Practice for the Google Cloud Associate Cloud Engineer exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Your company runs a real-time financial trading application serving customers primarily in North America. The applicatio. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Google Cloud Associate Cloud Engineer practice test →
What you will practice
- Your company runs a real-time financial trading application serving customers primarily in North America. The…
- You manage a GKE cluster running a stateful database application. You need to implement a disaster recovery s…
- Your company is onboarding 50 new software engineers. The security team requires that no source code is store…
- You are reviewing the security posture of a production project. You notice that several developers have been…
- A security auditor requires a report showing the exact configuration of all VPC Firewall rules in your projec…
- You are running a large-scale batch processing job that involves analyzing terabytes of image data. The job i…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Your company runs a real-time financial trading application serving customers primarily in North America. The application generates transaction logs that must be stored with high availability and minimal data loss risk during regional outa…
Answer: A. Create a dual-region bucket in NAM4 (us-central1 + us-east1) with turbo replication enabled
Turbo replication on a dual-region bucket guarantees an SLA-backed fifteen-minute recovery point objective across regions. Default replication on either multi-region or dual-region buckets only provides a twelve-hour RPO, failing the compliance requirement.
Q2. You manage a GKE cluster running a stateful database application. You need to implement a disaster recovery strategy that allows you to restore the entire application, including its Persistent Volume data and Kubernetes manifests, to a new…
Answer: B. Use the "Backup for GKE" feature to create a plan that backs up both config and Persistent Volume Claims (PVCs) to a multi-region bucket.
Backup for GKE captures both application manifests and persistent volume claims in a consistent, managed backup suitable for cross-region restore. Manual disk snapshots lack configuration consistency, and regional disks only protect against zonal failures.
Q3. Your company is onboarding 50 new software engineers. The security team requires that no source code is stored on local laptops, all developer environments run inside the corporate VPC, and each engineer starts with a consistent pre-approv…
Answer: C. Cloud Workstations, which provides managed, container-defined developer environments running inside your VPC with administrator-controlled configurations applied consistently across all developers.
Cloud Workstations provides managed, container-defined developer environments that run inside your VPC and support pre-approved configurations. Cloud Shell lacks persistent workspaces, and Compute Engine VMs lack centralized administrative control.
Q4. You are reviewing the security posture of a production project. You notice that several developers have been granted the Owner primitive role at the project level. To follow Google's best practices and the principle of least privilege, you…
Answer: C. Use the IAM Recommender to view the "Role recommendations" for the project.
The IAM Recommender automatically analyzes historical permission usage to suggest replacing broad primitive roles with narrower predefined roles. Policy Analyzer only shows current policy bindings without evaluating actual usage over time.
Q5. A security auditor requires a report showing the exact configuration of all VPC Firewall rules in your project as they existed 10 days ago. The rules have been modified multiple times since then. What should you do?
Answer: D. Use Cloud Asset Inventory to export the resource metadata to Cloud Storage, specifying the snapshotTime as 10 days ago.
Cloud Asset Inventory supports time travel, allowing you to export and view the exact resource metadata from a specific historical timestamp. Cloud Logging only records individual change events, not the complete state of all resources at a given time.
Q6. You are running a large-scale batch processing job that involves analyzing terabytes of image data. The job is fault-tolerant, meaning if a processing node stops, the work can be retried by another node without data loss. You want to run t…
Answer: A. Create Spot VMs within a Managed Instance Group (MIG). Configure the application to handle potential preemptions by saving checkpoints.
Spot VMs provide the deepest discounts for fault-tolerant batch workloads, and a Managed Instance Group automatically replaces preempted instances. Remember that Automatic Restart is strictly incompatible with Spot and Preemptible VMs, so relying on a group is necessary.
Q7. You are configuring autoscaling for a Managed Instance Group (MIG) that serves a high-traffic HTTP application behind a Load Balancer. You want the group to scale out when the incoming request rate exceeds 50 requests per second (RPS) per…
Answer: B. Configure the Backend Service with "Rate" balancing mode and "Maximum RPS" of 50. Set the autoscaler to target a utilization percentage of that capacity.
To scale based on specific requests per second, you configure the Backend Service with a maximum RPS limit, then the autoscaler targets a percentage of that capacity. Simply guessing a utilization percentage fails because the backend needs to know the instance limit.
Q8. You are using Cloud Build to build container images. Your build process requires access to a private package repository hosted in an on-premises network connected via Cloud VPN. The standard Cloud Build workers cannot reach this private ne…
Answer: C. Create a Cloud Build Private Pool peered to your VPC.
Creating a Cloud Build private worker pool peered to your VPC provides the necessary network route to your on-premises repository. Modifying IAM roles will not solve this because authorization does not establish network connectivity.
Q9. You need to deploy a streaming data pipeline to process log data from Pub/Sub and write it to BigQuery. You want to use a pre-built Google-provided template to avoid writing custom Java/Python code. You also need to ensure that the pipelin…
Answer: A. Use a Dataflow Flex Template.
Dataflow Flex Templates package your pipeline within a custom Docker container, allowing you to include specialized dependencies. Classic Templates are restricted to a fixed runtime environment and cannot load custom system-level dependencies.
Q10. You are deploying a mission-critical PostgreSQL database on a single Compute Engine instance. The database must have High Availability (HA) storage that can survive a complete zonal outage with an RPO (Recovery Point Objective) of zero (no…
Answer: B. Regional Persistent Disk (pd-balanced or pd-ssd) configured with synchronous replication.
Regional Persistent Disks synchronously replicate data across two zones, achieving an RPO of zero for zonal failover. Local SSDs are ephemeral and snapshot schedules cannot provide immediate recovery without some data loss.
Q11. Your development team wants to deploy containerized microservices to GKE with serverless features like automatic scaling (including scale-to-zero), traffic splitting between revisions, and HTTP-based routing—without having to directly mana…
Answer: B. Deploy applications using Knative serving on GKE. It provides serverless abstractions on top of Kubernetes with automatic scaling, traffic management, and revision control while running on your own GKE cluster with full portability.
Deploying with Knative serving on GKE delivers serverless abstractions like scale-to-zero on your own cluster. Fully managed Cloud Run is incorrect here because it abstracts away your cluster control and prevents on-premises deployment.
Q12. You are deploying a new workload to a Google Kubernetes Engine (GKE) cluster. The container image for the workload is stored in a private Artifact Registry repository named app-repo. The Pods are failing to start, and the status displays a…
Answer: C. Grant the Artifact Registry Reader (roles/artifactregistry.reader) role to the GKE Node Service Account on the app-repo repository.
Granting the Artifact Registry Reader role to the GKE Node Service Account provides the exact permissions needed to pull private images. The Storage Object Viewer role is an outdated legacy approach from the Container Registry era.
Q13. Your application team reports that their Cloud SQL for MySQL database has been experiencing slow performance during peak hours. They suspect certain queries are consuming excessive resources but don't know which ones are causing the issues…
Answer: B. Enable Query Insights to monitor database load and identify resource-intensive queries
Cloud SQL Query Insights is the native tool that automatically captures query latency and resource consumption without custom code. Relying on Cloud Logging exports to BigQuery requires extensive manual configuration that Query Insights handles natively.
Q14. You are designing a solution for a microservices application that consists of stateless HTTP containers. The application has highly variable traffic patterns, often dropping to zero requests at night. You want to minimize costs by paying o…
Answer: A. Cloud Run configured with the default autoscaling settings.
Cloud Run automatically scales to zero, ensuring you only pay when code executes. Compute Engine MIGs and App Engine Flexible require baseline instances, incurring costs even without traffic.
Q15. Your team runs analytical queries against a very large BigQuery table (events_raw) that stores application logs for the last three years. Several users complain that their queries are slow and expensive, especially when they only need data…
Answer: A. Recreate the table as a partitioned table based on a timestamp column, and ensure queries filter on the partition column.
Partitioning a table by timestamp limits data scanned to specific partitions, reducing costs and improving speed. Clustering alone does not reduce query costs since the entire table is still processed.
Q16. Your organization stores sensitive data in Cloud Storage buckets encrypted with CMEK. Your security policy requires regular key rotation. A junior engineer rotates the Cloud KMS CryptoKey by creating a new primary key version. They then as…
Answer: A. No. Rotating the key does not re-encrypt existing objects. Objects written before the rotation are still protected by the previous key version, which must remain enabled until those objects are re-encrypted or deleted.
Rotating a Cloud KMS key creates a new primary version but does not re-encrypt existing objects. Older objects remain tied to their original version, so disabling it prematurely makes them inaccessible.
Q17. You want to build an event-driven solution where a Cloud Run service is automatically triggered whenever a new object is uploaded to a Cloud Storage bucket. You want to use a fully managed, native integration without manually managing Pub/…
Answer: D. Create an Eventarc trigger for Cloud Storage events and configure it to invoke the Cloud Run service.
Eventarc provides native event routing to Cloud Run, abstracting away underlying infrastructure. Manually configuring Pub/Sub requires writing custom integration logic and managing separate resources.
More Google Cloud Associate Cloud Engineer drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.