I85PREP
⌘ K
GCP ACE study materials
GCP ACE study resources

GCP ACE practice questions

One question at a time. Build your GCP ACE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Setting up a cloud solution environment

Which sequence lists Google Cloud resource hierarchy levels from broadest scope to narrowest scope?

  1. Folder, organization, project, resource
  2. Organization, folder, project, resource Correct answer.
  3. Project, folder, organization, resource
  4. Organization, project, folder, resource

Explanation

Google Cloud arranges resources in a tree whose root is the organization, followed by folders, then projects, then individual resources such as VMs or buckets. Policy applied higher in the tree is inherited by everything below it.

Question 2Setting up a cloud solution environment

A team has created a new project but has not linked any billing account to it. What is the result?

  1. The project cannot be created until a billing account is attached.
  2. All APIs in the project are permanently disabled.
  3. Resources run normally and charges go to the organization's default billing account.
  4. Billable services such as Compute Engine cannot be used until a billing account is linked. Correct answer.

Explanation

A project can exist without billing, and free operations such as creating folders or using certain always-free quotas still work, but any billable service requires a linked billing account. Google Cloud does not silently fall back to another billing account.

Question 3Setting up a cloud solution environment

You create a Cloud Billing budget of $500 with an alert threshold set at 100%. Actual spend reaches $650. What happens?

  1. Creation of new resources is blocked until the budget is increased.
  2. Compute Engine instances are stopped automatically.
  3. The billing account is closed and all services are suspended.
  4. Alert recipients are notified by email, and the resources keep running. Correct answer.

Explanation

Budgets in Cloud Billing are monitoring and alerting tools only; they send notifications to the configured recipients when thresholds are crossed. They never cap spending or disable resources unless you separately build automation such as Pub/Sub-triggered Cloud Functions.

Question 4Setting up a cloud solution environment

An IAM role is granted to a group at the folder level. Which resources does that grant affect?

  1. Only the projects directly inside the folder, not the resources within them.
  2. Only the folder itself.
  3. Only projects created after the grant was made.
  4. All projects and resources nested under that folder. Correct answer.

Explanation

IAM policies are inherited down the resource hierarchy, so a binding on a folder applies to every project and resource beneath it. A more specific policy can add permissions but cannot remove an inherited grant.

Question 5Setting up a cloud solution environment

Which command makes my-project the default project for subsequent gcloud commands in the active configuration?

  1. gcloud config set project my-project Correct answer.
  2. gcloud config set compute/project my-project
  3. gcloud init my-project
  4. gcloud projects set my-project

Explanation

The gcloud config set command writes a property into the active configuration, and the property for the default project is 'project'. The change applies to all later commands run with that configuration until it is changed again.

Question 6Setting up a cloud solution environment

Which statement about Cloud Shell is accurate?

  1. The home directory provides unlimited persistent storage.
  2. Cloud Shell can only be used after installing the Cloud SDK locally.
  3. The virtual machine is ephemeral and recreated per session, while files in the home directory persist within a 5 GB limit. Correct answer.
  4. Files written to the home directory are deleted when the session ends.

Explanation

Each Cloud Shell session runs on an ephemeral Compute Engine VM with the Cloud SDK, gcloud, and common tools preinstalled. A separate persistent disk keeps the home directory across sessions up to 5 GB.

Question 7Setting up a cloud solution environment

Which command enables the Compute Engine API on the currently configured project?

  1. gcloud services enable compute.googleapis.com Correct answer.
  2. gcloud services activate compute-googleapis-com
  3. gcloud api-services enable compute
  4. gcloud compute enable api

Explanation

Service enablement is handled by the services command group, and each API is referenced by its service name such as compute.googleapis.com. The command acts on the project in the active configuration unless --project is supplied.

Question 8Setting up a cloud solution environment

Which command creates a project named acme-prod inside the folder whose ID is 123456789012?

  1. gcloud projects create acme-prod --organization=123456789012
  2. gcloud resource-manager projects create acme-prod --folder=123456789012
  3. gcloud projects create acme-prod --parent-folder=123456789012
  4. gcloud projects create acme-prod --folder=123456789012 Correct answer.

Explanation

The projects create command accepts a --folder flag whose value is the numeric folder ID, which places the new project under that folder. Using --organization instead would place the project directly under the organization.

Question 9Setting up a cloud solution environment

An organization must ensure that no project can create resources outside approved European locations. Which control accomplishes this?

  1. Apply the constraints/gcp.resourceLocations organization policy with allowed values limited to European locations. Correct answer.
  2. Grant roles/editor only to users who are based in Europe.
  3. Create a Cloud Billing budget filtered to non-European regions.
  4. Set the default compute region to europe-west1 in every project.

Explanation

Organization policies are enforced by Google Cloud at the API layer and define which locations may be used for resource creation. Setting a default region only changes where new resources land when no region is specified, so it does not prevent someone from choosing another location.

Question 10Setting up a cloud solution environment

A deployment fails with a quota exceeded error for CPUs in us-central1. What is the appropriate response?

  1. Request a quota increase for the project in the Quotas page (or with gcloud) and wait for adjustment. Correct answer.
  2. Move the deployment to a different zone without checking available quota.
  3. Re-run the deployment several times so the quota adjusts automatically.
  4. Delete the project and recreate it, because new projects receive fresh quota.

Explanation

CPU quota is an allocation limit that must be raised through a quota increase request, which is then reviewed and granted for the project. Many quotas are per project per region, so changing zones or projects is not a substitute for a valid increase.

Question 11Setting up a cloud solution environment

Which statement correctly distinguishes labels from tags in Google Cloud?

  1. Labels are key-value pairs used for organizing and cost analysis, while tags drive behaviour such as firewall rules and conditional IAM. Correct answer.
  2. Tags are key-value pairs used for billing analysis, while labels are used for firewall rules.
  3. Labels can be attached only at the organization level.
  4. Tags appear in billing exports while labels never do.

Explanation

Labels are metadata key-value pairs useful for inventory, filtering, and splitting billing reports. Tags are named resources with their own IAM and are referenced by controls such as firewall rules and IAM conditions.

Question 12Setting up a cloud solution environment

A developer wants a Python script running on their laptop to call a Google Cloud API with their own user identity, without downloading a service account key. Which command should they run first?

  1. gcloud auth login
  2. gcloud auth application-default login Correct answer.
  3. gcloud auth activate-service-account
  4. gcloud config set auth/impersonate_service_account

Explanation

Client libraries look for Application Default Credentials, which gcloud auth application-default login writes to a local well-known file using the developer's user identity. gcloud auth login only authenticates the gcloud CLI itself and does not create ADC for library code.

Question 13Setting up a cloud solution environment

A CI pipeline running outside Google Cloud must act as a service account, and the security team forbids long-lived key files. Which approach is recommended?

  1. Grant the pipeline identity roles/iam.serviceAccountTokenCreator on the service account and use impersonation. Correct answer.
  2. Add the pipeline identity to the service account's IAM policy with roles/owner.
  3. Attach the default Compute Engine service account to the pipeline runners.
  4. Generate a JSON key for the service account and store it as a pipeline secret.

Explanation

Service account impersonation produces short-lived credentials and requires the caller to hold the Token Creator role on the target service account. This removes the need to create and distribute key files that can be leaked or forgotten.

Question 14Setting up a cloud solution environment

You want to run detailed SQL analysis of daily cost by project and by label. What should you enable?

  1. The Cloud Billing API called with an API key.
  2. Cloud Billing export of cost data to a BigQuery dataset. Correct answer.
  3. A Cloud Logging sink that filters billing log entries.
  4. Cloud Billing budgets with Pub/Sub notifications.

Explanation

Billing export writes detailed usage and cost records, including label and project attribution, into a BigQuery dataset where they can be queried. Budgets and Pub/Sub notifications report thresholds rather than detailed line-item costs.

Question 15Setting up a cloud solution environment

What must exist before an organization resource for the domain example.com can be created in Google Cloud?

  1. At least one project already owned by the domain administrator.
  2. A billing account whose address matches the domain registration.
  3. A Cloud Identity or Google Workspace account that has verified ownership of the domain. Correct answer.
  4. A folder named after the domain.

Explanation

The organization resource is created automatically when a domain verified through Cloud Identity or Google Workspace is associated with Google Cloud. Without that verified domain there is no organization node, and projects exist in a 'No organization' state.

Question 16Setting up a cloud solution environment

Which predefined role gives full control over all resources in a project, including the ability to grant roles to other principals?

  1. roles/owner Correct answer.
  2. roles/viewer
  3. roles/editor
  4. roles/resourcemanager.projectCreator

Explanation

The basic Owner role includes all Editor permissions plus the ability to manage IAM policies and billing for the project. Editor can modify resources but cannot grant access to others.

Question 17Setting up a cloud solution environment

An administrator deletes a project that still contains data. What happens to that project?

  1. It remains fully active for 7 days and continues to be billed normally.
  2. Deletion is immediate and irreversible.
  3. It is shut down immediately and can be restored within a 30-day window before permanent deletion. Correct answer.
  4. It is moved into a Trash folder for 90 days.

Explanation

Deleting a project immediately shuts it down, so its services stop and API calls fail, but the project enters a pending-deletion period of roughly 30 days. During that window an authorized user can restore it; afterwards it is permanently removed.

Question 18Setting up a cloud solution environment

Which statement about a Google Cloud project ID is true?

  1. It must be unique only within its organization.
  2. It is a display name that may contain spaces.
  3. It can be renamed later from the project settings page.
  4. It is globally unique and cannot be changed after creation. Correct answer.

Explanation

The project ID is used in API calls and resource names, so it must be unique across all of Google Cloud and is immutable. The project name and labels can be changed freely, but the ID cannot.

Question 19Setting up a cloud solution environment

An engineer regularly switches between dev, staging, and production projects, each with a different account and default region. Which feature should be used?

  1. Setting the project before each command and leaving the account unchanged.
  2. Reinstalling the Cloud SDK whenever the environment changes.
  3. Running the Cloud SDK as a different operating system user for each environment.
  4. Named gcloud configurations that store account, project, and region per environment. Correct answer.

Explanation

A gcloud configuration bundles properties such as core/account, core/project, and compute/region together, and named configurations can be activated or invoked per command. This keeps credentials and defaults separate for each environment.

Question 20Setting up a cloud solution environment

A deny policy on a folder denies storage.objects.delete for a group, while a project-level allow policy grants the same group roles/storage.admin. What is the effective outcome?

  1. The group can delete objects because the project allow policy overrides the folder deny policy.
  2. The outcome depends on the order in which the bindings were created.
  3. The group can delete objects because deny policies apply only to service accounts.
  4. The group cannot delete objects, because deny policies take precedence over allow policies. Correct answer.

Explanation

IAM deny policies are evaluated before allow policies, so an explicit deny blocks the action even where an allow binding exists lower in the hierarchy. This makes deny policies a reliable guardrail against overly broad grants.

Question 21Setting up a cloud solution environment

Which command sets the default zone used by gcloud compute commands in the active configuration?

  1. gcloud config set compute/zone us-central1-a Correct answer.
  2. gcloud compute config set default-zone us-central1-a
  3. gcloud config set zone us-central1-a
  4. gcloud compute zones set us-central1-a

Explanation

Default location properties live under the compute section of the gcloud configuration, so the property name is compute/zone. Once set, compute commands that need a zone use this value unless --zone is supplied.

Question 22Setting up a cloud solution environment

Which command creates a folder named Prod directly under the organization with ID 123456789012?

  1. gcloud organizations create-folder Prod
  2. gcloud resource-manager folders create --display-name=Prod --organization=123456789012 Correct answer.
  3. gcloud resource-manager folders create --name=Prod --parent=123456789012
  4. gcloud projects create --folder=Prod

Explanation

Folders are created with the resource-manager folders create command, using --display-name for the human-readable name and --organization or --folder for the parent. The parent must be referenced by the numeric organization or folder ID.

Question 23Setting up a cloud solution environment

Security and billing notifications must reach a small set of named people rather than everyone holding a broad role. What should be configured?

  1. Cloud Audit Logs sinks that publish to Pub/Sub.
  2. An organization policy constraint restricting contact email domains.
  3. Essential Contacts with the relevant notification categories on the resource. Correct answer.
  4. A Google Group bound to roles/owner at the organization.

Explanation

Essential Contacts let you designate individuals per notification category, such as SECURITY, BILLING, and TECHNICAL, at the organization, folder, or project level. Google then sends those notifications to the designated contacts instead of to every principal with a broad role.

Question 24Setting up a cloud solution environment

An engineer must be able to associate new projects with an existing billing account but must not change payment methods or manage budgets. Which role should be granted?

  1. roles/billing.user Correct answer.
  2. roles/editor
  3. roles/billing.viewer
  4. roles/billing.admin

Explanation

Billing Account User allows a principal to link projects to a billing account without granting control over payment instruments or budgets. Administrator adds full control of the billing account, while Viewer is read-only and cannot link projects.

Question 25Setting up a cloud solution environment

Which statement describes the default Compute Engine service account created in every project and a recommended practice for it?

  1. It holds Owner on the organization but no project-level access.
  2. It has no permissions until an administrator binds a role to it.
  3. It can be used only from resources inside Google Cloud networks.
  4. It receives the Editor role on the project by default, and it should be replaced by a least-privilege service account. Correct answer.

Explanation

The default Compute Engine service account is granted Editor on its project, which is broader than most workloads require. Best practice is to create dedicated service accounts with narrow roles and to disable or restrict the default account.

Question 26Setting up a cloud solution environment

A team has just created a new Google Cloud project and wants to launch Compute Engine virtual machines in it. What must be associated with the project before billable resources can be created?

  1. A Cloud Identity domain
  2. A Shared VPC host project
  3. A Cloud Billing account Correct answer.
  4. An organization policy

Explanation

Paid Google Cloud services require the project to be linked to an active Cloud Billing account; without that link, resource creation attempts fail with a billing-related error. Identity domains, shared networking, and governance policies are optional and unrelated to the ability to incur charges.

Question 27Setting up a cloud solution environment

An engineer already has the Cloud SDK installed on a workstation and needs to add the kubectl command-line tool to that installation. Which command should be used?

  1. gcloud components install kubectl Correct answer.
  2. gcloud components update kubectl
  3. gcloud install kubectl
  4. gcloud sdk add kubectl

Explanation

Optional tools such as kubectl are distributed as Cloud SDK components and are added with the components install subcommand of gcloud. The components update subcommand only refreshes components that are already present.

Question 28Setting up a cloud solution environment

Which resource type in the Google Cloud resource hierarchy can directly contain both projects and additional resources of its own type?

  1. Service account
  2. Billing account
  3. Organization
  4. Folder Correct answer.

Explanation

Folders are grouping nodes that may contain projects as well as other folders, which is how multi-level hierarchies are built below the organization. The organization node sits above folders and cannot contain another organization, while billing and service accounts are not part of the resource containment hierarchy.

Question 29Setting up a cloud solution environment

Which project identifier is assigned by Google, is unique across all of Google Cloud, and is never reused, even if the project is deleted?

  1. Project name
  2. Project ID
  3. Project number Correct answer.
  4. Project label

Explanation

The project number is generated automatically when the project is created and is never reassigned, which makes it a stable identifier for billing and support purposes. The project ID is also unique but is chosen by the creator, while names and labels are user-controlled metadata that can be changed or duplicated.

Question 30Setting up a cloud solution environment

An administrator grants roles/storage.objectViewer to a group on a folder. A project inside that folder has no IAM binding mentioning the group. What access do group members have to Cloud Storage objects in that project?

  1. Read-only access only after an administrator copies the binding into the project
  2. Full control, because folder-level grants are expanded into basic roles at the project
  3. Read-only access, because allow policies are inherited down the resource hierarchy Correct answer.
  4. No access, because the project has no matching binding of its own

Explanation

IAM allow policies are inherited, so a role granted on a folder applies to every project and resource beneath it, and effective permissions are the union of all bindings along the ancestry path. Copying bindings into children is unnecessary and does not change the effective result.

Question 31Setting up a cloud solution environment

A team configures a Cloud Billing budget of $1,000 per month with alert thresholds at 50%, 90%, and 100%, scoped to one project. Actual spend for the month reaches $1,200. What is the outcome?

  1. Alert notifications are sent and resource usage continues unchanged Correct answer.
  2. The project is detached from its billing account once the threshold is crossed
  3. The budget amount is raised automatically to cover the overage
  4. Resources in the project are stopped until the next billing cycle begins

Explanation

A Cloud Billing budget is a monitoring construct: it triggers notifications when actual or forecast spend crosses configured thresholds but does not block, throttle, or modify resource usage. Stopping spend requires separate mechanisms such as quota limits or programmatic responses to the alerts.

Question 32Setting up a cloud solution environment

An organization must prevent any IAM policy in its hierarchy from granting access to identities outside its own domain. Which organization policy constraint should be enforced?

  1. constraints/iam.allowedPolicyMemberDomains Correct answer.
  2. constraints/iam.disableServiceAccountKeyCreation
  3. constraints/gcp.resourceLocations
  4. constraints/compute.vmExternalIpAccess

Explanation

The allowedPolicyMemberDomains constraint restricts the set of domains from which principals may appear in IAM allow policies, which is the supported way to enforce domain-restricted sharing. The other constraints govern key creation, external IP usage, and resource locations rather than principal identity.

Question 33Setting up a cloud solution environment

An engineer needs a machine-readable list of every project in the current organization whose project ID begins with prod-. Which command accomplishes this?

  1. gcloud projects list --format=json --prefix=prod-
  2. gcloud projects describe prod-* --format=json
  3. gcloud projects list --filter="projectId:prod-*" --format=json Correct answer.
  4. gcloud organizations list --filter="id:prod-*" --format=json

Explanation

The list verb accepts a --filter expression that can match a substring of the projectId field, and --format=json returns structured output suitable for scripts. describe operates on exactly one resource identifier and cannot expand a pattern.

Question 34Setting up a cloud solution environment

A security team needs a durable record of every configuration change made to resources in a project, available from the moment the project was created. Which log type satisfies this requirement by default?

  1. Admin Activity audit logs Correct answer.
  2. VPC Flow Logs
  3. Access Transparency logs
  4. Data Access audit logs

Explanation

Admin Activity audit logs record metadata-changing operations such as resource creation, updates, and deletions, and they are enabled for every project without any configuration. Data Access logs, by contrast, must be explicitly enabled and are typically higher volume.

Question 35Setting up a cloud solution environment

An engineer who can create Compute Engine instances receives PERMISSION_DENIED on iam.serviceAccounts.actAs when attaching an existing user-managed service account to a new VM. Which role should be granted on that service account?

  1. roles/iam.serviceAccountKeyAdmin
  2. roles/iam.serviceAccountTokenCreator
  3. roles/iam.serviceAccountUser Correct answer.
  4. roles/iam.workloadIdentityUser

Explanation

Attaching a service account to a resource is governed by the actAs permission, which is contained in the Service Account User role. Key administration and token creation grant different capabilities and do not permit attaching the identity to a VM.

Question 36Setting up a cloud solution environment

A contractor should hold roles/browser on a project only until the last day of the month, after which the access must lapse with no further administrator action. Which approach meets this requirement?

  1. Create a custom role with the same permissions and delete the custom role at month end
  2. Add an IAM condition with an expiration timestamp to the role binding Correct answer.
  3. Grant the role on the organization node and revoke it manually at month end
  4. Add the contractor to a Google Group and remove the group membership later

Explanation

IAM Conditions support time-based expressions, so a binding can be configured to stop granting the role after a specified timestamp without any follow-up work. The alternatives either grant broader access than needed or depend on a manual step that may be forgotten.

Question 37Setting up a cloud solution environment

Which command initializes a fresh Cloud SDK installation by authorizing the user, letting them choose or create a configuration, and setting a default project and region?

  1. gcloud components update
  2. gcloud init Correct answer.
  3. gcloud config set project
  4. gcloud auth login

Explanation

gcloud init is the guided setup that performs authorization, configuration selection or creation, and default property selection in one flow. The other commands perform only one narrow part of that setup and assume prerequisites already exist.

Question 38Setting up a cloud solution environment

An administrator deletes a folder that contains two projects and one nested folder. What is the result?

  1. The folder becomes read-only and its contents are preserved for 30 days
  2. The operation fails until every contained project is deleted first
  3. The folder is deleted and its projects are moved up to the organization root
  4. The folder is deleted, and the projects and nested folder inside it are also deleted Correct answer.

Explanation

Deleting a folder is a cascading operation: every folder and project beneath it is deleted along with it, and the affected projects enter pending deletion. Administrators must therefore confirm contents before removing a folder.

Question 39Setting up a cloud solution environment

An organization node enforces constraints/compute.vmExternalIpAccess with a deny-all list, and a project owner then adds that project to an allow list for the same constraint in a project-level policy. What is the effective behavior for the project?

  1. External IPs are allowed, because the project-level policy is more specific
  2. External IPs remain denied, because a child policy cannot loosen an enforced ancestor constraint Correct answer.
  3. External IPs are allowed, but only for instances created by the project owner
  4. The project-level policy is rejected when the administrator attempts to save it

Explanation

Organization policies are inherited, and a policy enforced on an ancestor resource continues to apply to all descendants; child resources can tighten restrictions but cannot relax what an ancestor enforces. The effective result is therefore the stricter of the policies in the ancestry path.

Question 40Setting up a cloud solution environment

A company needs a custom role that combines permissions from several services and that can be granted on any project in the organization. Where must the custom role be defined?

  1. At the organization level, so it can be granted on all descendant resources Correct answer.
  2. Separately in each project, because custom roles are always project-scoped
  3. On the billing account that pays for those projects
  4. Inside a folder, which automatically propagates the role to its projects

Explanation

Custom roles can be created at the organization level or at the project level; only an organization-level custom role can be granted on any project, folder, or other resource in that organization. Project-level definitions exist but restrict where the role may be bound.

Question 41Planning and configuring a cloud solution

Which resource is the top-level node of the Google Cloud resource hierarchy for an organization?

  1. A billing account
  2. A service account
  3. A project
  4. The organization resource Correct answer.

Explanation

The resource hierarchy is organization, then folders, then projects, then the resources inside projects. The organization node represents the company and is the root from which all folders and projects descend.

Question 42Planning and configuring a cloud solution

You need to group Compute Engine instances by cost center so the finance team can filter costs in billing reports. What should you use?

  1. Network tags on each instance
  2. A separate project for each instance
  3. Labels on each instance Correct answer.
  4. An instance name prefix per cost center

Explanation

Labels are key-value pairs that are exported with billing data, so costs can be filtered and grouped by label in billing reports and BigQuery exports. Tags are for networking, and names are not a supported cost filter.

Question 43Planning and configuring a cloud solution

Which statement about Compute Engine zones is accurate?

  1. Zones share one power source
  2. A region contains one zone
  3. Each zone spans three regions and one network
  4. Zones are isolated failure domains Correct answer.

Explanation

A region is a collection of independent zones with separate power, cooling, and networking, so an outage in one zone does not affect the others. Deploying across zones protects an application from a single-zone failure.

Question 44Planning and configuring a cloud solution

Which resource must be linked to a project before most billable Google Cloud services can be used?

  1. A Cloud DNS managed zone
  2. An organization policy
  3. A service account
  4. A billing account Correct answer.

Explanation

A project needs an active billing account attached before it can consume billable services such as Compute Engine or Cloud SQL. Projects without billing can only use services and quotas that are free of charge.

Question 45Planning and configuring a cloud solution

Virtual machine creation in a new region fails with a RESOURCE_EXHAUSTED error mentioning a limit. What is the most likely cause?

  1. The boot image has been deprecated
  2. The VPC has no firewall rule allowing SSH
  3. The service account lacks the Compute Admin role
  4. A regional CPU quota is too low Correct answer.

Explanation

Quota limits are enforced per project, per region, and per resource type, and exceeding them returns RESOURCE_EXHAUSTED. The fix is to request a quota increase in that region or choose another region.

Question 46Planning and configuring a cloud solution

Which Cloud Storage class is intended for data accessed less than once per month and has a 30-day minimum storage duration?

  1. Nearline Correct answer.
  2. Standard
  3. Archive
  4. Coldline

Explanation

Nearline is the low-frequency class with a 30-day minimum storage duration and lower storage cost than Standard. Coldline and Archive have longer minimum durations of 90 and 365 days respectively.

Question 47Planning and configuring a cloud solution

A batch job can tolerate interruptions and will finish within a few hours. Which Compute Engine purchasing option gives the lowest cost?

  1. Spot VMs Correct answer.
  2. Custom machine types
  3. Reserved sole-tenant nodes
  4. Committed use discounts

Explanation

Spot VMs use spare capacity at a large discount and can be reclaimed with 30 seconds' notice, which suits fault-tolerant batch work. Sole tenancy and committed use discounts target different requirements.

Question 48Planning and configuring a cloud solution

A service account must only read objects in a Cloud Storage bucket and change nothing. Which role should be granted?

  1. roles/storage.objectViewer Correct answer.
  2. roles/storage.objectCreator
  3. roles/storage.admin
  4. roles/iam.securityAdmin

Explanation

roles/storage.objectViewer grants read-only access to objects and their metadata, matching least privilege for a read-only consumer. Broader or write-oriented roles would exceed the stated requirement.

Question 49Planning and configuring a cloud solution

A central networking team must own and manage subnets while application teams deploy their own resources into those subnets. Which design fits?

  1. Shared VPC with a host project Correct answer.
  2. A separate VPC per team joined by Cloud VPN
  3. Cloud NAT deployed in each team project
  4. VPC Network Peering between the team projects

Explanation

In Shared VPC the host project owns the VPC network and subnets, and service projects attach to it, so the network team controls IP space while app teams create resources. This centralizes network administration without duplicating VPCs.

Question 50Planning and configuring a cloud solution

A relational workload must scale horizontally across regions and provide 99.999% availability for transactions. Which database should be chosen?

  1. Cloud Spanner Correct answer.
  2. Firestore in Datastore mode
  3. Cloud Bigtable
  4. Cloud SQL for PostgreSQL

Explanation

Cloud Spanner is a globally distributed relational database with horizontal scaling and a 99.999% SLA for multi-region configurations. Cloud SQL is regional and does not scale writes horizontally.