Practice for the Google Cloud Associate Cloud Engineer exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: You are deploying a new version of a critical microservice hosted on Cloud Run. To minimize risk, you want to perform a . Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Google Cloud Associate Cloud Engineer practice test →
What you will practice
- You are deploying a new version of a critical microservice hosted on Cloud Run. To minimize risk, you want to…
- You are deploying a high-performance database on a C3 series Compute Engine instance. The database workload r…
- You are managing a Compute Engine instance named data-processor-v1. This instance has a Persistent Disk conta…
- You need to manage SSH access to your Linux fleet. You want to enforce 2-Step Verification (2FA) for all SSH…
- Your company manages 5,000 users and multiple groups in an on-premises Active Directory (AD). You need to pro…
- You are managing a Managed Instance Group (MIG) that currently uses an instance template named web-server-v1…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. You are deploying a new version of a critical microservice hosted on Cloud Run. To minimize risk, you want to perform a canary release by routing only 5% of production traffic to the new revision, while the remaining 95% continues to go to…
Answer: D. Deploy the new revision with the "Serve this revision immediately" setting disabled. In the "Manage Traffic" tab, assign 5% of traffic to the new revision and 95% to the existing revision.
Cloud Run supports native traffic splitting between revisions for canary deployments. Deploy the new revision without serving traffic, then manually adjust percentages in the console.
Q2. You are deploying a high-performance database on a C3 series Compute Engine instance. The database workload requires 250,000 IOPS to handle peak transaction volumes. You want to provision this storage performance independently of the disk…
Answer: D. Hyperdisk Extreme
Hyperdisk Extreme provisions IOPS and capacity independently, avoiding disk over-provisioning. Local SSDs are ephemeral, causing data loss on instance stop, making them unsuitable for durable databases.
Q3. You are managing a Compute Engine instance named data-processor-v1. This instance has a Persistent Disk containing critical business data. You need to configure an automated backup strategy that meets the following requirements: A new snap…
Answer: C. Create a Snapshot Schedule resource with a daily frequency and a 14-day retention policy. Attach this schedule to the Persistent Disk.
Snapshot schedules provide the native, fully managed way to automate persistent disk backups with retention rules. Creating custom Cloud Functions or cron jobs violates the requirement to avoid custom scripts, and Cloud Storage lifecycle rules don't apply to block storage.
Q4. You need to manage SSH access to your Linux fleet. You want to enforce 2-Step Verification (2FA) for all SSH connections and ensure that when an employee leaves the company, their access is revoked immediately across all VMs. What should y…
Answer: C. Enable OS Login on the project and enforce 2-Step Verification in Google Workspace.
Enabling OS Login ties SSH access directly to Google Workspace identities, enforcing two-step verification and providing immediate revocation. Managing static keys via startup scripts lacks real-time synchronization, creating severe security gaps when employees leave the company.
Q5. Your company manages 5,000 users and multiple groups in an on-premises Active Directory (AD). You need to provision these users and groups into Cloud Identity so they can be assigned IAM roles in Google Cloud. The solution must automatical…
Answer: C. Install and configure Google Cloud Directory Sync (GCDS) on a server within your on-premises network.
Installing Google Cloud Directory Sync on an on-premises server securely automates user and group synchronization from Active Directory. SAML only handles authentication, not full lifecycle management, and manual CSV uploads fail to meet the automated synchronization requirement.
Q6. You are managing a Managed Instance Group (MIG) that currently uses an instance template named web-server-v1. You need to update the group so that all new and existing instances use a new configuration with a larger boot disk and a differe…
Answer: C. Use the gcloud compute instance-groups managed set-instance-template command to set the new template, then start a Rolling Update.
Setting a new instance template and initiating a rolling update applies changes with minimal disruption. Instance templates are immutable, so editing them is impossible, and deleting the entire group causes a complete service outage.
Q7. You have deployed a Cloud SQL instance for PostgreSQL in your test environment. An application running on a private GKE cluster needs to connect to this database, but the connection from the application to Cloud SQL is failing. You notice…
Answer: C. Enable private IP for the Cloud SQL instance so it can be accessed via the VPC's internal network, and configure VPC Private Services Access if needed.
Enabling a private IP address routes traffic internally through your VPC without exposing the database to the internet. Authorized networks fail because private GKE pods lack predictable public IPs, and the Auth Proxy still requires underlying network connectivity to function.
Q8. Your organization runs a PostgreSQL database for a mission-critical financial application that requires both high-volume transactional processing and real-time analytical queries on the same data. You need 4x faster transactional performan…
Answer: A. Deploy AlloyDB for PostgreSQL. It provides a built-in columnar engine for HTAP workloads, separates compute and storage for independent scaling, and delivers 4x faster transactions with up to 100x faster analytics compared to standard PostgreSQL.
AlloyDB is the designated solution for hybrid transactional and analytical workloads, offering the requested four times transactional and one hundred times analytical speed improvements. Cloud SQL read replicas cannot match this performance because they lack a columnar engine.
Q9. Your organization runs a multi-tenant GKE cluster where three different application teams (payments, orders, and shipping) need to expose their services externally. The platform team wants to maintain centralized control over TLS certifica…
Answer: D. Deploy a shared Gateway resource in an infrastructure namespace with HTTPRoute resources in each team's namespace
Using a shared Gateway resource separates infrastructure management from application routing, allowing teams to attach independent HTTPRoutes. Traditional Ingress relies on vendor-specific annotations for advanced traffic splitting and requires consolidating routing rules.
Q10. You are troubleshooting a deployment in your GKE cluster. The Pods for a specific application named data-processor are repeatedly crashing and restarting. When you inspect the Pod status, you see the reason is OOMKilled. You determined tha…
Answer: B. Update the deployment manifest to increase the resources.limits.memory to at least 600 MiB.
Increasing the memory limit resolves the Out of Memory crash while still preventing the container from consuming unlimited node resources. Remember that Kubernetes uses requests for scheduling, but enforces hard shutdowns based strictly on the configured limits.
Q11. You need to grant a developer permissions to deploy new versions and configure traffic splitting for an App Engine application using a SINGLE predefined role. The developer must not have permission to view or modify other resources in the…
Answer: C. Grant the developer the roles/appengine.appAdmin role on the project, and grant roles/iam.serviceAccountUser on the App Engine service account.
The App Engine App Admin role allows deploying versions and configuring traffic, but it must be paired with Service Account User for deployments. Note that the wording asks for a single predefined role, yet correctly deploying requires granting an additional role.
Q12. You are working on a security-sensitive project where the predefined IAM roles are too broad. For example, the Cloud Functions Developer role allows users to delete functions, but you want your junior developers to only be able to create a…
Answer: B. Permissions in a Custom Role might stop working if the underlying API features are deprecated or if the permissions are renamed by Google.
Permissions in custom roles might break if Google deprecates or renames the underlying APIs. Unlike predefined roles that Google maintains automatically, you must manually update custom roles when permissions change.
Q13. Your team needs to deploy a complex multi-tier application to GKE that includes a web frontend, application backend, Redis cache, and PostgreSQL database. You want to use pre-packaged, version-controlled deployment templates that can be ea…
Answer: C. Deploy the application using Helm charts. Helm provides package management for Kubernetes with templated manifests, versioned releases, customizable values files, and built-in rollback capabilities.
Helm packages Kubernetes applications into versioned charts with templated manifests and rollback support. Plain kubectl lacks built-in lifecycle management, making rollbacks error-prone.
Q14. You are developing a backend application that will run on a Compute Engine virtual machine. The application needs to read files from a specific Cloud Storage bucket and write metadata to a Cloud SQL database. Following security best practi…
Answer: C. Create a user-managed Service Account with the required IAM roles. Assign this Service Account to the Compute Engine instance during creation or while stopped.
Attaching a dedicated service account to the VM provides temporary tokens via the metadata server, eliminating long-lived keys. The default service account violates least privilege due to broad permissions.
Q15. A platform engineering team wants to create a library of pre-approved, reusable application infrastructure patterns on Google Cloud. Each pattern should be designable on a visual canvas, generate Terraform-backed code, and be shareable wit…
Answer: C. Application Design Center, which lets platform teams create and share Terraform-backed application templates on a visual canvas so developers can deploy governed applications from pre-approved designs.
Application Design Center is the correct service because it provides a visual canvas for creating shareable Terraform-backed templates. Standard Terraform requires writing code manually, which directly violates the requirement to provide pre-approved designs for developers.
Q16. You have migrated your container images from Container Registry (gcr.io) to a new Artifact Registry repository named app-repo located in the us-east1 region. You need to configure your local Docker client to use the gcloud credential helpe…
Answer: C. Run gcloud auth configure-docker us-east1-docker.pkg.dev.
The correct command explicitly passes the registry's hostname to the credential helper. On the exam, remember that omitting the hostname only configures the legacy Container Registry, while passing the specific domain connects your Docker client to Artifact Registry.
Q17. You are designing a caching layer for a global e-commerce application using Google Cloud Memorystore for Redis. The application requires high availability. If the primary Redis node fails, you need the system to automatically failover to a…
Answer: A. Standard Tier
Memorystore for Redis Standard Tier provides high availability through automatic cross-zone replication and failover. Basic Tier offers no replication, meaning a node failure results in complete cache loss.
More Google Cloud Associate Cloud Engineer drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.