Practice for the Google Cloud Associate Cloud Engineer exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: You are architecting a massive IoT ingestion platform for a smart city initiative. The system collects telemetry from 50. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Google Cloud Associate Cloud Engineer practice test →
What you will practice
- You are architecting a massive IoT ingestion platform for a smart city initiative. The system collects teleme…
- Your healthcare organization stores patient records in Cloud Storage and Cloud SQL. A new compliance regulati…
- Your e-commerce company is migrating a critical 3-tier web application (Web, App, Database) to Google Cloud…
- Your manufacturing company stores proprietary product blueprints in a Cloud Storage bucket within a secure pr…
- Your media company is deploying a public-facing REST API to serve metadata for viral videos. Traffic patterns…
- Your financial trading platform requires a real-time analytics engine to ingest massive volumes of market dat…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. You are architecting a massive IoT ingestion platform for a smart city initiative. The system collects telemetry from 50 million sensors, generating millions of write events per second. You need a database that offers single-digit millisec…
Answer: C. Use Bigtable.
Bigtable is a wide-column NoSQL database engineered for high-throughput operational workloads with single-digit millisecond latency. Firestore has strict throughput limits, and Cloud SQL scales vertically, making them unsuitable for massive IoT ingestion.
Q2. Your healthcare organization stores patient records in Cloud Storage and Cloud SQL. A new compliance regulation requires a granular audit trail identifying exactly which user accessed or viewed specific sensitive data records. The current…
Answer: D. Go to IAM & Admin > Audit Logs and enable "Data Access" logs for Cloud Storage and Cloud SQL.
Data Access audit logs capture operations that read configuration or data, such as storage object views or SQL queries. Admin Activity logs are enabled by default but only capture administrative changes, not user data reads.
Q3. Your e-commerce company is migrating a critical 3-tier web application (Web, App, Database) to Google Cloud. While the database will move to Cloud SQL, the Web tier must remain on virtual machines to minimize immediate refactoring. The Web…
Answer: D. Deploy the Web tier to a Regional Managed Instance Group (MIG) with an External Application Load Balancer.
A Regional Managed Instance Group distributes VMs across multiple zones, ensuring high availability during zonal failures. An External Application Load Balancer intelligently routes traffic and works with the group to handle variable customer demand.
Q4. Your manufacturing company stores proprietary product blueprints in a Cloud Storage bucket within a secure project. You need to prevent authorized employees, who have valid read permissions, from exfiltrating this intellectual property by…
Answer: D. Configure a VPC Service Controls (VPC-SC) perimeter around the project and restrict data egress.
VPC Service Controls define a security perimeter that blocks data exfiltration even if users have valid IAM permissions. Cloud DLP scans for sensitive text but cannot block API calls used to copy data to external projects.
Q5. Your media company is deploying a public-facing REST API to serve metadata for viral videos. Traffic patterns are highly volatile, spiking to millions of requests in seconds during trends and dropping to zero for hours at night. To maintai…
Answer: B. Deploy the API to Cloud Run.
Cloud Run automatically scales containers from zero to thousands of instances and charges only for exact compute time. GKE Autopilot and Compute Engine require baseline resources, meaning you pay a constant cost even when traffic drops to zero.
Q6. Your financial trading platform requires a real-time analytics engine to ingest massive volumes of market data. The system must calculate moving averages with sub-second latency, detect fraud patterns, and handle out-of-order data using ad…
Answer: B. Use Dataflow with Streaming Engine enabled.
Dataflow with Streaming Engine is the correct choice because it provides a fully managed Apache Beam environment optimized for sub-second latency, advanced windowing, and watermarking. Dataproc is a weaker distractor because managing cluster scaling for wildly fluctuating traffic is slower and more complex.
Q7. After using Query Insights, you've identified several slow-running queries in your Cloud SQL for MySQL database. The Query Insights dashboard shows that specific queries have high execution times and are consuming significant database reso…
Answer: D. Enable Index Advisor to automatically analyze queries and recommend missing indexes
Index Advisor is correct because it is the native Cloud SQL feature that analyzes query performance and provides automated CREATE INDEX commands. For the exam, remember that Cloud SQL database flags tune configurations, whereas Index Advisor specifically recommends missing indexes.
Q8. Your healthcare organization has a strict data residency mandate requiring all cloud resources (VMs, Buckets, Databases) to be deployed exclusively in US regions to comply with federal regulations. You need to enforce this restriction cent…
Answer: C. Configure an Organization Policy with the gcp.resourceLocations constraint restricted to US locations.
The gcp.resourceLocations organization policy is correct because it acts as a preventative guardrail that blocks resource creation outside of allowed regions. VPC Service Controls is a distractor because it secures data exfiltration rather than restricting physical infrastructure deployment.
Q9. A principal has been granted roles/bigquery.admin at the organisation level. A project owner wants to restrict this principal to read-only access on their specific project. The project owner grants the principal roles/bigquery.dataViewer o…
Answer: D. The principal retains full BigQuery admin access on the project, because IAM allow policies are additive — a more restrictive grant at the child level cannot remove permissions inherited from a parent.
The principal retains admin access because Google Cloud IAM allow policies are additive across the resource hierarchy, meaning child-level grants cannot remove parent permissions. To revoke inherited access, you must use an IAM deny policy instead of adding a more restrictive role.
Q10. Your development team provisions over 50 short-lived testing environments daily using Terraform. Each environment consists of a web server and database VM, runs for only two hours, and is then destroyed. The current on-demand compute costs…
Answer: C. Configure the Terraform scripts to provision Spot VMs (Preemptible) for these environments.
Provisioning Spot VMs is correct because it provides deep discounts for ephemeral, fault-tolerant compute resources with minimal Terraform code changes. Committed Use Discounts fail here because they require long-term commitments unsuitable for short-lived environments.
Q11. Your software development company manages a critical microservice on Cloud Run. You need to enable a senior developer to deploy new revisions to this production service. For security reasons, the developer must have the ability to deploy c…
Answer: A. Grant the user roles/run.developer and roles/iam.serviceAccountUser.
The roles/run.developer and roles/iam.serviceAccountUser combination is correct because it allows deployment and service account impersonation without granting IAM modification rights. The run.admin role is a strong distractor because it incorrectly includes permission to modify service IAM policies.
Q12. You are tasked with optimizing cloud spend for a large fleet of Compute Engine instances. You need a native Google Cloud tool that automatically analyzes historical usage metrics (CPU, RAM) over the last 30 days and provides actionable, on…
Answer: A. Use the Recommender API (Active Assist).
The Recommender API is correct because Active Assist uses machine learning to analyze historical usage and generate actionable rightsizing recommendations. Cloud Monitoring is a distractor because it only displays raw metrics without providing automated optimization advice.
Q13. Your financial services firm processes nightly transaction logs using a containerized batch job. The processing takes approximately 4 hours to complete and is computationally intensive. The job is designed to be fault-tolerant and can resu…
Answer: D. Use Cloud Batch to run the job on Spot VMs.
Cloud Batch with Spot VMs is correct because it is a managed service that automatically handles retries for interrupted, fault-tolerant batch workloads at massive discounts. Cloud Run jobs is a weaker distractor because it lacks deep infrastructure discounting like Spot VMs.
Q14. Your AI startup is deploying a large open-source Large Language Model (LLM) for a generative text application. The model requires NVIDIA L4 GPUs for inference. Traffic is consistent during business hours but drops significantly at night. Y…
Answer: A. Deploy the model to Cloud Run services with GPU allocation.
Cloud Run services with GPU allocation is correct because it provides a fully managed serverless platform that natively supports GPUs and autoscaling. GKE is a strong distractor but fails the requirement because managing node pools violates the strict infrastructure abstraction constraint.
Q15. Your healthcare organization manages sensitive patient data on Compute Engine instances. To comply with HIPAA regulations, the security policy strictly prohibits assigning public IP addresses to any production VM. However, operations engin…
Answer: C. Configure Identity-Aware Proxy (IAP) for TCP forwarding and grant users the roles/iap.tunnelResourceAccessor role.
Identity-Aware Proxy for TCP forwarding wraps SSH connections in HTTPS, tunneling traffic directly to internal IPs without requiring public IPs. A bastion host is a strong distractor, but it directly violates the strict security policy by requiring a public IP address to function.
Q16. Your data team manages a private GKE cluster that needs to connect to MongoDB Atlas, a third-party SaaS provider hosted on Google Cloud. Security policy forbids peering your entire VPC with the vendor due to overlapping IP risks and requir…
Answer: C. Use Private Service Connect (PSC) to create an endpoint for the SaaS provider.
Private Service Connect maps a specific service from another VPC to an internal IP address without requiring full network peering. VPC Network Peering is a strong distractor, but it connects entire networks and fails due to overlapping IP range restrictions.
More Google Cloud Associate Cloud Engineer drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.