Practice for the Google Cloud Associate Cloud Engineer exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Your enterprise has a strict governance policy for the "Production" folder in the resource hierarchy. The CISO requires . Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Google Cloud Associate Cloud Engineer practice test →
What you will practice
- Your enterprise has a strict governance policy for the "Production" folder in the resource hierarchy. The CIS…
- Your backend team uses App Engine to host a background worker service that processes video encoding tasks. Th…
- You are a Cloud Engineer at a healthcare company dealing with highly sensitive patient data. You are configur…
- Your enterprise is migrating a massive SAP ERP workload to Google Cloud. The network team requires a dedicate…
- Your legacy application runs on Compute Engine instances created with default settings. You recently updated…
- Your company uses Cloud Interconnect to link on-premises servers to Google Cloud. You have a Cloud SQL databa…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Your enterprise has a strict governance policy for the "Production" folder in the resource hierarchy. The CISO requires that no principal, not even those with "Organization Admin" or "Owner" roles, be able to delete projects within this fo…
Answer: C. Create an IAM Deny Policy attached to the Production folder. Add a rule denying the resourcemanager.projects.delete permission for principalSet: allUsers.
An IAM Deny policy explicitly overrides any inherited allow policies, ensuring that even Organization Administrators cannot delete the projects. Custom roles fail this requirement because standard IAM permissions are additive, meaning existing Owner rights cannot be subtracted away.
Q2. Your backend team uses App Engine to host a background worker service that processes video encoding tasks. These tasks are sporadic but intensive, often taking up to 15 minutes to complete. You need a scaling configuration that shuts down…
Answer: B. Use Basic Scaling in the App Engine configuration.
Basic scaling is the correct choice because it supports long request timeouts up to twenty-four hours, accommodating intensive video encoding tasks. Automatic scaling enforces a strict ten-minute timeout that would kill the process before completion, making it unsuitable for sporadic long-running requests.
Q3. You are a Cloud Engineer at a healthcare company dealing with highly sensitive patient data. You are configuring a new Cloud SQL for PostgreSQL instance to store medical records. The compliance team has issued a strict directive: to preven…
Answer: D. Enable the Service Networking API. Allocate an IP range in your VPC for Google services. Create a Private Connection (VPC Peering) to the Google service producer. Configure Cloud SQL to use 'Private IP'.
Enabling Private Service Access allocates an IP range and establishes a VPC peering connection to the Google-managed network, allowing internal traffic. Remember that Serverless VPC Access is only used to connect serverless compute services to your VPC, not to configure database networking.
Q4. Your enterprise is migrating a massive SAP ERP workload to Google Cloud. The network team requires a dedicated 10 Gbps physical link between your on-premises data center and your Google Cloud VPC to handle the throughput. You have already…
Answer: C. Create a Dedicated Interconnect connection. Order a "Cross-Connect" from your colocation provider using the LOA-CFA.
Ordering a Dedicated Interconnect directly connects your on-premises routers to Google's edge, generating the LOA-CFA needed for physical cross-connects. Use Partner Interconnect when you need lower bandwidth or lack a direct presence in a supported colocation facility.
Q5. Your legacy application runs on Compute Engine instances created with default settings. You recently updated the Service Account permissions to include roles/storage.objectAdmin to allow the app to upload backups to Cloud Storage. However…
Answer: B. The VM was created with the default Access Scope (Allow Default), which only allows Read access to Storage. You must verify the scopes.
Default Compute Engine access scopes restrict Cloud Storage API calls to read-only, overriding any broader IAM write permissions. To fix this without deleting the instance, stop the virtual machine and change its access scopes to allow full API access.
Q6. Your company uses Cloud Interconnect to link on-premises servers to Google Cloud. You have a Cloud SQL database running in a Google-managed VPC (connected via Private Service Access). Your on-premises servers need to access this database…
Answer: B. Create a Private Service Connect (PSC) endpoint in your VPC that targets the Cloud SQL service attachment. Access the endpoint IP from on-premises.
Creating a Private Service Connect endpoint maps the managed database to a local IP address in your VPC, bypassing transitive peering limits. While Private Service Access exists, it struggles with complex transitive routing from on-premises environments without custom route exports.
Q7. Your analytics team runs complex, long-running aggregations on your production Cloud SQL database every afternoon. These queries lock tables and consume CPU, causing significant latency for customers trying to check out on your e-commerce…
Answer: D. Create a Read Replica instance. Configure the analytics applications to connect to the replica's IP address instead of the primary.
Creating a Read Replica isolates heavy analytical queries from the primary transactional database, preventing CPU and table locking on your production instance. Vertical scaling only provides temporary relief and does not fix the underlying resource contention issue.
Q8. A junior DevOps engineer is writing a script to deploy a "web-server" instance. The requirement is to deploy the VM in the "us-central1-a" zone using the "e2-medium" machine type. The engineer needs the exact gcloud syntax to avoid executi…
Answer: D. gcloud compute instances create web-server –zone=us-central1-a –machine-type=e2-medium
The correct gcloud command follows the standard service, resource, and verb structure, using the zone and machine type flags. A practical exam cue is to verify the resource path and location flag match, because using a region flag for a zonal resource will cause deployment errors.
Q9. Your team is preparing to launch a high-performance computing (HPC) cluster next week and needs to deploy 500 N2-standard Compute Engine VMs in the us-central1 region immediately. You suspect this large request might exceed your project's…
Answer: D. Navigate to the IAM & Admin > Quotas page in the Console, and filter by "Service: Compute Engine API" and "Location: us-central1".
The IAM and Admin Quotas page displays exact resource capacity limits and usage for specific services in a chosen region. Billing reports show historical costs rather than technical capacity, and trial deployments fail without revealing exact limits.
Q10. Your FinOps team is tasked with identifying waste across thousands of Compute Engine instances. You need a tool that allows non-technical stakeholders to ask questions in plain English, such as "List all VMs that have been idle for more th…
Answer: D. Use Gemini Cloud Assist in the Google Cloud Console.
Gemini Cloud Assist is a console-based assistant that handles natural language queries about infrastructure and cost optimization. Gemini Code Assist is for software development, while BigQuery requires writing SQL, which non-technical stakeholders want to avoid.
Q11. Your Cloud Run service is experiencing high costs due to the large number of container instances being created to handle incoming traffic. Each request completes very quickly (under 100ms), and your application code is designed to handle m…
Answer: A. Increase the maximum concurrent requests per instance setting from the default of 80
Increasing the maximum concurrent requests per instance setting allows each container to process more traffic simultaneously. Raising the minimum instances setting keeps containers warm but actually increases baseline costs rather than optimizing them.
Q12. You manage a resource hierarchy where "Group A" is granted the roles/storage.admin role at the Folder level for ease of management. However, a specific project within this folder contains sensitive HR data, and you must revoke "Group A's"…
Answer: C. You cannot remove the access at the project level because IAM policies are additive. You must use an IAM Deny Policy or restructure the hierarchy.
Cloud IAM allow policies are purely additive, meaning inherited folder permissions cannot be revoked directly at the child project level. To pass this scenario, recognize that you must either restructure the resource hierarchy or apply a specific IAM deny policy.
Q13. Your platform engineering team is building a CLI automation script to provision new Compute Engine instances. To ensure the script runs successfully, you must identify the absolute minimum parameters required by the API. Which two componen…
Answer: D,E. Boot disk image/source (e.g., Debian, Rocky Linux, or custom image) || Machine type (e.g., e2-medium, n2-standard-4)
Specifying a machine type defines the virtual CPU and RAM hardware capacity, while selecting a boot disk image provides the base operating system. External IP addresses and startup scripts are optional configurations, as instances can run privately without internet access or custom boot scripts.
Q14. Your security team requires that all data in a new Cloud SQL for PostgreSQL instance be encrypted with a customer-managed encryption key (CMEK). The Cloud KMS API and Cloud SQL Admin API are already enabled in all relevant projects. You cr…
Answer: D. The Cloud KMS key ring was created in a different region than the Cloud SQL instance.
The Cloud KMS key ring must reside in the exact same region as the Cloud SQL instance, or instance creation will immediately fail. A key ring cannot be global or multi-regional, though the Cloud SQL service agent inherits its permissions from the key ring level.
Q15. Your network security team is designing a custom VPC (Virtual Private Cloud) to host a sensitive three-tier application. Since "Custom" mode creates an empty network, you must manually configure the components required for connectivity. Wh…
Answer: D,E. Subnets with IP ranges (e.g., 10.0.1.0/24) || Firewall rules (to allow internal/external traffic)
Subnets provide regional IP addressing for instances, while firewall rules are mandatory to bypass Google's default implied deny ingress policy. Cloud NAT and Cloud Router are only necessary later for outbound internet connectivity or advanced dynamic routing.
Q16. Your organization is migrating a regulated workload that has strict "physical isolation" requirements. The compliance auditor states that your VMs must run on dedicated physical servers that are NOT shared with any other Google Cloud custo…
Answer: A. Provision a Sole-tenant Node Group and launch your VMs onto it.
Provisioning a Sole-tenant Node Group provides exclusive access to physical servers, satisfying compliance and enabling per-core BYOL reporting. Standard Compute Engine reservations guarantee capacity but still place your virtual machines on shared multi-tenant hardware.
Q17. You are deploying a microservices application with a "frontend" pod and a "database" pod running in the same GKE cluster. To adhere to Zero Trust principles, you need to ensure that the "database" pod accepts network traffic only from the…
Answer: C. Create a NetworkPolicy resource selecting the database pods, with an ingress rule allowing traffic only from pods with the label app: frontend.
Applying a Kubernetes NetworkPolicy restricts pod traffic by selecting specific labels, ensuring the database only accepts ingress from the frontend. VPC firewalls apply to entire nodes rather than individual pods, making them too coarse for microsegmentation.
More Google Cloud Associate Cloud Engineer drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.