Practice for the Google Cloud Associate Cloud Engineer exam with 18 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Your application runs in a Google Kubernetes Engine (GKE) cluster and needs to write application logs to a Cloud Storage. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Google Cloud Associate Cloud Engineer practice test →
What you will practice
- Your application runs in a Google Kubernetes Engine (GKE) cluster and needs to write application logs to a Cl…
- You need to backup data from a source bucket in us-central1 to a destination bucket in europe-west1 for disas…
- Your team needs to process a large batch of images stored in Cloud Storage every night at 2 AM. The processin…
- You manage three Google Cloud projects (development, staging, and production) using Terraform. Each project r…
- Your data pipeline needs to process 10,000 independent tasks in parallel. Each task takes 5-10 minutes to com…
- Your application running on multiple Compute Engine VMs needs shared access to the same files with POSIX-comp…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Your application runs in a Google Kubernetes Engine (GKE) cluster and needs to write application logs to a Cloud Storage bucket. You want to follow Google's recommended security best practices for authentication, avoiding the management of…
Answer: B. Create a Google Service Account (GSA) with the roles/storage.objectCreator role, bind it to a Kubernetes Service Account (KSA) using Workload Identity, and annotate the KSA.
Workload Identity federates Kubernetes service accounts with Google service accounts to provide short-lived, automatically rotating credentials. Avoid downloading static JSON keys because managing long-lived secrets introduces severe security risks and violates Google Cloud best practices.
Q2. You need to backup data from a source bucket in us-central1 to a destination bucket in europe-west1 for disaster recovery. You want to run a batch synchronization job every night at 3 AM to copy only new or changed objects. What should you…
Answer: A. Configure a Storage Transfer Service job with a daily schedule.
Storage Transfer Service natively supports scheduled, incremental syncs between Cloud Storage buckets without managing custom code. Avoid building custom pipelines with Cloud Composer or Cloud Run because they introduce unnecessary operational overhead for a straightforward transfer job.
Q3. Your team needs to process a large batch of images stored in Cloud Storage every night at 2 AM. The processing task resizes and applies filters to thousands of images, which takes approximately 45 minutes to complete. Once the processing f…
Answer: C. Deploy a Cloud Run job and schedule it using Cloud Scheduler to run at 2 AM daily
Cloud Run jobs are specifically designed for run-to-completion batch tasks that don't require HTTP requests, stopping automatically when finished. Pairing them with Cloud Scheduler handles the timing perfectly, whereas Cloud Run services bill continuously for idle compute.
Q4. You manage three Google Cloud projects (development, staging, and production) using Terraform. Each project requires the same foundational infrastructure (VPC, GKE cluster, Cloud SQL instance) but necessitates different configurations, suc…
Answer: C. Create a reusable Terraform module for the shared infrastructure and use separate .tfvars files to supply environment-specific values.
Using a reusable Terraform module with separate tfvars files prevents duplication while allowing environment-specific customization. Avoid managing all environments in a single state file with conditional logic, as this increases complexity and blast radius.
Q5. Your data pipeline needs to process 10,000 independent tasks in parallel. Each task takes 5-10 minutes to complete. You want a fully managed service that handles job scheduling, queuing, and automatic scaling of resources without requiring…
Answer: D. Use Cloud Batch to define the job requirements and let it automatically provision and scale the instances.
Cloud Batch is a fully managed service that handles resource provisioning, scheduling, and queuing for massive parallel tasks automatically. Deploying a standard Google Kubernetes Engine cluster would violate the requirement by forcing you to manage the underlying infrastructure.
Q6. Your application running on multiple Compute Engine VMs needs shared access to the same files with POSIX-compliant file locking (e.g., flock). The application was designed for NFS storage and cannot be rewritten. What GCP service should yo…
Answer: B. Use Filestore to provide a fully managed NFS file system mounted to all VMs.
Filestore provides a fully managed Network File System that natively supports concurrent access and POSIX-compliant file locking. Cloud Storage FUSE lacks robust file locking semantics, making it unsuitable for legacy applications requiring strict consistency.
Q7. A principal in your organisation has been granted roles/storage.admin on a specific Cloud Storage bucket via an allow policy on that project. Your security team also attaches an IAM deny policy to the folder containing that project, which…
Answer: C. The deletion is denied, because IAM evaluates deny policies before allow policies, and a deny always overrides a grant.
Identity and Access Management deny policies are evaluated first and always override allow policies, regardless of hierarchy specificity. A deny policy attached to a parent folder successfully prevents the deletion action, even if the project grants admin rights.
Q8. Your security team requires that developers can only create Compute Engine instances when they are connecting from the corporate office IP range. Requests from outside this range should be denied. How should you implement this?
Answer: C. Create an IAM Allow Policy with a conditional binding that restricts access based on an Access Level containing the corporate IP.
Identity and Access Management Conditions evaluate access levels to restrict control plane API calls based on the corporate IP address. VPC firewall rules operate at the data plane and cannot restrict Google Cloud API calls like instance creation.
Q9. Your company runs non-critical data processing jobs nightly. These jobs take 4-6 hours to complete, run once per day, and can tolerate interruptions because they are designed to resume from checkpoints. You want to migrate these jobs to Co…
Answer: D. Use Compute Engine Spot VMs and implement a shutdown script to save the job state to Cloud Storage upon preemption.
Spot virtual machines offer the deepest compute discounts for fault-tolerant workloads and provide a short termination notice to save state. Committed use discounts are incorrect here because they require paying for continuous capacity you rarely use.
Q10. Your Organization Administrator wants to block outgoing traffic to port 25 (SMTP) for all projects in the organization to prevent spam, with no exceptions. You need to implement this policy at the top of the resource hierarchy so that it o…
Answer: A. Create a Hierarchical Firewall Policy at the Organization level with a "Deny" rule for egress port 25 and set action: deny.
Hierarchical firewall policies let you create centralized deny rules at the organization or folder level that override lower-level VPC firewall rules. Remember that VPC rules are always evaluated after hierarchical policies, ensuring your organization-wide traffic blocks cannot be bypassed by project owners.
Q11. Your production application uses Filestore and requires high availability. You need the service to automatically failover to a different zone in the event of a zonal outage, with an RPO (Recovery Point Objective) of zero. What should you c…
Answer: A. Use the Filestore Enterprise tier.
Filestore Enterprise tier uses synchronous regional replication across multiple zones, providing automatic failover and a zero recovery point objective. Zonal tiers or manual synchronization tools cannot guarantee zero data loss during an outage, making them unsuitable for strict high-availability requirements.
Q12. You have a Managed Instance Group (MIG) serving as the backend for an Application Load Balancer. The application takes 30 seconds to fully initialize after boot. However, the MIG keeps restarting instances immediately after they are create…
Answer: D. Configure the initial delay (initial-delay-sec) in the MIG's autohealing policy to 45 seconds.
Setting the initial delay in the managed instance group's autohealing policy gives instances a grace period to boot before health checks begin. Simply increasing the health check interval would slow down the detection of genuinely failed instances across your entire application.
Q13. You are running a Java-based data processing application on a Managed Instance Group. The application is working correctly, but the compute costs are unexpectedly high. You suspect that a specific function in the code is inefficiently cons…
Answer: A. Configure the application to use Cloud Profiler.
Cloud Profiler continuously collects CPU and memory usage data from production applications, mapping resource consumption directly to specific code functions. Cloud Trace is used for analyzing distributed request latency, not for identifying internal code inefficiencies driving up compute costs.
Q14. You are setting up a new Google Cloud project for the marketing department. You need to link this new project to the company's existing Billing Account. You want to delegate this task to a specific finance colleague. Which combination of r…
Answer: C. Project Billing Manager (roles/billing.projectManager) on the Project AND Billing Account User (roles/billing.user) on the Billing Account.
Linking a project to an existing billing account requires combined permissions to associate the resources. Project Billing Manager modifies the project's billing association, while Billing Account User grants permission to link projects to the target billing account.
Q15. You need to quickly see a list of all pods running across all namespaces in your GKE cluster, along with their assigned nodes and IP addresses, to troubleshoot a scheduling imbalance. What command should you use?
Answer: A. kubectl get pods –all-namespaces -o wide
Using the wide output format with the all-namespaces flag is the standard kubectl method to list pods across the cluster alongside their assigned nodes and IP addresses. The gcloud command-line tool queries infrastructure rather than Kubernetes objects running inside the cluster.
Q16. Your application pods in GKE are frequently crashing with "OOMKilled" (Out of Memory) errors. You are unsure of the exact memory requirements and want an automated way to adjust the resource requests and limits to fit the actual usage. Wha…
Answer: A. Configure the Vertical Pod Autoscaler (VPA) in Auto or Recommendation mode to analyze and adjust the pod resource requests.
The Vertical Pod Autoscaler analyzes historical usage and automatically adjusts CPU and memory requests to prevent crashes. Remember the scaling axes: Horizontal scales pod count, Vertical scales pod size, and Cluster Autoscaler scales nodes.
Q17. You have an existing GKE cluster with a default node pool running standard CPU machine types. You need to deploy a new machine learning workload that requires NVIDIA GPUs. You want to add this capacity without disrupting or recreating the…
Answer: B. Create a new node pool with GPU-enabled machine types and use node selectors or taints to schedule the ML workloads onto it.
Creating a separate node pool with GPU machine types isolates your hardware workloads without disrupting existing applications. GKE automatically taints GPU nodes, ensuring only pods requesting GPUs get scheduled there, preventing wasted resources.
Q18. You want to deploy a new version of your Cloud Run service but send only 10% of traffic to the new version initially to test it in production. If metrics look good, you'll gradually increase traffic. What should you configure?
Answer: A. Deploy the new revision and use Cloud Run traffic management to route 90% of traffic to the current revision and 10% to the new revision.
Cloud Run provides native traffic splitting capabilities, allowing you to route exact percentages of requests to different revisions. Revision tags create unique testing URLs but do not provide percentage-based routing on the main service endpoint.
More Google Cloud Associate Cloud Engineer drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.