Associate Cloud Engineer · Sample questions

Associate Cloud Engineer sample questions with answers and explanations

10 real questions from the CertifyDeck Associate Cloud Engineer bank, spread across the domains of the official Google Cloud Certified Associate Cloud Engineer skills outline, with the correct answer and a full explanation of why the other options are wrong. They are original questions written from the public syllabus, not exam dumps, and they are the same style you will find in the practice tests and mock exams.

1. Question 1Domain: Planning and configuring a cloud solutionMedium

   A project contains several VMs whose external IP addresses use Premium Tier. You run gcloud compute project-info update --default-network-tier STANDARD in that project. What is the effect of this command?

   • A.Existing VMs and addresses are switched to Standard Tier during their next restart.
   • B.Only new global external load balancers in the project are created in Standard Tier.
   • C.All external IP addresses in the project are moved to the Standard Tier pool right away.
   • D.New resources created without a tier use Standard; existing ones keep Premium.
   Show answer and explanation

   Correct answer: D. New resources created without a tier use Standard; existing ones keep Premium.

   Explanation

   The project default network tier is used by newly created eligible resources when you do not specify a tier for them; changing it does not change the tier of any existing resource. Addresses are never moved between pools, so existing Premium Tier addresses stay as they are, with or without a restart. Global external load balancers do not support Standard Tier at all.

   Official references

   • Quickstart: Set the network tier
   • Network Service Tiers overview
2. Question 2Domain: Planning and configuring a cloud solutionMedium

   Your company collects sensor readings from millions of devices, producing billions of rows that are written continuously and read back by device ID and timestamp with low latency. The data team already has code that uses the Apache HBase client library. Which product should you use?

   • A.Bigtable, with a row key built from the device ID and timestamp.
   • B.BigQuery, with a table partitioned by timestamp and clustered by device ID.
   • C.Firestore, with one document per reading in a device collection.
   • D.Cloud SQL, with an index on the device ID and timestamp columns.
   Show answer and explanation

   Correct answer: A. Bigtable, with a row key built from the device ID and timestamp.

   Explanation

   Bigtable is designed for large amounts of single-keyed data, scales to billions of rows, supports high read and write throughput at low latency, and offers an extension to the Apache HBase library for Java, so the existing client code can be reused. BigQuery is an analytics platform for SQL queries over large datasets rather than low-latency key lookups, and Cloud SQL and Firestore do not provide HBase compatibility for this workload.

   Official references

   • Bigtable overview
3. Question 3Domain: Deploying and implementing a cloud solutionMedium

   You manage 200 Linux VMs spread over two zones with VM Manager enabled. They must be patched every month, at most 10% of the VMs in a zone may be disrupted at the same time, and a script must stop the application on each VM before it is patched. What should you do?

   • A.Enforce the compute.requireOsConfig constraint so the agents install updates by themselves.
   • B.Enable OS inventory management and review the vulnerability reports every month.
   • C.Run a one-time patch job each month that patches both zones concurrently with no budget.
   • D.Create a recurring patch deployment with a 10% disruption budget and a pre-patch script.
   Show answer and explanation

   Correct answer: D. Create a recurring patch deployment with a 10% disruption budget and a pre-patch script.

   Explanation

   A patch deployment schedules recurring patch jobs, and its rollout options include a disruption budget, the number or percentage of VMs in a zone disrupted at one time, plus optional pre-patch and post-patch scripts. A monthly manual job without a budget fails the disruption limit and must be launched by hand. Inventory reports only show the patch status, and the compute.requireOsConfig constraint only sets the enable-osconfig metadata.

   Official references

   • Schedule patch jobs
   • About Patch
4. Question 4Domain: Deploying and implementing a cloud solutionMedium

   You have a project with an auto mode VPC network that runs production VMs in two regions. The security team wants you to remove the automatically created subnets in all the other regions, without recreating the network or interrupting the running VMs. What should you do?

   • A.Run gcloud compute networks update with --bgp-routing-mode=regional so that only the used regions keep subnets.
   • B.Delete the VPC network and recreate it in custom mode with only the two subnets that are in use.
   • C.Run gcloud compute networks subnets delete for each unused subnet while the network stays in auto mode.
   • D.Run gcloud compute networks update with --switch-to-custom-subnet-mode, then delete the unused subnets.
   Show answer and explanation

   Correct answer: D. Run gcloud compute networks update with --switch-to-custom-subnet-mode, then delete the unused subnets.

   Explanation

   Automatically created subnets cannot be deleted while the network is in auto mode, but you can convert the network to custom mode in place and then delete the unused subnets; the conversion is one-way. Deleting the subnets directly fails because the network is still in auto mode. Recreating the network would require removing the running VMs first, which breaks the requirement, and the dynamic routing mode has no effect on which subnets exist.

   Official references

   • Quickstart: Create and manage VPC networks
5. Question 5Domain: Configuring access and securityMedium

   A platform engineer must create service accounts in project prj-apps. Another team decides who can use and impersonate those service accounts, so the engineer must not be able to change their allow policies. Following the principle of least privilege, which role should you grant the engineer on the project?

   • A.Service Account User (roles/iam.serviceAccountUser)
   • B.Service Account Admin (roles/iam.serviceAccountAdmin)
   • C.Editor (roles/editor)
   • D.Create Service Accounts (roles/iam.serviceAccountCreator)
   Show answer and explanation

   Correct answer: D. Create Service Accounts (roles/iam.serviceAccountCreator)

   Explanation

   Create Service Accounts is the role that the documentation names for creating service accounts in a project. Service Account Admin also includes iam.serviceAccounts.setIamPolicy, which would let the engineer change who can use or impersonate the accounts. Service Account User only lets a principal attach existing service accounts to resources, and Editor is a broad basic role.

   Official references

   • Create service accounts
   • Best practices for using service accounts securely
6. Question 6Domain: Configuring access and securityMedium

   A support engineer must run gcloud commands with --impersonate-service-account=sa-ops@prj-ops.iam.gserviceaccount.com. You granted the engineer the Service Account User role on sa-ops, but the commands still fail with a permission error. Following least privilege, what should you do?

   • A.Grant the engineer the Workload Identity User role on the sa-ops service account.
   • B.Grant sa-ops the Service Account Token Creator role on itself so that it can issue tokens.
   • C.Grant the engineer the Service Account User role on the prj-ops project instead of on sa-ops.
   • D.Grant the engineer the Service Account Token Creator role on the sa-ops service account.
   Show answer and explanation

   Correct answer: D. Grant the engineer the Service Account Token Creator role on the sa-ops service account.

   Explanation

   Impersonation requires iam.serviceAccounts.getAccessToken, which is in the Service Account Token Creator role, and that role is what lets a principal use the --impersonate-service-account flag. Service Account User only lets a principal attach the account to resources, so granting it more broadly on the project still doesn't allow impersonation. The caller, not the service account, needs the role, and Workload Identity User is for workloads such as GKE Pods.

   Official references

   • Roles for service account authentication
   • Service account impersonation
7. Question 7Domain: Setting up a cloud solution environmentEasy

   You created a Cloud Billing budget for a group of projects. Two project managers who have no roles on the billing account must also receive the budget alert emails. You must not grant them any additional permissions. What should you do?

   • A.Enable the option that sends alert emails to project owners, and make the managers owners of the projects.
   • B.Link Cloud Monitoring email notification channels for the project managers' addresses to the budget.
   • C.Grant the project managers the Billing Account User role so that they receive the default alert emails.
   • D.Connect a Pub/Sub topic to the budget and add the project managers as subscribers of the topic.
   Show answer and explanation

   Correct answer: B. Link Cloud Monitoring email notification channels for the project managers' addresses to the budget.

   Explanation

   Cloud Monitoring email notification channels linked to a budget let you send alert emails to addresses of your choice, beyond the default billing role holders, without granting roles. Granting Billing Account User or making the managers Project Owners adds permissions, which the requirement forbids, and the project owner option is only available for budgets scoped to a single project. A Pub/Sub topic is for programmatic notifications that an application processes, not for email alerts to people.

   Official references

   • Create, edit, or delete budgets and budget alerts
8. Question 8Domain: Setting up a cloud solution environmentEasy

   Your company manages Google Cloud through an organization resource. A finance lead must create a new self-serve Cloud Billing account for a new business unit. Only a small, controlled group of people should be able to create billing accounts, and you must follow least privilege. Which role should you grant the finance lead on the organization?

   • A.Billing Account User (roles/billing.user)
   • B.Billing Account Administrator (roles/billing.admin)
   • C.Billing Account Creator (roles/billing.creator)
   • D.Project Creator (roles/resourcemanager.projectCreator)
   Show answer and explanation

   Correct answer: C. Billing Account Creator (roles/billing.creator)

   Explanation

   Members of an organization need the Billing Account Creator role on the organization node to create a Cloud Billing account, and Google recommends keeping the number of holders small to avoid untracked spend. Billing Account Administrator manages existing billing accounts but does not create them. Billing Account User only links projects to a billing account, and Project Creator creates projects, not billing accounts.

   Official references

   • Create a new self-serve Cloud Billing account
   • Cloud Billing access control and permissions
9. Question 9Domain: Ensuring successful operation of a cloud solutionEasy

   Your company has a custom mode VPC network named corp-net with subnets in two regions. You now need to deploy VMs in the asia-south1 region, in the same network, using the range 10.30.0.0/24. What should you do?

   • A.Run gcloud compute networks subnets create asia-subnet --network=corp-net --range=10.30.0.0/24 --region=asia-south1.
   • B.Run gcloud compute networks create corp-net-asia --subnet-mode=custom and then peer it with corp-net.
   • C.Run gcloud compute addresses create with --region=asia-south1 and --addresses=10.30.0.0.
   • D.Run gcloud compute networks subnets expand-ip-range on an existing subnet in corp-net so that it also covers 10.30.0.0/24.
   Show answer and explanation

   Correct answer: A. Run gcloud compute networks subnets create asia-subnet --network=corp-net --range=10.30.0.0/24 --region=asia-south1.

   Explanation

   VPC networks are global but subnets are regional, so adding a region to corp-net means creating a subnet in that region with gcloud compute networks subnets create, giving its network, primary range and region. A new peered network adds complexity and does not put the VMs in corp-net. Expanding an existing subnet keeps it in its own region, and gcloud compute addresses create reserves an IP address, not a subnet.

   Official references

   • Create and manage VPC networks
   • Subnets
10. Question 10Domain: Ensuring successful operation of a cloud solutionEasy

    You are setting up a global external Application Load Balancer for a public website. You need an IPv4 address that will not change so that you can publish it in DNS before go-live. What should you do?

    • A.Use the ephemeral address assigned to the forwarding rule and publish that address in DNS.
    • B.Reserve it with gcloud compute addresses create web-ip --global --ip-version=IPV4.
    • C.Reserve it with gcloud compute addresses create web-ip --region=us-central1.
    • D.Reserve it with gcloud compute addresses create web-ip --region=us-central1 --subnet=web-subnet.
    Show answer and explanation

    Correct answer: B. Reserve it with gcloud compute addresses create web-ip --global --ip-version=IPV4.

    Explanation

    Global load balancers use global static external IP addresses, which you reserve with gcloud compute addresses create and the --global flag; the address stays fixed until you release it. A regional external address is meant for VMs and regional load balancers, and adding --subnet reserves an internal address that isn't reachable from the internet. An ephemeral address isn't reserved, so it can change and is unsafe to publish in DNS.

    Official references

    • Reserve a static external IP address