Google ACE Multiple Select — 20 Questions

Question 1

An engineer needs to audit all Data Access logs for a project to detect unauthorized access to sensitive data. The engineer must ensure that logs are retained for 5 years and are immutable. Which THREE steps should the engineer take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the Cloud Storage bucket with a retention policy and enable object versioning. To achieve this, the engineer must: 1. Enable Data Access audit logs for the required services (e.g., Cloud Storage, BigQuery) in the project's IAM audit config. 2. Create a log sink that exports the logs to a Cloud Storage bucket (which provides cost-effective long-term retention). 3. Configure the bucket with retention policy and object versioning to make logs immutable and protect against deletion. Using Logging's default retention is only 30 days, not 5 years. Cloud Monitoring does not store logs. BigQuery is not ideal for immutable storage.

Answer

Use the default Logging retention of 30 days

Answer

Set up a Cloud Monitoring alert for any Data Access log entries

Question 2

A company requires that all service account keys be automatically rotated every 90 days. Which two steps should the administrator take to enforce this? (Choose two.)

Accepted Answer

Use the Service Account API to create keys with a custom expiration time.. The Service Account API allows creating keys with a custom expiration time, which enforces automatic rotation by ensuring keys are invalid after 90 days. Option E is correct because a Cloud Function can monitor key age and delete keys older than 90 days, providing a programmatic enforcement mechanism. Both approaches ensure keys are rotated automatically without manual intervention.

Answer

Enable the Service Account Key Rotator in the Google Cloud Console.

Answer

Use IAM to set a condition that keys must have an expiration date.

Answer

Use an Organization Policy to disable service account key creation.

Question 3

A company is migrating a legacy application to Google Cloud. The application requires a shared file system that can be mounted by multiple compute instances across different zones for high availability. Which two Google Cloud services can meet this requirement?

Accepted Answer

Google Cloud NetApp Volumes. Cloud Filestore and Google Cloud NetApp Volumes provide NFS-based file shares that can be mounted by multiple instances across zones. Persistent Disk cannot be attached in read-write mode to multiple instances across zones. Cloud Storage FUSE is not a POSIX-compliant shared file system. Cloud Run is a compute service, not a storage service.

Answer

Persistent Disk

Answer

Cloud Storage FUSE

Answer

Cloud Run

Question 4

Which TWO practices help ensure the reliability of a Cloud Functions deployment? (Choose two.)

Accepted Answer

Use Cloud Tasks to decouple function invocations.. Cloud Tasks decouples function invocations by queuing requests and delivering them asynchronously, which improves reliability by handling spikes in traffic without dropping requests and providing automatic retries on failure. Option E is correct because implementing retry policies for background functions (e.g., Cloud Functions triggered by Pub/Sub or Cloud Storage) ensures that transient failures are automatically retried, increasing the overall reliability of the deployment.

Answer

Deploy functions in a single region to minimize latency.

Answer

Configure a VPC connector for all functions.

Answer

Set maximum instances to 1 to avoid resource contention.

Question 5

You need to set up log-based alerting in Cloud Logging to send notifications when a specific error pattern appears in your application logs. Which TWO components are required to accomplish this?

Accepted Answer

An alerting policy. To create a log-based alert, you need a log-based metric that counts the matching log entries, and an alerting policy that uses that metric. The metric is the source of the condition, and the policy defines when to notify.

Answer

A log sink

Answer

A Cloud Pub/Sub topic

Answer

An uptime check

Question 6

A company wants to ensure that a Compute Engine instance can access only a specific Cloud Storage bucket and no other resources in the project. Which TWO steps should the engineer take? (Select 2 correct answers)

Accepted Answer

Attach the service account to the Compute Engine instance at creation.. To restrict an instance to a specific bucket, create a custom service account with the Storage Object Viewer role only on that bucket (via IAM binding on the bucket), then attach that service account to the instance. Granting role at project level is too broad. Using the default service account gives broader permissions.

Answer

Grant the roles/storage.admin role at the bucket level.

Answer

Grant the roles/storage.objectViewer role at the project level to the service account.

Answer

Use the default Compute Engine service account.

Question 7

A company wants to implement a least-privilege security model for a service account that needs to read secrets from Secret Manager and publish messages to Pub/Sub. Which TWO IAM roles should be granted? (Choose TWO)

Accepted Answer

roles/pubsub.publisher. The minimum roles needed are: roles/secretmanager.secretAccessor for reading secret versions, and roles/pubsub.publisher for publishing messages. roles/secretmanager.admin is too broad, roles/pubsub.admin is too broad, and roles/secretmanager.viewer only allows viewing metadata, not accessing secret values.

Answer

roles/secretmanager.viewer

Answer

roles/pubsub.admin

Answer

roles/secretmanager.admin

Question 8

A security engineer wants to audit all attempts to access a specific Cloud Storage bucket, including successful and failed read requests. Which THREE steps should they take? (Choose THREE)

Accepted Answer

Enable Data Access audit logs for the Cloud Storage service.. To audit data access, Data Access audit logs must be enabled for the bucket. Admin Activity logs only record configuration changes. Using Log Explorer allows filtering and analyzing logs. Granting the logging viewer role is necessary to view the logs. Creating a sink is for exporting logs, not necessary for auditing.

Answer

Create a log sink to BigQuery for the bucket's admin activity logs.

Answer

Enable Admin Activity audit logs for the bucket.

Question 9

You are designing a resource hierarchy for a company with three departments: Engineering, Sales, and HR. Each department should have its own projects, and policies should be applied at the department level. Which THREE steps should you take? (Choose three.)

Accepted Answer

Create a folder for each department. Create an organization node (if not already present). Under it, create a folder for each department. Then create projects within each folder. Apply IAM policies at the folder level.

Answer

Use labels to separate departments

Answer

Apply IAM policies at the project level only

Question 10

A startup wants to control costs across multiple GCP projects. They want to track spending by department and set budget alerts. Which THREE actions should they take?

Accepted Answer

Assign labels to resources indicating department. Using labels, budgets, and billing export enables tracking and alerts.

Answer

Use Cloud Monitoring to track costs

Answer

Create separate billing accounts for each department

Question 11

An administrator needs to create a custom IAM role that allows listing projects and viewing billing accounts. Which TWO permissions should be included?

Accepted Answer

billing.accounts.list. resourcemanager.projects.list and billing.accounts.list allow these actions.

Answer

billing.accounts.create

Answer

resourcemanager.projects.create

Answer

resourcemanager.projects.delete

Question 12

A company wants to manage multiple Google Cloud projects and enforce consistent security policies across all of them. Which TWO resources should they use? (Choose two.)

Accepted Answer

Organization policies. Organization policies are used to enforce constraints across projects. Folders allow grouping projects and applying common IAM policies.

Answer

Cloud Audit Logs

Answer

Shared VPC

Answer

Labels

Question 13

A Cloud Architect needs to understand the GCP resource hierarchy to set up proper access control. Which three resources are part of the GCP resource hierarchy? (Choose THREE.)

Accepted Answer

Folder. The GCP resource hierarchy includes Organization, Folder, Project, and Resources (like VMs). Cloud Identity and Billing Account are separate services.

Answer

Billing Account

Answer

Cloud Identity

Question 14

A company wants to run a containerized application on Google Cloud with minimal operational overhead. The application is stateless and can tolerate cold starts. Which three compute services should they consider? (Choose three.)

Accepted Answer

GKE Autopilot. Cloud Run, Cloud Functions, and GKE Autopilot are all serverless or fully managed container platforms with minimal operational overhead. Compute Engine and GKE Standard require node management.

Answer

Compute Engine

Answer

GKE Standard

Question 15

An engineer wants to create a VPC with a custom subnet mode and then create a subnet with Private Google Access enabled. Which two commands should they use? (Choose TWO.)

Accepted Answer

gcloud compute networks subnets create my-subnet --network my-vpc --region us-central1 --range 10.0.0.0/24 --enable-private-ip-google-access. To create a custom mode VPC, use 'gcloud compute networks create' with '--subnet-mode custom'. Then add a subnet with 'gcloud compute networks subnets create' including '--enable-private-ip-google-access'. The other commands are incorrect: one creates an auto mode VPC, another is for firewall rules.

Answer

gcloud compute networks subnets create my-subnet --network my-vpc --region us-central1 --range 10.0.0.0/24

Answer

gcloud compute firewall-rules create allow-http --allow tcp:80

Answer

gcloud compute networks create my-vpc --subnet-mode auto

Question 16

A developer wants to deploy a Cloud Function that is triggered by messages in a Pub/Sub topic. Which TWO flags are required in the gcloud functions deploy command?

Accepted Answer

--runtime. For a Pub/Sub-triggered Cloud Function, you must specify --trigger-topic and --runtime. The --entry-point is optional if the function name matches. --memory and --timeout are optional.

Answer

--timeout

Answer

--memory

Answer

--entry-point

Question 17

An organization wants to enforce that all Compute Engine instances in a project use customer-managed encryption keys (CMEK) for their boot disks. Which TWO steps should the security team take?

Accepted Answer

Set an organization policy constraint that requires CMEK for Compute Engine disks. To enforce CMEK, you can set an organization policy constraint (e.g., constraints/compute.requireCmek) to prevent creation of instances without CMEK. Additionally, you must grant the compute engine service account permission to use the KMS key so it can encrypt disks. Simply specifying the key in the instance template does not enforce the policy, and the Cloud KMS Admin role is too broad.

Answer

Specify the CMEK key in each instance template used for managed instance groups

Answer

Grant the Cloud KMS Admin role to the project's compute service account

Answer

Create a Cloud Audit Logs sink to monitor instances without CMEK

Question 18

Which THREE configurations are required to enable Private Google Access for Compute Engine instances in a custom VPC subnet? (Select 3 correct answers)

Accepted Answer

Create a subnet with the --enable-private-ip-google-access flag.. Private Google Access is enabled on a subnet. Instances in that subnet can reach Google APIs using internal IPs. It does not require Cloud NAT, Cloud VPN, or internet access. The three required elements are: a VPC network, a subnet with Private Google Access enabled, and instances in that subnet.

Answer

Create a Cloud Router to advertise routes to Google.

Answer

Configure Cloud NAT to route traffic to Google APIs.

Question 19

A company uses preemptible VMs for batch processing. Which TWO best practices should be implemented to improve resilience and manageability? (Choose 2)

Accepted Answer

Use instance metadata to pass configuration parameters.. Instance metadata is a key-value store that can be used to pass configuration parameters to preemptible VMs at boot time. Since preemptible VMs can be terminated at any time, using metadata ensures that new instances can be recreated with the same configuration without manual intervention. This improves manageability by centralizing configuration and resilience by enabling automated re-provisioning.

Answer

Use persistent disks to store application state.

Answer

Use Cloud Functions to monitor instance termination.

Answer

Use persistent disk snapshots for backup.

Question 20

A team is deploying a stateful application on GKE that requires each pod to have its own persistent disk. Which TWO Kubernetes resources are essential for this deployment? (Choose two.)

Accepted Answer

StatefulSet. A StatefulSet is essential because it provides stable, unique network identifiers and ordered, graceful deployment and scaling for stateful applications, ensuring each pod maintains its identity and persistent storage binding across rescheduling. A PersistentVolumeClaim (PVC) is required to request and bind a persistent disk to each pod, enabling the pod to retain its data independently of other pods in the set.

Answer

Deployment

Answer

ConfigMap

Answer

Ingress