Practice for the Google Cloud Associate Cloud Engineer exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: You are migrating a legacy database server to Compute Engine. The application configuration hardcodes the database IP ad. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Google Cloud Associate Cloud Engineer practice test →
What you will practice
- You are migrating a legacy database server to Compute Engine. The application configuration hardcodes the dat…
- You are troubleshooting a complex microservices application running on Google Kubernetes Engine (GKE). Users…
- You are setting up a new VPC network that will connect to your on-premises data center via Cloud VPN. To stri…
- You are looking to optimize costs for your Google Cloud project. You suspect that several reserved static ext…
- You are trying to connect to a Linux instance named db-server using the SSH button in the Google Cloud Consol…
- You are the Shared VPC Admin for your organization. You manage a Host Project named net-host that contains a…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. You are migrating a legacy database server to Compute Engine. The application configuration hardcodes the database IP address as 10.128.0.55. You need to launch a new instance that uses this specific internal IP address, and you must ensur…
Answer: D. Navigate to VPC Network > IP addresses. Click Reserve internal static IP address, specify 10.128.0.55, and select this reserved address when creating the instance.
Reserving a static internal IP address decouples the IP from the VM lifecycle, ensuring it remains available even if the instance is deleted. Custom ephemeral IPs are released upon deletion, making them unsuitable for persistent legacy configurations.
Q2. You are troubleshooting a complex microservices application running on Google Kubernetes Engine (GKE). Users are reporting that specific "Place Order" requests are taking over 5 seconds to complete. You suspect that a backend service is ca…
Answer: A. Use Cloud Trace to view the distributed traces. Select a trace for the "Place Order" request and analyze the waterfall view.
Cloud Trace captures distributed request flows across microservices and displays them in a waterfall view to pinpoint latency bottlenecks. Cloud Monitoring shows aggregate metrics, whereas tracing is required to analyze the individual hops of a single request.
Q3. You are setting up a new VPC network that will connect to your on-premises data center via Cloud VPN. To strictly prevent IP address overlap with your on-premises network (10.0.0.0/8), you need full control over which IP ranges are used in…
Answer: A. Create a Custom mode VPC. Manually define subnets with non-overlapping IP ranges in the specific regions you need.
A custom mode VPC prevents automatic subnet creation, giving you exact control over CIDR ranges to safely avoid overlapping your on-premises network. Auto mode VPCs automatically use 10.128.0.0/9, which risks immediate conflicts, and firewall rules never fix routing issues caused by overlapping IPs.
Q4. You are looking to optimize costs for your Google Cloud project. You suspect that several reserved static external IP addresses are not currently attached to any resources and that some Compute Engine instances have been running with extre…
Answer: B. Navigate to Active Assist (Recommender) in the Google Cloud Console.
Active Assist uses machine learning to automatically identify idle resources and provide actionable recommendations to reduce waste. While budgets alert you to high-level spending increases, they do not automatically identify the specific idle virtual machines or unused IP addresses.
Q5. You are trying to connect to a Linux instance named db-server using the SSH button in the Google Cloud Console. The instance resides in a private subnet and does not have an external IP address. The connection fails with a timeout error af…
Answer: A. Create an ingress allow rule for traffic from the source range 35.235.240.0/20 on TCP port 22.
Creating an ingress allow rule from the 35.235.240.0/20 CIDR block permits traffic specifically from the Identity-Aware Proxy to your private instance. Opening port 22 directly to the internet fails because private VMs lack external IPs and bypasses IAP security.
Q6. You are the Shared VPC Admin for your organization. You manage a Host Project named net-host that contains a Shared VPC with subnets in us-central1 and europe-west1. You need to authorize a developer, Sam, to deploy virtual machines in a s…
Answer: C. Grant Sam the Compute Network User role on the us-central1 subnet in the net-host project.
Granting the Compute Network User role on the specific subnet allows Sam to deploy virtual machines while adhering to least privilege. Granting broader project-level access would unnecessarily permit deployments in other regions.
Q7. You are architecting a hybrid connectivity solution to connect your on-premises data center to Google Cloud. Your requirements are: Capacity: You need a dedicated throughput of 20 Gbps. Security: Data must not traverse the public internet…
Answer: A. Provision four 10 Gbps Dedicated Interconnect connections across two separate metropolitan areas (2 per metro).
Provisioning four 10 Gbps Dedicated Interconnect connections across two metropolitan areas guarantees the 99.99% uptime SLA and ensures private connectivity. Two connections in a single city only provide a 99.9% SLA.
Q8. You are managing a fleet of Compute Engine instances hosting a web application. You need to create a Cloud Monitoring alert policy that triggers when the Memory utilization or Disk space usage on any instance exceeds 85%. However, when you…
Answer: C. Install the Ops Agent on each instance.
Installing the Ops Agent on your instances enables the collection of guest-level metrics like memory and disk utilization. For the exam, remember that Compute Engine only provides hypervisor-level metrics like CPU and network by default.
Q9. You are debugging a production application that interacts with the Compute Engine API. You suspect that the API is returning a high number of 5xx server errors, causing the application to fail. You need to confirm this by viewing the near…
Answer: C. Navigate to APIs & Services > Dashboard, locate the Compute Engine API, and view the "Errors" and "Traffic" graphs.
The APIs and Services Dashboard provides near real-time traffic, latency, and error rates for enabled APIs. Quotas only track allocation limits, not specific HTTP response codes like 5xx server errors.
Q10. Your company runs critical production workloads across multiple Google Cloud projects using Compute Engine, Cloud SQL, and GKE. The SRE team wants a centralized dashboard to view ongoing Google Cloud service disruptions and incidents that…
Answer: B. View the Personalized Service Health dashboard in the Google Cloud Console. It automatically filters and displays incidents relevant to your projects, showing impacted products, regions, and incident status.
The Personalized Service Health dashboard automatically filters global Google Cloud incidents to show only those relevant to your active projects. The public status dashboard lacks this filtering, which often causes unnecessary alert fatigue.
Q11. Your organization's security team has two requirements for all new Cloud Storage buckets created under a specific folder: (1) every bucket must use a CMEK key, and (2) the CMEK key must come only from a designated key management project na…
Answer: C. Apply constraints/gcp.restrictNonCmekServices listing Cloud Storage, and apply constraints/gcp.restrictCmekCryptoKeyProjects listing the kms-central project.
You must apply both organization policy constraints to the folder to enforce your requirements. The restrictNonCmekServices constraint forces CMEK usage, while the restrictCmekCryptoKeyProjects constraint limits those keys to the designated project.
Q12. You are a Cloud Engineer working on two separate projects: bi-analytics-dev (hosted in us-central1) and bi-analytics-prod (hosted in europe-west3). You frequently switch between these contexts in your terminal to run commands. You want to…
Answer: B. Create two named Configurations using gcloud config configurations create. Set the specific project and region properties for each, then switch using gcloud config configurations activate.
Creating and activating named configurations allows you to instantly switch grouped settings like project, region, and zone. Running interactive setup wizards or exporting individual environment variables is inefficient for frequent context switching.
Q13. You are preparing to deploy a complex microservices application to a Google Kubernetes Engine (GKE) cluster. The application consists of multiple Deployments, Services, and ConfigMaps that must be versioned and managed as a single release…
Answer: C. Package your application manifests into a Helm chart and use helm install to deploy it to the cluster.
Packaging manifests into a Helm chart allows you to version, install, and upgrade complex applications as a single release. While applying raw files works, it lacks native package management features like dependency tracking and simple rollbacks.
Q14. A research team is running a large-scale physics simulation across hundreds of compute nodes. Each node must read and write shared dataset files concurrently with sub-millisecond latency and aggregate throughput in the terabytes-per-second…
Answer: B. Google Cloud Managed Lustre, a fully managed parallel file system with sub-millisecond latency and TB/s-scale throughput, purpose-built for HPC and AI workloads requiring concurrent multi-node access.
Managed Lustre is the correct choice because it is a fully managed parallel file system specifically built for high-performance computing workloads requiring massive concurrent access. For the exam, remember that standard Filestore handles general NFS workloads, while Managed Lustre targets sub-millisecond HPC throughput.
Q15. You are the Billing Administrator for your company. You need to monitor the monthly costs of a critical production project, prod-app, to ensure it stays within a $5,000 limit. You want to receive email notifications when the project's spen…
Answer: A. Configure a Budget in the Billing section. Set the amount to $5,000 and define threshold rules for 50%, 90%, and 100%.
Configuring a budget with specified threshold rules correctly tracks spend and sends email alerts without disrupting your resources. A key exam cue is that Google Cloud budgets are purely for monitoring and alerting, as there is no native feature to automatically cap billing or shut down resources.
Q16. You are a Data Analyst using the bq command-line tool to analyze a massive dataset in BigQuery. You have written a complex SQL query and want to verify exactly how many bytes it will process before running it, to ensure it doesn't exceed y…
Answer: D. Run the command bq query –dry_run [QUERY_STRING].
Using the dry run flag with the BigQuery command-line tool returns the exact byte count a query will process without actually executing it or incurring costs. Remember that pricing calculators estimate general monthly costs, but they cannot parse a specific SQL statement to predict its exact scan size.
Q17. You are administering a Cloud SQL for PostgreSQL instance that serves a production application. A developer accidentally ran a script that dropped a critical table at 14:30 UTC today. You need to recover the table to its state at 14:29 UTC…
Answer: A. Use the Clone feature to create a new instance from the source instance, specifying a Point-in-time of 14:29 UTC.
Creating a clone with a specific point-in-time timestamp allows you to recover the lost table while keeping the production database online and unaffected. On the exam, remember that standard automated backups overwrite the existing instance and cause downtime, whereas cloning preserves the original instance.
More Google Cloud Associate Cloud Engineer drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.