Practice for the Google Cloud Associate Cloud Engineer exam with 18 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: You are configuring a new Google Cloud project using the command line. When you attempt to create a virtual machine usin. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Google Cloud Associate Cloud Engineer practice test →
What you will practice
- You are configuring a new Google Cloud project using the command line. When you attempt to create a virtual m…
- You are the Security Administrator for a financial institution. You need to grant a new contractor, ""User A…
- You are deploying a GKE cluster using Autopilot mode. You need to ensure your Pods have enough CPU to handle…
- You are building an event-driven system where messages published to Pub/Sub must be processed by a Cloud Run…
- Your company has a static website hosted at https://myapp.example.com that needs to display images stored in…
- You have deployed a Java-based microservice to Cloud Run. The application takes approximately 15 seconds to i…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. You are configuring a new Google Cloud project using the command line. When you attempt to create a virtual machine using gcloud compute instances create, the command fails with an error stating that the Compute Engine API is disabled. You…
Answer: D. gcloud services enable compute.googleapis.com
The command gcloud services enable compute.googleapis.com activates the Compute Engine API for your project. Remember that API management lives under the gcloud services group, not under the individual compute command groups.
Q2. You are the Security Administrator for a financial institution. You need to grant a new contractor, ""User A,"" SSH access to a specific Linux instance, finance-vm-01, which has OS Login enabled. For security reasons, User A must not have…
Answer: A. Grant User A the Compute OS Login role (roles/compute.osLogin) on the specific finance-vm-01 instance.
Granting the Compute OS Login role at the instance level restricts access to that specific VM without granting sudo privileges. Project-level grants violate the principle of least privilege, and metadata keys are ignored entirely when OS Login is enabled.
Q3. You are deploying a GKE cluster using Autopilot mode. You need to ensure your Pods have enough CPU to handle heavy computation. You have defined resources.requests.cpu: "500m" in your manifest, but the application is performing poorly. You…
Answer: A. Increase the resources.requests.cpu value in the Pod manifest.
Increasing the CPU request in your Pod manifest provisions guaranteed baseline compute for your workloads in Autopilot. You cannot manually configure node pools in Autopilot mode, as Google automatically manages the infrastructure based strictly on your resource requests.
Q4. You are building an event-driven system where messages published to Pub/Sub must be processed by a Cloud Run service. You want Pub/Sub to automatically deliver messages to your Cloud Run service over HTTPS without your service needing to p…
Answer: C. Create a push subscription with the Cloud Run service URL as the endpoint.
A push subscription automatically delivers messages to your Cloud Run service URL over HTTPS, providing a true event-driven architecture. Pull subscriptions require active polling, which directly violates the requirement and adds unnecessary complexity and compute costs.
Q5. Your company has a static website hosted at https://myapp.example.com that needs to display images stored in a Cloud Storage bucket. When users visit the website, their browsers block the images with CORS errors. The bucket contains public…
Answer: A. Set a CORS configuration on the bucket allowing GET requests from https://myapp.example.com
Setting a CORS configuration on the bucket explicitly allows the browser to fetch cross-origin resources securely. Making objects public via IAM only handles authorization, but browsers will still strictly block the requests without the proper CORS headers.
Q6. You have deployed a Java-based microservice to Cloud Run. The application takes approximately 15 seconds to initialize. Users report that the first request after a period of inactivity is extremely slow (cold start), while subsequent reque…
Answer: D. Configure the service with Minimum instances set to 1.
Setting the minimum instances to one ensures Cloud Run keeps a container continuously running, bypassing the cold start entirely. While pinging the service with a scheduler is a common workaround, it is a hack compared to the native min-instances feature.
Q7. A developer in a new Google Cloud project wants to create a Compute Engine N1 VM with an NVIDIA T4 GPU attached for a machine learning workload. They plan to use a standard Debian public image. The instance creation API call fails immediat…
Answer: B. Cause: the new project has zero default GPU quota and the request exceeds it. Post-creation step: manually install NVIDIA drivers, since standard public images do not pre-install them.
New Google Cloud projects start with a default GPU quota of zero, so the API immediately rejects the request until you request and are granted quota. Standard Debian images do not include NVIDIA drivers, so you must manually install them after the VM boots.
Q8. You manage a Google Cloud Organization that contains multiple projects for both North American and European teams. You need to apply a specific Organization Policy constraint only to the European projects. You want to ensure this policy is…
Answer: D. Create a "Europe" Folder. Move the European projects into this Folder and apply the Organization Policy to the Folder.
Applying the policy to a folder ensures all projects inside automatically inherit it, covering future European projects. Organization policies cannot be attached to labels or billing accounts, making folders the correct hierarchical grouping mechanism.
Q9. You are deploying a GKE cluster for a sensitive financial application. The security team requires that the cluster nodes have only private IP addresses and cannot be directly accessed from the internet. However, your CI/CD pipeline, which…
Answer: D. Create a Private Cluster with private nodes (–enable-private-nodes) and public control plane endpoint enabled. Configure Master Authorized Networks to whitelist the CI/CD provider's IP range.
Private clusters keep nodes isolated with internal IPs, while enabling the public endpoint lets external pipelines reach the control plane. Configuring Master Authorized Networks restricts this public access strictly to your CI/CD provider's approved IP ranges.
Q10. A pod running in your GKE cluster uses Workload Identity Federation for GKE to access Google Cloud APIs. The pod calls both the Cloud Storage API and a legacy internal API that does not support federated identity principals. You want to fo…
Answer: D. Use direct resource access for Cloud Storage and service account impersonation for the legacy API.
Direct resource access is recommended for supported APIs like Cloud Storage because it provides a cleaner audit trail. For unsupported legacy APIs, you must fall back to service account impersonation to exchange the federated token for an acceptable credential.
Q11. A developer on your team needs to run a one-time script that requires the Project Editor role to modify resources. You want to grant them these permissions temporarily without permanently attaching the role to their user identity. You have…
Answer: B. Grant the developer the Service Account Token Creator (roles/iam.serviceAccountTokenCreator) role on the specific Service Account.
Granting the Service Account Token Creator role allows the developer to impersonate the account using short-lived credentials. The Service Account User role is incorrect because it only allows attaching the account to compute resources, not CLI impersonation.
Q12. You have built a new container image for your application and pushed it to the Artifact Registry (e.g., us-central1-docker.pkg.dev/my-project/my-repo/my-app:v1). You have also authored a Kubernetes Deployment manifest file named deployment…
Answer: A. kubectl apply -f deployment.yaml
The apply command manages resources declaratively, letting you update configurations by simply rerunning the same command on the file. Imperative commands like create will throw an error if the resource already exists, breaking your update workflow.
Q13. You are designing the backend for a mobile application that stores user profiles, preferences, and activity history. The application requires: Flexible, hierarchical JSON-like data, Real-time synchronization across devices, Offline support…
Answer: D. Firestore (Native mode), because it supports document-based data with real-time and offline capabilities.
Firestore in Native mode is purpose-built for mobile and web applications requiring flexible JSON documents and real-time synchronization. Cloud SQL lacks built-in offline caching, and Bigtable is meant for massive analytical throughput, not mobile client syncing.
Q14. You are responsible for the patch management of a fleet of 50 Compute Engine instances running Linux and Windows. You need to ensure that security and critical patches are automatically applied every Saturday at 2:00 AM. You want to automa…
Answer: A. Create a Patch Deployment and configure it with a recurring schedule for Saturday at 2:00 AM.
Patch Deployments are the correct component because they support recurring schedules and executing pre-patch scripts automatically. A Patch Job is only a one-time execution, so it cannot handle the required weekly schedule.
Q15. You have uploaded a large CSV file to a Cloud Storage bucket: gs://sales-data-bucket/2024-sales.csv You need to make this data available for analysis using BigQuery with minimal manual schema configuration. The dataset does not yet exist i…
Answer: B. Create a new BigQuery dataset, then use the bq load command with schema autodetection enabled to load the data into a new table.
Creating a dataset is required first because BigQuery tables must reside inside datasets. Using the load command with autodetect minimizes manual schema configuration by automatically inferring column types from the CSV header.
Q16. Your security team is investigating a series of unauthorized IAM policy changes that occurred over the past 6 months across multiple projects in your organization. They need to run complex SQL queries to identify patterns, such as "Show al…
Answer: A. Create a Log Router sink that exports Admin Activity audit logs to a BigQuery dataset.
Exporting audit logs to BigQuery provides the SQL interface needed for complex joins and long-term retention required for compliance. Cloud Storage is great for cheap archival but lacks native analytical querying capabilities.
Q17. You have 50 TB of archive data stored on an on-premises NAS appliance. You need to migrate this data to a Cloud Storage bucket. You want a managed solution that handles retries and checksum validation automatically, without requiring you t…
Answer: B. Use Storage Transfer Service for on-premises data.
Storage Transfer Service provides a fully managed solution for large on-premises migrations, handling retries and checksum validation automatically. Command-line tools require writing custom scripts and maintaining compute resources for the duration.
Q18. Your team is running workloads in Google Cloud and you want to prevent unexpected cost overruns. You need to receive an email alert when monthly spend reaches 80% of your budget for a Cloud Billing account. What should you do?
Answer: A. Create a Cloud Billing budget and configure an 80% threshold rule with email notifications enabled.
Cloud Billing budgets with threshold rules are the native way to trigger email alerts when spending reaches a specific percentage. Logging and Monitoring track operational events and uptime, not cumulative spending thresholds.
More Google Cloud Associate Cloud Engineer drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.