Google ACE Setting Up a Cloud Solution Environment Practice Test 3 — 15 Questions

Question 1

Your organization has multiple Google Cloud projects. You want to separate development and production environments. Which resource hierarchy structure is recommended?

Accepted Answer

Use folders under the organization node to separate dev and prod projects.. Using folders under an organization node allows grouping projects by environment. Folders support IAM policies and org policies, enabling environment separation. Projects alone cannot nest; folders provide the logical grouping.

Answer

Create two separate organizations.

Answer

Use labels on projects to differentiate environments.

Answer

Use a single project with separate VPC networks.

Question 2

You want to enable the Kubernetes Engine API for your project using the command line. Which gcloud command should you use?

Accepted Answer

gcloud services enable container.googleapis.com. 'gcloud services enable container.googleapis.com' enables the required API. 'gcloud auth login' authenticates. 'gcloud config set' sets project. 'gcloud container clusters create' creates a cluster but doesn't enable the API.

Answer

gcloud container clusters create my-cluster

Answer

gcloud config set project my-project

Answer

gcloud auth login

Question 3

You need to grant a user the ability to create and manage Compute Engine instances in a specific project. You want to follow the principle of least privilege. Which IAM role should you assign?

Accepted Answer

roles/compute.instanceAdmin.v1. roles/compute.instanceAdmin.v1 provides full control over Compute Engine instances but not other services. roles/editor is broader. roles/owner is too permissive. roles/compute.admin includes all compute resources, not just instances.

Answer

roles/compute.admin

Answer

roles/editor

Answer

roles/owner

Question 4

Your organization wants to enforce that all Compute Engine instances are created only in us-central1 and europe-west1. You need to implement this constraint across all projects in the organization. What should you do?

Accepted Answer

Apply an organization policy with constraint gcp.resourceLocations to allow only us-central1 and europe-west1.. Organization policies can enforce constraints on resource locations. The constraint 'gcp.resourceLocations' restricts allowed locations. You set this at the organization level so it applies to all projects. IAM roles don't enforce location. VPC Service Controls control data exfiltration, not location restrictions. Labels don't enforce location.

Answer

Use VPC Service Controls to restrict access to Compute Engine API from other regions.

Answer

Use labels to tag instances and run a script to delete non-compliant ones.

Answer

Create an IAM policy denying the compute.instances.create permission in all other regions.

Question 5

Your company wants to track costs per department. Each department has its own project. You need to set up a budget alert in the billing account for each project. What is the most efficient approach?

Accepted Answer

Create one budget per project by selecting the project in the 'Scoped to' field.. You can create budgets at the billing account level with scoped projects. This allows one budget per project. Creating budgets per project individually is manual. Using labels requires tagging resources. Billing export to BigQuery is for analysis, not alerts.

Answer

Use Billing Export to BigQuery and create custom alerts using Cloud Monitoring.

Answer

Create a budget for each project by manually enabling billing for each project.

Answer

Create a single budget for the entire billing account and rely on labels.

Question 6

You are using Cloud Shell and need to access a file you created two weeks ago. What is the persistence behavior of Cloud Shell home directories?

Accepted Answer

Cloud Shell home directories persist across sessions, with 5 GB of storage.. Cloud Shell provides 5 GB of persistent home storage backed by Cloud Filestore or persistent disk. It persists across sessions, even if Cloud Shell is idle. However, it is not backed up; if the instance is reset, data may be lost. But under normal use, data persists.

Answer

Cloud Shell home directories are stored in Cloud Storage and are always available.

Answer

Cloud Shell home directories persist for 30 days after last use.

Answer

Cloud Shell home directories are temporary and are deleted after each session.

Question 7

Your organization uses Cloud Identity to manage users. A new employee joins and needs access to a GCP project. What is the correct sequence to grant access?

Accepted Answer

Add the user to Cloud Identity, then grant the appropriate IAM role in the project.. First, you add the user to Cloud Identity (if not already there). Then, in the GCP project, you grant an IAM role to the user. Cloud Identity provides the user account; IAM grants permissions. You cannot skip adding to Cloud Identity.

Answer

Grant the user an IAM role directly; Cloud Identity is not required.

Answer

Create a service account for the user and grant roles to the service account.

Answer

Add the user to a Cloud Identity group, then grant the group an IAM role.

Question 8

You are configuring a new project and need to enable the Compute Engine API. However, the command 'gcloud services enable compute.googleapis.com' fails with a permission error. Your user has the role roles/editor on the project. What is the likely cause?

Accepted Answer

The project does not have a billing account associated.. The role roles/editor includes serviceusage.services.enable permission, so it should work. However, if the organization has an org policy 'constraints/compute.restrictResourceCreation' that restricts API usage, it might block. But the most common issue is that the project is new and the billing account is not associated, preventing API enablement. Editor role has permission, but billing must be active.

Answer

The Compute Engine API is already enabled.

Answer

The user needs to authenticate again.

Answer

The user does not have the serviceusage.services.enable permission.

Question 9

You need to list all projects in your organization using the gcloud CLI. Which command is correct?

Accepted Answer

gcloud projects list. 'gcloud projects list' lists projects accessible to the authenticated user. To list all projects in an organization, you need the --filter or use organizations. But 'gcloud projects list' with appropriate permissions shows all projects. The other commands are incorrect: 'gcloud config list' shows config, 'gcloud compute projects list' doesn't exist, 'gcloud resource-manager projects list' is not a command.

Answer

gcloud compute projects list

Answer

gcloud config list

Answer

gcloud resource-manager projects list

Question 10

You want to switch between multiple GCP projects frequently using the gcloud CLI. What is the recommended approach?

Accepted Answer

Create multiple configuration profiles and activate them as needed.. Configuration profiles (gcloud config configurations) allow you to create named configurations with different project, region, and zone settings. You can activate one with 'gcloud config configurations activate'. Setting individual properties each time is error-prone. Running gcloud init each time is slow. Using separate terminals isn't efficient.

Answer

Open separate terminal windows for each project.

Answer

Run gcloud init every time you switch projects.

Answer

Use gcloud config set project each time you switch.

Question 11

Your company has a production project and a development project. You want to ensure that no one can delete the production project accidentally. Which TWO actions should you take? (Choose 2)

Accepted Answer

Apply an organization policy constraint that blocks project deletion.. To prevent accidental deletion, you can set a deletion protection policy at the project level. Additionally, using an organization policy constraint 'constraints/resourcemanager.projectDelete' at the folder or organization level can block deletion. Labels don't prevent deletion. Removing the Owner role from all users would break management. Budget alerts don't prevent deletion.

Answer

Set a budget alert at 100% of projected spend.

Answer

Remove the Owner role from all users and grant only Editor.

Answer

Add a label to the project indicating it is production.

Question 12

You are setting up a new GCP project for a microservices application. You need to select which APIs to enable. Which THREE APIs are likely required? (Choose 3)

Accepted Answer

cloudbuild.googleapis.com. For a microservices application on Kubernetes, you need the Kubernetes Engine API (container.googleapis.com), and often the Cloud Build API (cloudbuild.googleapis.com) for CI/CD and Compute Engine API (compute.googleapis.com) as a dependency for GKE. Cloud Storage API is not necessarily required unless using Cloud Storage. BigQuery is for analytics.

Answer

storage.googleapis.com

Answer

bigquery.googleapis.com

Question 13

You create a new Google Cloud project using the Cloud Console. After creating the project, you need to enable the Compute Engine API. What is the correct command to do this using the Cloud Shell?

Accepted Answer

gcloud services enable compute.googleapis.com. The gcloud services enable command is used to enable APIs for a project. The correct syntax is 'gcloud services enable compute.googleapis.com'.

Answer

gcloud projects enable compute.googleapis.com

Answer

gcloud compute enable compute.googleapis.com

Answer

gcloud api enable compute

Question 14

You are setting up billing for a new GCP project. You want to receive an alert when the projected cost for the month exceeds 80% of your budget. You also want to be notified if the actual cost reaches 100%. Which budget alert thresholds should you set?

Accepted Answer

Set a single alert at 80% and another at 100%. Budget alerts can be set at specific percentages, but only whole numbers are allowed. Typically, you set alerts at 80% and 100%. The 80% alert is for projected cost, and 100% is for actual cost.

Answer

Set a single alert at 100% and use the 'forecast' option to get projected cost alerts

Answer

Set alerts at 50%, 80%, and 100%

Answer

Set a single alert at 80% for projected cost; GCP automatically alerts at 100%

Question 15

You want to use gcloud CLI to set the default project to 'my-project' and the default compute zone to 'us-central1-a'. Which two gcloud config commands should you run?

Accepted Answer

gcloud config set project my-project and gcloud config set compute/zone us-central1-a. The commands are 'gcloud config set project my-project' and 'gcloud config set compute/zone us-central1-a'.

Answer

gcloud config configurations set project my-project and gcloud config configurations set zone us-central1-a

Answer

gcloud config set project my-project and gcloud config set zone us-central1-a

Answer

gcloud projects set my-project and gcloud compute zones set us-central1-a