Practice for the Google Cloud Associate Cloud Engineer exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Your team has deployed a web application on Cloud Run that processes user requests and returns responses quickly (typica. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Google Cloud Associate Cloud Engineer practice test →
What you will practice
- Your team has deployed a web application on Cloud Run that processes user requests and returns responses quic…
- Your security team requires that all Linux VMs must have specific security agents installed and firewall conf…
- Your data engineering team has received a massive 10 TB historical dataset in a CSV file stored in Cloud Stor…
- Your organization needs to ensure that all Compute Engine VMs running Ubuntu have a specific security monitor…
- You are manually configuring CMEK for a new BigQuery dataset in project-data. The Cloud KMS key lives in a se…
- Your application runs in a GKE cluster in project-a and needs to access a Cloud SQL instance located in proje…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Your team has deployed a web application on Cloud Run that processes user requests and returns responses quickly (typically under 500ms). After returning the response to users, the application needs to perform background logging and metric…
Answer: D. Change the billing setting to instance-based billing (CPU always allocated)
Enabling CPU always allocated keeps the CPU available for the container's entire lifecycle, allowing asynchronous background tasks to finish after returning a response. The default request-based billing setting immediately throttles CPU once a response is sent, interrupting execution.
Q2. Your security team requires that all Linux VMs must have specific security agents installed and firewall configuration files present. You need a solution that enforces this configuration continuously and automatically remediates any drift…
Answer: C. Create an OS policy assignment in VM Manager that defines the desired state (packages and files) and sets the mode to enforcement.
OS policies in enforcement mode continuously monitor VMs and automatically remediate configuration drift, such as removed packages. Startup scripts only run during boot, so they cannot fix drift that happens later while the VM is running.
Q3. Your data engineering team has received a massive 10 TB historical dataset in a CSV file stored in Cloud Storage. You need to perform a one-time transformation of this data and load it into BigQuery for analysis. The process must be optimi…
Answer: C. Create a Batch Dataflow pipeline.
A Dataflow batch pipeline is optimized for bounded datasets, automatically scaling workers for high throughput and shutting down upon completion. Streaming pipelines are designed for continuous, low-latency data and would leave workers idling.
Q4. Your organization needs to ensure that all Compute Engine VMs running Ubuntu have a specific security monitoring agent installed and running. New VMs are frequently created, and you want to automatically install and configure this agent on…
Answer: D. Create an OS policy assignment that installs and validates the agent package on Ubuntu VMs
OS policy assignments in VM Manager allow you to define a desired state, like required packages, and enforce it continuously. Startup scripts only run once at boot, whereas OS policies actively monitor and remediate drift for the VM's lifetime.
Q5. You are manually configuring CMEK for a new BigQuery dataset in project-data. The Cloud KMS key lives in a separate project called project-kms. You have created the key ring and CryptoKey in project-kms. The Cloud KMS API is enabled in bot…
Answer: B. Grant roles/cloudkms.cryptoKeyEncrypterDecrypter on the CryptoKey in project-kms to the BigQuery service agent for project-data.
Granting the Cloud KMS CryptoKey Encrypter Decrypter role to the BigQuery service agent allows the backend service to perform cryptographic operations. Remember that the human user creating the dataset needs standard BigQuery permissions, not KMS access, because the service agent handles encryption.
Q6. Your application runs in a GKE cluster in project-a and needs to access a Cloud SQL instance located in project-b. You are using Workload Identity. How should you configure the IAM permissions to allow this cross-project access?
Answer: C. Create a Google Service Account in project-a, bind it to the GKE workload, and grant this Service Account the roles/cloudsql.client role in project-b.
The Google Service Account should be created in the same project as the GKE workload. You then grant this service account the Cloud SQL Client role in the project hosting the database. Remember that VPC peering handles network connectivity, not IAM authorization.
Q7. Your company's security policy requires that GKE cluster nodes must not have public IP addresses to minimize the attack surface. Additionally, the Kubernetes control plane must only be accessible from your corporate network range (10.50.0…
Answer: B. Create a Private Cluster with private nodes and configure Master Authorized Networks restricted to 10.50.0.0/16.
Creating a private cluster ensures that compute nodes only receive internal IP addresses, isolating them from the internet. Configuring Master Authorized Networks restricts control plane access to your specified corporate CIDR block, meeting the network security requirements.
Q8. You need to create a new Compute Engine instance named web-server-1 using the gcloud CLI. The VM must use the latest Debian 11 image and automatically run a setup script located locally on your computer at ./setup.sh during the first boot…
Answer: B. gcloud compute instances create web-server-1 –image-family=debian-11 –image-project=debian-cloud –metadata-from-file=startup-script=./setup.sh
The metadata-from-file flag reads the local script content and correctly uploads it as startup-script metadata. Using the standard metadata flag simply passes the literal file path string, preventing the script from executing during the boot process.
Q9. You have defined a JSON file named lifecycle.json containing a policy to delete objects older than 365 days. You need to apply this configuration to an existing Cloud Storage bucket named my-archive-bucket. Which command should you run?
Answer: C. gcloud storage buckets update gs://my-archive-bucket –lifecycle-file=lifecycle.json
The gcloud storage buckets update command with the lifecycle-file flag correctly applies configurations to existing buckets. Although older questions might feature gsutil, gcloud storage is the current standard, making it the preferred answer.
Q10. Your Cloud Run service experiences cold start latency of 3-5 seconds, which impacts user experience. The service receives steady traffic during business hours (9 AM – 6 PM) but minimal traffic at night. You want to eliminate cold starts du…
Answer: C. Set the min-instances to 2 or 3 and use Cloud Scheduler to trigger a job that updates this configuration at 9 AM (scale up) and 6 PM (scale down).
Setting minimum instances keeps containers warm to eliminate cold starts, and using Cloud Scheduler to automate this schedule minimizes overnight costs. Keeping ten instances permanently active would prevent cold starts but incurs unnecessary off-hours billing.
Q11. Your CI/CD pipeline deploys a new version of a web application to Google Kubernetes Engine (GKE) using kubectl apply. The pipeline immediately proceeds to the testing stage, but the tests often fail because the new pods are not yet ready…
Answer: C. Add the command kubectl rollout status deployment/web-app after the apply command.
The rollout status command blocks the pipeline until the deployment completes or times out. Using a sleep command is fragile because it uses a hardcoded time rather than checking the actual cluster state.
Q12. A cloud operator is in the Google Cloud console reviewing a GKE cluster that is experiencing degraded performance. They want to ask an AI assistant, directly within the console, to analyze the cluster's logs, explain the likely root cause…
Answer: D. Gemini Cloud Assist, which is embedded in the Google Cloud console and provides contextual AI assistance for troubleshooting and optimizing Google Cloud resources on the current page.
Gemini Cloud Assist is embedded directly in the Google Cloud console and provides contextual troubleshooting and optimization recommendations for your current resource page. The command-line interface operates outside the graphical console and lacks direct contextual awareness of the active webpage.
Q13. You have a legacy third-party application running on a Compute Engine VM. This application exposes custom internal metrics (like "active_queue_depth") at the endpoint localhost:8080/metrics in standard OpenMetrics format. You need to inges…
Answer: B. Edit the /etc/google-cloud-ops-agent/config.yaml file. Configure a prometheus receiver in the metrics section pointing to the local endpoint.
The Ops Agent uses a prometheus receiver in its metrics configuration to scrape OpenMetrics endpoints and ingest them into Cloud Monitoring. Avoid writing custom API scripts, as the native receiver handles collection automatically and efficiently.
Q14. You are deploying a 3-tier application (Frontend, Backend, Database) in a single VPC. The Backend instance group autoscales dynamically based on traffic. You need to configure a VPC firewall rule that allows the Frontend instances to commu…
Answer: A. Create an ingress firewall rule with action: allow, sourceServiceAccounts: [Frontend-SA], and targetServiceAccounts: [Backend-SA].
Using source and target service accounts in a firewall rule creates an identity-based security model that seamlessly handles autoscaling. Service accounts are strictly governed by IAM, making them more secure than network tags, which Compute Engine admins can alter.
Q15. Your SRE team wants to collect Prometheus metrics from workloads running on GKE. They want to use the standard Prometheus data model and Query Language (PromQL) but do not want to manually manage the Prometheus server infrastructure, stora…
Answer: C. Enable Google Cloud Managed Service for Prometheus on the GKE cluster.
Google Cloud Managed Service for Prometheus provides native PromQL querying and managed collection without the operational overhead of maintaining your own storage. Avoid manually installing the Ops Agent on GKE nodes, as cluster monitoring is handled by system agents.
Q16. You are designing the network architecture for a new high-scale GKE cluster. You need to ensure the cluster follows Google's current networking best practices for scalability, native VPC integration, and pod-level firewall control. Which t…
Answer: D,E. VPC-native cluster (using Alias IPs) || Secondary IP ranges for Pods and Services
VPC-native clusters use alias IP ranges, giving pods natively routable VPC addresses for better scalability and enabling pod-level firewall controls. Defining secondary IP ranges for pods and services within the subnet is a required configuration step when setting up this architecture.
Q17. Your team has built a production AI agent using the Agent Development Kit (ADK) on Gemini Enterprise Agent Platform. You need to deploy it so it is available to end users at scale. You want a fully managed environment that handles the serv…
Answer: A. Agent Runtime on Gemini Enterprise Agent Platform, which provides a fully managed, serverless environment for deploying and scaling agents in production.
Agent Runtime provides a fully managed, serverless environment specifically designed to deploy and scale AI agents in production without infrastructure overhead. While Cloud Run hosts containers, it requires more manual configuration compared to a purpose-built agent runtime.
More Google Cloud Associate Cloud Engineer drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.