Google ACE Setting up a cloud solution environment Practice Test 4 — 15 Questions

Question 1

A team is creating a new GCP project for a sensitive workload. They need to ensure the project is linked to the correct billing account, placed in the correct folder, and has specific APIs enabled — all reproducibly. They want to automate this via Infrastructure as Code. Which approach is most appropriate?

Accepted Answer

Use Terraform with `google_project`, `google_project_service`, and billing account linkage resources.. Option B is correct because Terraform is an Infrastructure as Code (IaC) tool that allows you to define the entire project setup—including folder placement, billing account linkage, and API enablement—in declarative configuration files. This ensures reproducibility, version control, and automation, which aligns with the requirement for a sensitive workload that must be set up consistently every time.

Answer

Use a gcloud script with `gcloud projects create`, `gcloud beta billing projects link`, and `gcloud services enable`.

Answer

Use Cloud Console to manually create the project, then document the steps in a runbook.

Answer

Use Cloud Deployment Manager with a Python template to create the project.

Question 2

A team runs `gcloud organizations list` and sees no output even though they know their company has a GCP organization. What is the most likely cause, and how should they resolve it?

Accepted Answer

The user lacks org-level IAM permissions such as Organization Viewer.. The `gcloud organizations list` command retrieves organizations from the GCP Resource Manager API. If no output is returned despite the organization existing, the most likely cause is that the authenticated user lacks the `resourcemanager.organizations.get` permission, which is granted by roles like Organization Viewer (`roles/resourcemanager.organizationViewer`) or Organization Administrator (`roles/resourcemanager.organizationAdmin`). Without this IAM permission at the organization level, the API call returns an empty list rather than an error, which is a common source of confusion.

Answer

The organization does not exist yet; run `gcloud organizations create` to create it.

Answer

The gcloud SDK does not support the organizations command; use the Cloud Console instead.

Answer

The project must be linked to the organization using `gcloud projects move`.

Question 3

You need to allow a third-party auditing company to view all resources and IAM policies across your GCP organization without being able to modify anything. Which role should you grant, and at which level?

Accepted Answer

Grant `roles/iam.securityReviewer` at the organization level.. Option B is correct because `roles/iam.securityReviewer` at the organization level grants read-only access to all IAM policies and resources across all projects in the organization, exactly meeting the requirement for a third-party auditor to view without modification. This role includes permissions like `iam.roles.get`, `iam.policies.get`, and `resourcemanager.projects.get`, which are scoped organization-wide when assigned at the org level.

Answer

Grant `roles/viewer` on each individual project the auditor needs to access.

Answer

Grant `roles/owner` at the organization level with a time-limited condition.

Answer

Create a custom role with only `*.get` and `*.list` permissions and grant it at the org level.

Question 4

Your company uses Google Workspace for email. You need to set up GCP for a new team that includes contractors who use non-Google email addresses. Which identity solution allows contractors to authenticate to GCP without a Google Workspace license?

Accepted Answer

Provision contractor accounts using Cloud Identity Free, independent of Google Workspace.. Cloud Identity Free provides identity management for users without requiring a Google Workspace license. It allows contractors with non-Google email addresses to authenticate to GCP using their existing email as a Google account, enabling IAM role assignment without additional licensing costs. This is the correct solution because it decouples identity from Google Workspace, supporting external users while maintaining centralized access control.

Answer

Issue each contractor a Gmail account and add it directly to IAM.

Answer

Create service accounts for each contractor and share the key JSON files.

Answer

Add contractor email addresses as external users and grant them project-level IAM roles.

Question 5

You need to set an organization policy that prevents any project from creating Cloud SQL instances with a public IP address. The constraint you need is `sql.restrictPublicIp`. What type of constraint is this, and how do you enable it?

Accepted Answer

Boolean constraint — set `enforce: true` in the organization policy.. Option B is correct because `sql.restrictPublicIp` is a boolean constraint in Google Cloud Organization Policies. Boolean constraints have a simple `enforce: true` or `enforce: false` setting, and setting it to `true` prevents projects from creating Cloud SQL instances with public IP addresses. This is the standard method to enforce this restriction across the organization.

Answer

List constraint — add `CLOUD_SQL_INSTANCE` to the `deniedValues` list.

Answer

Custom constraint — define a CEL expression that evaluates the Cloud SQL instance's IP configuration.

Answer

List constraint — add `0.0.0.0/0` to the `deniedValues` list.

Question 6

A project has the following IAM bindings: User A has `roles/editor` at the project level, and a folder-level policy denies `roles/editor` to User A. Which effective permission does User A have on the project?

Accepted Answer

User A is denied Editor permissions because IAM Deny policies at a parent resource override allow grants at child resources.. In Google Cloud, IAM Deny policies at a parent resource (like a folder) override allow bindings at a child resource (like a project). Even though User A has `roles/editor` granted at the project level, the folder-level Deny policy explicitly denies that role, so the effective permission is denial. This follows the principle that Deny policies are evaluated before Allow bindings and take precedence.

Answer

User A has Editor permissions because project-level IAM takes precedence over folder-level.

Answer

User A has no permissions because conflicting policies result in no access.

Answer

User A has Editor permissions because folder-level policies don't apply to individual projects.

Question 7

You want to receive email notifications when your GCP project's billing reaches 50%, 80%, and 100% of a monthly budget. Which GCP feature should you configure?

Accepted Answer

Cloud Billing Budget with alert thresholds at 50%, 80%, and 100%.. Option B is correct because Cloud Billing Budgets allow you to set a budget amount for a GCP project and define alert threshold percentages (e.g., 50%, 80%, 100%). When the actual cost or forecasted cost reaches any threshold, Cloud Billing automatically sends email notifications to Billing Administrators and users you specify. This is the native, purpose-built feature for budget-based billing alerts.

Answer

Cloud Monitoring alerting policies on billing metrics.

Answer

Set a project spending limit in the Cloud Console billing settings.

Answer

Enable billing export to BigQuery and create a scheduled query that sends alert emails.

Question 8

Your organization policy at the root level sets `gcp.resourceLocations` to allow only `us-central1` and `us-east1`. A business unit needs to deploy resources in `europe-west1` for GDPR compliance. How can you grant this exception without affecting other business units?

Accepted Answer

Set a `gcp.resourceLocations` policy on the business unit's folder with `inheritFromParent: false`, allowing `us-central1`, `us-east1`, and `europe-west1`.. Option B is correct because Organization Policies support hierarchical inheritance, and setting `inheritFromParent: false` on the business unit's folder allows you to override the root-level `gcp.resourceLocations` constraint. This enables you to define a custom list of allowed locations (including `europe-west1`) for that specific folder without affecting other business units, as the policy is scoped to that folder only.

Answer

Create a separate GCP organization for the business unit and configure its own resource location policy.

Answer

Add a `europe-west1` exception to the root org policy using the `exceptions` field.

Answer

Remove the `gcp.resourceLocations` org policy from the root and apply it to each business unit's folder individually.

Question 9

You need to tag all Compute Engine VMs in your organization with a `cost-center` tag for billing allocation reports. The tag values must be controlled centrally — only predefined values should be allowed. Which GCP feature enables this?

Accepted Answer

Create Resource Manager Tag keys and values at the org level, then attach tags to VMs.. Resource Manager Tags (formerly 'tags' in the Resource Manager API) allow you to create tag keys and predefined tag values at the organization level, then attach those tags to resources like Compute Engine VMs. This ensures that only centrally controlled values can be used, meeting the requirement for controlled billing allocation. Labels, by contrast, are free-form key-value pairs and cannot have their values restricted natively by an org policy.

Answer

Use Compute Engine labels — configure label keys and restrict values using an org policy.

Answer

Use network tags on VMs and enforce allowed values via a custom org policy constraint.

Answer

Require teams to apply specific label values using a Terraform module, and enforce this via code review.

Question 10

A project is being decommissioned. You need to delete it but want to ensure there is a 30-day window during which the deletion can be cancelled if needed. What happens when you delete a GCP project?

Accepted Answer

The project enters a 30-day pending deletion period; resources are inaccessible but the project can be restored within this window.. When you delete a GCP project, it enters a 30-day pending deletion period. During this time, all resources are inaccessible, but the project and its data can be fully restored if needed. This ensures a safety window before permanent deletion, aligning with the requirement for a 30-day cancellation window.

Answer

The project is immediately and permanently deleted along with all resources.

Answer

The project is archived but billing continues for 30 days before final deletion.

Answer

All resources are deleted immediately but the project ID is reserved for 90 days.

Question 11

You have a GCP organization with hundreds of projects. You need to find all projects that have the `compute.googleapis.com` API enabled. Which approach provides the most efficient way to query this across all projects?

Accepted Answer

Use Cloud Asset Inventory to search for `serviceusage.googleapis.com/Service` assets with state `ENABLED` and name matching `compute.googleapis.com`.. Cloud Asset Inventory provides a scalable, API-driven way to query resources across all projects in an organization without iterating over each project. By searching for `serviceusage.googleapis.com/Service` assets with `state: ENABLED` and `name: compute.googleapis.com`, you can retrieve the exact list of projects with the Compute Engine API enabled in a single, efficient query. This avoids the latency and quota limitations of scripting against each project individually.

Answer

Write a script that runs `gcloud services list --enabled` for each project ID returned by `gcloud projects list`.

Answer

Check the Cloud Console's API library for each project manually.

Answer

Query Cloud Billing export data in BigQuery for projects with Compute Engine line items.

Question 12

You need to configure a GCP organization so that when new projects are created, a specific set of default IAM bindings is automatically applied (e.g., the security team's group gets Security Reviewer on every new project). Which approach achieves this without requiring manual post-creation steps?

Accepted Answer

Trigger a Cloud Function via Eventarc on project creation audit log events to automatically apply the IAM bindings.. Option B is correct because it uses Eventarc to capture audit log events for 'google.cloud.resourcemanager.v3.CreateProject' and triggers a Cloud Function that programmatically applies IAM bindings to the new project. This ensures the bindings are applied automatically without manual steps, leveraging serverless event-driven architecture.

Answer

Set an org policy constraint that applies default IAM bindings to all new projects.

Answer

Require all project creators to use a Terraform module that includes the IAM binding in its configuration.

Question 13

Your team needs to manage Google Kubernetes Engine clusters across multiple projects. Rather than granting `roles/container.admin` on each project individually, you want a centralized approach. What is the most maintainable solution?

Accepted Answer

Grant `roles/container.admin` to the team's Google Group at the folder level containing all relevant projects.. Granting `roles/container.admin` at the folder level to a Google Group is the most maintainable solution because it centralizes IAM policy management. When new projects are added under that folder, they automatically inherit the role, and team membership changes are handled by updating the Google Group rather than modifying individual project IAM policies. This approach follows Google Cloud's recommended practice of using groups and resource hierarchy for scalable access control.

Answer

Create a service account with `roles/container.admin` and share its key JSON with team members.

Answer

Grant `roles/container.admin` to each team member individually in each project's IAM policy.

Answer

Use the GKE Hub to create a fleet and assign RBAC roles within each cluster.

Question 14

Arrange the steps to create a Compute Engine instance with a custom service account in the correct order.

Question 15

Order the steps to configure a Cloud Load Balancer (HTTP/S) in front of a Compute Engine instance group.