Google ACE Multiple Select — 10 Questions

Question 1

Which TWO actions should a DevOps engineer take to reduce egress costs when transferring large amounts of data from Compute Engine to Cloud Storage in the same region?

Accepted Answer

Use internal IP addresses for the Compute Engine instances.. Option A is correct because using internal IP addresses for Compute Engine instances ensures that traffic to Cloud Storage stays within Google's internal network, avoiding internet egress charges. When instances communicate with Cloud Storage using external IPs, the traffic is routed over the public internet, incurring egress costs. Internal IPs keep the data transfer on Google's backbone, which is free for same-region transfers.

Answer

Set up a VPN between the instances and Cloud Storage.

Answer

Use a multi-regional Cloud Storage bucket.

Answer

Configure a Cloud NAT gateway.

Question 2

Which THREE options are valid methods to authenticate a service account when making calls to Google Cloud APIs from a Compute Engine instance?

Accepted Answer

Using a JSON key file downloaded for the service account.. Option A is correct because a JSON key file downloaded for a service account contains the private key necessary to create a signed JWT assertion, which is exchanged for an OAuth 2.0 access token via the Google OAuth 2.0 token endpoint (https://oauth2.googleapis.com/token). This is a standard authentication method for service accounts outside of Google Cloud, but it is also valid from a Compute Engine instance, though less secure than using the metadata server.

Answer

Using a user account's OAuth2 tokens obtained via a web browser.

Answer

Using an API key generated from the Cloud Console.

Question 3

Which TWO statements are true about Cloud IAM roles?

Accepted Answer

IAM roles are collections of permissions.. Option B is correct because IAM roles are indeed collections of permissions that define what actions an identity can perform on Google Cloud resources. Permissions are grouped into roles, and roles are assigned to principals (users, groups, or service accounts) to grant specific access. This is the fundamental building block of Google Cloud IAM, where a role bundles one or more permissions, and the role is then bound to a principal.

Answer

Custom roles are available for all Google Cloud services by default.

Answer

Roles assigned to a project are automatically inherited by all resources in the project.

Answer

Primitive roles are the same as predefined roles.

Question 4

A company wants to allow developers to create Compute Engine instances with a specific set of persistent disk types (e.g., only pd-ssd). Which TWO methods can be used to enforce this? (Choose two.)

Accepted Answer

Organization policy with constraint compute.restrictDiskTypes. Option C is correct because the `compute.restrictDiskTypes` organization policy constraint allows administrators to define a list of allowed persistent disk types (e.g., pd-ssd) at the project, folder, or organization level. When set, any Compute Engine instance creation request that specifies a disk type not on the allowed list will be denied by the policy engine, enforcing the restriction without requiring changes to individual IAM roles or scripts.

Answer

Organization policy with constraint compute.requireShieldedVm

Answer

VPC custom firewall rules

Answer

Service account permissions

Question 5

You are configuring a VPC with multiple subnets. You need to allow traffic from the internet to a specific instance on port 80, but only if the traffic originates from a set of known IP addresses. Which three resources must be configured? (Choose three.)

Accepted Answer

A load balancer with Cloud Armor.. Option A is correct because Cloud Armor is a web application firewall that can be attached to a load balancer to allow or deny traffic based on IP address ranges. This enables you to restrict inbound HTTP traffic on port 80 to only the known IP addresses, while the load balancer distributes traffic to the instance. Without Cloud Armor, a load balancer alone cannot filter by source IP; it relies on backend firewall rules or Cloud Armor policies for such granular access control.

Answer

A route to the internet gateway.

Answer

A Cloud Router.

Question 6

A company wants to ensure that only users from a specific domain (@example.com) can access Cloud Storage buckets in a project. Which two steps should be taken? (Choose two.)

Accepted Answer

Set an organization policy to restrict allowed domains for IAM.. Option C is correct because the organization policy constraint `iam.allowedPolicyMemberDomains` restricts which domains can be used as members in IAM policies across the entire project. This ensures that only principals from @example.com can be granted access to any resource, including Cloud Storage buckets. Option E is correct because a Cloud Identity group containing only @example.com users can be granted IAM roles on the bucket, and membership in the group is controlled by the domain, effectively limiting access to that domain.

Answer

Use VPC Service Controls to restrict access.

Answer

Enable domain restricted sharing in Cloud Storage settings.

Answer

Add an IAM condition to the bucket policy to require that the user's domain is @example.com.

Question 7

A developer wants to configure a firewall rule to allow HTTP traffic from the internet to a specific Compute Engine instance tagged 'web-server'. Which TWO conditions must be true? (Choose two.)

Accepted Answer

The firewall rule must be of type ingress. Option B is correct because an ingress firewall rule controls incoming traffic to instances. Since the developer wants to allow HTTP traffic from the internet to reach the instance, the rule must be of type ingress to permit inbound connections on port 80.

Answer

The instance must have a public IP address

Answer

The firewall rule must be applied to the VPC network

Answer

The firewall rule must specify the source IP range 0.0.0.0/0

Question 8

A systems administrator needs to grant a group of external auditors read-only access to all resources in a GCP project, except for Cloud Storage buckets that contain sensitive data. The auditors should not be able to view the contents of those buckets. Which two IAM policies should the administrator implement? (Choose two.)

Accepted Answer

Assign the roles/viewer role at the project level.. Option A is correct because the roles/viewer role at the project level grants read-only access to all resources in the project, including Cloud Storage buckets, but it does not grant access to the objects within those buckets. This provides the auditors with the broad read-only access they need, except for the sensitive buckets where object-level access must be explicitly denied.

Answer

Assign the roles/storage.objectViewer role at the project level.

Answer

Assign the roles/storage.admin role at the project level.

Answer

Assign the roles/storage.objectViewer role on the sensitive buckets with a deny condition.

Question 9

A developer is deploying an HTTP-triggered Cloud Function for a production application. Which TWO configuration options should be applied to ensure security and control costs? (Choose two.)

Accepted Answer

Set a maximum instances limit. Setting a maximum instances limit (option B) is correct because it prevents uncontrolled scaling of Cloud Functions, which could lead to excessive costs due to high concurrency. By capping the number of concurrent function instances, you ensure that even under heavy load, the function does not scale beyond a predefined budget, directly controlling cost in a production environment.

Answer

Allow unauthenticated invocations

Answer

Set minimum instances to 0

Answer

Configure a custom domain for the function

Question 10

Which TWO actions should a Cloud Engineer take to deploy a containerized application on Cloud Run with a custom domain and SSL certificate automatically provisioned? (Choose two.)

Accepted Answer

Enable automatic SSL certificate provisioning. Option A is correct because Cloud Run's managed SSL feature automatically provisions and renews a Google-managed SSL certificate for the custom domain when you map it to the service. This eliminates the need for manual certificate management and is the simplest way to achieve HTTPS with a custom domain.

Answer

Create a self-managed SSL certificate in Cloud Load Balancing

Answer

Configure Serverless VPC Access to handle DNS

Answer

Create an external HTTPS load balancer in front of Cloud Run