Practice for the Google Cloud Associate Cloud Engineer exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Your application running on Compute Engine needs to access Cloud Storage buckets in a different project. For security re. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Google Cloud Associate Cloud Engineer practice test →
What you will practice
- Your application running on Compute Engine needs to access Cloud Storage buckets in a different project. For…
- You are managing a VPC network in the us-central1 region for a production application. The current subnet app…
- Your platform engineering team wants to manage Google Cloud resources—such as Cloud SQL instances, Pub/Sub to…
- Your team is developing a high-traffic gaming leaderboard application. The application frequently queries the…
- Your finance department uploads monthly PDF invoices to a Cloud Storage bucket. These documents are accessed…
- Your business intelligence team is experiencing slow query performance on their Looker dashboards that query…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Your application running on Compute Engine needs to access Cloud Storage buckets in a different project. For security reasons, your organization's policy prohibits downloading and storing service account JSON key files. You need to grant t…
Answer: D. Grant the Compute Engine service account the Service Account Token Creator role on storage-admin@other-project.iam.gserviceaccount.com, then use the generateAccessToken API to create short-lived credentials
Granting the Token Creator role allows the VM service account to impersonate the target account and generate short-lived access tokens. This avoids downloading static JSON keys, which pose security risks, and keeps cross-project access securely auditable.
Q2. You are managing a VPC network in the us-central1 region for a production application. The current subnet app-subnet has a CIDR range of 10.0.1.0/24, which provides 254 usable IP addresses. You currently have 200 running instances in this…
Answer: C. Use the gcloud compute networks subnets expand-ip-range command to increase the prefix length to /21.
The expand-ip-range command lets you increase a subnet capacity in place without disrupting existing running instances. Secondary ranges are only for alias IPs and containers, not for assigning primary internal IPs to new Compute Engine VMs.
Q3. Your platform engineering team wants to manage Google Cloud resources—such as Cloud SQL instances, Pub/Sub topics, and IAM policies—using the same Kubernetes-style YAML manifests and GitOps workflows they use for their applications. They w…
Answer: A. Config Connector
Config Connector is a Kubernetes add-on that lets you manage Google Cloud resources using standard YAML manifests via kubectl. Terraform flows in the opposite direction, while Deployment Manager uses entirely different configuration templates.
Q4. Your team is developing a high-traffic gaming leaderboard application. The application frequently queries the same database records, causing high load on the primary Cloud SQL instance. You need to implement an in-memory caching layer that…
Answer: A. Deploy a Memorystore for Redis instance and configure the application to cache results there.
Memorystore for Redis provides a fully managed in-memory caching layer that natively supports the Redis protocol. Self-managing a cluster on GKE or VMs adds unnecessary operational overhead, while Memcached does not support the required protocol.
Q5. Your finance department uploads monthly PDF invoices to a Cloud Storage bucket. These documents are accessed frequently during the first 30 days for accounting reviews. After 30 days, they are rarely accessed but must be retained for 7 yea…
Answer: A. Configure an Object Lifecycle Management rule to downgrade storage class to Nearline after 30 days and to Coldline after 365 days.
Object Lifecycle Management automatically transitions storage classes based on age, minimizing costs without custom code. Jumping directly to Archive after thirty days incurs early deletion fees if accessed before the mandatory year elapses.
Q6. Your business intelligence team is experiencing slow query performance on their Looker dashboards that query BigQuery datasets. These dashboards run repeated queries on a few key tables (approximately 5 GB total) throughout the day to disp…
Answer: B. Create a BI Engine reservation with sufficient memory capacity and designate the key dashboard tables as preferred tables
Creating a BI Engine reservation with preferred tables accelerates repeated dashboard queries by caching table data in memory. BigQuery result caching only works for exact duplicate queries, whereas BI Engine accelerates similar queries across your preferred tables.
Q7. A CI/CD pipeline stores temporary build artifacts in a specific Cloud Storage bucket. To save costs, you want to ensure that any artifact older than 90 days is automatically removed. No one needs these files after this period. What should…
Answer: B. Configure a Lifecycle rule with the action Delete and condition Age: 90 days.
Configuring a Lifecycle rule with a Delete action and an age condition automatically removes old objects without custom scripts. Retention policies prevent deletion for compliance, which is the exact opposite of the required automatic cleanup behavior.
Q8. Your company uses Okta as its corporate identity provider. Employees need to access the Google Cloud console and run gcloud CLI commands using their existing Okta credentials, without creating separate Google Cloud Identity accounts for ea…
Answer: C. Workforce Identity Federation, by creating a workforce identity pool and an Okta OIDC or SAML 2.0 provider, so employees can use SSO with short-lived tokens and no Cloud Identity accounts are required.
Workforce Identity Federation allows employees to sign in using external identity providers with short-lived tokens, avoiding separate Cloud Identity accounts. Workload Identity Federation is designed for automated workloads and code pipelines, not interactive human users.
Q9. A data science team wants to train a custom TensorFlow model on Google Cloud and then serve it as a managed online prediction endpoint for low-latency real-time inference requests. They want the platform to handle the serving infrastructur…
Answer: B. Gemini Enterprise Agent Platform, which provides managed custom model training and a fully managed online prediction service that deploys models to endpoints without requiring infrastructure management.
Vertex AI provides a fully managed environment for custom model training and deploys models to online prediction endpoints without infrastructure management. BigQuery ML is excellent for training models using SQL on structured data but does not serve real-time custom TensorFlow endpoints.
Q10. You have a web application running on a managed instance group of VMs in subnet-a (10.0.1.0/24). These VMs need to connect to a Cloud SQL database instance located in subnet-b (10.0.2.0/24) using its Private IP. Your security team requires…
Answer: B. Apply a specific network tag (e.g., web-app) to the application VMs. Create a VPC firewall rule allowing ingress traffic to subnet-b from the source tag web-app.
Applying a network tag to your application VMs and using it as the source in a firewall rule provides the required strict access control. Filtering by subnet range is too broad because it would allow future VMs in that subnet to access the database.
Q11. Your company is migrating a critical on-premises PostgreSQL database to Google Cloud. The database is 5 TB in size and requires extremely high transaction throughput and strong consistency. The application relies on native PostgreSQL exten…
Answer: B. AlloyDB for PostgreSQL
AlloyDB for PostgreSQL is fully managed and delivers high transaction throughput while maintaining one hundred percent compatibility with native PostgreSQL extensions. Spanner's PostgreSQL interface lacks support for stored procedures, requiring substantial application refactoring.
Q12. A developer wants an AI assistant that runs entirely in their terminal, accepts natural-language prompts, can read and write files in their local project, execute shell commands, and help fix bugs or add features to a codebase — all withou…
Answer: D. Gemini CLI, an open-source AI agent that runs in the terminal and uses a reason-and-act loop to complete coding tasks, run commands, and manipulate files through natural-language prompts.
Gemini CLI is an open-source AI agent that runs locally in your terminal to manipulate files and execute commands. Gemini Cloud Assist operates exclusively within the Google Cloud console and cannot interact with your local codebase.
Q13. You are the Cloud Architect for a startup managing three distinct environments: Development, Staging, and Production. All environments use similar infrastructure definitions but require different resource capacities and project IDs. You wa…
Answer: B. Create separate Terraform directories (or workspaces) for each environment and reuse shared modules for infrastructure resources.
Using separate directories with shared modules ensures complete state isolation and minimizes code duplication. Monolithic files with conditional logic create a massive blast radius, and using a single project violates the requirement for strict environmental isolation.
Q14. You have discovered that a service account key for a production project was accidentally committed to a public GitHub repository. You suspect attackers are already using it to launch instances. You need to stop all incurring charges immedi…
Answer: D. Disable billing on the project.
Disabling billing on the project immediately stops all billable services and terminates running compute resources. Deleting the compromised service account halts new authentications, but existing access tokens remain valid for up to an hour, so disabling billing is the fastest way to stop incurring charges.
Q15. You are configuring a Global External Application Load Balancer to serve traffic for a web application spanning three regions. You need to ensure the load balancer accepts HTTP requests and distributes them intelligently to the closest hea…
Answer: B,D. A URL Map to define routing rules for incoming requests. || A Backend Service with a configured health check.
A backend service distributes traffic by relying on health checks to route requests only to available instances. The URL map is also mandatory because it defines the routing rules that direct incoming requests to the correct backend service.
Q16. A large retail company is migrating 200 legacy servers to Compute Engine VMs across multiple regions. The operations team requires detailed system metrics (memory, disk utilization) and application logs to be centralized in Cloud Logging a…
Answer: B. Use VM Manager to apply an OS policy that installs and configures the Ops Agent on all VMs.
Applying an OS policy via VM Manager installs and configures the Ops Agent at scale without manual SSH access. Startup scripts only run during boot, meaning they cannot easily update the agent on already running instances.
Q17. You are troubleshooting a critical issue on a Compute Engine instance named web-server-1. You need to quickly find all log entries with a severity level of ERROR that occurred in the last 24 hours specifically for this instance. Which filt…
Answer: D. resource.type="gce_instance" AND resource.labels.instance_id="[INSTANCE_ID]" AND severity="ERROR" (Assume [INSTANCE_ID] matches web-server-1)
The correct filter uses the exact resource type and the numeric instance ID along with the structured severity field. Filtering by the instance name fails because the labels require the unique numeric identifier rather than the human-readable string.
More Google Cloud Associate Cloud Engineer drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.