Practice for the Google Cloud Associate Cloud Engineer exam with 18 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: You need to export a large 5 TB BigQuery table to a Cloud Storage bucket in CSV format to share with a partner who does . Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Google Cloud Associate Cloud Engineer practice test →
What you will practice
- You need to export a large 5 TB BigQuery table to a Cloud Storage bucket in CSV format to share with a partne…
- You are working in a highly regulated financial environment where software supply chain security is critical…
- A project called dev-sandbox currently sits at the top of its own hierarchy with no parent folder. A develope…
- A team has built a stateless Python microservice that accepts an HTTP POST request, sends the request body as…
- Your security team has identified a risk of "bootkits" (malware that infects the OS bootloader) in your envir…
- Your application requires a sensitive database password that is securely stored in Google Secret Manager. You…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. You need to export a large 5 TB BigQuery table to a Cloud Storage bucket in CSV format to share with a partner who does not have Google Cloud access. When you attempt the export operation via the console, you receive an error message stati…
Answer: C. Use a wildcard URI (e.g., gs://my-bucket/export-.csv) in the export destination to split the data into multiple files.
BigQuery enforces a strict one-gigabyte limit for single exported CSV or JSON files. Using a wildcard URI in the destination bucket path shards the output into multiple smaller files, bypassing the limit. This is a standard console operation requiring no extra pipelines or quota increases.
Q2. You are working in a highly regulated financial environment where software supply chain security is critical. Your security team requires that only container images that have been scanned and digitally signed by your specific "Quality Assu…
Answer: C. Create a Binary Authorization Policy that sets the "enforcement mode" to ENFORCED_BLOCK_AND_AUDIT_LOG and requires the specific Attestor.
Binary Authorization enforces deploy-time security by blocking unsigned images at the GKE control plane based on configured attestors. Pipeline verification alone is insufficient because it cannot prevent users with cluster access from manually deploying unauthorized images outside the build process.
Q3. A project called dev-sandbox currently sits at the top of its own hierarchy with no parent folder. A developer has roles/editor on this project. Your team moves dev-sandbox into a new folder called engineering, where a separate principal a…
Answer: D. The developer retains roles/editor on the project, and additionally inherits any roles that the folder admin or others have granted at the engineering folder level.
Moving a project into a folder does not remove existing project-level role bindings, so the developer retains their editor role. IAM policies are additive and inherited downward, meaning the developer also gains any permissions granted at the new parent folder level.
Q4. A team has built a stateless Python microservice that accepts an HTTP POST request, sends the request body as a prompt to the Gemini API, and returns the model's response. The service has no session state, no multi-step reasoning loop, and…
Answer: C. Cloud Run, which is designed for stateless containerised services that scale automatically and require no infrastructure management.
Cloud Run is the managed compute service built specifically for stateless HTTP containers that scale to zero. GKE Autopilot adds Kubernetes complexity that is unnecessary for a single containerized microservice.
Q5. Your security team has identified a risk of "bootkits" (malware that infects the OS bootloader) in your environment. They have mandated a new policy: all Compute Engine VMs must cryptographically verify the digital signature of the kernel…
Answer: B. Enable Secure Boot in the Shielded VM settings.
Secure Boot cryptographically verifies bootloader and kernel signatures, halting the VM if modifications are detected. vTPM only records boot measurements for later analysis without actively blocking compromised software.
Q6. Your application requires a sensitive database password that is securely stored in Google Secret Manager. You want to mount this secret into your GKE pods as a file volume so the application can read it, while keeping it automatically sync…
Answer: A. Enable the Secret Manager add-on for GKE (using the CSI driver). Create a SecretProviderClass referencing the secret, and mount it in the Pod definition.
The Secret Manager CSI driver mounts secrets directly into GKE pods as file volumes while keeping them synchronized. The External Secrets Operator works but typically syncs to native Kubernetes secrets stored in etcd.
Q7. Your enterprise company has three distinct departments: Engineering, Marketing, and Sales. Each department creates its own isolated projects for development, staging, and production environments. The security team requires strict isolation…
Answer: B. Create a Folder for each department (Engineering, Marketing, Sales) under the Organization, and nest their respective projects inside. Apply IAM policies at the Folder level.
Folders provide hierarchical isolation and automatic IAM policy inheritance for all nested projects, enforcing governance automatically. Labels are for billing and filtering, not security boundaries, because IAM policies cannot attach to them.
Q8. You are architecting a global inventory management system for a major logistics firm. The system requires strong consistency (ACID transactions) to prevent selling the same item twice, high availability (99.999%), and the ability to scale…
Answer: B. Use Cloud Spanner.
Cloud Spanner uniquely combines ACID transactions with global horizontal scalability for regional write throughput. Cloud SQL is restricted to a single primary instance per region, preventing global write scaling.
Q9. You manage a multi-tenant GKE cluster and need to onboard a new team of developers. This team requires full control to deploy and manage applications within their specific namespace, dev. However, for security and stability reasons, they m…
Answer: A. Create a Role with full permissions in the dev namespace. Bind it to the group using a RoleBinding in the dev namespace.
Kubernetes RBAC isolates permissions by using a Role and RoleBinding to restrict access strictly to the dev namespace. Google Cloud IAM roles operate cluster-wide and cannot restrict access to individual Kubernetes namespaces.
Q10. You are maintaining a legacy reporting application hosted on Cloud Functions (1st gen). The application needs to query a Cloud SQL database that is configured with a Private IP address only for security compliance. The function fails to co…
Answer: C. Create a Serverless VPC Access Connector in the same region and VPC. Configure the Cloud Function to use this connector.
First-generation Cloud Functions require a Serverless VPC Access Connector to route traffic to internal IP addresses. While Direct VPC Egress simplifies this task, you must remember that it is exclusively available for second-generation functions and Cloud Run services.
Q11. Your legal technology firm manages confidential contracts in Cloud Storage. A client needs to download a specific "contract.pdf" file for review, but they do not have a Google account. The download link must work for exactly 15 minutes and…
Answer: B. Generate a Signed URL (V4) for the object with a 15-minute expiration. Give the URL to the user.
Generating a Signed URL grants time-limited access to a specific object without requiring a Google account or altering IAM. The cryptographic signature ensures the link expires exactly when configured. Sharing service account keys violates security best practices by providing overly broad access.
Q12. Your data analytics team frequently updates a "daily_sales.csv" file in a central Cloud Storage bucket. This morning, an automated script accidentally overwrote the valid file with corrupted data, halting all reporting pipelines. You need…
Answer: D. Enable Object Versioning on the bucket.
Object Versioning maintains a history of object generations, allowing instant restoration of overwritten files. This is the correct choice for recovering from accidental data modifications. Soft Delete and Retention Policies protect against deletions, but do not easily rollback overwrites.
Q13. You are the CTO of "TechStart," a rapidly growing startup that has just acquired the domain techstart.com. You need to establish a central Google Cloud Organization to enforce governance, manage billing, and unify IAM policies across your…
Answer: D. Verify domain ownership in the Google Admin console, then create a Cloud Identity or Google Workspace account.
Verifying domain ownership and creating a Cloud Identity or Workspace account automatically provisions the Organization resource. This root node allows you to centrally manage IAM policies and billing. You cannot build an organization upwards from individual projects using a billing migrate tool.
Q14. After checking your quotas in the Console, you confirm that your project is currently limited to 24 vCPUs in us-central1, but your upcoming HPC workload requires 200 vCPUs. The launch is time-sensitive, and you need to increase this limit…
Answer: A. In the IAM & Admin > Quotas & System Limits page, select the specific CPU quota, click "Edit Quotas," enter the new limit of 200, and submit the request.
The standard process for requesting more resources is using the Edit Quotas button on the Quotas page. This built-in self-service workflow is the fastest method and often processes automatically. Filing a critical support ticket is intended for active production outages, not standard capacity planning.
Q15. Your organization has a strict "Separation of Duties" model. A central "Platform Team" manages the network infrastructure (subnets, firewalls, routes), while 50 different "Application Teams" deploy and manage their own VMs. The App Teams m…
Answer: D. Use Shared VPC. Designate the Platform project as the "Host Project" and the Application projects as "Service Projects".
Shared VPC allows a host project to share network subnets with service projects without granting network admin rights. Application teams can deploy compute instances using the Network User role but cannot alter firewalls. VPC peering lacks this centralized control and is harder to scale.
Q16. Your e-commerce platform is building a real-time inventory system. You need to process sequence-critical events: "Item Created", "Item Updated", and "Item Deleted". It is vital that these events are processed in the exact order they occurr…
Answer: B. When publishing, provide an Ordering Key (e.g., product_id). On the Subscription, enable Message Ordering.
Providing an Ordering Key and enabling Message Ordering on the subscription guarantees sequence delivery. Pub/Sub handles this natively when configured correctly. Client-side buffering is an unnecessary anti-pattern, and Google Cloud does not use a distinct FIFO topic type like other clouds.
Q17. Your application architecture involves uploading thousands of small log files (1KB each) to a Cloud Storage bucket every second. During a load test, the application begins crashing, and your logs show a 429: Too Many Requests error. You ch…
Answer: D. You are exceeding the API Rate Quota (requests per second) for write operations on the bucket.
The 429 error indicates you are hitting the Cloud Storage API write request rate limit. This is a throughput constraint, not a total storage capacity limit. To fix this, you should batch uploads or introduce jitter into your application's upload timing to distribute requests evenly.
Q18. You are deploying a mission-critical PostgreSQL database for a banking application. The Service Level Agreement (SLA) requires 99.95% availability. You need to ensure that if the primary zone suffers a physical outage, the database automat…
Answer: B. Enable High Availability (HA) in the instance configuration. This creates a standby instance in a secondary zone and uses synchronous replication.
Enabling High Availability in Cloud SQL provisions a standby instance in a secondary zone with synchronous replication, guaranteeing zero data loss. The failover process is entirely automatic during a zonal outage. Read replicas use asynchronous replication and require manual promotion, risking data loss.
More Google Cloud Associate Cloud Engineer drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.