Practice for the Google Cloud Associate Cloud Engineer exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Your financial institution has hired an external auditor who requires temporary access to a sensitive BigQuery dataset t. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Google Cloud Associate Cloud Engineer practice test →
What you will practice
- Your financial institution has hired an external auditor who requires temporary access to a sensitive BigQuer…
- Your fintech startup operates a payment processing application with "Frontend" and "Backend" tiers located in…
- Your retail company needs to migrate a legacy Java monolith application from on-premises to Google Cloud with…
- You are migrating a mission-critical PostgreSQL application from on-premises to Google Cloud. The app require…
- Your global financial institution is re-platforming its core banking ledger to Google Cloud. The system proce…
- Your team is migrating a web application to a GKE Autopilot cluster. The development team deployed Pods witho…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Your financial institution has hired an external auditor who requires temporary access to a sensitive BigQuery dataset to perform a regulatory compliance check. The contract specifies access for exactly two weeks. You need to ensure their…
Answer: D. Grant the contractor roles/bigquery.dataViewer on the dataset with an IAM Condition request.time < timestamp("2025-XX-XXT00:00:00Z").
Attaching a temporal IAM Condition using the request.time attribute automatically revokes access precisely at the specified timestamp. A resource.name condition is the strongest distractor, but it only restricts resource scope and fails to expire access after the two-week period.
Q2. Your fintech startup operates a payment processing application with "Frontend" and "Backend" tiers located in the same VPC subnet. Security compliance dictates a strict micro-segmentation policy where the Backend must strictly accept TCP p…
Answer: C. Create a firewall rule allowing tcp:8080, targeting the Backend Service Account, with a Source Filter of the Frontend Service Account.
Using service accounts for target and source filters provides strict, identity-based micro-segmentation that remains secure during IP changes. Network tags are the strongest distractor, but they are legacy strings easily modified by users, making them less secure.
Q3. Your retail company needs to migrate a legacy Java monolith application from on-premises to Google Cloud within a strict two-week deadline. The application requires a specific older OS kernel version and depends on local persistent disk st…
Answer: C. Deploy the application to Google Compute Engine (GCE) instances using a Managed Instance Group (MIG).
Compute Engine with a Managed Instance Group supports specific OS kernels and local state for a direct infrastructure lift-and-shift. GKE is the strongest distractor, but containerizing a stateful monolith requires extensive code changes and violates the deadline.
Q4. You are migrating a mission-critical PostgreSQL application from on-premises to Google Cloud. The app requires strict "minimal code changes." Currently, running complex analytical queries on the live transactional data causes severe perfor…
Answer: D. Migrate to AlloyDB for PostgreSQL.
AlloyDB for PostgreSQL maintains full compatibility while using a columnar engine to accelerate analytics without impacting transactional performance. Cloud SQL is the strongest distractor, but it lacks specialized analytical acceleration and suffers from bottlenecks.
Q5. Your global financial institution is re-platforming its core banking ledger to Google Cloud. The system processes payments simultaneously across North America, Europe, and Asia and requires strict external consistency (ACID) to prevent dou…
Answer: D. Migrate to Cloud Spanner (Enterprise Edition).
Cloud Spanner is the correct choice because it provides global horizontal scalability while maintaining strict ACID compliance through external consistency. For the exam, remember that Cloud SQL fails this requirement because it only scales vertically and relies on eventually consistent read replicas globally.
Q6. Your team is migrating a web application to a GKE Autopilot cluster. The development team deployed Pods without specifying any CPU or memory requests in their deployment manifests. After deployment, you notice that the Pods are running but…
Answer: B. Autopilot automatically sets default CPU and memory requests based on pre-configured values
GKE Autopilot automatically applies pre-configured default resource requests to pods when they are not explicitly defined in the deployment manifest. A practical exam tip is that Autopilot tailors its infrastructure to your exact needs by strictly enforcing resource requests on all deployed workloads.
Q7. Your analytics platform processes a queue of complex mathematical modeling tasks pushed to a Pub/Sub topic. Each task requires consistent compute resources and takes between 30 to 50 minutes to complete. You need a reliable architecture th…
Answer: B. Deploy the worker application to a GKE Standard cluster using a Horizontal Pod Autoscaler (HPA) with Pub/Sub metrics.
GKE Standard is ideal for long-running batch tasks, allowing workers to pull messages and process them for up to fifty minutes without platform timeouts. Cloud Functions and App Engine are optimized for short-lived requests, making them vulnerable to timeout failures.
Q8. You are creating a Cloud Storage bucket to store highly sensitive customer financial data. You need to ensure the data is protected against unauthorized access and complies with strict encryption requirements where you manage the keys. Whi…
Answer: B,D. Customer-Managed Encryption Keys (CMEK). || Uniform Bucket-Level Access.
Customer-Managed Encryption Keys allow you to control encryption keys via Cloud KMS for compliance. Uniform Bucket-Level Access disables legacy ACLs and enforces IAM policies uniformly across the bucket to prevent accidental data exposure.
Q9. Your company is migrating a legacy Windows-based HR application to Google Cloud. The application stores employee records on a file server, and Windows employees access these files directly from their workstations using mapped network drive…
Answer: B. Provision Google Cloud NetApp Volumes and create an SMB share integrated with Active Directory.
Google Cloud NetApp Volumes natively supports the SMB protocol required for Windows network drives and native ACLs. Filestore uses NFS, which lacks native Windows UNC path support and standard Windows permission management.
Q10. Your retail analytics team needs to query 5 petabytes of historical sales data to generate quarterly trend reports. The team consists of business analysts who are proficient in Standard SQL but have no experience managing infrastructure or…
Answer: C. Use BigQuery.
BigQuery is the correct choice because it is a fully managed, serverless enterprise data warehouse that scales automatically to handle petabytes of data using standard SQL. For the exam, remember that Dataproc requires cluster management, while Cloud SQL and AlloyDB face strict storage limits or transactional bottlenecks.
Q11. Your retail company is launching a massive global e-commerce platform expecting millions of users. You need to secure user data by terminating SSL/TLS traffic at the edge to reduce load on backend VMs. Additionally, marketing requires that…
Answer: C. Use a Global External Application Load Balancer and enable Cloud CDN.
A Global External Application Load Balancer combined with Cloud CDN terminates SSL at the edge and caches static assets for worldwide users. A regional load balancer is a strong distractor, but it introduces high latency for global users by operating in a single region.
Q12. Your organization is undergoing a security audit. The auditor demands a report identifying the specific email addresses of users who performed SELECT queries against a Cloud SQL database containing sensitive PII. You check the Logs Explore…
Answer: D. You must explicitly enable "Data Access" audit logs for the Cloud SQL API.
Data Access audit logs capture user queries and must be explicitly enabled because they are disabled by default. Admin Activity logs are the strongest distractor, but they only capture control-plane changes, meaning SQL queries remain completely invisible.
Q13. A developer on your team needs to test a Python script locally that interacts with Google Cloud APIs. The script is designed to run as a specific service account in production. To adhere to security best practices, you want to enable the d…
Answer: A. Grant the developer roles/iam.serviceAccountTokenCreator and use gcloud auth impersonate-service-account.
Granting the token creator role allows developers to impersonate the service account using short-lived access tokens via the gcloud CLI. Downloading a JSON key is the strongest distractor, but it violates security best practices by creating risky permanent credentials.
Q14. Your organization has a central platform team responsible for auditing the configuration and compliance status of all Google Kubernetes Engine (GKE) clusters across the company hierarchy. This team requires read-only visibility into the cl…
Answer: D. Grant roles/container.clusterViewer to the team at the Organization level.
The container.clusterViewer role is granted because it specifically provides read-only access to Kubernetes API objects like pods and deployments. Note that container.viewer might also be a defensible choice for broad read-only access, which makes this question slightly ambiguous when selecting the single best fit.
Q15. You are troubleshooting a critical connectivity failure where a VM in your VPC is unable to reach an internal IP address via Cloud VPN. You suspect a routing or firewall issue but need immediate assistance to analyze the configuration. You…
Answer: A. Use Gemini Cloud Assist and ask, Why can't VM A connect to IP X.X.X.X?" to trigger a network troubleshooting investigation."
Gemini Cloud Assist is context-aware and integrated directly into the console to analyze live configurations. The Recommender API focuses on cost and security insights, not interactive troubleshooting or root cause analysis.
Q16. You are managing a "Sandbox" project for interns with a strictly limited budget. If the monthly costs hit 100% of the allocated budget, you want to automatically stop all running Compute Engine instances in that project to prevent any furt…
Answer: C. Configure a Budget Alert connected to a Pub/Sub topic, which triggers a Cloud Run Function to stop the instances.
Routing budget alerts through Pub/Sub to trigger a Cloud Function is the standard programmatic pattern for automated cost control. Google Cloud lacks a native hard spending cap, so you must deploy this serverless architecture. Email alerts alone require slow, manual human intervention.
Q17. You're setting up DNS for a new company domain (example.com) in Cloud DNS. Your requirements are: The main website (example.com) should resolve to your web server at IP address 203.0.113.50. The subdomain www.example.com should point to th…
Answer: G. Create an A record for example.com pointing to 203.0.113.50, a CNAME record for www.example.com pointing to example.com, and MX records pointing to Google's mail servers
An A record maps the apex domain to an IPv4 address, while a CNAME aliases the www subdomain to that apex. MX records are strictly required to route email to the proper mail servers. Remember that CNAME records cannot point directly to IP addresses.
More Google Cloud Associate Cloud Engineer drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.