Google ACE Deploying and Implementing a Cloud Solution Practice Question
You need to allow SSH access to a Compute Engine instance. Which method is the recommended way to manage SSH keys for multiple users?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable OS Login and assign IAM roles to users.
OS Login is the recommended method for managing SSH access to Compute Engine instances, as it links SSH keys to user accounts and integrates with IAM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add SSH keys to the instance metadata.
Why it's wrong here
Adding SSH keys to instance metadata is a manual, centralized approach that requires editing project or instance metadata every time a user changes or loses a key. It doesn't bind access to Google identity or IAM roles, so revoking a user's access means removing the key from metadata manually, and there's no audit trail linking who is using which key.
- ✗
Use gcloud compute ssh with the --ssh-key-file flag.
Why it's wrong here
The --ssh-key-file flag tells gcloud compute ssh to use a specific private key for that one-off session, which is suitable for a single user's ad-hoc troubleshooting. It doesn't create an IAM-managed identity or allow administrators to revoke access centrally, and the key file itself becomes an extra secret that may be shared or misused across the team.
- ✓
Enable OS Login and assign IAM roles to users.
Why this is correct
Enabling OS Login at the project or instance level, then assigning IAM roles such as roles/compute.osLogin or roles/compute.osAdminLogin to users, is the recommended pattern for SSH access. OS Login links the Linux account on the instance to the user's Google identity, automatically provisions a temporary SSH key when the user runs gcloud compute ssh, and allows instant revocation simply by removing the IAM policy binding.
- ✗
Create a custom image with preconfigured SSH keys.
Why it's wrong here
Preconfiguring SSH keys into a custom image embeds static credentials into every instance created from that image, creating a fleet-wide risk if any key is leaked. Rotating keys would require rebuilding and redeploying the entire image, and because access is not attributed to individual users, this approach lacks accountability and violates least-privilege best practices.
Go deeper
Related to this question
Learn chapter
Google Compute Engine
Key term
Compute Engine
Compute Engine is Google Cloud's Infrastructure-as-a-Service (IaaS) offering that lets you create and run virtual machines on Google's infrastructure.
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.