Associate Cloud Engineer

Correct answer: A. Grant the developer the roles/iam.serviceAccountTokenCreator role on the service account and instruct them to use the --impersonate-service-account flag.

Granting the Token Creator role enables the developer to generate short-lived credentials via impersonation. Downloading JSON or P12 keys introduces severe security risks, while the Service Account User role only allows attaching identities to resources, not local impersonation.

Correct answer: A. Configure Workload Identity to bind the Kubernetes Service Account (KSA) to a Google Service Account (GSA) with the Artifact Registry Reader role.

Configuring Workload Identity allows pods to securely impersonate a dedicated Google service account without managing long-lived keys. For the exam, always select Workload Identity over static JSON keys or node-level configurations to enforce least privilege in GKE.

Correct answer: D. Configure a Lifecycle rule to change the storage class to Archive Storage after 60 days.

Configuring an object lifecycle rule to transition logs to Archive Storage directly minimizes costs for long-term, rarely accessed compliance data. Moving files to Standard Storage or BigQuery increases expenses, as those services are optimized for frequently accessed, active workloads.

Correct answer: C. Cloud Bigtable

Cloud Bigtable is the correct choice because it handles massive write throughput and time-series workloads with sub-millisecond latency. BigQuery is optimized for analytical reporting rather than real-time ingestion, and Cloud SQL cannot scale efficiently to millions of writes per second.

Correct answer: B. Enable detailed usage cost data export to BigQuery.

Enabling detailed usage cost data export to BigQuery automatically streams granular billing data for SQL analysis. Exporting to Google Sheets or downloading CSVs lacks the necessary automation, while using the API requires unnecessary custom pipeline maintenance.

Correct answer: C. Configure an Organization Policy with the gcp.resourceLocations constraint and set the allowed values to the European regions.

Configuring an Organization Policy with the gcp.resourceLocations constraint immediately prevents resource creation outside allowed regions. IAM conditions or deny policies require massive administrative overhead, while reactive deletion functions fail to block non-compliant resources immediately.

Correct answer: D. Workload A: Cloud TPU. Workload B: GPU.

Cloud TPUs are optimized for large-scale matrix operations with fixed shapes, making them perfect for Workload A. GPUs are the correct choice for Workload B because they handle custom PyTorch operations and rapid iteration without the overhead of graph compilation.

Correct answer: B. Run the job on Compute Engine Spot VMs and use a shutdown script to save the checkpoint.

Running the job on Compute Engine Spot VMs minimizes costs while handling preemption via checkpointing. Shut down scripts capture the preemption notice to save progress, whereas serverless options like Cloud Run or App Engine lack the cost efficiency for long-running batch jobs.

Correct answer: C. Deploy Managed Instance Groups (MIGs) in each region and add them as backends to a Global External HTTP(S) Load Balancer.

A Global External HTTP(S) Load Balancer provides a single anycast IP and instantly routes traffic to the closest healthy region. DNS-based routing relies on TTLs causing delays during failover, and Cloud CDN alone lacks the necessary health checking backend routing capabilities.

Correct answer: B. compute.instances.get and compute.instances.list

Including compute.instances.get and list grants strictly read-only access to view machine configurations. Granting start, stop, or wildcard permissions violates the requirement, while setMetadata is a write operation that could allow unauthorized privilege escalation.

Correct answer: B. Create a firewall rule with the target service account of the database VMs and source service account of the application VMs.

Using service accounts for both source and target filtering ensures only the specific application VMs access the database. Network tags present security vulnerabilities since users could attach them to unauthorized machines, while static IPs break during autoscaling.

Correct answer: B. Create a Log Router sink to export the audit logs to a BigQuery dataset.

Creating a Log Router sink to BigQuery satisfies both long-term retention and complex SQL analysis requirements. Cloud Storage archives logs but complicates SQL queries, while relying on Cloud Logging's custom retention is expensive and less analytically capable.

Correct answer: C. Create a VPC Network Peering connection between the two VPC networks.

VPC Network Peering provides internal IP connectivity between two networks, keeping traffic on Google's private backbone with minimal latency. Shared VPC requires complex resource migration to a host project, resulting in significantly higher operational overhead than peering.

Correct answer: B. kubectl rollout undo deployment/frontend-app

The kubectl rollout undo command instantly reverts a deployment to its previous stable revision using built-in history. Applying an older YAML file works technically but requires locating the exact file, which introduces unnecessary delay during a production outage.

Correct answer: A. Enable Uniform Bucket-Level Access (UBLA) on the bucket.

Enabling Uniform Bucket-Level Access disables Access Control Lists, ensuring permissions are managed exclusively through bucket-level IAM policies. Setting default object ACLs to private leaves the ACL system active, meaning users could still modify individual object permissions later.

Correct answer: D. Configure a Cloud Monitoring Alerting Policy with a metric threshold condition for the MIG, setting the duration to 5 minutes.

A Cloud Monitoring Alerting Policy natively tracks infrastructure metrics and sends notifications when sustained thresholds are breached. Writing custom Cloud Run Functions to poll APIs duplicates existing managed services and introduces unnecessary code maintenance.

Correct answer: C. Use Premium Tier for the production project and Standard Tier for the development project.

Premium Tier routes traffic over Google's private global backbone using cold-potato routing, providing the lowest latency for your production environment. Standard Tier uses cheaper public ISP routing, making it the most cost-effective choice for your development environment where performance is less critical.

Correct answer: B. Create separate repositories for Maven and npm, as each Artifact Registry repository supports only a single format that cannot be changed after creation

Artifact Registry repositories are immutable and permanently bound to a single format specified at creation. You must create separate repositories for Docker, Maven, and npm packages because Google enforces strict one-to-one mappings between repositories and artifact formats.

Correct answer: B. GKE Autopilot

GKE Autopilot is a fully managed mode where Google handles node provisioning, scaling, and security patching. Standard mode fails the requirements because you still manage the underlying node pools and retain SSH access to the nodes.

Correct answer: A. Create a custom image from the source VM's boot disk and reference this image in your Instance Templates.

Creating a custom image from the boot disk lets you reference it globally within instance templates for immediate deployments. Using startup scripts increases boot times because they must download and install dependencies every time a new VM initializes.

Correct answer: C. Cloud Run with autoscaling and min-instances set to 0.

Cloud Run natively supports scaling to zero when idle and rapidly scales up to handle unpredictable traffic spikes. App Engine Flexible cannot scale to zero, and GKE requires additional tooling to achieve similar scale-from-zero behavior.

Correct answer: C. Create a Snapshot Schedule in Compute Engine with the required frequency and retention policy, and attach it to the persistent disks.

Compute Engine snapshot schedules provide native automated backups with configurable frequencies and retention policies, satisfying the requirements without custom scripts. Avoid cron jobs or Cloud Functions, which require you to write and maintain custom code for creation and deletion.

Correct answer: B. CACHE_ALL_STATIC - automatically caches static content based on Content-Type, even when origin doesn't set cache headers

The CACHE_ALL_STATIC mode caches static content based on Content-Type headers even if the origin provides no cache directives. The USE_ORIGIN_HEADERS mode fails here because the origin currently sets no headers, meaning nothing would be cached.

Correct answer: A. Create a Budget with a Pub/Sub topic, and trigger a Cloud Run Function to remove IAM bindings.

Cloud Budgets can publish notifications to Pub/Sub when spending thresholds are crossed, allowing an automated Cloud Run Function to revoke IAM permissions. Email alerts fail the requirement because they require manual human intervention to enforce the access changes.

Correct answer: A. Configure the firewall rules to use Service Accounts as the source and target.

Using service accounts as targets in VPC firewall rules binds security to VM identity rather than mutable network tags. Tags defined in instance templates work for basic deployments, but service accounts provide stronger cryptographic identity and avoid manual tag management.

Correct answer: C. Enable OS Login by setting the metadata enable-oslogin=TRUE at the project level, and grant developers the roles/compute.osLogin role.

Enabling OS Login links Linux accounts to Google Cloud identities, automatically managing SSH keys through IAM without manual metadata updates. While IAP TCP forwarding secures network connectivity, it does not handle operating system authentication, making OS Login the required component.

Correct answer: C. gcloud config set project my-core-app · E. gcloud auth login

Use gcloud auth login to authenticate interactively with user credentials, and gcloud config set project to define the default project. Avoid application-default login because it provisions credentials for application code libraries rather than the CLI itself.

Correct answer: B. HorizontalPodAutoscaler (HPA)

The HorizontalPodAutoscaler automatically adjusts the number of pod replicas based on observed CPU utilization. The VerticalPodAutoscaler fails this requirement because it adjusts CPU and memory requests instead of scaling the replica count horizontally.

Correct answer: A. Attach a Service Account to the instance with the roles/monitoring.metricWriter role.

Attach a dedicated service account with the monitoring.metricWriter role to grant write permissions via Application Default Credentials. Avoid downloading JSON keys, as Google recommends against manual key management when native service account attachment is available.

Correct answer: B. Create a Cloud Armor security policy with a rate-based ban rule that blocks IPs exceeding 100 requests per minute for a specified ban duration

Cloud Armor rate-based ban rules automatically block IPs exceeding a specified request threshold, mitigating DDoS attacks at the network edge. Manually adding deny rules fails the automation requirement because it is reactive and cannot scale against rapidly changing attackers.

Correct answer: C. Use Google Cloud Managed Service for Apache Kafka.

Google Cloud Managed Service for Apache Kafka provides native API compatibility and exactly-once delivery semantics without operational overhead. Self-managing Kafka on Compute Engine or GKE fails the operational efficiency requirement because your team must handle all patching and clustering manually.

Correct answer: B. Grant the roles/compute.instanceAdmin.v1 role to the developer group on the my-app-dev project.

Granting compute.instanceAdmin.v1 on the specific project perfectly enforces least privilege, allowing developers to manage VMs without affecting production. Avoid granting broad primitive roles like Editor, or granting permissions at the organization level, which violates your security boundaries.

Correct answer: C. Use the Reports view in the Cloud Billing Console and group by "Label".

The Reports view in the Cloud Billing Console provides native visualization of cost trends grouped by labels. Exporting to BigQuery is useful for advanced reporting, but it is unnecessary for quickly viewing a month of spending directly in the console.

Correct answer: D. Grant the auditor roles/storage.objectViewer at the organisation level.

Granting roles at the organization level leverages resource hierarchy inheritance, automatically applying permissions to all current and future folders and projects. Granting access at the folder or project level requires repeating the process manually whenever new resources are created.

Correct answer: B. Compute Engine

Compute Engine provides full administrative control over the operating system, allowing you to install specific kernel modules and customize configurations. Fully managed platforms like Cloud Run or App Engine abstract the underlying operating system and restrict kernel-level access.

Correct answer: D. Grant the Compute Engine service account the Service Account Token Creator role on storage-admin@other-project.iam.gserviceaccount.com, then use the generateAccessToken API to create short-lived credentials

Granting the Token Creator role allows the VM service account to impersonate the target account and generate short-lived access tokens. This avoids downloading static JSON keys, which pose security risks, and keeps cross-project access securely auditable.

Correct answer: C. Use the gcloud compute networks subnets expand-ip-range command to increase the prefix length to /21.

The expand-ip-range command lets you increase a subnet capacity in place without disrupting existing running instances. Secondary ranges are only for alias IPs and containers, not for assigning primary internal IPs to new Compute Engine VMs.

Correct answer: A. Config Connector

Config Connector is a Kubernetes add-on that lets you manage Google Cloud resources using standard YAML manifests via kubectl. Terraform flows in the opposite direction, while Deployment Manager uses entirely different configuration templates.

Correct answer: A. Deploy a Memorystore for Redis instance and configure the application to cache results there.

Memorystore for Redis provides a fully managed in-memory caching layer that natively supports the Redis protocol. Self-managing a cluster on GKE or VMs adds unnecessary operational overhead, while Memcached does not support the required protocol.

Correct answer: A. Configure an Object Lifecycle Management rule to downgrade storage class to Nearline after 30 days and to Coldline after 365 days.

Object Lifecycle Management automatically transitions storage classes based on age, minimizing costs without custom code. Jumping directly to Archive after thirty days incurs early deletion fees if accessed before the mandatory year elapses.

Correct answer: B. Create a BI Engine reservation with sufficient memory capacity and designate the key dashboard tables as preferred tables

Creating a BI Engine reservation with preferred tables accelerates repeated dashboard queries by caching table data in memory. BigQuery result caching only works for exact duplicate queries, whereas BI Engine accelerates similar queries across your preferred tables.

Correct answer: B. Configure a Lifecycle rule with the action Delete and condition Age: 90 days.

Configuring a Lifecycle rule with a Delete action and an age condition automatically removes old objects without custom scripts. Retention policies prevent deletion for compliance, which is the exact opposite of the required automatic cleanup behavior.

Correct answer: C. Workforce Identity Federation, by creating a workforce identity pool and an Okta OIDC or SAML 2.0 provider, so employees can use SSO with short-lived tokens and no Cloud Identity accounts are required.

Workforce Identity Federation allows employees to sign in using external identity providers with short-lived tokens, avoiding separate Cloud Identity accounts. Workload Identity Federation is designed for automated workloads and code pipelines, not interactive human users.

Correct answer: B. Gemini Enterprise Agent Platform, which provides managed custom model training and a fully managed online prediction service that deploys models to endpoints without requiring infrastructure management.

Vertex AI provides a fully managed environment for custom model training and deploys models to online prediction endpoints without infrastructure management. BigQuery ML is excellent for training models using SQL on structured data but does not serve real-time custom TensorFlow endpoints.

Correct answer: B. Apply a specific network tag (e.g., web-app) to the application VMs. Create a VPC firewall rule allowing ingress traffic to subnet-b from the source tag web-app.

Applying a network tag to your application VMs and using it as the source in a firewall rule provides the required strict access control. Filtering by subnet range is too broad because it would allow future VMs in that subnet to access the database.

Correct answer: B. AlloyDB for PostgreSQL

AlloyDB for PostgreSQL is fully managed and delivers high transaction throughput while maintaining one hundred percent compatibility with native PostgreSQL extensions. Spanner's PostgreSQL interface lacks support for stored procedures, requiring substantial application refactoring.

Correct answer: D. Gemini CLI, an open-source AI agent that runs in the terminal and uses a reason-and-act loop to complete coding tasks, run commands, and manipulate files through natural-language prompts.

Gemini CLI is an open-source AI agent that runs locally in your terminal to manipulate files and execute commands. Gemini Cloud Assist operates exclusively within the Google Cloud console and cannot interact with your local codebase.

Correct answer: B. Create separate Terraform directories (or workspaces) for each environment and reuse shared modules for infrastructure resources.

Using separate directories with shared modules ensures complete state isolation and minimizes code duplication. Monolithic files with conditional logic create a massive blast radius, and using a single project violates the requirement for strict environmental isolation.

Correct answer: D. Disable billing on the project.

Disabling billing on the project immediately stops all billable services and terminates running compute resources. Deleting the compromised service account halts new authentications, but existing access tokens remain valid for up to an hour, so disabling billing is the fastest way to stop incurring charges.

Correct answer: B. A URL Map to define routing rules for incoming requests. · D. A Backend Service with a configured health check.

A backend service distributes traffic by relying on health checks to route requests only to available instances. The URL map is also mandatory because it defines the routing rules that direct incoming requests to the correct backend service.

Correct answer: B. Use VM Manager to apply an OS policy that installs and configures the Ops Agent on all VMs.

Applying an OS policy via VM Manager installs and configures the Ops Agent at scale without manual SSH access. Startup scripts only run during boot, meaning they cannot easily update the agent on already running instances.

Correct answer: D. resource.type="gce_instance" AND resource.labels.instance_id="[INSTANCE_ID]" AND severity="ERROR" (Assume [INSTANCE_ID] matches web-server-1)

The correct filter uses the exact resource type and the numeric instance ID along with the structured severity field. Filtering by the instance name fails because the labels require the unique numeric identifier rather than the human-readable string.