Courseiva

CCNA Ace Access Security Questions

75 of 100 questions · Page 1/2 · Ace Access Security topic · Answers revealed

Practice these questionsExam hubAll questions
1
MCQhard

A security team wants to ensure that all new projects in an organization automatically have Data Access audit logs enabled for all services. What is the most efficient way to achieve this?

A.Use the Organization Policy service to define a constraint that enables Data Access audit logs.
B.Create a script using Deployment Manager to enable audit logs in all projects.
C.Enable Data Access audit logs in each project individually using gcloud logging.
D.Enable Admin Activity audit logs at the organization level, which automatically enables Data Access logs.
AnswerA

Correct: Organization policies can be used to enforce audit logging across all projects.

Why this answer

Setting an organization policy with a custom constraint or using the 'gcloud organizations set-iam-policy' to configure audit logs at the organization level will apply to all new projects. Enabling at each project individually is inefficient. Organization policies can enforce audit log configurations.

Practice this question →
2
MCQmedium

An engineer needs to allow HTTP traffic from the internet to a set of Compute Engine instances that have the network tag 'web-server'. The instances are in a VPC with a default firewall rule that denies all ingress. Which command creates the required firewall rule?

A.gcloud compute firewall-rules create allow-http --allow tcp:80 --source-tags web-server
B.gcloud compute firewall-rules create allow-http --allow tcp:80 --source-ranges web-server
C.gcloud compute firewall-rules create allow-http --allow http --target-tags web-server
D.gcloud compute firewall-rules create allow-http --allow tcp:80 --source-ranges 0.0.0.0/0 --target-tags web-server
AnswerD

Correct flags.

Why this answer

The rule must allow TCP port 80 from source 0.0.0.0/0 to instances with target tag 'web-server'. The correct command uses '--allow tcp:80', '--source-ranges 0.0.0.0/0', and '--target-tags web-server'. Priority can be default (1000).

Practice this question →
3
Multi-Selectmedium

An engineer wants to create a VPC with a custom subnet mode and then create a subnet with Private Google Access enabled. Which two commands should they use? (Choose TWO.)

Select 2 answers
A.gcloud compute networks subnets create my-subnet --network my-vpc --region us-central1 --range 10.0.0.0/24 --enable-private-ip-google-access
B.gcloud compute networks create my-vpc --subnet-mode custom
C.gcloud compute networks subnets create my-subnet --network my-vpc --region us-central1 --range 10.0.0.0/24
D.gcloud compute firewall-rules create allow-http --allow tcp:80
E.gcloud compute networks create my-vpc --subnet-mode auto
AnswersA, B

Creates subnet with Private Google Access enabled.

Why this answer

To create a custom mode VPC, use 'gcloud compute networks create' with '--subnet-mode custom'. Then add a subnet with 'gcloud compute networks subnets create' including '--enable-private-ip-google-access'. The other commands are incorrect: one creates an auto mode VPC, another is for firewall rules.

Practice this question →
4
MCQmedium

To meet compliance requirements, a company must encrypt all data at rest in Cloud SQL using customer-managed encryption keys (CMEK). What is required to enable CMEK on a Cloud SQL instance?

A.Specify the key during instance creation using --disk-encryption-key, and ensure the Cloud SQL service account has encryption/decryption permissions on the key
B.Create the instance without encryption, then use gcloud sql instances patch to add CMEK later
C.Enable CMEK by setting an organization policy that requires CMEK for all Cloud SQL instances
D.Use the default encryption; CMEK is not supported for Cloud SQL
AnswerA

Correct steps for CMEK on Cloud SQL.

Why this answer

When creating the Cloud SQL instance, you must specify a Cloud KMS key using the --disk-encryption-key flag. The Cloud SQL service account must be granted the Cloud KMS CryptoKey Encrypter/Decrypter role. The key must be in the same region as the Cloud SQL instance.

Practice this question →
5
Multi-Selectmedium

A security engineer needs to ensure that all secrets stored in Secret Manager are encrypted with a customer-managed encryption key (CMEK). Which TWO actions are required?

Select 3 answers
A.Create a key ring and key in Cloud KMS.
B.Use the --kms-key flag when creating or updating secrets.
C.Grant the Secret Manager service account the 'Cloud KMS CryptoKey Encrypter/Decrypter' role on the key.
D.Enable CMEK for the project in the Secret Manager settings.
E.Enable automatic replication for the secret.
AnswersA, B, C

A key in Cloud KMS is required as the CMEK.

Why this answer

To use CMEK with Secret Manager, you must create a key ring and key in Cloud KMS, and then use that key when creating or updating secrets by specifying the key name. Enabling CMEK at the project level is not a valid setting. Granting the Cloud KMS Admin role to the Secret Manager service account is necessary for it to use the key.

The other options are incorrect or insufficient.

Practice this question →
6
MCQmedium

You need to allow a Compute Engine instance to securely access a Cloud Storage bucket without managing service account keys. The instance already has a service account attached. What is the best practice to grant access?

A.Download a service account key file and store it on the instance.
B.Grant the necessary IAM roles to the service account attached to the instance.
C.Create a new service account and use its key on the instance.
D.Use the default compute engine service account and grant it Storage Admin.
AnswerB

This follows the principle of least privilege and avoids key management.

Why this answer

The best practice is to grant the appropriate IAM role (e.g., Storage Object Viewer) to the service account attached to the instance. This avoids the need to download and manage service account keys.

Practice this question →
7
Multi-Selectmedium

An organization wants to enforce that all Compute Engine instances in a project use customer-managed encryption keys (CMEK) for their boot disks. Which TWO steps should the security team take?

Select 2 answers
A.Set an organization policy constraint that requires CMEK for Compute Engine disks
B.Specify the CMEK key in each instance template used for managed instance groups
C.Grant the Cloud KMS Admin role to the project's compute service account
D.Create a Cloud Audit Logs sink to monitor instances without CMEK
E.Grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the Compute Engine service account
AnswersA, E

Correct: enforces CMEK at creation time.

Why this answer

To enforce CMEK, you can set an organization policy constraint (e.g., constraints/compute.requireCmek) to prevent creation of instances without CMEK. Additionally, you must grant the compute engine service account permission to use the KMS key so it can encrypt disks. Simply specifying the key in the instance template does not enforce the policy, and the Cloud KMS Admin role is too broad.

Practice this question →
8
Multi-Selecthard

An organization is designing a VPC with multiple subnets. They want instances in a private subnet to access the internet for updates. They also need to allow SSH access from a bastion host. Which THREE components must they configure? (Choose 3 answers.)

Select 3 answers
A.Firewall rule allowing ingress tcp:22 from the bastion host's subnet
B.Bastion host with an external IP address
C.Cloud Router with BGP session
D.Cloud NAT gateway
E.VPC peering with the internet
AnswersA, B, D

Allows SSH access from the bastion.

Why this answer

To allow outbound internet access from private instances, you need a Cloud NAT gateway. To allow inbound SSH from a bastion host, you need firewall rules allowing SSH from the bastion's IP range. The bastion host must be in a different subnet with an external IP or a Cloud NAT as well.

Practice this question →
9
MCQeasy

Which IAM role should be granted to a user to allow them to create and manage secrets in Secret Manager?

A.roles/secretmanager.admin
B.roles/secretmanager.secretAccessor
C.roles/editor
D.roles/secretmanager.viewer
AnswerA

This role includes permissions to create, update, and delete secrets.

Why this answer

roles/secretmanager.admin provides full control over secrets, including creation, deletion, and granting access. roles/secretmanager.secretAccessor only allows reading secret payloads. roles/editor is too broad and not specific. roles/viewer is read-only.

Practice this question →
10
MCQeasy

You need to allow inbound HTTP traffic to a set of Compute Engine instances that have the tag 'web-server'. All other inbound traffic should be denied. Which firewall rule configuration should you create?

A.Create an allow rule for tcp:80 with target tags 'web-server' and source range 0.0.0.0/0, and a deny rule for all other traffic.
B.Create an allow rule for tcp:80 with source range 0.0.0.0/0 and apply to all instances.
C.Create a deny rule for all ports except tcp:80 with target tags 'web-server'.
D.Create an allow rule for tcp:80 with source range 0.0.0.0/0 and target tags 'web-server'. No deny rule is needed.
AnswerD

Correct. Default deny all inbound traffic applies; only allow HTTP to tagged instances.

Why this answer

Firewall rules are stateful; you should create an allow rule for HTTP (tcp:80) with source range 0.0.0.0/0 and target tag 'web-server'. Implicit deny all inbound traffic is the default, so no explicit deny is needed.

Practice this question →
11
MCQmedium

A developer wants to allow a Compute Engine instance to access Cloud Storage without using a service account key file. What is the recommended approach?

A.Use Application Default Credentials with a user account.
B.Download a service account key and store it on the instance.
C.Create a service account, grant it the required roles, and attach it to the instance using the --service-account flag.
D.Set up a VPN connection to Cloud Storage.
AnswerC

This allows the instance to authenticate via the metadata server without keys.

Why this answer

The recommended approach is to create a service account, grant it the necessary roles, and attach it to the instance. The instance can then use the service account via the metadata server without needing keys.

Practice this question →
12
MCQhard

An organization has a hierarchy: Organization -> Folder A -> Project 1. An IAM policy at the organization level grants roles/editor to user@example.com. A policy at Folder A denies roles/editor to the same user. What is the effective role for the user in Project 1?

A.The user has the editor role only in resources directly under the organization, not under Folder A.
B.The user does not have the editor role in Project 1 because the deny policy at the folder level blocks it.
C.The user has the editor role because organization-level grants override folder-level denials.
D.The user has the editor role in Project 1 unless there is a specific project-level deny.
AnswerB

Correct: Deny policies override allow policies, so the user is denied the editor role in Project 1.

Why this answer

IAM policies are additive, but deny policies can override allow policies. If a deny policy is set at a higher level and applies to the user, it denies the permission even if granted at a lower level. However, if the deny policy is at the folder level, it denies the role in all resources under that folder, including Project 1.

Practice this question →
13
MCQmedium

An engineer needs to grant an external auditor read-only access to a subset of Cloud Storage buckets in a project. The auditor's identity is a Google account. Which IAM approach should the engineer use?

A.Add the auditor's email as a member with the Storage Admin role on the project.
B.Use a signed URL for each object the auditor needs to see.
C.Add the auditor's email as a member with the Storage Object Viewer role on each individual bucket.
D.Add the auditor's email as a member with the Storage Object Viewer role on the project, and use IAM Conditions to restrict access to specific bucket resources.
AnswerD

This grants read-only access to the specified buckets only, using conditions for fine-grained control.

Why this answer

The best practice is to grant the Storage Object Viewer role at the project level and then use IAM Conditions to restrict access to specific bucket resources. This avoids managing multiple bindings per bucket while ensuring the auditor only sees the intended buckets. Granting at the bucket level is possible but less scalable; granting Storage Admin is too permissive; using ACLs is legacy and more complex to audit.

Practice this question →
14
MCQmedium

A company has a Cloud SQL instance with CMEK enabled. The Cloud KMS key used for encryption is accidentally disabled. What is the impact on the Cloud SQL instance?

A.The instance will be automatically deleted after 30 days.
B.The instance becomes unavailable and cannot be started until the key is re-enabled.
C.A read replica can be promoted to replace the primary.
D.The instance continues to operate normally, but new data cannot be encrypted.
AnswerB

Correct: Cloud SQL uses the key continuously; disabling it immediately halts the instance.

Why this answer

When a CMEK key is disabled, the Cloud SQL instance becomes unavailable because the database cannot encrypt or decrypt data. The instance cannot be started or used until the key is re-enabled.

Practice this question →
15
MCQeasy

You need to view the current IAM policy for a project named 'my-project' in JSON format. Which command should you use?

A.gcloud projects add-iam-policy-binding my-project --format json
B.gcloud projects get-iam-policy my-project --format json
C.gcloud iam service-accounts list --project my-project
D.gcloud projects set-iam-policy my-project policy.json
AnswerB

Correct: This retrieves the IAM policy in JSON format.

Why this answer

The correct command is 'gcloud projects get-iam-policy my-project --format json'. The 'add-iam-policy-binding' command is for adding bindings, 'set-iam-policy' is for setting from a file, and 'list' is not a valid subcommand for IAM policies.

Practice this question →
16
MCQhard

A security team wants to enable audit logging for all Data Access (ADMIN_READ, DATA_READ, DATA_WRITE) on a specific Google Cloud project. They plan to use gcloud commands to configure this. What is the correct approach?

A.Use gcloud compute firewall-rules update to enable logging on firewall rules.
B.Use gcloud logging sinks to export data access logs to a BigQuery dataset.
C.Use gcloud projects set-iam-policy to set the auditConfig on the project.
D.Use gcloud services enable to enable the Cloud Audit Logs API.
AnswerC

Audit configs are part of IAM policy; setting auditConfig enables the logs.

Why this answer

Audit log configuration is set at the organization, folder, or project level using the 'gcloud projects get-iam-policy' and 'gcloud projects set-iam-policy' commands with audit configs. The correct method is to modify the IAM policy to include auditConfigs. The other options either use wrong commands or wrong scopes.

Practice this question →
17
MCQhard

An engineer is configuring a Cloud NAT to allow private Compute Engine instances to access the internet. After creating the Cloud Router and NAT gateway, the instances still cannot connect to the internet. What is the most likely missing configuration?

A.The VPC does not have a default route (0.0.0.0/0) to the default internet gateway.
B.The firewall rules do not allow egress traffic.
C.The Cloud Router is in a different region.
D.The instances are not assigned a network tag used by the NAT.
AnswerA

A default route is necessary for internet traffic to be sent to NAT.

Why this answer

Cloud NAT requires that the subnet has Private Google Access enabled for certain Google APIs, but for general internet access, the instances must have a default route to the internet gateway (0.0.0.0/0 next hop to default internet gateway). If this route is missing, traffic won't be sent to NAT. The other options are possible but less common.

Practice this question →
18
MCQmedium

You are creating a new service account for an application that needs to read from a Cloud Storage bucket and write to Cloud Pub/Sub. What is the most secure way to grant these permissions?

A.Grant the roles/storage.objectViewer and roles/pubsub.publisher roles to the service account.
B.Grant the roles/storage.admin and roles/pubsub.admin roles to the service account.
C.Create a custom role with storage.objects.get and pubsub.topics.publish, then grant it to the service account.
D.Grant the roles/editor role to the service account.
AnswerA

These roles provide the exact permissions needed: read objects and publish to Pub/Sub.

Why this answer

The principle of least privilege dictates granting only the specific roles needed. The Storage Object Viewer role provides read-only access to objects, and Pub/Sub Publisher allows publishing messages.

Practice this question →
19
MCQmedium

A DevOps engineer needs to grant a service account the ability to pull images from a specific Container Registry repository in project 'my-project'. The service account is in project 'other-project'. Which command should the engineer use?

A.gcloud projects add-iam-policy-binding my-project --member user:admin@other-project.com --role roles/storage.objectViewer
B.gcloud iam service-accounts add-iam-policy-binding sa@other-project.iam.gserviceaccount.com --member serviceAccount:sa@other-project.iam.gserviceaccount.com --role roles/storage.objectViewer
C.gcloud projects add-iam-policy-binding other-project --member serviceAccount:sa@other-project.iam.gserviceaccount.com --role roles/storage.objectViewer
D.gcloud projects add-iam-policy-binding my-project --member serviceAccount:sa@other-project.iam.gserviceaccount.com --role roles/storage.objectViewer
AnswerD

Correct: This grants the storage.objectViewer role (which includes read access to Container Registry) on 'my-project' to the service account from 'other-project'.

Why this answer

Cross-project IAM bindings require the resource owner project (my-project) to grant access to the service account principal. The correct command is 'gcloud projects add-iam-policy-binding' on the resource project.

Practice this question →
20
Multi-Selectmedium

A security engineer wants to audit all attempts to access a specific Cloud Storage bucket, including successful and failed read requests. Which THREE steps should they take? (Choose THREE)

Select 3 answers
A.Create a log sink to BigQuery for the bucket's admin activity logs.
B.Enable Data Access audit logs for the Cloud Storage service.
C.Use Log Explorer to filter for the bucket's data access logs.
D.Grant the auditor the roles/logging.viewer role on the project.
E.Enable Admin Activity audit logs for the bucket.
AnswersB, C, D

Correct: Data Access logs capture read and write requests.

Why this answer

To audit data access, Data Access audit logs must be enabled for the bucket. Admin Activity logs only record configuration changes. Using Log Explorer allows filtering and analyzing logs.

Granting the logging viewer role is necessary to view the logs. Creating a sink is for exporting logs, not necessary for auditing.

Practice this question →
21
MCQmedium

A developer wants to create a service account for an application running on Compute Engine. The application needs to access Cloud Storage. What is the best practice for granting this access?

A.Use Workload Identity Federation to grant access.
B.Create a service account, grant it the Cloud Storage roles, and attach it to the instance using the --service-account flag.
C.Use the default Compute Engine service account and grant it Cloud Storage roles.
D.Create a service account, download its key, and store it on the instance.
AnswerB

Correct: This follows the principle of least privilege and avoids managing keys.

Why this answer

The best practice is to create a service account, grant it the necessary roles, and attach it to the Compute Engine instance using the '--service-account' flag. Downloading keys is discouraged. Workload Identity is for on-premises or non-GCP workloads.

Practice this question →
22
MCQeasy

An engineer needs to view the current IAM policy for a project in JSON format. Which gcloud command should they use?

A.gcloud iam projects describe-iam-policy PROJECT_ID --format json
B.gcloud projects add-iam-policy-binding PROJECT_ID --format json
C.gcloud projects set-iam-policy PROJECT_ID --format json
D.gcloud projects get-iam-policy PROJECT_ID --format json
AnswerD

This command retrieves the IAM policy in the specified format, including JSON.

Why this answer

The gcloud projects get-iam-policy command retrieves the IAM policy for a project. The --format flag allows you to specify the output format, such as JSON. The other commands are for different purposes: set-iam-policy sets the policy, add-iam-policy-binding adds a binding, and describe-iam-policy does not exist.

Practice this question →
23
MCQmedium

You are configuring a Cloud NAT to allow private Compute Engine instances to access the internet for updates. What other resource is required to set up Cloud NAT?

A.A Cloud VPN tunnel
B.An interconnect attachment
C.A Cloud Router
D.A VPC peering connection
AnswerC

Correct: Cloud NAT requires a Cloud Router in the same region.

Why this answer

Cloud NAT requires a Cloud Router to manage dynamic routing and NAT configurations. The Cloud Router is created in the same region and VPC network as the NAT gateway.

Practice this question →
24
Multi-Selectmedium

A security team wants to restrict access to a Cloud Storage bucket so that only objects encrypted with a specific CMEK key can be uploaded. Which three actions are needed? (Choose 3)

Select 3 answers
A.Grant authorized users the roles/cloudkms.cryptoKeyEncrypterDecrypter role.
B.Grant all users the roles/cloudkms.cryptoKeyEncrypterDecrypter role.
C.Create a bucket IAM policy that denies storage.objects.create without the encryption header matching the CMEK key.
D.Enable Uniform Bucket-Level Access.
E.Create a Cloud KMS key and set it as the default key on the bucket using --kms-key.
AnswersA, C, E

Users need this role to use the key for encryption.

Why this answer

Setting the CMEK key on the bucket, creating a bucket-level policy denying uploads without the key, and granting the encrypt/decrypt role to users are required.

Practice this question →
25
MCQeasy

Which Google Cloud service provides a managed, scalable, and secure way to store API keys, passwords, and certificates?

A.Cloud Key Management Service (Cloud KMS)
B.Cloud IAM
C.Secret Manager
D.Cloud Storage
AnswerC

Secret Manager is designed to store and manage secrets such as API keys, passwords, and certificates.

Why this answer

Secret Manager is the correct service for storing secrets such as API keys, passwords, and certificates. It provides encryption, access control, and versioning. Cloud KMS is for managing encryption keys, Cloud IAM is for access management, and Cloud Storage is for object storage.

Practice this question →
26
MCQmedium

A security team wants to ensure that all Compute Engine instances in a project automatically use a custom service account with minimal permissions. What must the engineer do when creating new instances?

A.Create a custom role and assign it to the instance's service account through the instance metadata.
B.Use gcloud compute instances create with the --service-account flag pointing to the custom service account.
C.Set the project-wide default service account to the custom service account in the project settings.
D.Create a startup script that configures the instance to use the custom service account after boot.
AnswerB

The --service-account flag specifies the service account to attach to the instance, ensuring it uses that account.

Why this answer

When creating a Compute Engine instance, you can specify a custom service account using the --service-account flag. This attaches the service account to the instance and grants the associated IAM roles. The instance will use the custom service account instead of the default compute engine service account.

Practice this question →
27
Multi-Selectmedium

A company needs to enable Private Google Access for a subnet in a VPC so that Compute Engine instances without external IPs can access Google APIs and services. Which two steps are required? (Choose TWO.)

Select 2 answers
A.Create a Cloud NAT gateway.
B.Add a firewall rule allowing egress to 0.0.0.0/0.
C.Assign the instances a network tag.
D.Ensure the subnet has a default route (0.0.0.0/0) to the default internet gateway.
E.Enable Private Google Access on the subnet using --enable-private-ip-google-access.
AnswersD, E

Needed for routing traffic to Google APIs.

Why this answer

Private Google Access is enabled at the subnet level using '--enable-private-ip-google-access' flag. Additionally, to access non-Google APIs on the internet, Cloud NAT is required. But for Google APIs, Cloud NAT is not necessary.

However, the question may imply accessing both, but typically only subnet setting is needed. In this scenario, the two steps are: enable Private Google Access on the subnet, and create a Cloud NAT if they need to access the internet (non-Google). Since the question says 'Google APIs and services', Cloud NAT is not required.

But the option might be considered if they need to access other services. Let's check the correct answer: The definitive steps: enable Private Google Access on the subnet (option A) and ensure the subnet has a default route to the internet gateway (option D) because even for Google APIs, traffic needs a default route? Actually, for Private Google Access, the default route is automatically created? The default VPC has a default route. If not, you need one.

Let's assume the VPC already has default route. The most common two steps: enable subnet setting and ensure DNS resolution. But DNS is not listed.

The typical two: enable Private Google Access on subnet and ensure the subnet has a default route. So options A and D.

Practice this question →
28
MCQmedium

A developer needs to store a database password in Secret Manager and then allow a Compute Engine instance to access it. The instance uses the default compute engine service account. Which role should be granted to the service account?

A.roles/cloudsql.client
B.roles/secretmanager.admin
C.roles/viewer
D.roles/secretmanager.secretAccessor
AnswerD

This role grants access to secret payloads.

Why this answer

To access the secret version's payload, the service account needs the 'secretmanager.secretAccessor' role on the secret (or project). That role allows accessing secret versions. roles/secretmanager.admin is too broad. roles/cloudsql.client is for Cloud SQL, not Secret Manager. roles/viewer does not allow access to secret payloads.

Practice this question →
29
MCQeasy

An engineer wants to allow HTTP traffic from the internet to a set of Compute Engine instances that have the network tag 'web-server'. Which firewall rule should they create?

A.gcloud compute firewall-rules create allow-http --allow tcp:80 --source-tags web-server
B.gcloud compute firewall-rules create allow-http --allow tcp:80 --source-tags web-server --target-ranges 0.0.0.0/0
C.gcloud compute firewall-rules create allow-http --direction egress --allow tcp:80 --destination-ranges 0.0.0.0/0 --target-tags web-server
D.gcloud compute firewall-rules create allow-http --allow tcp:80 --source-ranges 0.0.0.0/0 --target-tags web-server
AnswerD

This creates an ingress rule allowing HTTP from anywhere to instances tagged 'web-server'.

Why this answer

The correct command creates an ingress rule allowing TCP port 80 from any source (0.0.0.0/0) to instances with tag 'web-server'. Ingress rules are for incoming traffic. The other options have incorrect direction or target.

Practice this question →
30
MCQmedium

A company wants to use Customer-Managed Encryption Keys (CMEK) for a Cloud SQL instance. What must be done first?

A.Create a bucket and upload a key file.
B.Create a Cloud KMS key ring and key, and grant the Cloud SQL service account the cloudkms.cryptoKeyEncrypterDecrypter role.
C.Enable Cloud KMS API and use default encryption.
D.Set the --disk-encryption-key flag to an existing key in Cloud KMS.
AnswerB

This is the prerequisite for using CMEK with Cloud SQL.

Why this answer

CMEK requires a Cloud KMS key ring and key to be created, and the Cloud SQL service account must be granted the Encrypter/Decrypter role on that key.

Practice this question →
31
MCQeasy

You want to allow HTTP traffic from the internet to a set of Compute Engine instances tagged 'web-server'. Which gcloud command creates the appropriate firewall rule?

A.gcloud compute firewall-rules create allow-http --allow tcp:80 --source-tags web-server --target-ranges 0.0.0.0/0
B.gcloud compute firewall-rules create allow-http --allow tcp:80 --source-ranges 0.0.0.0/0 --target-tags default
C.gcloud compute firewall-rules create allow-http --allow tcp:80 --source-ranges 0.0.0.0/0 --target-tags web-server
D.gcloud compute firewall-rules create allow-http --allow http --source-ranges 0.0.0.0/0 --target-tags web-server
AnswerC

Correct flags for this scenario.

Why this answer

The command uses gcloud compute firewall-rules create with --allow tcp:80, --source-ranges 0.0.0.0/0, and --target-tags web-server to allow HTTP traffic from anywhere to instances with that tag.

Practice this question →
32
MCQmedium

An organization requires that all Compute Engine instances be created with a specific service account. Which organization policy can enforce this?

A.constraints/compute.setServiceAccount
B.constraints/compute.vmExternalIpAccess
C.constraints/iam.allowedPolicyMemberDomains
D.constraints/compute.restrictCreateOnFirewall
AnswerA

This constraint restricts the service account that can be assigned to instances.

Why this answer

The 'constraints/compute.setServiceAccount' constraint can be used to restrict which service accounts can be used when creating instances. It can be set at the organization or project level. The other constraints are not related to service accounts.

Practice this question →
33
MCQhard

A company has a VPC with two subnets: subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). They want to allow traffic from instances in subnet-a to reach a specific instance in subnet-b only on TCP port 443. What is the most specific firewall rule to achieve this?

A.Create a rule with source tag 'subnet-a-instances', allow tcp:443, and target tag 'https-server'.
B.Create a rule with source range 0.0.0.0/0, allow tcp:443, and target the specific instance.
C.Create a rule with source range 10.0.1.0/24, allow tcp:443, and apply to all instances in subnet-b.
D.Create a rule with source range 10.0.1.0/24, allow tcp:443, and target tag 'https-server' applied to the specific instance.
AnswerD

This rule restricts source to subnet-a and target to the tagged instance, allowing only the intended traffic.

Why this answer

Firewall rules can specify source ranges (IP addresses or CIDR blocks) and target tags or service accounts. The most specific rule would use the subnet-a CIDR block (10.0.1.0/24) as the source, allow TCP port 443, and target the specific instance using a target tag. Using a tag makes the rule apply only to instances with that tag, avoiding impact on other instances in subnet-b.

Practice this question →
34
MCQmedium

A company has a VPC with a subnet that has Private Google Access enabled. They want their Compute Engine instances to access Google APIs and services through internal IP addresses. Which additional configuration is required?

A.No additional configuration is required.
B.Configure Cloud NAT to enable access to Google APIs.
C.Set up Cloud VPN tunnels to Google APIs.
D.Create a VPC peering connection with the Google APIs VPC.
AnswerA

Private Google Access routes Google API traffic through internal IPs automatically for instances in the subnet.

Why this answer

Private Google Access on a subnet allows instances in that subnet to reach Google APIs and services using internal IP addresses. No additional configuration is needed if the instances are in that subnet. Cloud NAT is for outbound internet access, not for Google API access.

Cloud VPN and Cloud Interconnect are for hybrid connectivity.

Practice this question →
35
MCQhard

An engineer created a firewall rule to allow inbound HTTP traffic on port 80 from the internet to instances with the tag 'web-server'. However, after applying the rule, a test instance with the tag 'web-server' is still not reachable on port 80. What is a likely cause?

A.The firewall rule has a priority lower than 65535.
B.The instance is using a VPC with a custom subnet.
C.The firewall rule is denying outbound traffic.
D.The instance does not have the 'web-server' network tag.
AnswerD

The firewall rule targets instances with the 'web-server' tag. If the instance lacks this tag, the rule does not apply to it.

Why this answer

Firewall rules are stateful, meaning return traffic is automatically allowed, but only if the inbound connection is permitted. A common misconfiguration is that the rule targets the wrong network tag, the instance does not have the tag, or the rule is not applied to the correct VPC network. Another possible issue is a higher-priority deny rule blocking the traffic.

However, the most direct cause is that the instance lacks the tag specified in the rule.

Practice this question →
36
Multi-Selecthard

An engineer needs to audit all Data Access logs for a project to detect unauthorized access to sensitive data. The engineer must ensure that logs are retained for 5 years and are immutable. Which THREE steps should the engineer take?

Select 3 answers
A.Configure the Cloud Storage bucket with a retention policy and enable object versioning
B.Enable Data Access audit logs for the relevant services in the project's IAM audit config
C.Use the default Logging retention of 30 days
D.Set up a Cloud Monitoring alert for any Data Access log entries
E.Create a log sink to export logs to a Cloud Storage bucket
AnswersA, B, E

Ensures immutability and prevents deletion.

Why this answer

To achieve this, the engineer must: 1. Enable Data Access audit logs for the required services (e.g., Cloud Storage, BigQuery) in the project's IAM audit config. 2. Create a log sink that exports the logs to a Cloud Storage bucket (which provides cost-effective long-term retention). 3.

Configure the bucket with retention policy and object versioning to make logs immutable and protect against deletion. Using Logging's default retention is only 30 days, not 5 years. Cloud Monitoring does not store logs.

BigQuery is not ideal for immutable storage.

Practice this question →
37
MCQeasy

You want to view the current IAM policy for a project in JSON format using the gcloud command-line tool. Which command should you run?

A.gcloud projects get-iam-policy <project-id> --format json
B.gcloud iam service-accounts get-iam-policy <service-account> --format json
C.gcloud iam policies get <project-id> --format json
D.gcloud projects describe <project-id> --format json
AnswerA

Correct command to get IAM policy in JSON format.

Why this answer

The correct command is `gcloud projects get-iam-policy <project-id> --format json`. This retrieves the IAM policy and formats it as JSON.

Practice this question →
38
MCQmedium

An engineer needs to view the current IAM policy for a project in JSON format to analyze bindings. Which command should be used?

A.gcloud resource-manager folders get-iam-policy my-project --format json
B.gcloud projects get-iam-policy my-project --format yaml
C.gcloud projects get-iam-policy my-project --format json
D.gcloud iam policies get my-project --format json
AnswerC

Correct command and format.

Why this answer

The command gcloud projects get-iam-policy PROJECT_ID --format json retrieves the IAM policy for the project in JSON format. Other commands either get policies for different resources or use a different format.

Practice this question →
39
MCQmedium

An organization has multiple projects under a folder. They want to grant a network admin the ability to create firewall rules in all projects in the folder. Which IAM policy binding achieves this with least privilege?

A.Grant roles/owner at the folder level
B.Grant roles/compute.admin at the project level for each project
C.Grant roles/compute.networkAdmin at the folder level
D.Grant roles/compute.securityAdmin at the folder level
AnswerD

Correct: folder-level grant covers all descendant projects with minimal permissions for firewall rules.

Why this answer

Grant the roles/compute.securityAdmin role at the folder level. This allows managing firewall rules across all projects under that folder. Granting at project level would require adding the role to each project individually.

The compute.networkAdmin role does not include firewall rule management.

Practice this question →
40
MCQeasy

You need to store a database password securely in Google Cloud. The password will be used by a Compute Engine instance. Which service should you use?

A.Secret Manager
B.Cloud Storage
C.Cloud KMS
D.Cloud Firestore
AnswerA

Correct service for storing secrets.

Why this answer

Secret Manager is the correct service for storing secrets like database passwords. It provides encryption, access control, and versioning.

Practice this question →
41
MCQhard

A company has an organization with multiple folders and projects. They want to audit all IAM policy changes across the entire organization. Which approach meets the requirement with minimal effort?

A.View Admin Activity audit logs in Logs Explorer, which are enabled by default.
B.Use Organization Policy to deny IAM policy changes and monitor violations.
C.Enable Data Access audit logs for all services in the organization.
D.Enable audit logging on each project individually using gcloud logging sinks.
AnswerA

Admin Activity logs record IAM policy changes and are enabled by default for all projects, no extra configuration needed.

Why this answer

Admin Activity audit logs capture all IAM policy changes by default and are enabled for all projects. Data Access audit logs do not capture IAM changes. Organization policies don't capture changes.

Enabling logs per project would be more effort.

Practice this question →
42
MCQmedium

An engineer wants to create a Google-managed SSL certificate for an HTTPS load balancer. Which command should they use?

A.gcloud compute ssl-policies create my-policy --profile MODERN
B.gcloud compute ssl-certificates create my-cert --domains example.com
C.gcloud compute ssl-certificates create my-cert --certificate cert.pem --private-key key.pem
D.gcloud compute target-https-proxies create my-proxy --ssl-certificates my-cert
AnswerB

Correct: This creates a Google-managed SSL certificate for the specified domain.

Why this answer

To create a Google-managed SSL certificate, use 'gcloud compute ssl-certificates create' with the '--domains' flag. The other commands are for other purposes or require manual certificate provisioning.

Practice this question →
43
MCQmedium

An engineer needs to grant a service account the ability to impersonate another service account when making API calls. Which IAM role should be assigned to the impersonating service account?

A.roles/iam.serviceAccountAdmin
B.roles/serviceusage.serviceUsageConsumer
C.roles/iam.serviceAccountUser
D.roles/iam.serviceAccountTokenCreator
AnswerC

This role grants the permission iam.serviceAccounts.implicitDelegation and is used for impersonation.

Why this answer

The roles/iam.serviceAccountUser role allows a principal to impersonate a service account (by getting an access token for that account). roles/iam.serviceAccountTokenCreator allows creating tokens but not full impersonation. roles/serviceusage.serviceUsageConsumer is for service usage, not impersonation. roles/iam.serviceAccountAdmin allows administrative actions but not impersonation.

Practice this question →
44
MCQmedium

A team needs to create a new service account and grant it the roles/storage.objectViewer role on a project. Which two gcloud commands are required?

A.gcloud iam service-accounts create and gcloud iam service-accounts add-iam-policy-binding
B.gcloud projects add-iam-policy-binding only
C.gcloud iam service-accounts create and gcloud projects add-iam-policy-binding
D.gcloud iam service-accounts create and gcloud iam roles create
AnswerC

Create the account, then add an IAM binding to grant the role on the project.

Why this answer

First, create the service account with gcloud iam service-accounts create. Then grant the role on the project using gcloud projects add-iam-policy-binding with the service account as member. The commands in other options are either missing steps or incorrect.

Practice this question →
45
Multi-Selectmedium

An engineer needs to allow a set of Compute Engine instances (with tag 'web-server') to receive traffic on port 443 from the internet. The VPC has a default network with default firewall rules. Which TWO actions should the engineer take? (Choose TWO)

Select 2 answers
A.Create a firewall rule allowing ingress from 0.0.0.0/0 on port 443 with target tag 'https-server' and priority 1000.
B.Modify the default-allow-https rule to change the target tag to 'web-server'.
C.Delete the default-allow-https rule to avoid conflicts.
D.Create a firewall rule allowing ingress from 0.0.0.0/0 on port 443 with target tag 'web-server' and priority 1000.
E.Ensure that instances have the 'web-server' network tag applied.
AnswersD, E

Correct: This rule allows the desired traffic.

Why this answer

To allow ingress on port 443 to instances with tag 'web-server', the engineer must create a firewall rule allowing that traffic. The default rules are already there but may not include port 443; the default-allow-https rule exists but only for instances with tag 'https-server', not 'web-server'. So a new rule is needed.

The engineer should not modify the default rule (cannot be modified) or delete it. Creating a rule with priority 1000 is appropriate.

Practice this question →
46
MCQmedium

An engineer needs to grant a service account the ability to start and stop Compute Engine instances in a specific project. The service account should not have permissions to delete instances or modify other resources. Which IAM role should be assigned?

A.roles/compute.viewer
B.roles/compute.admin
C.roles/compute.osAdminLogin
D.roles/compute.instanceAdmin.v1
AnswerD

This role allows managing instances (start, stop, reset) without delete permissions, meeting the requirement.

Why this answer

The Compute Instance Admin (roles/compute.instanceAdmin.v1) role provides permissions to create, start, stop, and reset instances, but does not include delete permissions. The Compute Admin role is too broad, and Compute Viewer is read-only. Compute OS Admin Login is for OS login, not instance lifecycle.

Practice this question →
47
MCQmedium

An engineer needs to create a firewall rule that allows incoming HTTPS traffic only from a specific IP range to instances tagged 'web-server'. Which command should they use?

A.gcloud compute firewall-rules create allow-https --allow tcp:443 --source-ranges 192.168.0.0/16 --target-tags web-server
B.gcloud compute firewall-rules create allow-https --allow tcp:443 --source-tags web-server
C.gcloud compute firewall-rules create allow-https --allow udp:443 --source-ranges 192.168.0.0/16 --target-tags web-server
D.gcloud compute firewall-rules create allow-https --allow tcp:443 --source-ranges 0.0.0.0/0 --target-tags web-server
AnswerA

Correctly restricts source to 192.168.0.0/16 and targets instances with tag web-server.

Why this answer

The correct command creates a firewall rule allowing TCP port 443 from the specified source range to instances with the target tag 'web-server'.

Practice this question →
48
MCQeasy

An engineer wants to create a Google-managed SSL certificate for a domain and attach it to an HTTPS load balancer. Which gcloud command should they use to create the certificate?

A.gcloud compute target-https-proxies create --ssl-certificates
B.gcloud compute ssl-certificates create --domains example.com
C.gcloud compute ssl-policies create
D.gcloud compute ssl-certificates create --certificate example.crt --private-key example.key
AnswerB

This creates a Google-managed SSL certificate for the specified domain.

Why this answer

The gcloud compute ssl-certificates create command with the --domains flag creates a Google-managed SSL certificate. The other commands are for creating SSL policies, self-managed certificates, or target HTTPS proxies.

Practice this question →
49
Multi-Selectmedium

A company is migrating a legacy application to Compute Engine. The application requires access to a Cloud Storage bucket for storing logs. The application runs on a VM with a service account attached. Which TWO steps should the engineer take to grant the application access to the bucket?

Select 2 answers
A.Store the bucket's access key and secret in instance metadata and have the application read them.
B.Download a service account key and store it securely on the VM, then configure the application to use the key.
C.Attach the service account to the Compute Engine instance at creation time using the --service-account flag.
D.Grant the service account the 'Storage Admin' role on the project.
E.Grant the service account the 'Storage Object Admin' (or 'Storage Object Creator') role on the specific bucket.
AnswersC, E

Attaching the service account to the VM allows the application to use its credentials automatically via the metadata server.

Why this answer

The correct approach is to grant the service account the appropriate role on the bucket (using IAM) and attach that service account to the VM. Option B is incorrect because granting the role on the project is too broad. Option C is incorrect because downloading keys is insecure and unnecessary.

Option D is incorrect because storing access keys in metadata violates best practices.

Practice this question →
50
MCQmedium

An engineer wants to view the current IAM policy for a project in JSON format. Which command should they use?

A.gcloud resource-manager folders get-iam-policy my-project --format json
B.gcloud projects describe my-project --format json
C.gcloud projects get-iam-policy my-project --format json
D.gcloud iam policies get my-project --format json
AnswerC

Correct command to get policy in JSON.

Why this answer

The gcloud projects get-iam-policy command with --format json outputs the IAM policy in JSON format.

Practice this question →
51
MCQmedium

An engineer needs to grant an external auditor read-only access to view IAM policies on a GCP project. The auditor should not have access to any other resources. Which IAM role should be assigned?

A.roles/iam.roleAdmin
B.roles/iam.serviceAccountAdmin
C.roles/viewer
D.roles/iam.securityReviewer
AnswerD

Correct. This role provides read-only access to IAM policies.

Why this answer

The `roles/iam.securityReviewer` role grants permission to view IAM policies without granting access to other resources. It is specifically designed for security auditors.

Practice this question →
52
MCQmedium

A company wants to use Cloud NAT to allow private instances in a VPC to send outbound traffic to the internet and to receive inbound responses. Which two resources must be configured to set up Cloud NAT?

A.Cloud Router and NAT gateway
B.Cloud Router only
C.Cloud VPN and Cloud NAT
D.Cloud Interconnect and Cloud NAT
AnswerA

Cloud NAT requires a Cloud Router and a NAT gateway. The Cloud Router is used to manage the NAT IP addresses and routes.

Why this answer

Cloud NAT requires a Cloud Router (to manage dynamic routing and NAT IP allocation) and a NAT gateway (the actual NAT service). The Cloud Router is a separate resource that must be created in the same region as the NAT gateway. The NAT gateway configuration includes the Cloud Router name.

Practice this question →
53
Multi-Selecthard

A security engineer wants to audit all actions that modify VPC firewall rules in their project. They need to enable the appropriate audit logs. Which three steps should they take? (Choose THREE.)

Select 3 answers
A.Configure the audit configuration at the project level using IAM policy.
B.Ensure Admin Activity audit logs are enabled (default setting).
C.Enable Data Access audit logs for the firewall service.
D.View the firewall rule changes in the Logs Explorer using the query 'resource.type=gce_firewall_rule AND operation=write'.
E.Use gcloud logging logs list to verify the log entries.
AnswersA, B, D

Audit config can specify which services to log.

Why this answer

Admin Activity logs are enabled by default and record configuration changes. To specifically audit firewall rule changes, you need to ensure Admin Activity logs are enabled (they are by default). However, the question may refer to Data Access logs? But modifying firewall rules is an admin activity.

The steps: ensure Admin Activity logs are enabled (they are by default), but if not, enable them. Then you can view logs in Logging. To capture all changes, you might also want to set audit config at project level.

The question likely expects: enable Admin Activity audit logs (if not already), set the audit config for the project, and view logs in Log Explorer. However, Admin Activity logs are always enabled. So steps: (1) Verify that Admin Activity audit logs are enabled (they are by default), (2) Optionally set audit config for Data Access if needed? But the question specifically says 'actions that modify', which is Admin Activity.

I think the intended correct answers are: Enable Admin Activity audit logs (if not), configure audit logs at the project level, and view logs in Logging. Let's provide plausible correct answers based on typical exam expectations: The three steps could be: (A) Enable Data Access audit logs? No. Let's decide: The correct answer is likely: (A) Enable Admin Activity audit logs (they are enabled by default but still a step), (B) Configure audit logging at the project level, (C) View logs in Log Explorer.

But those are generic. The question might expect specific commands or settings. Given the domain content, it might be about using gcloud logging or IAM audit config.

I'll construct options accordingly.

Practice this question →
54
MCQhard

An organization has a folder hierarchy with multiple projects. They want to grant a support team the ability to view all IAM policies across the entire folder. What is the most efficient way?

A.Grant roles/iam.securityReviewer at the folder level.
B.Grant roles/iam.securityReviewer on each project individually.
C.Grant roles/owner at the folder level.
D.Grant roles/viewer at the folder level.
AnswerA

This role allows viewing IAM policies and is inherited by all child projects.

Why this answer

Granting the role at the folder level applies to all projects under it, which is efficient and follows best practices for hierarchical IAM.

Practice this question →
55
MCQmedium

A company has multiple VPC networks in their project. They want Compute Engine instances in one VPC to communicate with instances in another VPC using internal IP addresses. Which feature should they use?

A.Cloud NAT
B.VPC Network Peering
C.Cloud VPN
D.Firewall rules
AnswerB

VPC peering enables internal IP communication across VPCs.

Why this answer

VPC Peering allows connectivity between two VPC networks using internal IPs. VPN is for on-premises connectivity. Cloud NAT is for outbound internet access.

Firewall rules control traffic but do not enable routing between VPCs.

Practice this question →
56
MCQhard

A company has a Google Cloud organization with multiple folders and projects. The security team wants to audit all actions that create or modify IAM policies across the entire organization. Which type of audit log should they examine?

A.System Event audit logs
B.Data Access audit logs
C.VPC Flow Logs
D.Admin Activity audit logs
AnswerD

Correct: Admin Activity logs capture IAM policy changes across the organization.

Why this answer

Admin Activity audit logs record all API calls that modify the configuration or metadata of resources, including IAM policy changes. These logs are enabled by default and cannot be disabled. Data Access logs record read operations and are not enabled by default.

System Event logs cover GCP infrastructure events, not IAM changes.

Practice this question →
57
MCQeasy

You need to add an IAM binding for a user to a project using the gcloud command. Which command should you use?

A.gcloud projects add-iam-policy-binding
B.gcloud iam service-accounts add-iam-policy-binding
C.gcloud projects set-iam-policy
D.gcloud iam roles update
AnswerA

Correct command to add a binding.

Why this answer

The command `gcloud projects add-iam-policy-binding <project-id> --member user:<email> --role <role>` adds an IAM policy binding to a project.

Practice this question →
58
Multi-Selecteasy

Which TWO of the following are valid ways to grant IAM roles to a service account for accessing a Cloud Storage bucket? (Select 2 correct answers)

Select 2 answers
A.Use gcloud projects set-iam-policy with a policy file that includes the binding.
B.Use gcloud storage buckets add-iam-policy-binding to grant the role directly on the bucket.
C.Use gcloud iam roles create to assign the role to the service account.
D.Use gcloud projects add-iam-policy-binding to grant the role at the project level.
E.Use gcloud iam service-accounts add-iam-policy-binding.
AnswersB, D

This adds a new IAM binding on the bucket for the member.

Why this answer

IAM roles can be granted at the bucket level using gcloud storage buckets add-iam-policy-binding (or gsutil iam ch) or at the project level which applies to all buckets in the project. The other options are incorrect: gcloud iam roles create creates a custom role definition, not a grant; gcloud iam service-accounts add-iam-policy-binding grants roles on the service account itself; and gcloud projects set-iam-policy replaces the entire policy, not a granular add.

Practice this question →
59
Multi-Selecteasy

An engineer wants to view the current IAM policy for a project. Which TWO commands will accomplish this?

Select 2 answers
A.gcloud projects get-iam-policy my-project --format json
B.gcloud resource-manager folders get-iam-policy my-folder
C.gcloud iam service-accounts get-iam-policy my-sa@my-project.iam.gserviceaccount.com
D.gcloud projects get-iam-policy my-project
E.gcloud projects get-ancestors-iam-policy my-project
AnswersA, D

Adding --format json outputs the policy in JSON format, which is also valid.

Why this answer

The gcloud projects get-iam-policy command retrieves the IAM policy for a project. The gcloud projects get-ancestors-iam-policy retrieves policies from ancestors, not the project itself. The other commands are for different purposes.

Practice this question →
60
Multi-Selectmedium

A company needs to audit all actions that modify a Cloud Storage bucket. Which TWO steps should they take to enable this? (Choose 2 answers.)

Select 2 answers
A.Use Log Explorer to filter logs by the Cloud Storage service and the 'data_access' log type.
B.Create a VPC Service Controls perimeter.
C.Enable Admin Activity audit logs for the Cloud Storage service.
D.Assign the roles/logging.viewer role to the security team.
E.Enable Data Access audit logs for the Cloud Storage service in the project's IAM audit config.
AnswersA, E

This allows you to view the logged data modifications.

Why this answer

To audit data access modifications, you need to enable Data Access audit logs for the storage service and then view those logs in Log Explorer. Admin Activity logs record configuration changes (like creating a bucket), but data modifications (like uploading objects) require Data Access logs.

Practice this question →
61
MCQmedium

An organization needs to audit all data access (read/write) to a Cloud Storage bucket for compliance. Which type of audit log should they enable?

A.System Event audit logs
B.Access Transparency logs
C.Admin Activity audit logs
D.Data Access audit logs
AnswerD

Data Access audit logs capture read and write operations on resources, such as Cloud Storage objects.

Why this answer

Data Access audit logs record who accessed what data, including read and write operations. Admin Activity logs record changes to configurations, not data access. To enable Data Access logs, they need to configure the audit policy at the organization, folder, or project level for the specific service (storage.googleapis.com).

Practice this question →
62
Multi-Selecthard

An organization has a VPC with several subnets. They want Compute Engine instances in one subnet to have outbound internet access for updates but not be reachable from the internet. The instances have no external IP addresses. Which THREE components must be configured?

Select 3 answers
A.Cloud Router
B.Private Google Access enabled on the subnet
C.An internet gateway attached to the VPC
D.Firewall rule allowing egress traffic to the internet
E.Cloud NAT
AnswersA, D, E

Cloud Router is required to create the NAT gateway and manage dynamic routes.

Why this answer

Cloud NAT allows outbound internet access for private instances. Cloud Router is required to manage NAT gateway routing. The internet gateway is not needed because Cloud NAT provides the translation.

Private Google Access is for Google APIs, not general internet. Firewall rules for ingress from internet are unnecessary since instances have no external IPs.

Practice this question →
63
MCQhard

A developer created a service account for an application running on a Compute Engine instance. The instance was started without specifying the service account. What must the developer do to make the application use the service account?

A.Use gcloud iam service-accounts add-iam-policy-binding to grant the instance access.
B.Stop the instance, update it with the --service-account flag using gcloud compute instances set-service-account, then start it.
C.Use gcloud compute instances add-iam-policy-binding to assign the service account to the instance.
D.Create a new instance with the service account and migrate the application.
AnswerB

Correct: you can attach a service account to an existing instance after stopping.

Why this answer

If an instance is created without a service account, it uses the default compute engine service account. To use a custom service account, the instance must be created with '--service-account' flag. If already running, the instance must be stopped and the service account can be changed (attached) by updating the instance.

The correct approach is to stop the instance, attach the service account, and restart.

Practice this question →
64
MCQeasy

A company wants to automate the rotation of encryption keys for Cloud Storage buckets every 30 days. Which key type should be used?

A.Customer-Managed Encryption Keys (CMEK)
B.Google-managed encryption keys
C.Key Access Justification
D.Customer-Supplied Encryption Keys (CSEK)
AnswerA

Correct: CMEK allows you to set a rotation period (e.g., 30 days) using Cloud Key Management Service.

Why this answer

Customer-Managed Encryption Keys (CMEK) allow you to control the key lifecycle, including rotation. Google-Managed keys rotate automatically but you cannot schedule or force rotation. CSEK requires manual rotation.

Key Access Justification is a feature of CMEK for access transparency.

Practice this question →
65
MCQmedium

You need to create a service account for a Compute Engine instance to allow it to access Cloud Storage objects. The service account should have minimal permissions. What is the recommended approach?

A.Create a service account and assign it to the instance using gcloud compute instances set-service-account after creation
B.Use the default compute engine service account and grant it roles/storage.objectAdmin
C.Create a service account, download a JSON key, and store it on the instance's local disk
D.Create a service account, grant it the required roles, and specify it when creating the instance using the --service-account flag
AnswerD

Correct: uses instance service account without keys.

Why this answer

Create a service account with only the necessary roles (e.g., roles/storage.objectViewer) and attach it to the instance at creation time. Avoid downloading service account keys; use instance metadata-based credentials instead.

Practice this question →
66
MCQeasy

You need to create a Google-managed SSL certificate for an external HTTPS load balancer. The domain is 'www.example.com'. Which command creates the certificate?

A.gcloud compute ssl-certificates create my-cert --certificate example.crt --private-key example.key
B.gcloud compute ssl-certificates create my-cert --certificate example.crt
C.gcloud compute ssl-certificates create my-cert --domains www.example.com
D.gcloud compute ssl-certificates create my-cert --domains www.example.com --managed
AnswerC

Correct: --domains flag creates a Google-managed certificate.

Why this answer

The correct command is gcloud compute ssl-certificates create with the --domains flag. This creates a Google-managed certificate that will be provisioned and renewed automatically.

Practice this question →
67
MCQhard

An organization wants to enforce encryption at rest for all data in Cloud Storage using Customer-Managed Encryption Keys (CMEK). They have created a Cloud KMS key ring and key. What additional step is required when creating a new bucket to use CMEK?

A.Use the `--encryption-key` flag in the `gsutil mb` command.
B.Use the `--default-encryption-key` flag with the KMS key resource ID in the `gsutil mb` command.
C.Assign the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Storage service account.
D.Enable CMEK in the Cloud Console under the bucket's encryption settings after creation.
AnswerB

Correct. This sets the default encryption key for the bucket.

Why this answer

When creating a bucket with CMEK, you must specify the `--default-encryption-key` flag with the KMS key resource ID. This sets the default encryption key for objects stored in the bucket.

Practice this question →
68
MCQeasy

Which of the following is required to enable Private Google Access on a subnet?

A.Configuring the subnet with --enable-private-ip-google-access
B.A Cloud Router in the same region
C.A Cloud NAT gateway
D.VPC peering with a Google-managed network
AnswerA

Correct: This flag enables Private Google Access on the subnet.

Why this answer

Private Google Access is enabled at the subnet level using the '--enable-private-ip-google-access' flag. A Cloud NAT is not required for Private Google Access, though it is commonly used together. Cloud Router and VPC peering are not prerequisites.

Practice this question →
69
Multi-Selecthard

A company wants to implement a least-privilege security model for a service account that needs to read secrets from Secret Manager and publish messages to Pub/Sub. Which TWO IAM roles should be granted? (Choose TWO)

Select 2 answers
A.roles/pubsub.publisher
B.roles/secretmanager.viewer
C.roles/secretmanager.secretAccessor
D.roles/pubsub.admin
E.roles/secretmanager.admin
AnswersA, C

Correct: Grants permission to publish messages to Pub/Sub topics.

Why this answer

The minimum roles needed are: roles/secretmanager.secretAccessor for reading secret versions, and roles/pubsub.publisher for publishing messages. roles/secretmanager.admin is too broad, roles/pubsub.admin is too broad, and roles/secretmanager.viewer only allows viewing metadata, not accessing secret values.

Practice this question →
70
MCQmedium

An engineer needs to enable Private Google Access for a subnet to allow instances without external IPs to access Google APIs and services. Which flag should be used when creating or updating the subnet?

A.--enable-google-access
B.--private-google-access
C.--enable-private-ip-google-access
D.--enable-private-ip
AnswerC

Correct flag to enable Private Google Access.

Why this answer

Private Google Access is enabled on a subnet using the `--enable-private-ip-google-access` flag. This allows instances in the subnet to reach Google APIs via the default route.

Practice this question →
71
Multi-Selecthard

A company wants to allow developers to create and manage secrets in Secret Manager, but prevent them from viewing secret values. Which TWO predefined roles should be combined to achieve this?

Select 2 answers
A.roles/secretmanager.admin
B.roles/secretmanager.secretAccessor
C.roles/secretmanager.secretManager
D.roles/secretmanager.secretVersionManager
E.roles/secretmanager.viewer
AnswersC, D

Allows managing secrets (create, update, delete) without accessing versions.

Why this answer

The roles/secretmanager.admin role includes permissions to create and manage secrets but not to access secret versions (i.e., view values). However, it includes the permission to access versions. Actually, the admin role includes secretmanager.versions.access, so it can view values.

To separate manage from view, you need roles/secretmanager.secretVersionManager (manage versions without access) and roles/secretmanager.secretManager (manage secrets). Wait, the correct combination is roles/secretmanager.secretVersionManager (create/disable/destroy versions) and roles/secretmanager.secretManager (create/update/delete secrets). Neither includes secretmanager.versions.access.

The roles/secretmanager.viewer allows viewing metadata but not values. The roles/secretmanager.secretAccessor allows accessing versions. To manage without viewing, combine roles that exclude access.

Check accurate roles: roles/secretmanager.admin includes all permissions including access. roles/secretmanager.secretManager includes manage secrets but not access versions? Let's verify: roles/secretmanager.secretManager has permissions: secretmanager.secrets.create, secretmanager.secrets.delete, secretmanager.secrets.get, secretmanager.secrets.update, secretmanager.secrets.list. It does NOT include secretmanager.versions.access. roles/secretmanager.secretVersionManager has permissions: secretmanager.versions.create, secretmanager.versions.disable, secretmanager.versions.destroy, secretmanager.versions.enable, secretmanager.versions.get, secretmanager.versions.list. It does NOT include secretmanager.versions.access.

So combining these two roles allows managing secrets and versions but not accessing the payload. roles/secretmanager.viewer allows viewing metadata but not accessing payload. roles/secretmanager.secretAccessor allows accessing payload. So the correct two are secretManager and secretVersionManager.

Practice this question →
72
MCQeasy

You need to grant a user the ability to view audit logs for a project but not modify any resources. Which predefined IAM role should you assign?

A.roles/iam.securityReviewer
B.roles/owner
C.roles/viewer
D.roles/logging.viewer
AnswerD

Correct: This role grants read access to all logs, including audit logs, without modification permissions.

Why this answer

The roles/logging.viewer role provides read-only access to logs, including audit logs. roles/iam.securityReviewer provides read access to IAM policies but not logs. roles/viewer is too broad. roles/owner is administrative.

Practice this question →
73
MCQmedium

A security team wants to audit all Data Access attempts in a project for a specific Cloud Storage bucket, including who accessed which object and when. Which configuration is required?

A.Configure VPC Flow Logs on the VPC network
B.Set up Cloud Monitoring alerts on the bucket
C.Enable Admin Activity audit logs for Cloud Storage in the project
D.Enable Data Access audit logs for Cloud Storage in the project's IAM audit config
AnswerD

Correct: Data Access audit logs capture object-level access.

Why this answer

Data Access audit logs must be enabled for Cloud Storage at the project level via IAM audit config. Admin Activity logs are always enabled but only record configuration changes, not data access. VPC Flow Logs record network metadata, not object-level access.

Cloud Monitoring does not provide audit logs.

Practice this question →
74
MCQhard

An organization uses Organization Policies to restrict the use of certain IAM roles. The security team wants to audit all modifications to IAM policies across the organization, including at the project level. Which log type should be enabled and analyzed?

A.Admin Activity audit logs
B.System Event audit logs
C.Data Access audit logs (READ)
D.Data Access audit logs (WRITE)
AnswerA

Correct: Admin Activity logs capture all API calls that modify configuration or metadata, including IAM policy changes.

Why this answer

Admin Activity audit logs record all modifications to IAM policies. Data Access logs record reads of data, not policy changes. To audit IAM policy changes, Admin Activity logs must be enabled and analyzed.

Practice this question →
75
MCQhard

An organization wants to use Cloud NAT to allow private Compute Engine instances to access the internet for updates. They have a VPC with a custom subnet and a Cloud Router configured. However, instances cannot reach the internet. What is the most likely cause?

A.The Cloud NAT gateway has not been created on the Cloud Router.
B.The instances do not have external IP addresses.
C.The firewall rules block egress traffic.
D.The subnet does not have Private Google Access enabled.
AnswerA

Correct: A Cloud Router alone does not provide NAT; a NAT gateway must be created on the router.

Why this answer

Cloud NAT requires a Cloud Router and a NAT gateway configuration on the router. If the NAT gateway is not created, instances cannot use NAT. Other issues like missing routes or firewall rules are possible but less likely when Cloud NAT is set up correctly.

Practice this question →
Page 1 of 2 · 100 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Ace Access Security questions.

Start 20-question session
CCNA Ace Access Security Questions — Page 1 of 2 | Courseiva