactively. 'gcloud auth login' only handles authentication. 'gcloud config set' sets individual properties but doesn't initialize. 'gcloud auth application-default login' is for application default credentials.

Answer

gcloud auth login

Answer

gcloud auth application-default login

Answer

gcloud config set project my-project

Question 17

Your organization has multiple Google Cloud projects. You want to separate development and production environments. Which resource hierarchy structure is recommended?

Accepted Answer

Use folders under the organization node to separate dev and prod projects.. Using folders under an organization node allows grouping projects by environment. Folders support IAM policies and org policies, enabling environment separation. Projects alone cannot nest; folders provide the logical grouping.

Answer

Create two separate organizations.

Answer

Use labels on projects to differentiate environments.

Answer

Use a single project with separate VPC networks.

Question 18

A team member accidentally deleted a GCP project. You need to recover it. What must be true for a successful recovery within the 30-day window?

Accepted Answer

The project can be restored within 30 days if you have the necessary permissions and the billing account is active.. A deleted project can be restored within 30 days only if the billing account is still active and you have ownership. The project must be undeleted via the Cloud Console or API. Billing must be enabled; if billing was disabled before deletion, you must re-enable it first.

Answer

The project can be restored only if billing was disabled prior to deletion.

Answer

The billing account must be re-associated after undeletion.

Answer

The project can be restored only if it was deleted by the owner.

Question 19

You want to enable the Kubernetes Engine API for your project using the command line. Which gcloud command should you use?

Accepted Answer

gcloud services enable container.googleapis.com. 'gcloud services enable container.googleapis.com' enables the required API. 'gcloud auth login' authenticates. 'gcloud config set' sets project. 'gcloud container clusters create' creates a cluster but doesn't enable the API.

Answer

gcloud container clusters create my-cluster

Answer

gcloud config set project my-project

Answer

gcloud auth login

Question 20

You need to grant a user the ability to create and manage Compute Engine instances in a specific project. You want to follow the principle of least privilege. Which IAM role should you assign?

Accepted Answer

roles/compute.instanceAdmin.v1. roles/compute.instanceAdmin.v1 provides full control over Compute Engine instances but not other services. roles/editor is broader. roles/owner is too permissive. roles/compute.admin includes all compute resources, not just instances.

Answer

roles/compute.admin

Answer

roles/editor

Answer

roles/owner