Google ACE Setting up a cloud solution environment — Timed 40 Questions

Question 1

What is the correct order of the Google Cloud resource hierarchy from highest to lowest level?

Accepted Answer

Organization → Folder → Project → Resources. The Google Cloud resource hierarchy is structured from highest to lowest as Organization, Folder, Project, and Resources. The Organization node is the root, allowing centralized policy management; Folders group projects under departments or teams; Projects are the base-level containers for services and APIs; Resources (like Compute Engine instances) reside within projects. Option B correctly reflects this top-down inheritance of IAM policies and access control.

Answer

Folder → Organization → Project → Resources

Answer

Project → Folder → Organization → Resources

Answer

Organization → Project → Folder → Resources

Question 2

A startup creates its first Google Cloud project. Before deploying any paid resources, what must be linked to the project?

Accepted Answer

A billing account. A billing account must be linked to a Google Cloud project before deploying any paid resources because Google Cloud requires a valid payment method to be associated with the project to track and charge for resource usage. Without a billing account, the project is in a 'billing-enabled' state and can only use free-tier or always-free resources, but any paid service will fail to provision.

Answer

A Cloud Identity domain

Answer

An Organization resource node

Answer

A Shared VPC host project

Question 3

Which gcloud CLI command authenticates a developer's local environment with their Google account?

Accepted Answer

gcloud auth login. Option B, `gcloud auth login`, is correct because it initiates the OAuth 2.0 flow to authenticate the gcloud CLI with a user's Google account, storing the resulting credentials locally for subsequent API calls. This command is the standard way to authorize a developer's local environment for the first time or when switching users.

Answer

gcloud config set account [EMAIL]

Answer

gcloud init --authenticate

Answer

gcloud accounts activate

Question 4

A developer attempts to create a Cloud SQL instance but receives the error: 'API [sqladmin.googleapis.com] not enabled.' What is the correct resolution?

Accepted Answer

Enable the Cloud SQL Admin API via APIs & Services > Library in the Console. The error 'API [sqladmin.googleapis.com] not enabled' indicates that the Cloud SQL Admin API has not been activated for the project. The correct resolution is to enable the API via APIs & Services > Library in the Google Cloud Console, as this is a prerequisite for creating any Cloud SQL instance. Assigning IAM roles or requesting quota increases does not enable the underlying API service.

Answer

Assign the developer the Cloud SQL Admin IAM role

Answer

Request a quota increase for Cloud SQL in the project

Answer

Create a new project — Cloud SQL is enabled by default in new projects

Question 5

An application running on a Compute Engine VM needs to read objects from a Cloud Storage bucket in the same project. What is the recommended authentication approach?

Accepted Answer

Attach a service account with the Storage Object Viewer role to the VM. Option B is correct because attaching a service account with the Storage Object Viewer role to the Compute Engine VM is the recommended and secure method for authenticating to Cloud Storage. The VM automatically obtains OAuth 2.0 access tokens for the service account via the metadata server, eliminating the need to manage or embed credentials in the application code.

Answer

Embed a developer's user account credentials in the application configuration file

Answer

Create an API key and store it as an environment variable on the VM

Answer

Grant the VM's IP address access to the bucket using a VPC firewall rule

Question 6

A company organizes its GCP projects by business unit — Finance, Engineering, and Sales. Which resource is best suited to group these projects while applying shared IAM policies to all projects in each group?

Accepted Answer

Create GCP Folders for each business unit and add the relevant projects. C is correct because GCP Folders are the hierarchical resource designed to group projects under an organization node, allowing you to apply shared IAM policies at the folder level that automatically propagate to all projects within that folder. This aligns with the requirement to organize projects by business unit and enforce consistent access controls across each group.

Answer

Apply labels to each project to identify the business unit

Answer

Apply resource tags to each project for policy enforcement

Answer

Create a Shared VPC host project for each business unit

Question 7

A developer works across five different GCP projects daily and wants to switch their active project in the gcloud CLI without rerunning `gcloud init`. Which command should they use?

Accepted Answer

gcloud config set project [PROJECT_ID]. The `gcloud config set project [PROJECT_ID]` command updates the `core/project` property in the active gcloud CLI configuration, allowing the developer to switch the active project without re-running `gcloud init`. This is the standard method for changing the project context in the current configuration, which persists across sessions until changed again.

Answer

gcloud projects switch [PROJECT_ID]

Answer

gcloud auth set-project [PROJECT_ID]

Answer

gcloud init --project=[PROJECT_ID]

Question 8

A security team wants to prevent every project in the organization from creating VM instances with external IP addresses — without requiring configuration in each individual project. What is the most scalable solution?

Accepted Answer

Set the organization policy constraint compute.vmExternalIpAccess to Deny All at the organization level. Option B is correct because the organization policy constraint `compute.vmExternalIpAccess` can be applied at the organization level to deny all VM instances from having external IP addresses, enforcing this rule across all projects without per-project configuration. This is the most scalable approach as it uses Google Cloud's hierarchical policy engine to centrally control resource creation, overriding any project-level settings.

Answer

Create a firewall rule in every project blocking outbound traffic on port 80 and 443

Answer

Remove the Compute Engine Admin role from all project owners

Answer

Use Cloud Armor to block all traffic destined for public IPs in the organization

Question 9

Where in the Google Cloud Console can a user view all APIs currently enabled for their project and monitor their usage?

Accepted Answer

APIs & Services > Dashboard. Option C is correct because the 'APIs & Services > Dashboard' page in the Google Cloud Console provides a centralized view of all enabled APIs for a project, along with real-time usage metrics such as requests per second, error rates, and latency. This dashboard is the primary interface for monitoring API consumption and identifying throttling or quota issues.

Answer

Cloud Shell > Active Sessions

Answer

IAM & Admin > Service Accounts

Answer

Monitoring > Metrics Explorer

Question 10

A team's Cloud Build jobs are consistently failing with 'quota exceeded' errors. Billing is active and the project has available budget. What should the team do?

Accepted Answer

Request a quota increase for the Cloud Build API in the project settings. Option C is correct because Cloud Build quota errors indicate that the project has reached its API rate limit or concurrent build limit, not a billing issue. Quotas are per-project and can be increased by requesting a higher limit from the Cloud Build API quotas page in the Google Cloud Console. Billing being active and having budget means the issue is not financial, so the team must specifically request a quota increase for the Cloud Build API.

Answer

Delete unused projects in the same organization to release global quota

Answer

Upgrade the billing account to a higher payment tier

Answer

Use a larger machine type for Cloud Build worker pools

Question 11

A Cloud Identity admin needs to grant a user access to manage billing for a specific GCP project without giving them access to any other projects in the organization. Which role should be assigned at the project level?

Accepted Answer

Project Billing Manager on the specific project. The Project Billing Manager role is the correct choice because it grants permissions to manage billing for a specific GCP project, including viewing billing reports and setting budget alerts, without providing access to other projects. This role is assigned at the project level, ensuring the user's billing management scope is limited to that single project.

Answer

Billing Account Administrator at the organization level

Answer

Editor on the specific project

Answer

Billing Account User at the billing account level

Question 12

During a gcloud CLI session, a developer runs `gcloud config list` and sees the output shows `project = old-project`. They need to work in `new-project`. Which sequence of commands correctly switches projects and verifies the change?

Accepted Answer

gcloud config set project new-project; gcloud config list. Option B is correct because `gcloud config set project new-project` updates the active project in the local CLI configuration, and `gcloud config list` then displays the current configuration, confirming the change. This is the standard method to switch the working project for subsequent gcloud commands.

Answer

gcloud projects activate new-project; gcloud config list

Answer

gcloud auth login --project=new-project; gcloud config list

Answer

export GCLOUD_PROJECT=new-project; gcloud config list

Question 13

An organization has a policy requiring all new GCP projects to be created within specific folders and linked to approved billing accounts only. Which combination of features enforces this at scale?

Accepted Answer

Organization policies to restrict allowed billing accounts + granting Project Creator role only at approved folder level. Option B is correct because it combines two enforcement mechanisms: Organization policies (specifically the `constraints/compute.restrictBillingAccounts` constraint) to limit which billing accounts can be attached to projects, and granting the Project Creator role (`roles/resourcemanager.projectCreator`) only at the folder level (not the organization level). This ensures that new projects can only be created within the approved folders and must use an approved billing account, enforcing the policy at scale across the entire organization.

Answer

IAM deny policies on the organization + VPC Service Controls

Answer

Cloud Asset Inventory alerts + manual review of new projects

Answer

Requiring multi-factor authentication for all project creators

Question 14

A GCP project has three service accounts. A developer wants to list all service accounts in the project using the gcloud CLI. Which command is correct?

Accepted Answer

gcloud iam service-accounts list. Option C is correct because the `gcloud iam service-accounts list` command is the standard gcloud CLI command to list all service accounts in a GCP project. It uses the IAM API to retrieve the service accounts associated with the current project (or a specified project via the `--project` flag). This command is part of the `gcloud iam` group, which manages IAM resources, and the `service-accounts` sub-group specifically handles service account operations.

Answer

gcloud service-accounts list

Answer

gcloud iam list service-accounts

Answer

gcloud projects list-service-accounts

Question 15

A team uses Cloud Shell for all GCP CLI operations. A developer notices that files they create in Cloud Shell's home directory persist between sessions, but files in other directories do not. What explains this behavior?

Accepted Answer

Only $HOME (~) has persistent 5 GB storage; other directories use ephemeral container storage. Cloud Shell provides each user with a persistent 5 GB home directory ($HOME) backed by Cloud Storage. Files created outside this directory reside in the container's ephemeral storage, which is discarded when the Cloud Shell session ends or is restarted. This design ensures user configurations and scripts are preserved while maintaining a clean, temporary environment for other operations.

Answer

Cloud Shell saves all files to Cloud Storage automatically

Answer

Cloud Shell stores files in Firestore, which only retains home directory paths

Answer

Files outside $HOME are deleted after 24 hours automatically

Question 16

A GCP project uses labels extensively for cost attribution across teams. A finance team member needs to add a 'cost-center' label to an existing Compute Engine VM. Which gcloud command applies the label?

Accepted Answer

gcloud compute instances add-labels my-vm --labels=cost-center=finance-ops --zone=us-central1-a. Option B is correct because the `gcloud compute instances add-labels` command is the specific gcloud command designed to add labels to an existing Compute Engine VM. It requires the `--labels` flag with key-value pairs and the `--zone` flag to specify the VM's location, which is necessary for the API call to succeed.

Answer

gcloud compute instances update my-vm --add-label=cost-center=finance-ops

Answer

gcloud label add --resource=my-vm --key=cost-center --value=finance-ops

Answer

gcloud compute instances set-labels my-vm --labels=cost-center=finance-ops

Question 17

A project manager wants to see how much each GCP service is costing the team this month, broken down by service. Where should they look?

Accepted Answer

Billing > Reports (filtered by service). Option C is correct because the Billing > Reports page in the Google Cloud Console allows you to filter costs by service, SKU, project, and other dimensions. This provides a granular breakdown of monthly spending per GCP service, which is exactly what the project manager needs.

Answer

IAM & Admin > Quotas

Answer

Cloud Monitoring > Cost metrics dashboard

Answer

Resource Manager > Project settings > Cost summary

Question 18

A new engineer joins the team and needs access to GCP. The company uses Google Workspace for identity management. The GCP admin needs to add the engineer and grant them access to one project. What is the correct order of steps?

Accepted Answer

Create the user in Google Workspace Admin Console, then grant their account IAM roles on the GCP project. Option B is correct because Google Workspace is the identity provider (IdP) for the organization, so the engineer must first be created as a user in the Google Workspace Admin Console. Once the user exists, the GCP admin can then grant IAM roles (e.g., roles/viewer, roles/editor) on the specific project, which maps the Workspace user identity to GCP permissions. This follows the principle that GCP IAM relies on existing identities from the Cloud Identity or Workspace domain, not on separate user creation within GCP.

Answer

Create a service account for the engineer in GCP, then share the key file

Answer

Create a GCP project for the engineer, then add their personal Gmail as a project owner

Answer

Create an API key for the engineer in the GCP Console and share it securely

Question 19

A developer frequently switches between three GCP projects and accounts throughout the day. They want to avoid rerunning `gcloud init` each time. Which gcloud feature lets them save and switch between pre-configured project/account/region combinations?

Accepted Answer

gcloud named configurations created with `gcloud config configurations create`. Option B is correct because `gcloud config configurations` allow a developer to create, save, and switch between named sets of gcloud properties (project, account, region, zone) without re-running `gcloud init`. Each configuration stores its own active account, project ID, and default compute region/zone, and can be activated instantly with `gcloud config configurations activate <name>`, making it ideal for frequent context switching between multiple GCP projects and accounts.

Answer

gcloud environments — a built-in workspace manager

Answer

Separate gcloud installations — one per project

Answer

A .gcloudrc file in each project directory that gcloud reads automatically

Question 20

A security team needs an inventory of all Compute Engine VM instances across all projects in their GCP organization, including instance names, zones, and status, without logging into each project individually. Which service provides this?

Accepted Answer

Cloud Asset Inventory with an organization-scoped asset search. Cloud Asset Inventory provides a unified, organization-scoped view of all resources across projects, including Compute Engine VM instances. By using an organization-scoped asset search, the security team can query for all VM instances (e.g., `asset_type = "compute.googleapis.com/Instance"`) without needing to log into each project individually. This service is purpose-built for cross-project resource discovery and inventory management.

Answer

Cloud Monitoring — use the metric explorer to list all VM instances

Answer

Cloud Resource Manager — list all projects and then query each for VMs

Answer

BigQuery information_schema views for GCP compute resources