Get Your CertGoogle Cloud Associate Cloud EngineerPlayCompete
‹ Google Cloud Associate Cloud Engineer tests

Google Cloud Associate Cloud Engineer practice questions

100 questions in 10 tests. Open one to answer it on its own, or take a whole test.

Test 1

Take Test 1 ›
  1. Your organization has a folder named retail that contains 12 projects, and new projects are added to that folder every month. A group of support engineers… · Resource Hierarchy & IAM
  2. The finance team at your company wants to be emailed whenever the spend on the dev Cloud Billing account reaches 50%, 90%, and 100% of a $10,000 monthly target. They also want an… · Billing & Cost Management
  3. A media company runs a nightly video transcoding job on Compute Engine. The job is fault tolerant: workers checkpoint progress to Cloud Storage every few minutes and resume from… · Compute Options & Planning
  4. A regional managed instance group named web-mig runs 10 instances behind a load balancer from instance template web-v1. You have built a new template, web-v2, containing a… · Compute Engine Deployment
  5. A platform team is moving a set of stateless microservices to GKE. They will keep managing their own Kubernetes manifests, Services, and HorizontalPodAutoscalers with kubectl… · Google Kubernetes Engine
  6. You created a custom-mode VPC network and launched three instances into it, each carrying the network tag web and serving HTTP on TCP port 8080. The instances have external IP… · VPC Networking
  7. A regulated business must retain seven years of transaction records in Cloud Storage. Auditors expect to read a small subset of the objects at most once a year, and when they do… · Cloud Storage
  8. A subnet named prod-us-east1 in a custom-mode VPC has the primary IPv4 range 10.10.0.0/24 and is almost out of addresses. Roughly 200 VMs are running in it and serving production… · VPC Networking
  9. A project contains 30 Cloud Storage buckets. A group of data analysts, analysts@example.com, must be able to list and download the objects in exactly one of them, reports-2026… · IAM & Least Privilege
  10. A developer needs to reproduce a production failure by running gcloud commands with the exact permissions of the service account pipeline-sa@example-prod.iam.gserviceaccount.com… · Service Accounts

Test 2

Take Test 2 ›
  1. A team has a stateless HTTP service packaged as a container image. Traffic is unpredictable and often drops to zero overnight, and the team does not want to manage servers… · Cloud Run
  2. You work on a development project with your corporate account and on a customer's production project with a separate account. You keep running commands against the wrong project… · gcloud CLI
  3. A production Cloud SQL for MySQL instance runs in a single zone. Leadership requires that a zonal outage causes an automatic failover with no manual intervention, and that the… · Cloud SQL
  4. A bucket has Object Versioning enabled so that users can recover overwritten files. Storage costs are growing because old versions accumulate forever. The company only needs to… · Cloud Storage
  5. A security team must retain the Admin Activity audit logs of every current and future project in the organization in one central Cloud Storage bucket for seven years. New… · Cloud Logging
  6. You want an alert when memory utilization on a Compute Engine VM exceeds 90 percent. In Metrics Explorer you can see CPU, disk throughput, and network metrics for the VM, but… · Cloud Monitoring
  7. A public web application runs on managed instance groups in us-central1 and europe-west1. You want one external IP address for the site, and users should be routed to the closest… · Load Balancing
  8. A subscriber application processes messages from a Pub/Sub subscription. A few malformed messages always cause the handler to throw an exception, so they are never acknowledged… · Pub/Sub
  9. Your application must let a customer without a Google account download one private report from a Cloud Storage bucket. The link should stop working after 15 minutes, and the rest… · Cloud Storage
  10. A 40 TB BigQuery table holds five years of events. Analysts almost always query one or two days of data with WHERE event_date = ..., but on-demand query costs are high because… · BigQuery

Test 3

Take Test 3 ›
  1. A Compute Engine VM stores customer uploads on a persistent disk. You must take a snapshot of the disk every day and keep each snapshot for 14 days, without writing or… · Compute Engine Operations
  2. VMs in a private subnet have no external IP addresses. They must download operating system patches from a third party repository on the internet, but nothing on the internet… · VPC Networking
  3. A subnet contains VMs without external IP addresses. A security policy forbids both external IPs and NAT gateways for this subnet. A batch job on these VMs must read and write… · VPC Networking
  4. A central network team must own the subnets, routes, and firewall rules for the whole organization. Application teams work in their own projects, and want to create VMs that use… · VPC Networking
  5. On a GKE Standard cluster with a fixed size node pool, a Deployment is scaled up and several new pods stay in the Pending state. The output of kubectl describe pod shows… · Google Kubernetes Engine
  6. You updated the container image of the Deployment web with kubectl set image. The new pods crash on startup and users see errors. You need to return to the previous working… · Google Kubernetes Engine
  7. Whenever a file is uploaded to a Cloud Storage bucket, a small piece of code must run to generate a thumbnail. Uploads are rare and irregular, and the team does not want to poll… · Event-driven Compute
  8. A contractor needs the Compute Instance Admin (v1) role on a project until December 1, 2026. Access must end automatically on that date, without anyone remembering to remove it… · IAM & Least Privilege
  9. To meet data residency rules, your company must ensure that no team can create Google Cloud resources outside the European Union in any project of the organization. What should… · Organization Policy
  10. You must connect an on-premises data center to a VPC network with encrypted traffic. The connection must have a 99.99 percent availability SLA, use the public internet, and be… · Hybrid Connectivity

Test 4

Take Test 4 ›
  1. An App Engine standard application serves all of its traffic from version v1. You want to test a new version with 10 percent of the users and send the remaining 90 percent to v1… · App Engine
  2. A company runs a database on Compute Engine VMs of a fixed machine family and size. The VMs have run 24 hours a day for a year, and the workload will continue for at least the… · Billing & Cost Management
  3. A compliance officer asks who downloaded objects from a sensitive Cloud Storage bucket last week. You search Cloud Logging and find entries for bucket creation and IAM policy… · Cloud Audit Logs
  4. A company must copy 50 TB of data from an Amazon S3 bucket to Cloud Storage, and then keep the bucket synchronized with a nightly transfer. The team wants a managed service that… · Cloud Storage
  5. A web tier runs in a managed instance group behind a load balancer. CPU use rises during the day and falls at night. You want the group to add VMs when average CPU utilization is… · Compute Engine Deployment
  6. In a managed instance group, a VM sometimes keeps running while the web server process on it hangs and stops answering requests. The load balancer already stops sending traffic… · Compute Engine Deployment
  7. An application on Cloud Run connects to a database. The password is currently stored in plain text in the source repository. The security team wants the password removed from the… · Secret Manager
  8. You built a container image on your workstation and want to store it in Google Cloud so that GKE and Cloud Run can pull it. You need a managed, private registry that is the… · Artifact Registry
  9. A pod on a GKE cluster must read objects from one Cloud Storage bucket. Other workloads on the same nodes must not gain that access, and the security team forbids service account… · Google Kubernetes Engine
  10. A bucket serves public product images. Each object had an ACL granting READER to allUsers. After an administrator enabled uniform bucket-level access on the bucket, the image… · Cloud Storage

Test 5

Take Test 5 ›
  1. Finance wants to break down Google Cloud costs by team label and by service with SQL queries, and to build dashboards from the results. The console cost reports do not offer the… · Billing & Cost Management
  2. An engineer deleted a production project by mistake two weeks ago. The team now realizes the project and its resources are needed. The organization has not changed any policies… · Resource Hierarchy & IAM
  3. An application must read objects and create new objects in a bucket, but it must never delete or overwrite objects. roles/storage.objectCreator cannot read objects, and… · IAM & Least Privilege
  4. Compliance requires a bucket's data to be stored in exactly two named regions, europe-west1 and europe-west4, and the data must remain available if one of those regions has an… · Cloud Storage
  5. A financial application needs a relational database with SQL support and strongly consistent transactions. Users are located on several continents, so writes must be possible… · Databases
  6. Analysts want to run ad hoc SQL queries over several petabytes of historical sales data, with no infrastructure to provision, and pay for the amount of data the queries process… · Databases
  7. Administrators need SSH access to VMs that have no external IP addresses. The security team does not want to run and patch a bastion host, and does not want to open port 22 to… · Compute Engine Operations
  8. You run gcloud compute instances create for a standard (not Spot) N1 VM with an NVIDIA T4 GPU attached, using default options. The command fails with an error stating that the… · Compute Engine Deployment
  9. A public website is served by a load balancer. The on-call engineer must be paged through PagerDuty when the site stops answering HTTPS requests from the internet, even when the… · Cloud Monitoring
  10. A VM runs a service that only publishes messages to one Pub/Sub topic. It currently runs as the default Compute Engine service account, which holds the Editor role on the… · Service Accounts

Test 6

Take Test 6 ›
  1. A team creates a brand new Google Cloud project and immediately tries to run gcloud compute instances create from Cloud Shell. The command fails with an error stating that the… · gcloud CLI
  2. A new Google Cloud project was created without a linked billing account, so its resources cannot be deployed. Priya needs to link the project to the company's existing… · Billing & Cost Management
  3. A team tries to deploy several new Compute Engine instances in the us-central1 region, but the deployment fails with an error stating that the CPU quota for the region has been… · Quotas & Resource Limits
  4. A logistics company operates several hundred thousand vehicle sensors that each publish a telemetry reading every second. The company needs a managed database that can absorb… · Databases
  5. A team runs a stateless web application on a single Compute Engine VM in one zone. During a recent zonal outage, the application became unavailable until the zone recovered. The… · Compute Engine Deployment
  6. A team runs a production GKE Standard cluster and wants GKE to manage its control plane and node version automatically. They are not chasing new Kubernetes features and want each… · Google Kubernetes Engine
  7. A team runs a Cloud Run service that is already serving 100% of its traffic on the current revision. They built a new container image with a bug fix and want to verify it in… · Cloud Run
  8. A team's application writes a specific error message to stdout whenever a downstream payment API call fails. The team wants to track how often this error occurs over time on a… · Cloud Logging
  9. A security review finds that several users and service accounts in a project hold broad predefined roles such as Editor, but nobody is sure which permissions each principal… · IAM & Least Privilege
  10. A production Linux VM has a secondary, non-boot persistent disk mounted at /data that is almost full. The application on the VM cannot tolerate any downtime. You need to add… · Compute Engine Operations

Test 7

Take Test 7 ›
  1. A data analytics team has frequent membership changes as contractors rotate on and off the project every few weeks. The team needs read access to a set of BigQuery datasets, and… · IAM & Least Privilege
  2. An administrator runs gcloud projects move to relocate the project finance-app from the sandbox folder to the prod-finance folder in the same organization. A custom IAM role is… · Resource Hierarchy & IAM
  3. A financial services company must store compliance records in a Cloud Storage bucket for seven years. Regulations require that during that period no one, including project owners… · Cloud Storage
  4. A three-tier application runs entirely inside a single VPC in one region. The application tier communicates with a backend tier over a custom TCP protocol on port 9000, not HTTP… · Load Balancing
  5. A company has three VPC networks in the same organization: network A, network B, and network C. Network A has a VPC Network Peering connection to network B, and network B has a… · VPC Networking
  6. A platform team currently creates Compute Engine VMs, VPC subnets, and Cloud SQL instances by running gcloud commands from engineers' laptops. Configurations often drift between… · Infrastructure as Code
  7. A batch job that runs nightly maintenance scripts against a production Cloud SQL for PostgreSQL instance had a bug: at 02:14 today it dropped a table that the application still… · Cloud SQL
  8. A Deployment named web runs on a GKE Standard cluster whose node pool already has the cluster autoscaler enabled, so the node count adjusts automatically. Traffic to web varies… · Google Kubernetes Engine
  9. A company runs four separate Google Cloud projects, one per team. The operations team already has dashboards and alerting policies built in their own project, called… · Cloud Monitoring
  10. A company runs its build pipeline in GitHub Actions and needs the pipeline to deploy artifacts to a Google Cloud project. Security policy forbids creating or downloading any… · Service Accounts

Test 8

Take Test 8 ›
  1. A company runs workloads for three internal teams inside a single GCP project. Finance wants a monthly breakdown of spend per team in the billing reports, without splitting the… · Billing & Cost Management
  2. Your company is building a new VPC network that will only ever have workloads in us-central1 and europe-west1. The network team wants full control over the subnet IP ranges in… · VPC Networking
  3. A developer has containerized a nightly report generation task. The container reads data, produces a PDF, uploads it to Cloud Storage, and exits; it never listens for incoming… · Cloud Run
  4. A managed instance group uses an instance template that specifies machine type e2-medium. You need the group's future instances to use machine type e2-standard-4 instead. What is… · Compute Engine Deployment
  5. A mobile app team is building a note taking app. Notes must sync in real time across a user's devices, remain usable and editable while a device is offline, and automatically… · Databases
  6. A GKE node pool has 5 nodes and runs a latency sensitive service. You need to upgrade the node pool so that it always keeps at least 4 of the 5 nodes serving traffic during the… · Google Kubernetes Engine
  7. A script running with incorrect permissions accidentally overwrote report.csv in a Cloud Storage bucket that has object versioning enabled. The current object content is wrong… · Cloud Storage
  8. A project's Default log sink is ingesting a large volume of high frequency health check log entries from a load balancer, driving up Cloud Logging costs. The team still wants all… · Cloud Logging
  9. A user has been granted the Editor role on a project, which includes permission to delete Compute Engine disks. Your security team wants to guarantee that no principal… · IAM & Least Privilege
  10. A company has dozens of projects spread across several folders in its organization. The security team wants to enforce a rule that blocks inbound traffic from the public internet… · VPC Networking

Test 9

Take Test 9 ›
  1. A company has dozens of projects spread across several folders under one organization. The security team needs a single command that lists every Compute Engine instance in the… · IAM & Least Privilege
  2. A startup owns a domain name but has never signed up for Google Workspace. The founders want their Google Cloud projects to sit under an Organization resource so they can apply… · Resource Hierarchy & IAM
  3. A team has a Deployment running in a GKE Standard cluster and needs to expose it to clients on the public internet with a stable external IP address, using only Kubernetes-native… · Google Kubernetes Engine
  4. A batch analytics workload on Compute Engine writes large volumes of temporary intermediate files during processing and discards them once each job finishes. The team wants the… · Compute Options & Planning
  5. A developer has application source code in a local directory but has not written a Dockerfile and does not want to manually build or push a container image before deploying. They… · Cloud Run
  6. An analyst is about to run a query against a multi-terabyte BigQuery table and wants to know how many bytes the query will process, and therefore roughly what it will cost… · BigQuery
  7. A production Cloud SQL for PostgreSQL instance serves a transactional web application. A new internal reporting dashboard needs to run large, frequent SELECT queries against the… · Cloud SQL
  8. A managed instance group of 40 instances runs on instance template web-v1. The team built a new instance template web-v2 and wants to validate it on a small slice of production… · Compute Engine Deployment
  9. A team creates a new Cloud Storage bucket configured to use a customer-managed encryption key (CMEK) stored in Cloud KMS. After setting the default encryption key on the bucket… · Cloud Storage
  10. A security reviewer needs to answer a specific audit question: which principals currently have the storage.buckets.delete permission on a particular Cloud Storage bucket… · IAM & Least Privilege

Test 10

Take Test 10 ›
  1. An organization uses a resource hierarchy with a folder named "Engineering" for all product teams. You want every member of the group eng-leads@example.com to be able to create… · Resource Hierarchy & IAM
  2. A company runs internal services on VM instances in two VPC networks, "prod-vpc" and "staging-vpc", both in the same project. You need to publish DNS records for… · VPC Networking
  3. A GKE Standard cluster runs a customer-facing web Deployment on an on-demand node pool. To cut cost, you add a second node pool backed by Spot VMs for a batch analytics workload… · Google Kubernetes Engine
  4. A media streaming backend accepts UDP traffic on port 5004 from clients on the public internet. The backend VMs run in a single region behind a managed instance group. The… · Load Balancing
  5. A web application deployed on Compute Engine needs a fast, fully managed, in-memory cache to store user session data. The team does not want to install, patch, or operate their… · Databases
  6. A Compute Engine VM instance stops responding to SSH after a kernel update was applied inside the guest OS, and the instance never becomes reachable again after a reboot. You… · Compute Engine Operations
  7. A subscriber application consumed and acknowledged a batch of Pub/Sub messages, but a downstream bug means those messages need to be reprocessed. You want to seek the… · Pub/Sub
  8. A request to your application passes through several microservices before a response is returned to the user. Users report that some requests are slow, but the team cannot tell… · Cloud Monitoring
  9. A web application is served by an external Application Load Balancer. The security team wants to block all requests from a set of known malicious IP ranges before they reach the… · Load Balancing
  10. A security review finds that a few Cloud Storage buckets could be made publicly readable by mistake if a future IAM binding accidentally granted access to allUsers or… · Cloud Storage