Google Cloud Associate Cloud Engineer (GCP-ACE) practice questions

A boolean organization policy constraint is enforced on a folder. A team then creates a new project inside that folder, and no policy is set directly on the project. How does the constraint apply to the new project?

• AThe constraint is inherited from the folder and enforced on the new project, because a project evaluates an effective policy built from every ancestor above it.check_circle Correct
• BThe constraint does not reach the project, because organization policies attach to the organization node and folders but stop above the project level.
• CThe constraint applies only after an administrator re-applies it on the project, since existing policies do not propagate to resources created after the policy is set.
• DThe constraint is inherited but downgraded to advisory, so violations on the project are recorded in Cloud Logging instead of being blocked.

Why A is correct: Correct: the effective policy for any node is the result of evaluating its own policy against those inherited from the folders and organization above it, so a folder constraint applies to child projects.

Why B is wrong: It sounds plausible if you assume policies protect only higher tiers, but organization policies attach to and are enforced at organization, folder, and project nodes alike.

Why C is wrong: The timing detail is tempting, but inheritance is evaluated dynamically at each request, so a project created later still inherits the folder policy without any manual re-application.

Why D is wrong: It borrows the idea of a dry-run mode, but an enforced organization policy actively blocks non-compliant actions rather than merely logging them as advisory events.

A colleague new to Google Cloud asks how the three IAM role types differ. Which statement correctly characterises basic, predefined, and custom roles?

• ABasic roles are granular roles maintained by Google for a single service, predefined roles are the legacy Owner, Editor, and Viewer, and custom roles are copies of basic roles scoped to one project.
• BBasic roles are the broad legacy Owner, Editor, and Viewer roles, predefined roles are granular Google-maintained roles for specific services, and custom roles let you assemble a chosen set of permissions.check_circle Correct
• CBasic roles apply only to Cloud Storage buckets, predefined roles apply only to Compute Engine, and custom roles are the sole way to grant access to any other Google Cloud service.
• DBasic roles and predefined roles are both authored by the customer, whereas custom roles are supplied and updated automatically by Google as services change.

Why A is wrong: This swaps the definitions of basic and predefined roles; Owner, Editor, and Viewer are the basic roles, while the granular per-service roles maintained by Google are the predefined ones.

Why B is correct: This matches the model exactly: basic roles are broad and legacy, predefined roles are fine-grained and maintained by Google, and custom roles are built by selecting the specific permissions you want.

Why C is wrong: This invents per-service limits that do not exist; basic and predefined roles both span many services, and custom roles are an option for tailoring permissions rather than the only route to most services.

Why D is wrong: This reverses authorship; basic and predefined roles are provided and maintained by Google, while custom roles are the ones the customer authors and must maintain themselves.

A team wants to grant an application the permissions to publish and consume Pub/Sub messages without giving any broader access. What is the main advantage of choosing a predefined role over a basic role here?

• AA predefined role can be edited by the team to add or remove individual permissions, whereas a basic role has a fixed permission set that cannot be changed.
• BA predefined role automatically applies across the whole organisation hierarchy, so it needs to be granted only once, unlike a basic role that must be granted per resource.
• CA predefined role bundles a curated set of permissions for a specific service, granting just the Pub/Sub access the application needs rather than broad access to unrelated services.check_circle Correct
• DA predefined role grants temporary permissions that expire after the application finishes, while a basic role grants permanent access that must be revoked manually.

Why A is wrong: This confuses predefined with custom roles; predefined roles are maintained by Google and are not customer-editable, so editability is not the advantage they offer.

Why B is wrong: This misstates inheritance; both role types follow the same policy-inheritance rules based on where they are granted, so this is not a distinguishing benefit of predefined roles.

Why C is correct: Predefined roles are granular and service-focused, so a Pub/Sub publisher or subscriber role grants only the relevant permissions, aligning with least privilege far better than a broad basic role.

Why D is wrong: This invents an expiry behaviour; predefined roles do not self-expire, and time-bound access is handled separately, so the genuine advantage is their granular service scope.