Hard — ACE Practice Quiz

Question 1

Your company is a Google Cloud reseller managing workloads for several independent client organizations. Finance requires that each client's charges appear on a separate invoice while all invoices roll up under your company's single payments profile for consolidated payment. Which approach should you use?

Accepted Answer

Create a separate Cloud Billing subaccount for each client under your master billing account, then link each client's projects to their subaccount.

Answer

Create one billing account and use budget alerts with per-client labels to split the charges at invoice time.

Answer

Create a completely separate payments profile and billing account for each client so invoices are fully isolated.

Answer

Link all client projects to a single billing account and use BigQuery billing export to generate separate reports per client.

Question 2

Your company has one Cloud Billing account that pays for all Google Cloud usage. The finance team wants each of the three business units to see and manage its own subset of projects and spending, while the overall payment and invoicing must remain centralized under the single master billing account. What should you do to give each business unit a view into and control over only its own projects' costs, without creating separate paid invoices?

Accepted Answer

Group each business unit's projects into folders, then grant each unit the Billing Account Viewer role on the master billing account so they can filter reports by folder.

Answer

Create a separate self-serve Cloud Billing account for each business unit and link that unit's projects to it.

Answer

Grant each business unit the Billing Account Administrator role on the single master billing account and rely on project-level filtering.

Answer

Use budgets and alerts scoped to each business unit's projects and share Cloud Monitoring dashboards with the respective teams.

Question 3

Your team runs a payment API on Cloud Run and has defined a Cloud Monitoring service with a 99.9% availability SLO over a rolling 28-day window. On-call engineers complain they receive too many alerts for tiny, temporary error blips that never threaten the monthly target, yet they still want to be paged quickly when a real outage is rapidly consuming the error budget. Which Cloud Monitoring feature should you configure to meet both needs?

Accepted Answer

An SLO burn-rate alerting policy that pages only when the error budget is being consumed faster than a defined threshold over a lookback window

Answer

A metric-threshold alerting policy that fires whenever the request error rate exceeds 0.1% for 1 minute

Answer

An uptime check against the Cloud Run URL with a notification channel to the on-call PagerDuty service

Answer

A log-based metric counting 5xx responses with an alert on every non-zero value

Question 4

Your organization must ensure that no principal — regardless of any allow role they hold — can delete Cloud Storage buckets anywhere in the 'production' folder. Several project owners already have roles like roles/owner and roles/storage.admin that include the storage.buckets.delete permission. You want a solution that enforces this restriction centrally and takes precedence over existing allow grants. What should you do?

Accepted Answer

Create an IAM deny policy attached to the 'production' folder that denies the storage.buckets.delete permission for all principals.

Answer

Remove roles/owner and roles/storage.admin from every project owner in the folder and replace them with a custom role that omits storage.buckets.delete.

Answer

Add an IAM allow policy at the folder level granting roles/storage.objectViewer to all principals.

Answer

Create an organization policy constraint that restricts the storage.googleapis.com service in the 'production' folder.

Question 5

A Compute Engine VM was created with the default service account and the access scope set to 'Allow default access'. The application on the VM needs to write objects to a Cloud Storage bucket, but writes fail with a permission error even though the service account has been granted the Storage Object Admin IAM role at the project level. What is the most likely cause, and how should you fix it?

Accepted Answer

The default access scope does not include full storage read/write; stop the VM and change its access scope to include the Cloud Platform scope (or a storage-read-write scope), then restart it.

Answer

IAM roles cannot be granted at the project level for storage; re-grant Storage Object Admin directly on the bucket.

Answer

The default service account must be replaced with a user-managed service account before any IAM role takes effect.

Answer

Access scopes are deprecated and ignored; the issue is a missing firewall rule blocking outbound HTTPS to storage.googleapis.com.

Question 6

A Compute Engine VM runs a data-processing job that must write objects to a Cloud Storage bucket. The VM uses a custom service account that has been granted the roles/storage.objectAdmin IAM role on the bucket. However, the job fails with a 403 error when attempting to write objects. You inspect the VM and confirm the service account is correctly attached. What is the MOST likely cause of the failure?

Accepted Answer

The VM's access scopes do not include storage write access, so the token is limited despite the IAM role.

Answer

The roles/storage.objectAdmin role does not include permission to write objects and must be replaced with roles/storage.admin.

Answer

IAM roles granted at the bucket level are not honored; the role must be granted at the project level instead.

Answer

Custom service accounts cannot be used with Compute Engine VMs and must be replaced with the default service account.

Question 7

A Compute Engine instance runs an application that must read objects from a Cloud Storage bucket. The instance uses the default Compute Engine service account, which already has the 'Storage Object Viewer' IAM role granted at the project level. However, the application receives a 403 permission error when calling the Cloud Storage API. You confirm the IAM binding is correct. What is the most likely cause and how should you fix it without recreating the instance?

Accepted Answer

The instance's access scopes do not include storage access; stop the VM and update the access scopes to allow Cloud Storage.

Answer

The service account key has expired; generate a new service-account key and place it on the instance.

Answer

The IAM role must be granted at the bucket level instead of the project level; re-grant it directly on the bucket.

Answer

The Cloud Storage API is disabled in the project; enable the API and the call will succeed immediately.