Question bank
Google Associate Cloud Engineer
40 Google Associate Cloud Engineer questions with the correct answer and a written explanation, organised across 4 exam domains.
- 40 questions
- 4 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Configuring access and security
8 questions in this domain
- Question 1Single Choice
What is the purpose of the 'etag' field in an IAM policy object?
- AIt specifies the version of the policy schema.
- BIt provides optimistic concurrency control to prevent race conditions.Correct answer
- CIt indicates the expiry time of the policy.
- DIt stores the hash of the policy for integrity checking.
Why this is the answer
The etag field is used for optimistic concurrency control. When you fetch a policy, the etag is returned; you must include it in subsequent write requests to ensure you are modifying the latest version. This prevents race conditions when multiple administrators update the same policy.
- Question 2Multiple Select
Which of the following are characteristics of predefined roles in Google Cloud IAM? (Choose two.)
- AThey are coarse-grained and include permissions across all resources.
- BThey are curated by Google to follow the principle of least privilege.Correct answer
- CThey can be modified by adding custom permissions.
- DThey are fine-grained and provide specific permissions for a service.Correct answer
Why this is the answer
Predefined roles are curated by Google to be fine-grained and follow least privilege. They are not coarse-grained like primitive roles, and they cannot be modified (that is the purpose of custom roles).
- Question 3Interactive
Review the following scenario and the gcloud command. A company needs to create a service account key for an external workload. What is the correct command to create a new JSON key for service account 'my-sa@project.iam.gserviceaccount.com'?
- Agcloud iam service-accounts keys create --iam-account my-sa@project.iam.gserviceaccount.com key.jsonCorrect answer
- Bgcloud iam service-accounts create my-sa --project my-project
- Cgcloud iam service-accounts keys list --iam-account my-sa@project.iam.gserviceaccount.com
- Dgcloud auth activate-service-account --key-file key.json
Why this is the answer
The correct command creates a new key: gcloud iam service-accounts keys create key.json --iam-account my-sa@project.iam.gserviceaccount.com. The other options either list keys, create a service account, or activate a key file.
- Question 4Single Choice
What is the primary purpose of VPC Service Controls?
- AControlling network traffic based on IP addresses and ports.
- BPreventing unauthorized access to data by creating perimeters around services.Correct answer
- CAllowing private access to Google APIs from on-premises networks.
- DLogging all API calls made to Google Cloud services.
Why this is the answer
VPC Service Controls create perimeters around GCP services (like Cloud Storage, BigQuery) to prevent data exfiltration and unauthorized access. They work at the service API layer, not the network layer.
- Question 5Multiple Select
Which of the following are requirements for a Compute Engine VM to use Private Google Access? (Choose two.)
- AThe VM must have an external IP address.
- BThe subnet must have Private Google Access enabled.Correct answer
- CThe VM must have the appropriate IAM roles to access the target services.Correct answer
- DA Cloud VPN or Interconnect connection to on-premises is required.
Why this is the answer
Private Google Access requires the subnet to be enabled for PGA and the VM must have the correct IAM permissions (roles) for the target services. An external IP is not required; that is the point of PGA. VPN/Interconnect is for on-premises PGA, not for VM-based PGA.
- Question 6Interactive
A company wants to enforce an organization policy that prevents creation of VM instances with external IPs in all projects under a folder. Which gcloud command sets this constraint at the folder level?
- Agcloud resource-manager org-policies set-policy policy.yaml --folder=FOLDER_IDCorrect answer
- Bgcloud compute project-info add-metadata --metadata=block-project-ssh-keys=true
- Cgcloud compute instances set-iam-policy my-instance policy.yaml
- Dgcloud iam service-accounts set-iam-policy SA@PROJECT.iam.gserviceaccount.com policy.yaml
Why this is the answer
The correct command is 'gcloud resource-manager org-policies set-policy' with a policy YAML file that contains the constraint definition. The other commands are for metadata, instance IAM, and service account IAM respectively.
- Question 7Single Choice
Which IAM role must be granted to a service account to allow an application to read the payload of a secret from Secret Manager?
- Aroles/secretmanager.admin
- Broles/secretmanager.secretAccessorCorrect answer
- Croles/secretmanager.viewer
- Droles/cloudkms.cryptoKeyDecrypter
Why this is the answer
The Secret Manager Secret Accessor role (roles/secretmanager.secretAccessor) grants permission to access secret versions and read secret data. The admin role includes management, not just access. The viewer role only sees metadata. Cloud KMS roles are for encryption keys.
- Question 8Multiple Select
Which of the following types of Cloud Audit Logs are enabled by default and free of charge? (Choose two.)
- AAdmin ActivityCorrect answer
- BData Access
- CSystem EventCorrect answer
- DVPC Flow Logs
Why this is the answer
Admin Activity and System Event audit logs are enabled by default and free. Data Access logs are optional and incur costs. VPC Flow Logs are not audit logs; they capture network metadata.
Ensuring the successful operation of a cloud solution
12 questions in this domain
- Question 9Single Choice
What happens to persistent disks when you stop a Compute Engine instance?
- APersistent disks are preserved; storage costs continueCorrect answer
- BPersistent disks are deleted
- CPersistent disks are detached
- DPersistent disks are snapshotted automatically
Why this is the answer
Stopping an instance preserves all persistent disks; only compute costs stop, disk storage continues to incur charges.
- Question 10Multiple Select
Which two Cloud Storage storage classes are designed for infrequently accessed data?
- AStandard
- BNearlineCorrect answer
- CArchive
- DColdlineCorrect answer
Why this is the answer
Nearline and Coldline are designed for infrequently accessed data, with minimum storage durations of 30 and 90 days respectively.
- Question 11Interactive
What action does the following gcloud command perform?
- ACreates a snapshot of the specified persistent diskCorrect answer
- BDeletes the specified persistent disk
- CCreates a new persistent disk from a snapshot
- DAttaches a disk to an instance
Why this is the answer
The command creates an incremental snapshot of the source disk, used for backup or creating new disks.
- Question 12Single Choice
What is the highest possible priority value for a VPC firewall rule?
- A0Correct answer
- B1000
- C65535
- D100
Why this is the answer
Priority values range from 0 to 65535, with lower numbers having higher precedence; 0 is the highest.
- Question 13Multiple Select
Choose two valid severity levels in Cloud Logging.
- AERRORCorrect answer
- BWARNINGCorrect answer
- CCRITICAL
- DFATAL
Why this is the answer
Cloud Logging severity levels include ERROR and WARNING; FATAL is not a standard level.
- Question 14Interactive
What does this Cloud Logging query filter?
- AError and higher severity logs from Compute Engine instancesCorrect answer
- BAll logs from Compute Engine instances
- COnly critical logs
- DLogs from all resources except instances
Why this is the answer
The query retrieves logs from Compute Engine instances with severity ERROR or higher (including CRITICAL, etc.).
- Question 15Single Choice
Which gcloud command configures kubectl to connect to a GKE cluster?
- Agcloud container clusters get-credentialsCorrect answer
- Bgcloud container clusters create
- Ckubectl cluster-info
- Dgcloud auth application-default login
Why this is the answer
This command downloads cluster credentials and configures kubectl to connect to the specified GKE cluster.
- Question 16Multiple Select
Select two backup methods for Compute Engine persistent disks.
- ASnapshotsCorrect answer
- BImagesCorrect answer
- CObject versioning
- DDatabase export
Why this is the answer
Snapshots are incremental backups of disks; images capture the full OS and disk state for cloning.
- Question 17Interactive
What does this gcloud command create?
- AA snapshot schedule for persistent disksCorrect answer
- BA Cloud Scheduler job
- CA lifecycle rule
- DA backup of a disk
Why this is the answer
This command creates a resource policy that automatically takes daily snapshots of attached persistent disks.
- Question 18Single Choice
What happens when you change the machine type of a running Compute Engine instance?
- AThe instance reboots brieflyCorrect answer
- BThe instance remains running without interruption
- CThe instance is stopped and restarted automatically
- DThe change is applied only after the next stop
Why this is the answer
Changing machine type on a running instance requires a reboot; the instance is briefly interrupted.
- Question 19Multiple Select
Select two prerequisites for enabling Cloud CDN.
- AAn HTTP(S) Load BalancerCorrect answer
- BA Cloud NAT gateway
- CA backend bucket or serviceCorrect answer
- DA Cloud VPN tunnel
Why this is the answer
Cloud CDN requires an HTTP(S) Load Balancer and a backend (Cloud Storage bucket or instance group).
- Question 20Interactive
What is the purpose of the 'kubectl describe pod my-pod' command?
- ADisplays detailed information about a podCorrect answer
- BDeletes a pod
- CLists all pods
- DCreates a pod
Why this is the answer
It shows detailed state, metadata, and events for the specified pod.
Planning and implementing a cloud solution
12 questions in this domain
- Question 21Single Choice
Which Google Cloud compute service provides the highest abstraction, requiring only code and configuration files?
- ACompute Engine
- BGoogle Kubernetes Engine
- CApp EngineCorrect answer
- DCloud Functions
Why this is the answer
App Engine is a PaaS offering automatic scaling and runtime management, requiring only code and a configuration file.
- Question 22Multiple Select
Which two characteristics apply to App Engine Standard environment? (Choose two)
- ASupports custom containers
- BSandboxed runtimeCorrect answer
- CAutomatic scalingCorrect answer
- DRuns any programming language
Why this is the answer
App Engine Standard provides a sandboxed runtime and automatic scaling. It does not support custom containers or arbitrary languages.
- Question 23Interactive
Review the following gcloud command that creates a resource. What compute component is this resource used by?
- AManaged Instance GroupsCorrect answer
- BUnmanaged Instance Groups
- CApp Engine
- DGKE
Why this is the answer
Instance templates are used by Managed Instance Groups (MIGs) to create and manage identical VMs.
- Question 24Single Choice
Which Cloud Storage class has a minimum storage duration of 90 days and is suitable for data accessed less than once a quarter?
- AStandard
- BNearlineCorrect answer
- CColdline
- DArchive
Why this is the answer
Nearline has a 30-day minimum; Coldline has 90 days. For quarterly access, Coldline is appropriate, but the question specifies 90-day minimum, so Nearline is incorrect. Correct is Coldline? Wait, re-examine: playbook says Nearline minimum 30 days, Coldline minimum 90 days. The question says 'accessed less than once a quarter' (quarter ~90 days) and 'minimum storage duration of 90 days' – that matches Coldline. Let me adjust options. Actually Nearline has 30 days, so for quarterly it would be Coldline. But the question says 90-day minimum. Let me fix: change correct to Coldline. Options: Standard no min, Nearline 30 days, Coldline 90 days, Archive 365 days. So correct is Coldline. I'll correct the answers in the JSON below.
- Question 25Multiple Select
Which two statements about Firestore Native mode are correct? (Choose two)
- ASupports real-time listenersCorrect answer
- BUses eventual consistency by default
- CProvides strong consistencyCorrect answer
- DIs backward compatible with App Engine Datastore
Why this is the answer
Firestore Native mode offers real-time listeners and strong consistency. Datastore mode provides eventual consistency and backward compatibility.
- Question 26Interactive
Examine the BigQuery SQL query below. What configuration technique is needed to avoid full table scans and reduce costs?
- APartitioningCorrect answer
- BClustering
- CSharding
- DReplication
Why this is the answer
Partitioning divides a table into segments based on a date column, allowing the query engine to scan only relevant partitions.
- Question 27Single Choice
In a custom-mode VPC, what is the scope of a subnet?
- AGlobal
- BRegionalCorrect answer
- CZonal
- DProject
Why this is the answer
Subnets in Google Cloud are regional resources. Each subnet is associated with a specific region and cannot span multiple regions.
- Question 28Multiple Select
Which two statements about Cloud NAT are correct? (Choose two)
- AIt provides outbound internet access for private instances.Correct answer
- BIt allows inbound connections from the internet to private instances.
- CIt is a regional resource.Correct answer
- DIt provides static IP addresses for inbound traffic.
Why this is the answer
Cloud NAT enables outbound internet access for private VMs and is regional. It does not allow inbound connections.
- Question 29Interactive
Review the firewall rule configuration below. What is the action for traffic from source range 10.0.0.0/8 to port 22?
- AAllowed
- BDeniedCorrect answer
- CLogged only
- DNot applicable
Why this is the answer
Rule 500 denies traffic from 10.0.0.0/8 on port 22, and it has higher priority (lower number) than rule 1000, so the deny is applied.
- Question 30Single Choice
Which load balancer type is global and supports HTTP/HTTPS traffic?
- AExternal TCP/UDP Network Load Balancer
- BExternal HTTP(S) Load BalancerCorrect answer
- CInternal TCP/UDP Load Balancer
- DSSL Proxy Load Balancer
Why this is the answer
The External HTTP(S) Load Balancer is a global Layer 7 load balancer that uses a single anycast IP address.
- Question 31Multiple Select
Which two components are required to configure a backend service for autoscaling with a managed instance group? (Choose two)
- AInstance templateCorrect answer
- BUnmanaged instance group
- CHealth checkCorrect answer
- DCloud NAT
Why this is the answer
A MIG requires an instance template and a health check to enable autoscaling. Unmanaged groups cannot autoscale.
- Question 32Interactive
The code below shows an autoscaling policy. What parameter prevents rapid scaling oscillations by allowing new VMs to stabilize?
- ACool-down periodCorrect answer
- BTarget CPU utilization
- CMin replicas
- DMax replicas
Why this is the answer
The cool-down period (default 60 seconds) prevents autoscaler from adding or removing instances too quickly based on initialization.
Setting up a cloud solution environment
8 questions in this domain
- Question 33Single Choice
Which characteristic of a GCP project ID is immutable after creation?
- AProject IDCorrect answer
- BProject name
- CBilling account
- DProject number
Why this is the answer
Project ID is globally unique and immutable; project name and billing account can be changed.
- Question 34Multiple Select
Which of the following are supported destinations for Google Cloud billing exports? (Select two.)
- ABigQueryCorrect answer
- BCloud StorageCorrect answer
- CCloud SQL
- DPub/Sub
Why this is the answer
Cloud Storage (CSV/JSON) and BigQuery (detailed daily table) are the two export destinations. Pub/Sub is for streaming but not a standard billing export destination.
- Question 35Interactive
You are automating a deployment script. Which gcloud command authenticates using a service account key file without user interaction?
- Agcloud auth activate-service-account --key-file=KEY_PATHCorrect answer
- Bgcloud auth login
- Cgcloud init
- Dgcloud auth application-default login
Why this is the answer
The correct command is gcloud auth activate-service-account with the key file flag for automated scripts.
- Question 36Single Choice
How much persistent storage is provided to the Cloud Shell home directory by default?
- A5 GBCorrect answer
- B10 GB
- C1 GB
- D20 GB
Why this is the answer
Cloud Shell allocates 5 GB of persistent disk storage in the home directory for each user.
- Question 37Multiple Select
Which of the following are valid principals in Google Cloud IAM? (Select two.)
- AService accountCorrect answer
- BGoogle GroupCorrect answer
- CIP address
- DAPI key
Why this is the answer
IAM members can be Google Accounts, Google Groups, service accounts, or Cloud Identity domains. IP addresses and API keys are not IAM principals.
- Question 38Interactive
You need to move an existing project from one folder to another. Which gcloud command must be used?
- Agcloud projects move PROJECT_ID --folder=FOLDER_IDCorrect answer
- Bgcloud projects update PROJECT_ID --parent=folders/FOLDER_ID
- Cgcloud projects update PROJECT_ID --folder=FOLDER_ID
- Dgcloud resource-manager projects move PROJECT_ID --folder=folder/FOLDER_ID
Why this is the answer
The correct command is `gcloud projects move PROJECT_ID --folder=FOLDER_ID`.
- Question 39Single Choice
What is the grace period for recovering a deleted GCP project?
- A30 daysCorrect answer
- B7 days
- C14 days
- D45 days
Why this is the answer
After deletion, projects enter a 30-day grace period during which they can be recovered intact.
- Question 40Multiple Select
Which types of thresholds can trigger budget alerts in Google Cloud billing? (Select two.)
- AActual spendCorrect answer
- BForecasted spendCorrect answer
- CAverage daily spend
- DResource count
Why this is the answer
Alerts can be triggered by actual spend reaching a threshold or by forecasted end-of-month spend reaching a threshold.
Frequently asked questions
Everything about the Google Associate Cloud Engineer question bank and how to use it.