Google ACE Configuring access and security Practice Test 6 — 15 Questions

Question 1

A developer wants to configure a firewall rule to allow HTTP traffic from the internet to a specific Compute Engine instance tagged 'web-server'. Which TWO conditions must be true? (Choose two.)

Accepted Answer

The firewall rule must be of type ingress. Option B is correct because an ingress firewall rule controls incoming traffic to instances. Since the developer wants to allow HTTP traffic from the internet to reach the instance, the rule must be of type ingress to permit inbound connections on port 80.

Answer

The instance must have a public IP address

Answer

The firewall rule must be applied to the VPC network

Answer

The firewall rule must specify the source IP range 0.0.0.0/0

Question 2

A company has a Compute Engine instance that needs to read files from a Cloud Storage bucket. The instance is running a custom application. What is the recommended way to grant the instance access to the bucket?

Accepted Answer

Create a service account with Storage Object Viewer role and associate it with the instance.. Option B is correct because associating a service account with a Compute Engine instance and granting it the Storage Object Viewer role is the recommended IAM-based approach for granting least-privilege access to Cloud Storage. The instance retrieves short-lived OAuth 2.0 access tokens from the metadata server, which the application can use to authenticate API calls without embedding long-lived credentials.

Answer

Generate a signed URL for the bucket and embed it in the application.

Answer

Use the default Compute Engine service account with Storage Admin role.

Answer

Store the bucket credentials in the instance metadata.

Question 3

A user needs to view the list of firewall rules in a project but should not be able to create or modify them. Which predefined IAM role should you grant?

Accepted Answer

roles/compute.viewer. The roles/compute.viewer role grants read-only access to Compute Engine resources, including the ability to list firewall rules, without permitting create, update, or delete operations. This aligns with the principle of least privilege for a user who only needs to view firewall configurations.

Answer

roles/editor

Answer

roles/compute.securityAdmin

Answer

roles/owner

Question 4

You want to ensure that all Cloud Storage buckets in your organization require customer-managed encryption keys (CMEK). What is the most efficient way to enforce this?

Accepted Answer

Create an Organization Policy with constraint 'storage.requireCustomerManagedEncryption'.. Option B is correct because the Organization Policy constraint 'storage.requireCustomerManagedEncryption' is a centralized, scalable way to enforce CMEK across all Cloud Storage buckets in the organization. This policy is applied at the organization or folder level and automatically prevents the creation of new buckets without CMEK, while also blocking updates to existing non-compliant buckets. It is the most efficient method as it requires no per-bucket configuration or ongoing monitoring.

Answer

Use Cloud Audit Logs to monitor for non-compliant buckets.

Answer

Use a service account to encrypt all objects with CMEK.

Answer

Set a bucket policy on each bucket to require CMEK.

Question 5

A developer accidentally assigned the 'roles/editor' role to a user for a project. After revoking the role, the user still has permissions to modify resources. What is the most likely reason?

Accepted Answer

The user is a member of a group that still has editor role.. The most likely reason is that the user is a member of a Google Group that still has the 'roles/editor' role assigned at the project level. In Google Cloud IAM, permissions are inherited from group memberships, and revoking a role from a user directly does not remove permissions granted through group bindings. The user's effective permissions are the union of all roles assigned directly and indirectly via groups.

Answer

The user has been granted owner role through another binding.

Answer

The role revocation takes up to 24 hours to propagate.

Answer

The user has a more specific role that grants the same permissions.

Question 6

You need to allow a Cloud Function to write logs to Cloud Logging. The function uses a default service account. What IAM role should you grant to the service account?

Accepted Answer

roles/logging.logWriter. The Cloud Function's default service account needs the `roles/logging.logWriter` role to write logs to Cloud Logging. This role grants the `logging.logEntries.create` permission, which is the minimum required for writing log entries. Without it, the function cannot send logs to Logging, even though it may have other permissions.

Answer

roles/cloudfunctions.serviceAgent

Answer

roles/logging.admin

Answer

roles/logging.viewer

Question 7

A security team wants to restrict access to a Google Cloud project such that only virtual machines with a specific tag 'web' can connect to a Compute Engine instance on port 443. Which configuration is required?

Accepted Answer

Create a firewall rule allowing ingress from instances with tag 'web' to the target instance on port 443.. Option B is correct because firewall rules in Google Cloud are stateful and control ingress traffic at the network level. To allow only VMs with tag 'web' to connect to the target instance on port 443, you must create an ingress firewall rule that specifies the source tag 'web', the target instance (or its network tag), and the protocol/port tcp:443. This rule permits incoming HTTPS traffic from any VM that has the 'web' tag, regardless of its IP address.

Answer

Create a firewall rule allowing egress from instances with tag 'web' to the target instance on port 443.

Answer

Set an IAM condition on the instance to only allow calls from instances with tag 'web'.

Answer

Use Cloud Armor to filter traffic based on tags.

Question 8

You are configuring Identity-Aware Proxy (IAP) for a web application running on Compute Engine. Users authenticate through IAP and are granted access based on their email addresses. However, some users report that they are prompted to sign in multiple times during the same session. What is the most likely cause?

Accepted Answer

The IAP session timeout is set too low.. Option A is correct because IAP has a configurable session timeout; if set too low, users will need to re-authenticate frequently. Option B (HTTPS) is required for IAP but not the cause. Option C (different browsers) is not a common cause. Option D (cookie validation) is handled by IAP.

Answer

The backend service is missing the IAP session cookie validation.

Answer

The users are accessing the application via different browsers.

Answer

The backend service does not support HTTPS.

Question 9

A company uses VPC Service Controls to protect Cloud Storage. They have a service perimeter that includes the storage API and the project where the stored data resides. Users inside the perimeter can access the data, but users outside cannot. However, a group of users outside the perimeter are able to access the data using a signed URL generated by a service inside the perimeter. Why does this happen?

Accepted Answer

VPC Service Controls do not apply to signed URLs.. VPC Service Controls are designed to restrict access to Google Cloud resources based on the network origin of requests, but they do not evaluate or block requests made using signed URLs. Signed URLs are authenticated via cryptographic signatures, not IAM or network context, so they bypass the perimeter check entirely. This is by design, as signed URLs are intended for temporary, out-of-band access.

Answer

Signed URLs bypass VPC Service Controls.

Answer

The service perimeter is misconfigured, missing signed URL restrictions.

Answer

The users have been granted IAM roles that override the perimeter.

Question 10

You need to audit all IAM policy changes in your project. You want to ensure that every change is logged with the identity of the user who made the change. Which type of audit log should you enable?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs (also known as Cloud Audit Logs) record all API calls that modify the configuration or metadata of resources, including IAM policy changes. These logs capture the identity of the user who made the change, the time of the change, and the specific modification, ensuring full accountability for administrative actions.

Answer

Data Access audit logs

Answer

Policy Denied audit logs

Answer

System Event audit logs

Question 11

A company wants to ensure that only users from a specific domain (@example.com) can access Cloud Storage buckets in a project. Which two steps should be taken? (Choose two.)

Accepted Answer

Set an organization policy to restrict allowed domains for IAM.. Option C is correct because the organization policy constraint `iam.allowedPolicyMemberDomains` restricts which domains can be used as members in IAM policies across the entire project. This ensures that only principals from @example.com can be granted access to any resource, including Cloud Storage buckets. Option E is correct because a Cloud Identity group containing only @example.com users can be granted IAM roles on the bucket, and membership in the group is controlled by the domain, effectively limiting access to that domain.

Answer

Use VPC Service Controls to restrict access.

Answer

Enable domain restricted sharing in Cloud Storage settings.

Answer

Add an IAM condition to the bucket policy to require that the user's domain is @example.com.

Question 12

You are configuring a VPC with multiple subnets. You need to allow traffic from the internet to a specific instance on port 80, but only if the traffic originates from a set of known IP addresses. Which three resources must be configured? (Choose three.)

Accepted Answer

A load balancer with Cloud Armor.. Option A is correct because Cloud Armor is a web application firewall that can be attached to a load balancer to allow or deny traffic based on IP address ranges. This enables you to restrict inbound HTTP traffic on port 80 to only the known IP addresses, while the load balancer distributes traffic to the instance. Without Cloud Armor, a load balancer alone cannot filter by source IP; it relies on backend firewall rules or Cloud Armor policies for such granular access control.

Answer

A route to the internet gateway.

Answer

A Cloud Router.

Question 13

A company requires that all service account keys be automatically rotated every 90 days. Which two steps should the administrator take to enforce this? (Choose two.)

Accepted Answer

Use the Service Account API to create keys with a custom expiration time.. Option C is correct because the Service Account API allows creating keys with a custom expiration time, which enforces automatic rotation by ensuring keys are invalid after 90 days. Option E is correct because a Cloud Function can monitor key age and delete keys older than 90 days, providing a programmatic enforcement mechanism. Both approaches ensure keys are rotated automatically without manual intervention.

Answer

Enable the Service Account Key Rotator in the Google Cloud Console.

Answer

Use IAM to set a condition that keys must have an expiration date.

Answer

Use an Organization Policy to disable service account key creation.

Question 14

Your company runs a microservices application on Google Kubernetes Engine (GKE) with a shared VPC. The security team requires that all pod-to-pod traffic be encrypted using TLS. Additionally, you need to restrict which pods can communicate with each other. The application uses a service mesh with Istio. You have enabled Istio mTLS in STRICT mode, but you notice that some pods are still able to communicate with other pods without TLS. You have verified that all pods have the Istio sidecar injected. What should you do to fix the issue?

Accepted Answer

Apply a Kubernetes Network Policy to deny all non-mTLS traffic.. Option C is correct because Istio mTLS in STRICT mode only enforces encryption between sidecars that are properly configured and have discovered each other via the Istio control plane. However, if a pod bypasses the sidecar (e.g., by using a hostNetwork or a non-sidecar port), or if the sidecar is not enforcing the policy due to a misconfiguration, plaintext traffic can still flow. Applying a Kubernetes Network Policy that explicitly denies all non-mTLS traffic (e.g., by blocking TCP port 80 and allowing only port 443 or the Istio mTLS port) provides a defense-in-depth layer that blocks any unencrypted communication at the network layer, regardless of sidecar behavior.

Answer

Enable VPC Flow Logs to identify the unencrypted traffic.

Answer

Restart all pods to force re-injection of the sidecar.

Answer

Ensure that the GKE cluster has the Istio add-on enabled for all node pools.

Question 15

A startup wants to grant developers the ability to create and manage Compute Engine instances, but prevent them from deleting instances or changing firewall rules. Which IAM approach should they use?

Accepted Answer

Create a custom role with permissions for instance management but without compute.instances.delete.. Option A is correct because creating a custom role allows the startup to grant fine-grained permissions for instance management (e.g., compute.instances.create, compute.instances.start, compute.instances.stop) while explicitly omitting compute.instances.delete and any firewall-related permissions like compute.firewalls.update or compute.firewalls.delete. This ensures developers can manage instances but cannot delete them or alter firewall rules, meeting the exact requirement.

Answer

Assign the roles/compute.instanceAdmin.v1 role.

Answer

Assign the roles/compute.instanceOperator role.

Answer

Assign the roles/compute.admin role.