Practice for the Google Cloud Associate Cloud Engineer exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Your company wants to migrate containerized workloads to Google Kubernetes Engine (GKE). The operations team wants to mi. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Google Cloud Associate Cloud Engineer practice test →
What you will practice
- Your company wants to migrate containerized workloads to Google Kubernetes Engine (GKE). The operations team…
- You have configured a Compute Engine VM with a specific application stack, security patches, and custom confi…
- Your development team needs to deploy a stateless HTTP API. The application receives unpredictable traffic sp…
- You are managing a fleet of production virtual machines that host critical business applications. Your disast…
- Your web application serves a mix of content through an external Application Load Balancer with Cloud CDN ena…
- You want to enforce strict budget controls on a sandbox project. The requirement is to automatically remove a…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Your company wants to migrate containerized workloads to Google Kubernetes Engine (GKE). The operations team wants to minimize ongoing maintenance overhead. Specifically, they require a solution where Google manages the node configuration…
Answer: B. GKE Autopilot
GKE Autopilot is a fully managed mode where Google handles node provisioning, scaling, and security patching. Standard mode fails the requirements because you still manage the underlying node pools and retain SSH access to the nodes.
Q2. You have configured a Compute Engine VM with a specific application stack, security patches, and custom configuration files. You need to launch 50 identical instances of this VM across three different regions (us-central1, europe-west1, as…
Answer: A. Create a custom image from the source VM's boot disk and reference this image in your Instance Templates.
Creating a custom image from the boot disk lets you reference it globally within instance templates for immediate deployments. Using startup scripts increases boot times because they must download and install dependencies every time a new VM initializes.
Q3. Your development team needs to deploy a stateless HTTP API. The application receives unpredictable traffic spikes, ranging from 0 requests per minute at night to 1000 requests per minute during the day. To minimize costs, the solution must…
Answer: C. Cloud Run with autoscaling and min-instances set to 0.
Cloud Run natively supports scaling to zero when idle and rapidly scales up to handle unpredictable traffic spikes. App Engine Flexible cannot scale to zero, and GKE requires additional tooling to achieve similar scale-from-zero behavior.
Q4. You are managing a fleet of production virtual machines that host critical business applications. Your disaster recovery plan requires daily backups of the persistent disks at 2:00 AM local time. These backups must be retained for exactly…
Answer: C. Create a Snapshot Schedule in Compute Engine with the required frequency and retention policy, and attach it to the persistent disks.
Compute Engine snapshot schedules provide native automated backups with configurable frequencies and retention policies, satisfying the requirements without custom scripts. Avoid cron jobs or Cloud Functions, which require you to write and maintain custom code for creation and deletion.
Q5. Your web application serves a mix of content through an external Application Load Balancer with Cloud CDN enabled. The application serves static assets (images, CSS, JavaScript) that should be cached, but your origin server doesn't current…
Answer: B. CACHE_ALL_STATIC – automatically caches static content based on Content-Type, even when origin doesn't set cache headers
The CACHE_ALL_STATIC mode caches static content based on Content-Type headers even if the origin provides no cache directives. The USE_ORIGIN_HEADERS mode fails here because the origin currently sets no headers, meaning nothing would be cached.
Q6. You want to enforce strict budget controls on a sandbox project. The requirement is to automatically remove all permissions for the project's developers if the monthly spend exceeds 90% of the budget. You need a solution that requires no m…
Answer: A. Create a Budget with a Pub/Sub topic, and trigger a Cloud Run Function to remove IAM bindings.
Cloud Budgets can publish notifications to Pub/Sub when spending thresholds are crossed, allowing an automated Cloud Run Function to revoke IAM permissions. Email alerts fail the requirement because they require manual human intervention to enforce the access changes.
Q7. Your organization is deploying a large fleet of microservices on Compute Engine. You want to implement firewall rules that automatically apply to VMs based on their identity (Service Account). You want to avoid the operational overhead of…
Answer: A. Configure the firewall rules to use Service Accounts as the source and target.
Using service accounts as targets in VPC firewall rules binds security to VM identity rather than mutable network tags. Tags defined in instance templates work for basic deployments, but service accounts provide stronger cryptographic identity and avoid manual tag management.
Q8. Your organization wants to centralize SSH access management for all Compute Engine Linux instances. You need to ensure that developers can SSH into VMs using their Google Workspace credentials. You want to avoid managing individual SSH key…
Answer: C. Enable OS Login by setting the metadata enable-oslogin=TRUE at the project level, and grant developers the roles/compute.osLogin role.
Enabling OS Login links Linux accounts to Google Cloud identities, automatically managing SSH keys through IAM without manual metadata updates. While IAP TCP forwarding secures network connectivity, it does not handle operating system authentication, making OS Login the required component.
Q9. A developer has installed the Google Cloud CLI (gcloud) on a new workstation. They need to authenticate using their user account and ensure that all commands run against the project my-core-app by default. Which TWO commands must they run?
Answer: C,E. gcloud config set project my-core-app || gcloud auth login
Use gcloud auth login to authenticate interactively with user credentials, and gcloud config set project to define the default project. Avoid application-default login because it provisions credentials for application code libraries rather than the CLI itself.
Q10. Your application running on GKE experiences variable traffic. You need the number of Pod replicas to automatically increase when the average CPU utilization across all pods exceeds 70%, and decrease when it drops below that target. What sh…
Answer: B. HorizontalPodAutoscaler (HPA)
The HorizontalPodAutoscaler automatically adjusts the number of pod replicas based on observed CPU utilization. The VerticalPodAutoscaler fails this requirement because it adjusts CPU and memory requests instead of scaling the replica count horizontally.
Q11. You have an application running on a Compute Engine instance that needs to write custom metrics to Cloud Monitoring. To follow the principle of least privilege, which identity and role should you use?
Answer: A. Attach a Service Account to the instance with the roles/monitoring.metricWriter role.
Attach a dedicated service account with the monitoring.metricWriter role to grant write permissions via Application Default Credentials. Avoid downloading JSON keys, as Google recommends against manual key management when native service account attachment is available.
Q12. Your company's public-facing web application behind an external Application Load Balancer is experiencing frequent DDoS attacks from multiple IP addresses. Security logs show that some attackers are sending over 100 requests per minute fro…
Answer: B. Create a Cloud Armor security policy with a rate-based ban rule that blocks IPs exceeding 100 requests per minute for a specified ban duration
Cloud Armor rate-based ban rules automatically block IPs exceeding a specified request threshold, mitigating DDoS attacks at the network edge. Manually adding deny rules fails the automation requirement because it is reactive and cannot scale against rapidly changing attackers.
Q13. A financial services company is building a fraud detection system that processes millions of transactions per second. The architecture requires a messaging system that provides exactly-once delivery guarantees and must be compatible with e…
Answer: C. Use Google Cloud Managed Service for Apache Kafka.
Google Cloud Managed Service for Apache Kafka provides native API compatibility and exactly-once delivery semantics without operational overhead. Self-managing Kafka on Compute Engine or GKE fails the operational efficiency requirement because your team must handle all patching and clustering manually.
Q14. You are setting up a new project my-app-dev for a team of developers. They need full control to create, modify, and delete Compute Engine instances within this specific project. However, for security reasons, they must not have any access…
Answer: B. Grant the roles/compute.instanceAdmin.v1 role to the developer group on the my-app-dev project.
Granting compute.instanceAdmin.v1 on the specific project perfectly enforces least privilege, allowing developers to manage VMs without affecting production. Avoid granting broad primitive roles like Editor, or granting permissions at the organization level, which violates your security boundaries.
Q15. Your organization assigns costs to different departments using labels (e.g., dept:marketing, dept:sales). You need to see a visualization of the last 30 days of spending, grouped by these labels, directly in the Google Cloud Console. What…
Answer: C. Use the Reports view in the Cloud Billing Console and group by "Label".
The Reports view in the Cloud Billing Console provides native visualization of cost trends grouped by labels. Exporting to BigQuery is useful for advanced reporting, but it is unnecessary for quickly viewing a month of spending directly in the console.
Q16. Your organisation currently has three teams: Finance, Engineering, and Marketing, each with projects in their own folder. A new auditor needs read-only access to all Cloud Storage buckets across the organisation. This access must automatic…
Answer: D. Grant the auditor roles/storage.objectViewer at the organisation level.
Granting roles at the organization level leverages resource hierarchy inheritance, automatically applying permissions to all current and future folders and projects. Granting access at the folder or project level requires repeating the process manually whenever new resources are created.
Q17. You are migrating a legacy Java application to Google Cloud. The application depends on specific Linux kernel modules and a custom OS configuration that was tuned manually over years. The application is not containerized, and the team does…
Answer: B. Compute Engine
Compute Engine provides full administrative control over the operating system, allowing you to install specific kernel modules and customize configurations. Fully managed platforms like Cloud Run or App Engine abstract the underlying operating system and restrict kernel-level access.
More Google Cloud Associate Cloud Engineer drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.