GCP ACE Practice / Study guide / Domain 5
GCP ACE Domain 5: Configuring Access and Security
Roughly ~20% of the Google Cloud Associate Cloud Engineer exam. What it
actually covers, the traps to know, and 8 free sample questions with full explanations.
Domain 5 is IAM in depth, and IAM is arguably the single most-tested subject across the whole exam once you count how often it resurfaces in other domains. Know the three role types cold: basic roles (Owner, Editor, Viewer — broad, legacy, generally discouraged in production), predefined roles (service-specific, Google-maintained, the usual right answer), and custom roles (when you need a permission set no predefined role matches, at the cost of maintaining it yourself). The principle of least privilege is the thread running through nearly every correct answer in this domain.
Service accounts get their own deep dive here: they're identities for workloads rather than people, they can be granted roles just like a user, and attaching a service account to a Compute Engine instance is almost always preferable to distributing a downloaded JSON key — key management (rotation, and never committing a key to source control) is a frequent exam trap. Understand impersonation and short-lived credentials as the modern alternative to long-lived keys.
Beyond IAM proper, expect organization policies (constraints applied at the org/folder/project level — e.g., restricting VM external IPs or which regions resources can be created in) and basic data protection: Google encrypts data at rest by default, Cloud KMS is how you manage your own encryption keys (customer-managed encryption keys, CMEK) when default encryption isn't enough, and Cloud Audit Logs record who did what, when — Admin Activity logs are on and cannot be disabled; Data Access logs mostly have to be turned on deliberately.
Exam tips for this domain
- Predefined roles are the default correct answer whenever one fits; basic roles (Owner/Editor/Viewer) are almost always the wrong, over-broad choice in a security-focused question.
- Prefer attaching a service account to the resource that needs it over downloading and distributing a long-lived JSON key — key-handling questions test exactly this instinct.
- Admin Activity audit logs are always on and can't be turned off; Data Access audit logs (except for BigQuery) are off by default and must be enabled — a frequently-tested distinction.
Sample questions — Domain 5
These 8 questions are drawn from our full bank of 658 to show the style and
depth you'll get in the app. Each comes with the full explanation you'd see after answering
in a real practice session.
2FA
After a phishing attempt targets your organization's admins, you harden their accounts. What is the highest-value authentication control?
- Enforcing 2-Step Verification, ideally hardware security keys, for privileged usersCorrect
- Longer usernames
- Monthly password rotation only
- Shared admin accounts so fewer passwords exist
Why: Phishing-resistant 2SV (security keys) neutralizes credential theft — the dominant attack. Password-rotation-alone and shared accounts are outdated/actively harmful.
AI security
Teams in your company have started calling Vertex AI APIs with customer data. What belongs in the baseline security review? (Choose two.)
- IAM: who/what SAs can invoke models and access training dataCorrect
- Data governance: residency of data used, logging of access, DLP where PII flowsCorrect
- Whether the model likes the data
- GPU color
Why: AI workloads inherit standard controls: identity on APIs/data, residency/logging/de-identification for content. Same discipline, new service.
Access
In an access review, you explain why the basic roles in your org quietly get riskier over time. Which statement about IAM and new Google Cloud services is true?
- Basic roles automatically include permissions of newly launched services, another reason to avoid them — predefined roles scope to known servicesCorrect
- Basic roles never gain permissions
- Custom roles auto-update
- New services have no IAM
Why: Owner/Editor/Viewer silently expand as Google ships services — your grant grows without review. Custom roles are static (your job to update); every service launches WITH IAM.
Access review
You are planning your org's first quarterly access review and time is limited. What should the review focus on FIRST?
- High-privilege grants (Owner/Editor/admin roles, SA impersonation rights) and dormant accounts/keysCorrect
- Every user in alphabetical order, for complete coverage
- New hires from the last quarter, since access changes most for them
- Viewer-level grants, which are the most numerous
Why: Risk-ranked review: powerful roles, stale users, unused SAs/keys (IAM Recommender and Policy Analyzer help automate). Breadth matters less than catching the dangerous outliers.
Audit logs
Preparing a security briefing, you must explain how Google Cloud separates audit logs for data-plane versus control-plane operations. Which two categories exist?
- Data Access logs (reads/writes of data) and Admin Activity logs (configuration changes)Correct
- Platform logs and workload logs, split by where they originate
- Network logs and compute logs, split by service family
- Paid and unpaid logs
Why: Admin Activity records configuration/metadata changes (always on); Data Access records data reads/writes (mostly opt-in, potentially voluminous). Both feed security review workflows.
Compliance
An auditor asks your team to produce Google Cloud's compliance certifications (ISO 27001, SOC, HIPAA readiness). Where do you find them?
- The Compliance Reports Manager / compliance resource center documentationCorrect
- The audit logs of your own projects
- The quota page of each service
- The Trust & Security section of Cloud Marketplace listings
Why: Google publishes certifications/attestations centrally; customers inherit infrastructure compliance but remain responsible for their configuration (shared responsibility).
Custom roles
Your team is considering a custom role because no predefined role fits the need exactly. Which statement about custom roles is TRUE?
- They can be created at project or org level, and you must maintain them as services add permissionsCorrect
- Google updates their permission lists automatically
- They can include permissions from other clouds
- They're always safer than predefined roles
Why: Custom roles are your maintenance burden (launch-stage awareness, permission drift), which is why predefined roles are preferred when they fit. Org-level customs can be reused across projects.
Data governance
Your analysts need aggregated query results from BigQuery tables that contain raw PII they must never see. What does BigQuery offer for this?
- Authorized views/routines exposing only sanitized results, while the base tables stay restrictedCorrect
- Emailing CSV extracts
- Renaming columns
- Trusting the analysts
Why: Authorized views run with the view owner's access to base tables; consumers get only the view's output. Extract-and-email destroys governance; renames hide nothing.
Practice this domain for real
The app has dozens more Domain 5 questions with instant scoring, spaced
repetition of what you get wrong, and progress tracking across sessions.
Start Domain 5 practice →
Other exam domains