Google ACE Setting up a cloud solution environment — 15 Questions

Question 1

What is the correct order of the Google Cloud resource hierarchy from highest to lowest level?

Accepted Answer

Organization → Folder → Project → Resources. The Google Cloud resource hierarchy is structured from highest to lowest as Organization, Folder, Project, and Resources. The Organization node is the root, allowing centralized policy management; Folders group projects under departments or teams; Projects are the base-level containers for services and APIs; Resources (like Compute Engine instances) reside within projects. Option B correctly reflects this top-down inheritance of IAM policies and access control.

Answer

Folder → Organization → Project → Resources

Answer

Project → Folder → Organization → Resources

Answer

Organization → Project → Folder → Resources

Question 2

A startup creates its first Google Cloud project. Before deploying any paid resources, what must be linked to the project?

Accepted Answer

A billing account. A billing account must be linked to a Google Cloud project before deploying any paid resources because Google Cloud requires a valid payment method to be associated with the project to track and charge for resource usage. Without a billing account, the project is in a 'billing-enabled' state and can only use free-tier or always-free resources, but any paid service will fail to provision.

Answer

A Cloud Identity domain

Answer

An Organization resource node

Answer

A Shared VPC host project

Question 3

Which gcloud CLI command authenticates a developer's local environment with their Google account?

Accepted Answer

gcloud auth login. Option B, `gcloud auth login`, is correct because it initiates the OAuth 2.0 flow to authenticate the gcloud CLI with a user's Google account, storing the resulting credentials locally for subsequent API calls. This command is the standard way to authorize a developer's local environment for the first time or when switching users.

Answer

gcloud config set account [EMAIL]

Answer

gcloud init --authenticate

Answer

gcloud accounts activate

Question 4

A developer attempts to create a Cloud SQL instance but receives the error: 'API [sqladmin.googleapis.com] not enabled.' What is the correct resolution?

Accepted Answer

Enable the Cloud SQL Admin API via APIs & Services > Library in the Console. The error 'API [sqladmin.googleapis.com] not enabled' indicates that the Cloud SQL Admin API has not been activated for the project. The correct resolution is to enable the API via APIs & Services > Library in the Google Cloud Console, as this is a prerequisite for creating any Cloud SQL instance. Assigning IAM roles or requesting quota increases does not enable the underlying API service.

Answer

Assign the developer the Cloud SQL Admin IAM role

Answer

Request a quota increase for Cloud SQL in the project

Answer

Create a new project — Cloud SQL is enabled by default in new projects

Question 5

An application running on a Compute Engine VM needs to read objects from a Cloud Storage bucket in the same project. What is the recommended authentication approach?

Accepted Answer

Attach a service account with the Storage Object Viewer role to the VM. Option B is correct because attaching a service account with the Storage Object Viewer role to the Compute Engine VM is the recommended and secure method for authenticating to Cloud Storage. The VM automatically obtains OAuth 2.0 access tokens for the service account via the metadata server, eliminating the need to manage or embed credentials in the application code.

Answer

Embed a developer's user account credentials in the application configuration file

Answer

Create an API key and store it as an environment variable on the VM

Answer

Grant the VM's IP address access to the bucket using a VPC firewall rule

Question 6

A company organizes its GCP projects by business unit — Finance, Engineering, and Sales. Which resource is best suited to group these projects while applying shared IAM policies to all projects in each group?

Accepted Answer

Create GCP Folders for each business unit and add the relevant projects. C is correct because GCP Folders are the hierarchical resource designed to group projects under an organization node, allowing you to apply shared IAM policies at the folder level that automatically propagate to all projects within that folder. This aligns with the requirement to organize projects by business unit and enforce consistent access controls across each group.

Answer

Apply labels to each project to identify the business unit

Answer

Apply resource tags to each project for policy enforcement

Answer

Create a Shared VPC host project for each business unit

Question 7

A developer works across five different GCP projects daily and wants to switch their active project in the gcloud CLI without rerunning `gcloud init`. Which command should they use?

Accepted Answer

gcloud config set project [PROJECT_ID]. The `gcloud config set project [PROJECT_ID]` command updates the `core/project` property in the active gcloud CLI configuration, allowing the developer to switch the active project without re-running `gcloud init`. This is the standard method for changing the project context in the current configuration, which persists across sessions until changed again.

Answer

gcloud projects switch [PROJECT_ID]

Answer

gcloud auth set-project [PROJECT_ID]

Answer

gcloud init --project=[PROJECT_ID]

Question 8

A security team wants to prevent every project in the organization from creating VM instances with external IP addresses — without requiring configuration in each individual project. What is the most scalable solution?

Accepted Answer

Set the organization policy constraint compute.vmExternalIpAccess to Deny All at the organization level. Option B is correct because the organization policy constraint `compute.vmExternalIpAccess` can be applied at the organization level to deny all VM instances from having external IP addresses, enforcing this rule across all projects without per-project configuration. This is the most scalable approach as it uses Google Cloud's hierarchical policy engine to centrally control resource creation, overriding any project-level settings.

Answer

Create a firewall rule in every project blocking outbound traffic on port 80 and 443

Answer

Remove the Compute Engine Admin role from all project owners

Answer

Use Cloud Armor to block all traffic destined for public IPs in the organization

Question 9

Where in the Google Cloud Console can a user view all APIs currently enabled for their project and monitor their usage?

Accepted Answer

APIs & Services > Dashboard. Option C is correct because the 'APIs & Services > Dashboard' page in the Google Cloud Console provides a centralized view of all enabled APIs for a project, along with real-time usage metrics such as requests per second, error rates, and latency. This dashboard is the primary interface for monitoring API consumption and identifying throttling or quota issues.

Answer

Cloud Shell > Active Sessions

Answer

IAM & Admin > Service Accounts

Answer

Monitoring > Metrics Explorer

Question 10

A team's Cloud Build jobs are consistently failing with 'quota exceeded' errors. Billing is active and the project has available budget. What should the team do?

Accepted Answer

Request a quota increase for the Cloud Build API in the project settings. Option C is correct because Cloud Build quota errors indicate that the project has reached its API rate limit or concurrent build limit, not a billing issue. Quotas are per-project and can be increased by requesting a higher limit from the Cloud Build API quotas page in the Google Cloud Console. Billing being active and having budget means the issue is not financial, so the team must specifically request a quota increase for the Cloud Build API.

Answer

Delete unused projects in the same organization to release global quota

Answer

Upgrade the billing account to a higher payment tier

Answer

Use a larger machine type for Cloud Build worker pools

Question 11

A Cloud Identity admin needs to grant a user access to manage billing for a specific GCP project without giving them access to any other projects in the organization. Which role should be assigned at the project level?

Accepted Answer

Project Billing Manager on the specific project. The Project Billing Manager role is the correct choice because it grants permissions to manage billing for a specific GCP project, including viewing billing reports and setting budget alerts, without providing access to other projects. This role is assigned at the project level, ensuring the user's billing management scope is limited to that single project.

Answer

Billing Account Administrator at the organization level

Answer

Editor on the specific project

Answer

Billing Account User at the billing account level

Question 12

During a gcloud CLI session, a developer runs `gcloud config list` and sees the output shows `project = old-project`. They need to work in `new-project`. Which sequence of commands correctly switches projects and verifies the change?

Accepted Answer

gcloud config set project new-project; gcloud config list. Option B is correct because `gcloud config set project new-project` updates the active project in the local CLI configuration, and `gcloud config list` then displays the current configuration, confirming the change. This is the standard method to switch the working project for subsequent gcloud commands.

Answer

gcloud projects activate new-project; gcloud config list

Answer

gcloud auth login --project=new-project; gcloud config list

Answer

export GCLOUD_PROJECT=new-project; gcloud config list

Question 13

An organization has a policy requiring all new GCP projects to be created within specific folders and linked to approved billing accounts only. Which combination of features enforces this at scale?

Accepted Answer

Organization policies to restrict allowed billing accounts + granting Project Creator role only at approved folder level. Option B is correct because it combines two enforcement mechanisms: Organization policies (specifically the `constraints/compute.restrictBillingAccounts` constraint) to limit which billing accounts can be attached to projects, and granting the Project Creator role (`roles/resourcemanager.projectCreator`) only at the folder level (not the organization level). This ensures that new projects can only be created within the approved folders and must use an approved billing account, enforcing the policy at scale across the entire organization.

Answer

IAM deny policies on the organization + VPC Service Controls

Answer

Cloud Asset Inventory alerts + manual review of new projects

Answer

Requiring multi-factor authentication for all project creators

Question 14

A GCP project has three service accounts. A developer wants to list all service accounts in the project using the gcloud CLI. Which command is correct?

Accepted Answer

gcloud iam service-accounts list. Option C is correct because the `gcloud iam service-accounts list` command is the standard gcloud CLI command to list all service accounts in a GCP project. It uses the IAM API to retrieve the service accounts associated with the current project (or a specified project via the `--project` flag). This command is part of the `gcloud iam` group, which manages IAM resources, and the `service-accounts` sub-group specifically handles service account operations.

Answer

gcloud service-accounts list

Answer

gcloud iam list service-accounts

Answer

gcloud projects list-service-accounts

Question 15

A team uses Cloud Shell for all GCP CLI operations. A developer notices that files they create in Cloud Shell's home directory persist between sessions, but files in other directories do not. What explains this behavior?

Accepted Answer

Only $HOME (~) has persistent 5 GB storage; other directories use ephemeral container storage. Cloud Shell provides each user with a persistent 5 GB home directory ($HOME) backed by Cloud Storage. Files created outside this directory reside in the container's ephemeral storage, which is discarded when the Cloud Shell session ends or is restarted. This design ensures user configurations and scripts are preserved while maintaining a clean, temporary environment for other operations.

Answer

Cloud Shell saves all files to Cloud Storage automatically

Answer

Cloud Shell stores files in Firestore, which only retains home directory paths

Answer

Files outside $HOME are deleted after 24 hours automatically