GCP Associate Cloud Engineer Practice Questions¶

40 practice questions covering all exam domains.

Exam Domain Breakdown: - Setting up a cloud solution environment (17.5%) - 7 questions - Planning and configuring a cloud solution (17.5%) - 7 questions - Deploying and implementing a cloud solution (25%) - 10 questions - Ensuring successful operation of a cloud solution (20%) - 8 questions - Configuring access and security (20%) - 8 questions

Cert page: exams/gcp/cloud-engineer/

Setting Up a Cloud Solution Environment (17.5%)¶

Question 1¶

Scenario: A company is starting to use Google Cloud and needs to organize resources for three departments: Marketing, Engineering, and Sales. Each department should have separate billing and resource management. What is the recommended approach?

A. Create one project with three folders inside it, one per department, and use labels on the resources for the billing split B. Create one organization with three folders, each containing projects C. Create three billing accounts, each linked to the same shared projects, and let each department manage its own account D. Create three separate projects with no organization over them, one per department, and link each to its own billing account

Question 2¶

Scenario: A developer needs to use the gcloud CLI to manage resources in a specific project. They have access to multiple projects. How should they configure gcloud to work with the correct project?

A. Hand-edit the gcloud config file B. Export a GOOGLE_PROJECT variable C. Add the --project flag only to the first command in each session D. Run gcloud config set project PROJECT_ID

Question 3¶

Scenario: A company needs to grant a contractor temporary access to view Cloud Storage buckets in a specific project for an audit. The access should expire in 30 days. What should be configured?

A. Grant the storage.admin role temporarily and ask the contractor to stop using it, with a calendar reminder to remove it after 30 days B. Add the contractor to a Google Group that holds the storage.objectViewer role, and remove the person from the group when the audit ends C. Create a service account with read access and share its key file with the contractor, rotating the key after 30 days D. Grant storage.objectViewer role with an IAM condition for time-based access

Question 4¶

Scenario: An organization needs to ensure that no resources are created in certain regions due to data residency requirements. How can they enforce this across all projects?

A. Use Cloud Armor policies B. Configure VPC firewall rules C. Set organization policies with location constraints D. Configure Cloud NAT for specific regions

Question 5¶

Scenario: A team needs to create multiple identical environments (dev, staging, prod) with the same infrastructure configuration. What tool should they use?

A. gcloud CLI scripts only B. Infrastructure Manager or Terraform C. Cloud Marketplace D. Cloud Console

Question 6¶

Scenario: A company wants to monitor and control cloud spending with alerts when costs exceed budgets. What should they configure?

A. Organization policies that restrict which services and regions can be used, to keep spending within what finance has approved B. Quotas and limits on each API, so that resource usage stops when the project reaches the maximum that is allowed C. Cloud Monitoring alerts on the CPU and instance count metrics, which indicate cost growth ahead of the monthly invoice D. Cloud Billing budgets and alerts

Question 7¶

Scenario: An administrator needs to view all IAM policy changes across the organization for compliance auditing. Where should they look?

A. Cloud Monitoring dashboards, which chart performance metrics and can show a count of policy updates over time B. Security Command Center, which lists vulnerabilities and misconfigurations found in the organization's resources C. Cloud Audit Logs (Admin Activity logs) D. Cloud Billing reports, which break down spending by project and service and show who changed the billing settings

Planning and Configuring a Cloud Solution (17.5%)¶

Question 8¶

Scenario: A web application needs to automatically scale based on CPU usage. The application runs on Compute Engine VMs. What should be configured?

A. Cloud Run with automatic scaling, which adds container instances as request concurrency rises for stateless services B. Cloud Functions with concurrent execution, which runs more copies of an event-driven function as events arrive C. Managed Instance Group with autoscaling policy D. Kubernetes HPA, which adds pods to a Deployment when CPU rises but needs a GKE cluster to run on

Question 9¶

Scenario: A company needs to store 100 TB of data that will be accessed about once per year for compliance purposes. Cost is the primary concern. What storage option should they choose?

A. Cloud Storage Coldline, with a 90-day minimum B. Cloud Storage Nearline, with a 30-day minimum C. Cloud Storage Archive D. Standard storage

Question 10¶

Scenario: An application needs a fully managed relational database with automatic replication across multiple regions for high availability and disaster recovery. What should be used?

A. Cloud Spanner with a multi-region configuration B. Firestore C. Cloud SQL with cross-region read replicas and manual promotion D. BigQuery

Question 11¶

Scenario: A data analytics team needs to run SQL queries on petabytes of data without managing infrastructure. The queries are ad-hoc and run a few times per day. What service should they use?

A. Dataproc B. BigQuery with on-demand pricing C. Cloud Spanner with a multi-region configuration D. Cloud SQL with a read replica for reports

Question 12¶

Scenario: A company needs to connect their on-premises network to Google Cloud with dedicated, private connectivity for regulatory compliance. What should they use?

A. Cloud VPN B. Cloud Interconnect C. VPC Peering D. Cloud Router

Question 13¶

Scenario: An application needs to send 10 million push notifications per day with minimal latency. The notifications must be processed exactly once. What GCP service should be used?

A. Cloud Run B. Pub/Sub with exactly-once delivery C. Cloud Tasks D. Cloud Functions with a trigger per message

Question 14¶

Scenario: A startup needs to deploy a containerized web application quickly without managing servers or Kubernetes clusters. They need automatic scaling to zero when idle to minimize costs. What should they use?

A. GKE Standard B. App Engine Flexible C. Cloud Run (fully managed), which scales to zero when idle D. Compute Engine

Deploying and Implementing a Cloud Solution (25%)¶

Question 15¶

Scenario: A developer needs to deploy a Compute Engine VM from a custom image. The VM should automatically restart if it fails. How should this be configured?

A. Create a single Spot VM with the stop termination action B. Create an instance template and an unmanaged instance group C. Create an instance template and a managed instance group with autohealing D. Use Kubernetes with node auto-repair

Question 16¶

Scenario: A developer needs to deploy a containerized application to GKE. The application needs 2 replicas with a load balancer. What Kubernetes resources should be created?

A. A DaemonSet and a NodePort Service, which run one pod on each node and expose each node on a high port number B. Deployment and Service (type: LoadBalancer) C. A StatefulSet and an Ingress, which give each pod a stable name and storage and route HTTP traffic by path D. A single Pod and a Service of type ClusterIP, which gives the pod a stable internal address inside the cluster

Question 17¶

Scenario: A developer needs to store application configuration that can be updated without redeploying the application. The configuration contains non-sensitive data like feature flags. What should they use?

A. Cloud Storage bucket B. Runtime Configurator (Deployment Manager) C. Environment variables in the service definition D. Secret Manager

Question 18¶

Scenario: A company needs to copy 50 TB of data from AWS S3 to Cloud Storage. They want to minimize network costs and time. What should they use?

A. BigQuery Data Transfer Service B. Storage Transfer Service C. Transfer Appliance D. gsutil cp command

Question 19¶

Scenario: A developer needs to create a Cloud SQL PostgreSQL instance with high availability within a region. What configuration is required?

A. Enable regional availability (HA) configuration B. Create two separate instances in different zones and fail over manually by promoting the second one when the first fails C. Use Cloud SQL Proxy with multiple endpoints, so that clients connect to whichever instance is healthy at that time D. Create read replicas in different zones of the region, and promote one of the replicas when the primary becomes unavailable

Question 20¶

Scenario: A developer needs to deploy a Cloud Function that triggers when a file is uploaded to a Cloud Storage bucket. What trigger type should be configured?

A. Cloud Storage trigger on object finalize B. Cloud Scheduler trigger C. HTTP trigger D. Pub/Sub trigger

Question 21¶

Scenario: A web application on GKE needs to serve HTTPS traffic with automatic SSL certificate management. What should be configured?

A. GKE Ingress with Google-managed certificates B. Cloud Armor with SSL policies C. Cloud CDN with custom certificates D. Network Load Balancer with manually uploaded certificates

Question 22¶

Scenario: A developer needs to deploy updates to a Cloud Run service with the ability to gradually shift traffic to the new revision and rollback if issues occur. What should they use?

A. Canary deployment with GKE B. Blue/green deployment with two separate services C. Traffic splitting between revisions D. Instance group rolling update

Question 23¶

Scenario: A company needs to run batch processing jobs on large datasets using Apache Spark without managing infrastructure. What should they use?

A. Cloud Composer B. Dataflow C. A Compute Engine cluster with Spark installed by hand D. Dataproc with managed Spark clusters

Question 24¶

Scenario: A developer needs to expose a set of microservices through a single API endpoint with authentication, rate limiting, and monitoring. What service should be used?

A. Traffic Director B. Cloud CDN with signed URLs, which caches responses and limits who can fetch them C. Cloud Load Balancing, which spreads traffic D. Cloud Endpoints with an OpenAPI spec

Ensuring Successful Operation of a Cloud Solution (20%)¶

Question 25¶

Scenario: A Cloud SQL instance is experiencing slow query performance. What tool should be used to identify the problematic queries?

A. Cloud Monitoring dashboards of instance metrics B. Query Insights for Cloud SQL C. Cloud Trace D. Cloud Profiler, which samples application code

Question 26¶

Scenario: An application running on GKE needs to be notified when CPU usage exceeds 80% so the team can investigate. What should be configured?

A. Cloud Monitoring alerting policy on CPU utilization above 80%, with an email notification channel B. A Kubernetes liveness probe on the container, which restarts it when a health check fails C. A Horizontal Pod Autoscaler with an 80% CPU target, which adds pods past that level D. The GKE cluster autoscaler, which adds nodes when pods cannot be scheduled

Question 27¶

Scenario: A Cloud Function is failing intermittently. The developer needs to view the error messages and stack traces. Where should they look?

A. Cloud Monitoring metrics, charted on a custom dashboard B. Cloud Trace C. Cloud Profiler, which samples CPU and memory use in the code D. Cloud Logging, queried by the function name

Question 28¶

Scenario: A company needs to create automated backups of a Cloud SQL database and retain them for 30 days. What should be configured?

A. Scheduled Cloud Functions that export the data to a bucket every night and delete the files after 30 days B. Cloud SQL automated backups with retention settings C. Compute Engine snapshots of the instance's boot disk on a schedule, kept for 30 days by a snapshot policy D. Cloud Storage lifecycle policies on a bucket that holds exported dump files, deleting them after 30 days

Question 29¶

Scenario: A managed instance group needs to be updated to a new VM image with minimal disruption. The update should replace instances gradually. What update type should be used?

A. A recreate update, which stops all instances first B. Proactive rolling update, replacing a few instances at a time C. A blue/green deployment with a second full group D. An opportunistic update, which applies the new template only when instances are recreated for other reasons

Question 30¶

Scenario: A GKE workload needs to read data from Cloud Storage. What is the recommended way to grant access without storing credentials in the container?

A. Use Workload Identity, binding the Kubernetes service account to a Google service account B. Grant permissions to the default compute service account C. Use Cloud SQL Auth proxy D. Store service account key in a Kubernetes secret

Question 31¶

Scenario: A company needs to track costs across different teams using the same project. What should they implement?

A. Labels on resources B. Multiple service accounts C. Separate billing accounts D. Quotas

Question 32¶

Scenario: A Compute Engine VM is running slowly. The administrator needs to analyze CPU, memory, and disk performance. What tool should they use?

A. Serial console output, which shows boot messages and kernel logs and can reveal a startup problem on the VM B. The VM instance details page, which shows machine type, disks, network settings, and the status of the instance C. Cloud Shell, which opens a terminal where the administrator can run top over SSH and read the load by hand D. Cloud Monitoring metrics explorer

Configuring Access and Security (20%)¶

Question 33¶

Scenario: A developer needs to grant a service account permission to read objects from a specific Cloud Storage bucket but not other buckets. What is the recommended approach?

A. Grant the storage.admin role at project level, so it covers every bucket B. Add the service account to allUsers C. Grant storage.objectViewer role at bucket level D. Grant storage.objectViewer role at project level, covering every bucket

Question 34¶

Scenario: A company wants newly created user-managed service account keys to stop working after 90 days, enforced across the whole organization. How can they enforce this?

A. IAM Recommender, which suggests removing excess role grants from principals but does not set or enforce any key lifetime B. IAM Conditions C. VPC Service Controls D. The iam.serviceAccountKeyExpiryHours organization policy constraint, set to 2160 hours

Question 35¶

Scenario: A Cloud Run service needs to access a Cloud SQL database. The service should authenticate securely without managing passwords. What should be configured?

A. Store the password in Secret Manager and read it at startup B. Whitelist the Cloud Run IP addresses in Cloud SQL authorized networks C. Use Cloud SQL Auth Proxy with IAM database authentication for the service account D. Use a VPC connector, a public IP, and a database user with a file password

Question 36¶

Scenario: A company wants to prevent data exfiltration from their GCP project to external destinations. What should they implement?

A. VPC Service Controls B. Firewall rules on the VPC network C. Cloud NAT D. Cloud Armor security policies on the load balancer

Question 37¶

Scenario: An application needs to encrypt data using a customer-managed encryption key (CMEK). Where should the key be created and managed?

A. Secret Manager B. Cloud Storage buckets C. IAM D. Cloud KMS

Question 38¶

Scenario: A developer accidentally committed a service account key to a public GitHub repository. What is the first action they should take?

A. Delete the GitHub repository, so that the key is no longer public, and then review the logs for any use of it B. Revoke all user access to the project, so that nobody can sign in while the team works out what happened C. Disable or delete the service account key D. Create a new service account with the same roles, and update the application to use it from now on

Question 39¶

Scenario: A GKE cluster needs to restrict which container images can be deployed. Only images from the company's Artifact Registry should be allowed. What should be configured?

A. Pod Security Policy, which sets pod security contexts B. Kubernetes RBAC for approved users creating Deployments C. A Network Policy that blocks egress from the cluster to every registry apart from the company's Artifact Registry D. Binary Authorization with a policy that allows only approved registry images

Question 40¶

Scenario: A company needs to audit who accessed specific BigQuery tables containing sensitive data. What should be enabled?

A. Cloud Audit Logs - Data Access logs, enabled for BigQuery to record who read each table B. VPC Flow Logs, which record network flows between the database hosts C. BigQuery INFORMATION_SCHEMA views, which show table metadata and jobs D. Cloud Monitoring metrics for BigQuery, charting query counts and bytes scanned

Answer Key¶

Study Resources¶

• Google Cloud Associate Cloud Engineer
• Google Cloud Documentation
• Cloud Skills Boost
• GCP Free Tier