Google ACE Deploying and Implementing a Cloud Solution Practice Question
An engineer needs to SSH into a Compute Engine instance using OS Login. What must be enabled first?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable OS Login in the project metadata
OS Login must be enabled at the project or instance level using 'gcloud compute project-info add-metadata --enable-oslogin' or similar. Direct SSH key metadata is not needed if OS Login is used.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an SSH key and upload to the instance
Why it's wrong here
Manually uploading an SSH key to the instance bypasses OS Login but is not the required step. When OS Login is enabled, the instance ignores project/instance-level SSH keys in metadata and instead authenticates via the OS Login API, which manages SSH keys based on IAM roles. Creating and uploading a key manually is the older method and may even be blocked if OS Login is enforced. Therefore, enabling OS Login is the necessary prerequisite.
- ✗
Grant the compute.osLogin role to the user
Why it's wrong here
Granting the compute.osLogin role is a required step for authenticating via OS Login, but it is insufficient on its own. The instance and project must have the enable-oslogin metadata set to TRUE before OS Login is active. Without enabling OS Login, the IAM role alone does not create an OS account or grant SSH access; the instance will fall back to legacy SSH key metadata. Thus, the engineer must first enable OS Login at the project level, then assign the role.
- ✗
Add SSH keys to the project metadata
Why it's wrong here
Adding SSH keys to project metadata is the traditional method for granting SSH access, but it is incompatible with OS Login. When OS Login is enabled, all SSH key metadata on the project and instance is ignored; authentication is handled dynamically through the OS Login API. Even if the engineer adds the key, the instance will not use it for authentication, and if OS Login is enforced, the key may be ignored or cause an error. The correct action is to enable OS Login, which supersedes metadata-based keys.
- ✓
Enable OS Login in the project metadata
Why this is correct
Enabling OS Login by setting the project metadata key enable-oslogin to TRUE is the foundational step. This tells Compute Engine to use IAM-based authentication for SSH, allowing the engineer to log in with Google credentials rather than managing SSH keys. Once enabled at the project level, instances inherit the setting, and a user with the compute.osLogin role can SSH without manual key distribution. This is the required first action to meet the engineer's need.
Go deeper
Related to this question
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.