GOOGLE CLOUD ASSOCIATE CLOUD ENGINEER EXAM– QUESTIONS AND ANSWERS | VERIFIED AND WELL
DETAILED ANSWERS | PLUS RATIONALES | DOWNLOAD AND PASS | LATEST EXAM UPDATE 2026/2027
Core Domains
Configuring and Managing Virtual Machines
Managing Kubernetes Engine Clusters and Applications
Configuring Networking and Load Balancing
Managing Cloud Storage and Databases
Identity and Access Management (IAM)
Monitoring, Logging, and Diagnostics
Deployment and Resource Automation
Security and Compliance Best Practices
Introduction
,This comprehensive examination is designed to rigorously assess a candidate's readiness for the Google Cloud Associate
Cloud Engineer certification. The assessment covers a wide range of foundational and applied skills necessary for
deploying, managing, and monitoring applications and infrastructure on Google Cloud Platform (GCP). It includes a
mix of multiple-choice and scenario-based questions that emphasize not just theoretical knowledge, but also practical
decision-making, troubleshooting, and the application of best practices in real-world environments. This document
serves as a definitive tool for exam preparation, providing clear, detailed rationales for every answer to ensure a deep
and thorough understanding of the subject matter.
Section One: Questions 1 – 50
1. A company is migrating a legacy application to Google Cloud. The application has strict licensing requirements
and must run on a specific version of a Linux operating system. Which Compute Engine boot disk option is the
MOST suitable for this requirement?
A. Standard persistent disk with a public image.
B. SSD persistent disk with a custom image.
C. Local SSD with a public image.
D. Standard persistent disk with a container-optimized image.
🟢 Correct Answer: B. SSD persistent disk with a custom image.
,🔴 Explanation: A custom image allows you to create a boot disk with the specific OS and any pre-installed
software, including the required Linux version, to meet licensing and configuration needs. SSD persistent disks
provide better performance, but the core requirement is the custom image. A public image would not have the
specific version.
2. You need to ensure that a Cloud Storage bucket is accessible only from a specific Virtual Private Cloud (VPC)
network. No other IP addresses should be able to access the bucket. What is the MOST efficient way to configure
this?
A. Set the bucket's IAM policy to only allow the service account of the VPC.
B. Use a Cloud CDN and restrict access to the VPC's IP range.
C. Create a VPC Service Controls perimeter and add the bucket to the perimeter.
D. Set bucket-level permissions to deny access from all IPs, then allow the VPC's IP range.
🟢 Correct Answer: C. Create a VPC Service Controls perimeter and add the bucket to the perimeter.
🔴 Explanation: VPC Service Controls provides a security boundary around Google Cloud services, including Cloud
Storage. By placing the bucket inside a perimeter, you can restrict access to it from within a specific VPC network,
effectively preventing data exfiltration from any other network.
3. An application running on a Compute Engine instance needs to securely access a Cloud Storage bucket. What
is the BEST practice for managing these credentials?
, A. Store the service account key in the instance's metadata.
B. Include the service account key in the application's source code.
C. Create a service account with the necessary permissions and attach it to the instance.
D. Use the default Compute Engine service account and grant it storage.admin access.
🟢 Correct Answer: C. Create a service account with the necessary permissions and attach it to the instance.
🔴 Explanation: This is the best practice for security. You create a dedicated service account with the principle of
least privilege (granting only the necessary storage.objectViewer or similar permissions) and attach it to the VM.
The VM then uses this account's identity to access Google Cloud services without needing static keys.
4. You are deploying a global, microservices-based application on Google Kubernetes Engine (GKE). You need a
fully managed solution to expose your services to the internet and handle SSL termination. Which GKE Ingress
controller should you use?
A. NGINX Ingress Controller
B. Google Cloud Load Balancer Ingress
C. HAProxy Ingress Controller
D. Istio Ingress Gateway
🟢 Correct Answer: B. Google Cloud Load Balancer Ingress.
DETAILED ANSWERS | PLUS RATIONALES | DOWNLOAD AND PASS | LATEST EXAM UPDATE 2026/2027
Core Domains
Configuring and Managing Virtual Machines
Managing Kubernetes Engine Clusters and Applications
Configuring Networking and Load Balancing
Managing Cloud Storage and Databases
Identity and Access Management (IAM)
Monitoring, Logging, and Diagnostics
Deployment and Resource Automation
Security and Compliance Best Practices
Introduction
,This comprehensive examination is designed to rigorously assess a candidate's readiness for the Google Cloud Associate
Cloud Engineer certification. The assessment covers a wide range of foundational and applied skills necessary for
deploying, managing, and monitoring applications and infrastructure on Google Cloud Platform (GCP). It includes a
mix of multiple-choice and scenario-based questions that emphasize not just theoretical knowledge, but also practical
decision-making, troubleshooting, and the application of best practices in real-world environments. This document
serves as a definitive tool for exam preparation, providing clear, detailed rationales for every answer to ensure a deep
and thorough understanding of the subject matter.
Section One: Questions 1 – 50
1. A company is migrating a legacy application to Google Cloud. The application has strict licensing requirements
and must run on a specific version of a Linux operating system. Which Compute Engine boot disk option is the
MOST suitable for this requirement?
A. Standard persistent disk with a public image.
B. SSD persistent disk with a custom image.
C. Local SSD with a public image.
D. Standard persistent disk with a container-optimized image.
🟢 Correct Answer: B. SSD persistent disk with a custom image.
,🔴 Explanation: A custom image allows you to create a boot disk with the specific OS and any pre-installed
software, including the required Linux version, to meet licensing and configuration needs. SSD persistent disks
provide better performance, but the core requirement is the custom image. A public image would not have the
specific version.
2. You need to ensure that a Cloud Storage bucket is accessible only from a specific Virtual Private Cloud (VPC)
network. No other IP addresses should be able to access the bucket. What is the MOST efficient way to configure
this?
A. Set the bucket's IAM policy to only allow the service account of the VPC.
B. Use a Cloud CDN and restrict access to the VPC's IP range.
C. Create a VPC Service Controls perimeter and add the bucket to the perimeter.
D. Set bucket-level permissions to deny access from all IPs, then allow the VPC's IP range.
🟢 Correct Answer: C. Create a VPC Service Controls perimeter and add the bucket to the perimeter.
🔴 Explanation: VPC Service Controls provides a security boundary around Google Cloud services, including Cloud
Storage. By placing the bucket inside a perimeter, you can restrict access to it from within a specific VPC network,
effectively preventing data exfiltration from any other network.
3. An application running on a Compute Engine instance needs to securely access a Cloud Storage bucket. What
is the BEST practice for managing these credentials?
, A. Store the service account key in the instance's metadata.
B. Include the service account key in the application's source code.
C. Create a service account with the necessary permissions and attach it to the instance.
D. Use the default Compute Engine service account and grant it storage.admin access.
🟢 Correct Answer: C. Create a service account with the necessary permissions and attach it to the instance.
🔴 Explanation: This is the best practice for security. You create a dedicated service account with the principle of
least privilege (granting only the necessary storage.objectViewer or similar permissions) and attach it to the VM.
The VM then uses this account's identity to access Google Cloud services without needing static keys.
4. You are deploying a global, microservices-based application on Google Kubernetes Engine (GKE). You need a
fully managed solution to expose your services to the internet and handle SSL termination. Which GKE Ingress
controller should you use?
A. NGINX Ingress Controller
B. Google Cloud Load Balancer Ingress
C. HAProxy Ingress Controller
D. Istio Ingress Gateway
🟢 Correct Answer: B. Google Cloud Load Balancer Ingress.
