Practice for the Google Cloud Associate Cloud Engineer exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: You are deploying a mission-critical web application on Compute Engine in the us-central1 region. The application must r. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Google Cloud Associate Cloud Engineer practice test →
What you will practice
- You are deploying a mission-critical web application on Compute Engine in the us-central1 region. The applica…
- You are the Organization Administrator for your company. You notice that any user in your domain can currentl…
- Your company has three Google Cloud projects: prod-app (production environment), staging-app (staging environ…
- You are in the planning phase for a new data warehousing project. You need to estimate the monthly cost of a…
- You are configuring a Cloud Monitoring alert policy for a group of Compute Engine instances running a mission…
- You are deploying a fleet of Compute Engine instances to host a highly sensitive application. Your security c…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. You are deploying a mission-critical web application on Compute Engine in the us-central1 region. The application must remain available and continue serving traffic even if a single zone (e.g., us-central1-a) experiences a complete infrast…
Answer: D. Create a Regional Managed Instance Group (MIG) in us-central1 and select "Multiple zones" for the target distribution.
A regional Managed Instance Group distributes instances across multiple zones within a region, providing the high availability and single logical management required here. Zonal groups fail entirely if their specific zone goes down, making them incorrect for strict resilience requirements.
Q2. You are the Organization Administrator for your company. You notice that any user in your domain can currently create new Google Cloud projects, leading to resource sprawl and governance issues. You need to restrict project creation privil…
Answer: C. On the Organization resource, remove the Project Creator role (roles/resourcemanager.projectCreator) from the domain-wide principal and grant it to the cloud-admins group.
To restrict project creation, you must modify IAM roles on the organization node by removing default domain-wide access and granting the role to specific administrators. The organization policy constraint mentioned in another option does not exist for this purpose.
Q3. Your company has three Google Cloud projects: prod-app (production environment), staging-app (staging environment), and dev-app (development environment). The SRE team needs to create dashboards and alerting policies that display metrics f…
Answer: A. Create a new Google Cloud project called monitoring-hub. Configure a Metrics Scope on monitoring-hub and add prod-app, staging-app, and dev-app as monitored projects. Grant the SRE team the Monitoring Viewer role on monitoring-hub. All dashboards and alerts created in monitoring-hub will automatically query metrics from all three projects.
A Metrics Scope allows you to view metrics from multiple projects simultaneously within a single host project. Networking controls like VPC peering handle private connectivity and are completely separate from cloud monitoring data aggregation.
Q4. You are in the planning phase for a new data warehousing project. You need to estimate the monthly cost of a proposed architecture that includes BigQuery, Cloud Storage, and several large Compute Engine instances. You want to share this es…
Answer: D. Use the Google Cloud Pricing Calculator to model the resources and generate a shareable estimate URL.
The Google Cloud Pricing Calculator models costs for proposed architectures and provides a shareable link before deployment. Provisioning actual resources to estimate pricing wastes money, while migration tools target on-premises lift-and-shift scenarios.
Q5. You are configuring a Cloud Monitoring alert policy for a group of Compute Engine instances running a mission-critical web server. You need to be notified via email whenever the CPU utilization of any single instance exceeds 90% for more t…
Answer: B. Create an Alert Policy. Select the metric compute.googleapis.com/instance/cpu/utilization. Set the condition to "is above 90%" for a duration of 5 minutes.
The compute dot googleapis dot com slash instance slash utilization metric reflects CPU usage from the hypervisor without requiring an agent. The agent-based metric violates the no-agent rule, while uptime checks only test external reachability.
Q6. You are deploying a fleet of Compute Engine instances to host a highly sensitive application. Your security compliance team requires that the instances strictly prevent the loading of any unsigned drivers or malicious bootloaders during th…
Answer: C. Enable Secure Boot in the Shielded VM options.
Secure Boot halts the boot process entirely if it detects unsigned drivers or unauthorized boot components. Integrity monitoring and virtual TPM modules measure and report system state but do not actively block the system from booting.
Q7. You are configuring a Cloud DNS managed zone for an internal application named intranet-app. The application must be accessible via the hostname app.corp.internal from Compute Engine instances in your prod-vpc network. This hostname should…
Answer: A. Create a Private managed zone with the DNS name corp.internal.. In the zone details, select the prod-vpc network as a visible network.
A private managed zone restricts DNS resolution to authorized VPC networks, hiding your internal records from the internet. Public zones expose records globally, while peering zones only forward queries to another VPC.
Q8. You are architecting a new healthcare application for a hospital network located exclusively in Germany. Your organization has a general policy to deploy all workloads in the us-central1 region to minimize costs and maximize Carbon-Free En…
Answer: A. europe-west3 (Frankfurt) to satisfy the data residency laws and latency requirements.
Legal compliance laws like GDPR act as hard constraints, forcing you to choose specific geographical regions for data residency. Ignoring strict data sovereignty rules to save money or improve sustainability in another country violates legal requirements.
Q9. You are the Organization Administrator for a financial company. You need to ensure that no Virtual Machine instances in the "Internal-Apps" folder can ever be assigned an external public IP address, to strictly prevent direct internet expo…
Answer: C. Configure an Organization Policy on the folder with the constraint "Define allowed external IPs for VM instances" (constraints/compute.vmExternalIpAccess) and set the policy to Deny All.
Setting the compute external IP access organization policy to deny all prevents instances from acquiring public addresses, overriding IAM permissions. Firewall rules block traffic but still allow the public IP assignment you must prevent.
Q10. You manage two projects, project-a and project-b. You need to connect their VPC networks (vpc-a and vpc-b) so that virtual machines in both networks can communicate using internal IP addresses. You have just run the following command in pr…
Answer: A. Run the equivalent gcloud compute networks peerings create command in project-b to peer vpc-b with vpc-a.
VPC peering requires creating matching configurations on both networks because Google Cloud uses a decentralized model without an accept request. The status remains inactive until the reciprocal peering connection is created in the second project.
Q11. You have deployed a new Compute Engine instance named data-loader to process files. You attached a user-managed Service Account to the instance and granted it the Storage Object Admin IAM role. However, when the application on the instance…
Answer: D. Stop the instance. Edit the configuration to set the Access Scopes to "Allow full access to all Cloud APIs". Restart the instance.
Setting access scopes to allow full access to all Cloud APIs resolves the token restriction while strictly relying on IAM roles to enforce least privilege. Granular per-API scopes are considered legacy because they add operational overhead and limit IAM effectiveness.
Q12. You are the Organization Security Administrator. You need to strictly enforce a security requirement across all projects residing in the "Finance" folder. Specifically, you must ensure that no Virtual Machine in any of these projects can r…
Answer: D. Create a Hierarchical Firewall Policy containing a deny rule for tcp:21. Associate the policy with the Finance folder.
Associating a hierarchical firewall policy containing a deny rule enforces centralized security at the folder level. Standard VPC firewall rules are ineffective here because project owners can easily override or delete them.
Q13. You are writing a shell script to automate the provisioning of new environments for your development team. You need to create a new Google Cloud project with the ID dev-app-2024 and place it directly inside a specific Folder (ID 1234567890…
Answer: C. gcloud projects create dev-app-2024 –folder=123456789012
The gcloud projects create command accepts the project ID as a positional argument and uses the folder flag to set the parent. Remember that gcloud commands generally require the resource ID positionally rather than using flags, making the first option invalid.
Q14. You are managing a Compute Engine instance named backend-vm that is deployed in a private subnet without an external IP address. The instance needs to download security patches and updates from a public repository on the internet. You must…
Answer: A. Create a Cloud NAT gateway and a Cloud Router in the same region as the instance.
Cloud NAT provides outbound internet access for private instances without exposing them to inbound connections. Private Google Access only connects your VPC to Google APIs, not the public internet, making it a frequent distractor for patching scenarios.
Q15. You are the Data Engineer for Project A (data-producer), which generates critical analytics events. You publish these events to a Pub/Sub topic named analytics-events. A separate development team working in Project B (data-consumer) has de…
Answer: C. In Project A, grant the Pub/Sub Subscriber role (roles/pubsub.subscriber) to the Project B service account on the analytics-events topic.
Granting the Pub/Sub Subscriber role on the topic in the producer project provides the exact permission needed to attach a cross-project subscription. This adheres to least privilege, whereas granting project-level editor roles would be overly permissive.
Q16. Your company hired an external contractor to help with a production incident for 2 weeks. The contractor needs the Compute Instance Admin role to troubleshoot VM issues in the production project. For security and compliance reasons, you wa…
Answer: A. Grant the Compute Instance Admin role with an IAM Condition that includes an expiration timestamp. After March 15, 2026, the role binding still exists in the IAM policy but the condition evaluates to false, preventing any access.
IAM Conditions allow you to bind a role with a time limit, automatically denying access once the specified timestamp passes. For temporary contractor access, rely on this native expiration feature rather than custom Cloud Scheduler jobs or manual revocation.
Q17. You need to grant a group of developers SSH access to a specific fleet of private Compute Engine instances that do not have external IP addresses. You have decided to use the "SSH" button in the Google Cloud Console, which uses Identity-Aw…
Answer: C. Grant the IAP-secured Tunnel User role (roles/iap.tunnelResourceAccessor) to the group.
Using the console SSH button for private instances routes traffic through Identity-Aware Proxy, which requires the IAP-secured Tunnel User role. Compute Instance Admin allows VM management but lacks the specific permission to establish the IAP tunnel.
More Google Cloud Associate Cloud Engineer drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.