Google Associate Cloud Engineer (ACE) — Questions 751–769

An organization policy custom constraint (e.g., a CEL-based constraint on the resource's `labels` field) is evaluated synchronously when a create or update request is made, and the request is rejected if the labels do not satisfy the rule. This is the only option that provides native, proactive enforcement at the API layer, preventing unlabeled resources from being created across supported GCP services. You can define it in the Resource Manager and attach it at the organization, folder, or project level.

A metric threshold alerting policy is the native Cloud Monitoring mechanism for checking a numeric metric stream against a condition, such as compute.googleapis.com/instance/cpu/utilization being above 80% for 5 minutes. You configure an alignment period, aggregator, window, and threshold, then route the incident to notification channels like email, Pub/Sub, or mobile. This directly consumes the CPU utilization metric and triggers a notification only when the threshold condition is met.

The compute.vmExternalIpAccess organization policy is a list constraint that governs whether VMs can be assigned external IP addresses. Setting it to 'Deny All' at the organization level means the policy inherits down to every project and future project, so no VM can ever get an ephemeral or static external IP. This is the correct, centralized, and scalable preventive control because it directly blocks the resource assignment at the API level, rather than reacting to traffic or permissions.

The home directory ($HOME) in Cloud Shell is the designated persistent storage area, backed by a 5GB disk that survives across sessions and idle timeouts. Files saved there, including Terraform state files, are retained for later use and are protected from session cleanup. This makes $HOME the simplest and correct choice for persisting state in a personal Cloud Shell environment.

Cloud Identity requires proof that you own the custom domain (e.g., @yourdomain.com) before it can create user accounts and manage access for that domain. You must add a unique verification code as a DNS TXT record, or follow the alternate HTML file method, to prove control of the domain. Without this step, Google cannot legally or technically assign identity administration to your domain.

Container-Optimized OS is a minimal, hardened Linux distribution from Google that boots very quickly and is preconfigured to run Docker containers. If the container image is already cached on the boot disk or in a nearby registry, the startup script can simply run docker start or docker run, launching the application and its dependencies in seconds and eliminating per-instance package installation.

A managed instance group (MIG) with autoscaling can scale out based on real-time load metrics such as CPU utilization or requests per second, automatically adding instances as demand rises. Adding a scheduled scaling policy that pre-warms capacity a few hours before Black Friday ensures the additional instances are fully initialized, warmed up, and ready to accept traffic before the spike hits, avoiding the latency and slow startup that could occur if scaling were purely reactive. Together these provide both proactive capacity for the expected surge and reactive scaling for any unexpected above-forecast demand, making this the correct solution.

Assigning internal IP addresses to Compute Engine instances ensures that instance-to-instance traffic stays within Google's private VPC network, which is never billed as egress. Traffic between instances using external IPs, even in the same zone, incurs standard egress charges because it leaves the internal network. Internal IPs also eliminate the need for public IP addresses, reducing both cost and potential security exposure.

`gcloud projects get-iam-policy [PROJECT_ID]` fetches the complete IAM policy object for the specified project, which is structured as a list of bindings where each binding maps one role to a set of members. The output includes the policy version, etag, and bindings, so you can see exactly which members are assigned each role (e.g., serviceAccount:..., user:...). This is the direct, correct way to query current member-role bindings on a project.

On a Compute Engine VM, Application Default Credentials automatically uses the service account that was attached to the instance at creation time by querying the instance metadata server at metadata.google.internal/computeMetadata/v1/instance/service-accounts/. The metadata server returns a short-lived OAuth 2.0 access token with scopes defined on the instance, eliminating the need for any downloaded key file on disk. The client libraries cache and refresh these tokens automatically, making this the default and most secure credential source in a GCE environment.

Cloud Dataflow is the correct choice because it is the fully managed, native execution engine for Apache Beam pipelines on Google Cloud. When you run a Beam pipeline with the Dataflow runner, the service automatically provisions and autoscales workers for both streaming and batch modes, providing unified semantics. It handles resource management, checkpointing, and exactly-once processing without requiring you to manage clusters.

Organization policies are the correct tool because they directly enforce restrictions on resource configurations across the entire hierarchy (folders and projects). For example, the compute.vmExternalIpAccess constraint can be set to only allow certain VMs to have external IPs, or require a dedicated VPC peering. They act as guardian rules that cannot be overridden by users without the necessary admin permissions.

The correct command is `gcloud services enable compute.googleapis.com`. The `gcloud services` group is the standard interface for enabling and disabling Google Cloud APIs, and `compute.googleapis.com` is the unique service name for Compute Engine. This command works asynchronously, so you can verify the operation with `gcloud services list --enabled` or the console. It requires the `serviceusage.services.enable` IAM permission on the project.

Snapshot schedules automatically take incremental persistent disk snapshots at defined intervals, providing a predictable hourly RPO while minimizing storage costs because only changed blocks are captured. These snapshots are a native Compute Engine feature and can be used to create new disks in a target region during failover, streamlining replication and restoration without custom code. This balance of cost, integration, and recoverability makes it the most practical, cost-effective DR choice.

Access Transparency logs are a specialized Cloud Logging feature specifically designed to record metadata about actions performed by Google personnel when they access customer data and GCP environments. These logs capture the who, when, and why for Google support or engineering access, giving customers visibility and accountability for Google-side activities. Unlike other audit logs, Access Transparency is the only option that directly documents Google employee actions, and it is available in enabled organizations, often in conjunction with Assured Workloads.

Cloud Run is Google Cloud's fully managed serverless container platform that executes stateless containers on a Knative-based infrastructure, making it ideal for an HTTP web application. It automatically scales to zero when there is no traffic, so you pay nothing during idle periods, and it scales up to thousands of concurrent instances based on incoming requests, with per-request billing that only charges from the moment a request starts to when it finishes. Cloud Run supports any OCI-container image, meaning you can package a web server (e.g., Nginx, Express, Django) and it will handle TLS certificates, domain mapping, and load balancing natively. For variable traffic patterns of a stateless HTTP app, Cloud Run offers the perfect balance of elasticity, cost-efficiency, and operational simplicity.

An external HTTPS load balancer provides a managed, anycast IP that terminates SSL/TLS and forwards decrypted HTTP/HTTPS traffic to the instance over your VPC. This keeps the VM itself on an internal IP, so it is never directly exposed to the internet. The load balancer also adds health checking, autoscaling integration, and Google Cloud Armor DDoS/security policy protection.

Dataflow's horizontal autoscaler monitors pipeline backlog and adjusts the number of worker VMs to maintain throughput — enabled by default for streaming and configurable for batch.