Sign in Register
Home  /  Blog

GCP ACE Practice Questions: The Compute and Networking Scenarios That Trip People Up

Cloud certifications·8 min read·PractiseExam

Here are 8 multiple-choice questions designed to match the style, difficulty, and domain coverage of the Google Cloud Associate Cloud Engineer exam. --- These questions cover key concepts from the official ACE exam guide, including IAM, Compute, Networking, Storage, and Billing. Test your knowledge and read the explanations carefully to understand the "why" behind each answer. ---

Question 1

You are migrating a legacy application to Compute Engine. The application requires a static IP address that you must assign to the VM instance. You have already created a VM named app-server. How should you assign a static IP address to this VM? Want to go further? GCP Associate Cloud Engineer Cheat Sheet: Services, IAM and Networking on One Page is a good next step.

  1. A. Edit the VM instance and change the "External IP" field from "Ephemeral" to "Static," then create a new static address in the process.
  2. B. Delete the VM and recreate it, specifying a static IP address in the gcloud compute instances create command.
  3. C. You cannot assign a static IP to an existing VM; you must create a new VM and migrate the application.
  4. D. Reserve a new static IP address in the same region and then use the gcloud compute instances add-access-config command to assign it.

Answer: D

Explanation: You cannot simply change an ephemeral IP to a static one in the VM settings. You must first reserve a static IP address in the same region as the VM and then attach it to the VM's network interface using the add-access-config command. Options A and B are incorrect because you can attach a reserved static IP to an existing VM without deleting it. Option C is incorrect because this process is supported.

Question 2

Your organization requires that all users accessing Compute Engine instances must authenticate using Identity-Aware Proxy (IAP) and not be exposed to the public internet. What is the minimal network configuration to meet this requirement?

  1. A. Grant all users the roles/iap.httpsResourceAccessor role and ensure the VMs have public IPs.
  2. B. Grant all users the roles/iap.httpsResourceAccessor role and configure the firewall to allow traffic only from the IAP IP range (35.235.240.0/20).
  3. C. Grant all users the roles/compute.instanceAdmin role and configure the firewall to deny all incoming traffic.
  4. D. Place the VMs in a VPC with no external IP addresses and configure a NAT gateway for outbound traffic.

Answer: B

Explanation: IAP requires the user to have the roles/iap.httpsResourceAccessor role. To ensure traffic only comes through IAP, you must configure firewall rules to allow ingress traffic only from the IAP's well-known IP range (35.235.240.0/20) and not from the public internet. Option A is wrong because VMs should not have public IPs for this scenario. Option C is wrong because compute.instanceAdmin is not the correct IAM role for IAP access. Option D describes a NAT setup, which handles outbound traffic, not secure inbound access.

Question 3

You have a batch job running on a Compute Engine VM that terminates unexpectedly. You need to ensure the job runs again if the VM is stopped or fails. Which Compute Engine feature should you use?

  1. A. A managed instance group with an autoscaling policy based on CPU utilization.
  2. B. A managed instance group with a health check and a base instance name.
  3. C. A sole-tenant node group.
  4. D. A preemptible VM instance.

Answer: B

Explanation: A managed instance group (MIG) provides automatic healing by using a health check. If the health check fails (e.g., the VM stops or crashes), the MIG automatically recreates the VM instance. Autoscaling (A) is used for scaling based on load, not for restarting a single failed VM. Sole-tenant nodes (C) are for hardware isolation, not high availability. Preemptible VMs (D) are for short-lived, fault-tolerant workloads and can be terminated at any time, making them unsuitable for this requirement. If you're preparing for this exam, AWS Advanced Networking Specialty Difficulty: What Actually Makes People Fail is essential reading.

Question 4

Your application stores user-uploaded images in a Cloud Storage bucket. You want to automatically generate a thumbnail version of every new image uploaded to the bucket. What is the most cost-effective and serverless way to achieve this?

  1. A. Run a Compute Engine VM that polls the bucket every minute for new objects.
  2. B. Use a Cloud Function triggered by Cloud Storage events to generate the thumbnail.
  3. C. Use Cloud Scheduler to run a script on a schedule that processes new objects.
  4. D. Use Cloud Run to deploy a container that runs a script to process all objects in the bucket.

Answer: B

Explanation: Cloud Functions is Google Cloud's serverless compute platform that can be triggered directly by Cloud Storage events (e.g., object finalize). This is the most efficient and cost-effective solution because you only pay for the compute time when a new object is uploaded. Polling (A) and scheduled jobs (C) introduce latency and cost for continuous compute even when there are no new files. Option D is a possible solution, but it is more complex and not event-driven unless you set up a separate trigger, making Cloud Functions the better fit.

Question 5

You need to allow a group of users to view and create objects in a specific Cloud Storage bucket, but they should not be able to delete objects or view the bucket's IAM permissions. Which IAM role should you grant them?

  1. A. roles/storage.objectViewer
  2. B. roles/storage.objectAdmin
  3. C. roles/storage.legacyBucketWriter
  4. D. roles/storage.objectCreator

Answer: D

Explanation: The roles/storage.objectCreator role grants the ability to create new objects in a bucket but does not allow viewing or deleting existing objects. objectViewer (A) only allows viewing, not creating. objectAdmin (B) grants full control over objects, including deleting. legacyBucketWriter (C) grants broad bucket-level access, including the ability to list objects and view bucket metadata, which is more than required.

Question 6

You are designing a disaster recovery plan. You have a Cloud SQL (MySQL) instance in us-central1. You need to ensure you can recover your database with minimal data loss if the entire region fails. What is the simplest Google Cloud service to configure for this requirement?

  1. A. Create a scheduled export of the database to Cloud Storage.
  2. B. Enable automatic backups and point-in-time recovery for the instance.
  3. C. Create a read replica in a different region and promote it to a primary if needed.
  4. D. Create a clone of the primary instance in a different zone.

Answer: C Our post on AWS Cloud Practitioner Difficulty: What Actually Makes People Fail covers this further.

Explanation: A cross-region read replica is the best solution for regional disaster recovery. It provides an asynchronous copy of your data in a different region. In a disaster, you can promote the replica to a primary instance. While backups (B) and exports (A) are good for data recovery, they involve significant downtime and potential data loss. A clone (D) is in the same region and does not protect against a regional failure.

Question 7

You are using Cloud Pub/Sub to decouple two microservices. You notice that the subscriber is failing to keep up with the volume of messages, causing a backlog. The subscriber is a Compute Engine VM. What is the most efficient way to handle the increased load?

  1. A. Increase the size of the VM's disk to handle more messages.
  2. B. Create a pull subscription and increase the maxMessagesPerPull setting on the subscriber client.
  3. C. Add more VM instances to the same subscription to process messages in parallel.
  4. D. Change the subscription to a push subscription.

Answer: C

Explanation: Pub/Sub is designed to scale horizontally. The most efficient way to handle a growing backlog is to add more subscribers (VM instances) to the same subscription. The Pub/Sub service will automatically distribute messages across the available subscribers. Increasing disk size (A) doesn't help with processing throughput. While tuning pull parameters (B) can help, it is not as effective as adding more consumers. Changing to push (D) doesn't inherently solve the throughput problem.

Question 8

Your organization has a strict policy that no Google Cloud resources can be created outside of the europe-west1 region. You need to enforce this policy for all future projects. What should you do?

  1. A. Create a new project and move all existing resources to it.
  2. B. Use the Cloud Billing API to restrict the billing account.
  3. C. Use the Resource Manager API to set an Organization Policy constraint on the project.
  4. D. Set a quota for all resources in the region.

Answer: C

Explanation: Organization Policies are the correct mechanism for enforcing restrictions across your cloud resources. You can set a constraint like constraints/gcp.resourceLocations at the organization, folder, or project level to define a list of allowed locations. This is a preventive control. Moving resources (A) doesn't enforce the policy. Restricting the billing account (B) doesn't control resource location. Setting quotas (D) limits usage but doesn't prevent resource creation in a specific region.

These scenarios represent the core tasks you'll be expected to handle as an Associate Cloud Engineer. Remember to focus on the "why" behind each solution—the underlying concepts of IAM, networking, and managed services are more important than rote memorization of commands. Good luck with your exam preparation!

If you're working within a set timeline, a free Google Cloud Associate Cloud Engineer study plan can turn your available weeks and hours into a schedule weighted by the official topic areas.

Simulate the full exam experience with Google Cloud Associate Cloud Engineer practice questions that replicate the question format and timing.

Before you sit for the real thing, use a free Google Cloud Associate Cloud Engineer readiness check to identify the topic area where you need the most review.

Google CloudGCP Associate Cloud Engineerpractice-qCloud & AI
All postsSit a full-length mock