Google ACE Configuring access and security Practice Test 5 — 15 Questions

Question 1

Arrange the steps to create a Cloud SQL MySQL instance, configure a database, and connect using the Cloud SQL Proxy.

Question 2

Order the steps to set up a Cloud IAM policy that grants a user the 'roles/compute.admin' role on a specific project.

Question 3

Match each Cloud Storage storage class to its typical use case.

Question 4

Match each Google Cloud security term to its definition.

Question 5

A security auditor needs read-only access to Compute Engine instance metadata but should not be able to start or stop instances. Which predefined IAM role should be assigned?

Accepted Answer

roles/compute.viewer. The roles/compute.viewer role grants read-only access to Compute Engine resources, including instance metadata, without allowing write operations such as starting or stopping instances. This matches the requirement for read-only metadata access while preventing instance lifecycle changes.

Answer

roles/compute.instanceAdmin.v1

Answer

roles/compute.admin

Answer

roles/compute.networkAdmin

Question 6

A developer is running a batch process on a Compute Engine instance that needs to write logs to Cloud Logging. The instance uses the default Compute Engine service account. What must be done?

Accepted Answer

Ensure the instance's access scopes include logging.write. The default Compute Engine service account has the `logging.logWriter` role by default, but access scopes act as an additional permission layer on Compute Engine instances. Even if the IAM role is present, the instance must have the `logging.write` access scope enabled to allow the service account to write logs to Cloud Logging. Option A is correct because explicitly setting the access scope ensures the API call to `logging.write` is permitted at the instance level.

Answer

No action needed, the default service account has logging write access

Answer

Create a custom service account with the required roles

Answer

Add the Logging Admin role to the service account

Question 7

A company has multiple projects under an organization. They want to enforce that all service accounts created in any project must use the naming prefix 'sa-'. Which policy should be used?

Accepted Answer

Organization policy using a custom constraint. An organization policy with a custom constraint is the correct approach because it allows you to define a specific rule (e.g., all service accounts must start with 'sa-') that is enforced across all projects in the organization. Custom constraints use the Resource Manager API's `constraints/*` format and are evaluated at resource creation time, making them ideal for naming conventions that must be applied universally.

Answer

VPC Service Controls

Answer

Project-level IAM condition

Answer

Cloud Audit Logs

Question 8

A developer creates a Cloud Storage bucket and sets a uniform bucket-level access policy. What is the implication?

Accepted Answer

Object ACLs are disabled. When uniform bucket-level access is enabled on a Cloud Storage bucket, all access control is managed exclusively through IAM policies at the bucket level. Object ACLs are disabled, meaning individual object permissions cannot be set or evaluated. This ensures consistent access control across all objects in the bucket.

Answer

Only object ACLs are used

Answer

Bucket permissions override object ACLs

Answer

Both bucket IAM and object ACLs are used

Question 9

An organization needs to allow a third-party SIEM tool to ingest audit logs from their Google Cloud organization. The SIEM tool should only have read access to logs. Which IAM role should be granted?

Accepted Answer

roles/logging.viewer. The roles/logging.viewer role grants read-only access to all logs in the Google Cloud organization, including audit logs, which is exactly what the third-party SIEM tool requires. This role allows the SIEM to ingest logs without the ability to modify or delete them, ensuring the principle of least privilege is maintained.

Answer

roles/logging.configWriter

Answer

roles/logging.admin

Answer

roles/logging.privateLogViewer

Question 10

Which console page would you use to create and manage custom IAM roles?

Accepted Answer

IAM & Admin > Roles. The IAM & Admin > Roles page in the Google Cloud Console is the dedicated interface for creating, editing, and managing custom IAM roles. Custom roles allow you to define a precise set of permissions that are not available in predefined roles, giving you granular control over access to Google Cloud resources. This page also lists all predefined and custom roles, and allows you to clone, delete, or update role definitions.

Answer

IAM & Admin > Audit Logs

Answer

IAM & Admin > Organization Policies

Answer

IAM & Admin > Service Accounts

Question 11

Refer to the exhibit. An application running on this instance is unable to write to a Cloud Storage bucket. What is the most likely cause?

Accepted Answer

The access scopes only allow read access to Cloud Storage. When an instance is created with access scopes, these scopes restrict the API methods that the instance's credentials can use, regardless of the IAM permissions granted to the attached service account. The exhibit shows that the access scopes are set to 'Read Only' for Cloud Storage, which means the application can only call read methods (e.g., storage.objects.get) and cannot perform write operations (e.g., storage.objects.insert). This overrides any IAM role that would otherwise allow write access.

Answer

The application is using the wrong authentication method

Answer

The Cloud Storage bucket is in a different project

Answer

The service account does not have the storage.objectAdmin IAM role

Question 12

Refer to the exhibit. After applying this IAM policy to a bucket, what access is granted?

Accepted Answer

Anyone authenticated with a Google account can list and read objects. The IAM policy grants the `roles/storage.objectViewer` role to `allAuthenticatedUsers`, which includes any identity authenticated with a Google account (including non-GCP accounts). The condition `resource.name.startsWith('projects/_/buckets/example-bucket/objects/public/')` restricts the grant to objects whose path starts with `public/`, so only those objects can be listed and read. This is why option A is correct.

Answer

No access is granted because the condition is missing

Answer

Only users in the same GCP project can read objects

Answer

Anyone on the internet can list and read objects

Question 13

Refer to the exhibit. A user attempts to create a Deployment Manager deployment that references a service account. What is the most likely issue?

Accepted Answer

The user does not have the roles/iam.serviceAccountUser role on the service account. When a Deployment Manager deployment references a service account, the user must have the `roles/iam.serviceAccountUser` role on that service account to impersonate it. Without this role, the deployment fails even if the user has `deploymentmanager.deployments.create` permission, because the service account is used to execute the deployment's resources. Option B correctly identifies this missing IAM binding as the most likely issue.

Answer

The user does not have deploymentmanager.deployments.create permission

Answer

The service account is disabled

Answer

The service account does not exist

Question 14

A company wants to allow developers to create Compute Engine instances with a specific set of persistent disk types (e.g., only pd-ssd). Which TWO methods can be used to enforce this? (Choose two.)

Accepted Answer

Organization policy with constraint compute.restrictDiskTypes. Option C is correct because the `compute.restrictDiskTypes` organization policy constraint allows administrators to define a list of allowed persistent disk types (e.g., pd-ssd) at the project, folder, or organization level. When set, any Compute Engine instance creation request that specifies a disk type not on the allowed list will be denied by the policy engine, enforcing the restriction without requiring changes to individual IAM roles or scripts.

Answer

Organization policy with constraint compute.requireShieldedVm

Answer

VPC custom firewall rules

Answer

Service account permissions

Question 15

Which THREE are valid ways to authenticate a user for gcloud commands? (Choose three.)

Accepted Answer

OAuth2 access token. Option B is correct because an OAuth2 access token can be used to authenticate gcloud commands by passing it with the `--access-token-file` flag or via the `gcloud auth print-access-token` command. This token is obtained from an authorization server and provides temporary, scoped access to Google Cloud resources without requiring a long-lived credential like a service account key.

Answer

API key

Answer

IdP token