Google ACE Setting Up a Cloud Solution Environment — 25 Questions

Question 1

A junior engineer accidentally deleted a project. Later, they realize they need to restore it. What must be true for project deletion to be reversible?

Accepted Answer

The billing account must have been disabled before deletion. For a project to be successfully deleted, its associated billing account must first be disabled. Therefore, for a project to be in a 'pending deletion' state (and thus reversible), its billing account must have been disabled prior to deletion. Deleted projects are retained for 30 days and can be recovered during this period.

Answer

The user must have the Owner role at the organization level

Answer

The project must be within the first 7 days of creation

Answer

The project must not have any active resources

Question 2

A team member accidentally deleted a GCP project. You need to recover it. What must be true for a successful recovery within the 30-day window?

Accepted Answer

The project can be restored within 30 days if you have the necessary permissions and the billing account is active.. A deleted project can be restored within 30 days only if the billing account is still active and you have the necessary permissions (e.g., `resourcemanager.projects.undelete`). The project must be undeleted via the Cloud Console or API. For the project to function correctly after undeletion, billing must be enabled; if billing was disabled before deletion, you must re-enable it first.

Answer

The project can be restored only if billing was disabled prior to deletion.

Answer

The billing account must be re-associated after undeletion.

Answer

The project can be restored only if it was deleted by the owner.

Question 3

Your organization uses GCP organizations with multiple folders. You need to assign a team the ability to create projects only in a specific folder. Which THREE steps should you take? (Choose 3)

Accepted Answer

Grant the team the roles/resourcemanager.folderAdmin role on the folder.. To restrict project creation to a specific folder, you can grant the roles/resourcemanager.folderAdmin role on the folder (option C) or the more specific roles/resourcemanager.projectCreator role (option E). Both allow creating projects within that folder. Optionally, apply an organization policy (option D) to further restrict which folders can contain projects. Granting the projectCreator role at the organization level (option B) would allow creation in any folder, which is too permissive. The folderViewer role on the organization (option A) does not grant project creation ability.

Answer

Ensure the team has the role roles/resourcemanager.folderViewer on the organization.

Answer

Grant the role roles/resourcemanager.projectCreator at the organization level.

Question 4

An organization wants to separate its development and production environments using Google Cloud resource hierarchy. What is the recommended approach?

Accepted Answer

Create two folders under the organization node, one for dev and one for prod.. The recommended approach is to create two folders under the organization node, one for development and one for production. This allows for separate IAM policies and organization policies, providing isolation between environments. Using a single project with separate VPC networks is not recommended because it still shares the same project-level policies. Creating two organizations is overly complex and unnecessary. Using labels within a single project does not provide the same level of isolation as folders.

Answer

Create a single project and use separate VPC networks for dev and prod.

Answer

Create two separate organizations, one for dev and one for prod.

Answer

Create two projects under the same folder and use labels to differentiate dev and prod.

Question 5

You want to set up a budget alert for a GCP project. You need to receive a notification when the forecasted cost exceeds $1000 and when the actual cost exceeds $1000. Which budget amount should you set?

Accepted Answer

$1000. Set the budget amount to $1000. Then configure alert thresholds at 100% for both forecasted and actual costs. This triggers the alert when either the forecasted or actual cost exceeds $1000.

Answer

$2000

Answer

$100

Answer

$500

Question 6

A company wants to organize its Google Cloud resources. They have multiple departments (Engineering, Finance, Marketing) and want to apply common policies at the department level. Which resource hierarchy level should they use to create folders for each department?

Accepted Answer

Organization node. Department-level folders are created directly under the Organization node, which serves as the root of the Google Cloud resource hierarchy. This allows for grouping projects and applying policies at the department level, as described in the stem.

Answer

Folder

Answer

Resource

Answer

Project

Question 7

An engineer tries to delete a project using the Cloud Console but the option is greyed out. The engineer has the Project Owner role. What is the most likely reason?

Accepted Answer

The engineer does not have proper permissions. While the Project Owner role typically grants `resourcemanager.projects.delete` permission, an Organization Policy constraint (e.g., `constraints/resourcemanager.deleteProject`) can be enforced at a higher level (Folder or Organization) that overrides project-level IAM permissions, effectively denying the ability to delete projects even for Project Owners. This would cause the delete option to be greyed out in the Cloud Console. In Google Cloud, you do not need to disable billing or unlink a billing account before deleting a project, nor do you need to delete active resources within the project first.

Answer

The billing account is disabled

Answer

The project has active resources

Answer

The billing account is still linked to the project

Question 8

A new engineer is setting up their GCP environment for the first time. They have a billing account and need to create a new project for development. What is the correct order of steps?

Accepted Answer

Create project → Associate billing account → Enable APIs. Given that the engineer already has a billing account, the first step is to create a new project. This project must then be associated with the existing billing account to enable paid services. Finally, specific APIs are enabled within the project as needed to use particular GCP services.

Answer

Enable APIs → Create billing account → Create project

Answer

Create project → Enable APIs → Associate billing account

Answer

Create billing account → Create project → Enable APIs

Question 9

You are a project owner and need to grant a colleague the ability to create and manage Compute Engine instances, but restrict them from deleting any resources. Which IAM role should you assign?

Accepted Answer

roles/compute.instanceAdmin.v1. The Compute Instance Admin role (roles/compute.instanceAdmin.v1) allows full management of instances including create, modify, and start/stop, but not delete. The Compute Admin role allows deletion. The Viewer role only allows read access. The Security Admin role is for managing security policies.

Answer

roles/compute.admin

Answer

roles/compute.securityAdmin

Answer

roles/compute.viewer

Question 10

A company wants to track costs by department and project. They have multiple GCP projects used by different teams. Which feature should they use to categorize costs?

Accepted Answer

Labels. Labels are key-value pairs that can be attached to resources to organize and track costs by department or project. Budgets and alerts notify when spending exceeds thresholds but do not categorize costs. Billing export to BigQuery is for exporting billing data for analysis, not for direct categorization. Custom IAM roles are for managing permissions, not cost tracking.

Answer

Budgets and alerts

Answer

Billing export to BigQuery

Answer

Custom IAM roles

Question 11

You need to delete a Google Cloud project. What prerequisite must be met before the project can be deleted?

Accepted Answer

The billing account must be disabled for the project.. Before deleting a Google Cloud project, you must first disable the billing account associated with it. This ensures no outstanding charges occur. While the project must also be in the ACTIVE state (option D is a prerequisite), disabling billing is the specific action required before deletion. The other options are not required: IAM members do not need to be removed, and resources do not need to be deleted beforehand.

Answer

All IAM members must be removed from the project.

Answer

All resources in the project must be deleted.

Answer

The project must be in the ACTIVE state.

Question 12

An organization wants to set up a budget alert for a GCP project. Which TWO options can be configured as alert thresholds?

Accepted Answer

50% of budget. GCP budget alerts allow thresholds based on a 'Percentage of budget' (e.g., 50%, 90%, 100%, 120%) for both actual and forecasted spend, and also based on a 'Specific amount' for both actual and forecasted spend. Therefore:
- Option A (50% of budget) is correct as a percentage-based threshold.
- Option B (Actual cost equals budget) is correct as a 100% actual cost percentage-based threshold.
- Option C (Forecasted spend exceeds budget) is correct as a 100% forecasted cost percentage-based threshold.
- Option D (Custom amount) is correct as a 'Specific amount' threshold.
The original explanation incorrectly states that 'Custom amount' is not a standard threshold type and contradicts itself by supporting '100% of budget' while marking option B as wrong.

Answer

Per-service cost exceeds $100

Question 13

An engineer needs to enable the Cloud Build API and the Kubernetes Engine API for a project. Which TWO commands should they run?

Accepted Answer

gcloud services enable cloudbuild.googleapis.com. The question asks for two commands to enable the Cloud Build API and the Kubernetes Engine API. Option A enables the Cloud Build API, and option B enables the Kubernetes Engine API (container.googleapis.com). Option E also enables the Cloud Build API but is redundant with option A, so only two commands (A and B) are needed. Options C and D use incorrect service names.

Answer

gcloud services enable compute.googleapis.com

Answer

gcloud services enable kubernetes-engine.googleapis.com

Answer

gcloud services enable cloudbuild.googleapis.com --project=my-project

Question 14

An organization is setting up a new GCP environment and needs to create a hierarchy that separates development, staging, and production workloads. Which two resources can be used to group projects for this purpose? (Choose TWO.)

Accepted Answer

Folder. In GCP, both Folders and the Organization node can be used to group projects. Folders contain projects and subfolders, while the Organization node is the root container that holds all projects and folders. A Project itself is the basic resource container, not a grouping element for other projects.

Answer

VPC

Answer

Project

Answer

Cloud Identity

Question 15

A company has multiple GCP projects and wants to enforce a policy that prevents the creation of VMs with public IP addresses. Which three methods can be used to enforce this restriction? (Choose THREE.)

Accepted Answer

Create a VPC with no default route to the internet and enforce using network tags. Three methods to enforce that no VMs have public IPs are: using an organization policy constraint (compute.vmExternalIpAccess), creating a VPC with no default route and using network tags to restrict external internet access, and using IAM conditions with a custom role that allows compute.instances.create only when the instance does not have an external IP (resource.hasExternalIp == false). Option E is not a valid method because IAM conditions cannot check for external IPs at instance creation; the attribute resource.hasExternalIp is not available during the create operation.

Answer

Create a custom IAM role that denies the `compute.instances.create` permission

Answer

Use a custom role with `compute.instances.create` and add a condition that checks for the absence of external IPs

Question 16

A new engineer needs to set up the gcloud CLI on their local machine and authenticate with a user account. Which command should they run after installing the SDK?

Accepted Answer

gcloud init. The 'gcloud init' command initializes the SDK, sets properties, and runs auth login. Alternatively, 'gcloud auth login' only authenticates without setting project/defaults.

Answer

gcloud auth application-default login

Answer

gcloud config set account

Answer

gcloud auth login

Question 17

A startup wants to create a new GCP project for development. They've already created a billing account. Which command can they use to create the project?

Accepted Answer

gcloud projects create PROJECT_ID. The 'gcloud projects create' command creates a new project. The billing association is separate, but the project can be created without billing immediately.

Answer

gcloud config set project PROJECT_ID

Answer

gcloud alpha projects create

Answer

gcloud resource-manager projects create

Question 18

An organization wants to enforce a policy that disables the creation of VMs with external IPs across all projects. Which resource hierarchy level should the policy be attached to for maximum coverage?

Accepted Answer

Organization. Organization policies can be applied at the organization level to affect all projects and folders underneath. This ensures the policy covers all resources.

Answer

Project

Answer

Resource (VM)

Answer

Folder

Question 19

A company wants to track costs for each department by using labels on resources. What is the next step after labeling resources to view costs per label?

Accepted Answer

View billing reports filtered by label. Labels are key-value pairs attached to resources. To view cost breakdown, you can use billing reports or export to BigQuery and query by label.

Answer

Export billing to Cloud Storage and analyze

Answer

Create a billing account budget

Answer

Use the Cost Table in Cloud Console

Question 20

An engineer needs to enable the Compute Engine API for a project using the CLI. Which command should they run?

Accepted Answer

gcloud services enable compute.googleapis.com. The 'gcloud services enable' command enables APIs in a project. The service name for Compute Engine is compute.googleapis.com.

Answer

gcloud compute enable

Answer

gcloud services enable compute

Answer

gcloud api enable compute.googleapis.com