I85PREP
⌘ K
ACE study materials
ACE study resources

ACE practice questions

One question at a time. Build your ACE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Set up a cloud solution environment

An organization wants separate Google Cloud projects for its development, staging, and production environments so that billing and access can be isolated. Which resource hierarchy element should hold these projects so that policies applied there flow down to all three?

  1. A service account
  2. A billing account
  3. A folder Correct answer.
  4. An organization node

Explanation

Folders sit between the organization node and projects and act as policy inheritance containers, so IAM and organization policies set on a folder apply to every project beneath it. Grouping environment projects under one folder gives centralized control without granting access project by project.

Question 2Set up a cloud solution environment

A company has an existing Google Workspace domain and wants Google Cloud resources to inherit its existing user identities and groups. Which approach satisfies this requirement with the least administrative overhead?

  1. Use only service accounts for all human access
  2. Issue each employee a personal Gmail account
  3. Attach the domain to an organization node through Cloud Identity or Workspace Correct answer.
  4. Create Cloud Identity users manually for each employee

Explanation

Associating the domain with Cloud Identity or Google Workspace creates an organization node and lets existing directory users and groups be granted IAM roles directly. This avoids duplicate identity stores and keeps group-based access management working as it already does.

Question 3Set up a cloud solution environment

You need to grant a data analyst read access to objects in a single Cloud Storage bucket without giving access to any other bucket in the project. Which IAM approach is most appropriate?

  1. Grant roles/storage.objectViewer on the individual bucket Correct answer.
  2. Grant roles/storage.objectViewer at the project level
  3. Grant roles/viewer on the organization node
  4. Grant roles/storage.admin on the bucket

Explanation

IAM policies can be set on individual buckets, which allows least-privilege access scoped to just that resource. Granting the viewer role on the bucket limits the analyst to reading objects there and nothing else in the project.

Question 4Set up a cloud solution environment

Which tool provides a web-based, interactive environment for writing and running queries and commands against Google Cloud resources from a browser?

  1. Cloud SDK installed locally
  2. Cloud Console mobile app
  3. gcloud CLI in a CI pipeline
  4. Cloud Shell Correct answer.

Explanation

Cloud Shell is a browser-based terminal with the Cloud SDK, language tools, and a persistent home directory already configured and authenticated. It requires no local installation and provides temporary compute for command-line work.

Question 5Set up a cloud solution environment

A team wants to script the creation of a Compute Engine instance so the same configuration can be repeated reliably. Which interface is designed primarily for programmatic, repeatable automation?

  1. The Cloud Monitoring dashboards
  2. The gcloud CLI and client libraries Correct answer.
  3. The Cloud Billing reports page
  4. The Cloud Console web UI

Explanation

The gcloud CLI and client libraries expose Google Cloud APIs in a scriptable form, making them suitable for repeatable, version-controlled automation. Console clicks are manual and harder to reproduce consistently across environments.

Question 6Set up a cloud solution environment

You are creating a new project and must associate it with an existing billing account so that charges are attributed correctly. What is required for the project to use that billing account?

  1. The project creator must have the Billing Account User role on the billing account Correct answer.
  2. The project must have no labels applied
  3. The billing account must be linked to Cloud Shell
  4. The project must be placed directly under the organization node

Explanation

Linking a project to a billing account requires permission on the billing account itself, typically Billing Account User combined with Project Creator. Without that permission the project can be created but cannot be attached to the account for billing.

Question 7Set up a cloud solution environment

Which predefined IAM role is intended for a user who needs to view project configuration and resources but must not be able to change them?

  1. roles/editor
  2. roles/iam.securityAdmin
  3. roles/owner
  4. roles/viewer Correct answer.

Explanation

The Viewer role grants read-only access to resources and configuration within the scope where it is granted. Editor and Owner both include permissions to modify or delete resources, so they violate the read-only requirement.

Question 8Set up a cloud solution environment

An administrator wants to enforce a constraint so that no project in the organization can create external IP addresses on virtual machines. Which mechanism should be used?

  1. A firewall rule applied to each VPC network
  2. An organization policy constraint applied at the organization node Correct answer.
  3. A Cloud Armor security policy
  4. An IAM deny policy on each service account

Explanation

Organization policies are constraints that can be enforced across the hierarchy, and applying them at the organization node covers all descendant projects and folders. This provides centralized, preventive control rather than per-resource configuration.

Question 9Set up a cloud solution environment

A developer needs to deploy resources into a project but should not be able to change IAM policies or delete the project. Which role assignment best follows least privilege?

  1. roles/editor on the project Correct answer.
  2. roles/iam.securityAdmin on the organization
  3. roles/owner on the project
  4. roles/viewer on the project

Explanation

The Editor role allows creating and modifying resources within a project while excluding the access-management and policy powers reserved for Owner. It therefore supports deployment work without granting control over IAM or project deletion.

Question 10Set up a cloud solution environment

You want all new projects created by members of a team to automatically land inside a specific folder. Which control achieves this?

  1. A shared VPC host project
  2. An organization policy constraint that restricts project creation to a folder Correct answer.
  3. A billing account budget alert
  4. A Cloud DNS managed zone

Explanation

Organization policy constraints can restrict where new projects may be created, for example limiting project creation to a designated folder. This enforces placement automatically rather than relying on user discipline.

Question 11Set up a cloud solution environment

A company wants a central networking team to own and manage VPC networks while application teams deploy resources into those shared networks from their own projects. Which feature supports this?

  1. Multiple standalone VPCs per team
  2. VPC peering between every project
  3. Cloud NAT in each project
  4. Shared VPC with a host project and service projects Correct answer.

Explanation

Shared VPC designates a host project that owns the network and subnets, and attaches service projects whose resources use those subnets. IAM on the host project lets the networking team control the network while application teams manage their own resources.

Question 12Set up a cloud solution environment

You must give an external contractor temporary access to a specific Compute Engine instance for two weeks, after which access should expire automatically. Which approach is most appropriate?

  1. Grant a role binding with an IAM condition that sets an expiration time Correct answer.
  2. Create a permanent user account and rely on the contractor to stop using it
  3. Add the contractor to a Google Group with Owner rights
  4. Share the project's service account key

Explanation

IAM conditions allow a role binding to include an expiry timestamp, so the grant stops being effective automatically at the specified time. This avoids manual cleanup and keeps the permission scoped to the intended resource and duration.

Question 13Set up a cloud solution environment

A finance team needs to see cost breakdowns by department and environment. Which practice enables this reporting in Cloud Billing?

  1. Using only predefined IAM roles
  2. Creating one service account per department
  3. Applying consistent labels to resources and enabling label export to billing Correct answer.
  4. Enabling Cloud Audit Logs for all services

Explanation

Labels attached to resources are exported into billing data, allowing costs to be grouped and filtered by label keys such as department or environment. Consistent labeling is what makes the breakdown reliable.

Question 14Set up a cloud solution environment

An administrator wants to review which IAM roles a specific user effectively holds across a project, including inherited grants. Which tool is designed for this analysis?

  1. Cloud Trace
  2. VPC Flow Logs
  3. Policy Troubleshooter or Policy Analyzer Correct answer.
  4. Cloud Profiler

Explanation

Policy Troubleshooter and Policy Analyzer evaluate effective IAM permissions by combining inherited policies from the resource hierarchy. They answer whether a principal has a permission and why, which manual policy reading cannot do reliably.

Question 15Set up a cloud solution environment

A team wants to run commands in Cloud Shell and have custom scripts and configuration persist between sessions. What should they rely on?

  1. The project's Cloud Storage default bucket only
  2. The instance metadata server
  3. The ephemeral /tmp directory
  4. The persistent home directory of five gigabytes Correct answer.

Explanation

Cloud Shell provides a persistent home directory with a fixed storage quota, so files written there survive across sessions. Temporary directories and the underlying VM are reset, so only the home directory is durable.

Question 16Set up a cloud solution environment

You need to create a project non-interactively from a script and capture its project ID for later use. Which command accomplishes this?

  1. gcloud billing accounts list
  2. gcloud projects create my-project --name="My Project" Correct answer.
  3. gcloud compute instances create my-project
  4. gcloud iam roles create my-project

Explanation

The gcloud projects create command provisions a new project and accepts flags for the project ID and display name. Its output can be captured in a script to reference the new project in later commands.

Question 17Set up a cloud solution environment

A company wants a single, centrally managed billing relationship for several departments while still tracking each department's spend separately. Which setup best meets both goals?

  1. Paying through individual credit cards per project
  2. One billing account with projects grouped by department and labeled for reporting Correct answer.
  3. A separate billing account per developer
  4. One project shared by all departments

Explanation

A single billing account centralizes payment and invoicing, while labels and project structure let costs be attributed to each department. This combines administrative simplicity with detailed reporting.

Question 18Set up a cloud solution environment

An auditor must confirm that a specific user cannot delete any Cloud Storage bucket in a project, even though the user is a member of a group that was granted a broad role. Which capability directly answers this?

  1. Cloud Shell quota inspection
  2. Cloud Billing export to BigQuery
  3. Policy Troubleshooter checking the specific permission for the user Correct answer.
  4. VPC Service Controls perimeter listing

Explanation

Policy Troubleshooter evaluates effective access for a principal and permission, accounting for group membership and inherited policies. It can confirm whether the delete permission is actually granted through any path.

Question 19Set up a cloud solution environment

A platform team wants to prevent any project in a folder from using service account keys, while still allowing the same keys in a separate legacy folder. Which design achieves this?

  1. Apply the constraint on each service account individually
  2. Apply the constraint at the organization node with no exceptions
  3. Apply the constraint on the billing account
  4. Apply the constraint on the target folder only Correct answer.

Explanation

Organization policies inherit downward, so setting the constraint on the target folder blocks key creation for its projects while leaving sibling folders unaffected. This scopes the restriction precisely to the intended part of the hierarchy.

Question 20Set up a cloud solution environment

A user reports that they can view a bucket even though no IAM policy on the bucket or its project mentions them. What is the most likely explanation?

  1. The bucket is public and allows allUsers
  2. The user's browser cached the page
  3. The user holds a role granted at a folder or organization ancestor Correct answer.
  4. Cloud CDN served the object

Explanation

IAM policies are inherited from ancestors, so a role granted at a folder or the organization node applies to resources below it even when the resource's own policy is silent. Effective access must always be evaluated across the full hierarchy.

Question 21Set up a cloud solution environment

An organization requires that production projects be unable to reach the public internet except through an approved egress proxy, and this must hold even if project owners try to change it. Which combination enforces the requirement?

  1. Cloud Shell network settings
  2. Firewall rules created by each project owner
  3. An organization policy constraint plus centrally managed firewall rules in a Shared VPC host project Correct answer.
  4. A budget alert on the production billing account

Explanation

Organization policies provide preventive guardrails that project owners cannot override, while centrally managed firewall rules in a Shared VPC host project control actual traffic paths. Combining the two enforces both the configuration restriction and the network behavior.

Question 22Set up a cloud solution environment

A security team wants to know exactly which principal granted a role binding and when the change occurred, for a recent IAM modification. Which log source should they consult?

  1. VPC Flow Logs
  2. Admin Activity audit logs for IAM Correct answer.
  3. Cloud Trace spans
  4. Serial port output

Explanation

Admin Activity audit logs record administrative changes such as IAM policy updates, including the principal that made the change and the timestamp. They are the authoritative source for reconstructing who altered access.

Question 23Set up a cloud solution environment

A team needs to grant a workload running on Compute Engine access to a Cloud Storage bucket without storing long-lived credentials in code. Which approach is recommended?

  1. Download a service account JSON key and embed it in the container image
  2. Attach a service account to the instance and grant it the needed bucket role Correct answer.
  3. Use the user's personal OAuth token in the application
  4. Store the key in a public Cloud Storage bucket

Explanation

Attaching a service account to the instance lets workloads obtain short-lived credentials from the metadata server automatically. Granting that service account only the bucket role keeps access scoped and avoids distributing long-lived keys.

Question 24Set up a cloud solution environment

Which Google Cloud interface allows a user to browse and manage resources graphically across multiple projects from a browser without installing software?

  1. Terraform provider
  2. The gcloud CLI
  3. The Cloud Console Correct answer.
  4. The Cloud Storage client library

Explanation

The Cloud Console is the browser-based graphical interface for viewing and managing resources across projects. It requires no local installation and provides visual navigation of services and settings.

Question 25Set up a cloud solution environment

An organization wants to ensure that when an employee leaves, access to Google Cloud resources is revoked automatically along with their corporate account. Which identity setup provides this?

  1. Local Cloud Identity users created separately from the corporate directory
  2. Shared service account credentials used by employees
  3. A federated identity through Google Workspace or an identity provider Correct answer.
  4. Static API keys distributed to each employee

Explanation

When identities come from a federated directory, disabling the corporate account immediately removes the ability to authenticate to Google Cloud. This centralizes offboarding and avoids orphaned cloud-only accounts.

Question 26Set up a cloud solution environment

Which Google Cloud resource hierarchy node is the direct parent of a project when the project is not placed in any folder?

  1. The billing account
  2. The organization node Correct answer.
  3. The default VPC network
  4. The Cloud Identity group

Explanation

Projects that are not placed inside a folder are attached directly to the organization node, which sits at the root of the hierarchy. Folders are optional containers that can exist between the organization and its projects. Billing accounts and networks are not part of the resource hierarchy of ownership.

Question 27Set up a cloud solution environment

Which tool is designed to let you create and manage Google Cloud resources using declarative configuration files stored in version control?

  1. Cloud Scheduler
  2. Terraform Correct answer.
  3. Cloud Build triggers
  4. Cloud Trace

Explanation

Terraform is an infrastructure-as-code tool that describes resources in declarative configuration files, which can be committed to a repository and applied repeatedly. The other listed services handle scheduling, tracing, and build automation rather than resource provisioning through configuration files.

Question 28Set up a cloud solution environment

Which command-line tool is installed locally and authenticates with your user credentials to run gcloud commands against Google Cloud?

  1. gsutil only
  2. kubectl only
  3. The Cloud Console mobile app
  4. The Google Cloud CLI Correct answer.

Explanation

The Google Cloud CLI provides the gcloud command set and stores credentials from an interactive login so subsequent commands act on your behalf. gsutil and kubectl are narrower tools for storage and Kubernetes respectively. The CLI is the general-purpose local interface.

Question 29Set up a cloud solution environment

What is the primary purpose of a Google Cloud organization node?

  1. To store billing invoices for all departments
  2. To group projects for centralized policy and access control Correct answer.
  3. To provide a shared VPC for every project
  4. To host the virtual machines that run internal services

Explanation

The organization node is created automatically with a Cloud Identity or Workspace domain and acts as the root for centralized IAM and organization policy inheritance. Resources such as VMs, invoices, and networks are managed elsewhere. Central control flows down from this root to folders and projects.

Question 30Set up a cloud solution environment

Which predefined role gives a principal full control over a project's resources, including the ability to manage IAM policy for that project?

  1. roles/browser
  2. roles/editor
  3. roles/owner Correct answer.
  4. roles/viewer

Explanation

The owner role includes every permission of editor plus the ability to manage IAM policies and billing for the project. Editor can modify most resources but cannot change access grants. Viewer and browser are read-oriented roles.

Question 31Set up a cloud solution environment

Which command initializes a new gcloud configuration and sets the active account, project, and default region in one interactive flow?

  1. gcloud auth print-access-token
  2. gcloud components update
  3. gcloud init Correct answer.
  4. gcloud projects list

Explanation

gcloud init walks through authentication, project selection, and default compute region and zone, writing them into a named configuration. The other commands print a token, list projects, or update installed components without establishing defaults.

Question 32Set up a cloud solution environment

A startup wants to begin using Google Cloud with minimal setup and pay only for what it consumes, without a long-term commitment. Which billing arrangement matches this need?

  1. A self-serve account with a Cloud Billing account tied to a payment method Correct answer.
  2. A reseller agreement with prepaid annual invoicing
  3. A committed use contract for three years
  4. An enterprise discount program requiring minimum annual spend

Explanation

A self-serve Cloud Billing account attaches a payment instrument and charges usage as it occurs, which suits small teams exploring the platform. Committed use, reseller, and enterprise programs involve contracts or minimum commitments. Self-serve requires no upfront spend.

Question 33Set up a cloud solution environment

Which interface provides a browser-based graphical view for creating and inspecting resources across multiple projects?

  1. The Cloud Console Correct answer.
  2. The gcloud CLI
  3. The Cloud Storage XML API
  4. The Cloud SQL Auth Proxy

Explanation

The Cloud Console is the web interface where you select a project and manage resources visually. The CLI is text-based, and the other two options are programmatic interfaces for specific services. Graphical browsing across projects is the Console's role.

Question 34Set up a cloud solution environment

You need to grant a data analyst read-only access to BigQuery datasets in a project while ensuring they cannot modify or delete any datasets. Which approach is most appropriate?

  1. Grant roles/owner at the dataset level
  2. Grant roles/bigquery.dataViewer at the project level Correct answer.
  3. Grant roles/bigquery.dataEditor at the project level
  4. Grant roles/bigquery.admin at the dataset level

Explanation

The BigQuery data viewer role provides read access to datasets and their contents without write permissions. Granting it at the project level covers all datasets in the project. Editor and admin roles allow modification, and owner is broader than needed.

Question 35Set up a cloud solution environment

A team wants every new project created under a folder to inherit a specific label automatically. Which mechanism should they use?

  1. An organization policy constraint on labels
  2. A Cloud Scheduler job that labels projects nightly
  3. An IAM condition on the project creator role
  4. A default label configured on the folder so projects inherit it Correct answer.

Explanation

Labels applied to a folder are inherited by projects created inside it, so setting the label on the folder propagates it automatically. Organization policy constraints govern behavior such as allowed locations rather than labels. Scheduled jobs and IAM conditions do not provide automatic label inheritance.

Question 36Set up a cloud solution environment

A developer must run gcloud commands against two different projects frequently and switch between them without re-authenticating. What is the recommended approach?

  1. Log out and log back in with a different account each time
  2. Create two named gcloud configurations and activate the needed one Correct answer.
  3. Reinstall the Cloud CLI for each project
  4. Edit the project ID in each command manually and never store defaults

Explanation

Named configurations store separate account, project, and region settings, and you switch between them with a single activation command. This avoids repeated authentication and manual edits. Reinstalling or logging out repeatedly is unnecessary overhead.

Question 37Set up a cloud solution environment

An administrator wants to require that all Compute Engine instances in a project use only approved machine types. Which control should be applied?

  1. A budget alert on the billing account
  2. An IAM deny policy on compute.instances.create
  3. A custom organization policy constraint restricting machine types Correct answer.
  4. A VPC firewall rule blocking port 22

Explanation

Organization policy provides managed and custom constraints that restrict resource configurations such as allowed machine types across projects. Firewall rules affect network traffic, and budget alerts only notify about spending. IAM deny blocks actions entirely rather than constraining configuration values.

Question 38Set up a cloud solution environment

A company wants to separate production and development resources so that different teams can be granted access at each level. Which structure best supports this?

  1. Place all projects directly under the organization with no folders
  2. Create separate folders for production and development and place projects inside them Correct answer.
  3. Create a single folder and grant every team owner on the organization
  4. Create one project and use labels to separate environments

Explanation

Folders let you group projects by environment and attach IAM policies at the folder level so permissions inherit to all contained projects. Labels are useful for reporting but do not scope access. Broad organization-level grants would violate least privilege.

Question 39Set up a cloud solution environment

A finance analyst needs to view cost data for a project but must not be able to change any resources. Which role assignment meets this requirement?

  1. roles/resourcemanager.projectIamAdmin on the project
  2. roles/billing.viewer on the billing account Correct answer.
  3. roles/editor on the project
  4. roles/owner on the project

Explanation

The billing viewer role grants read access to billing account data such as costs and budgets without any ability to modify cloud resources. Editor and owner confer broad modification rights, and project IAM admin manages access bindings. Read-only cost visibility is exactly what billing viewer provides.

Question 40Set up a cloud solution environment

You are setting up a new environment and want to create a project, enable the Compute Engine API, and create a VM without visiting the Console. Which sequence of tools accomplishes this?

  1. gcloud auth login only, then wait for automatic provisioning
  2. gsutil mb, then gcloud compute instances create
  3. kubectl apply with a project manifest
  4. gcloud projects create, gcloud services enable, gcloud compute instances create Correct answer.

Explanation

The gcloud CLI can create a project, enable a service API, and create an instance in sequence, all from a terminal. gsutil handles storage buckets, and kubectl targets Kubernetes. No step of the CLI automatically provisions resources after login.

Question 41Set up a cloud solution environment

A security policy states that no service account key files may be created in any project. Where should the enforcing constraint be attached for the widest coverage?

  1. On a single service account resource
  2. On the organization node so it inherits to all folders and projects Correct answer.
  3. On each individual project separately
  4. On the billing account

Explanation

Organization policy constraints attached at the organization node are inherited by every folder and project beneath it, giving the broadest enforcement. Attaching per project leaves gaps for new projects. Service accounts and billing accounts are not the right scope for this constraint.

Question 42Set up a cloud solution environment

A team lead wants to see which projects exist under a folder and confirm each project's parent without opening the Console. Which command helps?

  1. gcloud projects list --filter="parent.id:FOLDER_ID" Correct answer.
  2. gcloud compute instances list
  3. gcloud iam roles describe roles/owner
  4. gcloud storage buckets list

Explanation

The projects list command supports filters, and filtering on the parent identifier returns projects whose parent matches the given folder. The other commands list instances, describe a role, or list buckets and reveal nothing about project parentage.

Question 43Set up a cloud solution environment

An organization wants new employees to receive access to Google Cloud resources automatically based on their department, using their existing corporate identity. Which approach fits best?

  1. Share a single service account key among all employees
  2. Create local Google accounts for each employee manually
  3. Email each employee an access token
  4. Use Cloud Identity or Workspace groups and grant roles to the groups Correct answer.

Explanation

When identities come from Cloud Identity or Workspace, group membership can drive role grants so that adding a user to a department group automatically confers the group's permissions. Sharing keys or tokens violates accountability. Manual local accounts do not scale or integrate with corporate identity.

Question 44Set up a cloud solution environment

A platform engineer wants to grant a CI/CD pipeline permission to deploy to a project without giving it the ability to change IAM policy. Which role is appropriate?

  1. roles/owner
  2. roles/editor Correct answer.
  3. roles/viewer
  4. roles/iam.securityAdmin

Explanation

The editor role permits creating and modifying most resources, including deployments, but does not include permission to manage IAM policy. Owner adds IAM control, security admin manages access, and viewer cannot deploy. Editor matches the deployment need.

Question 45Set up a cloud solution environment

A company needs to ensure that resources for a regulated workload are created only in a specific region. Which mechanism enforces this?

  1. A resource location organization policy constraint Correct answer.
  2. A Cloud CDN configuration
  3. A Cloud Armor security policy
  4. A quota increase request

Explanation

Organization policy includes a location constraint that restricts where resources can be created, which is the standard way to enforce data residency. Cloud Armor and CDN govern traffic handling, and quota requests change capacity limits rather than allowed locations.

Question 46Set up a cloud solution environment

An administrator needs to audit every configuration change made to organization policies across the hierarchy. Which Google Cloud capability should they rely on?

  1. Cloud Audit Logs for admin activity Correct answer.
  2. VPC flow logs
  3. Cloud Trace spans
  4. Cloud Monitoring uptime checks

Explanation

Admin activity audit logs record changes to resource configurations, including organization policy modifications, and identify who made each change. Flow logs capture network traffic, uptime checks test availability, and trace spans measure request latency. Auditing configuration changes requires audit logs.

Question 47Set up a cloud solution environment

A multinational company wants a single organization node but must keep European and American projects under separate administrative control with different inherited policies. What design achieves this?

  1. A single project containing all regional resources
  2. Separate billing accounts with no folders
  3. One flat set of projects directly under the organization with shared policies
  4. Top-level folders per region, each with its own policies and delegated administrators Correct answer.

Explanation

Top-level folders beneath the organization let each region inherit distinct policies and delegate administration to regional teams while retaining one organization node. A flat structure shares one policy set, and a single project cannot separate administrative control. Billing accounts do not govern policy inheritance.

Question 48Set up a cloud solution environment

A team reports that a member can delete resources in a project even though the project-level policy grants only viewer. What is the most likely explanation?

  1. Audit logs are disabled for the project
  2. The project has no billing account attached
  3. The member holds a broader role granted at a parent folder or the organization Correct answer.
  4. The viewer role always includes delete permissions

Explanation

IAM policies are additive and inherited, so a broader role granted higher in the hierarchy overrides the appearance of a restrictive project-level grant. The viewer role never includes delete permissions. Audit logging and billing attachment do not grant permissions.

Question 49Set up a cloud solution environment

An organization wants to guarantee that a specific security group can always read audit logs even if a project-level policy accidentally denies it. Which feature should be used?

  1. An IAM deny policy applied at the organization level Correct answer.
  2. A VPC Service Controls perimeter
  3. A standard allow binding on each project
  4. A budget alert configured for the project

Explanation

IAM deny policies take precedence over allow policies, so a deny at the organization level blocks access regardless of project-level allows. Allow bindings can be overridden and offer no guarantee. Budget alerts and service perimeters address cost and network boundaries rather than permission precedence.

Question 50Set up a cloud solution environment

A company must prove that projects cannot be created outside approved folders. Which combination most directly enforces this?

  1. A firewall rule plus a Cloud Scheduler job
  2. An organization policy constraint on resource locations plus a role that limits project creation to specific folders Correct answer.
  3. A shared VPC plus a service account key rotation policy
  4. A budget alert plus a label on the organization

Explanation

A location constraint restricts where resources, including projects, may be created, and scoping the project creator role to approved folders limits where creation can occur. Budget alerts, labels, firewall rules, and key rotation address cost, organization, network traffic, and credentials rather than project placement.