Google ACE Setting Up a Cloud Solution Environment — 25 Questions

Question 1

A company wants to track costs for each department by using labels on resources. What is the next step after labeling resources to view costs per label?

Accepted Answer

View billing reports filtered by label. After labeling resources, the next step to view costs per label is to view billing reports filtered by that label. In Google Cloud, the Billing Reports page (and the Cost Table) allows you to filter and group costs by label, so you can see spend attributed to each department. This is the direct, built-in way to consume the label data you just applied.

Answer

Export billing to Cloud Storage and analyze

Answer

Create a billing account budget

Answer

Use the Cost Table in Cloud Console

Question 2

A junior engineer accidentally deleted a project. Later, they realize they need to restore it. What must be true for project deletion to be reversible?

Accepted Answer

The billing account must have been disabled before deletion. For a project to be successfully deleted, its associated billing account must first be disabled. Therefore, for a project to be in a 'pending deletion' state (and thus reversible), its billing account must have been disabled prior to deletion. Deleted projects are retained for 30 days and can be recovered during this period.

Answer

The user must have the Owner role at the organization level

Answer

The project must be within the first 7 days of creation

Answer

The project must not have any active resources

Question 3

A team wants to export GCP billing data for detailed analysis using SQL. Which three steps are necessary? (Choose THREE)

Accepted Answer

Create a BigQuery dataset. Option C (Create a BigQuery dataset) is correct because Cloud Billing export to BigQuery writes the detailed cost and usage data into a dataset that you must designate as the destination for the export. Option D (Set up billing export in the Cloud Console) is correct because the actual export configuration—selecting the BigQuery dataset and enabling standard or detailed usage cost export—is performed in the Billing section of the Cloud Console. Option E (Enable BigQuery API) is correct because the BigQuery API must be enabled on the project so that the billing export service can create and write to the BigQuery tables. Option A is not required because the Cloud Billing API is not a prerequisite for configuring BigQuery billing export, and Option B is not required because Cloud Storage is not used as the destination for BigQuery billing export.

Answer

Enable Cloud Billing API

Answer

Create a Cloud Storage bucket

Question 4

A team member accidentally deleted a GCP project. You need to recover it. What must be true for a successful recovery within the 30-day window?

Accepted Answer

The project can be restored within 30 days if you have the necessary permissions and the billing account is active.. A deleted project can be restored within 30 days only if the billing account is still active and you have the necessary permissions (e.g., `resourcemanager.projects.undelete`). The project must be undeleted via the Cloud Console or API. For the project to function correctly after undeletion, billing must be enabled; if billing was disabled before deletion, you must re-enable it first.

Answer

The project can be restored only if billing was disabled prior to deletion.

Answer

The billing account must be re-associated after undeletion.

Answer

The project can be restored only if it was deleted by the owner.

Question 5

You need to grant a user the ability to create and manage Compute Engine instances in a specific project. You want to follow the principle of least privilege. Which IAM role should you assign?

Accepted Answer

roles/compute.instanceAdmin.v1. roles/compute.instanceAdmin.v1 is the correct choice because it grants the necessary permissions to create, modify, and delete Compute Engine instances while excluding broader permissions like managing networks, firewalls, or IAM policies. This aligns with the principle of least privilege by providing only the access required for instance management. In contrast, roles/compute.admin includes additional permissions beyond instance management, such as managing disks, snapshots, and images, which are not needed here.

Answer

roles/compute.admin

Answer

roles/editor

Answer

roles/owner

Question 6

Your organization uses Cloud Identity to manage users. A new employee joins and needs access to a GCP project. What is the correct sequence to grant access?

Accepted Answer

Add the user to Cloud Identity, then grant the appropriate IAM role in the project.. The correct sequence is to first add the user to Cloud Identity (the identity provider), then grant the appropriate IAM role in the GCP project. Cloud Identity manages the user account and authentication, while IAM roles in GCP control authorization to resources. This ensures the user has a managed identity and the correct permissions.

Answer

Grant the user an IAM role directly; Cloud Identity is not required.

Answer

Create a service account for the user and grant roles to the service account.

Answer

Add the user to a Cloud Identity group, then grant the group an IAM role.

Question 7

You are configuring a new project and need to enable the Compute Engine API. However, the command 'gcloud services enable compute.googleapis.com' fails with a permission error. Your user has the role roles/editor on the project. What is the likely cause?

Accepted Answer

The project does not have a billing account associated.. The most likely cause is that the project lacks a billing account. In Google Cloud, enabling certain APIs—especially those that provision billable resources like Compute Engine—requires an active billing account linked to the project. Even with the Editor role, which includes the serviceusage.services.enable permission, the API enablement will fail if billing is not enabled. This is a common guardrail to prevent accidental resource creation without a payment method.

Answer

The Compute Engine API is already enabled.

Answer

The user needs to authenticate again.

Answer

The user does not have the serviceusage.services.enable permission.

Question 8

Your organization uses GCP organizations with multiple folders. You need to assign a team the ability to create projects only in a specific folder. Which THREE steps should you take? (Choose 3)

Accepted Answer

Grant the team the roles/resourcemanager.folderAdmin role on the folder.. To restrict project creation to a specific folder, you can grant the roles/resourcemanager.folderAdmin role on the folder (option C) or the more specific roles/resourcemanager.projectCreator role (option E). Both allow creating projects within that folder. Optionally, apply an organization policy (option D) to further restrict which folders can contain projects. Granting the projectCreator role at the organization level (option B) would allow creation in any folder, which is too permissive. The folderViewer role on the organization (option A) does not grant project creation ability.

Answer

Ensure the team has the role roles/resourcemanager.folderViewer on the organization.

Answer

Grant the role roles/resourcemanager.projectCreator at the organization level.

Question 9

You are setting up billing for a new GCP project. You want to receive an alert when the projected cost for the month exceeds 80% of your budget. You also want to be notified if the actual cost reaches 100%. Which budget alert thresholds should you set?

Accepted Answer

Set a single alert at 80% and another at 100%. GCP budget alerts are configured as threshold percentages of the budget amount, and each threshold triggers when either actual or forecasted spend crosses it. To be alerted when projected cost exceeds 80% and actual cost reaches 100%, you set two thresholds: 80% and 100%. The 80% alert fires on forecasted spend crossing 80%, and the 100% alert fires on actual spend reaching 100%.

Answer

Set a single alert at 100% and use the 'forecast' option to get projected cost alerts

Answer

Set alerts at 50%, 80%, and 100%

Answer

Set a single alert at 80% for projected cost; GCP automatically alerts at 100%

Question 10

You want to use gcloud CLI to set the default project to 'my-project' and the default compute zone to 'us-central1-a'. Which two gcloud config commands should you run?

Accepted Answer

gcloud config set project my-project and gcloud config set compute/zone us-central1-a. The commands are 'gcloud config set project my-project' and 'gcloud config set compute/zone us-central1-a'.

Answer

gcloud config configurations set project my-project and gcloud config configurations set zone us-central1-a

Answer

gcloud config set project my-project and gcloud config set zone us-central1-a

Answer

gcloud projects set my-project and gcloud compute zones set us-central1-a

Question 11

You want to set up a budget alert for a GCP project. You need to receive a notification when the forecasted cost exceeds $1000 and when the actual cost exceeds $1000. Which budget amount should you set?

Accepted Answer

$1000. GCP budget alerts are triggered as a percentage of the budget amount, and the default alert thresholds include 50%, 90%, and 100% of the budget. To receive notifications when both forecasted and actual costs exceed $1000, you set the budget amount to $1000; the 100% threshold then fires for both actual and forecasted spend crossing that value. Setting the budget to $1000 aligns the alert threshold directly with the $1000 target.

Answer

$2000

Answer

$100

Answer

$500

Question 12

You are designing a resource hierarchy for a company with three departments: Engineering, Sales, and HR. Each department should have its own projects, and policies should be applied at the department level. Which THREE steps should you take? (Choose three.)

Accepted Answer

Create a folder for each department. Option C is correct because an organization node is the root of the Google Cloud resource hierarchy and is required to group and govern all resources under the company, enabling folder-level policy inheritance. Option A is correct because creating a folder for each department (Engineering, Sales, HR) lets you apply IAM policies at the department level, and those policies are inherited by all projects and resources beneath each folder. Option D is correct because projects are the fundamental resource containers where services are enabled and resources are created, so each department needs its own project(s) under its folder to host its workloads. Option B is not correct because labels are metadata for organizing, filtering, and billing reporting, not for policy inheritance or hierarchical separation. Option E is not correct because applying IAM policies only at the project level contradicts the requirement to apply policies at the department level, which is achieved through folders.

Answer

Use labels to separate departments

Answer

Apply IAM policies at the project level only

Question 13

A company wants to organize its Google Cloud resources. They have multiple departments (Engineering, Finance, Marketing) and want to apply common policies at the department level. Which resource hierarchy level should they use to create folders for each department?

Accepted Answer

Organization node. Department-level folders are created directly under the Organization node, which serves as the root of the Google Cloud resource hierarchy. This allows for grouping projects and applying policies at the department level, as described in the stem.

Answer

Folder

Answer

Resource

Answer

Project

Question 14

A developer needs to authenticate to Google Cloud from their local machine to run application code that reads from Cloud Storage. They use a service account. Which gcloud command should they use to obtain application credentials?

Accepted Answer

gcloud auth activate-service-account --key-file=KEY_FILE. The gcloud auth activate-service-account --key-file=KEY_FILE command authenticates the gcloud CLI as the service account using its downloaded JSON key, which is the correct way to obtain credentials for application code running locally with a service account. This sets the active account to the service account so subsequent gcloud and client library calls use it.

Answer

gcloud auth login

Answer

gcloud config set account service-account@project.iam.gserviceaccount.com

Answer

gcloud auth application-default login

Question 15

An engineer tries to delete a project using the Cloud Console but the option is greyed out. The engineer has the Project Owner role. What is the most likely reason?

Accepted Answer

The engineer does not have proper permissions. While the Project Owner role typically grants `resourcemanager.projects.delete` permission, an Organization Policy constraint (e.g., `constraints/resourcemanager.deleteProject`) can be enforced at a higher level (Folder or Organization) that overrides project-level IAM permissions, effectively denying the ability to delete projects even for Project Owners. This would cause the delete option to be greyed out in the Cloud Console. In Google Cloud, you do not need to disable billing or unlink a billing account before deleting a project, nor do you need to delete active resources within the project first.

Answer

The billing account is disabled

Answer

The project has active resources

Answer

The billing account is still linked to the project

Question 16

A new engineer is setting up their GCP environment for the first time. They have a billing account and need to create a new project for development. What is the correct order of steps?

Accepted Answer

Create project → Associate billing account → Enable APIs. Given that the engineer already has a billing account, the first step is to create a new project. This project must then be associated with the existing billing account to enable paid services. Finally, specific APIs are enabled within the project as needed to use particular GCP services.

Answer

Enable APIs → Create billing account → Create project

Answer

Create project → Enable APIs → Associate billing account

Answer

Create billing account → Create project → Enable APIs

Question 17

You are a project owner and need to grant a colleague the ability to create and manage Compute Engine instances, but restrict them from deleting any resources. Which IAM role should you assign?

Accepted Answer

roles/compute.instanceAdmin.v1. The Compute Instance Admin role (roles/compute.instanceAdmin.v1) allows full management of instances including create, modify, and start/stop, but not delete. The Compute Admin role allows deletion. The Viewer role only allows read access. The Security Admin role is for managing security policies.

Answer

roles/compute.admin

Answer

roles/compute.securityAdmin

Answer

roles/compute.viewer

Question 18

You need to delete a Google Cloud project. What prerequisite must be met before the project can be deleted?

Accepted Answer

The billing account must be disabled for the project.. Before deleting a Google Cloud project, you must first disable the billing account associated with it. This ensures no outstanding charges occur. While the project must also be in the ACTIVE state (option D is a prerequisite), disabling billing is the specific action required before deletion. The other options are not required: IAM members do not need to be removed, and resources do not need to be deleted beforehand.

Answer

All IAM members must be removed from the project.

Answer

All resources in the project must be deleted.

Answer

The project must be in the ACTIVE state.

Question 19

A multinational corporation requires that all GCP resources across multiple projects are tagged with a key-value pair 'environment: production' and 'environment: development'. They want to enforce that any resource created without the appropriate label is automatically denied. How can this be achieved?

Accepted Answer

Use an organization policy constraint to require labels.. GCP Organization Policy constraints are the native mechanism for enforcing rules across all projects in an organization. Required labels are enforced with the predefined organization policy constraint 'constraints/gcp.requireLabels' (or a custom organization policy constraint), which specifies the label keys that must be present on resources. When a resource is created without the required 'environment' label, the policy denies the creation request. This is the only option that provides preventive, organization-wide enforcement, unlike Cloud Asset Inventory (detective), IAM conditions (not evaluated against resource labels at creation), or a custom IAM role (IAM roles grant permissions; they cannot express 'deny if label missing').

Answer

Use Cloud Asset Inventory to monitor and alert on missing labels.

Answer

Use IAM conditions to check labels at resource creation.

Answer

Create a custom IAM role that denies creation without labels.

Question 20

An organization wants to set up a budget alert for a GCP project. Which TWO options can be configured as alert thresholds?

Accepted Answer

50% of budget. GCP budget alerts allow thresholds based on a 'Percentage of budget' (e.g., 50%, 90%, 100%, 120%) for both actual and forecasted spend, and also based on a 'Specific amount' for both actual and forecasted spend. Therefore:
- Option A (50% of budget) is correct as a percentage-based threshold.
- Option B (Actual cost equals budget) is correct as a 100% actual cost percentage-based threshold.
- Option C (Forecasted spend exceeds budget) is correct as a 100% forecasted cost percentage-based threshold.
- Option D (Custom amount) is correct as a 'Specific amount' threshold.
The original explanation incorrectly states that 'Custom amount' is not a standard threshold type and contradicts itself by supporting '100% of budget' while marking option B as wrong.

Answer

Per-service cost exceeds $100