Google Cloud Associate Cloud Engineer —
Comprehensive Practice Exam & Study Guide
2027 | Updated Questions, Detailed
Answers, Explanations & Comprehensive
Rationales
1. A company runs a stateless web application on a
managed instance group (MIG). The application must
automatically scale based on CPU utilization, but traffic
spikes are brief and unpredictable. Which configuration
best minimizes unnecessary instance creation while
maintaining responsiveness?
A. Set the autoscaler to use only a fixed target CPU utilization
B. Disable autoscaling and increase the MIG's maximum size
C. Configure autoscaling with a target CPU utilization and an
appropriate stabilization period
D. Configure autoscaling based only on disk utilization
C. Configure autoscaling with a target CPU utilization and an
appropriate stabilization period
Rationale: A MIG autoscaler can use CPU utilization as a
scaling signal. The stabilization period helps prevent rapid
scale-in immediately after a transient spike, while the target
CPU utilization provides a workload-based scaling trigger.
,Disk utilization is generally unsuitable for scaling stateless
compute workloads.
2. A Compute Engine VM must access Cloud Storage
without storing service-account keys on the VM. The VM
should receive only the permissions required to read
objects from one specific bucket. What should the
administrator do?
A. Download a service-account JSON key to the VM and
restrict its filesystem permissions
B. Attach a service account to the VM and grant it the
required bucket-level IAM role
C. Use the default Compute Engine service account with
project-wide Editor access
D. Store the service-account key in Cloud Storage and
download it during startup
B. Attach a service account to the VM and grant it the
required bucket-level IAM role
Rationale: Attaching a service account provides the VM with
short-lived credentials through the metadata server, avoiding
long-lived key files. Granting the role specifically on the
required bucket follows least privilege and limits the service
account's access scope.
3. An organization wants to deploy containers to Google
Cloud with minimal infrastructure management. The
application must automatically scale based on incoming
, HTTP requests and can tolerate stateless execution.
Which service is most appropriate?
A. Compute Engine managed instance group
B. Google Kubernetes Engine Standard
C. Cloud Run
D. Bare-metal solution
C. Cloud Run
Rationale: Cloud Run is designed for managed container
execution and can automatically scale stateless HTTP
workloads, including scaling down when demand falls. It
avoids the infrastructure and cluster-management overhead
associated with Compute Engine or GKE.
4. A Cloud Run service must connect to a Cloud SQL
database using a private IP address. The Cloud SQL
instance and Cloud Run service are configured in the
same Google Cloud project. What networking capability
should be used?
A. Cloud NAT only
B. Serverless VPC Access or the applicable direct VPC egress
configuration
C. External IP forwarding
D. Cloud CDN
B. Serverless VPC Access or the applicable direct VPC egress
configuration
, Rationale: A Cloud Run service needs VPC connectivity to
reach resources through private networking. Depending on
the current Cloud Run networking configuration, this can be
achieved using direct VPC egress or Serverless VPC Access.
Cloud NAT alone does not provide private connectivity to a
Cloud SQL private address.
5. A company has a production VPC with multiple subnets.
An administrator creates a new subnet in one region.
What happens to the subnet's IP range?
A. It automatically becomes available in every region
B. It is associated only with the region where it was created
C. It can be moved between regions without recreation
D. It is automatically replicated into every VPC
B. It is associated only with the region where it was created
Rationale: Google Cloud VPC networks are global, but subnets
are regional resources. A subnet created in one region serves
resources in that region. Additional regional subnets must be
created when workloads require IP ranges elsewhere.
6. A VM must be reachable from the internet over HTTPS,
but SSH access should be restricted to administrators
from a corporate network. Which firewall strategy is
most appropriate?
A. Allow TCP 22 and TCP 443 from 0.0.0.0/0
B. Allow TCP 443 from the internet and TCP 22 only from the
Comprehensive Practice Exam & Study Guide
2027 | Updated Questions, Detailed
Answers, Explanations & Comprehensive
Rationales
1. A company runs a stateless web application on a
managed instance group (MIG). The application must
automatically scale based on CPU utilization, but traffic
spikes are brief and unpredictable. Which configuration
best minimizes unnecessary instance creation while
maintaining responsiveness?
A. Set the autoscaler to use only a fixed target CPU utilization
B. Disable autoscaling and increase the MIG's maximum size
C. Configure autoscaling with a target CPU utilization and an
appropriate stabilization period
D. Configure autoscaling based only on disk utilization
C. Configure autoscaling with a target CPU utilization and an
appropriate stabilization period
Rationale: A MIG autoscaler can use CPU utilization as a
scaling signal. The stabilization period helps prevent rapid
scale-in immediately after a transient spike, while the target
CPU utilization provides a workload-based scaling trigger.
,Disk utilization is generally unsuitable for scaling stateless
compute workloads.
2. A Compute Engine VM must access Cloud Storage
without storing service-account keys on the VM. The VM
should receive only the permissions required to read
objects from one specific bucket. What should the
administrator do?
A. Download a service-account JSON key to the VM and
restrict its filesystem permissions
B. Attach a service account to the VM and grant it the
required bucket-level IAM role
C. Use the default Compute Engine service account with
project-wide Editor access
D. Store the service-account key in Cloud Storage and
download it during startup
B. Attach a service account to the VM and grant it the
required bucket-level IAM role
Rationale: Attaching a service account provides the VM with
short-lived credentials through the metadata server, avoiding
long-lived key files. Granting the role specifically on the
required bucket follows least privilege and limits the service
account's access scope.
3. An organization wants to deploy containers to Google
Cloud with minimal infrastructure management. The
application must automatically scale based on incoming
, HTTP requests and can tolerate stateless execution.
Which service is most appropriate?
A. Compute Engine managed instance group
B. Google Kubernetes Engine Standard
C. Cloud Run
D. Bare-metal solution
C. Cloud Run
Rationale: Cloud Run is designed for managed container
execution and can automatically scale stateless HTTP
workloads, including scaling down when demand falls. It
avoids the infrastructure and cluster-management overhead
associated with Compute Engine or GKE.
4. A Cloud Run service must connect to a Cloud SQL
database using a private IP address. The Cloud SQL
instance and Cloud Run service are configured in the
same Google Cloud project. What networking capability
should be used?
A. Cloud NAT only
B. Serverless VPC Access or the applicable direct VPC egress
configuration
C. External IP forwarding
D. Cloud CDN
B. Serverless VPC Access or the applicable direct VPC egress
configuration
, Rationale: A Cloud Run service needs VPC connectivity to
reach resources through private networking. Depending on
the current Cloud Run networking configuration, this can be
achieved using direct VPC egress or Serverless VPC Access.
Cloud NAT alone does not provide private connectivity to a
Cloud SQL private address.
5. A company has a production VPC with multiple subnets.
An administrator creates a new subnet in one region.
What happens to the subnet's IP range?
A. It automatically becomes available in every region
B. It is associated only with the region where it was created
C. It can be moved between regions without recreation
D. It is automatically replicated into every VPC
B. It is associated only with the region where it was created
Rationale: Google Cloud VPC networks are global, but subnets
are regional resources. A subnet created in one region serves
resources in that region. Additional regional subnets must be
created when workloads require IP ranges elsewhere.
6. A VM must be reachable from the internet over HTTPS,
but SSH access should be restricted to administrators
from a corporate network. Which firewall strategy is
most appropriate?
A. Allow TCP 22 and TCP 443 from 0.0.0.0/0
B. Allow TCP 443 from the internet and TCP 22 only from the
