Google ACE Setting up a cloud solution environment Practice Test 5 — 15 Questions

Question 1

Match each Google Cloud service to its primary purpose.

Question 2

Match each Google Cloud deployment tool to its purpose.

Question 3

A developer wants to use Cloud Shell to create a Compute Engine VM but receives an error 'API not enabled'. What should the developer do first?

Accepted Answer

Enable the Compute Engine API. The error 'API not enabled' indicates that the Compute Engine API has not been activated for the developer's Google Cloud project. Cloud Shell uses the gcloud CLI, which requires the Compute Engine API to be enabled before it can create VM instances. The correct first step is to enable the Compute Engine API via the Cloud Console or the `gcloud services enable compute.googleapis.com` command.

Answer

Switch to a different region

Answer

Use gcloud auth login

Answer

Increase project quota

Question 4

A company wants to allow a junior admin to view project resources and create/modify Cloud Storage buckets but not delete them. Which IAM role should be assigned?

Accepted Answer

roles/storage.legacyBucketWriter. The storage.legacyBucketWriter role allows creation and update of buckets without delete permission. Option B is correct. Option A (storage.admin) allows all actions including delete. Option C (storage.objectAdmin) is for objects, not buckets. Option D (storage.objectCreator) is for object creation only.

Answer

roles/storage.objectCreator

Answer

roles/storage.objectAdmin

Answer

roles/storage.admin

Question 5

A service account needs to be able to create snapshots of disks in a specific project and store them in a different project. What is the correct IAM policy configuration?

Accepted Answer

Grant roles/compute.snapshotAdmin on the source project and roles/storage.objectAdmin on the target bucket. Option C is correct because creating snapshots in one project and storing them in another requires distinct permissions: `roles/compute.snapshotAdmin` on the source project allows the service account to create snapshots, while `roles/storage.objectAdmin` on the target bucket (within the destination project) grants the necessary permissions to write snapshot data into the bucket. This separation follows the principle of least privilege and aligns with the cross-project snapshot workflow.

Answer

Grant roles/compute.storageAdmin on both projects

Answer

Grant roles/viewer on both projects

Answer

Grant roles/compute.instanceAdmin on the source project and roles/storage.objectAdmin on the target bucket

Question 6

A user wants to use gcloud to create a Cloud Storage bucket but receives a permission denied error. What is the most likely cause?

Accepted Answer

The user does not have storage.buckets.create permission. C is correct because Cloud Storage uses IAM permissions to control access to bucket creation. The specific permission required is `storage.buckets.create`, which must be granted at the project level. Without this permission, the gcloud command will fail with a permission denied error, even if the user is authenticated and billing is enabled.

Answer

The bucket name is already taken

Answer

The user is not authenticated

Answer

The project does not have billing enabled

Question 7

An organization needs to set up a new Google Cloud project with restricted access to only approved IP ranges for SSH into VMs. Which Google Cloud service should be used?

Accepted Answer

VPC Firewall Rules. VPC Firewall Rules (Option C) are the correct choice because they allow you to restrict inbound SSH (TCP port 22) traffic to specific source IP ranges by defining ingress rules at the VPC network level. This directly enforces IP-based access control for SSH into VM instances without additional services or proxies.

Answer

Cloud Armor

Answer

Cloud NAT

Answer

Identity-Aware Proxy (IAP) TCP forwarding

Question 8

A service account from project A needs to read a BigQuery dataset in project B. The service account is granted roles/bigquery.dataViewer at the project B level. Yet the access is denied. What additional step is needed?

Accepted Answer

Add the service account to the dataset's ACL in BigQuery. D is correct because BigQuery datasets use Access Control Lists (ACLs) in addition to IAM policies. Even though the service account has the roles/bigquery.dataViewer IAM role at the project B level, this role grants access to list datasets and read metadata, but does not automatically grant access to the actual data within a dataset. The dataset's ACL must explicitly include the service account to allow reading the tables and views. This is a common requirement when cross-project access is needed, as IAM roles at the project level do not propagate to dataset-level ACLs unless the dataset is configured to inherit permissions.

Answer

Enable the BigQuery API on project A

Answer

Grant the service account roles/bigquery.jobUser on project A

Answer

Grant the service account roles/bigquery.user on project B

Question 9

Which two actions are required to allow a user to create a Cloud Storage bucket using gcloud?

Accepted Answer

Assign the user roles/storage.admin. Option C is correct because the `roles/storage.admin` IAM role includes the `storage.buckets.create` permission, which is required to create a Cloud Storage bucket using the gcloud command. Without this role, the user will receive a permission denied error even if other prerequisites like billing are configured.

Answer

Set up billing

Answer

Create a service account

Answer

Assign the user roles/storage.objectAdmin

Question 10

Which three steps are part of the initial setup for a new Google Cloud project with multiple subnets in a VPC?

Accepted Answer

Create a project. Creating a project is the first step in Google Cloud because it serves as the top-level container for all resources, billing, and permissions. Without a project, you cannot provision any services, including VPC networks or Compute Engine instances. This step is mandatory and foundational for organizing and isolating cloud resources.

Answer

Create a VPC network with custom subnets

Answer

Create firewall rules

Question 11

A developer needs to allow a CI/CD system to deploy applications to Cloud Run. The CI/CD system uses a service account. Which two roles should be granted to that service account?

Accepted Answer

roles/iam.serviceAccountUser. To deploy Cloud Run services, the service account needs roles/run.admin to create and manage services, and roles/iam.serviceAccountUser to act as the runtime service account. Options A and C are correct. Options B, D, E are insufficient or unrelated.

Answer

roles/cloudbuild.builds.builder

Answer

roles/run.invoker

Answer

roles/storage.objectViewer

Question 12

Refer to the exhibit. A user runs `gcloud compute instances list` in Cloud Shell and gets the output 'Listed 0 items.' The user expects to see the VM they just created via the Console. What is the most likely cause?

Accepted Answer

The Cloud Shell is in a different project. The `gcloud compute instances list` command lists VM instances in the currently configured project (set via `gcloud config set project`). If the Cloud Shell is pointing to a different project than the one where the VM was created via the Console, the command will return 'Listed 0 items' even though the VM exists. This is the most likely cause because the user expects to see the VM but the command is scoped to a different project context.

Answer

The VM was created in a different region

Answer

The VM is stopping

Answer

The user does not have compute.instances.list permission

Question 13

Refer to the exhibit. An administrator wants to grant a service account read-only access to all Compute Engine instances in a project, but only those with label 'environment=production'. Which IAM policy configuration should be used?

Accepted Answer

roles/compute.viewer with condition 'resource.labels.environment == "production"'. Option B is correct because roles/compute.viewer provides read-only access to Compute Engine resources, and the condition 'resource.labels.environment == "production"' restricts that access to only instances with the specified label. This satisfies the requirement of granting read-only access to production-labeled instances without granting broader permissions.

Answer

roles/compute.instanceAdmin with condition 'resource.labels.environment == "production"'

Answer

roles/compute.imageUser with condition 'resource.labels.environment == "production"'

Answer

roles/compute.viewer with condition 'request.host == "production"'

Question 14

Refer to the exhibit. A developer tries to create a new project using the command `gcloud projects create my-project --name="My Project"` and receives the error 'Project ID my-project already exists.' What should the developer do?

Accepted Answer

Use a different project ID. Project IDs are globally unique. The developer must choose a different project ID. Option C is correct. Options A, B, D are not appropriate or would cause issues.

Answer

Enable the Cloud Resource Manager API

Answer

Delete the existing project with the same ID

Answer

Use the --organization flag

Question 15

Which service should be used to manage billing budgets and alerts?

Accepted Answer

Cloud Billing Budgets. Cloud Billing Budgets is the correct service because it is specifically designed to allow you to set spending limits (budgets) on your Google Cloud projects, billing accounts, or folders, and to configure alerts (e.g., email notifications or Pub/Sub messages) when actual or forecasted costs exceed those thresholds. This directly addresses the requirement to manage billing budgets and alerts, whereas other services focus on monitoring infrastructure performance or logging operational data.

Answer

Cloud Monitoring

Answer

Cloud Billing Reports

Answer

Cloud Logging