Google Associate Cloud Engineer QUESTIONS AND
ANSWERS | VERIFIED AND WELL DETAILED
ANSWERS | PLUS RATIONALES | GUARANTEED PASS
| LATEST EXAM UPDATE | EXAM PREP | STUDY
GUIDE | PRACTICE TEST
,Section 1: Setting Up a Cloud Solution Environment (Q1–Q15)
Q1. Your company wants to ensure that all Google Cloud resources are created in the `europe-west1` region
unless explicitly approved otherwise. What should you do?
A) Create a VM in each region
B) Use an Organization Policy constraint `gcp.resourceLocations`
C) Enable VPC Service Controls
D) Use IAM roles
Answer: B
Rationale: Organization Policy `gcp.resourceLocations` restricts resource creation to specified locations. IAM
and VPC-SC don't restrict region selection.
, Q2. You need to grant a user the ability to view all resources in a project but not modify them. Which role
should you assign?
A) roles/owner
B) roles/editor
C) roles/viewer
D) roles/browser
Answer: C
Rationale: `roles/viewer` grants read-only access to all resources. `roles/browser` only allows browsing the
hierarchy.
Q3. You want to create a new project and link it to your organization's billing account. Which is required?
A) Project Creator role and Billing Account User role
B) Owner role only
C) Editor role
D) Billing Account Administrator only
, Answer: A
Rationale: You need `resourcemanager.projects.create` (Project Creator) and
`billing.resourceAssociations.create` (Billing Account User).
Q4. Your organization wants to enforce MFA for all users. Where do you configure this?
A) IAM
B) Cloud Identity / Google Workspace Admin Console
C) Cloud Shell
D) VPC firewall rules
Answer: B
Rationale: MFA is configured in Cloud Identity or Google Workspace, not in GCP IAM directly.
ANSWERS | VERIFIED AND WELL DETAILED
ANSWERS | PLUS RATIONALES | GUARANTEED PASS
| LATEST EXAM UPDATE | EXAM PREP | STUDY
GUIDE | PRACTICE TEST
,Section 1: Setting Up a Cloud Solution Environment (Q1–Q15)
Q1. Your company wants to ensure that all Google Cloud resources are created in the `europe-west1` region
unless explicitly approved otherwise. What should you do?
A) Create a VM in each region
B) Use an Organization Policy constraint `gcp.resourceLocations`
C) Enable VPC Service Controls
D) Use IAM roles
Answer: B
Rationale: Organization Policy `gcp.resourceLocations` restricts resource creation to specified locations. IAM
and VPC-SC don't restrict region selection.
, Q2. You need to grant a user the ability to view all resources in a project but not modify them. Which role
should you assign?
A) roles/owner
B) roles/editor
C) roles/viewer
D) roles/browser
Answer: C
Rationale: `roles/viewer` grants read-only access to all resources. `roles/browser` only allows browsing the
hierarchy.
Q3. You want to create a new project and link it to your organization's billing account. Which is required?
A) Project Creator role and Billing Account User role
B) Owner role only
C) Editor role
D) Billing Account Administrator only
, Answer: A
Rationale: You need `resourcemanager.projects.create` (Project Creator) and
`billing.resourceAssociations.create` (Billing Account User).
Q4. Your organization wants to enforce MFA for all users. Where do you configure this?
A) IAM
B) Cloud Identity / Google Workspace Admin Console
C) Cloud Shell
D) VPC firewall rules
Answer: B
Rationale: MFA is configured in Cloud Identity or Google Workspace, not in GCP IAM directly.
