Google Cloud
Associate Cloud Engineer
Deploying, Monitoring & Managing Google Cloud Solutions
Exam: ACE Exam | 60 Questions & Verified Answers
Domain 1: Setting Up a Cloud Solution Environment
Projects, IAM & Billing
Q1. What is a Google Cloud project and why is it important?
A. A folder that organizes cloud resources
B. The foundational organizational unit in Google Cloud that contains resources, enables
billing, controls API access, and forms the boundary for IAM permissions
C. A type of virtual machine
D. A Google Cloud billing account
Answer: B. Foundational unit containing resources, enabling billing, controlling APIs and
IAM permissions
Every Google Cloud resource belongs to a project. Projects have: unique project ID (immutable),
project name, project number.
Projects control: which APIs are enabled, which service accounts exist, IAM policies, billing account
linkage.
Resource hierarchy: Organization > Folders > Projects > Resources.
Q2. What is the principle of least privilege in Google Cloud IAM?
A. Grant all users Owner role for simplicity
B. Grant only the minimum IAM roles and permissions required for a user or service account to
perform their specific tasks
C. Use only predefined roles, never custom roles
D. Restrict all access and require escalation for everything
Answer: B. Grant minimum IAM roles needed for specific tasks
IAM roles: Basic (Owner, Editor, Viewer — broad), Predefined (service-specific), Custom (fine-
grained).
Always prefer predefined roles over basic roles — they are more granular.
Use Custom roles when predefined roles grant too many permissions for a specific use case.
Audit permissions regularly — remove unused permissions and service account keys.
,Q3. What is a Google Cloud service account and when should you use one?
A. An account for human users to access Google Cloud
B. A special non-human identity for applications and services to authenticate and interact with
Google Cloud APIs — without using a human user's credentials
C. An account shared among all developers on a team
D. A billing account for managing project costs
Answer: B. Non-human identity for applications to authenticate to Google Cloud APIs
Service accounts are used by: Compute Engine VMs, Cloud Functions, Cloud Run, GKE pods, and
any application running code that needs to call Google Cloud APIs.
Best practice: create dedicated service accounts per application with minimum required
permissions.
Avoid using the Compute Engine default service account with broad Editor role — create specific
ones.
Workload Identity Federation: allow external workloads to use service accounts without service
account keys.
Q4. What is the difference between Cloud IAM conditions and IAM deny policies?
A. They are identical features
B. IAM conditions add context (time, resource attributes) to allow bindings; IAM deny policies
create explicit denies that override IAM allow policies
C. IAM conditions are for all users; deny policies are for admins only
D. Deny policies are not available in Google Cloud
Answer: B. Conditions add context to allow bindings; deny policies create explicit denies
overriding allows
IAM conditions: grant access only when conditions are met — e.g., only during business hours, only
from corporate IP, only for resources with specific tags.
IAM deny policies: explicitly deny specific permissions to specific principals — denies override
allows.
Use deny policies to enforce organizational guardrails regardless of allow policies below.
Q5. How do you set up billing alerts in Google Cloud?
A. Billing alerts are set up automatically
B. In Cloud Billing > Budgets & alerts: create a budget, set threshold amounts, configure email
notifications when spending reaches percentage thresholds
C. Configure billing alerts in Cloud Monitoring only
D. Contact Google support to set up billing alerts
Answer: B. Cloud Billing > Budgets & alerts — create budget, set thresholds, configure
email notifications
Budget alerts: set a budget for a project or billing account, define alert thresholds (50%, 90%,
100%, forecasted 100%).
Notifications: email alerts, Pub/Sub topic (for programmatic response — e.g., auto-disable billing).
Budgets don't stop services — they just alert. Use Cloud Functions + Pub/Sub to automatically
disable billing if needed.
Domain 2: Planning & Configuring a Cloud Solution
Compute, Storage & Networking
, Q6. What is the difference between Google Compute Engine (GCE) and Google Kubernetes
Engine (GKE)?
A. They are identical services
B. GCE provides IaaS virtual machines you manage; GKE is a managed Kubernetes service
for deploying and managing containerized applications
C. GKE is deprecated; use GCE for containers
D. GCE is only for Windows; GKE is only for Linux
Answer: B. GCE = IaaS VMs you manage; GKE = managed Kubernetes for containerized
applications
GCE: full control of VMs — choose machine type, OS, disk, networking. You manage the OS,
patches, software.
GKE: managed control plane (masters), you manage nodes. Handles container scheduling, self-
healing, scaling.
GKE Autopilot: fully managed — Google manages both control plane and nodes. You pay only for
running pods.
Q7. What is Cloud Run and when should it be used?
A. A VM service for running enterprise applications
B. A fully managed serverless platform that runs stateless containerized applications —
automatically scales to zero and handles all infrastructure
C. A Kubernetes deployment tool
D. A batch processing service
Answer: B. Fully managed serverless container platform — scales to zero, no infrastructure
management
Cloud Run: deploy containerized applications without managing servers or Kubernetes clusters.
Scales automatically from 0 to thousands of instances based on HTTP request traffic.
Pay only for actual compute time (per 100ms). Zero traffic = zero cost.
Best for: web APIs, microservices, event-driven workloads, batch jobs triggered by events.
Q8. What are the Google Cloud storage classes and when should each be used?
A. Only one storage class exists — Standard
B. Standard (frequent access), Nearline (monthly access, 30-day minimum), Coldline (quarterly
access, 90-day minimum), Archive (yearly access, 365-day minimum)
C. Hot, Warm, and Cold storage
D. SSD, HDD, and Tape storage classes
Answer: B. Standard (frequent), Nearline (monthly/30d), Coldline (quarterly/90d), Archive
(yearly/365d)
Choose based on access frequency: frequently accessed data = Standard. Backup files accessed
monthly = Nearline.
Coldline: disaster recovery data accessed quarterly.
Archive: long-term archival (compliance records) — cheapest storage, highest retrieval cost.
You pay for: storage, retrieval operations, and early deletion penalties.
Q9. What is the difference between Cloud Storage, Cloud SQL, and Bigtable?
A. They are identical storage services
B. Cloud Storage: unstructured object storage; Cloud SQL: managed relational database
(MySQL/PostgreSQL/SQLServer); Bigtable: NoSQL wide-column database for high-throughput
analytics and IoT
Associate Cloud Engineer
Deploying, Monitoring & Managing Google Cloud Solutions
Exam: ACE Exam | 60 Questions & Verified Answers
Domain 1: Setting Up a Cloud Solution Environment
Projects, IAM & Billing
Q1. What is a Google Cloud project and why is it important?
A. A folder that organizes cloud resources
B. The foundational organizational unit in Google Cloud that contains resources, enables
billing, controls API access, and forms the boundary for IAM permissions
C. A type of virtual machine
D. A Google Cloud billing account
Answer: B. Foundational unit containing resources, enabling billing, controlling APIs and
IAM permissions
Every Google Cloud resource belongs to a project. Projects have: unique project ID (immutable),
project name, project number.
Projects control: which APIs are enabled, which service accounts exist, IAM policies, billing account
linkage.
Resource hierarchy: Organization > Folders > Projects > Resources.
Q2. What is the principle of least privilege in Google Cloud IAM?
A. Grant all users Owner role for simplicity
B. Grant only the minimum IAM roles and permissions required for a user or service account to
perform their specific tasks
C. Use only predefined roles, never custom roles
D. Restrict all access and require escalation for everything
Answer: B. Grant minimum IAM roles needed for specific tasks
IAM roles: Basic (Owner, Editor, Viewer — broad), Predefined (service-specific), Custom (fine-
grained).
Always prefer predefined roles over basic roles — they are more granular.
Use Custom roles when predefined roles grant too many permissions for a specific use case.
Audit permissions regularly — remove unused permissions and service account keys.
,Q3. What is a Google Cloud service account and when should you use one?
A. An account for human users to access Google Cloud
B. A special non-human identity for applications and services to authenticate and interact with
Google Cloud APIs — without using a human user's credentials
C. An account shared among all developers on a team
D. A billing account for managing project costs
Answer: B. Non-human identity for applications to authenticate to Google Cloud APIs
Service accounts are used by: Compute Engine VMs, Cloud Functions, Cloud Run, GKE pods, and
any application running code that needs to call Google Cloud APIs.
Best practice: create dedicated service accounts per application with minimum required
permissions.
Avoid using the Compute Engine default service account with broad Editor role — create specific
ones.
Workload Identity Federation: allow external workloads to use service accounts without service
account keys.
Q4. What is the difference between Cloud IAM conditions and IAM deny policies?
A. They are identical features
B. IAM conditions add context (time, resource attributes) to allow bindings; IAM deny policies
create explicit denies that override IAM allow policies
C. IAM conditions are for all users; deny policies are for admins only
D. Deny policies are not available in Google Cloud
Answer: B. Conditions add context to allow bindings; deny policies create explicit denies
overriding allows
IAM conditions: grant access only when conditions are met — e.g., only during business hours, only
from corporate IP, only for resources with specific tags.
IAM deny policies: explicitly deny specific permissions to specific principals — denies override
allows.
Use deny policies to enforce organizational guardrails regardless of allow policies below.
Q5. How do you set up billing alerts in Google Cloud?
A. Billing alerts are set up automatically
B. In Cloud Billing > Budgets & alerts: create a budget, set threshold amounts, configure email
notifications when spending reaches percentage thresholds
C. Configure billing alerts in Cloud Monitoring only
D. Contact Google support to set up billing alerts
Answer: B. Cloud Billing > Budgets & alerts — create budget, set thresholds, configure
email notifications
Budget alerts: set a budget for a project or billing account, define alert thresholds (50%, 90%,
100%, forecasted 100%).
Notifications: email alerts, Pub/Sub topic (for programmatic response — e.g., auto-disable billing).
Budgets don't stop services — they just alert. Use Cloud Functions + Pub/Sub to automatically
disable billing if needed.
Domain 2: Planning & Configuring a Cloud Solution
Compute, Storage & Networking
, Q6. What is the difference between Google Compute Engine (GCE) and Google Kubernetes
Engine (GKE)?
A. They are identical services
B. GCE provides IaaS virtual machines you manage; GKE is a managed Kubernetes service
for deploying and managing containerized applications
C. GKE is deprecated; use GCE for containers
D. GCE is only for Windows; GKE is only for Linux
Answer: B. GCE = IaaS VMs you manage; GKE = managed Kubernetes for containerized
applications
GCE: full control of VMs — choose machine type, OS, disk, networking. You manage the OS,
patches, software.
GKE: managed control plane (masters), you manage nodes. Handles container scheduling, self-
healing, scaling.
GKE Autopilot: fully managed — Google manages both control plane and nodes. You pay only for
running pods.
Q7. What is Cloud Run and when should it be used?
A. A VM service for running enterprise applications
B. A fully managed serverless platform that runs stateless containerized applications —
automatically scales to zero and handles all infrastructure
C. A Kubernetes deployment tool
D. A batch processing service
Answer: B. Fully managed serverless container platform — scales to zero, no infrastructure
management
Cloud Run: deploy containerized applications without managing servers or Kubernetes clusters.
Scales automatically from 0 to thousands of instances based on HTTP request traffic.
Pay only for actual compute time (per 100ms). Zero traffic = zero cost.
Best for: web APIs, microservices, event-driven workloads, batch jobs triggered by events.
Q8. What are the Google Cloud storage classes and when should each be used?
A. Only one storage class exists — Standard
B. Standard (frequent access), Nearline (monthly access, 30-day minimum), Coldline (quarterly
access, 90-day minimum), Archive (yearly access, 365-day minimum)
C. Hot, Warm, and Cold storage
D. SSD, HDD, and Tape storage classes
Answer: B. Standard (frequent), Nearline (monthly/30d), Coldline (quarterly/90d), Archive
(yearly/365d)
Choose based on access frequency: frequently accessed data = Standard. Backup files accessed
monthly = Nearline.
Coldline: disaster recovery data accessed quarterly.
Archive: long-term archival (compliance records) — cheapest storage, highest retrieval cost.
You pay for: storage, retrieval operations, and early deletion penalties.
Q9. What is the difference between Cloud Storage, Cloud SQL, and Bigtable?
A. They are identical storage services
B. Cloud Storage: unstructured object storage; Cloud SQL: managed relational database
(MySQL/PostgreSQL/SQLServer); Bigtable: NoSQL wide-column database for high-throughput
analytics and IoT
