Google Cloud Associate Cloud Engineer practice questions

Question 1

An engineer is being asked the following question. A network engineer is being asked which lifecycle operations on Virtual Private Cloud (VPC) networks and subnetworks are covered by the VPC quickstart page. Which statement matches the documented scope?

Accepted Answer

This document describes how to create, modify, and delete Virtual Private Cloud (VPC) networks and subnetworks. This is the documented behavior in the canonical Google Cloud reference for this product.

Answer

This document describes only how to peer two VPC networks across organizations and explicitly does not cover creating, modifying, or deleting any VPC network or subnetwork on the Google Cloud platform today on VPC.

Answer

This document describes only how to manage Cloud DNS managed zones and explicitly does not cover creating, modifying, or deleting any VPC network or subnetwork on the Google Cloud platform today at the network layer.

Answer

This document describes only how to attach Cloud VPN tunnels to a VPC network for site-to-site connectivity and does not cover any other lifecycle operation on the VPC networks or subnetworks themselves.

Question 2

A company is reviewing Cloud SQL for MySQL automated backups and notices the first backup is large while later ones are much smaller. Which statement matches the documented backup model?

Accepted Answer

All backups after the first are incremental, storing only data changed since the prior backup.

Answer

Every backup is a complete full copy, so each one is about the same size as the entire database.

Answer

Backups live only on the instance's local disk and are lost whenever the instance is deleted.

Answer

You must provision and manage a Cloud Storage bucket yourself to retain the incremental backups.

Question 3

A developer is being onboarded to a new Google Cloud project and runs gcloud init for the first time on a freshly installed Cloud CLI. Which statement best describes what gcloud init does during this interactive workflow?

Accepted Answer

gcloud init launches an interactive Getting Started workflow for the gcloud command-line tool. This is the documented behavior in the canonical Google Cloud reference for this product.

Answer

gcloud init only refreshes cached metadata for an existing configuration and does not authorize the CLI or alter any project or region settings during its run.

Answer

gcloud init exclusively installs additional gcloud component packages from the public repository and is not used to authorize or configure the CLI in any way.

Answer

gcloud init enables billing on the current project by linking it to a Cloud Billing account, but it does not configure regions, zones, or user credentials at any point.

Question 4

A platform team is tasked with giving a new analyst group the ability to list and read resources in a project, and a junior engineer asks why they cannot just attach the individual resourcemanager.projects.get permission directly to each user. According to the IAM overview, how does IAM actually deliver permissions to principals?

Accepted Answer

You cannot grant a permission to a principal directly; principals receive permissions only by being granted roles, which bundle permissions.

Answer

You attach each permission directly to the principal, and roles are merely optional labels used to group users together for billing exports.

Answer

You grant the permissions to the principal directly, but the grant only activates once the matching REST API method has been enabled first.

Answer

You let the permissions flow from the project's VPC network automatically, so granting any roles to the principals is never actually required.

Question 5

An engineer is being asked the following question. An SRE is being asked about the failure mode for preemptible VM instances in Compute Engine, since their service-level expectations are different from standard VMs. Which statement matches the documented behavior?

Accepted Answer

However, Compute Engine might stop (preempt) these instances if it needs to reclaim the compute capacity for allocation to other VMs. This is the documented behavior in the canonical Google Cloud reference for this product.

Answer

Compute Engine never preempts preemptible VMs once they are running; the discount is the only difference between preemptible and standard instances, so SLO calculations can treat them identically in production today.

Answer

Compute Engine preempts preemptible VMs strictly on a 24-hour rolling timer regardless of platform capacity demand and ignores whether other workloads need the underlying physical resources in the host data center.

Answer

Compute Engine preempts preemptible VMs only on a quarterly maintenance window scheduled per region and never in response to capacity needs on the platform, so they are predictable for SLO purposes.

Question 6

A developer is being asked how App Engine standard environment handles traffic increases for a deployed application. Which statement matches the documented behavior?

Accepted Answer

Applications run in a secure, sandboxed environment, allowing the standard environment to distribute requests across multiple servers and scale servers to meet traffic demands. This is the documented behavior in the canonical Google Cloud reference for this product.

Answer

App Engine standard environment pins each application to one server for the entire lifetime of the deployment and cannot distribute requests across multiple servers under any circumstances regardless of how much traffic it gets.

Answer

App Engine standard environment requires the user to manually pre-warm a fixed number of Compute Engine VMs and cannot scale the server pool dynamically in response to incoming request volume at any time on the platform.

Answer

App Engine standard environment is a single-tenant bare-metal product that runs each application on dedicated hardware and never distributes requests across multiple servers regardless of how much traffic the application receives at peak hours.

Question 7

An engineer is being asked the following question. A platform engineer is being asked how Cloud Monitoring supports probing services that are reachable only from inside a private network, not from the public internet. Which statement matches the documented option?

Accepted Answer

For information about how to create uptime checks for private networks, see Create private uptime checks . This is the documented behavior in the canonical Google Cloud reference for this product. This statement appears verbatim in the linked Google Cloud documentation page.

Answer

Cloud Monitoring supports private network uptime checks only by deploying a Compute Engine VM that runs a custom shell script which posts results back to Cloud Monitoring using the API, with no first-class private-network probe documented today.

Answer

Cloud Monitoring does not support uptime checks against any resource that is not reachable from the public internet and explicitly recommends moving the resource onto a publicly addressable host before any health monitoring can be set up at all.

Answer

Cloud Monitoring supports private network uptime checks only via a separate paid Premium Support tier and the configuration is not part of the standard Cloud Monitoring documentation set in any Google Cloud region available to customers today.

Question 8

A cloud administrator is decommissioning an unused analytics service and disables its API, expecting that this alone will halt the storage charges for data the service already wrote to Cloud Storage and BigQuery. According to the Service Usage documentation, what is the billing impact of disabling a service's API?

Accepted Answer

Disabling the API does not delete your data, so you keep being billed until you delete the associated data yourself.

Answer

Disabling the API immediately deletes the data the service stored, so all associated storage charges stop right away.

Answer

Disabling the API stops storage billing at once, although Google retains the data for a 30-day recovery window.

Answer

Disabling the API automatically moves the stored data to Archive class, which lowers but does not remove the charges.

Question 9

An engineer is being asked to explain, for an internal audit, exactly which identities participate when a principal impersonates a service account to obtain short-lived credentials. According to the service account impersonation documentation, which description is accurate?

Accepted Answer

Two identities are involved: an authenticated principal and the service account, with the principal getting a token for that account.

Answer

Only one identity is involved: the service account signs its own request, and no separate authenticated principal participates in the flow at all.

Answer

Three identities are involved: a user, a Workload Identity Pool, and an external identity provider that mints the final access token for the call.

Answer

Two identities are involved, but the principal hands the service account a long-lived password that the account can store and reuse later on.

Question 10

An architect is designing client access for a public web application whose users connect from the internet and whose backends are deployed across several regions for low latency. Which TWO statements match the documented behavior of Cloud Load Balancing?

Accepted Answer

An external load balancer fits here because the application's clients need to reach it from the internet rather than from inside Google Cloud.

Accepted Answer

A global load balancer is the correct scope because it supports backends in multiple regions, whereas a regional one is limited to a single region.

Answer

A regional load balancer supports backends spread across several regions, so it is the correct scope for this multi-region backend deployment.

Answer

An internal load balancer fits here because the clients reach the application from the public internet, which is precisely what internal balancing targets.

Question 11

A developer is being asked to summarize where application workloads run in a GKE cluster after they are deployed via kubectl apply. Which statement matches the documented architecture?

Accepted Answer

You deploy applications to clusters, and the applications run on the nodes. This is the documented behavior in the canonical Google Cloud reference for this product. This statement appears verbatim in the linked Google Cloud documentation page.

Answer

Applications deployed via kubectl apply run only on Cloud Run revisions that are dynamically created per Pod by GKE and are billed separately from the underlying Compute Engine cluster's worker nodes.

Answer

Applications deployed via kubectl apply run only on the GKE control plane machines and never on the worker nodes, regardless of how many node pools or autoscalers are configured for the cluster.

Answer

Applications deployed via kubectl apply run only on Cloud Functions instances that are dynamically created per Pod by GKE and are billed separately from the underlying Compute Engine cluster worker nodes.

Question 12

An engineer is being asked the following question. A security team is being asked which Cloud Storage feature provides per-request log data on a specific bucket. Which statement matches the documented offering?

Accepted Answer

Cloud Storage offers usage logs and storage logs in the form of CSV files that you can download and view. This is the documented behavior in the canonical Google Cloud reference for this product. This statement appears verbatim in the linked Google Cloud documentation page.

Answer

Cloud Storage does not offer any kind of access logging on individual buckets; teams must instead deploy a Compute Engine VM that runs nginx as a proxy in front of every bucket to capture per-request logs at all today on the platform.

Answer

Cloud Storage offers only protobuf-encoded binary logs that can be queried solely through a private partner API and are not available as CSV files or any other format to the bucket administrator on the project at all today.

Answer

Cloud Storage offers usage data only through Cloud Billing exports because each request maps directly to a billing line item, and there is no documented log artifact provided to the bucket administrator separately from billing exports.

Question 13

A finance team has decided to restructure how Google Cloud costs are discounted and invoiced, and a cloud administrator is mapping the requirements to Cloud Billing features. Which TWO statements correctly match documented Cloud Billing cost-optimization and invoicing features? (Choose two.)

Accepted Answer

Committed Use Discounts provide discounted pricing for predictable workloads with specific resource commitments.

Accepted Answer

Subaccounts let you group a set of projects' charges into separate sections of the invoice, useful for resellers or BUs.

Answer

Subaccounts merge every linked project onto one single line item so that per-project charges can no longer be separated.

Answer

Labels must be applied at the billing-account level only and cannot be attached to individual project resources.

Question 14

A platform team is designing access control for several internal HTTPS web apps and must decide between relying on network-level firewalls and adopting Identity-Aware Proxy. According to the Identity-Aware Proxy overview, what does IAP let the team establish?

Accepted Answer

A central authorization layer for HTTPS applications, enabling an application-level access control model instead of network-level firewalls.

Answer

A network-level firewall tier that inspects packets at the VPC perimeter and is meant to fully replace any application-level authorization checks.

Answer

A managed VPN gateway that encrypts inter-region traffic so that application owners no longer have to define any access policies at all.

Answer

A dedicated Cloud Armor policy that rate-limits requests per source IP, giving the same guarantees as application-level authorization.

Question 15

An engineer is being asked the following question. A platform engineer is being asked to justify which Compute Engine discount to apply to a steady-state web tier that runs the same VM shapes 24x7 in one region. Which statement matches the documented use case for resource-based committed use discounts (CUDs)?

Accepted Answer

These CUDs are ideal for predictable and steady state resource usage. This is the documented behavior in the canonical Google Cloud reference for this product. This statement appears verbatim in the linked Google Cloud documentation page.

Answer

Resource-based committed use discounts are intended only for short-lived development workloads under 30 minutes of total runtime and never apply when the same VM shape runs around the clock in a region throughout the commitment term.

Answer

Resource-based committed use discounts apply only to preemptible VMs in a region and explicitly cannot be combined with any standard on-demand VM running the same machine type in the same region during the commitment term.

Answer

Resource-based committed use discounts apply only to Cloud Run requests and explicitly cannot be used to reduce the cost of any Compute Engine virtual machine usage in any region for the entire commitment term length.

Google Cloud Associate Cloud Engineer

Sample questions

Sources

Similar exams