Google ACE Setting Up a Cloud Solution Environment Practice Test 5 — 15 Questions

Question 1

A new engineer is setting up their GCP environment for the first time. They have a billing account and need to create a new project for development. What is the correct order of steps?

Accepted Answer

Create billing account → Create project → Enable APIs. The standard order is to first create the billing account, then create the project and associate it with the billing account, and finally enable the required APIs within that project.

Answer

Enable APIs → Create billing account → Create project

Answer

Create project → Associate billing account → Enable APIs

Answer

Create project → Enable APIs → Associate billing account

Question 2

You are a project owner and need to grant a colleague the ability to create and manage Compute Engine instances, but restrict them from deleting any resources. Which IAM role should you assign?

Accepted Answer

roles/compute.instanceAdmin.v1. The Compute Instance Admin role (roles/compute.instanceAdmin.v1) allows full management of instances including create, modify, and start/stop, but not delete. The Compute Admin role allows deletion. The Viewer role only allows read access. The Security Admin role is for managing security policies.

Answer

roles/compute.admin

Answer

roles/compute.securityAdmin

Answer

roles/compute.viewer

Question 3

An organization has multiple Google Cloud projects and wants to enforce a policy that all Compute Engine instances must use a specific set of approved machine types. Which tool should be used to implement this constraint?

Accepted Answer

Organization policies. Organization policies are used to enforce constraints across projects, folders, or the entire organization. The constraint 'compute.constraints.allowMachineTypes' can be set to restrict machine types. IAM roles control access, not resource configuration. Cloud Scheduler is for cron jobs. VPC Service Controls is for data exfiltration prevention.

Answer

IAM custom roles

Answer

VPC Service Controls

Answer

Cloud Scheduler

Question 4

Which gcloud command is used to set the default project for a configuration profile?

Accepted Answer

gcloud config set project. The command 'gcloud config set project [PROJECT_ID]' sets the default project in the current active configuration. The other commands are for other purposes.

Answer

gcloud init

Answer

gcloud projects set

Answer

gcloud projects list

Question 5

An engineer needs to enable the Compute Engine API for a project using the gcloud command line. Which command should they run?

Accepted Answer

gcloud services enable compute.googleapis.com. The command 'gcloud services enable compute.googleapis.com' enables the Compute Engine API for the current project. The other options either list services or are incorrect.

Answer

gcloud compute instances enable-api

Answer

gcloud services list --enabled

Answer

gcloud api enable compute

Question 6

A company wants to track costs by department and project. They have multiple GCP projects used by different teams. Which feature should they use to categorize costs?

Accepted Answer

Labels. Labels are key-value pairs that can be attached to resources and are used to organize and track costs. Budget alerts notify when spending exceeds thresholds. Billing export sends data to BigQuery. Custom roles are for IAM permissions.

Answer

Budgets and alerts

Answer

Billing export to BigQuery

Answer

Custom IAM roles

Question 7

An organization wants to enforce that all projects under a specific folder have a set of constraints, such as disabling default network creation and requiring shielded VMs. What is the most efficient way to achieve this?

Accepted Answer

Apply organization policies at the folder level.. Organization policies can be applied at the folder level, inheriting to all projects within that folder. This is more efficient than applying per project. Using Cloud Shell is irrelevant. IAM cannot enforce such constraints. Service accounts are for authentication.

Answer

Use Cloud Shell to run scripts in each project.

Answer

Create IAM roles to restrict default network creation.

Answer

Use a service account to enforce policies.

Question 8

Which of the following is true about Cloud Shell?

Accepted Answer

Cloud Shell has 5 GB of persistent home directory storage.. Cloud Shell provides a temporary virtual machine with 5 GB of persistent home directory storage, and the gcloud, kubectl, and terraform tools are pre-installed. The home directory persists across sessions, but the VM is ephemeral (after 20 minutes of inactivity the VM is terminated, but home directory persists).

Answer

Cloud Shell requires installation of gcloud and kubectl manually.

Answer

Cloud Shell only supports the gcloud CLI, not kubectl.

Answer

Cloud Shell provides a persistent VM that can run for hours.

Question 9

An engineer wants to authenticate to Google Cloud using their own user credentials and also set up application default credentials for a local development environment. Which sequence of gcloud auth commands should they use?

Accepted Answer

gcloud auth login then gcloud auth application-default login. First, use 'gcloud auth login' to authenticate the gcloud CLI with user credentials. Then, use 'gcloud auth application-default login' to set up application default credentials for local development. The other options are incorrect or reversed.

Answer

gcloud auth application-default login then gcloud auth login

Answer

gcloud init then gcloud auth login

Answer

gcloud auth configure-docker then gcloud auth login

Question 10

You need to delete a Google Cloud project. What prerequisite must be met before the project can be deleted?

Accepted Answer

The billing account must be disabled for the project.. Before deleting a project, you must disable the billing account associated with it. This is to ensure that no outstanding charges occur. The project may still have active resources but billing must be disabled. The other options are not prerequisites.

Answer

All IAM members must be removed from the project.

Answer

All resources in the project must be deleted.

Answer

The project must be in the ACTIVE state.

Question 11

A multinational corporation requires that all GCP resources across multiple projects are tagged with a key-value pair 'environment: production' and 'environment: development'. They want to enforce that any resource created without the appropriate label is automatically denied. How can this be achieved?

Accepted Answer

Use an organization policy constraint to require labels.. Organization policy constraints like 'compute.googleapis.com/requireLabels' can enforce that certain labels must be present on resources. IAM conditions can restrict access based on labels, but they don't automatically deny creation of unlabeled resources. Cloud Asset Inventory is for monitoring, not enforcement. Custom roles cannot enforce labeling.

Answer

Use Cloud Asset Inventory to monitor and alert on missing labels.

Answer

Use IAM conditions to check labels at resource creation.

Answer

Create a custom IAM role that denies creation without labels.

Question 12

What is the purpose of the gcloud init command?

Accepted Answer

To set up a new gcloud configuration and authenticate.. gcloud init is used to initialize or reinitialize the gcloud environment, including setting default project, authentication, and compute region/zone. It can also create a new configuration profile.

Answer

To create a billing account.

Answer

To initialize a new project in Google Cloud.

Answer

To enable APIs for a project.

Question 13

An organization wants to set up a budget alert for a GCP project. Which TWO options can be configured as alert thresholds?

Accepted Answer

50% of budget. When creating a budget alert, you can set alert thresholds at spending amounts or percentages (e.g., 50%, 90%, 100%) of the budget. You can also set alerts based on forecasted spend. 'Custom amount' and 'per-service' are not standard threshold types.

Answer

Actual cost equals budget

Answer

Custom amount

Answer

Per-service cost exceeds $100

Question 14

A company wants to organize their GCP resources into a hierarchy to separate development, staging, and production environments. Which THREE resources can be used to create this separation?

Accepted Answer

Folders. GCP resource hierarchy includes Organization, Folders, Projects, and Resources. Folders can be used to group projects (e.g., dev folder, prod folder). Projects are the containers for resources. Labels are metadata tags but not part of the hierarchy. Billing accounts are separate from the hierarchy. IAM policy is not a resource for separation.

Answer

Billing accounts

Answer

Labels

Question 15

An engineer needs to enable the Cloud Build API and the Kubernetes Engine API for a project. Which TWO commands should they run?

Accepted Answer

gcloud services enable cloudbuild.googleapis.com. To enable APIs, use 'gcloud services enable' with the service name. For Cloud Build, it's cloudbuild.googleapis.com. For Kubernetes Engine, it's container.googleapis.com. The other options are incorrect.

Answer

gcloud services enable compute.googleapis.com

Answer

gcloud services enable kubernetes-engine.googleapis.com