ACE practice questions 1–10

1. Question 1 · 325 in bank

   Every employee of your company has a Google account. Your operational team needs to manage a large number of instances on Compute Engine. Each member of this team needs only administrative access to the servers. Your security team wants to ensure that the deployment of credentials is operationally efficient and must be able to determine who accessed a given instance. What should you do?

   • AGenerate a new SSH key pair. Give the private key to each member of your team. Configure the public key in the metadata of each instance.
   • BAsk each member of the team to generate a new SSH key pair and to send you their public key. Use a configuration management tool to deploy those keys on each instance.
   • CAsk each member of the team to generate a new SSH key pair and to add the public key to their Google account. Grant the ג€compute.osAdminLoginג€ role to the Google group corresponding to this team.
   • DGenerate a new SSH key pair. Give the private key to each member of your team. Configure the public key as a project-wide public SSH key in your Cloud Platform project and allow project-wide public SSH keys on each instance.

   Show answer

   Answer: C

   Explanation

   We recommend collecting users with the same responsibilities into groups and assigning IAM roles to the groups rather than to individual users. For example, you can create a "data scientist" group and assign appropriate roles to enable interaction with BigQuery and Cloud Storage. When a new data scientist joins your team, you can simply add them to the group and they will inherit the defined permissions. You can create and manage groups through the Admin Console.

   Source: Adapted from community discussion — adedj99

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

2. Question 2 · 325 in bank

   You have a development project with appropriate IAM roles defined. You are creating a production project and want to have the same IAM roles on the new project, using the fewest possible steps. What should you do?

   • AUse gcloud iam roles copy and specify the production project as the destination project.
   • BUse gcloud iam roles copy and specify your organization as the destination organization.
   • CIn the Google Cloud Platform Console, use the 'create role from role' functionality.
   • DIn the Google Cloud Platform Console, use the 'create role' functionality and select all applicable permissions.

   Show answer

   Answer: A

   Explanation

   The correct answer is Option A. To create the same IAM roles in a production project as in a development project, using the fewest possible steps, you can use the gcloud iam roles copy command and specify the production project as the destination project. The `gcloud iam roles copy` command allows you to copy IAM roles between projects or organizations. By specifying the production project as the destination project, you can copy the IAM roles from the development project to the production project. Option B is incorrect because specifying your organization as the destination organization will copy the IAM roles to all projects within the organization, which is not what you want.

   Source: Adapted from community discussion — Buruguduystunstugudunstuy

   References

   • Google Cloud documentation

   Next question

3. Question 3 · 325 in bank

   Your organization has strict requirements to control access to Google Cloud projects. You need to enable your Site Reliability Engineers (SREs) to approve requests from the Google Cloud support team when an SRE opens a support case. You want to follow Google-recommended practices. What should you do?

   • AAdd your SREs to roles/iam.roleAdmin role.
   • BAdd your SREs to roles/accessapproval.approver role.
   • CAdd your SREs to a group and then add this group to roles/iam.roleAdmin.role.
   • DAdd your SREs to a group and then add this group to roles/accessapproval.approver role.

   Show answer

   Answer: D

   Explanation

   Passed my exams today. Not because just because of the questions I practiced here, but because of you guys, your knowledge and experience and breakdown of questions. Too bad this site can't go legit. It such an wholesome resource. Some final words... KEEP MOVING FORWARD UNTIL ALL THE QUESTIONS ARE DESTROYED TATAKAE!!!!!!

   Source: Adapted from community discussion — ErenYeager

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

4. Question 4 · 325 in bank

   You need to host an application on a Compute Engine instance in a project shared with other teams. You want to prevent the other teams from accidentally causing downtime on that application. Which feature should you use?

   • AUse a Shielded VM.
   • BUse a Preemptible VM.
   • CUse a sole-tenant node.
   • DEnable deletion protection on the instance.

   Show answer

   Answer: D

   Explanation

   Correct Answer is (D): Preventing Accidental VM Deletion This document describes how to protect specific VM instances from deletion by setting the deletionProtection property on an Instance resource. To learn more about VM instances, read the Instances documentation. As part of your workload, there might be certain VM instances that are critical to running your application or services, such as an instance running a SQL server, a server used as a license manager, and so on. These VM instances might need to stay running indefinitely so you need a way to protect these VMs from being deleted. By setting the deletionProtection flag, a VM instance can be protected from accidental deletion. If a user attempts to delete a VM instance for which you have set the deletionProtection flag, the request fails. Only a user that has been granted a role with compute.instances.create permission can reset the flag to allow the resource to be deleted. https://cloud.google.com/compute/docs/instances/preventing-accidental-vm-deletion

   Source: Adapted from community discussion — ESP_SAP

   References

   • Google Cloud documentation

   Next question

5. Question 5 · 325 in bank

   Your organization needs to grant users access to query datasets in BigQuery but prevent them from accidentally deleting the datasets. You want a solution that follows Google-recommended practices. What should you do?

   • AAdd users to roles/bigquery user role only, instead of roles/bigquery dataOwner.
   • BAdd users to roles/bigquery dataEditor role only, instead of roles/bigquery dataOwner.
   • CCreate a custom role by removing delete permissions, and add users to that role only.
   • DCreate a custom role by removing delete permissions. Add users to the group, and then add the group to the custom role.

   Show answer

   Answer: D

   Explanation

   I believe the key part is the "following Google Best Practices" phrase. A - Works, but doesn't follow GCP best practices B - Doesn't work as the role grants permission to delete datasets C - Works, but is more complicated than A and doesn't follow Google best practices D - Correct, more complicated than A, but it follows Google Best Practices.

   Source: Adapted from community discussion — someoneinthecloud

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

6. Question 6 · 325 in bank

   You have a developer laptop with the Cloud SDK installed on Ubuntu. The Cloud SDK was installed from the Google Cloud Ubuntu package repository. You want to test your application locally on your laptop with Cloud Datastore. What should you do?

   • AExport Cloud Datastore data using gcloud datastore export.
   • BCreate a Cloud Datastore index using gcloud datastore indexes create.
   • CInstall the google-cloud-sdk-datastore-emulator component using the apt get install command.
   • DInstall the cloud-datastore-emulator component using the gcloud components install command.

   Show answer

   Answer: C

   Explanation

   I agree with this comment. The answer is C. If you installed the SDK from the Ubuntu repo and try to do the following: $ gcloud components install cloud-datastore-emulator You will receive this message: ERROR: (gcloud.components.install) You cannot perform this action because the Cloud SDK component manager is disabled for this installation. You can run the following command to achieve the same result for this installation: sudo apt-get install google-cloud-sdk-datastore-emulator

   Source: Adapted from community discussion — XRiddlerX

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

7. Question 7 · 325 in bank

   Your company set up a complex organizational structure on Google Cloud. The structure includes hundreds of folders and projects. Only a few team members should be able to view the hierarchical structure. You need to assign minimum permissions to these team members, and you want to follow Google-recommended practices. What should you do?

   • AAdd the users to roles/browser role.
   • BAdd the users to roles/iam.roleViewer role.
   • CAdd the users to a group, and add this group to roles/browser.
   • DAdd the users to a group, and add this group to roles/iam.roleViewer role.

   Show answer

   Answer: C

   Explanation

   Correct Answer is (C): We need to apply the GCP Best practices. roles/browser Browser Read access to browse the hierarchy for a project, including the folder, organization, and IAM policy. This role doesn't include permission to view resources in the project. https://cloud.google.com/iam/docs/understanding-roles

   Source: Adapted from community discussion — ESP_SAP

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

8. Question 8 · 325 in bank

   Your company has a single sign-on (SSO) identity provider that supports Security Assertion Markup Language (SAML) integration with service providers. Your company has users in Cloud Identity. You would like users to authenticate using your company's SSO provider. What should you do?

   • AIn Cloud Identity, set up SSO with Google as an identity provider to access custom SAML apps.
   • BIn Cloud Identity, set up SSO with a third-party identity provider with Google as a service provider.
   • CObtain OAuth 2.0 credentials, configure the user consent screen, and set up OAuth 2.0 for Mobile & Desktop Apps.
   • DObtain OAuth 2.0 credentials, configure the user consent screen, and set up OAuth 2.0 for Web Server Applications.

   Show answer

   Answer: B

   Explanation

   B - This is the only possible option. You configure applications (service providers) to accept SAML assertions from the company’s existing identity provider and users in Cloud Identity can sign in to various applications through the third-party single sign-on (SSO) identity provider. It is important to note that user authentication occurs in the third-party IdP so the absence of a Gmail login is not an issue for signing in. Ref: https://cloud.google.com/identity/solutions/enable-sso If you have a third-party IdP, you can still configure SSO for third-party apps in the Cloud Identity catalog. User authentication occurs in the third-party IdP, and Cloud Identity manages the cloud apps. To use Cloud Identity for SSO, your users need Cloud Identity accounts. They sign in through your third-party IdP or using a password on their Cloud Identity accounts.

   Source: Adapted from community discussion — sudav

   References

   • support.google.com documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • support.google.com documentation
   • Google Cloud documentation

   Next question

9. Question 9 · 325 in bank

   Your organization has a dedicated person who creates and manages all service accounts for Google Cloud projects. You need to assign this person the minimum role for projects. What should you do?

   • AAdd the user to roles/iam.roleAdmin role.
   • BAdd the user to roles/iam.securityAdmin role.
   • CAdd the user to roles/iam.serviceAccountUser role.
   • DAdd the user to roles/iam.serviceAccountAdmin role.

   Show answer

   Answer: D

   Explanation

   Whoever say C is right answer, please read the question 1000000000 times if not understand - "Your organization has a dedicated person who creates and manages all service accounts for Google Cloud projects. " Dedicated person who creates and manages all service... Now read below; To allow a user to manage service accounts, grant one of the following roles: Service Account User (roles/iam.serviceAccountUser): Includes permissions to list service accounts, get details about a service account, and impersonate a service account. Service Account Admin (roles/iam.serviceAccountAdmin): Includes permissions to list service accounts and get details about a service account. Also includes permissions to create, update, and delete service accounts, and to view or change the IAM policy on a service account. Now look in which role mentioned "CREATE"? Obviously - roles/iam.serviceAccountAdmin....... So Answer is???? 1M% - D only

   Source: Adapted from community discussion — PhilipAWS

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

10. Question 10 · 325 in bank

    You are building an archival solution for your data warehouse and have selected Cloud Storage to archive your data. Your users need to be able to access this archived data once a quarter for some regulatory requirements. You want to select a cost-efficient option. Which storage option should you use?

    • ACold Storage
    • BNearline Storage
    • CRegional Storage
    • DMulti-Regional Storage

    Show answer

    Answer: A

    Explanation

    Took ACE last week and the exact question came out. I go with B as i felt A is a trick answer. There is no Cold Storage in GCP.

    Source: Adapted from community discussion — Teegongkia

    References

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

ACE practice, question 1. 325 questions available.