Associate Cloud Engineer Practice Test.
Free practice exam — 61 verified questions, instant feedback.
Browse all questions & answers
1. An organization needs to apply a single IAM policy to every project belonging to one business unit, without repeating the binding per project. Which resource hierarchy level should the policy target?
- A. Each resource within the projects
- B. The billing account associated with the projects
- C. A folder containing those projects, since IAM policy is inherited downward through the hierarchy
- D. Each project individually, since folders do not carry IAM policy
Show answer & explanation
Answer: C
The hierarchy runs organization, folder, project, resource, and an IAM policy set at any level is inherited by everything beneath it. Folders exist precisely to group projects for shared policy and delegated administration. A billing account governs payment rather than access, so it is not an access-control boundary.2. A project's identifier must be referenced in automation scripts that will run for years. Which project attribute is safe to hard-code?
- A. The project name, which is a human-readable label
- B. The organization's domain name
- C. The project ID, which is globally unique and cannot be changed after creation
- D. The billing account display name
Show answer & explanation
Answer: C
A project carries three identifiers: a mutable display name, an immutable globally unique project ID, and an automatically assigned project number. Only the ID and number are stable, and the ID is the one most APIs and CLI commands expect. Scripting against the display name breaks the moment somebody renames the project.3. An engineer switches between two projects repeatedly while using the gcloud CLI. What is the cleanest way to avoid passing the project on every command?
- A. Edit the credentials file by hand between commands
- B. Use a separate machine for each project
- C. Create a named gcloud configuration per project and activate the one required
- D. Reinstall the SDK when switching projects
Show answer & explanation
Answer: C
gcloud configurations store a named set of properties including account, project and default region or zone, and activating one switches all of them together. This is what makes multi-project and multi-account work practical from one machine, and it avoids the error of running a destructive command against whichever project happened to be set.4. A VPC network is created and subnets are added. What is the scope of each?
- A. The VPC network is regional while subnets are zonal
- B. The VPC network is a global resource while each subnet is regional
- C. Both the VPC network and its subnets are regional
- D. Both are zonal resources tied to a single zone
Show answer & explanation
Answer: B
A Google Cloud VPC spans all regions without needing peering between them, and subnets carve regional address ranges out of it. That global scope is a genuine architectural difference from providers whose virtual networks are regional, and it means instances in different regions can communicate over internal addresses within one VPC.5. A firewall rule must apply only to a specific set of Compute Engine instances rather than to the whole subnet. What mechanism targets them?
- A. The machine type of the instances
- B. Network tags on the instances, referenced as the rule's target
- C. The instance names listed individually in the rule
- D. Labels on the instances, which firewall rules evaluate directly
Show answer & explanation
Answer: B
Network tags are the targeting mechanism for firewall rules and routes, while labels are metadata for organization and billing breakdown and are not evaluated by the network. Confusing the two is common because both are key-value-ish annotations, but only tags affect traffic. A service account can also be used as a firewall target, which is the more secure option since it cannot be self-assigned by an instance editor.6. A workload can tolerate interruption and needs the lowest possible compute cost. Which Compute Engine option fits?
- A. Spot VMs, which offer a deep discount in exchange for possible pre-emption at short notice
- B. Sole-tenant nodes
- C. Custom machine types
- D. Committed use discounts on standard instances
Show answer & explanation
Answer: A
Spot VMs trade availability for price and suit batch, rendering and fault-tolerant processing where a restart costs little. Committed use discounts reward predictable steady consumption over a term, sole-tenant nodes address physical isolation requirements, and custom machine types tune the CPU and memory ratio rather than the pricing model.7. A managed instance group is configured with autohealing. What determines when an instance is recreated?
- A. A health check that the group applies to each instance, with an initial delay before checking begins
- B. The instance's billing charges exceeding a budget
- C. The age of the instance since creation
- D. The instance's CPU utilization exceeding the autoscaling target
Show answer & explanation
Answer: A
Autohealing recreates an instance that fails its health check, and the initial delay exists so a slow-booting application is not killed before it can report healthy. Setting that delay too short produces a group that recreates instances forever without ever serving traffic, which is the classic misconfiguration. Autoscaling responds to load and is a separate mechanism.8. Data in Cloud Storage is written once and accessed roughly once a quarter, and must be retained for years. Which storage class is most appropriate?
- A. Nearline, which targets data accessed about once a month
- B. Standard, which targets frequently accessed data
- C. Coldline, which targets data accessed about once a quarter with a lower storage price and higher retrieval cost
- D. Archive, which targets data accessed less than once a year
Show answer & explanation
Answer: C
The four classes are graded by expected access frequency: Standard for frequent, Nearline for roughly monthly, Coldline for roughly quarterly and Archive for less than annual. Each step lowers storage price and raises retrieval cost, and the colder classes carry minimum storage durations, so moving data down too aggressively can cost more than leaving it warm.9. A bucket must move objects to a colder class automatically as they age. What provides this?
- A. Changing the bucket's default storage class, which reclassifies existing objects
- B. An object lifecycle management rule with an age condition and a SetStorageClass action
- C. A Cloud Scheduler job invoking a manual copy
- D. Enabling object versioning on the bucket
Show answer & explanation
Answer: B
Lifecycle rules evaluate conditions such as age, creation date or number of newer versions and apply SetStorageClass or Delete actions automatically. Changing the bucket's default class affects only objects written afterwards, leaving existing data where it was, which is the misconception this question targets.10. A team wants access to a Cloud Storage bucket controlled purely by IAM, with per-object ACLs disabled. What should be enabled?
- A. Object versioning, which retains prior object generations
- B. Requester pays, which shifts egress charges to the caller
- C. A retention policy, which prevents deletion for a period
- D. Uniform bucket-level access, which disables object ACLs so IAM alone governs access
Show answer & explanation
Answer: D
Uniform bucket-level access removes the dual permission model where an object ACL could grant access that bucket IAM did not, which is the source of most accidental public exposure. The other three options address version retention, egress billing and immutability respectively, none of which changes how access is evaluated.11. A bucket must serve users across a continent with the highest availability, and cost is secondary. Which location type applies?
- A. A multi-region location, which stores data redundantly across a geographic area at higher cost than a single region
- B. A dual-region location, which pairs exactly two named regions
- C. A single region, which minimises cost and latency for one area
- D. A zonal location, which confines data to one zone
Show answer & explanation
Answer: A
Cloud Storage offers region, dual-region and multi-region location types, and the choice is permanent for the bucket — it cannot be changed afterwards without copying the data to a new bucket. Multi-region maximises availability and continental reach, dual-region gives a named pair for a defined recovery posture, and a single region minimises cost and keeps data closest to one place. There is no zonal bucket.12. IAM roles are being assigned. What distinguishes a predefined role from a basic role?
- A. Predefined roles must be created by the customer before use
- B. Predefined roles are broader than basic roles
- C. Basic roles are broad legacy roles applying across all services, while predefined roles are curated per service and follow least privilege more closely
- D. Basic roles can only be granted to service accounts
Show answer & explanation
Answer: C
The basic roles Owner, Editor and Viewer predate IAM's granular model and grant sweeping permissions across every service in the project, which is why production use is discouraged. Predefined roles are maintained by Google per service, and custom roles are the customer-authored option when neither fits.13. A custom IAM role is created at the project level. Where can it be granted?
- A. Only to service accounts, not to users
- B. Only at the organization node
- C. Only within that project or its resources, since a project-level custom role is not visible to other projects
- D. Anywhere in the organization, since custom roles are global
Show answer & explanation
Answer: C
A custom role's scope follows where it was created: a project-level role is usable only in that project, while an organization-level role can be granted anywhere beneath the organization. Teams that create the same custom role in dozens of projects usually should have created it once at the organization level.14. A relational database must scale horizontally across regions with strong consistency and an SQL interface. Which managed service fits?
- A. Bigtable, which is a wide-column NoSQL store
- B. Cloud SQL, which is a managed single-instance relational database
- C. Cloud Spanner, which provides horizontal scale with strong consistency and relational semantics
- D. Firestore, which is a document database
Show answer & explanation
Answer: C
Spanner is the option combining relational semantics with horizontal scale and strong consistency across regions, at a correspondingly higher cost. Cloud SQL is the managed MySQL, PostgreSQL and SQL Server offering suited to conventional workloads, Bigtable suits very high-throughput wide-column access, and Firestore suits document-oriented application data.15. An analytics team needs to run SQL over terabytes of data without managing servers or clusters. Which service is intended for this?
- A. Compute Engine instances running a database manually
- B. Cloud SQL with a large machine type
- C. Bigtable with a wide row key design
- D. BigQuery, a serverless data warehouse where storage and query compute scale independently
Show answer & explanation
Answer: D
BigQuery removes cluster sizing entirely and bills against data stored and data scanned, so an occasional very large query needs no standing capacity. Because cost follows bytes scanned, partitioning, clustering and selecting only the needed columns have a direct financial effect rather than being purely performance tuning.16. A GKE cluster is created in Autopilot mode rather than Standard. What changes for the operator?
- A. Autopilot clusters cannot run more than one namespace
- B. The operator gains SSH access to the underlying nodes
- C. Google manages the nodes and the operator is billed for the resources pods request, rather than for provisioned node capacity
- D. Autopilot removes the need to define resource requests on pods
Show answer & explanation
Answer: C
Autopilot shifts node provisioning, scaling and maintenance to Google and changes the billing unit from node capacity to pod resource requests. That makes accurate requests more important rather than less, since they now drive the bill directly. Standard mode retains node-level control, including node pool configuration and node access.17. A GKE cluster needs two different machine types for different workloads. How is this configured?
- A. Create a second cluster, since a cluster supports one machine type
- B. Change the machine type of individual running nodes
- C. Use a custom machine type applied cluster-wide
- D. Create a second node pool with the required machine type and schedule workloads to it
Show answer & explanation
Answer: D
Node pools are groups of nodes sharing a configuration, and a cluster can carry several so that memory-heavy, GPU and general workloads coexist. Workloads are directed to the right pool with node selectors, taints and tolerations rather than by hoping the scheduler picks correctly.18. An HTTP application must be served from the closest of several regions to each user, behind a single anycast IP address. Which load balancer applies?
- A. DNS round-robin across regional addresses
- B. A network load balancer scoped to one region
- C. The global external HTTP(S) load balancer, which uses a single anycast address and routes to the nearest healthy backend
- D. A regional internal TCP load balancer
Show answer & explanation
Answer: C
The global HTTP(S) load balancer presents one anycast IP worldwide and directs each request to the nearest backend with capacity, which is why no DNS-based steering is needed. Network load balancing operates at layer 4 within a region, and DNS round-robin cannot react to backend health quickly because resolvers cache.19. A Compute Engine instance in a subnet without external addresses must reach the internet to download package updates. What provides this?
- A. A firewall rule permitting all egress
- B. Assigning an ephemeral external IP address to the instance
- C. Cloud NAT, which allows outbound-initiated connections without assigning external IP addresses
- D. Adding the instance to a load balancer backend service
Show answer & explanation
Answer: C
Cloud NAT gives outbound reachability while leaving the instances unreachable from the internet, which is the asymmetry a private subnet needs. Assigning an external address defeats the reason the instance had none, and a firewall rule can permit egress but cannot supply the address translation required for the traffic to return.20. A project is approaching a quota limit for a resource. What is the correct response?
- A. Request a quota increase for that resource in the project, since many quotas are adjustable on request
- B. Delete unrelated resources in other projects
- C. Create additional projects to work around the limit permanently
- D. Change the billing account, which resets all quotas
Show answer & explanation
Answer: A
Quotas are per project and per region and many can be raised through a request, so the supported path is to ask rather than to architect around the limit. Splitting work across projects to evade quota adds management overhead and hides the real capacity need, and changing billing does not reset quotas.21. Finance needs to attribute spend across teams sharing one project. What mechanism supports this?
- A. Labels applied to resources, which appear in billing export and let cost be grouped by the labelled dimension
- B. Resource names, parsed by the billing console
- C. IAM role bindings, which record cost per principal
- D. Network tags, which are surfaced in billing data
Show answer & explanation
Answer: A
Labels carry the business metadata that billing has no other way to know, such as which team or environment owns a resource, and billing export makes them groupable. Network tags exist for firewall and route targeting and do not reach billing, and IAM records who may act rather than who consumed.22. A project's billing account is disabled while resources are still running. What happens to those resources?
- A. Only new resource creation is blocked while existing ones are unaffected
- B. They continue running and charges accrue against the organization
- C. They are stopped and eventually deleted, since a project cannot run chargeable resources without an active billing account
- D. They are migrated automatically to another billing account
Show answer & explanation
Answer: C
Disabling billing is a destructive act rather than a pause: chargeable resources are shut down and data can be lost permanently, which is why it is the wrong lever for cost control. One billing account can serve many projects and a project links to exactly one at a time, so the safe way to stop spend on a project is to delete the specific resources or the project itself rather than to detach billing and hope.23. Billing data must be analysed historically with SQL. What should be configured?
- A. Downloading the monthly PDF invoice
- B. Applying a budget with a 100 percent threshold
- C. Billing export to BigQuery, which writes detailed usage and cost data for querying
- D. Enabling Cloud Monitoring on the billing account
Show answer & explanation
Answer: C
Billing export delivers granular per-SKU, per-project and per-label records into BigQuery, which is what makes historical trend analysis and chargeback possible. The console reports and invoices answer summary questions but cannot be joined against a team's own data, and monitoring covers resource metrics rather than cost.24. An operations team needs alerting when an application's error rate rises. Which service produces the alert?
- A. Cloud Trace, which records request latency distribution
- B. Cloud Logging, which stores log entries
- C. Cloud Build, which runs build pipelines
- D. Cloud Monitoring, using an alerting policy over a metric with a notification channel
Show answer & explanation
Answer: D
Cloud Monitoring owns metrics, dashboards and alerting policies, while Cloud Logging owns log storage and search. The two connect through log-based metrics, which turn a log pattern into a metric that Monitoring can then alert on — the usual route when the signal exists only in logs.25. Logs must be retained for seven years at low cost and remain queryable occasionally. What is the appropriate destination?
- A. Emailing the log entries to an archive mailbox
- B. Increasing the default retention of the _Default log bucket indefinitely
- C. Keeping the logs in Cloud Monitoring dashboards
- D. A log sink exporting matching entries to Cloud Storage, with a lifecycle policy moving them to colder classes
Show answer & explanation
Answer: D
Sinks route matching log entries to Cloud Storage, BigQuery or Pub/Sub based on a filter, and Cloud Storage with lifecycle transitions is the cheapest long-retention destination. Choosing BigQuery instead trades higher cost for immediate SQL access, so the decision follows how often the archive will actually be queried.26. A Compute Engine instance must be resized to a larger machine type. What is required?
- A. Stop the instance, change the machine type, and start it again
- B. Change the machine type while the instance is running
- C. Delete the instance and recreate it from scratch
- D. Create a new project with a higher quota
Show answer & explanation
Answer: A
Machine type changes require the instance to be stopped, which is why capacity changes are planned rather than reactive. The boot disk and its data persist across the change, so recreating the instance is unnecessary and would lose anything not stored on a persistent disk that was preserved.27. A persistent disk must survive the loss of an entire zone. Which disk type provides this?
- A. A local SSD attached to the instance
- B. A larger standard persistent disk
- C. A zonal SSD persistent disk with daily snapshots
- D. A regional persistent disk, which replicates synchronously across two zones in the region
Show answer & explanation
Answer: D
Regional persistent disks replicate across two zones so the data survives a zone failure, at higher cost and with some write latency. Local SSDs are the opposite extreme: physically attached, very fast and ephemeral, with data lost when the instance stops. Snapshots enable recovery rather than continuity, which is a different objective measured in restore time.28. Snapshots of a persistent disk are taken daily. What characterizes Compute Engine snapshots after the first one?
- A. Snapshots can only be restored to the same zone
- B. Deleting an older snapshot invalidates the newer ones
- C. They are incremental, storing only blocks changed since the previous snapshot, while each remains individually restorable
- D. Each snapshot is a full copy of the disk
Show answer & explanation
Answer: C
Snapshots are incremental in storage but behave as independent restore points, and the service manages the block dependencies so deleting an old snapshot does not break later ones. Snapshots are also a global resource, so a disk can be restored into a different zone or region, which is what makes them useful for migration as well as recovery.29. An instance template is updated with a new image. What happens to instances already running in the managed instance group?
- A. All running instances are recreated immediately
- B. Nothing until an update is started, since templates apply to instances created afterwards
- C. Running instances are patched in place
- D. The group is deleted and recreated automatically
Show answer & explanation
Answer: B
A template describes how new instances are built, so existing ones continue unchanged until a rolling update is initiated with a chosen maximum surge and maximum unavailable. Instance templates are also immutable once created, so a change means creating a new template rather than editing the existing one.30. A Kubernetes Deployment on GKE must be exposed to the public internet over HTTP with path-based routing. Which Kubernetes object is used?
- A. A ConfigMap, which holds configuration data
- B. An Ingress, which provisions an HTTP(S) load balancer and routes by host and path
- C. A DaemonSet, which runs one pod per node
- D. A ClusterIP Service, which is reachable only inside the cluster
Show answer & explanation
Answer: B
On GKE an Ingress provisions a Google Cloud HTTP(S) load balancer and supports host and path routing, which a Service of type LoadBalancer cannot express. ClusterIP is internal only, so it is the correct backing service type for an Ingress rather than an alternative to it.31. A service account in project A must read a Cloud Storage bucket in project B. How is this granted?
- A. Grant that service account a storage role on the bucket or on project B, since a service account is an identity usable across projects
- B. Recreate the service account inside project B
- C. Move the bucket into project A
- D. Enable VPC peering between the two projects
Show answer & explanation
Answer: A
A service account lives in one project but is an IAM principal that any project can grant a role to, which is the basis of cross-project access. Duplicating the identity or relocating the resource are both heavier answers to a problem a single role binding solves, and VPC peering addresses network reachability rather than authorization.32. A user must be able to use a service account's identity without holding its key. Which role enables that?
- A. Service Account Admin, which manages the account itself
- B. Project Viewer, which grants read access
- C. Service Account User on the service account, which allows acting as it
- D. Storage Object Viewer on the target bucket
Show answer & explanation
Answer: C
Impersonation is governed by roles on the service account resource itself: Service Account User permits acting as it, while Service Account Token Creator permits minting short-lived credentials. Administering an account is a separate permission from using it, which is a distinction worth keeping because the ability to act as a privileged account effectively confers its access.33. An IAM policy grants a role at the organization level and a narrower role at a project inside it. What is the effective permission at that project?
- A. No access, because the two grants conflict
- B. The union of both, since IAM grants are additive and inherited downward
- C. Only the organization-level grant
- D. Only the project-level grant, which overrides the broader one
Show answer & explanation
Answer: B
IAM bindings accumulate rather than override, so a narrower grant lower down cannot reduce what a broader grant above already conferred. Reducing effective access means removing the higher binding or applying an IAM deny policy, which is why an unexpectedly permissive result usually traces to an inherited grant rather than to the project's own bindings.34. Sensitive data must be encrypted at rest with keys the organization controls and can disable. What should be configured?
- A. Customer-managed encryption keys in Cloud KMS, referenced by the resource
- B. Google-managed default encryption, which is already applied
- C. Object versioning on the storage bucket
- D. A firewall rule restricting access to the resource
Show answer & explanation
Answer: A
Data at rest is encrypted by default with Google-managed keys, so the reason to configure customer-managed keys is control rather than the presence of encryption: the organization can rotate, disable or destroy the key, which renders the data unreadable. Disabling a key in use makes the data inaccessible immediately, which is the intended power and the operational hazard.35. Instances in a private subnet must reach the Cloud Storage API without traversing the internet. What provides this?
- A. Private Google Access on the subnet, letting instances without external addresses reach Google APIs
- B. A firewall rule allowing egress on port 443
- C. An external IP address on each instance
- D. Cloud NAT, which handles general outbound internet traffic
Show answer & explanation
Answer: A
Private Google Access is a subnet-level setting that lets instances lacking external addresses reach Google APIs and services over internal routing. Cloud NAT solves the adjacent problem of general internet egress, and the two are frequently confused because both remove the need for external IP addresses while doing so for different destinations.36. Two VPC networks in different projects must communicate over internal addresses. What connects them?
- A. An external load balancer in front of each
- B. VPC Network Peering, which requires non-overlapping address ranges and is not transitive
- C. A single subnet spanning both networks
- D. Cloud NAT configured in both projects
Show answer & explanation
Answer: B
Peering exchanges internal routes between two VPCs and requires that their ranges do not overlap. It is not transitive, so peering A to B and B to C leaves A and C unable to reach each other — a hub-and-spoke design needs an appliance or Network Connectivity Center rather than a chain of peerings.37. Several projects must share one central VPC administered by a network team. Which model applies?
- A. Placing all workloads in a single project
- B. Shared VPC, where a host project owns the network and service projects attach to it
- C. VPC peering between every pair of projects
- D. Copying the subnet definitions into each project
Show answer & explanation
Answer: B
Shared VPC centralizes network administration in a host project while letting service projects run workloads on its subnets, which keeps network policy with the network team and workloads with their owners. Full-mesh peering achieves connectivity but scatters administration and grows quadratically with the number of projects.38. A stateless container image must run and scale to zero when idle, with billing only for requests served. Which service fits?
- A. Cloud Run, which runs containers serverlessly and scales to zero
- B. GKE Standard with a fixed node pool
- C. Compute Engine with an autoscaling instance group
- D. App Engine flexible environment
Show answer & explanation
Answer: A
Cloud Run runs a container image with no cluster to manage and scales to zero between requests, which suits intermittent traffic. Instance groups and standard GKE node pools keep capacity provisioned and billed while idle, so their floor is above zero regardless of how little traffic arrives.39. Two services must be decoupled so a slow consumer does not block the producer. Which Google Cloud service provides the buffer?
- A. Pub/Sub, which accepts published messages and delivers them to subscribers independently
- B. Cloud Armor, which filters malicious traffic
- C. Cloud DNS, which resolves names
- D. Cloud CDN, which caches content at the edge
Show answer & explanation
Answer: A
Pub/Sub separates publication from consumption so a producer is unaffected by consumer availability or speed, and retains undelivered messages for a retention period. Delivery is at-least-once, so subscribers must be idempotent — duplicates are a normal condition rather than an error.40. Infrastructure must be defined declaratively and version-controlled. Which Google-native option does this?
- A. Manual creation through the console, documented afterwards
- B. A shell script of gcloud commands run in order
- C. Infrastructure as code with a declarative configuration, applied so the same definition converges rather than duplicating resources
- D. Exporting the current state to a spreadsheet
Show answer & explanation
Answer: C
A declarative definition describes the desired end state so reapplying it converges rather than creating duplicates, which is what makes environments reproducible and changes reviewable. An imperative script executes steps regardless of current state, so rerunning it can fail or duplicate work, and console changes leave no reviewable history at all.41. A new project needs the Compute Engine API before instances can be created. What must happen?
- A. A support case must be opened
- B. The billing account must be changed
- C. Nothing, since all APIs are enabled automatically
- D. The API must be enabled on the project, since APIs are disabled by default on a new project
Show answer & explanation
Answer: D
Services are enabled per project, so a new project starts with most APIs off and calls fail until the relevant one is enabled. This is a routine first step in project setup and a routine cause of confusing permission-looking errors, because the failure can read as an access problem rather than a disabled service.42. A project must be moved under a different folder in the organization. What is the effect on its IAM?
- A. All IAM bindings on the project are cleared
- B. The project retains inheritance from its previous folder
- C. The project must be recreated in the new folder
- D. The project keeps its own bindings but now inherits from the new parent instead of the old one
Show answer & explanation
Answer: D
Moving a project re-parents it, so inherited policy changes to that of the new ancestry while bindings set directly on the project are untouched. That makes a move a genuine access change and not merely an organizational tidy-up, which is why the effective policy should be reviewed afterwards rather than assumed unchanged.43. A deleted project is discovered to have been needed. What is possible?
- A. It can be restored at any time indefinitely
- B. It can be restored within a pending-deletion window, after which deletion becomes permanent
- C. It is destroyed immediately with no recovery path
- D. Only its billing history can be recovered
Show answer & explanation
Answer: B
Project deletion schedules the project for removal rather than executing immediately, leaving a window in which an owner can restore it. Some resources may still be irrecoverable after restoration, so the window is a safety net rather than a guarantee that nothing was lost.44. An operator needs to see who deleted a firewall rule and when. Which log records this?
- A. VPC Flow Logs, which record network traffic samples
- B. Application logs written by the workload
- C. Cloud Audit Logs, specifically the Admin Activity log, which records configuration changes and the calling identity
- D. Data Access logs, which record reads of user data
Show answer & explanation
Answer: C
Admin Activity audit logs capture administrative writes with the principal that made them and are enabled by default at no charge. Data Access logs cover reads of user data and are largely off by default because of volume, and flow logs describe network conversations rather than configuration changes.45. An instance is unreachable on port 443 from the internet even though the application is listening. Which layers must be checked?
- A. Only whether the external IP is static or ephemeral
- B. Only the VPC firewall rules
- C. Only the guest operating system firewall
- D. The VPC firewall rules and the guest operating system firewall, since traffic must pass both
Show answer & explanation
Answer: D
Both layers must permit the traffic, and a rule allowing it at one level is defeated by a block at the other. The guest firewall is the frequent oversight because the cloud-side configuration looks correct while the operating system silently drops the packets, and default-deny ingress in the VPC means an explicit allow rule is required in the first place.46. A Compute Engine instance has lost its SSH key and must be recovered without deleting it. What approach works?
- A. Delete and recreate the instance from the same boot disk name
- B. Change the machine type, which resets credentials
- C. Add a new key through instance or project metadata, or use OS Login to manage access through IAM
- D. Reassign the external IP address
Show answer & explanation
Answer: C
SSH keys live in metadata at project or instance scope, so adding one restores access without touching the instance's data. OS Login is the more manageable alternative, tying SSH access to IAM identities so that access is granted and revoked centrally rather than by editing key lists.47. An autoscaler on a managed instance group is configured with a CPU utilization target. What does the target represent?
- A. A hard ceiling above which instances are terminated
- B. The average utilization the autoscaler tries to maintain across the group by adding or removing instances
- C. The utilization at which billing changes rate
- D. The minimum utilization required before the group starts
Show answer & explanation
Answer: B
The autoscaler adds capacity when average utilization runs above the target and removes it when below, so the target is a set point rather than a limit. Scale-in is deliberately more conservative than scale-out because removing capacity too eagerly during a lull causes thrashing when load returns.48. A Cloud SQL instance must survive the failure of its zone with minimal manual intervention. What should be configured?
- A. A read replica, promoted manually if the primary fails
- B. A high availability configuration with a standby in another zone, which fails over automatically
- C. More frequent automated backups
- D. A larger machine type for the primary
Show answer & explanation
Answer: B
The high availability configuration maintains a standby in a second zone and fails over without manual promotion, keeping the same connection endpoint. Read replicas serve read scaling and use asynchronous replication, so promoting one is a manual operation that may lose recent writes, and backups address recovery rather than continuity.49. A Cloud SQL instance must be reachable from a Compute Engine instance without exposing it to the internet. What should be used?
- A. A public IP address with an authorized network covering the whole internet
- B. An external HTTP load balancer in front of the database
- C. A private IP address on the Cloud SQL instance, reached over the VPC
- D. A firewall rule on the Compute Engine instance only
Show answer & explanation
Answer: C
Private IP keeps the database on the VPC with no internet exposure, which is the preferred configuration. Where a public IP is required, authorized networks restrict which source ranges may connect and the Cloud SQL Auth Proxy handles authentication and encryption, but neither is a substitute for not being publicly reachable at all.50. A team must ensure no project in the organization can create resources with external IP addresses. What enforces this?
- A. An organization policy constraint applied at the organization or folder level
- B. An IAM role that omits the compute.instances.create permission
- C. A firewall rule denying all ingress
- D. A budget alert on network egress
Show answer & explanation
Answer: A
Organization policies constrain what configurations are permitted regardless of what IAM allows, so even a project owner cannot create a disallowed resource. IAM answers who may act and organization policy answers what may be configured, and both are needed because an authorized principal can still create a non-compliant resource.51. A Cloud Storage object must be shared with someone outside the organization for a limited period without granting them an IAM role. What mechanism fits?
- A. Making the bucket publicly readable
- B. Adding the person as a project Viewer
- C. A signed URL, which grants time-limited access to a specific object
- D. Sending them a service account key file
Show answer & explanation
Answer: C
Signed URLs carry a scoped, expiring capability for one object and one operation, and need no account on the recipient's side. Making the bucket public exposes everything in it to everyone, project Viewer is far broader than one object, and sharing a key file hands over a durable identity rather than a temporary permission.52. An application's secrets must be stored centrally with versioning and access controlled by IAM. Which service is intended for this?
- A. Cloud Storage with a restricted bucket
- B. Environment variables set in the deployment configuration
- C. Instance metadata on each VM
- D. Secret Manager, which stores versioned secrets with IAM-controlled access and audit logging
Show answer & explanation
Answer: D
Secret Manager provides versioning, per-secret IAM and audit logging of access, which a restricted bucket approximates poorly and environment variables not at all. Storing secrets in metadata or configuration also spreads them across every place a deployment is defined, which makes rotation a search-and-replace exercise.53. A Compute Engine instance runs continuously for a full month with no commitment purchased. What pricing behaviour applies automatically?
- A. A discount only if the instance is a spot VM
- B. No discount, since any reduction requires a committed use contract
- C. A discount only after a support case requests it
- D. Sustained use discounts, applied automatically as usage in a month rises, with no commitment or action required
Show answer & explanation
Answer: D
Sustained use discounts apply automatically to eligible Compute Engine usage as the portion of the month a resource runs increases, requiring neither a commitment nor a purchase. Committed use discounts are the separate mechanism that trades a one or three-year commitment for a deeper reduction, and the two are evaluated together rather than being alternatives to choose between.54. An operator wants to know which instances are running across all zones in a project from the command line. Which approach is correct?
- A. Run the list command once per zone and combine the output manually
- B. Query the billing export, which is the only cross-zone view
- C. List instances without specifying a zone, since the list command returns instances across zones by default
- D. Check each instance individually by name
Show answer & explanation
Answer: C
Aggregate list behaviour returns instances across all zones unless a zone is specified, which is why the output carries a zone column. Filters and format flags then narrow and shape the result, which is more reliable than post-processing text and is what makes gcloud output usable in scripts.55. A Kubernetes workload on GKE must access a Google Cloud API using an IAM identity rather than a stored key. What provides this?
- A. Workload Identity, which binds a Kubernetes service account to a Google service account
- B. Running the workload with host networking
- C. Granting the node pool's service account broad project roles
- D. Mounting a downloaded service account key as a Kubernetes Secret
Show answer & explanation
Answer: A
Workload Identity maps a Kubernetes service account to a Google service account so pods obtain short-lived credentials with no key material in the cluster. The alternatives are exactly what it replaces: a mounted key is a durable secret in the cluster, and granting the node service account broad roles gives every pod on the node the same access.56. A container image built by the team must be stored for deployment to Cloud Run and GKE. Which service is intended?
- A. Cloud Source Repositories, which hosts source code
- B. Cloud Storage, storing the image as a tar file
- C. Artifact Registry, which stores container images and language packages with IAM-controlled access
- D. Persistent disk snapshots
Show answer & explanation
Answer: C
Artifact Registry is the managed registry for images and packages, integrating with IAM, vulnerability scanning and the deployment services. Source repositories hold code rather than built artefacts, and storing an image as an object in a bucket loses the registry semantics that make pulls and tags work.57. A GKE cluster must receive Kubernetes version updates automatically, favouring stability over early access to new features. Which setting applies?
- A. Disabling auto-upgrade on the node pools
- B. Pinning the cluster to a specific patch version indefinitely
- C. Enrolment in the rapid release channel
- D. Enrolment in the stable release channel, which lags the rapid and regular channels
Show answer & explanation
Answer: D
GKE release channels trade currency against stability: rapid gets new versions first, regular is the default middle ground, and stable lags both so a version has been exercised longer before it reaches the cluster. Disabling auto-upgrade is not a stability strategy in the long run, because a cluster left behind eventually falls out of support and must then make a much larger jump.58. A Cloud Run service must receive only a percentage of traffic on a new revision while the rest stays on the previous one. What supports this?
- A. Traffic splitting across revisions, assigning a percentage to each
- B. Scaling the previous revision to zero
- C. A firewall rule sampling requests
- D. Deploying a second service and using DNS weighting
Show answer & explanation
Answer: A
Cloud Run keeps revisions and can split traffic between them by percentage, which is what makes a canary release possible without extra infrastructure. DNS weighting is a blunter instrument because resolver caching delays both the rollout and any rollback.59. An operator must grant a contractor read-only visibility of resources in one project for a fixed period. What is the appropriate approach?
- A. Grant a viewer-level predefined role scoped to that project, with an IAM condition expiring the access
- B. Grant Editor and rely on the contractor not to change anything
- C. Share a team member's credentials
- D. Add the contractor as an organization Viewer
Show answer & explanation
Answer: A
Scoping the grant to the project and attaching a time-based IAM condition means the access narrows and ends without depending on anyone remembering to revoke it. Granting at organization level exceeds the need, sharing credentials destroys attribution, and granting Editor relies on restraint rather than on permission.60. A team wants to know why a particular request to their service was slow, down to the individual downstream calls it made. Which service is intended?
- A. Cloud Profiler, which samples CPU and memory usage
- B. Cloud Monitoring, which aggregates metrics
- C. Cloud Trace, which records latency across the spans of a single request
- D. Cloud Logging, which stores discrete log entries
Show answer & explanation
Answer: C
Trace reconstructs a single request as a tree of timed spans, which is what identifies the downstream call responsible for the latency. Monitoring shows that latency rose in aggregate and logging shows what individual components recorded, while Profiler answers where code time is spent rather than which call in a request was slow.61. An on-premises data centre needs private, high-bandwidth connectivity to a VPC with predictable throughput, rather than an encrypted tunnel over the public internet. Which option fits?
- A. Cloud Interconnect, which provides a dedicated or partner physical connection with committed bandwidth
- B. VPC Network Peering with the on-premises network
- C. Private Google Access on the on-premises subnet
- D. Cloud VPN, which builds an IPsec tunnel over the internet
Show answer & explanation
Answer: A
Interconnect delivers a physical link with committed bandwidth and lower, more predictable latency, either as a dedicated connection or through a partner. Cloud VPN is cheaper and faster to stand up but rides the public internet on best-effort performance. Peering connects two VPCs rather than a VPC to a physical network, and Private Google Access is a subnet setting about reaching Google APIs.
More in this family
Explore more Google Cloud certifications
In the same family
More in this category
- Certified Information Systems AuditorPractice questions →
- Certified Information Security ManagerPractice questions →
- ISC2 Certified in Cybersecurity (CC)Practice questions →
- Project Management Professional (PMP)Practice questions →
- Salesforce Certified Platform AdministratorPractice questions →
- HashiCorp Certified: Terraform Associate (004)Practice questions →
- AWS Certified AI PractitionerPractice questions →
- AWS Certified Cloud PractitionerPractice questions →
- AWS Certified Developer - AssociatePractice questions →
- AWS Certified Solutions Architect – AssociatePractice questions →
- Microsoft Certified: Azure Administrator Associate (Exam AZ-104)Practice questions →
2026 statistics
Key facts: Associate Cloud Engineer exam
The Associate Cloud Engineer is administered by Google Cloud, with a 2 hours time limit.
This free Associate Cloud Engineer practice test has 61 original questions written to Google Cloud's official content outline, last checked against it on July 23, 2026. Every question shows a worked explanation, and nothing here requires a signup.
As of 2026, the Associate Cloud Engineer exam fee is $125.
Every free resource for this exam
Get a free Associate Cloud Engineer study plan
A week-by-week plan plus new practice questions, straight to your inbox.
Official sources
Every exam fact on this page traces to a primary document published by the body that administers the exam.
- Associate Cloud Engineer CertificationGoogle Cloudcloud.google.com
- Associate Cloud Engineer Certification Exam GuideGoogle Cloudservices.google.com
- Associate Cloud Engineer CertificationGoogle Cloudcloud.google.com
- Associate Cloud Engineer Certification Exam GuideGoogle Cloudservices.google.com
- Google Cloud Certification Exam Terms and ConditionsGoogle Cloudcloud.google.com
Last verified against the official exam content outline:
Frequently asked questions
How closely do these practice questions match the real ACE exam?
They are written against Google's four published domains and weighted the same way: Setting up a cloud solution environment at 20 percent, Planning and implementing at 30, Ensuring successful operation at 30, and Configuring access and security at 20. The real exam presents 50 to 60 questions in 2 hours, so working through a set of this size covers comparable ground to a full sitting.
How much hands-on experience should I have before relying on practice questions?
Google recommends around 6 months or more of hands-on Google Cloud experience. That matters for how you use a question bank: with real experience, practice questions reveal gaps in coverage, whereas without it they tend to teach the answers to those specific items rather than the underlying service behaviour. If a question's explanation is the first time you have met a service, treat that as a signal to go and use it.
How should I pace myself against the real exam clock?
2 hours for 50 to 60 questions works out to roughly 2 to 2.4 minutes each. That is generous compared with most certification exams and is deliberate, because ACE scenarios often describe a small architecture before asking the question. Use practice sets to build the habit of reading the whole scenario once rather than skimming for keywords, since the distractors are usually plausible services that solve an adjacent problem.
What does the ACE certification cost and how long does it last?
The exam fee is $125 and the certification is valid for 3 years. Renewal is cheaper and shorter: a $75 renewal exam of 20 questions in 1 hour, which can be taken within a 180-day window before expiry. Planning for that window matters, because letting a certification lapse means sitting the full exam again rather than the renewal.
Which domain should I practise hardest?
Follow the weightings rather than instinct. Planning and implementing, and Ensuring successful operation, carry 30 percent each — 60 percent of the exam between them — while Setting up the environment and Configuring access and security carry 20 percent each. Candidates who over-invest in IAM because it feels intricate are polishing a fifth of the paper, and the operations domain in particular rewards familiarity with monitoring, logging and instance group behaviour.