Free Google Associate Cloud Engineer practice questions

10 free Google Associate Cloud Engineer practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 375 questions. Work through them, then open each answer to check your reasoning.

Get all 375 questions (US$39) · Download these 10 as a PDF

Question 1

Every employee of your company has a Google account. Your operational team needs to manage a large number of instances on Compute Engine.

Each member of this team needs only administrative access to the servers. Your security team wants to ensure that the deployment of credentials is operationally efficient and must be able to determine who accessed a given instance.

What should you do?

  1. Generate a new SSH key pair. Give the private key to each member of your team. Configure the public key in the metadata of each instance.
  2. Ask each member of the team to generate a new SSH key pair and to send you their public key. Use a configuration management tool to deploy those keys on each instance.
  3. Ask each member of the team to generate a new SSH key pair and to add the public key to their Google account. Grant the "compute.osAdminLogin" role to the Google group corresponding to this team.
  4. Generate a new SSH key pair. Give the private key to each member of your team. Configure the public key as a project-wide public SSH key in your Cloud Platform project and allow project-wide public SSH keys on each instance.
Show answer and explanation

Correct answer: C. Ask each member of the team to generate a new SSH key pair and to add the public key to their Google account. Grant the "compute.osAdminLogin" role to the Google group corresponding to this team.

Option C provides the best combination of security and auditability. When team members add their public keys to their Google accounts and are granted the compute.osAdminLogin role, Google Cloud's OS Login feature automatically manages SSH key deployment across instances and maintains audit logs showing which user accessed which instance. This satisfies the security team's requirement to determine who accessed a given instance while being operationally efficient since OS Login handles credential deployment automatically.

Why the other options are wrong

  • A. Sharing a single private key across multiple team members prevents audit logging from identifying which specific person accessed an instance, violating security requirements.
  • B. While configuration management tools can deploy keys, this approach requires manual setup and maintenance without the built-in audit trail that OS Login provides.
  • D. Project-wide SSH keys cannot be tied to individual users, making it impossible to audit who accessed a specific instance.

Question 2

You need to create a custom VPC with a single subnet. The subnet's range must be as large as possible.

Which range should you use?

  1. 0.0.0.0/0
  2. 10.0.0.0/8
  3. 172.16.0.0/12
  4. 192.168.0.0/16
Show answer and explanation

Correct answer: B. 10.0.0.0/8

The 10.0.0.0/8 range is the largest usable private IP range specified in RFC 1918, providing 16,777,216 addresses. While 0.0.0.0/0 is technically larger, it represents all IP addresses globally and cannot be used for a subnet. The 172.16.0.0/12 range provides 1,048,576 addresses, and 192.168.0.0/16 provides 65,536 addresses, both substantially smaller than the /8 range.

Why the other options are wrong

  • A. 0.0.0.0/0 represents the entire IP address space and is not valid for configuring a custom VPC subnet.
  • C. 172.16.0.0/12 provides only 1,048,576 addresses, significantly smaller than the /8 range.
  • D. 192.168.0.0/16 provides only 65,536 addresses, making it the smallest of the valid options.

Question 3

You want to select and configure a cost-effective solution for relational data on Google Cloud Platform. You are working with a small set of operational data in one geographic location. You need to support point-in-time recovery.

What should you do?

  1. Select Cloud SQL (MySQL). Verify that the enable binary logging option is selected.
  2. Select Cloud SQL (MySQL). Select the create failover replicas option.
  3. Select Cloud Spanner. Set up your instance with 2 nodes.
  4. Select Cloud Spanner. Set up your instance as multi-regional.
Show answer and explanation

Correct answer: A. Select Cloud SQL (MySQL). Verify that the enable binary logging option is selected.

For a small set of operational data in a single geographic location with point-in-time recovery requirements, Cloud SQL with MySQL and binary logging enabled is the most cost-effective solution. Binary logging enables Cloud SQL's automated backup and poin-n-time recovery capabilities without the expense of additional failover replicas or Cloud Spanner, which is designed for distributed, high-scale scenarios and carries substantially higher costs.

Why the other options are wrong

  • B. Creating failover replicas adds significant cost without being necessary for point-i-ime recovery, which is achieved through binary logging alone.
  • C. Cloud Spanner is a global, distributed database designed for large-scale applications and is far more expensive than Cloud SQL for small operational datasets.
  • D. Multi-regional Cloud Spanner is unnecessary for data in a single geographic location and represents wasted expense.

Question 4

You want to configure autohealing for network load balancing for a group of Compute Engine instances that run in multiple zones, using the fewest possible steps. You need to configure re-creation of VMs if they are unresponsive after 3 attempts of 10 seconds each.

What should you do?

  1. Create an HTTP load balancer with a backend configuration that references an existing instance group. Set the health check to healthy (HTTP)
  2. Create an HTTP load balancer with a backend configuration that references an existing instance group. Define a balancing mode and set the maximum RPS to 10.
  3. Create a managed instance group. Set the Autohealing health check to healthy (HTTP)
  4. Create a managed instance group. Verify that the autoscaling setting is on.
Show answer and explanation

Correct answer: C. Create a managed instance group. Set the Autohealing health check to healthy (HTTP)

Autohealing health check to healthy (HTTP) A managed instance group with autohealing is the fewest-step way to automatically recreate unresponsive VMs across multiple zones. You attach an autohealing health check to the group and set the check interval to 10 seconds with an unhealthy threshold of 3, which produces the required 3 attempts of 10 seconds each before the instance is recreated. The managed instance group handles both the health monitoring and the recreation, so no load balancer is needed for this requirement.

Why the other options are wrong

  • A. A load balancer health check only marks a backend unhealthy and stops sending it traffic, it never recreates the instance.
  • B. Balancing mode and a maximum RPS control traffic distribution, they have nothing to do with detecting or replacing unresponsive VMs.
  • D. Autoscaling changes instance count in response to load metrics, it does not replace instances that fail health checks.

Question 5

You are using multiple configurations for gcloud. You want to review the configured Kubernetes Engine cluster of an inactive configuration using the fewest possible steps.

What should you do?

  1. Use gcloud config configurations describe to review the output.
  2. Use gcloud config configurations activate and gcloud config list to review the output.
  3. Use kubectl config get-contexts to review the output.
  4. Use kubectl config use-context and kubectl config view to review the output.
Show answer and explanation

Correct answer: A. Use gcloud config configurations describe to review the output.

The gcloud config configurations describe command displays all settings for a specific configuration, including the Kubernetes Engine cluster details, in a single step. This is the most direct way to review the cluster configuration without needing to activate the configuration or switch contexts, making it the fewest possible steps.

Why the other options are wrong

  • B. This approach requires two commands and unnecessarily activates the configuration, changing the active context when the task only requires reviewing it.
  • C. kubectl config get-contexts displays Kubernetes contexts but does not show details about which cluster is associated with a gcloud configuration.
  • D. This requires two commands and uses kubectl unnecessarily when gcloud configuration tools are designed for this task.

Question 6

Your company uses Cloud Storage to store application backup files for disaster recovery purposes. You want to follow Google's recommended practices.

Which storage option should you use?

  1. Multi-Regional Storage
  2. Regional Storage
  3. Nearline Storage
  4. Coldline Storage
Show answer and explanation

Correct answer: D. Coldline Storage

Coldline Storage is Google's recommended practice for disaster recovery backup files. It is designed for infrequently accessed data with low retrieval costs and provides the most cost-effective solution for long-term backup retention while maintaining the ability to recover data when needed. Coldline has a 90-day minimum storage duration and is optimized for this use case.

Why the other options are wrong

  • A. Multi-Regional Storage is high-cost and unnecessary for disaster recovery backups that are rarely accessed.
  • B. Regional Storage has higher costs than Coldline for backup data and is not optimized for infrequent access patterns.
  • C. Nearline Storage is suitable for data accessed monthly but is less cost-effective than Coldline for long-term backups accessed infrequently.

Question 7

Several employees at your company have been creating projects with Cloud Platform and paying for it with their personal credit cards, which the company reimburses. The company wants to centralize all these projects under a single, new billing account.

What should you do?

  1. Contact [email protected] with your bank account details and request a corporate billing account for your company.
  2. Create a ticket with Google Support and wait for their call to share your credit card details over the phone.
  3. In the Google Platform Console, go to the Resource Manage and move all projects to the root Organizarion.
  4. In the Google Cloud Platform Console, create a new billing account and set up a payment method.
Show answer and explanation

Correct answer: D. In the Google Cloud Platform Console, create a new billing account and set up a payment method.

The correct approach is to create a new billing account directly in the Google Cloud Platform Console and set up a payment method. This allows the company to centralize billing without contacting external support or requiring phone calls with sensitive information. The company can then link existing projects to this new centralized billing account through the Console.

Why the other options are wrong

  • A. Sharing bank account details via email is not a secure practice and is not how Google Cloud billing accounts are established.
  • B. Sharing credit card details over the phone with support is neither necessary nor a secure practice for setting up billing accounts.
  • C. The Resource Manager does not handle billing; billing accounts are managed separately in the Billing section of the Console.

Question 8

You have an application that looks for its licensing server on the IP 10.0.3.21. You need to deploy the licensing server on Compute Engine. You do not want to change the configuration of the application and want the application to be able to reach the licensing server.

What should you do?

  1. Reserve the IP 10.0.3.21 as a static internal IP address using gcloud and assign it to the licensing server.
  2. Reserve the IP 10.0.3.21 as a static public IP address using gcloud and assign it to the licensing server.
  3. Use the IP 10.0.3.21 as a custom ephemeral IP address and assign it to the licensing server.
  4. Start the licensing server with an automatic ephemeral IP address, and then promote it to a static internal IP address.
Show answer and explanation

Correct answer: A. Reserve the IP 10.0.3.21 as a static internal IP address using gcloud and assign it to the licensing server.

10.0.3.21 is an RFC 1918 address, so it must be reserved as a static internal IP address in the subnet that contains that range and then assigned to the licensing server VM. Reserving the specific address guarantees the server always answers on 10.0.3.21, so the application needs no configuration change. You can do this in one step with gcloud compute addresses create using –subnet and –addresses 10.0.3.21.

Why the other options are wrong

  • B. External IP reservations cannot use a private RFC 1918 address such as 10.0.3.21, and the application is addressing the server internally.
  • C. Compute Engine does not offer a custom ephemeral internal address that you can pin this way, and an ephemeral address can change when the instance is recreated.
  • D. An automatically assigned address will almost certainly be some other address in the subnet, so promoting it to static preserves the wrong IP rather than 10.0.3.21.

Question 9

You are deploying an application to App Engine. You want the number of instances to scale based on request rate. You need at least 3 unoccupied instances at all times.

Which scaling type should you use?

  1. Manual Scaling with 3 instances.
  2. Basic Scaling with min_instances set to 3.
  3. Basic Scaling with max_instances set to 3.
  4. Automatic Scaling with min_idle_instances set to 3.
Show answer and explanation

Correct answer: D. Automatic Scaling with min_idle_instances set to 3.

Automatic scaling adjusts instance count based on request rate, response latency and other signals, and min_idle_instances keeps a set number of instances warm and unoccupied at all times. Setting min_idle_instances to 3 guarantees the three spare instances required to absorb traffic spikes without cold starts. This is the only scaling type in App Engine that offers an idle instance guarantee.

Why the other options are wrong

  • A. Manual scaling runs a fixed number of instances and never responds to request rate.
  • B. Basic scaling has no min_instances setting, it only supports max_instances and idle_timeout, so it cannot reserve idle capacity.
  • C. Basic scaling with max_instances caps the total instances and shuts idle ones down after the idle timeout, so it guarantees no unoccupied instances.

Question 10

You have a development project with appropriate IAM roles defined. You are creating a production project and want to have the same IAM roles on the new project, using the fewest possible steps.

What should you do?

  1. Use gcloud iam roles copy and specify the production project as the destination project.
  2. Use gcloud iam roles copy and specify your organization as the destination organization.
  3. In the Google Cloud Platform Console, use the 'create role from role' functionality.
  4. In the Google Cloud Platform Console, use the 'create role' functionality and select all applicable permissions.
Show answer and explanation

Correct answer: A. Use gcloud iam roles copy and specify the production project as the destination project.

gcloud iam roles copy takes an existing custom role and recreates it in a destination project in a single command, so pointing the destination at the new production project duplicates the role definitions with the fewest steps. The source role is read from the development project and written to production unchanged. This avoids any manual permission selection.

Why the other options are wrong

  • B. Copying to the organization creates organization-level custom roles rather than the project-scoped roles the development project has, which changes the scope instead of mirroring it.
  • C. Creating a role from an existing role in the Console works but requires navigating the UI and repeating the process for each role, which is more steps than a single gcloud command.
  • D. Building each role by hand and picking every permission is the slowest option and invites mistakes.

That was 10 of 375.

The full Google Associate Cloud Engineer pack has all 375 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.

Get the full pack