Practice for the Google Cloud Associate Cloud Engineer exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Your organization uses Okta as its identity provider and has dozens of on-premises applications across multiple departme. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Google Cloud Associate Cloud Engineer practice test →
What you will practice
- Your organization uses Okta as its identity provider and has dozens of on-premises applications across multip…
- Your Cloud Run service container takes 45 seconds to start because it downloads large dependencies and initia…
- Your stateless web application in GKE needs to automatically scale the number of pods between 3 and 20 based…
- You need to migrate 50 TB of data from your on-premises NAS to Cloud Storage. The data must be transferred se…
- Your security team has mandated that no virtual machines (VMs) in your production VPC should have external IP…
- You are designing a storage strategy for a compliance system that stores audit logs. The logs must be resilie…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Your organization uses Okta as its identity provider and has dozens of on-premises applications across multiple departments that need to access different Google Cloud resources. Each application should only access specific resources based…
Answer: C. Configure Workload Identity Federation with a Workload Identity Pool that trusts Okta as an external identity provider. Use attribute mappings and attribute conditions to control which applications can impersonate which Service Accounts based on their Okta claims.
Workload Identity Federation lets external applications use short-lived tokens from providers like Okta to impersonate service accounts. Workforce Identity Federation is for human users, while workload federation handles automated programmatic access.
Q2. Your Cloud Run service container takes 45 seconds to start because it downloads large dependencies and initializes data models at runtime. This causes request timeouts during scaling events. What is the most effective solution?
Answer: A. Refactor the container image to use multi-stage builds, pre-installing all dependencies and models into the image during the build process.
Pre-installing dependencies into the container image during the build process eliminates heavy runtime initialization, ensuring fast startup times. Increasing the request timeout does not fix the underlying cold start delay, leaving users waiting.
Q3. Your stateless web application in GKE needs to automatically scale the number of pods between 3 and 20 based on traffic load. You want to scale up when the average CPU utilization exceeds 70% and scale down when it drops below that target…
Answer: D. Configure a HorizontalPodAutoscaler object with minReplicas: 3, maxReplicas: 20, and targetCPUUtilizationPercentage: 70.
The Horizontal Pod Autoscaler scales the number of pod replicas up or down based on metrics like CPU utilization. The Vertical Pod Autoscaler adjusts resource requests per pod, while the Cluster Autoscaler provisions underlying nodes.
Q4. You need to migrate 50 TB of data from your on-premises NAS to Cloud Storage. The data must be transferred securely over your existing VPN connection. You want a managed solution that handles retries, validation, and minimal script mainten…
Answer: D. Use Storage Transfer Service with "Transfer Service for on-premises data" agents.
Storage Transfer Service with on-premises data agents is the managed solution optimized for moving terabytes of network data, handling retries and integrity checks natively. Use gsutil only for smaller, ad-hoc transfers because it requires custom scripts and manual error handling.
Q5. Your security team has mandated that no virtual machines (VMs) in your production VPC should have external IP addresses. However, developers still need to establish SSH connections to these VMs to perform debugging tasks. You need to enabl…
Answer: B. Assign the IAP-Secured Tunnel User (roles/iap.tunnelResourceAccessor) role to the developers and use gcloud compute ssh with the –tunnel-through-iap flag.
The IAP-secured Tunnel User role grants the exact permission needed to route SSH traffic through Identity-Aware Proxy to private VMs. Avoid the IAP Policy Admin role because it manages overall IAP settings rather than granting the actual access needed to establish tunnels.
Q6. You are designing a storage strategy for a compliance system that stores audit logs. The logs must be resilient to a region-wide outage (geo-redundant) and will be accessed once immediately after creation, and then potentially once every 2…
Answer: A. Create a Multi-region bucket. Configure a Lifecycle Rule to SetStorageClass to Archive after 1 day.
A multi-region bucket ensures geo-redundancy, while transitioning objects to Archive storage after one day minimizes costs for data rarely accessed. Choose Nearline or Coldline only for more frequent access patterns, like once per month or once per quarter respectively.
Q7. Your startup needs to optimize cloud costs. You have determined that your customer-facing application requires high performance and reliability, but your internal data processing jobs and non-critical workloads do not have strict latency r…
Answer: B. Use the Premium Tier for customer-facing services and the Standard Tier for internal or non-critical workloads.
Premium Tier routes traffic over Google's fast, reliable global backbone, making it optimal for user-facing applications. Standard Tier uses public internet routing, costing less and making it perfect for internal or non-critical workloads where latency is less important.
Q8. You are the lead SRE for a retail company. You need to grant a new junior engineer access to view metrics, dashboards, and uptime checks in the Google Cloud Console for troubleshooting purposes. The security policy strictly prohibits grant…
Answer: B. Assign the Monitoring Viewer (roles/monitoring.viewer) role to the engineer.
The Monitoring Viewer role grants read-only access to dashboards and metrics without allowing changes to alerting policies, satisfying least privilege. Avoid broad primitive roles like Viewer because they grant unnecessary read access across all project resources.
Q9. You are creating a Cloud Storage bucket to store highly sensitive financial documents. The security team requires that no individual object can be accidentally exposed to the public internet, and that access must be managed solely through…
Answer: B,D. Public Access Prevention || Uniform Bucket-Level Access
Enabling Public Access Prevention blocks any attempt to share the bucket publicly, while Uniform Bucket-Level Access disables legacy object ACLs. Remember that Requester Pays handles billing shifts, not security, and fine-grained ACLs actively contradict the requirement.
Q10. Your company has two separate requirements. Requirement 1: Software developers employed by your company must be able to sign in to the Google Cloud console and run gcloud commands using their existing Microsoft Entra ID corporate credentia…
Answer: D. Requirement 1: Workforce Identity Federation. Requirement 2: Workload Identity Federation.
Workforce Identity Federation provides syncless, interactive access for human users needing to authenticate with external corporate identity providers. Workload Identity Federation allows external automated pipelines to exchange OIDC tokens for short-lived Google Cloud access, eliminating risky long-lived keys.
Q11. Your production e-commerce application serves a global customer base and requires the lowest possible latency. However, your development environment runs internal tools accessed only by your team in a single region. You need to configure t…
Answer: C. Configure the Production environment to use the Premium Tier and the Development environment to use the Standard Tier.
The Premium Tier routes traffic over Google's fast, global backbone network, making it optimal for low-latency, worldwide production applications. The Standard Tier uses lower-cost public internet routing, which is perfectly adequate for regional development environments.
Q12. Your security team wants to enforce strict firewall rules on "PCI-Compliant" servers across multiple VPC networks in your organization. These rules must be managed centrally by the security team using IAM controls, preventing VM administra…
Answer: D. Use Secure Tags (IAM-governed tags) bound to the VM instances.
Secure Tags provide IAM governance, ensuring that only authorized principals can attach or modify tags used in firewall policies. Network tags lack IAM controls, allowing VM administrators to bypass security restrictions by altering instance metadata.
Q13. You are architecting a three-tier web application. The Frontend tier serves users from the internet. The API Backend tier must be accessed only by the Frontend tier. The Database tier is accessed only by the API Backend. Which load balance…
Answer: C. Use an External Application Load Balancer for the Frontend tier and an Internal Application Load Balancer for the API Backend tier.
An External Application Load Balancer correctly exposes the Frontend tier to the public internet. An Internal Application Load Balancer keeps the API Backend private, ensuring it is only accessible from within the VPC and maintaining proper security segmentation.
Q14. Your company requires all production Compute Engine VMs to receive security patches automatically every Sunday at 3 AM. However, you want to test patches on development VMs first, applying them on Friday evenings. How should you configure…
Answer: C. Create two separate patch deployment policies: one with a Sunday schedule filtering for production VMs, and another with a Friday schedule filtering for development VMs.
Creating separate patch deployment policies allows you to define distinct schedules and target specific VMs using instance filters. Remember that a single policy cannot split schedules dynamically, so separating them by environment is required.
Q15. You need to create a new GKE cluster named app-cluster. Security policy dictates that the cluster nodes must NOT use the default Compute Engine service account. Instead, they must use a custom service account named gke-sa@my-project.iam.gs…
Answer: A. –service-account=gke-sa@my-project.iam.gserviceaccount.com
The service account flag configures the specific IAM identity that the cluster nodes use. The impersonate flag only affects the identity running the gcloud command, not the underlying virtual machines being provisioned.
Q16. Your team maintains a microservices-based e-commerce application running on Google Kubernetes Engine (GKE). Customers are reporting that the "Checkout" process is intermittently slow, taking over 10 seconds. You need to identify exactly wh…
Answer: C. Instrument the application to send data to Cloud Trace and analyze the waterfall latency graphs.
Cloud Trace provides distributed tracing that maps out request waterfalls to isolate exact latency bottlenecks across microservices. Cloud Profiler analyzes CPU and memory consumption, which does not effectively track network or wait delays.
Q17. Your company operates in a regulated industry where customer data must be permanently and automatically deleted exactly 7 years (2555 days) after it was created. This process must happen without human intervention to ensure compliance.
Answer: A. Configure an Object Lifecycle Management rule with Action: Delete and Condition: Age: 2555 days.
Object Lifecycle Management directly automates the deletion of data based on an age condition, permanently removing objects after the specified days. A retention policy only prevents deletion until the period expires, meaning objects will remain unless manually deleted afterward.
More Google Cloud Associate Cloud Engineer drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.