Google ACE Quick Quiz — 10 Questions

Question 1

An organization policy at the organization level sets `constraints/compute.requireOsLogin` to enforced (true) on all projects. A specific project needs an exception — VMs there should not require OS Login. How can this exception be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set a project-level organization policy overriding `compute.requireOsLogin` to not enforced (if the constraint allows override). Organization policies can be overridden at a lower level (project, folder) if the constraint's `inheritFromParent` setting allows it. The `compute.requireOsLogin` boolean constraint supports per-project override, so setting it to `false` at the project level exempts that project's VMs from requiring OS Login while the organization-level policy remains enforced for all other projects.

Answer

Removing the VM from the VPC will bypass the organization policy

Answer

Grant the VM's service account the OS Login Admin role to bypass the policy

Answer

Move the project to a folder that doesn't inherit the organization policy

Question 2

Order the steps to set up a VPC network with a subnet, firewall rule allowing SSH, and a Compute Engine instance in that subnet.

Accepted Answer

Create VPC network and subnet first, then create firewall rule allowing SSH, then create Compute Engine instance in the subnet.. The correct sequence is to first create the VPC network and subnet, then create the firewall rule allowing SSH, and finally create the Compute Engine instance. This ensures that the network infrastructure is ready before the instance is launched, and SSH access is available immediately.

Answer

Create VPC network and subnet first, then create Compute Engine instance, then create firewall rule allowing SSH.

Answer

Create firewall rule allowing SSH first, then create VPC network and subnet, then create Compute Engine instance.

Answer

Create VPC network and subnet first, then create Compute Engine instance in the default subnet, then create a firewall rule allowing SSH for that subnet.

Question 3

You need to enforce that all new Cloud Storage buckets in your organization use Uniform Bucket-Level Access (UBLA) and are created in one of three approved regions: `us-central1`, `us-east1`, or `europe-west1`. What is the most efficient way to enforce both constraints?

Accepted Answer

Apply `storage.uniformBucketLevelAccess` and `gcp.resourceLocations` org policies at the organization level.. Organization policies are the most efficient way to enforce constraints across all new Cloud Storage buckets because they are evaluated at resource creation time by the Cloud Resource Manager. The `storage.uniformBucketLevelAccess` policy enforces UBLA, and `gcp.resourceLocations` restricts the allowed locations, both applied at the organization level to cover all projects without per-bucket overhead.

Answer

Write a Cloud Function triggered by bucket creation events to check and delete non-compliant buckets.

Answer

Create a custom IAM role that removes the `storage.buckets.create` permission for disallowed regions.

Answer

Use Terraform to provision all buckets and include validation in the Terraform plan step.

Question 4

A team wants to use Cloud Run to deploy a container that processes messages from a Pub/Sub topic. The container is stateless and the workload is expected to have irregular traffic spikes with high concurrency. Which scaling configuration is most appropriate?

Accepted Answer

Set min-instances to 0 and max-instances to 100 with concurrency of 80. Cloud Run can set a maximum number of concurrent requests per container instance. For Pub/Sub processing, setting max-instances can control cost, and the CPU is always allocated during request processing. The key is to allow multiple concurrent requests to handle spikes efficiently.

Answer

Set min-instances to 0 and max-instances to 1000 with concurrency of 1

Answer

Set min-instances to 10 and max-instances to 100 with concurrency of 1

Answer

Set min-instances to 1 and max-instances to 100 with concurrency of 1

Question 5

Your on-premises data center needs a dedicated, private connection to GCP with a guaranteed 10 Gbps bandwidth and SLA-backed availability. Internet-based VPN is not acceptable due to compliance requirements. Which connectivity option should you choose?

Accepted Answer

Cloud Interconnect Dedicated (10 Gbps). Dedicated Interconnect provides a direct, private physical connection between your on-premises network and GCP, offering up to 10 Gbps per circuit with a 99.99% SLA. Since internet-based VPN is not acceptable due to compliance requirements, this option meets the need for dedicated bandwidth and SLA-backed availability without traversing the public internet.

Answer

Cloud VPN with multiple tunnels for redundancy

Answer

Partner Interconnect via a carrier partner

Answer

Cloud Router with BGP peering over the public internet

Question 6

A new engineer joins the team and needs access to GCP. The company uses Google Workspace for identity management. The GCP admin needs to add the engineer and grant them access to one project. What is the correct order of steps?

Accepted Answer

Create the user in Google Workspace Admin Console, then grant their account IAM roles on the GCP project. Google Workspace is the identity provider (IdP) for the organization, so the engineer must first be created as a user in the Google Workspace Admin Console. Once the user exists, the GCP admin can then grant IAM roles (e.g., roles/viewer, roles/editor) on the specific project, which maps the Workspace user identity to GCP permissions. This follows the principle that GCP IAM relies on existing identities from the Cloud Identity or Workspace domain, not on separate user creation within GCP.

Answer

Create a service account for the engineer in GCP, then share the key file

Answer

Create a GCP project for the engineer, then add their personal Gmail as a project owner

Answer

Create an API key for the engineer in the GCP Console and share it securely

Question 7

You want to export a subset of Cloud Logging logs to BigQuery for long-term analysis. Which method should you use?

Accepted Answer

Create a log sink with a filter and destination BigQuery. Log sinks route logs to destinations like BigQuery, Cloud Storage, or Pub/Sub. Creating a sink with a filter is the correct approach.

Answer

Create a log-based metric and export the metric to BigQuery

Answer

Set up a Cloud Function that triggers on logs and inserts into BigQuery

Answer

Use gcloud logging read and pipe to bq load

Question 8

You are troubleshooting a Pub/Sub subscription that is not receiving messages as fast as they are published. You want to check if there is a backlog of unacknowledged messages for the subscription. What should you use?

Accepted Answer

Use Cloud Monitoring to view the 'oldest_unacked_message_age' metric. Cloud Monitoring has a metric for Pub/Sub subscription backlog (oldest unacknowledged message age or num_undelivered_messages).

Answer

Check the Cloud Logging logs for the subscription

Answer

Use gcloud pubsub subscriptions describe and check the ackDeadlineSeconds

Answer

Check the Cloud Console Pub/Sub dashboard for the topic publish rate

Question 9

A security engineer needs to ensure that Compute Engine instances in a VPC can only communicate with each other on port 443 and cannot receive traffic from the internet. The VPC has a default network with default firewall rules. What should the engineer do?

Accepted Answer

Delete all default firewall rules and create a rule allowing ingress from the VPC's subnet range (e.g., 10.0.0.0/16) on port 443.. The default VPC includes default firewall rules that allow ingress from the internet and allow all internal traffic. To restrict communication, the engineer must first delete the default ingress rule that allows all traffic from the internet (allow-ssh, allow-icmp, allow-rdp, and allow-http/https can be deleted), then create a new rule that allows ingress only from the VPC's IP range on port 443. The default internal rule allows all traffic within the network; to restrict to port 443, a new rule with higher priority can override it, or the default rule can be deleted and a new one created.

Answer

Create a firewall rule with priority 2000 denying ingress from 0.0.0.0/0 and a rule allowing ingress from 10.0.0.0/16 on port 443 with priority 1000.

Answer

Create a firewall rule with priority 1000 allowing ingress from 0.0.0.0/0 on port 443 and deny all other traffic.

Answer

Modify the default-allow-internal rule to only allow port 443.

Question 10

An engineer needs to audit all Data Access logs for a project to detect unauthorized access to sensitive data. The engineer must ensure that logs are retained for 5 years and are immutable. Which THREE steps should the engineer take?

Accepted Answer

Configure the Cloud Storage bucket with a retention policy and enable object versioning. To achieve this, the engineer must: 1. Enable Data Access audit logs for the required services (e.g., Cloud Storage, BigQuery) in the project's IAM audit config. 2. Create a log sink that exports the logs to a Cloud Storage bucket (which provides cost-effective long-term retention). 3. Configure the bucket with retention policy and object versioning to make logs immutable and protect against deletion. Using Logging's default retention is only 30 days, not 5 years. Cloud Monitoring does not store logs. BigQuery is not ideal for immutable storage.

Answer

Use the default Logging retention of 30 days

Answer

Set up a Cloud Monitoring alert for any Data Access log entries