Google ACE Setting up a cloud solution environment Practice Test 2 — 15 Questions

Question 1

A GCP project uses labels extensively for cost attribution across teams. A finance team member needs to add a 'cost-center' label to an existing Compute Engine VM. Which gcloud command applies the label?

Accepted Answer

gcloud compute instances add-labels my-vm --labels=cost-center=finance-ops --zone=us-central1-a. Option B is correct because the `gcloud compute instances add-labels` command is the specific gcloud command designed to add labels to an existing Compute Engine VM. It requires the `--labels` flag with key-value pairs and the `--zone` flag to specify the VM's location, which is necessary for the API call to succeed.

Answer

gcloud compute instances update my-vm --add-label=cost-center=finance-ops

Answer

gcloud label add --resource=my-vm --key=cost-center --value=finance-ops

Answer

gcloud compute instances set-labels my-vm --labels=cost-center=finance-ops

Question 2

A project manager wants to see how much each GCP service is costing the team this month, broken down by service. Where should they look?

Accepted Answer

Billing > Reports (filtered by service). Option C is correct because the Billing > Reports page in the Google Cloud Console allows you to filter costs by service, SKU, project, and other dimensions. This provides a granular breakdown of monthly spending per GCP service, which is exactly what the project manager needs.

Answer

IAM & Admin > Quotas

Answer

Cloud Monitoring > Cost metrics dashboard

Answer

Resource Manager > Project settings > Cost summary

Question 3

A new engineer joins the team and needs access to GCP. The company uses Google Workspace for identity management. The GCP admin needs to add the engineer and grant them access to one project. What is the correct order of steps?

Accepted Answer

Create the user in Google Workspace Admin Console, then grant their account IAM roles on the GCP project. Option B is correct because Google Workspace is the identity provider (IdP) for the organization, so the engineer must first be created as a user in the Google Workspace Admin Console. Once the user exists, the GCP admin can then grant IAM roles (e.g., roles/viewer, roles/editor) on the specific project, which maps the Workspace user identity to GCP permissions. This follows the principle that GCP IAM relies on existing identities from the Cloud Identity or Workspace domain, not on separate user creation within GCP.

Answer

Create a service account for the engineer in GCP, then share the key file

Answer

Create a GCP project for the engineer, then add their personal Gmail as a project owner

Answer

Create an API key for the engineer in the GCP Console and share it securely

Question 4

A developer frequently switches between three GCP projects and accounts throughout the day. They want to avoid rerunning `gcloud init` each time. Which gcloud feature lets them save and switch between pre-configured project/account/region combinations?

Accepted Answer

gcloud named configurations created with `gcloud config configurations create`. Option B is correct because `gcloud config configurations` allow a developer to create, save, and switch between named sets of gcloud properties (project, account, region, zone) without re-running `gcloud init`. Each configuration stores its own active account, project ID, and default compute region/zone, and can be activated instantly with `gcloud config configurations activate <name>`, making it ideal for frequent context switching between multiple GCP projects and accounts.

Answer

gcloud environments — a built-in workspace manager

Answer

Separate gcloud installations — one per project

Answer

A .gcloudrc file in each project directory that gcloud reads automatically

Question 5

A security team needs an inventory of all Compute Engine VM instances across all projects in their GCP organization, including instance names, zones, and status, without logging into each project individually. Which service provides this?

Accepted Answer

Cloud Asset Inventory with an organization-scoped asset search. Cloud Asset Inventory provides a unified, organization-scoped view of all resources across projects, including Compute Engine VM instances. By using an organization-scoped asset search, the security team can query for all VM instances (e.g., `asset_type = "compute.googleapis.com/Instance"`) without needing to log into each project individually. This service is purpose-built for cross-project resource discovery and inventory management.

Answer

Cloud Monitoring — use the metric explorer to list all VM instances

Answer

Cloud Resource Manager — list all projects and then query each for VMs

Answer

BigQuery information_schema views for GCP compute resources

Question 6

A team runs a critical production project and wants to prevent anyone — including project owners and organization admins — from accidentally deleting it. Which mechanism provides this protection?

Accepted Answer

Create a project lien using the Cloud Resource Manager API or gcloud. A project lien is the correct mechanism because it explicitly prevents the deletion of a Google Cloud project by blocking the `resourcemanager.projects.delete` operation until the lien is removed. This protection works regardless of the user's role, including project owners and organization admins, and is managed via the Cloud Resource Manager API or `gcloud` command. It is designed specifically for accidental deletion prevention, not for access control.

Answer

Remove the Owner role from all users in the project

Answer

Set an organization policy denying the resourcemanager.projects.delete permission

Answer

Enable deletion protection in the project's IAM settings in the Console

Question 7

Instead of granting IAM roles to 50 individual developer email addresses, a team wants to manage access by team membership. When a developer joins or leaves, access updates automatically. What is the recommended approach?

Accepted Answer

Grant IAM roles to a Google Group containing all team members. Option B is correct because Google Groups act as identity containers that can be granted IAM roles at the project or resource level. When developers are added to or removed from the group, their IAM permissions automatically update without requiring manual role changes for each individual user. This aligns with the principle of least privilege and simplifies access management at scale.

Answer

Create a service account shared by all developers on the team

Answer

Create a GCP project per developer and use cross-project IAM bindings

Answer

Use Cloud Identity-Aware Proxy to manage team membership

Question 8

A Cloud Build pipeline needs to deploy to Cloud Run but the pipeline's service account has only minimal permissions. Rather than granting it Cloud Run Admin, the team wants it to temporarily act as a more privileged deployment service account. Which technique enables this?

Accepted Answer

Grant service account impersonation: give the Cloud Build SA the Token Creator role on the deployment SA. Option B is correct because it uses IAM service account impersonation, which allows the Cloud Build service account to temporarily assume the identity of a more privileged deployment service account by calling the iam.serviceAccounts.actAs permission. This avoids granting broad Cloud Run Admin permissions directly to the pipeline's service account, adhering to the principle of least privilege. The Token Creator role (roles/iam.serviceAccountTokenCreator) on the deployment service account enables the Cloud Build SA to generate short-lived OAuth2 tokens for impersonation, which are automatically scoped to the deployment SA's permissions.

Answer

Download the deployment service account's JSON key and store it in Cloud Build secrets

Answer

Add the Cloud Build SA as an Owner of the project

Answer

Enable service account delegation in the project's IAM settings

Question 9

A project was accidentally deleted. A GCP administrator realizes the mistake 3 days later. What is the maximum time window in which the project can be restored?

Accepted Answer

30 days — projects can be restored using `gcloud projects undelete` within this window. Option C is correct because Google Cloud projects have a 30-day soft-delete period after deletion. During this window, the project can be recovered using the `gcloud projects undelete` command or the Cloud Resource Manager API, restoring all associated resources and configurations.

Answer

24 hours — projects are permanently deleted after one day

Answer

7 days — projects enter a one-week soft-delete period

Answer

Projects are permanently deleted immediately and cannot be recovered

Question 10

A FinOps team wants to analyze daily GCP spending trends, allocate costs by team using labels, and create custom dashboards. Which configuration exports billing data for this analysis?

Accepted Answer

Enable Cloud Billing data export to BigQuery and query the exported dataset. Option C is correct because exporting GCP billing data to BigQuery enables granular, daily cost analysis, label-based allocation, and custom dashboard creation via tools like Looker Studio. BigQuery's SQL interface allows querying detailed cost and usage data, which is essential for the FinOps team's requirements.

Answer

Enable Cloud Monitoring billing metrics and build dashboards in Metrics Explorer

Answer

Download the monthly billing PDF from the Console and import it into a spreadsheet

Answer

Use the Cloud Billing API to pull cost data into Cloud Firestore nightly

Question 11

An infrastructure team uses Terraform to manage GCP resources including API enablement. Which Terraform resource enables a GCP API for a project, equivalent to `gcloud services enable`?

Accepted Answer

google_project_service with the desired service endpoint. The `google_project_service` resource is the direct Terraform equivalent of `gcloud services enable`, as it explicitly enables a specified GCP service API for a given project. This resource takes the service endpoint (e.g., `compute.googleapis.com`) and handles the enablement lifecycle, including dependency tracking and disabling on destroy.

Answer

google_project_iam_binding with the serviceusage.services.enable permission

Answer

google_service_account with enabled_services block

Answer

google_project with the services argument listing all required APIs

Question 12

A platform team needs to categorize GCP resources for policy enforcement (e.g., applying IAM conditions only to resources tagged 'environment:production'). Labels exist but don't support IAM conditions. What feature provides policy-tag-based enforcement?

Accepted Answer

Resource Manager Tags — attach a tag with key 'environment' and value 'production' and reference it in IAM conditions. Option B is correct because Resource Manager Tags are the GCP feature specifically designed to support IAM conditions for policy enforcement. Unlike resource labels, which are simple key-value pairs used for metadata and billing, Resource Manager Tags can be referenced in IAM condition expressions using the `resource.matchTag` function, enabling fine-grained access control based on tag values such as 'environment:production'.

Answer

Resource labels — set environment=production on each resource and reference in IAM conditions

Answer

Cloud Asset Inventory metadata fields — query by label and apply policies

Answer

Pub/Sub event-driven policy application triggered by label changes

Question 13

A developer wants to verify which IAM roles they currently have on a specific GCP project before requesting additional access. Which gcloud command lists the IAM policy for a project?

Accepted Answer

gcloud projects get-iam-policy [PROJECT_ID]. The correct command to retrieve the IAM policy for a GCP project is `gcloud projects get-iam-policy [PROJECT_ID]`. This command returns the complete IAM policy bindings (roles and members) for the specified project, allowing the developer to see which roles they currently have. It directly queries the Cloud Resource Manager API to fetch the project-level IAM policy.

Answer

gcloud iam roles list --project=[PROJECT_ID]

Answer

gcloud auth list --project=[PROJECT_ID]

Answer

gcloud iam service-accounts get-iam-policy [PROJECT_ID]

Question 14

A developer's gcloud command fails with 'PROJECT_ID is not set'. They need to confirm the currently active configuration — project, account, and default region. Which command shows this?

Accepted Answer

gcloud config list. Option B, `gcloud config list`, is correct because it displays the currently active configuration's core properties: project, account, and region (and zone if set). This directly answers the need to confirm the active project ID, account, and default region, and is the standard command for troubleshooting configuration issues like 'PROJECT_ID is not set'.

Answer

gcloud info

Answer

gcloud auth status

Answer

gcloud projects describe --current

Question 15

A startup's GCP project has a project ID of 'my-startup-prod' and a project number of '123456789012'. An API call requires the project number, not the project ID. How can the project number be retrieved quickly?

Accepted Answer

Run `gcloud projects describe my-startup-prod` and look for the projectNumber field. Option B is correct because the `gcloud projects describe` command retrieves detailed metadata about a GCP project, including the `projectNumber` field, which is a unique numeric identifier assigned by Google Cloud. This is the standard method to quickly obtain the project number when only the project ID is known, as the project number is not derivable from the project ID.

Answer

The project number is always the same as the last 12 digits of the project ID

Answer

Run `gcloud config get-value project-number`

Answer

The project number appears in the URL bar of the GCP Console — it's the number after /project/