20+ practice questions focused on Configuring Access and Security — one of the most tested topics on the Google Associate Cloud Engineer exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Configuring Access and Security PracticeAn engineer created a firewall rule to allow inbound HTTP traffic on port 80 from the internet to instances with the tag 'web-server'. However, after applying the rule, a test instance with the tag 'web-server' is still not reachable on port 80. What is a likely cause?
Explanation: The explanation incorrectly asserts that the instance lacks the tag, contradicting the stem. A likely cause not listed would be a higher-priority deny rule or the rule being attached to the wrong VPC network.
An engineer needs to grant a user the ability to create and manage service accounts in a project, but not delete them. Which predefined IAM role should be assigned?
Explanation: The roles/iam.serviceAccountCreator predefined role grants the permissions iam.serviceAccounts.create, iam.serviceAccounts.get, and iam.serviceAccounts.list. This allows a user to create service accounts and view them, but not delete them (since delete permission is not included). roles/iam.serviceAccountAdmin includes the delete permission, so it does not meet the requirement. roles/iam.serviceAccountDeleter does not exist as a predefined role. roles/iam.serviceAccountUser allows users to use service accounts but not create them.
You want to allow HTTP traffic from the internet to a set of Compute Engine instances tagged 'web-server'. Which gcloud command creates the appropriate firewall rule?
Explanation: The command uses gcloud compute firewall-rules create with --allow tcp:80, --source-ranges 0.0.0.0/0, and --target-tags web-server to allow HTTP traffic from anywhere to instances with that tag.
A security team wants to ensure that all new projects in an organization automatically have Data Access audit logs enabled for all services. What is the most efficient way to achieve this?
Explanation: Using the Organization Policy service, you can configure audit log settings at the organization level. This configuration automatically applies to all new projects, ensuring Data Access audit logs are enabled without manual intervention. This is the most efficient method compared to per-project enablement or using Deployment Manager scripts.
A security team wants to ensure that all Compute Engine instances in a project are created with a specific custom service account attached. What is the most effective way to enforce this?
Explanation: Organization policies with the `constraints/compute.restrictServiceAccounts` constraint are designed to enforce which service accounts can be attached to Compute Engine instances at the project, folder, or organization level. This ensures that all new instances are created with only the specified service accounts, directly addressing the requirement for project-wide enforcement. Other options do not provide this level of comprehensive and declarative enforcement for service accounts during instance creation.
+15 more Configuring Access and Security questions available
Practice all Configuring Access and Security questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Configuring Access and Security. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Configuring Access and Security questions on the ACE frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Configuring Access and Security is tested as part of the Google Associate Cloud Engineer blueprint. Practicing with targeted Configuring Access and Security questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free ACE practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Configuring Access and Security is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Configuring Access and Security practice session with instant scoring and detailed explanations.
Start Configuring Access and Security Practice →