mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: A security team needs an inventory of all Compute…
A security team needs an inventory of all Compute Engine VM instances across all projects in their GCP organization, including instance names, zones, and status, without logging into each project individually. Which service provides this?
⚠ Common exam trap
A common mix-up: candidates confuse Cloud Monitoring's metric explorer with an inventory tool, or assume Cloud Resource Manager can directly query resources across projects, when in fact it only manages project metadata and IAM policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Asset Inventory with an organization-scoped asset search
Cloud Asset Inventory provides a unified, organization-scoped view of all resources across projects, including Compute Engine VM instances. By using an organization-scoped asset search, the security team can query for all VM instances (e.g., `asset_type = "compute.googleapis.com/Instance"`) without needing to log into each project individually. This service is purpose-built for cross-project resource discovery and inventory management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud Monitoring — use the metric explorer to list all VM instances
Why it's wrong here
Cloud Monitoring's metric explorer visualizes time-series metrics such as CPU utilization or disk I/O for monitored resources, but it is not a resource inventory or discovery service. It requires you to already know the metric type and resource group you are interested in, and it does not provide a flat list of all VM instances with their zones and project IDs across an organization. Its metric data is also retained only for a limited time, so it cannot serve as a reliable asset catalog.
- ✓
Cloud Asset Inventory with an organization-scoped asset search
Why this is correct
Cloud Asset Inventory is the correct service because its search-all-resources API allows an organization-scoped query like `gcloud asset search-all-resources --scope=organizations/ORG_ID --asset-types=compute.googleapis.com/Instance`, which returns every Compute Engine instance across all projects in that organization. It returns metadata including instance names, zones, projects, and additional properties, and it can be filtered by conditions. This provides a single, authoritative, and queryable inventory endpoint for all VM assets.
- ✗
Cloud Resource Manager — list all projects and then query each for VMs
Why it's wrong here
Cloud Resource Manager manages project lifecycles, IAM policies, and organization-level controls, but it does not maintain an index of resources inside each project. You could list projects and then loop over each with `gcloud compute instances list`, but that is a multi-step, error-prone process that Cloud Asset Inventory is designed to replace. The correct org-scoped alternative gives you one search call rather than per-project queries and does not require enumerating projects first.
- ✗
BigQuery information_schema views for GCP compute resources
Why it's wrong here
BigQuery INFORMATION_SCHEMA views are metadata tables scoped to a single BigQuery region or project; they expose datasets, tables, columns, and jobs, not GCP infrastructure resources. There is no construct within BigQuery's INFORMATION_SCHEMA for Compute Engine instances, nor do BigQuery service accounts have visibility into compute resources. Querying these views would return only BigQuery object metadata, so it cannot answer an org-wide VM inventory.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Compute Engine
Compute Engine is Google Cloud's Infrastructure-as-a-Service (IaaS) offering that lets you create and run virtual machines on Google's infrastructure.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.