Google ACE Setting up a cloud solution environment Practice Test 3 — 15 Questions

Question 1

A security auditor needs to check whether a specific user (user@company.com) currently has sufficient permissions to delete a Cloud SQL instance in project 'prod-db'. Without making any changes, which tool simulates this check?

Accepted Answer

Use the IAM Policy Troubleshooter (Policy Simulator) to check if the permission is granted. The IAM Policy Troubleshooter (Policy Simulator) is the correct tool because it allows you to check whether a specific user has a particular permission (e.g., cloudsql.instances.delete) on a given resource (the Cloud SQL instance in project 'prod-db') without making any changes. It evaluates the effective IAM policy, including all inherited roles and policies, and returns a result indicating whether the permission is granted. This directly addresses the auditor's need to simulate a permission check without executing any action.

Answer

Run the delete command with `--dry-run` flag to simulate without executing

Answer

Inspect the IAM policy with `gcloud projects get-iam-policy` and manually trace inheritance

Answer

Grant the user the permission temporarily, test the delete, then revoke it

Question 2

A team is migrating from Google Container Registry (gcr.io) to Artifact Registry. Existing automation scripts use `gcr.io/my-project/myimage`. To avoid updating all scripts immediately, which Artifact Registry feature allows gcr.io-addressed pulls to work with Artifact Registry backends?

Accepted Answer

Enable the gcr.io compatibility redirect in Artifact Registry settings so gcr.io URLs route to Artifact Registry. Option B is correct because Artifact Registry offers a gcr.io compatibility redirect feature that automatically routes requests originally targeting `gcr.io/my-project/myimage` to the corresponding Artifact Registry repository. This allows existing automation scripts to continue using the old `gcr.io` hostname without modification, while the underlying storage and image management are handled by Artifact Registry. The redirect is configured at the project level and works transparently for pull operations, eliminating the need for immediate script updates.

Answer

Artifact Registry has no gcr.io compatibility — all scripts must be updated immediately

Answer

Use a Cloud DNS private zone to redirect gcr.io to Artifact Registry

Answer

Both Container Registry and Artifact Registry can be active simultaneously with no configuration

Question 3

A platform admin creates a new GCP project for a team. The team lead's email is teamlead@company.com. The admin needs the team lead to be able to create resources in the project but not manage IAM policies or billing. Which role is most appropriate?

Accepted Answer

Editor. The Editor role (roles/editor) grants all permissions necessary to create, modify, and delete resources within a GCP project, but explicitly excludes permissions to manage IAM policies (roles/iam.securityAdmin or roles/owner) and billing (roles/billing.admin). This makes it the correct choice for a team lead who needs to deploy and manage resources without having the ability to change access controls or alter billing configurations.

Answer

Owner

Answer

Viewer

Answer

Billing Account Administrator

Question 4

A team needs to create a Compute Engine VM but the `gcloud compute instances create` command is failing with 'insufficient permissions'. The team lead says the service account has the Compute Engine Default role. What is the minimal IAM role that allows creating VM instances?

Accepted Answer

Compute Instance Admin (v1). The Compute Instance Admin (v1) role (roles/compute.instanceAdmin.v1) provides the necessary permissions to create, modify, and delete Compute Engine VM instances. The Compute Engine Default service account lacks the required permissions for instance creation, and this role is the minimal predefined IAM role that includes compute.instances.create.

Answer

Compute Viewer

Answer

Compute Network Admin

Answer

Project Editor

Question 5

A developer accidentally exposed their gcloud application default credentials (ADC) file. They need to immediately revoke these credentials. Which command revokes the active application default credentials?

Accepted Answer

gcloud auth application-default revoke. Option B is correct because `gcloud auth application-default revoke` is the specific command designed to revoke the Application Default Credentials (ADC) that were set via `gcloud auth application-default login`. This command invalidates the OAuth 2.0 refresh token stored in the ADC file, ensuring the credentials can no longer be used for authentication to Google Cloud APIs.

Answer

gcloud auth revoke [ACCOUNT_EMAIL]

Answer

Delete the ~/.config/gcloud/application_default_credentials.json file manually

Answer

gcloud config unset auth/application_default_credentials

Question 6

A GCP organization has 150 projects. A new security policy requires all projects to enable the Security Command Center API. What is the most efficient way to enable this API across all projects without manually visiting each project?

Accepted Answer

Use a gcloud script to iterate over all projects and enable the API for each. Option B is correct because the gcloud command-line tool allows you to script the enabling of the Security Command Center API across all projects efficiently. Using `gcloud services enable securitycenter.googleapis.com --project=<project_id>` in a loop over the list of projects automates the task without manual intervention, leveraging the Cloud SDK's programmatic access to the Service Usage API.

Answer

Manually enable the API in each of the 150 projects via the Cloud Console

Answer

Enable the API at the organization level — it inherits down to all projects

Answer

Create an organization policy enabling all APIs on all projects

Question 7

A team's CI/CD pipeline authenticates to GCP using Application Default Credentials (ADC). The pipeline runs on a GCE VM with a service account attached. Which credential source does the ADC use when running on a GCE VM?

Accepted Answer

The VM's attached service account credentials via the instance metadata server. On a GCE VM, Application Default Credentials (ADC) automatically uses the credentials from the VM's attached service account by querying the instance metadata server at the link-local address 169.254.169.254. This is the default behavior when no environment variable or other credential source is explicitly configured, making option B correct.

Answer

The GOOGLE_APPLICATION_CREDENTIALS environment variable pointing to a JSON key file

Answer

The developer's personal Google account used during `gcloud auth login`

Answer

A randomly selected service account from the project's service accounts list

Question 8

A GCP project administrator needs to share read-only access to all resources in the project with an external auditor who has a Gmail account (auditor@gmail.com). What should the admin do?

Accepted Answer

Grant the Viewer role to auditor@gmail.com in the project's IAM policy. Granting the Viewer (roles/viewer) role to auditor@gmail.com in the project's IAM policy is correct because it provides read-only access to all resources in the project without requiring a Cloud Identity account. Gmail accounts are supported as Google Accounts and can be added directly to IAM policies, allowing them to authenticate and access resources via the GCP Console or APIs.

Answer

Create a service account for the auditor and share the JSON key file

Answer

Add auditor@gmail.com as a project billing admin to give them read-only access

Answer

Create a Cloud Identity account for the auditor — Gmail accounts cannot access GCP projects

Question 9

Your organization has a parent folder structure: Root Org → Division A → Team 1 → projects. You need to apply a constraint that prevents all projects in Team 1 from disabling Cloud Audit Logs, but you want Division A to be able to override this constraint for its other teams. At which resource level should you apply the `gcp.disableCloudLogging` org policy?

Accepted Answer

Team 1 folder. Option C is correct because applying the `gcp.disableCloudLogging` org policy at the Team 1 folder ensures that all projects within that folder inherit the constraint, preventing them from disabling Cloud Audit Logs. Since org policies are inherited hierarchically, Division A can override this constraint for its other teams by applying a different policy at the Division A folder level, which takes precedence over the Team 1 folder policy for those other teams.

Answer

Root organization node

Answer

Division A folder

Answer

Each individual project in Team 1

Question 10

A developer runs `gcloud projects list` and receives the error: `ERROR: (gcloud.projects.list) PERMISSION_DENIED: The caller does not have permission`. The developer has the Viewer role on several projects. What is the most likely cause?

Accepted Answer

The developer lacks `resourcemanager.projects.list` at the organization or folder level.. The `gcloud projects list` command requires the `resourcemanager.projects.list` permission, which is granted at the organization or folder level, not at the individual project level. Even with the Viewer role on several projects, the developer lacks this specific permission at the resource hierarchy level above the projects, causing the PERMISSION_DENIED error.

Answer

The developer does not have multi-factor authentication enabled.

Answer

The gcloud SDK is outdated and must be updated.

Answer

The developer's account has been suspended by the billing administrator.

Question 11

You are designing an environment where a CI/CD pipeline running in GitHub Actions needs to deploy Cloud Run services without storing any long-lived service account keys. Your organization's security policy prohibits downloading SA keys. Which approach meets these requirements?

Accepted Answer

Use Workload Identity Federation to allow GitHub Actions to impersonate a service account using OIDC tokens.. Workload Identity Federation allows GitHub Actions to exchange OIDC tokens from GitHub's identity provider for Google Cloud service account impersonation, eliminating the need to download and store long-lived service account keys. This approach satisfies the security policy by using short-lived, automatically rotated tokens that are valid for only one hour, and it integrates directly with GitHub's OIDC provider without requiring any secret key material.

Answer

Create a service account key, base64-encode it, and store it as a GitHub Actions secret.

Answer

Grant the GitHub Actions runner VM's default service account the necessary roles.

Answer

Use Cloud Build triggers instead of GitHub Actions to avoid key management.

Question 12

You need to enforce that all new Cloud Storage buckets in your organization use Uniform Bucket-Level Access (UBLA) and are created in one of three approved regions: `us-central1`, `us-east1`, or `europe-west1`. What is the most efficient way to enforce both constraints?

Accepted Answer

Apply `storage.uniformBucketLevelAccess` and `gcp.resourceLocations` org policies at the organization level.. Organization policies are the most efficient way to enforce constraints across all new Cloud Storage buckets because they are evaluated at resource creation time by the Cloud Resource Manager. The `storage.uniformBucketLevelAccess` policy enforces UBLA, and `gcp.resourceLocations` restricts the allowed locations, both applied at the organization level to cover all projects without per-bucket overhead.

Answer

Write a Cloud Function triggered by bucket creation events to check and delete non-compliant buckets.

Answer

Create a custom IAM role that removes the `storage.buckets.create` permission for disallowed regions.

Answer

Use Terraform to provision all buckets and include validation in the Terraform plan step.

Question 13

A developer needs to use Application Default Credentials (ADC) in a local development environment to call the Cloud Translation API. They have already run `gcloud auth login`. What additional step is required to make ADC work correctly?

Accepted Answer

Run `gcloud auth application-default login` to generate ADC credentials.. Option A is correct because `gcloud auth application-default login` creates a special credential file (typically at `~/.config/gcloud/application_default_credentials.json`) that Application Default Credentials (ADC) uses to authenticate API calls. While `gcloud auth login` sets up user credentials for gcloud CLI commands, ADC does not use those credentials directly; it requires its own separate credential file. Running this command ensures that the local development environment can authenticate to the Cloud Translation API via ADC without additional configuration.

Answer

Set the `GOOGLE_CLOUD_PROJECT` environment variable to the project ID.

Answer

Download a service account JSON key and set `GOOGLE_APPLICATION_CREDENTIALS`.

Answer

Run `gcloud config set account` to switch to the correct account.

Question 14

Your security team requires that all service accounts in your GCP organization older than 90 days that have not been used must be automatically disabled. They want a fully managed, serverless solution with no persistent infrastructure. Which architecture best meets these requirements?

Accepted Answer

Use Cloud Scheduler to trigger a Cloud Function that queries Cloud Asset Inventory and disables stale service accounts.. Option B is correct because Cloud Scheduler can trigger a serverless Cloud Function on a schedule (e.g., nightly) to query Cloud Asset Inventory for service accounts older than 90 days with no last authentication time, then disable them via the IAM API. This meets the fully managed, serverless requirement with no persistent infrastructure (no VMs or servers to maintain).

Answer

Deploy a Compute Engine VM with a cron job that calls the IAM API nightly.

Answer

Configure an org policy that automatically expires service accounts after 90 days.

Answer

Use Security Command Center to flag and manually disable unused service accounts.

Question 15

Which gcloud command lists all available roles that can be granted on a GCP project, including both predefined and custom roles?

Accepted Answer

`gcloud iam list-grantable-roles //cloudresourcemanager.googleapis.com/projects/PROJECT_ID`. Option B is correct because the `gcloud iam list-grantable-roles` command is specifically designed to list all roles (both predefined and custom) that can be granted on a given resource, such as a GCP project. The resource is identified by its canonical name, which for a project is `//cloudresourcemanager.googleapis.com/projects/PROJECT_ID`. This command returns roles that are eligible for binding at that resource level, including those inherited from ancestors.

Answer

`gcloud iam roles list --project=PROJECT_ID`

Answer

`gcloud projects get-iam-policy PROJECT_ID`

Answer

`gcloud iam roles describe roles/editor`