Google Cloud Associate Cloud Engineer (ACE) · 18% practice allocation

Google Cloud ACE: Setting up a cloud solution environment Practice Questions

5 free sample questions from the Setting up a cloud solution environment domain, with answers and explanations. The full ACE bank has 251 questions across 5 domains. Questions are scenario-based and written from the official Google Cloud exam guide.

1.

A team member reports that a critical API (Cloud SQL Admin API) is not functioning. Upon investigation, you find the API has not been enabled in the current project. However, when you attempt to enable it, you receive the error 'ERROR: (gcloud.services.enable) User does not have permission [servicemanagement.services.create].' Which role assignment will resolve this issue?

  • A. Assign the Project Editor role to the user
  • B. Assign the Service Account Admin role to the user
  • C. Assign the Editor role to the user
  • D. Assign the Service Usage Admin role to the user✓ Correct
Explanation

Option 2 is correct: The Service Usage Admin role includes the servicemanagement.services.create permission needed to enable APIs in a project. Option 1 (Service Account Admin) manages service accounts, not API enablement. Option 3 (Editor) works but is overly broad for this specific task. Option 4 (Project Editor) is not a standard predefined role; the actual role is just 'Editor'.

2.

You are creating a service account for a Compute Engine VM that needs to read objects from a specific Cloud Storage bucket named 'app-logs-bucket' and write to Cloud Logging, but should not access any other buckets or logging destinations. You have created the service account 'vm-logs-reader@project-id.iam.gserviceaccount.com'. What is the most secure way to grant the necessary permissions?

  • A. Assign the Storage Admin role and Cloud Logging Admin role to the service account, then use bucket-level IAM to restrict the Storage Admin role to 'app-logs-bucket' only
  • B. Create a custom role with the required permissions and assign it only to the service account via a custom role at the bucket level and logging sink level
  • C. Assign the Storage Object Viewer and Logs Writer predefined roles to the service account at the project level
  • D. Create a custom role with storage.objects.get and logging.logEntries.create permissions, assign it at the project level to the service account✓ Correct
Explanation

Option 2 is correct: A custom role with only storage.objects.get and logging.logEntries.create permissions follows the principle of least privilege—granting exactly what is needed and nothing more. Option 1 (Storage Object Viewer) is close but doesn't specify which bucket, potentially granting access to all buckets in the project; using Cloud Logging Writer role (which writes to any logs) is also overly broad. Option 3 grants Storage Admin which allows deletion and bucket modification—far beyond the read requirement. Option 4 is overly complex; custom roles are project-level constructs and cannot be assigned at bucket level directly (though the permissions are correct, the implementation is flawed).

3.

A team member runs 'gcloud compute instances create' without specifying a project, and the command fails with 'ERROR: (gcloud.compute.instances.create) Missing required property [project].' The user's gcloud configuration shows no active project. Which sequence of commands will resolve this issue?

  • A. gcloud projects list to find the correct PROJECT_ID, then export GCLOUD_PROJECT=PROJECT_ID in the terminal
  • B. gcloud init and select the correct project from the list presented
  • C. gcloud config set project PROJECT_ID, then rerun the gcloud compute instances create command✓ Correct
  • D. gcloud auth login, then gcloud config list to verify the active project
Explanation

Option 1 is correct: 'gcloud config set project PROJECT_ID' explicitly sets the active project in the configuration, which resolves the missing project property error. Option 2 authenticates the user but doesn't set an active project. Option 3 lists projects but exporting GCLOUD_PROJECT is not the standard gcloud method; this is an environment variable approach that doesn't affect the gcloud configuration. Option 4 (gcloud init) works but is unnecessarily verbose for an already-authenticated user who only needs to set the project.

4.

You are setting up billing for a startup's Google Cloud environment. The startup has two projects: 'frontend-project' and 'backend-project'. Both projects are linked to a single billing account. You want to receive an email notification when combined spending across both projects exceeds $500 per month. Which configuration will achieve this?

  • A. Create a budget of $500 in the billing account with alert threshold at 100% and configure email notifications✓ Correct
  • B. Create a budget of $500 at the billing account level and configure email notifications via Cloud Monitoring alert policy
  • C. Create a budget of $500 in the billing account with alert threshold at 100%, and set up email notifications
  • D. Create a separate budget of $250 for each project with 100% threshold to split the budget
Explanation

Options 3 and 4 are essentially the same, but option 4 is the most direct and correct answer: Create a billing account-level budget (not project-level), set it to $500, set the alert threshold to 100%, and enable email notifications. The billing account level automatically aggregates both projects' spending. Option 1 is correct in the budget setup but less specific about the email notification mechanism. Option 2 splits the budget arbitrarily ($250 per project), which doesn't reflect the $500 total limit requirement and misses that a single billing account budget aggregates both projects automatically. Option 3 adds unnecessary complexity by involving Cloud Monitoring when email notifications are directly configurable on the budget.

5.

SELECT TWO of the following statements that accurately describe how quotas and API enablement interact in Google Cloud projects.

  • A. Quotas are project-specific, and if an API is enabled in one project, you must request separate quota increases for that API in a different project
  • B. A disabled API cannot be called, and even if you have quota remaining from a previous billing period, calls will be rejected with a 'permission denied' error✓ Correct
  • C. Quotas are enforced globally across all Google Cloud regardless of which project's API is enabled
  • D. You can use the gcloud compute project-info describe command to view both enabled APIs and current quota usage for a project
  • E. An API must be enabled before it can be used, and enabling an API automatically increases the quota limits from zero to the default allowance✓ Correct
Explanation

Options 1 and 3 are correct: Option 1 accurately states that enabling an API is a prerequisite, and it comes with default quotas (not zero). Option 3 accurately states that disabled APIs return 'permission denied' errors regardless of quota. Option 2 is incorrect—quotas are project-specific, not global. Option 4 is partially correct—'gcloud compute project-info describe' shows some information, but quotas are better viewed via 'gcloud compute project-info describe --format' or the Cloud Console. Option 5 is correct that quotas are project-specific, but the phrasing about 'requesting separate quota increases' in the option as written is confusing; quota requests are typically made per project anyway.

Test yourself across every ACE domain

The free ACE practice test mixes about 20 questions weighted like the exam. The full 251-question bank adds instant grading, flashcards and a timed mock exam.

Take the free ACE practice testPractice the full bank

Study this domain

Setting up a cloud solution environment study guide (ACE) →

Other ACE domains

← All Google Cloud Associate Cloud Engineer study resources