Google ACE Configuring access and security Practice Test 3 — 15 Questions

Question 1

A team needs to give a third-party vendor read-only access to specific Cloud Storage objects for 48 hours. The vendor uses an AWS account (not a Google account). What is the most secure way to grant this temporary access?

Accepted Answer

Generate a Signed URL for the specific objects with a 48-hour expiration. Option B is correct because a Signed URL provides time-bound, read-only access to specific Cloud Storage objects without requiring the vendor to have a Google account. The URL embeds authentication information and expires after 48 hours, ensuring temporary access while maintaining security by not exposing broader permissions or credentials.

Answer

Create a GCP service account for the vendor and share the JSON key file with 48-hour expiry

Answer

Use Workload Identity Federation with AWS as the identity provider for the vendor

Answer

Make the objects publicly readable and share the direct Cloud Storage URL

Question 2

A developer accidentally creates a firewall rule allowing all inbound traffic (0.0.0.0/0) on all ports to all instances in a production VPC. The rule has priority 1000. The team has an existing rule allowing only SSH (port 22) from the corporate IP range at priority 999. Which traffic is actually allowed?

Accepted Answer

SSH from corporate IP plus all traffic from all IPs — both allow rules match for their respective traffic. In Google Cloud VPC firewall rules, both allow rules are evaluated independently. The rule at priority 999 allows SSH (TCP port 22) from the corporate IP range, and the rule at priority 1000 allows all traffic from all IPs (0.0.0.0/0) on all ports. Since both rules are allow rules and match the traffic, the result is that SSH traffic from the corporate IP is allowed by the more specific rule, and all other traffic (including SSH from other IPs and all other protocols) is allowed by the broader rule. There is no implicit deny in GCP firewall rules; only explicit deny rules can block traffic, and no deny rule is present here.

Answer

Only SSH from the corporate range is allowed — the more specific rule takes precedence for all traffic

Answer

No traffic is allowed — deny rules override allow rules in GCP

Answer

All traffic from all IPs is allowed — the priority 1000 allow-all overrides the more specific priority 999 rule

Question 3

A security team wants to ensure that a service account created for an application cannot create new service accounts or modify IAM policies within the project. Which IAM role restriction achieves this?

Accepted Answer

Grant the service account only the specific roles its application requires — omitting IAM admin roles. Option A is correct because the principle of least privilege dictates that a service account should only be granted the specific roles required for its application's functionality. By deliberately omitting roles that include IAM administrative permissions (such as roles/iam.serviceAccountAdmin or roles/iam.serviceAccountUser with the iam.serviceAccounts.create permission, or roles/resourcemanager.projectIamAdmin), the service account is inherently restricted from creating new service accounts or modifying IAM policies. This approach avoids the complexity of deny policies and aligns with Google Cloud's recommended IAM best practices.

Answer

Create an IAM deny policy blocking iam.serviceAccounts.create and iam.projects.setIamPolicy for the service account

Answer

Set an organization policy constraint restricting service account creation to admin users only

Answer

Disable the IAM API for the project so service accounts cannot manage IAM

Question 4

A team enables OS Login on their GKE node pool. What does OS Login provide for SSH access to GKE nodes compared to the default metadata-based SSH key approach?

Accepted Answer

OS Login links SSH access to IAM roles — access is centrally managed and revocable via IAM without updating VM metadata. OS Login links SSH access to IAM roles, so access is centrally managed and revocable via IAM without updating VM metadata. This means you can grant or revoke SSH access to GKE nodes by assigning or removing IAM roles (e.g., roles/compute.osLogin) on user or service accounts, eliminating the need to manage SSH keys in instance metadata. This provides a more secure and auditable access control mechanism compared to the default metadata-based SSH key approach.

Answer

OS Login stores SSH keys in a Cloud KMS-managed keystore for enhanced encryption

Answer

OS Login automatically generates and rotates SSH key pairs every 24 hours

Answer

OS Login restricts SSH access to connections from specific IP ranges defined in Cloud Armor

Question 5

A GCP organization mandates that all new Cloud SQL instances must require SSL/TLS for connections. No exceptions are allowed. Which enforcement mechanism ensures this across all projects in the organization?

Accepted Answer

Apply the org policy constraint `constraints/sql.requireSsl` at the organization level to enforce SSL on all Cloud SQL instances. Option D is correct because the organization policy constraint `constraints/sql.requireSsl` is a native, enforceable policy that can be applied at the organization level in GCP. Once set, it prevents the creation of any Cloud SQL instance that does not require SSL/TLS, and it also blocks any attempt to disable SSL on existing instances. This ensures 100% compliance across all projects without relying on manual intervention or reactive detection.

Answer

Rely on database administrators to manually enable SSL on each new Cloud SQL instance

Answer

Use Security Command Center to detect SSL-disabled instances and alert the team

Answer

Set a Cloud Monitoring alert for new Cloud SQL instances and auto-remediate via Cloud Functions

Question 6

A team's Cloud Storage bucket has fine-grained access control (ACLs) enabled. They want to switch to a simpler model where IAM policies alone control access, and object-level ACLs are ignored. What should they enable?

Accepted Answer

Enable Uniform Bucket-Level Access (UBLA) on the bucket. Option A is correct because enabling Uniform Bucket-Level Access (UBLA) on the bucket disables object-level ACLs and enforces IAM policies as the sole access control mechanism. This simplifies management by ignoring any existing ACLs on objects, ensuring that only bucket-level IAM permissions are evaluated for access decisions.

Answer

Delete all ACLs on each object and set them to 'authenticated-read'

Answer

Enable VPC Service Controls on the bucket

Answer

Set the bucket's default object ACL to `projectPrivate` and apply it to all objects

Question 7

A GCP organization has recently experienced a credential theft incident involving a service account key. The CISO requires that all service account keys in the organization be inventoried and those older than 90 days be rotated. Which tool identifies old service account keys across all projects?

Accepted Answer

Cloud Asset Inventory querying all IAM ServiceAccountKey assets across the organization. Cloud Asset Inventory (CAI) is the correct tool because it can query all IAM ServiceAccountKey assets across the entire organization, including all projects, using a single API call or gcloud command. This allows you to filter by the `validAfterTime` field to identify keys older than 90 days, meeting the CISO's requirement for a comprehensive, automated inventory without manual per-project inspection.

Answer

Security Command Center — it audits service account key age automatically

Answer

Cloud Monitoring metric for service account key creation date

Answer

Manually check each service account in each project's IAM & Admin > Service Accounts page

Question 8

An application receives the error 'Permission denied on resource project [PROJECT_ID] (or it may not exist)' when making an API call with a service account. The service account has the correct IAM role. What else might be missing?

Accepted Answer

The relevant GCP API is not enabled in the project. The error 'Permission denied on resource project [PROJECT_ID] (or it may not exist)' typically occurs when the service account has the correct IAM role but the API being called is not enabled for the project. Even with proper IAM permissions, GCP requires that the specific API (e.g., Compute Engine API, Cloud Storage API) be enabled in the project before any API calls can succeed. Enabling the API activates the service and allows the service account to use it.

Answer

The service account needs the Project Owner role to make any API calls

Answer

The service account needs to be in the same organization as the project

Answer

The service account email must be explicitly allow-listed in the API's configuration

Question 9

A team builds a GKE application that processes healthcare data. Regulatory requirements mandate that data in transit between GKE nodes must be encrypted. GKE is running on GCP. What provides encrypted node-to-node traffic within the cluster?

Accepted Answer

GCP automatically encrypts all VM-to-VM traffic in transit within its network. GCP automatically encrypts all VM-to-VM traffic in transit at the network layer, including traffic between GKE nodes, using a combination of MACsec (IEEE 802.1AE) and IPsec. This encryption is enabled by default for all traffic within a VPC and between VPCs, without any configuration required. Therefore, node-to-node traffic within a GKE cluster is already encrypted, satisfying the regulatory requirement.

Answer

GKE node traffic is unencrypted by default — mTLS must be manually configured on every Pod

Answer

Enable VPC Flow Logs — they activate encryption for logged traffic

Answer

Install a TLS termination proxy on each GKE node — it encrypts intranode traffic

Question 10

A developer reports that a Cloud Function is failing with '403 Forbidden' when calling the BigQuery API. The function's service account has the BigQuery Data Viewer role. What is a likely additional requirement that may be missing?

Accepted Answer

The BigQuery API may not be enabled in the Cloud Functions' project. The 403 Forbidden error indicates that the Cloud Function's service account lacks the necessary permissions to call the BigQuery API. Even with the correct IAM role (BigQuery Data Viewer), the BigQuery API must be explicitly enabled in the project where the Cloud Function is running, as Google Cloud requires APIs to be activated per project before they can be used. Without enabling the API, any API call from the function will be rejected with a 403, regardless of IAM roles.

Answer

The Cloud Function must be deployed in the same region as the BigQuery dataset

Answer

Cloud Functions cannot call BigQuery — it must use Dataflow or BigQuery scheduled queries instead

Answer

The service account needs the BigQuery Admin role instead of Data Viewer to make API calls

Question 11

A Cloud Run service needs to read secrets from Secret Manager. The service is deployed with a custom runtime service account. Which IAM role should be granted to the runtime service account, and on which resource?

Accepted Answer

Grant `roles/secretmanager.secretAccessor` on the specific secret resource.. The principle of least privilege dictates that the runtime service account should only have the minimum permissions required to access the specific secret. The `roles/secretmanager.secretAccessor` role provides exactly the `secretmanager.versions.access` permission needed to read the secret value, and granting it on the specific secret resource (rather than the project) scopes the permission to that secret only, preventing broader access.

Answer

Grant `roles/secretmanager.admin` on the project.

Answer

Grant `roles/viewer` on the project.

Answer

Grant `roles/secretmanager.secretVersionManager` on the secret.

Question 12

Your security team wants to prevent any user or service account from creating firewall rules that allow ingress from `0.0.0.0/0` (the internet) to any VM in your organization. Which approach enforces this without requiring per-project IAM changes?

Accepted Answer

Apply a hierarchical firewall policy at the organization level with a deny rule for ingress from 0.0.0.0/0, set to take precedence over project rules.. Option B is correct because hierarchical firewall policies at the organization level can include a deny rule for ingress from `0.0.0.0/0` with a priority that takes precedence over any project-level firewall rules. This enforces the restriction globally without requiring per-project IAM changes, as the policy is inherited by all projects in the organization.

Answer

Grant IAM deny policies that prevent the `compute.firewalls.create` permission across the organization.

Answer

Use Security Command Center to detect and alert when 0.0.0.0/0 firewall rules are created.

Answer

Set the `compute.skipDefaultNetworkCreation` org policy constraint across the organization.

Question 13

A developer accidentally committed a service account key JSON file to a public GitHub repository. The key was valid for a service account with broad Editor permissions. What should you do FIRST?

Accepted Answer

Immediately delete or disable the service account key in the Cloud Console or via gcloud.. Option B is correct because the immediate priority is to revoke the exposed credential to prevent unauthorized access. Deleting or disabling the service account key in the Cloud Console or via `gcloud iam service-accounts keys delete` ensures the key is invalidated within minutes, stopping any attacker from using it to authenticate with Google Cloud APIs. This aligns with the principle of least privilege and incident response best practices: contain the breach before remediation.

Answer

Remove the committed file from Git history using `git filter-branch` or BFG Repo Cleaner.

Answer

Make the GitHub repository private to hide the exposed key.

Answer

Reduce the service account's permissions to limit the blast radius.

Question 14

You want to allow a vendor to upload files to a specific Cloud Storage bucket in your project without creating a GCP account for them. The upload URL should expire after 24 hours. Which mechanism should you use?

Accepted Answer

Generate a Signed URL with a 24-hour expiration for the specific bucket path.. Option B is correct because a signed URL allows time-limited, permissionless access to a specific Cloud Storage object or bucket path without requiring a GCP identity. The URL is cryptographically signed using a service account key, and the 24-hour expiration is set via the `expires` parameter. This meets the requirement of allowing the vendor to upload files without creating a GCP account.

Answer

Create a GCP service account for the vendor and share the key JSON file.

Answer

Make the Cloud Storage bucket publicly writable and share the bucket URL.

Answer

Add the vendor's email to the bucket's IAM policy with Storage Object Creator role.

Question 15

A GKE cluster hosts multiple teams' workloads in separate namespaces. One team's pods should not be able to make API calls to Google Cloud services (e.g., they should not call BigQuery or Cloud Storage). The pods currently use the node's service account via the Compute Engine metadata server. How do you restrict these specific pods from accessing GCP APIs while allowing other pods on the same node to continue using GCP APIs?

Accepted Answer

Apply a Kubernetes NetworkPolicy in the team's namespace blocking egress to `169.254.169.254` (the metadata server).. Option A is correct because the Compute Engine metadata server (169.254.169.254) is the endpoint that provides the node's service account credentials to pods. By applying a Kubernetes NetworkPolicy that blocks egress to this IP in the team's namespace, you prevent those pods from reaching the metadata server, thus denying them access to GCP APIs. Other pods on the same node are unaffected because NetworkPolicy is namespace-scoped and does not apply to them.

Answer

Revoke all IAM roles from the node's service account.

Answer

Set `automountServiceAccountToken: false` on the restricted team's pods.

Answer

Use a Kubernetes ResourceQuota to limit the team's namespace API access.