Google ASSOCIATE-CLOUD-ENGINEER Online Practice Questions and Exam Preparation

Google ASSOCIATE-CLOUD-ENGINEER Online Questions & Answers

• Question 1:

  You need to create and manage service accounts for your workloads running on Google Cloud. You want to follow Google-recommended practices. What should you do? (Choose two.)

  A. Create as few service accounts as possible.
  B. Delete any unused service accounts immediately.
  C. Create single-purpose service accounts.
  D. Manage service accounts as resources.
  E. Use random names for the service accounts.
  C. Create single-purpose service accounts.
  D. Manage service accounts as resources.

  ---

  explanation:

  Explanation

  Create single-purpose service accounts.

  Google recommends giving each workload its own service account (rather than sharing one account among many workloads). This ensures that you can grant each service account exactly the permissions it needs (and no more), and makes

  it easier to audit or revoke permissions for any one function.

  Manage service accounts as resources.

  Treat service accounts the same way you treat other GCP resources - track them in IAM policies, apply labels, automate their creation/deletion in Infrastructure-as-Code, and regularly review their roles. In other words, don't let service

  accounts "just sit there"; include them in your normal resource-management and auditing processes.

• Question 2:

  Your company uses Pub/Sub for event-driven workloads. You have a subscription named email-updates attached to the new-orders topic. You need to fetch and acknowledge waiting messages from this subscription. What should you do?

  A. Use the gcloud pubsub subscriptions seek email-updates command.
  B. Use the gcloud pubsub topics describe new-orders command.
  C. Use the gcloud pubsub subscriptions pull email-updates --auto-ack command.
  D. Use the gcloud pubsub topics list-subscriptions new-orders --filter="email- command.updates"
  C. Use the gcloud pubsub subscriptions pull email-updates --auto-ack command.

  ---

  explanation:

  Explanation

  The subscriptions pull command actually retrieves (pulls) any pending messages on the specified subscription. Adding --auto-ack causes each message to be acknowledged immediately upon retrieval, removing it from the subscription's backlog.

• Question 3:

  You are developing an internet of things (IoT) application that captures sensor data from multiple devices that have already been set up. You need to identify the global data storage product your company should use to store this data. You must ensure that the storage solution you choose meets your requirements of sub-millisecond latency. What should you do?

  A. Store the IoT data in Spanner. Use caches to speed up the process and avoid latencies.
  B. Store the IoT data in Bigtable.
  C. Capture IoT data in BigQuery datasets.
  D. Store the IoT data in Cloud Storage. Implement caching by using Cloud CDN.
  B. Store the IoT data in Bigtable.

  ---

  explanation:

  Explanation

  Cloud Bigtable is designed for high-throughput, low-latency workloads like IoT data ingestion. It offers sub- millisecond latency for reads and writes, making it ideal for time-series data such as sensor outputs. It's a NoSQL wide-column database, optimized for scalability and performance across massive datasets.

• Question 4:

  You are implementing a company-wide standard to control SSH access for your Google Cloud projects. You want to simplify SSH access management to your Compute Engine instances while maintaining audit compliance and eliminating as many manual steps as possible. What should you do?

  A. Configure a service account to add SSH keys for all VMs.
  B. Configure metadata SSH keys to manage sudo access to instances.
  C. Enable OS Login by using an organization policy for each Google Cloud project.
  D. Enable OS Login with two-factor authentication for the domain.
  C. Enable OS Login by using an organization policy for each Google Cloud project.

  ---

  explanation:

  Explanation

  OS Login centralizes SSH access management by using IAM roles instead of manually managed SSH keys. It simplifies and standardizes access across all Compute Engine instances. Applying OS Login via an organization policy ensures consistent enforcement across all projects, reducing manual configuration and enhancing audit compliance. This approach allows fine-grained control, logging, and the use of identity-based access without needing to distribute or rotate SSH keys manually.

• Question 5:

  Your digital media company stores a large number of video files on-premises. Each video file ranges from 100 MB to 100 GB. You are currently storing 150 TB of video data in your on-premises network, with no room for expansion. You need to migrate all infrequently accessed video files older than one year to Cloud Storage to ensure that on-premises storage remains available for new files. You must also minimize costs and control bandwidth usage. What should you do?

  A. Use Storage Transfer Service to move the data from the selected on-premises file storage systems to a Cloud Storage bucket.
  B. Use Transfer Appliance to request an appliance. Load the data locally, and ship the appliance back to Google for ingestion into Cloud Storage.
  C. Set up a Cloud Interconnect connection between the on-premises network and Google Cloud. Establish a private endpoint for Filestore access. Transfer the data from the existing Network File System (NFS) to Filestore.
  D. Create a Cloud Storage bucket. Establish an Identity and Access Management (IAM) role with write permissions to the bucket. Use the gsutil tool to directly copy files over the network to Cloud Storage.
  B. Use Transfer Appliance to request an appliance. Load the data locally, and ship the appliance back to Google for ingestion into Cloud Storage.

  ---

  explanation:

  Explanation

  Transfer Appliance is the ideal Google Cloud solution for large-scale, infrequently accessed data migrations (like 150 TB of video files), especially when bandwidth is limited or must be controlled. It allows you to load data locally and physically ship the appliance back to Google, avoiding long transfer times and high bandwidth usage. This minimizes costs, prevents congestion on your network, and suits bulk archival migrations perfectly.

• Question 6:

  Your company runs a variety of applications and workloads on Google Cloud, and you are responsible for managing cloud costs. You need to identify a solution that enables you to perform detailed cost analysis. You also must be able to visualize the cost data in multiple ways on the same dashboard. What should you do?

  A. Use the cost breakdown report with the available filters from Cloud Billing to visualize the data.
  B. Enable the Cloud Billing export to BigQuery, and use Looker Studio to visualize the data.
  C. Run queries in Cloud Monitoring. Create dashboards to visualize the billing metrics.
  D. Enable Cloud Monitoring metrics export to BigQuery, and use Looker to visualize the data.
  B. Enable the Cloud Billing export to BigQuery, and use Looker Studio to visualize the data.

  ---

  explanation:

  Explanation

  Cloud Billing export to BigQuery allows you to perform detailed, granular analysis of your cost data by writing custom SQL queries. Looker Studio (formerly Data Studio) enables flexible, customizable dashboards, letting you visualize cost data in multiple ways (e.g., by project, service, labels). This combination is the Google-recommended solution for in-depth cost reporting and visualization.

• Question 7:

  You are managing a stateful application deployed on Google Kubernetes Engine (GKE) that can only have one replica. You recently discovered that the application becomes unstable at peak times. You have identified that the application needs more CPU than what has been configured in the manifest at these peak times. You want Kubernetes to allocate the application sufficient CPU resources during these peak times, while ensuring cost efficiency during off-peak periods. What should you do?

  A. Enable node auto-provisioning on the GKE cluster.
  B. Configure a Vertical Pod Autoscaler on the Deployment.
  C. Configure a Horizontal Pod Autoscaler on the Deployment.
  D. Enable cluster autoscaling on the GKE cluster.
  B. Configure a Vertical Pod Autoscaler on the Deployment.

  ---

  explanation:

  Explanation

  A Vertical Pod Autoscaler (VPA) automatically adjusts the CPU and memory requests and limits for a pod based on usage. This is ideal for stateful applications with a single replica, where scaling out horizontally is not possible. It ensures the pod gets more CPU during peak times and reverts to lower usage when idle, thus ensuring performance and cost-efficiency.

• Question 8:

  You ate managing an application deployed on Cloud Run. The development team has released a new version of the application. You want to deploy and redirect traffic to this new version of the application. To ensure traffic to the new version of the application is served with no startup time, you want to ensure that there are two idle instances available for incoming traffic before adjusting the traffic flow. You also want to minimize administrative overhead. What should you do?

  A. Ensure the checkbox "Serve this revision immediately" is unchecked when deploying the new revision. Before changing the traffic rules, use a traffic simulation tool to send load to the new revision.
  B. Configure service autoscaling and set the minimum number of instances to 2.
  C. Configure revision autoscaling for the new revision and set the minimum number of instances to 2.
  D. Configure revision autoscaling for the existing revision and set the minimum number of instances to 2.
  C. Configure revision autoscaling for the new revision and set the minimum number of instances to 2.

  ---

  explanation:

  Explanation

  In Cloud Run, setting the minimum number of instances ensures that a specified number of container instances are pre-warmed and ready to serve traffic immediately -- this removes cold start latency. You need to apply this setting specifically to the new revision before redirecting traffic, which ensures two idle instances are ready. This approach minimizes administrative overhead by using native autoscaling settings rather than manual traffic simulation.

• Question 9:

  You assist different engineering teams in deploying their infrastructure on Google Cloud. Your company has defined certain practices required for all workloads. You need to provide the engineering teams with a solution that enables teams to deploy their infrastructure independently without having to know all implementation details of the company's required practices. What should you do?

  A. Configure organization policies to enforce your company's required practices. Ask the teams to provision their infrastructure by using the Google Cloud console.
  B. Create a service account per team, and grant the service account the Project Editor role. Ask the teams to provision their infrastructure through the Google Cloud CLI (gcloud CL), while impersonating their dedicated service account.
  C. Write Terraform modules for each component that are compliant with the company's required practices, and ask teams to implement their infrastructure through these modules.
  D. Provide training for all engineering teams you work with to understand the company's required practices. Allow the engineering teams to provision the infrastructure to best meet their needs.
  C. Write Terraform modules for each component that are compliant with the company's required practices, and ask teams to implement their infrastructure through these modules.

  ---

  explanation:

  Explanation

  Terraform modules allow you to codify and encapsulate company-required practices (e.g., naming conventions, tagging, security settings) in reusable components. Teams can deploy infrastructure independently without needing to understand or implement the underlying compliance logic, improving standardization and security. This approach is scalable, automated, and aligns with Infrastructure as Code (IaC) best practices.

• Question 10:

  You are planning to migrate your on-premises VMs to Google Cloud. You need to set up a landing zone in Google Cloud before migrating the VMs. You must ensure that all VM in your production environment can communicate with each other through private IP addresses. You need to allow all VMs in your Google Cloud organization to accept connections on specific TCP ports. You want to follow Google-recommended practices, and you need to minimize your operational costs. What should you do?

  A. Create individual VPCs per Google Cloud project. Peer all he VPC together. Apply organization policies on the organization level.
  B. Create individual VPCs for each Google Cloud project. Peer ail ne VPCs together. Apply hierarchical firewall policies on the organization level.
  C. Create a host VPC project with each production project as its service project. Apply organization policies on the organization level.
  D. Create a host VPC project with each production project as its service project. Apply hierarchical firewall policies on the organization level.
  D. Create a host VPC project with each production project as its service project. Apply hierarchical firewall policies on the organization level.

  ---

  explanation:

  Explanation

  Shared VPC (host and service projects) is the Google-recommended practice for enabling centralized network management while allowing production workloads to run in separate projects. It enables VMs to communicate via private IPs across projects. Hierarchical firewall policies allow you to define and enforce organization-wide security rules (like allowing specific TCP ports) at the organization or folder level, minimizing repetitive configuration and improving security posture. This architecture is cost-effective and supports scalable, secure, and centralized operations.