Practice for the Google Cloud Associate Cloud Engineer exam with 18 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: You are deploying a production Google Kubernetes Engine (GKE) cluster that will host internet-facing microservices. You . Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Google Cloud Associate Cloud Engineer practice test →
What you will practice
- You are deploying a production Google Kubernetes Engine (GKE) cluster that will host internet-facing microser…
- Your logistics company is building an automated pipeline to process delivery confirmation photos. When driver…
- Your software company has scaled its microservices architecture to 50 distinct services within a VPC. The sec…
- A compliance officer at your company has directed your team to immediately make a specific BigQuery dataset i…
- A GitHub Actions workflow needs to read secrets from Secret Manager in your Google Cloud project. Currently t…
- Your enterprise is migrating a legacy Java application to a Managed Instance Group (MIG) on Compute Engine. T…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. You are deploying a production Google Kubernetes Engine (GKE) cluster that will host internet-facing microservices. You need to implement security best practices to harden the cluster against attacks. Which TWO configurations should you en…
Answer: B,E. Configure the cluster as a Private Cluster (private nodes). || Enable Workload Identity Federation for GKE.
Private clusters remove nodes from the public internet, and Workload Identity Federation eliminates the security risks of managing static service account keys in pods. For the exam, immediately eliminate legacy GKE authentication options like ABAC and Basic Authentication, as they are deprecated and insecure.
Q2. Your logistics company is building an automated pipeline to process delivery confirmation photos. When drivers upload images to a specific Cloud Storage bucket, the system must immediately trigger a Python script to resize the image and up…
Answer: B. Deploy a Cloud Function (2nd gen) triggered by Eventarc for Cloud Storage events.
Cloud Functions triggered by Eventarc provide a fully serverless, event-driven architecture that executes only when files are uploaded. Avoid polling architectures like cron jobs or Cloud Run on a schedule, because they introduce unnecessary latency and incur continuous compute costs.
Q3. Your software company has scaled its microservices architecture to 50 distinct services within a VPC. The security team mandates a "Zero Trust" model requiring mutual TLS (mTLS) authentication and authorization for every service-to-service…
Answer: B. Implement a Service Mesh (like Cloud Service Mesh) to manage mTLS and authorization.
A service mesh uses sidecar proxies to manage mutual TLS and fine-grained authorization without complex IP-based firewall rules. Traditional firewall policies operate at layers three and four, making them incapable of handling layer seven identity verification needed for zero trust.
Q4. A compliance officer at your company has directed your team to immediately make a specific BigQuery dataset inaccessible in response to a security event. The dataset is encrypted with a CMEK stored in Cloud KMS. The data must remain recove…
Answer: D. Disable the specific Cloud KMS CryptoKey version protecting the dataset.
Disabling the specific Cloud KMS CryptoKey version immediately blocks BigQuery from decrypting the dataset. This approach is preferred because the key version can simply be re-enabled later, ensuring the data remains fully recoverable. Destroying the key would permanently destroy the data.
Q5. A GitHub Actions workflow needs to read secrets from Secret Manager in your Google Cloud project. Currently the workflow authenticates using a JSON service account key stored as a GitHub Actions secret. Your security team has mandated the…
Answer: C. Create a workload identity pool and provider in your Google Cloud project, configure it to trust GitHub's OIDC tokens, and grant the GitHub identity roles/iam.workloadIdentityUser on a service account so the workflow exchanges its OIDC token for a short-lived Google Cloud access token.
Workload Identity Federation allows external systems like GitHub to exchange native OIDC tokens for short-lived Google Cloud access tokens. This eliminates the security risk of storing long-lived service account JSON keys in third-party platforms. Automating key rotation still leaves vulnerable credentials in your pipelines.
Q6. Your enterprise is migrating a legacy Java application to a Managed Instance Group (MIG) on Compute Engine. The application requires extensive initialization, taking approximately 3 minutes to load libraries before it can accept traffic. C…
Answer: A. Configure an initialDelaySec (Initialization period) of 240 seconds on the MIG's autohealing policy.
Setting a high initial delay in the autohealing policy gives the instances enough time to initialize before health checks begin. Increasing the check interval globally is a strong distractor, because it would severely delay detecting legitimate application crashes during normal operations.
Q7. Your financial trading firm uses a proprietary high-performance database running on Compute Engine. This database communicates via a custom non-HTTP TCP protocol and requires the client's original source IP address for audit logging and ac…
Answer: C. Use an External Passthrough Network Load Balancer.
An external passthrough network load balancer operates at layer four, routing traffic directly while preserving the client's original IP address. Proxy load balancers terminate connections and mask client IPs, failing the prompt's strict source visibility and low latency requirements.
Q8. A media production company needs to migrate 100 TB of video archives from an on-premises NAS to a Cloud Storage bucket. The on-premises data center is connected to Google Cloud via a dedicated 10 Gbps Interconnect. You want a managed solut…
Answer: A. Install the Storage Transfer Service (STS) agent on-premises and configure a Transfer Job.
Storage Transfer Service is the managed tool designed for large-scale, on-premises to cloud migrations over a high-speed network. Avoid gsutil for massive migrations because scripting lacks centralized monitoring, managed retries, and built-in checksum validation.
Q9. Your retail application running on Cloud Run requires an API key to communicate with a third-party payment processor. Security policies strictly demand that this sensitive key must be encrypted at rest, version-controlled, and never expose…
Answer: C. Store the key in Secret Manager and expose it to the Cloud Run service as an environment variable or mounted volume.
Secret Manager natively integrates with Cloud Run to securely inject versioned secrets at runtime. Plain text environment variables fail the requirement because they are visible in the console to anyone with Viewer access, lacking proper encryption and versioning.
Q10. Your healthcare organization stores patient imaging records in Cloud Storage to meet a 7-year retention compliance mandate. The data is accessed frequently during the first 30 days for diagnosis, occasionally during the next 90 days, and p…
Answer: C. Configure an Object Lifecycle Management policy to downgrade storage classes based on age (Standard -> Nearline -> Coldline -> Archive).
Object Lifecycle Management automatically transitions objects to cheaper storage classes based on age, optimizing costs natively. Writing custom Cloud Functions to move files manually introduces unnecessary execution costs and operational complexity compared to the built-in feature.
Q11. You are tasked with migrating a 2 TB MySQL production database from an on-premises server to Cloud SQL. The business requires the migration to be completed with minimal downtime (less than 5 minutes) to avoid disrupting operations. You nee…
Answer: A. Use the Database Migration Service (DMS) for a continuous migration.
Database Migration Service handles minimal-downtime database migrations by performing an initial dump followed by continuous replication. Using mysqldump requires taking the source offline, resulting in hours of unacceptable downtime during the transfer.
Q12. A gaming startup is building a new mobile RPG. The game needs to store player profiles, inventory, and save states. A critical requirement is offline resilience: players must be able to continue playing and saving progress while disconnect…
Answer: D. Use Firestore.
Firestore provides mobile client SDKs with built-in offline persistence that automatically synchronize local data changes once network connectivity is restored. Memorystore and Spanner are strictly server-side backends, lacking native device-level offline capabilities.
Q13. Your fintech startup is launching a new application composed of 20 distinct microservices handling high-volume financial transactions. The architecture requires complex orchestration, support for custom non-HTTP network protocols, and the…
Answer: B. Deploy the microservices to Google Kubernetes Engine (GKE) Standard clusters.
GKE Standard grants full administrative access to cluster nodes, enabling the installation of required security agents via DaemonSets. App Engine and Cloud Run completely abstract the underlying infrastructure, preventing you from installing custom compliance tools on the host.
Q14. Your global logistics company runs a microservices application on Compute Engine across three regions (us-central1, europe-west1, asia-east1). The internal communication between services must be secure, using only private IPs. To ensure hi…
Answer: A. Deploy a Cross-region Internal Application Load Balancer.
A Cross-region Internal Application Load Balancer provides a single private IP and instant Layer 7 failover across multiple regions. Using DNS geolocation policies with separate regional load balancers is slower, relying on DNS TTLs rather than instant routing.
Q15. Your web application running on Compute Engine needs to connect to a backend Cloud SQL database using the Cloud SQL Auth Proxy for secure connectivity. You are configuring the IAM service account for the Compute Engine instance. The securi…
Answer: C. Grant the service account roles/cloudsql.client.
The Cloud SQL Client role provides the specific permission needed by the Auth Proxy to establish database connections. Granting Editor or Admin violates the least privilege principle because those roles allow unauthorized modifications to the infrastructure.
Q16. You are architecting a secure three-tier web application (Web, App, Database) on Compute Engine. You need to configure firewall rules to allow the Web Tier to communicate with the App Tier. The solution must be highly secure, resilient to…
Answer: A. Create an ingress allow rule on the App Tier targeting the App Service Account, filtering source by the Web Service Account.
Filtering firewall rules by service account tightly couples network access to IAM identities, dynamically adapting to autoscaling without managing IP addresses. Network tags are less secure because users with basic instance permissions could potentially modify them to bypass restrictions.
Q17. Your startup is building a multi-cloud analytics platform where an application hosted in AWS needs to query a database in Google Cloud. You need to establish a secure, high-availability (HA) private connection between the clouds quickly. Y…
Answer: D. Configure HA VPN between AWS and Google Cloud.
HA VPN provides a secure, highly available, and software-only connection between cloud environments without the need for physical hardware. Cross-Cloud Interconnect or Dedicated Interconnect require physical infrastructure, which violates the prompt's budget and time constraints.
Q18. Your media company is establishing a hybrid connection between its on-premises video archive and Google Cloud. You require a dedicated throughput of 8 Gbps immediately, scaling to 20 Gbps next year for 4K video transfer. The connection mus…
Answer: D. Provision a Dedicated Interconnect (10 Gbps circuit) now, and add a second circuit later.
Dedicated Interconnect provides a physical 10 Gbps link that meets the immediate bandwidth requirements and can be scaled by adding circuits. HA VPN relies on the public internet, introducing latency and jitter that would cause video frame drops.
More Google Cloud Associate Cloud Engineer drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.