10 Google Associate Cloud Engineer Practice Questions That Mirror the Real Exam
Here are 10 multiple-choice questions designed to match the difficulty, style, and domain coverage of the Google Associate Cloud Engineer exam. They focus on practical scenarios rather than rote memorization, as the real exam does.
Welcome to this Google Associate Cloud Engineer practice set. These questions are designed to test your applied knowledge of core GCP services, from IAM and networking to compute and storage. Read each scenario carefully, as the correct answer often depends on specific constraints like "cost-effective," "minimal downtime," or "fully managed." Good luck! Our post on GCP Associate Cloud Engineer Difficulty: Why Google Exams Feel Different covers this further.
Question 1
You need to grant a group of users the ability to view (but not modify) the CPU utilization metrics for a specific Compute Engine instance. What is the minimum, most secure IAM role to assign?
A. roles/monitoring.viewer
B. roles/compute.viewer
C. roles/monitoring.editor
D. roles/compute.instanceAdmin.v1
Answer: A
Explanation: The roles/monitoring.viewer role grants read-only access to all monitoring data, including metrics, dashboards, and alerting policies. roles/compute.viewer grants read-only access to compute resources but not necessarily the full monitoring data for those resources. The editor role is too permissive, and the compute instanceAdmin role grants management permissions.
Question 2
Your application requires a shared filesystem that can be mounted by multiple Compute Engine VMs simultaneously, and you need to minimize latency for a high-performance computing workload. Which storage solution should you choose?
A. Cloud Storage (GCS)
B. Persistent Disk (PD) Standard
C. Filestore
D. Cloud Bigtable
Answer: C
Explanation: Filestore provides fully managed Network Attached Storage (NAS) for Compute Engine instances, allowing multiple VMs to mount the same file system concurrently with low latency. Cloud Storage is object storage, not a filesystem. Persistent Disk is block storage for a single VM (unless using read-only sharing). Bigtable is a NoSQL database, not a filesystem.
Question 3
You are migrating an on-premises MySQL database to Google Cloud. You want to minimize operational overhead and require automatic failover to a standby replica in a different zone. Which service should you use?
A. Compute Engine with a self-managed MySQL instance
B. Cloud SQL with a single zone availability
C. Cloud SQL with a primary and standby instance configuration
D. Cloud Spanner
Answer: C
Explanation: Cloud SQL is a managed database service, and configuring high availability (HA) creates a synchronous standby replica in a different zone, providing automatic failover. A self-managed instance on Compute Engine requires you to handle failover yourself, which is high overhead. Single zone Cloud SQL does not offer automatic failover. Cloud Spanner is a globally distributed relational database that is overkill and more expensive for a simple MySQL migration.
Question 4
Your organization has a strict policy that all resources must be tagged with a cost-center label. You want to prevent the creation of Compute Engine instances without this label. What is the most effective way to enforce this policy?
A. Use a Cloud Function to delete any instances created without the label.
B. Create a VPC Service Controls perimeter. For background on this area, read 10 Databricks Data Engineer Associate Practice Questions That Mirror the Real Exam.
C. Use Organization Policy to define a list constraint.
D. Use a Cloud Deployment Manager template for all instance creation.
Answer: C
Explanation: Organization Policy can enforce a "constraints/compute.requireOsLogin" or, more relevantly, a list constraint like compute.instance.requireLabel (or similar) to mandate that specific labels be present on resources. This is a preventive control enforced at the API level. Deleting instances via a function is reactive and inefficient. VPC Service Controls is for preventing data exfiltration, not labeling. Deployment Manager helps with IaC but doesn't enforce the policy for all users.
Question 5
You have a global web application deployed on Compute Engine behind a global load balancer. You want to improve performance for users in Europe by serving static content from a cache closer to them. Which GCP service should you configure?
A. Cloud CDN
B. Cloud NAT
C. Cloud VPN
D. Traffic Director
Answer: A
Explanation: Cloud CDN (Content Delivery Network) uses Google's global edge network to cache static content (images, CSS, JavaScript) close to users, reducing latency and load on the origin servers. Cloud NAT is for outbound internet access for private VMs. Cloud VPN is for connecting on-premises networks. Traffic Director is for service mesh traffic management.
Question 6
A developer accidentally left a public Cloud Storage bucket open to the public, and it was discovered that sensitive data was exposed. You need to immediately prevent all public access to the bucket while you investigate. What is the first step you should take?
A. Delete the bucket and its contents.
B. Use gsutil iam ch -d allUsers:objectViewer gs://bucket-name.
C. Apply a VPC Service Controls perimeter to the bucket.
D. Recreate the bucket with a random name.
Answer: B
Explanation: The immediate action is to remove the IAM binding that grants access to allUsers (or allAuthenticatedUsers) using the gsutil iam command. This rectifies the misconfiguration instantly. Deleting the bucket causes data loss and is not a first step. VPC Service Controls is a broader security layer and doesn't fix the existing IAM policy. Recreating the bucket doesn't solve the current exposure.
Question 7
You need to schedule a job to run a Cloud Run service every hour. What is the simplest and most reliable way to achieve this?
A. Use a Compute Engine instance with cron.
B. Use Cloud Scheduler to invoke the Cloud Run service via HTTP.
C. Use a Cloud Function triggered by a Pub/Sub message.
D. Use App Engine Cron Service.
Answer: B See also How Hard Is Google Associate Cloud Engineer, Really? An Honest Difficulty Rating for a complementary perspective.
Explanation: Cloud Scheduler is Google's fully managed cron service. It can be set to send an HTTP request to the Cloud Run service's endpoint every hour, which is the most direct and simple method. A Compute Engine instance requires managing infrastructure. A Cloud Function is an extra hop and unnecessary. App Engine Cron Service is a valid option, but Cloud Scheduler is the more universal, modern choice that works with any service, making it the "simplest and most reliable" for this specific Cloud Run use case.
Question 8
You are designing a VPC network. You need to ensure that a development project can only communicate with a production project via a specific private IP address, not through the public internet. Which two components must you configure? (Choose the best two-step approach)
A. VPC peering and a firewall rule
B. A VPN gateway and a Cloud Router
C. A shared VPC and an organization policy
D. Cloud NAT and a route
Answer: A
Explanation: VPC Peering connects two VPC networks privately (using internal IPs). To restrict traffic to a specific IP, you would configure a firewall rule on the peered connection to only allow traffic from/to that specific IP range. A VPN is for on-premises connections. Shared VPC is for centralized management, not necessarily private peering between projects. Cloud NAT is for outbound internet.
Question 9
Your application uses Cloud Pub/Sub to ingest user events. The subscriber service is currently a Compute Engine VM. You want to change it to a Cloud Run service to simplify deployment and scaling. What is the primary benefit of this change?
A. It will reduce network latency.
B. It will eliminate the need for a VPC network.
C. It will automatically scale to zero when there are no messages to process.
D. It will allow you to use a different programming language.
Answer: C
Explanation: Cloud Run is a serverless container platform that scales to zero when not in use, so you don't pay for idle compute. This is a significant cost benefit compared to a persistent Compute Engine VM. It doesn't inherently reduce network latency, still requires a VPC (for shared VPC or serverless connector if needed), and language choice is not the primary benefit as both can use various languages.
Question 10
You need to analyze a large dataset (multiple terabytes) stored in Cloud Storage using SQL queries. You want to run ad-hoc analytical queries without provisioning or managing any servers. Which service should you use?
A. Cloud SQL
B. BigQuery
C. Dataproc
D. Cloud Datastore
Answer: B
Explanation: BigQuery is Google's fully managed, serverless data warehouse. It is designed for analyzing large datasets (petabytes) using SQL, and you only pay for the queries you run (or slots reserved). Cloud SQL is for transactional workloads. Dataproc is a managed service for Hadoop/Spark clusters, which requires managing clusters. Cloud Datastore (now Firestore) is a NoSQL document database.
Now that you have worked through these questions, a free Google Cloud Associate Cloud Engineer readiness check can help you spot the topics that still need review.
Closing: These questions cover the core concepts of the exam, but remember that the real test is scenario-based and requires you to integrate your knowledge across services. Focus on understanding the why behind each service choice—like "serverless" vs. "managed" vs. "self-managed"—and how they interact.
To give your remaining preparation more structure, a free Google Cloud Associate Cloud Engineer study plan can help you build a schedule that fits your available time.
Identify your weak spots early — work through Google Cloud Associate Cloud Engineer mock exam while you still have time to review.