Practice for the Google Cloud Associate Cloud Engineer exam with 18 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A developer needs to test a script that interacts with a Cloud Storage bucket. The script is designed to run on a VM usi. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Google Cloud Associate Cloud Engineer practice test →
What you will practice
- A developer needs to test a script that interacts with a Cloud Storage bucket. The script is designed to run…
- You are deploying a workload to GKE that needs to pull private container images from an Artifact Registry rep…
- Your application generates extensive log files stored in a Cloud Storage bucket. These logs are critical for…
- You are building an IoT platform that ingests sensor data from 100,000 devices. The devices send readings eve…
- You are the cloud lead for a company running workloads in multiple projects. The finance team needs to perfor…
- Your company operates in a regulated industry with strict data residency requirements. The compliance officer…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A developer needs to test a script that interacts with a Cloud Storage bucket. The script is designed to run on a VM using a specific service account app-sa@project.iam.gserviceaccount.com. To test locally on their workstation without down…
Answer: A. Grant the developer the roles/iam.serviceAccountTokenCreator role on the service account and instruct them to use the –impersonate-service-account flag.
Granting the Token Creator role enables the developer to generate short-lived credentials via impersonation. Downloading JSON or P12 keys introduces severe security risks, while the Service Account User role only allows attaching identities to resources, not local impersonation.
Q2. You are deploying a workload to GKE that needs to pull private container images from an Artifact Registry repository located in the same project. You want to follow the principle of least privilege and avoid managing static keys. How shoul…
Answer: A. Configure Workload Identity to bind the Kubernetes Service Account (KSA) to a Google Service Account (GSA) with the Artifact Registry Reader role.
Configuring Workload Identity allows pods to securely impersonate a dedicated Google service account without managing long-lived keys. For the exam, always select Workload Identity over static JSON keys or node-level configurations to enforce least privilege in GKE.
Q3. Your application generates extensive log files stored in a Cloud Storage bucket. These logs are critical for troubleshooting during the first 60 days. After that, they are required solely for regulatory compliance, will likely never be rea…
Answer: D. Configure a Lifecycle rule to change the storage class to Archive Storage after 60 days.
Configuring an object lifecycle rule to transition logs to Archive Storage directly minimizes costs for long-term, rarely accessed compliance data. Moving files to Standard Storage or BigQuery increases expenses, as those services are optimized for frequently accessed, active workloads.
Q4. You are building an IoT platform that ingests sensor data from 100,000 devices. The devices send readings every second, resulting in a massive volume of write operations. You need a database that can handle millions of writes per second wi…
Answer: C. Cloud Bigtable
Cloud Bigtable is the correct choice because it handles massive write throughput and time-series workloads with sub-millisecond latency. BigQuery is optimized for analytical reporting rather than real-time ingestion, and Cloud SQL cannot scale efficiently to millions of writes per second.
Q5. You are the cloud lead for a company running workloads in multiple projects. The finance team needs to perform complex, granular cost analysis using SQL to join billing data with internal business metrics (e.g., "Cost per customer transact…
Answer: B. Enable detailed usage cost data export to BigQuery.
Enabling detailed usage cost data export to BigQuery automatically streams granular billing data for SQL analysis. Exporting to Google Sheets or downloading CSVs lacks the necessary automation, while using the API requires unnecessary custom pipeline maintenance.
Q6. Your company operates in a regulated industry with strict data residency requirements. The compliance officer has mandated that all new cloud resources (VMs, Buckets, Databases) must be created ONLY in European regions (europe-west1, europ…
Answer: C. Configure an Organization Policy with the gcp.resourceLocations constraint and set the allowed values to the European regions.
Configuring an Organization Policy with the gcp.resourceLocations constraint immediately prevents resource creation outside allowed regions. IAM conditions or deny policies require massive administrative overhead, while reactive deletion functions fail to block non-compliant resources immediately.
Q7. A data science team is evaluating accelerators for two separate workloads. Workload A is a large-scale transformer model training job using JAX, with fixed input shapes, large batch sizes, and dominated by dense matrix operations. Workload…
Answer: D. Workload A: Cloud TPU. Workload B: GPU.
Cloud TPUs are optimized for large-scale matrix operations with fixed shapes, making them perfect for Workload A. GPUs are the correct choice for Workload B because they handle custom PyTorch operations and rapid iteration without the overhead of graph compilation.
Q8. Your company runs a nightly batch processing job that takes approximately 3-4 hours to complete. The job requires a specific amount of RAM and CPU to run efficiently. The application has built-in checkpointing, so if it is interrupted, it…
Answer: B. Run the job on Compute Engine Spot VMs and use a shutdown script to save the checkpoint.
Running the job on Compute Engine Spot VMs minimizes costs while handling preemption via checkpointing. Shut down scripts capture the preemption notice to save progress, whereas serverless options like Cloud Run or App Engine lack the cost efficiency for long-running batch jobs.
Q9. You are designing a global web application that must be deployed in three specific regions: us-central1, europe-west1, and asia-east1. You need a single global IP address that routes users to the closest healthy region and automatically fa…
Answer: C. Deploy Managed Instance Groups (MIGs) in each region and add them as backends to a Global External HTTP(S) Load Balancer.
A Global External HTTP(S) Load Balancer provides a single anycast IP and instantly routes traffic to the closest healthy region. DNS-based routing relies on TTLs causing delays during failover, and Cloud CDN alone lacks the necessary health checking backend routing capabilities.
Q10. Your security team mandates that junior operators must be able to view the configuration details of Compute Engine instances (e.g., machine type, disk size) but must strictly be prevented from starting, stopping, or deleting them. You need…
Answer: B. compute.instances.get and compute.instances.list
Including compute.instances.get and list grants strictly read-only access to view machine configurations. Granting start, stop, or wildcard permissions violates the requirement, while setMetadata is a write operation that could allow unauthorized privilege escalation.
Q11. You are deploying a 3-tier application with web, application, and database layers. The application VMs are in subnet-a, and the database VMs are in subnet-b. For security compliance, you need to configure a firewall rule that allows traffi…
Answer: B. Create a firewall rule with the target service account of the database VMs and source service account of the application VMs.
Using service accounts for both source and target filtering ensures only the specific application VMs access the database. Network tags present security vulnerabilities since users could attach them to unauthorized machines, while static IPs break during autoscaling.
Q12. Your organization's security team requires that all audit logs from your production project be retained for 3 years to satisfy compliance regulations. Additionally, security analysts need to run complex SQL queries against these logs to id…
Answer: B. Create a Log Router sink to export the audit logs to a BigQuery dataset.
Creating a Log Router sink to BigQuery satisfies both long-term retention and complex SQL analysis requirements. Cloud Storage archives logs but complicates SQL queries, while relying on Cloud Logging's custom retention is expensive and less analytically capable.
Q13. Your organization has two Google Cloud projects: frontend-proj and backend-proj. Each project has its own Custom VPC network. The frontend application in frontend-proj needs to connect to the database in backend-proj using internal private…
Answer: C. Create a VPC Network Peering connection between the two VPC networks.
VPC Network Peering provides internal IP connectivity between two networks, keeping traffic on Google's private backbone with minimal latency. Shared VPC requires complex resource migration to a host project, resulting in significantly higher operational overhead than peering.
Q14. You have just applied a rolling update to a deployment named frontend-app in your GKE cluster. Users immediately report 500 errors. You need to revert the deployment to the previous stable revision as quickly as possible. Which command sho…
Answer: B. kubectl rollout undo deployment/frontend-app
The kubectl rollout undo command instantly reverts a deployment to its previous stable revision using built-in history. Applying an older YAML file works technically but requires locating the exact file, which introduces unnecessary delay during a production outage.
Q15. Your security team has issued a new mandate for a sensitive Cloud Storage bucket containing financial records. They require that access to objects must be uniform: if a user has access to the bucket, they should have access to all objects…
Answer: A. Enable Uniform Bucket-Level Access (UBLA) on the bucket.
Enabling Uniform Bucket-Level Access disables Access Control Lists, ensuring permissions are managed exclusively through bucket-level IAM policies. Setting default object ACLs to private leaves the ACL system active, meaning users could still modify individual object permissions later.
Q16. You are responsible for the reliability of a Managed Instance Group (MIG) serving a production API. You need to ensure the operations team is notified via email whenever the average CPU utilization of the instance group exceeds 80% for a d…
Answer: D. Configure a Cloud Monitoring Alerting Policy with a metric threshold condition for the MIG, setting the duration to 5 minutes.
A Cloud Monitoring Alerting Policy natively tracks infrastructure metrics and sends notifications when sustained thresholds are breached. Writing custom Cloud Run Functions to poll APIs duplicates existing managed services and introduces unnecessary code maintenance.
Q17. You are designing the network architecture for a global media application. The production environment requires the lowest possible latency and high availability for users worldwide. However, the development environment is cost-sensitive an…
Answer: C. Use Premium Tier for the production project and Standard Tier for the development project.
Premium Tier routes traffic over Google's private global backbone using cold-potato routing, providing the lowest latency for your production environment. Standard Tier uses cheaper public ISP routing, making it the most cost-effective choice for your development environment where performance is less critical.
Q18. Your development team uses Artifact Registry to store Docker container images in a repository called "app-images" in us-central1. The team now wants to also store their Maven Java packages and npm Node.js packages in the same location to s…
Answer: B. Create separate repositories for Maven and npm, as each Artifact Registry repository supports only a single format that cannot be changed after creation
Artifact Registry repositories are immutable and permanently bound to a single format specified at creation. You must create separate repositories for Docker, Maven, and npm packages because Google enforces strict one-to-one mappings between repositories and artifact formats.
More Google Cloud Associate Cloud Engineer drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.