Google ACE Setting Up a Cloud Solution Environment Practice Test 2 — 15 Questions

Question 1

A new engineer wants to set up their local environment to interact with Google Cloud. Which command initializes the gcloud CLI and configures the project, region, and zone?

Accepted Answer

gcloud init. The 'gcloud init' command initializes the SDK, sets default project, region, and zone interactively. 'gcloud auth login' only handles authentication. 'gcloud config set' sets individual properties but doesn't initialize. 'gcloud auth application-default login' is for application default credentials.

Answer

gcloud auth login

Answer

gcloud auth application-default login

Answer

gcloud config set project my-project

Question 2

Your organization has multiple Google Cloud projects. You want to separate development and production environments. Which resource hierarchy structure is recommended?

Accepted Answer

Use folders under the organization node to separate dev and prod projects.. Using folders under an organization node allows grouping projects by environment. Folders support IAM policies and org policies, enabling environment separation. Projects alone cannot nest; folders provide the logical grouping.

Answer

Create two separate organizations.

Answer

Use labels on projects to differentiate environments.

Answer

Use a single project with separate VPC networks.

Question 3

A team member accidentally deleted a GCP project. You need to recover it. What must be true for a successful recovery within the 30-day window?

Accepted Answer

The project can be restored within 30 days if you have the necessary permissions and the billing account is active.. A deleted project can be restored within 30 days only if the billing account is still active and you have ownership. The project must be undeleted via the Cloud Console or API. Billing must be enabled; if billing was disabled before deletion, you must re-enable it first.

Answer

The project can be restored only if billing was disabled prior to deletion.

Answer

The billing account must be re-associated after undeletion.

Answer

The project can be restored only if it was deleted by the owner.

Question 4

You want to enable the Kubernetes Engine API for your project using the command line. Which gcloud command should you use?

Accepted Answer

gcloud services enable container.googleapis.com. 'gcloud services enable container.googleapis.com' enables the required API. 'gcloud auth login' authenticates. 'gcloud config set' sets project. 'gcloud container clusters create' creates a cluster but doesn't enable the API.

Answer

gcloud container clusters create my-cluster

Answer

gcloud config set project my-project

Answer

gcloud auth login

Question 5

You need to grant a user the ability to create and manage Compute Engine instances in a specific project. You want to follow the principle of least privilege. Which IAM role should you assign?

Accepted Answer

roles/compute.instanceAdmin.v1. roles/compute.instanceAdmin.v1 provides full control over Compute Engine instances but not other services. roles/editor is broader. roles/owner is too permissive. roles/compute.admin includes all compute resources, not just instances.

Answer

roles/compute.admin

Answer

roles/editor

Answer

roles/owner

Question 6

Your organization wants to enforce that all Compute Engine instances are created only in us-central1 and europe-west1. You need to implement this constraint across all projects in the organization. What should you do?

Accepted Answer

Apply an organization policy with constraint gcp.resourceLocations to allow only us-central1 and europe-west1.. Organization policies can enforce constraints on resource locations. The constraint 'gcp.resourceLocations' restricts allowed locations. You set this at the organization level so it applies to all projects. IAM roles don't enforce location. VPC Service Controls control data exfiltration, not location restrictions. Labels don't enforce location.

Answer

Use VPC Service Controls to restrict access to Compute Engine API from other regions.

Answer

Use labels to tag instances and run a script to delete non-compliant ones.

Answer

Create an IAM policy denying the compute.instances.create permission in all other regions.

Question 7

Your company wants to track costs per department. Each department has its own project. You need to set up a budget alert in the billing account for each project. What is the most efficient approach?

Accepted Answer

Create one budget per project by selecting the project in the 'Scoped to' field.. You can create budgets at the billing account level with scoped projects. This allows one budget per project. Creating budgets per project individually is manual. Using labels requires tagging resources. Billing export to BigQuery is for analysis, not alerts.

Answer

Use Billing Export to BigQuery and create custom alerts using Cloud Monitoring.

Answer

Create a budget for each project by manually enabling billing for each project.

Answer

Create a single budget for the entire billing account and rely on labels.

Question 8

You are using Cloud Shell and need to access a file you created two weeks ago. What is the persistence behavior of Cloud Shell home directories?

Accepted Answer

Cloud Shell home directories persist across sessions, with 5 GB of storage.. Cloud Shell provides 5 GB of persistent home storage backed by Cloud Filestore or persistent disk. It persists across sessions, even if Cloud Shell is idle. However, it is not backed up; if the instance is reset, data may be lost. But under normal use, data persists.

Answer

Cloud Shell home directories are stored in Cloud Storage and are always available.

Answer

Cloud Shell home directories persist for 30 days after last use.

Answer

Cloud Shell home directories are temporary and are deleted after each session.

Question 9

Your organization uses Cloud Identity to manage users. A new employee joins and needs access to a GCP project. What is the correct sequence to grant access?

Accepted Answer

Add the user to Cloud Identity, then grant the appropriate IAM role in the project.. First, you add the user to Cloud Identity (if not already there). Then, in the GCP project, you grant an IAM role to the user. Cloud Identity provides the user account; IAM grants permissions. You cannot skip adding to Cloud Identity.

Answer

Grant the user an IAM role directly; Cloud Identity is not required.

Answer

Create a service account for the user and grant roles to the service account.

Answer

Add the user to a Cloud Identity group, then grant the group an IAM role.

Question 10

You are configuring a new project and need to enable the Compute Engine API. However, the command 'gcloud services enable compute.googleapis.com' fails with a permission error. Your user has the role roles/editor on the project. What is the likely cause?

Accepted Answer

The project does not have a billing account associated.. The role roles/editor includes serviceusage.services.enable permission, so it should work. However, if the organization has an org policy 'constraints/compute.restrictResourceCreation' that restricts API usage, it might block. But the most common issue is that the project is new and the billing account is not associated, preventing API enablement. Editor role has permission, but billing must be active.

Answer

The Compute Engine API is already enabled.

Answer

The user needs to authenticate again.

Answer

The user does not have the serviceusage.services.enable permission.

Question 11

You need to list all projects in your organization using the gcloud CLI. Which command is correct?

Accepted Answer

gcloud projects list. 'gcloud projects list' lists projects accessible to the authenticated user. To list all projects in an organization, you need the --filter or use organizations. But 'gcloud projects list' with appropriate permissions shows all projects. The other commands are incorrect: 'gcloud config list' shows config, 'gcloud compute projects list' doesn't exist, 'gcloud resource-manager projects list' is not a command.

Answer

gcloud compute projects list

Answer

gcloud config list

Answer

gcloud resource-manager projects list

Question 12

You want to switch between multiple GCP projects frequently using the gcloud CLI. What is the recommended approach?

Accepted Answer

Create multiple configuration profiles and activate them as needed.. Configuration profiles (gcloud config configurations) allow you to create named configurations with different project, region, and zone settings. You can activate one with 'gcloud config configurations activate'. Setting individual properties each time is error-prone. Running gcloud init each time is slow. Using separate terminals isn't efficient.

Answer

Open separate terminal windows for each project.

Answer

Run gcloud init every time you switch projects.

Answer

Use gcloud config set project each time you switch.

Question 13

Your company has a production project and a development project. You want to ensure that no one can delete the production project accidentally. Which TWO actions should you take? (Choose 2)

Accepted Answer

Apply an organization policy constraint that blocks project deletion.. To prevent accidental deletion, you can set a deletion protection policy at the project level. Additionally, using an organization policy constraint 'constraints/resourcemanager.projectDelete' at the folder or organization level can block deletion. Labels don't prevent deletion. Removing the Owner role from all users would break management. Budget alerts don't prevent deletion.

Answer

Set a budget alert at 100% of projected spend.

Answer

Remove the Owner role from all users and grant only Editor.

Answer

Add a label to the project indicating it is production.

Question 14

You are setting up a new GCP project for a microservices application. You need to select which APIs to enable. Which THREE APIs are likely required? (Choose 3)

Accepted Answer

cloudbuild.googleapis.com. For a microservices application on Kubernetes, you need the Kubernetes Engine API (container.googleapis.com), and often the Cloud Build API (cloudbuild.googleapis.com) for CI/CD and Compute Engine API (compute.googleapis.com) as a dependency for GKE. Cloud Storage API is not necessarily required unless using Cloud Storage. BigQuery is for analytics.

Answer

storage.googleapis.com

Answer

bigquery.googleapis.com

Question 15

Your organization uses GCP organizations with multiple folders. You need to assign a team the ability to create projects only in a specific folder. Which THREE steps should you take? (Choose 3)

Accepted Answer

Optionally apply an organization policy to restrict which folders can contain projects.. To restrict project creation to a specific folder, you grant the roles/resourcemanager.projectCreator role at the folder level. Additionally, you may need to grant the role on the organization for the folder to exist. Also, setting an organization policy to constrain where projects can be created (e.g., gcp.resourceLocations) is optional but recommended. Granting at organization level would give access to all folders. Creating a custom role is unnecessary.

Answer

Ensure the team has the role roles/resourcemanager.folderViewer on the organization.

Answer

Grant the role roles/resourcemanager.projectCreator at the organization level.

Answer

Grant the team the roles/resourcemanager.folderAdmin role on the folder.