Google ACE Setting Up a Cloud Solution Environment Practice Test 2 — 15 Questions

Question 1

A new engineer is setting up their GCP environment for the first time. They have a billing account and need to create a new project for development. What is the correct order of steps?

Accepted Answer

Create project → Associate billing account → Enable APIs. Given that the engineer already has a billing account, the first step is to create a new project. This project must then be associated with the existing billing account to enable paid services. Finally, specific APIs are enabled within the project as needed to use particular GCP services.

Answer

Enable APIs → Create billing account → Create project

Answer

Create project → Enable APIs → Associate billing account

Answer

Create billing account → Create project → Enable APIs

Question 2

You are a project owner and need to grant a colleague the ability to create and manage Compute Engine instances, but restrict them from deleting any resources. Which IAM role should you assign?

Accepted Answer

roles/compute.instanceAdmin.v1. The Compute Instance Admin role (roles/compute.instanceAdmin.v1) allows full management of instances including create, modify, and start/stop, but not delete. The Compute Admin role allows deletion. The Viewer role only allows read access. The Security Admin role is for managing security policies.

Answer

roles/compute.admin

Answer

roles/compute.securityAdmin

Answer

roles/compute.viewer

Question 3

You need to delete a Google Cloud project. What prerequisite must be met before the project can be deleted?

Accepted Answer

The billing account must be disabled for the project.. Before deleting a Google Cloud project, you must first disable the billing account associated with it. This ensures no outstanding charges occur. While the project must also be in the ACTIVE state (option D is a prerequisite), disabling billing is the specific action required before deletion. The other options are not required: IAM members do not need to be removed, and resources do not need to be deleted beforehand.

Answer

All IAM members must be removed from the project.

Answer

All resources in the project must be deleted.

Answer

The project must be in the ACTIVE state.

Question 4

A multinational corporation requires that all GCP resources across multiple projects are tagged with a key-value pair 'environment: production' and 'environment: development'. They want to enforce that any resource created without the appropriate label is automatically denied. How can this be achieved?

Accepted Answer

Use an organization policy constraint to require labels.. GCP Organization Policy constraints are the native mechanism for enforcing rules across all projects in an organization. Required labels are enforced with the predefined organization policy constraint 'constraints/gcp.requireLabels' (or a custom organization policy constraint), which specifies the label keys that must be present on resources. When a resource is created without the required 'environment' label, the policy denies the creation request. This is the only option that provides preventive, organization-wide enforcement, unlike Cloud Asset Inventory (detective), IAM conditions (not evaluated against resource labels at creation), or a custom IAM role (IAM roles grant permissions; they cannot express 'deny if label missing').

Answer

Use Cloud Asset Inventory to monitor and alert on missing labels.

Answer

Use IAM conditions to check labels at resource creation.

Answer

Create a custom IAM role that denies creation without labels.

Question 5

An organization wants to set up a budget alert for a GCP project. Which TWO options can be configured as alert thresholds?

Accepted Answer

50% of budget. GCP budget alerts allow thresholds based on a 'Percentage of budget' (e.g., 50%, 90%, 100%, 120%) for both actual and forecasted spend, and also based on a 'Specific amount' for both actual and forecasted spend. Therefore:
- Option A (50% of budget) is correct as a percentage-based threshold.
- Option B (Actual cost equals budget) is correct as a 100% actual cost percentage-based threshold.
- Option C (Forecasted spend exceeds budget) is correct as a 100% forecasted cost percentage-based threshold.
- Option D (Custom amount) is correct as a 'Specific amount' threshold.
The original explanation incorrectly states that 'Custom amount' is not a standard threshold type and contradicts itself by supporting '100% of budget' while marking option B as wrong.

Answer

Per-service cost exceeds $100

Question 6

An organization is setting up a new GCP environment and needs to create a hierarchy that separates development, staging, and production workloads. Which two resources can be used to group projects for this purpose? (Choose TWO.)

Accepted Answer

Folder. Option D (Folder) is correct because folders are the GCP resource hierarchy node used to group projects (and sub-folders) under an organization, so you can place development, staging, and production projects into separate folders and apply IAM policies and org policies at that level. Option E (Organization) is correct because the organization is the root node of the GCP resource hierarchy that contains all folders and projects for the company, providing the top-level grouping under which the dev/staging/prod folders and their projects are organized. Option A (VPC) is incorrect because a VPC is a networking construct that hosts subnets and routes, not a resource-hierarchy container for projects. Option B (Project) is incorrect because a project is the resource being grouped, not a grouping mechanism for other projects. Option C (Cloud Identity) is incorrect because it is an identity and access management service for users and groups, not a resource-hierarchy node for grouping projects.

Answer

VPC

Answer

Project

Answer

Cloud Identity

Question 7

A company has multiple GCP projects and wants to enforce a policy that prevents the creation of VMs with public IP addresses. Which three methods can be used to enforce this restriction? (Choose THREE.)

Accepted Answer

Create a VPC with no default route to the internet and enforce using network tags. Three methods to enforce that no VMs have public IPs are: using an organization policy constraint (compute.vmExternalIpAccess), creating a VPC with no default route and using network tags to restrict external internet access, and using IAM conditions with a custom role that allows compute.instances.create only when the instance does not have an external IP (resource.hasExternalIp == false). Option E is not a valid method because IAM conditions cannot check for external IPs at instance creation; the attribute resource.hasExternalIp is not available during the create operation.

Answer

Create a custom IAM role that denies the `compute.instances.create` permission

Answer

Use a custom role with `compute.instances.create` and add a condition that checks for the absence of external IPs

Question 8

A developer needs to use gcloud CLI to manage multiple projects. They want to switch between configurations quickly. Which three commands are part of managing gcloud configuration profiles? (Choose THREE.)

Accepted Answer

gcloud config configurations activate. Option B, gcloud config configurations activate, is correct because it switches the active named configuration so subsequent gcloud commands use that profile's project, account, and other properties. Option C, gcloud config configurations list, is correct because it enumerates all named configurations and shows which one is currently active, which is essential for quickly choosing among multiple project profiles. Option D, gcloud config configurations create, is correct because it creates a new named configuration profile that can then be activated and populated with project-specific settings. Option A, gcloud config configurations export, is not a valid gcloud command for exporting configuration profiles, so it does not belong. Option E, gcloud config set project, changes the project property within the currently active configuration but does not itself manage configuration profiles, so it is not one of the three profile-management commands.

Answer

gcloud config configurations export

Answer

gcloud config set project

Question 9

A new engineer needs to set up the gcloud CLI on their local machine and authenticate with a user account. Which command should they run after installing the SDK?

Accepted Answer

gcloud init. The 'gcloud init' command is the standard way to initialize the gcloud CLI, authenticate with a user account, set the default project, and configure other initial settings. It walks the user through the authentication flow and sets up the local configuration for subsequent gcloud commands.

Answer

gcloud auth application-default login

Answer

gcloud config set account

Answer

gcloud auth login

Question 10

A startup wants to create a new GCP project for development. They've already created a billing account. Which command can they use to create the project?

Accepted Answer

gcloud projects create PROJECT_ID. The 'gcloud projects create' command creates a new project. The billing association is separate, but the project can be created without billing immediately.

Answer

gcloud config set project PROJECT_ID

Answer

gcloud alpha projects create

Answer

gcloud resource-manager projects create

Question 11

An organization wants to enforce a policy that disables the creation of VMs with external IPs across all projects. Which resource hierarchy level should the policy be attached to for maximum coverage?

Accepted Answer

Organization. To enforce a policy across all projects, the policy must be attached at the highest level in the resource hierarchy: the organization. Organization policies are inherited by all descendant resources (folders, projects, and VMs), ensuring uniform enforcement. Attaching at lower levels would not cover all projects unless applied individually, which is inefficient and error-prone.

Answer

Project

Answer

Resource (VM)

Answer

Folder

Question 12

An engineer needs to enable the Compute Engine API for a project using the CLI. Which command should they run?

Accepted Answer

gcloud services enable compute.googleapis.com. The correct command to enable a Google Cloud API for a project using the CLI is 'gcloud services enable compute.googleapis.com'. This command uses the 'gcloud services' command group, which manages API enablement, and requires the full service name (e.g., compute.googleapis.com). This is the standard and documented way to enable APIs.

Answer

gcloud compute enable

Answer

gcloud services enable compute

Answer

gcloud api enable compute.googleapis.com

Question 13

A team is using gcloud configurations to manage multiple projects. They want to create a new configuration for a production project. How can they achieve this?

Accepted Answer

Run 'gcloud config configurations create prod' then 'gcloud config set project prod-project'. The correct command sequence is 'gcloud config configurations create prod' followed by 'gcloud config set project prod-project'. This creates a new named configuration and sets the active project within it. The 'gcloud config configurations create' command is specifically designed for this purpose.

Answer

Run 'gcloud init' and select 'Create a new configuration'

Answer

Run 'gcloud config set project prod-project' with a flag to create new config

Answer

Edit the gcloud config file manually

Question 14

An organization needs to separate development, staging, and production environments using the GCP resource hierarchy. Which approach is most effective?

Accepted Answer

Create folders for dev, staging, and prod under the organization, then place projects in each folder. Folders under the organization node allow you to group projects by environment and apply IAM policies and organizational policies at the folder level, which are inherited by all projects within. This creates a clean separation of dev, staging, and prod while enabling centralized governance. It is the most effective use of the GCP resource hierarchy for environment isolation.

Answer

Use labels on projects to denote environment, but keep all in one folder

Answer

Create separate projects for each environment without folders

Answer

Create a single project and use separate VPC networks per environment

Question 15

A Cloud Shell user wants to persist Terraform state files across sessions. What is the best approach?

Accepted Answer

Store them in the home directory ($HOME). In Google Cloud Shell, the home directory ($HOME) is persistent across sessions, while other locations like /tmp are ephemeral and cleared when the session ends. Storing Terraform state files in $HOME ensures they persist and are available in subsequent Cloud Shell sessions without additional setup.

Answer

Store them in /tmp

Answer

Store them in a Cloud Storage bucket and mount via gcsfuse

Answer

Store them on the instance's local SSD