Google ACE Configuring access and security — Timed 20 Questions

Question 1

A junior developer needs read-only access to all GCP resources in a project. Which IAM role grants the minimum permissions required?

Accepted Answer

Viewer. The Viewer role (roles/viewer) grants read-only access to all GCP resources in a project, including existing and future resources, without allowing any modifications. This is the minimum permissions required for read-only access, as it provides exactly the necessary permissions (e.g., resourcemanager.projects.get, storage.objects.list) without any write or administrative capabilities.

Answer

Editor

Answer

Owner

Answer

Browser

Question 2

A security review identifies that service account JSON key files are stored on multiple developer laptops, posing a data exfiltration risk. What is the recommended remediation?

Accepted Answer

Remove the key files and use service account impersonation or Workload Identity for workloads that need GCP access. Option C is correct because storing service account JSON key files on developer laptops creates a persistent credential that can be exfiltrated. The recommended remediation is to remove these static keys entirely and instead use service account impersonation (via the `iamcredentials.googleapis.com` API) or Workload Identity (for GKE or GCE workloads) to obtain short-lived access tokens. This eliminates the long-lived secret and follows Google's principle of using federated identity rather than distributing static keys.

Answer

Rotate the key files every 90 days and redistribute them securely

Answer

Encrypt the JSON key files using Cloud KMS before distributing

Answer

Store the key files in Secret Manager and retrieve them at application startup

Question 3

A team wants to allow inbound HTTPS traffic (TCP port 443) from the internet to instances tagged 'web-server', while blocking all other inbound traffic. What firewall configuration achieves this?

Accepted Answer

An ingress allow rule for port 443 from 0.0.0.0/0 targeting the 'web-server' tag, relying on the implied deny for other traffic. Option A is correct because Google Cloud VPC firewall rules are stateful and have an implicit deny for all traffic that is not explicitly allowed. An ingress allow rule for TCP port 443 from 0.0.0.0/0 applied to instances with the 'web-server' tag permits inbound HTTPS traffic, and the implicit deny blocks all other inbound traffic without needing additional rules.

Answer

An ingress allow rule for port 443 and a separate egress deny rule for all other ports

Answer

An ingress deny rule for all ports from 0.0.0.0/0, plus an ingress allow for port 443 with lower priority

Answer

A Cloud Armor policy allowing only HTTPS requests to port 443

Question 4

An enterprise stores sensitive customer data in Cloud Storage. Regulatory requirements mandate that the company controls its own encryption keys — Google must not be able to decrypt data unilaterally. Which encryption configuration satisfies this?

Accepted Answer

Customer-managed encryption keys (CMEK) using Cloud KMS. Option B is correct because Customer-Managed Encryption Keys (CMEK) with Cloud KMS allow the enterprise to control and manage their own encryption keys, ensuring that Google cannot unilaterally decrypt the data. With CMEK, the encryption keys are stored in Cloud KMS under the customer's control, and Google only has access to the key material for encryption/decryption operations as authorized by the customer. This satisfies the regulatory requirement that the company retains sole control over key material, preventing Google from decrypting data without explicit permission.

Answer

Google-managed encryption keys (the default)

Answer

Client-side encryption before uploading to Cloud Storage, without using Cloud KMS

Answer

Shielded VM with vTPM enabled on the storage backend

Question 5

A Cloud Run service needs to access a database password at runtime. Where should the password be stored according to GCP security best practices?

Accepted Answer

In Secret Manager, referenced as a mounted secret or accessed via the API at runtime. Secret Manager is the GCP-native service designed to securely store sensitive data like database passwords. It provides encryption at rest and in transit, fine-grained access control via IAM, and supports both mounting secrets as volumes and accessing them via the API at runtime. This aligns with GCP security best practices by avoiding exposure of secrets in plain text, configuration files, or container images.

Answer

As a plain-text environment variable in the Cloud Run service configuration

Answer

In a Cloud Storage bucket accessible to the service account

Answer

Baked into the container image at build time

Question 6

A compliance team needs a log of every time a user or service account accessed data in a BigQuery dataset — specifically read operations. Which Cloud Audit Log type captures this?

Accepted Answer

Data Access audit logs. Data Access audit logs record API calls that read or modify user-provided data, including BigQuery read operations like SELECT queries. Since the requirement is specifically for read operations on user data, Data Access logs are the correct type. Admin Activity logs cover configuration changes, not data reads, and System Event logs cover Google-managed actions, not user-initiated reads.

Answer

System event audit logs

Answer

Admin Activity audit logs

Answer

VPC flow logs

Question 7

A security team wants to prevent authorized users from copying BigQuery query results to a dataset in a different GCP project that is outside the team's security boundary — even if the user has valid IAM permissions. Which control enforces this?

Accepted Answer

VPC Service Controls with a perimeter enclosing BigQuery. VPC Service Controls (VPC-SC) create a security perimeter around Google Cloud services, including BigQuery, that prevents data exfiltration to projects outside the perimeter regardless of IAM permissions. By configuring a service perimeter that includes BigQuery and the authorized project, any attempt to copy query results to a dataset in a project outside the perimeter is blocked, even if the user has valid IAM roles. This enforces a data boundary that overrides IAM-based access.

Answer

IAM deny policies restricting cross-project BigQuery operations

Answer

An organization policy preventing resource creation outside specific projects

Answer

Cloud Armor rules blocking outbound API requests to BigQuery in other projects

Question 8

A GKE Pod needs to call the Cloud Storage API. The team wants to avoid creating and managing service account key files. What is the recommended approach?

Accepted Answer

Enable Workload Identity on the GKE cluster and bind a Kubernetes ServiceAccount to a GCP IAM ServiceAccount. Workload Identity is the recommended approach because it allows a Kubernetes ServiceAccount in GKE to authenticate as a GCP IAM ServiceAccount without managing or storing any service account key files. This eliminates the security risk of key leakage and simplifies credential rotation. By binding the Kubernetes ServiceAccount to a GCP IAM ServiceAccount, Pods can directly call Cloud Storage APIs using the IAM permissions of the linked service account, with automatic token exchange via the GKE metadata server.

Answer

Mount a service account JSON key file as a Kubernetes Secret and set GOOGLE_APPLICATION_CREDENTIALS

Answer

Rely on the GKE node's Compute Engine service account for all Pod authentication

Answer

Grant the GKE node pool's service account the Storage Admin role to cover all Pod needs

Question 9

A public API receives global traffic but has been targeted by both volumetric DDoS attacks and SQL injection attempts in HTTP request parameters. Which single GCP service provides protection against both threats?

Accepted Answer

Cloud Armor security policies on the load balancer. Cloud Armor security policies, when attached to a Google Cloud HTTPS Load Balancer, provide both Layer 7 DDoS protection (via pre-configured WAF rules like 'modsecurity-crs' to block SQL injection) and volumetric DDoS defense (via rate limiting and adaptive protection). This makes it the single GCP service that directly addresses both threats mentioned in the question.

Answer

VPC firewall rules with deny rules for known attacker IPs

Answer

Cloud NAT to hide backend IP addresses

Answer

Identity-Aware Proxy (IAP) to require authentication before accessing the API

Question 10

A team wants to grant a contractor the Storage Object Viewer role on a specific bucket path, but only during business hours (Monday–Friday, 9am–5pm local time). Which IAM feature supports these conditions?

Accepted Answer

IAM Conditions on the role binding. IAM Conditions allow you to define time-based constraints on role bindings using the `request.time` attribute. By setting a condition that restricts access to Monday–Friday, 9am–5pm, the contractor is granted the Storage Object Viewer role only during those hours. This is the native IAM feature designed for such fine-grained, attribute-based access control.

Answer

IAM deny policies scoped to non-business hours

Answer

VPC Service Controls with a time-based access policy

Answer

Cloud Scheduler removing and re-adding the IAM binding on a schedule

Question 11

A team wants to grant three developers access to view Cloud SQL instance details and connection strings, but not create, delete, or modify any Cloud SQL instances. Which predefined IAM role is the most appropriate?

Accepted Answer

Cloud SQL Viewer. The Cloud SQL Viewer role (roles/cloudsql.viewer) grants read-only permissions to view Cloud SQL instance details, including connection strings, without allowing any create, delete, or modify operations. This matches the requirement precisely, as it provides the necessary visibility while preventing any changes to the instances.

Answer

Cloud SQL Editor

Answer

Cloud SQL Client

Answer

Project Viewer

Question 12

A compliance requirement mandates that all VM-to-VM traffic within a GCP project must be encrypted in transit, even for internal VPC traffic. Which feature enforces this for Compute Engine?

Accepted Answer

Mutual TLS (mTLS) enforced at the application layer between VMs. Mutual TLS (mTLS) is the correct answer because it enforces encryption in transit for all VM-to-VM traffic within a GCP project, including internal VPC traffic, by requiring both sides to present certificates and establishing a TLS-encrypted session. GCP's internal mTLS feature, when enabled on a VPC network, automatically encrypts traffic between Compute Engine VMs using TLS 1.2 or higher, regardless of the application layer, ensuring compliance with encryption mandates without requiring application changes.

Answer

Shielded VMs with Secure Boot enabled

Answer

VPC firewall rules denying all non-encrypted traffic

Answer

Enabling VPC Flow Logs on all subnets

Question 13

An organization needs to ensure that only images from their approved Container Registry (gcr.io/approved-project) can be deployed on GKE clusters in their organization. Which GCP control enforces this?

Accepted Answer

Binary Authorization with a policy requiring attestation from the approved registry. Binary Authorization enforces deployment-time policies that require images to be signed by trusted authorities. By configuring a policy that requires attestations from the approved registry (gcr.io/approved-project), only images from that registry can be deployed on GKE clusters, directly meeting the requirement.

Answer

A VPC firewall rule blocking pulls from unauthorized registries

Answer

Cloud Armor rules blocking container pull requests from external sources

Answer

Manually reviewing all Docker images before deployment

Question 14

A DevOps engineer creates a service account for a CI/CD pipeline. The pipeline needs to push container images to Artifact Registry. Which role grants the minimum required permission?

Accepted Answer

Artifact Registry Writer. Option B is correct because the Artifact Registry Writer role provides the minimal permissions needed to push container images to Artifact Registry, specifically the `artifactregistry.writer` permission. This role allows writing artifacts without granting broader administrative or read-only access, aligning with the principle of least privilege.

Answer

Artifact Registry Administrator

Answer

Storage Object Creator on the underlying Cloud Storage bucket

Answer

Artifact Registry Reader

Question 15

A security team discovers that a service account key was accidentally committed to a public GitHub repository 48 hours ago. What should be the immediate steps to remediate this incident?

Accepted Answer

Delete the leaked key immediately, audit Cloud Audit Logs for unauthorized activity using the key, then create a new key or switch to keyless authentication. Option B is correct because the immediate priority is to revoke the compromised key's access by deleting it, which invalidates it instantly. Auditing Cloud Audit Logs is essential to detect any unauthorized usage that occurred during the 48-hour exposure window. Finally, creating a new key or switching to keyless authentication (e.g., workload identity federation) restores secure access without relying on long-lived static credentials.

Answer

Rotate the service account key to generate a new one, keeping the old key active briefly for transition

Answer

Change the service account's display name and email to invalidate the leaked key

Answer

Remove all IAM roles from the service account to deny all actions until the investigation completes

Question 16

A team's Cloud Storage bucket containing backups has been accidentally made publicly readable. A monitoring alert fires. What is the fastest way to remove public access?

Accepted Answer

Remove the 'allUsers' IAM binding from the bucket using the Console or gcloud/gsutil. Removing the `allUsers` and `allAuthenticatedUsers` IAM bindings from the bucket removes public access. Alternatively, enabling 'Uniform bucket-level access' and removing the public policy achieves the same. For speed, `gsutil iam ch -d allUsers:objectViewer gs://[BUCKET]` or using the Console's Permissions tab is fastest.

Answer

Delete the bucket and recreate it with correct permissions

Answer

Enable VPC Service Controls around Cloud Storage to block all external access

Answer

Apply a Cloud Armor policy to Cloud Storage to block external IPs

Question 17

A GKE cluster hosts both a public-facing web application and an internal data processing service. The data processing service should only accept traffic from the web application Pods, not from the internet. Which Kubernetes feature enforces this policy?

Accepted Answer

Kubernetes NetworkPolicy restricting ingress to the data service to only Pods with the web app label. Kubernetes NetworkPolicy is the native Kubernetes resource that controls traffic flow at the IP address or port level (OSI layer 3 or 4). By defining an ingress rule that allows traffic only from Pods with a specific label (e.g., 'app: web-app'), you can restrict access to the data processing service exclusively to the web application Pods, regardless of whether the service is exposed via ClusterIP, NodePort, or LoadBalancer. This is the correct and recommended approach for pod-level network segmentation within a cluster.

Answer

A VPC firewall rule blocking external traffic to the data service's Node IPs

Answer

IAP (Identity-Aware Proxy) configured on the data service

Answer

Using a private ClusterIP Service for the data service — it's automatically private

Question 18

A developer accidentally grants the Owner role to a test service account on the production project. The team wants to remove only this specific IAM binding without affecting other members' access. Which gcloud command achieves this?

Accepted Answer

gcloud projects remove-iam-policy-binding [PROJECT] --member=serviceAccount:[SA_EMAIL] --role=roles/owner. Option B is correct because `gcloud projects remove-iam-policy-binding` is the precise command to remove a single IAM binding (member-role pair) from a project's policy without affecting other bindings. It takes the project ID, member (service account email), and role as parameters, ensuring only the specified binding is removed. This command modifies the existing policy by removing only that specific entry, leaving all other IAM bindings intact.

Answer

gcloud projects set-iam-policy [PROJECT] --member=serviceAccount:[SA] --role=roles/owner

Answer

gcloud iam remove-binding --project=[PROJECT] --member=[SA] --role=owner

Answer

gcloud projects delete-member [PROJECT] --member=serviceAccount:[SA_EMAIL]

Question 19

A regulated financial company must ensure that all GCP API calls made by employees are logged with full request and response payloads for audit purposes. Which combination of Cloud Audit Log types captures this?

Accepted Answer

Admin Activity logs + Data Access logs (DATA_READ and DATA_WRITE). Admin Activity logs capture administrative actions like creating or modifying resources, but not the data within API calls. Data Access logs (DATA_READ and DATA_WRITE) capture the request and response payloads for API calls that read or write data, which is required for full audit logging. Together, they cover both the administrative context and the data-level payloads mandated for regulated financial companies.

Answer

Admin Activity logs only

Answer

VPC Flow Logs + Cloud Monitoring metrics

Answer

System event logs + Data Access logs

Question 20

A GCP project needs to allow outbound internet access from VMs that have only private IP addresses, without exposing those VMs to inbound internet traffic. Which GCP service provides this?

Accepted Answer

Cloud NAT configured on the VPC's Cloud Router. Cloud NAT (Network Address Translation) is the correct service because it allows VMs with only private IP addresses to initiate outbound connections to the internet while preventing any inbound connections from the internet. It works by translating the private source IP addresses of outbound packets to a set of ephemeral public IP addresses managed by Google, using the VPC's Cloud Router to dynamically allocate NAT IPs and ports. This meets the requirement of outbound-only internet access without exposing the VMs to inbound traffic.

Answer

Cloud VPN connecting the VPC to the internet

Answer

A VPC firewall rule allowing egress to 0.0.0.0/0 on all ports

Answer

An internal load balancer with internet routing enabled