GOOGLE CLOUD ASSOCIATE CLOUD ENGINEER – PRACTICE QUESTIONS AND CORRECT ANSWERS (VERIFIED ANSWERS)
PLUS RATIONALES 2026 Q&A | INSTANT DOWNLOAD PDF.
CORE DOMAINS
1. Setting up a cloud solution environment
2. Planning and configuring a cloud solution
3. Deploying and implementing a cloud solution
4. Ensuring successful operation of a cloud solution
5. Configuring access and security
6. Monitoring, logging, and cost estimation
INTRODUCTION
The Associate Cloud Engineer exam validates the ability to maintain and deploy applications on Google Cloud. Candidates demonstrate
proficiency in using the Google Cloud Console and the command-line interface to perform common platform-based tasks to maintain one or
more deployed solutions that leverage Google-managed or self-managed services on Google Cloud. This comprehensive practice
assessment consists of multiple-choice and scenario-based questions designed to test real-world application, critical thinking, and technical
decision-making capabilities across compute, storage, networking, and identity management services. Success requires a solid
understanding of cloud infrastructure infrastructure components and access control policies.
SECTION ONE: QUESTIONS 1–100
Question 1
Your company has a single Google Cloud project containing multiple Compute Engine instances used by different development teams. You
need to track the monthly costs incurred by each team without separating the resources into different projects. What should you do?
A. Create a separate billing account for each team.
B. Apply resource labels to the instances indicating the team name.
C. Use Identity and Access Management roles to isolate the resources.
D. Move the instances into different zones within the same region.
🟢 B. Apply resource labels to the instances indicating the team name.
🔴 RATIONALE: Resource labels are key-value pairs assigned to Google Cloud resources, allowing organizations to categorize and track
costs in billing reports. Creating separate billing accounts or shifting zones does not inherently group costs by team within a single project,
and IAM roles manage permissions rather than financial tracking.
Question 2
A development team wants to deploy a containerized web application that scales automatically based on incoming HTTP traffic to zero
when there is no load. They want a fully managed service where they do not have to manage the underlying server infrastructure. Which
Google Cloud service should they choose?
A. Compute Engine
,B. Google Kubernetes Engine
C. Cloud Run
D. App Engine Flexible Environment
🟢 C. Cloud Run
🔴 RATIONALE: Cloud Run is a fully managed serverless platform that automatically scales containerized applications up or down,
including scaling to zero when there is no traffic. Compute Engine and GKE require underlying infrastructure management, while App
Engine Flexible does not scale to zero.
Question 3
You need to establish a secure, high-bandwidth connection between your on-premises data center and a Google Cloud Virtual Private
Cloud. The connection must guarantee a minimum bandwidth of 10 Gbps and cannot traverse the public internet. Which connectivity option
should you select?
A. Carrier Peering
B. Dedicated Interconnect
C. Partner Interconnect
D. Cloud VPN
🟢 B. Dedicated Interconnect
🔴 RATIONALE: Dedicated Interconnect provides a direct physical connection between an on-premises network and Google's network with
capacities starting at 10 Gbps per link, bypassing the public internet. Cloud VPN traverses the public internet, whereas Carrier Peering does
not provide direct access to internal VPC networks.
Question 4
An auditor requires a list of all IAM policy modifications made within your Google Cloud organization over the past 90 days. Where should
you look to find this information with the least operational effort?
A. Compute Engine serial port logs
B. Cloud Storage access logs
C. Cloud Audit Logs
D. Error Reporting logs
🟢 C. Cloud Audit Logs
🔴 RATIONALE: Cloud Audit Logs automatically record administrative activities, including IAM policy updates, across Google Cloud
services. This metadata provides an immutable audit trail, making it the correct location for compliance reviews.
Question 5
You are creating a Cloud Storage bucket to store data that will be accessed less than once a year, primarily for long-term disaster recovery
purposes. Which storage class minimizes total storage costs for this use case?
A. Standard
B. Nearline
C. Coldline
D. Archive
, 🟢 D. Archive
🔴 RATIONALE: Archive storage offers the lowest cost per gigabyte for data storage and is specifically designed for long-term retention and
disaster recovery where data access is expected to happen less than once a year.
Question 6
A script needs to run on a Compute Engine instance and write files directly into a Cloud Storage bucket. Following security best practices,
how should you grant the instance the necessary permissions?
A. Embed your personal user account credentials directly inside the script.
B. Attach a service account with the Storage Object Admin role to the instance.
C. Configure the bucket to have public write access via ACLs.
D. Generate an API API key and hardcode it in the instance's metadata.
🟢 B. Attach a service account with the Storage Object Admin role to the instance.
🔴 RATIONALE: Attaching a dedicated service account to a Compute Engine instance adheres to the principle of least privilege, allowing
applications to authenticate securely without hardcoding sensitive credentials or exposing resources publicly.
Question 7
You need to deploy an update to an application running on an App Engine standard environment. You want to test the new version with 10%
of your production traffic before routing all traffic to it. Which strategy should you implement?
A. Deploy the new version as a separate service and use Cloud Load Balancing.
B. Deploy the new version and use traffic splitting within the App Engine console.
C. Override the existing version immediately and use Cloud Tasks to queue requests.
D. Deploy the new version to a separate project and use Cloud DNS to route traffic.
🟢 B. Deploy the new version and use traffic splitting within the App Engine console.
🔴 RATIONALE: App Engine natively supports traffic splitting, which allows administrators to distribute incoming requests between two or
more versions of an application by cookie or IP address without requiring an external load balancer.
Question 8
You are setting up a Google Kubernetes Engine cluster. You want to minimize administrative overhead for node management tasks,
including OS patching, node upgrades, and auto-scaling. Which cluster type should you deploy?
A. Standard Cluster with manual provisioning
B. GKE Autopilot Cluster
C. Alpha Cluster
D. Private Cluster with manual scaling
🟢 B. GKE Autopilot Cluster
🔴 RATIONALE: GKE Autopilot is a mode of operation in which Google manages the entire cluster infrastructure, including the underlying
nodes, scaling, updates, and security configuration, reducing operational management overhead.
Question 9
PLUS RATIONALES 2026 Q&A | INSTANT DOWNLOAD PDF.
CORE DOMAINS
1. Setting up a cloud solution environment
2. Planning and configuring a cloud solution
3. Deploying and implementing a cloud solution
4. Ensuring successful operation of a cloud solution
5. Configuring access and security
6. Monitoring, logging, and cost estimation
INTRODUCTION
The Associate Cloud Engineer exam validates the ability to maintain and deploy applications on Google Cloud. Candidates demonstrate
proficiency in using the Google Cloud Console and the command-line interface to perform common platform-based tasks to maintain one or
more deployed solutions that leverage Google-managed or self-managed services on Google Cloud. This comprehensive practice
assessment consists of multiple-choice and scenario-based questions designed to test real-world application, critical thinking, and technical
decision-making capabilities across compute, storage, networking, and identity management services. Success requires a solid
understanding of cloud infrastructure infrastructure components and access control policies.
SECTION ONE: QUESTIONS 1–100
Question 1
Your company has a single Google Cloud project containing multiple Compute Engine instances used by different development teams. You
need to track the monthly costs incurred by each team without separating the resources into different projects. What should you do?
A. Create a separate billing account for each team.
B. Apply resource labels to the instances indicating the team name.
C. Use Identity and Access Management roles to isolate the resources.
D. Move the instances into different zones within the same region.
🟢 B. Apply resource labels to the instances indicating the team name.
🔴 RATIONALE: Resource labels are key-value pairs assigned to Google Cloud resources, allowing organizations to categorize and track
costs in billing reports. Creating separate billing accounts or shifting zones does not inherently group costs by team within a single project,
and IAM roles manage permissions rather than financial tracking.
Question 2
A development team wants to deploy a containerized web application that scales automatically based on incoming HTTP traffic to zero
when there is no load. They want a fully managed service where they do not have to manage the underlying server infrastructure. Which
Google Cloud service should they choose?
A. Compute Engine
,B. Google Kubernetes Engine
C. Cloud Run
D. App Engine Flexible Environment
🟢 C. Cloud Run
🔴 RATIONALE: Cloud Run is a fully managed serverless platform that automatically scales containerized applications up or down,
including scaling to zero when there is no traffic. Compute Engine and GKE require underlying infrastructure management, while App
Engine Flexible does not scale to zero.
Question 3
You need to establish a secure, high-bandwidth connection between your on-premises data center and a Google Cloud Virtual Private
Cloud. The connection must guarantee a minimum bandwidth of 10 Gbps and cannot traverse the public internet. Which connectivity option
should you select?
A. Carrier Peering
B. Dedicated Interconnect
C. Partner Interconnect
D. Cloud VPN
🟢 B. Dedicated Interconnect
🔴 RATIONALE: Dedicated Interconnect provides a direct physical connection between an on-premises network and Google's network with
capacities starting at 10 Gbps per link, bypassing the public internet. Cloud VPN traverses the public internet, whereas Carrier Peering does
not provide direct access to internal VPC networks.
Question 4
An auditor requires a list of all IAM policy modifications made within your Google Cloud organization over the past 90 days. Where should
you look to find this information with the least operational effort?
A. Compute Engine serial port logs
B. Cloud Storage access logs
C. Cloud Audit Logs
D. Error Reporting logs
🟢 C. Cloud Audit Logs
🔴 RATIONALE: Cloud Audit Logs automatically record administrative activities, including IAM policy updates, across Google Cloud
services. This metadata provides an immutable audit trail, making it the correct location for compliance reviews.
Question 5
You are creating a Cloud Storage bucket to store data that will be accessed less than once a year, primarily for long-term disaster recovery
purposes. Which storage class minimizes total storage costs for this use case?
A. Standard
B. Nearline
C. Coldline
D. Archive
, 🟢 D. Archive
🔴 RATIONALE: Archive storage offers the lowest cost per gigabyte for data storage and is specifically designed for long-term retention and
disaster recovery where data access is expected to happen less than once a year.
Question 6
A script needs to run on a Compute Engine instance and write files directly into a Cloud Storage bucket. Following security best practices,
how should you grant the instance the necessary permissions?
A. Embed your personal user account credentials directly inside the script.
B. Attach a service account with the Storage Object Admin role to the instance.
C. Configure the bucket to have public write access via ACLs.
D. Generate an API API key and hardcode it in the instance's metadata.
🟢 B. Attach a service account with the Storage Object Admin role to the instance.
🔴 RATIONALE: Attaching a dedicated service account to a Compute Engine instance adheres to the principle of least privilege, allowing
applications to authenticate securely without hardcoding sensitive credentials or exposing resources publicly.
Question 7
You need to deploy an update to an application running on an App Engine standard environment. You want to test the new version with 10%
of your production traffic before routing all traffic to it. Which strategy should you implement?
A. Deploy the new version as a separate service and use Cloud Load Balancing.
B. Deploy the new version and use traffic splitting within the App Engine console.
C. Override the existing version immediately and use Cloud Tasks to queue requests.
D. Deploy the new version to a separate project and use Cloud DNS to route traffic.
🟢 B. Deploy the new version and use traffic splitting within the App Engine console.
🔴 RATIONALE: App Engine natively supports traffic splitting, which allows administrators to distribute incoming requests between two or
more versions of an application by cookie or IP address without requiring an external load balancer.
Question 8
You are setting up a Google Kubernetes Engine cluster. You want to minimize administrative overhead for node management tasks,
including OS patching, node upgrades, and auto-scaling. Which cluster type should you deploy?
A. Standard Cluster with manual provisioning
B. GKE Autopilot Cluster
C. Alpha Cluster
D. Private Cluster with manual scaling
🟢 B. GKE Autopilot Cluster
🔴 RATIONALE: GKE Autopilot is a mode of operation in which Google manages the entire cluster infrastructure, including the underlying
nodes, scaling, updates, and security configuration, reducing operational management overhead.
Question 9
