I85PREP
⌘ K
ACE-Associate study materials
ACE-Associate study resources

ACE-Associate practice questions

One question at a time. Build your ACE-Associate understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Set up a cloud solution environment

A team needs to run a batch analytics job that can tolerate interruption and must complete within 24 hours. Which Compute Engine provisioning model best fits this requirement while minimizing cost?

  1. Committed use discounts on standard VMs
  2. Spot VMs Correct answer.
  3. Standard on-demand VMs with a 3-year commitment
  4. Sole-tenant nodes

Explanation

Spot VMs provide heavily discounted compute for workloads that can be preempted, making them suitable for fault-tolerant batch jobs. Committed use discounts and sole-tenant nodes cost more and are aimed at steady-state or compliance-driven workloads.

Question 2Set up a cloud solution environment

An administrator wants to create a new project and ensure it inherits no permissions from a parent folder. Which statement describes what happens by default when a project is created inside a folder?

  1. The project is isolated and inherits nothing unless explicitly granted
  2. The project inherits only billing permissions from the organization
  3. The project inherits IAM policies from the folder and organization Correct answer.
  4. The project inherits permissions only from other projects in the folder

Explanation

Resource hierarchy inheritance means IAM policies applied at the organization and folder levels flow down to projects and their resources. A project cannot opt out of inherited policies; effective access is the union of policies along the path.

Question 3Set up a cloud solution environment

A company wants all new resources to be created in the europe-west1 region by default unless a user specifies otherwise. Which mechanism should be used?

  1. An organization policy constraint on resource locations
  2. A VPC network with only europe-west1 subnets
  3. A default region set in the gcloud CLI configuration Correct answer.
  4. A quota override limited to europe-west1

Explanation

Setting the compute/region property in the gcloud configuration makes that region the default for commands that accept a region. Organization policies restrict locations rather than set convenient defaults, and VPC or quota settings do not change CLI defaults.

Question 4Set up a cloud solution environment

Which IAM role allows a user to create and manage projects within an organization but does not grant access to the resources inside those projects?

  1. roles/resourcemanager.organizationAdmin
  2. roles/resourcemanager.projectCreator Correct answer.
  3. roles/owner
  4. roles/editor

Explanation

The Project Creator role grants permission to create projects under a specified organization or folder. It does not by itself grant access to resources within the created projects, which requires separate role grants.

Question 5Set up a cloud solution environment

A user needs to view the details of an existing Compute Engine instance but must not be able to start, stop, or modify it. Which predefined role should be granted?

  1. roles/compute.instanceAdmin.v1
  2. roles/compute.viewer Correct answer.
  3. roles/compute.admin
  4. roles/viewer

Explanation

Compute Viewer provides read-only access to Compute Engine resources, including viewing instance details. Instance Admin and Compute Admin include mutating permissions, and the basic Viewer role is broader and not scoped to Compute Engine.

Question 6Set up a cloud solution environment

Which tool provides a single place to set up and manage billing for multiple projects in a Google Cloud organization?

  1. An organization policy constraint
  2. A folder-level budget alert
  3. A Cloud Billing account linked to projects Correct answer.
  4. A Cloud Quotas policy

Explanation

A Cloud Billing account is the payment instrument that projects link to, and it can pay for multiple projects. Budgets and alerts monitor spend but do not handle payment, while quotas and org policies govern capacity and configuration.

Question 7Set up a cloud solution environment

An engineer wants to create a VPC network and a subnet in a single command using the gcloud CLI. Which command should be used?

  1. gcloud compute networks create with the --subnet-mode=custom flag Correct answer.
  2. gcloud compute firewall-rules create
  3. gcloud compute instances create
  4. gcloud compute routes create

Explanation

Creating a VPC network with custom subnet mode establishes a network where subnets are defined manually, and subnets can then be added. Firewall rules, instances, and routes are separate resource types created after the network exists.

Question 8Set up a cloud solution environment

Which service should be used to run a containerized application without managing the underlying servers and while scaling automatically based on traffic?

  1. GKE Autopilot
  2. Compute Engine managed instance groups
  3. Cloud Run Correct answer.
  4. App Engine standard environment

Explanation

Cloud Run is a fully managed serverless platform for containerized workloads that scales automatically, including to zero. Managed instance groups require VM management, GKE Autopilot manages nodes but is Kubernetes-oriented, and App Engine standard runs language runtimes rather than arbitrary containers.

Question 9Set up a cloud solution environment

An organization wants to prevent any user from creating resources outside approved regions. Which control should be applied?

  1. An organization policy with the location constraint Correct answer.
  2. A firewall rule denying outbound traffic
  3. A budget alert on the billing account
  4. A custom IAM role with fewer permissions

Explanation

Organization policy constraints such as the resource location restriction enforce where resources may be created across the hierarchy. Firewall rules, budgets, and IAM roles do not restrict geographic locations.

Question 10Set up a cloud solution environment

A developer must be able to deploy Cloud Run services but should not be able to modify IAM policies on those services. Which approach follows least privilege?

  1. Grant roles/run.developer on the specific service Correct answer.
  2. Grant roles/run.admin at the organization level
  3. Grant roles/editor on the project
  4. Grant roles/owner on the project

Explanation

The Cloud Run Developer role permits deploying and managing services without granting permission to change IAM policies, and scoping it to the service limits blast radius. Broader roles include IAM management or unrelated permissions.

Question 11Set up a cloud solution environment

An administrator needs to grant a group of auditors read-only access to all resources in a folder, including future projects added to it. What is the most appropriate action?

  1. Add the group to a project-level allow policy on one project
  2. Grant a read-only role to the group on the folder Correct answer.
  3. Grant a read-only role to each user on each project individually
  4. Grant a read-only role to the group on the organization only

Explanation

Granting a role at the folder level applies to all current and future projects within that folder through inheritance. Per-project grants require repeated work, organization-level grants would exceed the intended scope, and a single project grant does not cover the folder.

Question 12Set up a cloud solution environment

A team wants to ensure that when a VM is created, it uses a specific service account with only the logging write scope. Which configuration step is required?

  1. Attach the service account to the instance and set access scopes to logging-write Correct answer.
  2. Assign the service account the Owner role
  3. Create the VM with the allow-full-access scope
  4. Set the default service account on the project and enable the Compute API

Explanation

A VM's identity is determined by the service account attached to it, and access scopes further limit the API access available to that account. Setting a project default or broad scopes does not enforce the intended least privilege.

Question 13Set up a cloud solution environment

An engineer wants to create a project with a specific project ID and link it to an existing billing account in one workflow. Which sequence is correct?

  1. Create the project, then link the billing account to it Correct answer.
  2. Link the billing account to the organization, then create the project
  3. Create the project and enable the Cloud Billing API only
  4. Create the project and set the billing account as a label

Explanation

Projects are created first and then associated with a billing account, which enables billing for the project's services. Billing accounts are linked to projects rather than to the organization as a prerequisite, and labels do not establish billing.

Question 14Set up a cloud solution environment

A company needs to give a contractor temporary access to a specific Cloud Storage bucket for two weeks. Which method is most appropriate?

  1. Grant a bucket-level IAM role with an IAM condition that expires Correct answer.
  2. Grant the contractor the project Viewer role permanently
  3. Create a service account key and share it with the contractor
  4. Add the contractor to the organization admin group

Explanation

IAM conditions can limit a role binding to a time window, and scoping the grant to the bucket follows least privilege. Permanent broad roles, shared keys, and admin group membership all exceed the intended access.

Question 15Set up a cloud solution environment

A startup wants to receive an alert when monthly spending on a billing account exceeds a threshold but does not want resources disabled. What should be configured?

  1. A Cloud Billing budget with alert thresholds Correct answer.
  2. An organization policy denying resource creation
  3. A quota limit on Compute Engine
  4. A committed use discount

Explanation

Cloud Billing budgets send alerts when spend crosses configured thresholds and do not by themselves disable resources. Quotas limit usage, org policies restrict configuration, and committed use discounts affect pricing rather than alerting.

Question 16Set up a cloud solution environment

An administrator wants to verify which account and project the gcloud CLI is currently using before running commands. Which command should be run?

  1. gcloud projects delete
  2. gcloud auth revoke
  3. gcloud compute instances list
  4. gcloud config list Correct answer.

Explanation

The gcloud config list command displays the active configuration, including the account and project properties. The other commands revoke credentials, delete a project, or list instances and do not show the current configuration.

Question 17Set up a cloud solution environment

A team needs a private network in which subnets are created automatically across all regions when the network is created. Which subnet mode should be selected?

  1. Custom mode
  2. Auto mode Correct answer.
  3. Legacy mode
  4. Shared VPC mode

Explanation

Auto mode VPC networks automatically create one subnet per region with predefined ranges. Custom mode requires manual subnet creation, and legacy and Shared VPC describe other network arrangements.

Question 18Set up a cloud solution environment

An organization has multiple departments that each need separate IAM administration while sharing a single billing account. Which structure best supports this?

  1. Create a folder per department under the organization and delegate administration at the folder level Correct answer.
  2. Create a separate organization for each department
  3. Create all resources in a single project with per-user roles
  4. Create one project per department and grant Owner at the organization

Explanation

Folders let you delegate administration and apply policies per department while keeping a single organization and billing account. Organization-wide Owner grants, a single shared project, or multiple organizations undermine isolation and centralized billing.

Question 19Set up a cloud solution environment

A workload requires a VM that must run continuously for three years with predictable usage. Which purchasing option most reduces cost for this steady-state workload?

  1. Spot VM
  2. Preemptible instance
  3. Committed use discount Correct answer.
  4. Per-second on-demand billing

Explanation

Committed use discounts lower the price for resources used steadily over a one- or three-year term. Spot and preemptible instances are cheaper but can be interrupted, and on-demand billing offers no commitment discount.

Question 20Set up a cloud solution environment

An engineer must grant a service account permission to publish messages to a specific Pub/Sub topic only. Which grant satisfies this requirement?

  1. roles/editor on the project
  2. roles/pubsub.admin on the project
  3. roles/pubsub.subscriber on the topic
  4. roles/pubsub.publisher on the topic Correct answer.

Explanation

The Pub/Sub Publisher role scoped to the topic allows publishing to that topic only. Admin and Editor are broader, and the Subscriber role permits consuming messages rather than publishing.

Question 21Set up a cloud solution environment

An administrator needs to confirm which IAM roles a user effectively has on a project after inheritance from the folder and organization. Which tool should be used?

  1. VPC Flow Logs
  2. Cloud Audit Logs
  3. Policy Troubleshooter Correct answer.
  4. Cloud Monitoring uptime checks

Explanation

Policy Troubleshooter evaluates a principal's effective access by considering policies along the resource hierarchy. Audit logs record actions taken, flow logs capture network traffic, and uptime checks monitor availability.

Question 22Set up a cloud solution environment

A company wants to enforce that no service account keys are created in any project under its organization. Which control achieves this?

  1. An organization policy disabling service account key creation Correct answer.
  2. A firewall rule blocking metadata access
  3. A budget alert on the billing account
  4. A custom role that omits key creation permissions

Explanation

An organization policy constraint can disable service account key creation across all projects in the hierarchy. Budgets, firewall rules, and custom roles do not reliably prevent key creation organization-wide.

Question 23Set up a cloud solution environment

An engineer must create a VPC network where only specific subnets exist and instances in different subnets can communicate privately without leaving the network. Which two configuration choices are required?

  1. Auto mode and a Cloud NAT gateway
  2. Legacy mode and an external IP on each instance
  3. Shared VPC and a VPN tunnel between subnets
  4. Custom subnet mode and firewall rules allowing internal traffic Correct answer.

Explanation

Custom mode lets you define exactly the subnets you need, and firewall rules must permit traffic between them because VPC networks deny ingress by default. Auto mode, NAT, external IPs, and VPN tunnels are not required for private intra-network communication.

Question 24Set up a cloud solution environment

An organization requires that all projects be created only under approved folders and that project deletion be restricted to a central team. Which combination of controls best meets this requirement?

  1. An organization policy restricting project creation to folders plus an IAM role granting project deletion only to the central team Correct answer.
  2. A budget alert plus a firewall rule
  3. A custom role for developers plus auto mode VPC networks
  4. A Shared VPC plus Cloud NAT

Explanation

Organization policies can constrain where projects are created, and IAM role bindings control who may delete projects. Budgets, firewall rules, VPC modes, and NAT settings do not govern project lifecycle permissions.

Question 25Set up a cloud solution environment

A platform team must give application teams the ability to create their own projects while ensuring those projects automatically inherit network and security policies from a shared folder. Which approach is correct?

  1. Grant Owner on the organization to each application team
  2. Grant projectCreator on the shared folder and apply the policies at the folder level Correct answer.
  3. Grant projectCreator at the organization and apply policies per project
  4. Create all projects centrally and grant Editor to each team

Explanation

Granting projectCreator on the folder allows teams to create projects within it, and policies set at the folder are inherited by all projects created there. Organization-wide grants exceed the needed scope, and per-project or central creation approaches do not achieve automatic inheritance.

Question 26Set up a cloud solution environment

Which Google Cloud resource is the top-level node of the resource hierarchy and contains all folders, projects, and resources for a company?

  1. The folder node
  2. The project node
  3. The billing account
  4. The organization node Correct answer.

Explanation

The organization node is the root of the Google Cloud resource hierarchy and represents the company; folders, projects, and resources descend from it. Billing accounts sit outside the hierarchy and are linked to projects for payment.

Question 27Set up a cloud solution environment

An engineer wants to create a new project from the command line and immediately set it as the active project for subsequent gcloud commands. Which approach accomplishes both steps?

  1. Run gcloud projects create, then gcloud config set project with the new project ID Correct answer.
  2. Run gcloud projects create with the --set-active flag
  3. Run gcloud config set project before creating the project
  4. Run gcloud init and select the existing default project

Explanation

Project creation and configuration are separate operations: gcloud projects create makes the project, and gcloud config set project changes the active project in the current configuration. Setting the active project before it exists fails because the project must exist first.

Question 28Set up a cloud solution environment

Which predefined IAM role grants the ability to view all resources and their IAM policies across a project without allowing changes?

  1. roles/viewer
  2. roles/editor
  3. roles/iam.securityReviewer Correct answer.
  4. roles/owner

Explanation

roles/iam.securityReviewer provides read access to IAM policies and security-related metadata without permitting modification. roles/viewer allows reading resources but does not by itself grant visibility into IAM policies.

Question 29Set up a cloud solution environment

A team wants a project's resources to be created in a specific region by default when a region is not specified in commands. Which setting should be configured in the gcloud CLI?

  1. gcloud config set api_endpoint_overrides/compute
  2. gcloud config set core/project
  3. gcloud config set compute/region Correct answer.
  4. gcloud config set compute/zone

Explanation

The compute/region property sets the default region used when a command omits a region. The compute/zone property sets a default zone, which is a more specific location within a region.

Question 30Set up a cloud solution environment

Which Google Cloud component must be linked to a project before most billable resources in that project can be created?

  1. A billing account Correct answer.
  2. A service account
  3. A VPC network
  4. An organization policy

Explanation

A project must be linked to an active billing account to use billable services; without it, most resource creation is blocked. Networks and service accounts are resources within the project, not prerequisites for billing.

Question 31Set up a cloud solution environment

An administrator wants to grant a new employee the minimum role needed to create and manage VMs but not to change IAM policies. Which role is most appropriate?

  1. roles/owner
  2. roles/compute.instanceAdmin.v1 Correct answer.
  3. roles/compute.admin
  4. roles/iam.securityAdmin

Explanation

roles/compute.instanceAdmin.v1 grants management of Compute Engine instances without granting IAM policy changes. roles/compute.admin includes broader permissions over Compute Engine resources but is not the least-privilege choice for instance management alone.

Question 32Set up a cloud solution environment

Which command displays the current gcloud CLI configuration properties, including the active account and project?

  1. gcloud projects list
  2. gcloud config list Correct answer.
  3. gcloud auth login
  4. gcloud info --run-diagnostics

Explanation

gcloud config list prints the active configuration's properties, such as account, project, and region. The other commands either authenticate, enumerate projects, or run diagnostics rather than showing configuration.

Question 33Set up a cloud solution environment

A company wants every new project created under a folder to inherit the same set of IAM bindings automatically. Where should the bindings be granted?

  1. On the folder containing the projects Correct answer.
  2. On the organization node only
  3. On each project after creation
  4. On each individual resource inside the projects

Explanation

IAM policies granted on a folder are inherited by all projects and resources beneath it, including projects created later. Granting at the folder level avoids repeating bindings on each project.

Question 34Set up a cloud solution environment

Which tool is used to define and deploy Google Cloud resources from templates stored in version control, enabling repeatable environment creation?

  1. Infrastructure as code with Terraform Correct answer.
  2. Cloud Shell's built-in editor
  3. The Cloud Console resource creation wizard
  4. gcloud interactive shell

Explanation

Infrastructure as code tools such as Terraform let teams declare resources in files, store them in version control, and apply them repeatedly for consistent environments. Console wizards and shells are interactive and do not provide declarative, versioned templates.

Question 35Set up a cloud solution environment

An organization wants to restrict which APIs can be enabled in all projects under a folder. Which mechanism should be used?

  1. Organization Policy Service constraints Correct answer.
  2. IAM deny policies on each project
  3. Quota adjustments on the projects
  4. VPC Service Controls perimeters

Explanation

Organization Policy Service provides constraints, such as restricting service usage, that are enforced across the hierarchy and inherited by descendant projects. IAM deny policies control access to actions but do not govern which APIs may be enabled.

Question 36Set up a cloud solution environment

A developer needs to authenticate the gcloud CLI using a user account on a workstation. Which command starts the browser-based sign-in flow?

  1. gcloud auth login Correct answer.
  2. gcloud config set account
  3. gcloud auth application-default login
  4. gcloud auth activate-service-account

Explanation

gcloud auth login authenticates a human user for the gcloud CLI through a browser-based flow. Application default credentials are a separate mechanism used by client libraries and code.

Question 37Set up a cloud solution environment

A team needs a shared, centrally managed network that multiple projects can use for their resources. Which design supports this?

  1. A default VPC network in each project
  2. A Shared VPC host project with service projects attached Correct answer.
  3. A separate VPC network in each project
  4. A single project containing all resources

Explanation

Shared VPC designates a host project whose network is shared with attached service projects, centralizing network administration. Separate VPCs per project isolate networks and do not provide a shared network.

Question 38Set up a cloud solution environment

Which predefined role allows a principal to create and manage projects within an organization but not to administer the organization itself?

  1. roles/billing.admin
  2. roles/resourcemanager.organizationAdmin
  3. roles/iam.organizationRoleAdmin
  4. roles/resourcemanager.projectCreator Correct answer.

Explanation

roles/resourcemanager.projectCreator permits creating projects within a specified scope such as an organization or folder. Organization administration and billing administration are separate roles with broader or different responsibilities.

Question 39Set up a cloud solution environment

An engineer wants to list all projects in an organization that the current account can access. Which command provides this?

  1. gcloud iam roles list
  2. gcloud resource-manager folders list
  3. gcloud organizations list
  4. gcloud projects list Correct answer.

Explanation

gcloud projects list enumerates the projects the authenticated account can see. Listing organizations or folders returns different resource types and does not enumerate projects.

Question 40Set up a cloud solution environment

A company wants to ensure that resources in a project cannot be created in regions outside an approved list, regardless of who runs the command. Which control is designed for this?

  1. A VPC firewall rule
  2. A budget alert on the billing account
  3. An organization policy constraint restricting resource locations Correct answer.
  4. A custom IAM role for developers

Explanation

Organization policy constraints can restrict the locations where resources may be created and are enforced regardless of a principal's permissions. Budget alerts and firewall rules do not constrain resource location.

Question 41Set up a cloud solution environment

What is the primary purpose of a Google Cloud folder in the resource hierarchy?

  1. To store billing account payment details
  2. To provide compute capacity for workloads
  3. To host the organization's DNS records
  4. To group projects for common IAM and policy administration Correct answer.

Explanation

Folders group projects and other folders so that IAM policies and organization policies can be applied once and inherited. Compute capacity, billing details, and DNS records are handled by other services.

Question 42Set up a cloud solution environment

An administrator wants a new project to use a specific billing account at creation time from the command line. Which flag accomplishes this with gcloud projects create?

  1. --budget
  2. --billing-account Correct answer.
  3. --payment-profile
  4. --account

Explanation

gcloud projects create accepts --billing-account to link the new project to a billing account during creation. The other flags do not exist for this purpose.

Question 43Set up a cloud solution environment

A team must ensure that service accounts in a project can only be created by members of a specific group. Which IAM approach best achieves this?

  1. Grant the group roles/iam.serviceAccountAdmin and grant other principals roles that exclude it Correct answer.
  2. Grant the group roles/viewer
  3. Grant all developers roles/editor
  4. Grant all developers roles/owner

Explanation

Restricting service account administration to a group requires granting that group the service account admin role while ensuring others lack permissions to create service accounts. Broad roles such as editor or owner include service account permissions.

Question 44Set up a cloud solution environment

Which practice best follows the principle of least privilege when setting up a new environment for a development team?

  1. Grant roles/owner at the organization for convenience
  2. Share a single service account key among all developers
  3. Grant roles/editor at the folder level to all staff
  4. Grant predefined roles scoped to the team's project rather than at the organization Correct answer.

Explanation

Least privilege means granting only the permissions needed, at the narrowest scope that satisfies the requirement, such as project-level predefined roles. Organization-wide owner or folder-wide editor grants far more access than necessary.

Question 45Set up a cloud solution environment

An engineer needs to switch the active configuration in gcloud between two environments that use different accounts and projects. Which feature is designed for this?

  1. Multiple billing accounts
  2. Separate organization nodes
  3. Multiple Cloud Shell sessions
  4. Named gcloud configurations Correct answer.

Explanation

Named configurations store separate sets of gcloud properties, such as account, project, and region, and can be activated as needed. The other options do not provide switchable CLI property sets.

Question 46Set up a cloud solution environment

A company wants to enforce that all new projects are created beneath a specific folder. Which control should be configured?

  1. An organization policy constraint on resource locations for projects Correct answer.
  2. A firewall rule on the default network
  3. A custom role with project creation permissions
  4. A budget alert scoped to the folder

Explanation

Organization policy constraints can restrict where projects may be created in the hierarchy, such as requiring creation under a designated folder. Budget alerts, firewall rules, and custom roles do not enforce project placement.

Question 47Set up a cloud solution environment

Which Google Cloud resource is a container for services, APIs, and resources and forms the basis for enabling APIs and assigning most IAM roles?

  1. A billing account
  2. An organization
  3. A folder
  4. A project Correct answer.

Explanation

A project is the fundamental container in which resources are created, APIs are enabled, and IAM roles are commonly granted. Folders and organizations group projects, and billing accounts handle payment.

Question 48Set up a cloud solution environment

A team needs to grant a principal permission to view billing information for a project without allowing changes to the billing account. Which role is appropriate?

  1. roles/owner
  2. roles/billing.viewer Correct answer.
  3. roles/billing.admin
  4. roles/viewer

Explanation

roles/billing.viewer allows viewing billing account information without making changes. roles/billing.admin permits modifying billing settings, and other roles do not target billing visibility.

Question 49Set up a cloud solution environment

An administrator is designing a hierarchy for a company with several departments, each needing independent policy administration while sharing one organization. Which structure is most appropriate?

  1. A single folder containing all projects for every department
  2. A folder per department beneath the organization, with projects beneath each folder Correct answer.
  3. A single project containing all departments' resources
  4. A separate organization for each department

Explanation

Folders beneath the organization let each department apply its own IAM and organization policies that are inherited by its projects while remaining under one organization. A single project or single folder removes the departmental isolation of policy administration.

Question 50Set up a cloud solution environment

Which command creates a new folder under an organization using the gcloud CLI?

  1. gcloud organizations create --display-name=NAME
  2. gcloud resource-manager folders create --display-name=NAME --organization=ORG_ID Correct answer.
  3. gcloud resource-manager folders list --organization=ORG_ID
  4. gcloud projects create --folder=NAME

Explanation

gcloud resource-manager folders create creates a folder and accepts --organization to specify the parent organization. The other commands either create projects, attempt to create organizations, or list folders.