Practice for the Google Cloud Associate Cloud Engineer exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: You are architecting a global financial ledger application that will process payments for users in North America, Europe. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Google Cloud Associate Cloud Engineer practice test →
What you will practice
- You are architecting a global financial ledger application that will process payments for users in North Amer…
- You manage a Custom Mode VPC network named prod-vpc with a subnet named app-subnet in the us-central1 region…
- You are the IAM Administrator for a rapidly growing organization. You need to grant the Compute OS Login role…
- You frequently use Google Cloud Shell to manage your resources. You recently used sudo apt-get install to ins…
- You are deploying an application on AWS EC2 that needs to read data from a private Google Cloud Storage bucke…
- You are developing a Python application that runs on a Compute Engine instance. You need to track a custom bu…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. You are architecting a global financial ledger application that will process payments for users in North America, Europe, and Asia. The application has the following strict requirements: Global Strong Consistency: Financial transactions mu…
Answer: D. Cloud Spanner with a multi-region instance configuration.
Cloud Spanner with a multi-region configuration provides the required global strong consistency, relational SQL interface, and a 99.999 percent availability service level agreement. Cloud SQL lacks horizontal scalability, while Bigtable and Firestore are NoSQL solutions that do not offer external consistency.
Q2. You manage a Custom Mode VPC network named prod-vpc with a subnet named app-subnet in the us-central1 region. The subnet's primary IP range is 10.1.0.0/24, and it is nearly exhausted of IP addresses due to a growing number of Compute Engin…
Answer: B. Edit the subnet details in the Google Cloud Console and change the IP range to 10.1.0.0/23.
Expanding the primary IP range of an existing subnet is the non-disruptive method to increase available addresses without recreating resources. Secondary ranges are strictly for alias IPs like Kubernetes pods, so they cannot expand the primary address pool needed for standard virtual machines.
Q3. You are the IAM Administrator for a rapidly growing organization. You need to grant the Compute OS Login role to 50 new developers who joined this week. You expect to hire 20 more developers every month. You want to follow Google Cloud bes…
Answer: C. Create a Google Group for the developers. Grant the role to the group email address. Add the developers' accounts to the group.
Creating a Google Group and granting it the IAM role is the recommended practice, allowing you to manage access simply by adjusting group membership. Assigning roles to individual users creates massive policy bloat, and granting access to the entire domain violates the principle of least privilege.
Q4. You frequently use Google Cloud Shell to manage your resources. You recently used sudo apt-get install to install a specific third-party Linux CLI tool required for your workflow. However, when you logged back in the next day, you found th…
Answer: C. Create a script named .customize_environment in your $HOME directory and add the installation commands there.
The customize environment script in your home directory is the designated mechanism for installing system-wide packages that need to run once when Cloud Shell starts. Placing the command in your bash profile runs it inefficiently on every new terminal tab instead of just once per virtual machine boot.
Q5. You are deploying an application on AWS EC2 that needs to read data from a private Google Cloud Storage bucket. You want to avoid managing long-lived Google Service Account keys (JSON files) on the AWS side due to security risks. You need…
Answer: C. Create a Workload Identity Pool and an AWS Provider in Google Cloud. Grant the Workload Identity User role to the AWS IAM role ARN on the Google Service Account.
Creating a Workload Identity Pool establishes the necessary trust to let AWS identities exchange their credentials for short-lived Google Cloud access tokens. Long-lived service account keys are a security risk, and Workload Identity Federation is the modern, keyless best practice for cross-cloud authentication.
Q6. You are developing a Python application that runs on a Compute Engine instance. You need to track a custom business metric named active_queue_depth that measures the number of items currently waiting to be processed. This value fluctuates…
Answer: D. Use the Cloud Monitoring API client library in your application to define a custom metric and write the gauge values periodically.
Using the Cloud Monitoring API to write a custom gauge metric is correct because a gauge represents values that fluctuate up and down over time. A counter metric only increases, making it unsuitable for tracking a dynamic queue depth.
Q7. You are auditing a legacy VPC network to identify and remove unused firewall rules. You plan to use the Hit count column in the Google Cloud Console to identify rules that have processed zero traffic in the last six weeks. However, when yo…
Answer: D. Enable Firewall Rule Logging on the individual firewall rules.
Enabling Firewall Rule Logging on the individual rules is correct because the console uses this specific feature to populate the hit count and last used metrics. VPC Flow Logs sample network traffic at the subnet level but do not populate firewall columns.
Q8. A developer is familiar with attaching NVIDIA GPUs to existing N1 Compute Engine VMs. They now want to use a Cloud TPU for a JAX training job and assume the workflow is the same: create a standard VM first, then attach a TPU to it afterwar…
Answer: A. You provision a TPU VM directly via Compute Engine, GKE, or Gemini Enterprise Agent Platform, where the TPU chips and the host VM are a single integrated unit. You cannot attach a TPU to an existing arbitrary VM.
Cloud TPU VMs are provisioned as an integrated unit of host hardware and TPU chips, completely unlike attaching a GPU to an existing N1 VM. For the exam, remember that network-attached TPU nodes are legacy architecture; modern TPU usage relies entirely on the unified TPU VM model.
Q9. You are deploying a global gaming application that uses UDP for high-speed, real-time player communication. The application is deployed across multiple regions (US, Europe, Asia) to minimize latency. You need a load balancing solution that…
Answer: B. Configure a Regional External Passthrough Network Load Balancer in each region. Use Cloud DNS with a Geolocation routing policy to direct traffic.
Deploying regional passthrough network load balancers with a Cloud DNS geolocation policy correctly handles global UDP routing. Google Cloud lacks a global load balancer supporting raw UDP traffic, and proxy or application load balancers only handle TCP or HTTP protocols.
Q10. Your organization uses Google Kubernetes Engine (GKE) extensively. To unify your operational workflows, you want to manage your Google Cloud infrastructure (such as Cloud SQL instances, Pub/Sub topics, and IAM policies) using the same Kube…
Answer: A. Install and configure Config Connector on your GKE cluster.
Config Connector is a Kubernetes add-on that lets you manage Google Cloud resources using standard declarative YAML manifests. Terraform is incorrect because it uses HashiCorp Configuration Language rather than Kubernetes-native configuration files.
Q11. Your company is migrating a Windows-based enterprise application to Google Cloud. The application requires SMB/CIFS file sharing for user home directories and shared storage for Microsoft SQL Server. The application also needs advanced dat…
Answer: D. Google Cloud NetApp Volumes. It supports both NFS and SMB/CIFS protocols, provides enterprise data management features like snapshots and replication, and offers three performance tiers (Standard, Premium, Extreme) with built-in data efficiency.
Google Cloud NetApp Volumes is the correct choice because it natively supports SMB and CIFS protocols required for Windows workloads. Filestore only supports NFS, making it incompatible with native Microsoft application requirements.
Q12. You manage a sandbox project used for experimental development with a strict monthly budget of $100. You want to receive an automated alert 3 days in advance when Google Cloud forecasts that spending will exceed the budget by month-end, gi…
Answer: C. Configure a Budget of $100 with forecast-based thresholds enabled. Connect it to a Pub/Sub topic and deploy a Cloud Run Function triggered by the topic that sends notifications to your team's Slack channel when forecasted spend exceeds 100%.
Configuring a budget with a forecasted spend threshold and a Pub/Sub topic provides proactive alerts before exceeding your limit. Cloud Monitoring does not expose billing forecast metrics, so you must use the native budget programmatic notifications.
Q13. You are deploying a 3-tier application with frontend and backend Managed Instance Groups that autoscale dynamically. You need to configure a VPC Firewall rule to allow the frontend instances to communicate with the backend instances on TCP…
Answer: B. Create specific Service Accounts for the frontend and backend pools. Create a firewall rule allowing traffic where the Source Service Account is the frontend SA and the Target Service Account is the backend SA.
Using specific service accounts in your firewall rules securely ties network access to virtual machine identity, preventing users with basic instance admin rights from altering tags to bypass controls. Network tags are less secure because anyone who can edit an instance can modify them.
Q14. You configure Workload Identity Federation for a GitHub Actions pipeline using GitHub as the OIDC provider. After testing, a colleague points out that any GitHub Actions workflow across all of GitHub — not just your company's repositories…
Answer: C. Add an attribute condition to the workload identity pool provider that checks the repository_owner_id claim against your organisation's numeric ID.
Adding an attribute condition to the pool provider is correct because it validates specific claims within the incoming token to restrict access. Modifying the issuer URL fails because GitHub uses a single, global issuer endpoint for all organizations.
Q15. Your security team wants to analyze Cloud SQL audit logs to identify all database connection attempts that resulted in authentication failures over the past 30 days. They need to run SQL queries to aggregate and group this data by user and…
Answer: D. Upgrade the log bucket containing the Cloud SQL audit logs to use Log Analytics. Once upgraded, you can write SQL queries directly in the Log Analytics page to query log views and aggregate data without additional BigQuery costs for storage or ingestion.
Upgrading a log bucket to use Log Analytics enables native SQL queries directly within Cloud Logging without requiring BigQuery exports. While Log Analytics is heavily marketed, exporting to BigQuery remains a valid, common architectural choice for complex queries.
Q16. Your organization is setting up a new Google Cloud environment from scratch. You need a turnkey, open-source solution that uses Terraform to bootstrap a complete, production-ready landing zone. This includes the resource hierarchy (Organiz…
Answer: D. The Fabric FAST (Foundational Architecture Solution for Terraform) repository.
Fabric FAST provides a turnkey, open-source Terraform blueprint to bootstrap a production-ready landing zone aligned with enterprise best practices. Deployment Manager is Google's deprecated infrastructure-as-code service and is not recommended for new landing zones.
Q17. You are responsible for managing a large fleet of Cloud SQL and AlloyDB instances across multiple projects in your organization. You need a unified, AI-powered dashboard to proactively identify operational risks, such as databases that are…
Answer: D. Enable Database Center and view the Fleet Health dashboard.
Database Center provides a unified dashboard to proactively identify fleet-wide operational risks like missing backups. Cloud Monitoring tracks performance metrics, whereas this tool specifically evaluates configuration health and optimization.
More Google Cloud Associate Cloud Engineer drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.