GCP ACE Setting up a cloud solution environment: 61 practice questions

12 of the 61 Setting up a cloud solution environment questions in the Certsqill GCP ACE bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for GCP ACE? Take the free 5-min readiness check →

1. A Google Cloud Project: What is the most fundamental unit of organization you should create first?

1. A Google Cloud Project ✓

   Correct. A Google Cloud Project is the fundamental organizing unit in GCP. It provides a logical boundary for resources, enables separate billing, and controls access via IAM. Every GCP resource must belong to a project.
2. A Google Cloud Folder

   Incorrect. Folders are used to group projects within an organization for policy inheritance and organizational hierarchy, but resources are not deployed directly into folders — they belong to projects.
3. A Google Cloud Organization

   Incorrect. An Organization is the top-level node in the GCP resource hierarchy and represents your company domain. It contains folders and projects, but is not the unit where resources are deployed or where billing is tracked at the team level.
4. A Billing Account

   Incorrect. A Billing Account is used to pay for GCP usage, but it is not a resource container. One billing account can be linked to multiple projects, but it does not provide resource isolation on its own.

A Google Cloud Project is the fundamental unit for deploying, isolating, and billing GCP resources.

2. Create a Budget in the Billing Account that covers all: What is the correct approach?

1. Move all 20 projects into a common Folder and create a budget directly on that Folder with a $50,000 threshold and an email channel

   Incorrect. Budgets in GCP are created on Billing Accounts, not on Folders. A Folder aids IAM and policy inheritance but has no budget resource of its own, so this cannot be configured.
2. Create a Budget in the Billing Account that covers all projects, set the threshold at $50,000, and configure an email notification channel ✓

   Correct. GCP Billing Budgets are created at the Billing Account level and can scope to all projects or specific projects. You can set threshold rules (e.g., 90% of budget) that trigger email alerts to billing account admins or via Pub/Sub.
3. Configure a Cloud Monitoring alert policy on each project that tracks billing metrics and emails Finance when the combined spend nears $50,000

   Incorrect. Billing thresholds are managed as budgets in the Cloud Billing console, not as Cloud Monitoring alert policies, and per-project policies cannot natively sum spend into one aggregate $50,000 alert.
4. Enable the Billing Export to BigQuery and write a scheduled query that emails via Cloud Functions whenever the summed spend exceeds $50,000

   Incorrect. Billing Export to BigQuery is a data-analysis pipeline, not the native budget-alert mechanism. Building a scheduled query plus Cloud Functions is needlessly complex when Billing Budgets alert on this directly.

GCP Billing Budgets are created at the Billing Account level and support multi-project scoping with threshold-based email alerts.

3. Grant the developer the roles/appengine.deployer role: Which IAM role assignment follows the principle of leas

1. Grant the developer the roles/owner role on the project

   Incorrect. The Owner role provides full control including IAM policy management and billing, which directly violates the requirement to restrict those capabilities.
2. Grant the developer the roles/appengine.serviceAdmin role on the project

   Incorrect. The roles/appengine.serviceAdmin role includes management of all App Engine settings, versions, and services — it is broader than deployer. It still does not include IAM or billing, but it exceeds the minimum permissions needed just for deployments.
3. Grant the developer the roles/appengine.deployer role on the project ✓

   Correct. The roles/appengine.deployer predefined role allows deploying new application versions to App Engine without granting broader permissions like IAM management or billing access. This aligns with least privilege.
4. Grant the developer the roles/editor role on the project

   Incorrect. The Editor role is a basic role that grants broad write access across almost all GCP services. While it allows App Engine deployments, it also grants far more permissions than necessary, violating least privilege.

roles/appengine.deployer provides exactly the permissions needed to deploy App Engine versions without granting IAM or billing access.

4. gcloud init: Which command should they run first?

1. gcloud auth login

   Incorrect. While gcloud auth login does authenticate the user, it does not set a default project or compute region. The user would then need additional commands to configure the environment. gcloud init combines all of these steps.
2. gcloud config set project [PROJECT_ID]

   Incorrect. This command sets the default project but requires the user to already be authenticated. Running it on a fresh installation without prior authentication would fail.
3. gcloud components install

   Incorrect. gcloud components install is used to install additional SDK components (like kubectl or beta commands), not to authenticate or configure the environment for first-time use.
4. gcloud init ✓

   Correct. The gcloud init command runs an interactive workflow that authenticates the user with their Google account, sets the active project, and optionally configures a default compute region and zone. It is the recommended first command after installing the Cloud SDK.

gcloud init is the correct first command after installing Cloud SDK — it handles authentication, project selection, and default region/zone setup interactively.

5. Cloud Shell provides a temporary virtual machine with 5 GB: Which statement accurately describes a key charact

1. Cloud Shell provides a temporary virtual machine with 5 GB of persistent home directory storage and the Cloud SDK pre-installed ✓

   Correct. Google Cloud Shell is a browser-based terminal that spins up a temporary e2-small VM with Debian Linux. It includes a pre-installed, always up-to-date Cloud SDK and 5 GB of persistent storage on /home/[username] that persists across sessions.
2. Cloud Shell provides unlimited persistent home storage plus a dedicated static IP address that stays fixed for the whole session

   Incorrect. Cloud Shell's home directory is limited to 5 GB, not unlimited, and its VM is ephemeral with no dedicated or static IP address assigned to the session.
3. Cloud Shell requires you to manually install and periodically update the Cloud SDK yourself before any gcloud commands will run

   Incorrect. A key benefit of Cloud Shell is that the Cloud SDK (gcloud, bq, gsutil) comes pre-installed and auto-updated, so no manual installation is ever required.
4. Cloud Shell sessions remain active indefinitely with no inactivity timeout, so the ephemeral VM keeps running even without user interaction

   Incorrect. Cloud Shell sessions time out after roughly 20 minutes of inactivity and the VM is reclaimed; only the /home directory persists across sessions.

Cloud Shell provides a browser-based terminal with a pre-installed Cloud SDK and 5 GB of persistent home directory storage.

6. roles/resourcemanager.organizationAdmin: Which role provides the minimum necessary permissions?

1. roles/resourcemanager.projectIamAdmin on every project

   Incorrect. While project IAM Admin allows managing IAM on individual projects, applying it to every project is operationally cumbersome. An organization-level role is more efficient and extends to all current and future projects automatically.
2. roles/resourcemanager.organizationAdmin ✓

   Correct. The Organization Admin role grants the ability to set IAM policies at the organization level, which cascade down to all folders and projects. It does not include billing management or project creation rights, aligning with the least-privilege requirement.
3. roles/iam.organizationRoleAdmin

   Incorrect. The Organization Role Admin role grants the ability to manage custom IAM roles within the organization, but does not grant the ability to set IAM policy bindings on resources — those are two different capabilities.
4. roles/owner at the organization level

   Incorrect. The Owner basic role at the organization level grants full administrative control over all resources including billing management and is far broader than needed. It violates least privilege.

roles/resourcemanager.organizationAdmin grants cross-organization IAM policy management without billing or project creation permissions.

7. Enable Billing Export to BigQuery and use Looker Studio: Which approach provides the most comprehensive cost a

1. Configure Cloud Monitoring custom dashboards populated with exported billing metrics

   Incorrect. Cloud Monitoring targets operational metrics like latency and CPU, not financial cost analysis, and billing data is not exposed as native Monitoring metrics for this use.
2. Enable Cloud Billing budget alerts that email detailed spend reports each month

   Incorrect. Budget alerts only warn as spend nears a threshold; they give no historical detail, label attribution, or query capability the FinOps team needs.
3. Enable Billing Export to BigQuery and use Looker Studio or SQL queries for analysis ✓

   Correct. Cloud Billing Export to BigQuery exports detailed billing data including resource-level costs, labels, credits, and adjustments. This enables complex SQL analysis, trend reporting, label-based attribution, and integration with visualization tools like Looker Studio.
4. Use the Cloud Console Billing Reports page to chart cost and usage trends

   Incorrect. The console Billing Reports page shows basic visualizations but lacks custom dashboards, label-based programmatic analysis, and SQL over historical data.

Billing Export to BigQuery provides detailed, label-attributed cost data enabling SQL-based trend analysis and custom FinOps dashboards.

8. Shared VPC with a host project run by the networking team: Which architecture achieves this with the least ope

1. Grant every application team direct IAM access to the central VPC project so that they can share its subnets

   Incorrect. Direct IAM access to the central project lets application teams modify subnets and firewall rules, defeating centralized control. Shared VPC shares networking without sharing its management.
2. VPC Peering configured between the central networking project and each individual application team's project

   Incorrect. VPC Peering connects two separate VPCs that keep their own subnets, so the networking team could not centrally own the subnets that application VMs use. Peering does not let you use another project's subnets.
3. Cloud Interconnect links set between each application project's VPC and the central networking project

   Incorrect. Cloud Interconnect connects on-premises networks to GCP, not GCP projects to one another. It does not apply to this intra-GCP centralized networking scenario.
4. Shared VPC with a host project run by the networking team and service projects for each application team ✓

   Correct. Shared VPC lets a host project own the VPC and share it with service projects. The networking team manages subnets and firewall rules in the host project while application teams deploy into service projects using the shared subnets.

Shared VPC centralizes network management in a host project while allowing application teams to deploy in service projects using the shared subnets.

9. Organization Policy with the compute.vmExternalIpAccess: Which mechanism enforces this company-wide?

1. Organization Policy with the compute.vmExternalIpAccess constraint set to deny at the organization level ✓

   Correct. The Organization Policy Service allows setting constraints at the organization, folder, or project level. The compute.vmExternalIpAccess constraint, when denied at the organization level, prevents any VM in any project from having an external IP. Org policies take precedence and cannot be overridden by project owners.
2. IAM policy denying roles/compute.instanceAdmin to all users

   Incorrect. Revoking compute.instanceAdmin would prevent anyone from creating VMs at all, which is far too restrictive. It doesn't specifically restrict external IP assignment while allowing other VM operations.
3. Cloud Monitoring alert that detects VMs with external IPs and automatically removes them via Cloud Functions

   Incorrect. A reactive approach (detect and remove) has a window of exposure between creation and removal. Organization Policy is a preventive control that blocks external IP assignment at the API level before any exposure occurs.
4. VPC firewall rules blocking all external traffic at the organization level

   Incorrect. Firewall rules block network traffic to/from existing IPs but do not prevent VMs from being created with external IP addresses. A VM can still be assigned an external IP — the firewall just blocks traffic to it. Org Policy prevents external IP assignment at creation time.

Organization Policy constraints (compute.vmExternalIpAccess) enforce governance at the organization level, preventing external IP assignment on all VMs across all projects.

10. Named gcloud configurations created and activated: Which gcloud feature enables this workflow?

1. Named gcloud configurations created and activated with gcloud config configurations commands ✓

   Correct. gcloud configurations store named sets of properties such as project, account, region, and zone. Create one per environment and switch instantly with gcloud config configurations activate [NAME].
2. Separate Google Cloud Console browser tabs kept open, one for each of the three projects

   Incorrect. Console browser tabs give visual context but do not change the gcloud CLI configuration, so the engineer still has to pass --project on every command or manage configurations separately.
3. Create shell aliases that append the correct project flag onto each of the common commands

   Incorrect. Shell aliases can append --project flags but are fragile, hard to maintain, and are not a built-in gcloud feature. Named configurations are the purpose-built solution.
4. Use separate service accounts per environment and switch between all their downloaded key files

   Incorrect. Swapping service account key files is insecure and adds key-management overhead, and it does not change the active project context. Named configurations manage project, account, and regional settings cleanly.

gcloud named configurations store project/account/region settings and can be instantly activated to switch CLI context between environments.

11. Request a quota increase via the Google Cloud Console: What is the correct resolution?

1. Move the workload to a different region such as us-east1, which may provide a higher default vCPU quota

   Incorrect. Quotas are per-region and per-project; relocating a workload to dodge a quota is a workaround, not the fix, and the right action is to raise the quota in the region you actually need.
2. Request a quota increase via the Google Cloud Console quotas page for the specific quota in us-central1 ✓

   Correct. Quota increases are requested in the Cloud Console under IAM & Admin Quotas; you select Compute Engine CPUs in us-central1, request the new limit with justification, and Google reviews the request.
3. Wait roughly 24 hours for the vCPU quota to reset automatically, then retry the failed deployment

   Incorrect. Resource quotas like vCPU counts are hard concurrency limits, not time-based rate limits, so they do not reset on a schedule and waiting will not free additional capacity.
4. Split the batch workload across several separate projects so that each one stays under its own per-project quota

   Incorrect. Spreading across projects can technically work but adds cross-project networking, IAM, and billing complexity; requesting a quota increase is the standard solution for legitimate capacity needs.

Quota increases are requested via the Cloud Console quotas page for the specific service and region; quotas do not auto-reset.

12. A custom IAM role with compute.instances.list: What should you create?

1. A custom IAM role with compute.instances.list, compute.instances.get, storage.objects.list, and storage.objects.get permissions ✓

   Correct. Custom IAM roles let you enumerate exactly the permissions needed, combining Compute instance viewing with Cloud Storage object viewing into a precisely scoped role that honors least privilege.
2. Grant both roles/compute.viewer and roles/storage.objectViewer together to the users to approximate the exact permission combination requested

   Incorrect. Combining these predefined roles is close but roles/compute.viewer carries many extra permissions beyond listing instances, such as viewing disks, networks, and snapshots, so a custom role is more precise.
3. Create a Shared VPC and rely on subnet-level access controls to restrict the users to only these specific viewing permissions

   Incorrect. Shared VPC is a networking feature for sharing subnets across projects; it has nothing to do with defining a scoped IAM role granting specific view permissions on resources.
4. Grant roles/viewer (Project Viewer), which provides read-only access across every GCP service in the entire project

   Incorrect. roles/viewer is a basic role granting read access to every GCP service in the project, far more than the requirement specifies, which violates the principle of least privilege.

Custom IAM roles allow precisely specifying the exact permissions needed when no predefined role provides the exact combination required.

Other GCP ACE domains

• Deploying and implementing a cloud solution — 158 questions →
• Planning and configuring a cloud solution — 108 questions →
• Ensuring successful operation of a cloud solution — 96 questions →
• Configuring access and security — 77 questions →
• All 500 GCP ACE questions →