Google ACE Practice Question: A security team wants to centrally identify…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Cloud Asset Inventory — query for all resources and write custom checks

  Why it's wrong here

  Cloud Asset Inventory is a metadata service that captures and queries the full resource history and configuration across your GCP hierarchy, but it does not apply any security findings logic on its own. Writing custom checks against its output would require a separate system to define what constitutes a misconfiguration and to correlate it across resource types. Because it lacks built-in detectors like public-bucket or open-firewall analysis, any security assessment would be entirely manual and outside the service's scope.

• ✓

  Security Command Center (SCC) with Security Health Analytics enabled

  Why this is correct

  Security Command Center (SCC) with Security Health Analytics enabled is the correct choice because it automatically runs continuous, built-in scans for known security misconfigurations and vulnerabilities across your GCP resources. It uses detectors based on CIS benchmarks and other GCP best practices, surfacing findings such as publicly exposed Cloud Storage buckets, overly permissive firewall rules, and non-compliant IAM bindings at the organization, folder, and project level. It provides a centralized dashboard and API to see the current security posture without requiring custom logic or manual log parsing.

• ✗

  Cloud Monitoring alert policies with metric conditions for firewall rule changes

  Why it's wrong here

  Cloud Monitoring alert policies using metric conditions are designed to notify you when a specific metric crosses a threshold, such as a change in firewall rule count or a particular event stream. These alerts are reactive—they fire after a change occurs—and do not evaluate whether the current firewall rules are insecure, nor do they scan other resource types like buckets or IAM policies. The scope of such alerts is narrow and metric-based, whereas the question asks for broad, automated detection of security misconfigurations across numerous GCP services.

• ✗

  Cloud Logging audit log analysis for admin activity changes

  Why it's wrong here

  Cloud Logging's audit logs record who did what, when, and from where, providing a valuable forensic trail for admin activity. However, audit logs are raw event streams; they do not compare current resource configurations against security best practices, and they rarely flag existing misconfigurations unless a relevant action triggered a log entry. Using them to 'detect' insecure resources would require ingesting logs, building custom pipelines, and correlating events with configuration state—an approach lacking the proactive, state-based scanning found in a purpose-built security service.

Go deeper

Related to this question