ASSOCIATE-CLOUD-ENGINEER Real Exam Questions and Verified Answers

Question 1 Single choice

You want to configure an SSH connection to a single Compute Engine instance for users in the dev1 group. This instance is the only resource in this particular Google Cloud Platform project that the dev1 users should be able to connect to.

What should you do?

A
Set metadata to enable-oslogin=true for the instance. Grant the dev1 group the compute.osLogin role.
Direct them to use the Cloud Shell to ssh to that instance.
B
Set metadata to enable-oslogin=true for the instance. Set the service account to no service account for that instance. Direct them to use the Cloud Shell to ssh to that instance.
C
Enable block project wide keys for the instance. Generate an SSH key for each user in the dev1 group.
Distribute the keys to dev1 users and direct them to use their third-party tools to connect.
D
Enable block project wide keys for the instance. Generate an SSH key and associate the key with that instance. Distribute the key to dev1 users and direct them to use their third-party tools to connect.

Show answer and explanation

Correct answer: A

Explanation

Set enable-oslogin=true in the instance metadata, grant the dev1 group the compute.osLogin role for the instance, and have members connect through Cloud Shell. Instance-level OS Login activation and IAM scope confine SSH authorization to this VM. Shared private keys would weaken per-user control, and removing the VM service account would not grant users SSH access.

Question 2 Single choice

You have an autoscaled managed instance group that is set to scale based on CPU utilization of 60%.
There are currently 3 instances in the instance group. You're connected to one of the instances and notice that the CPU usage is a 70%.
However, the instance group isn't starting up another instance.

What's the most likely reason?

A
The autoscaler is disabled.
B
The autoscaler takes 60 seconds before creating a new instance.
C
The load balancer doesn't recognize the instance as healthy.
D
The average CPU for the entire instance group is below 60%.

Show answer and explanation

Correct answer: D

Explanation

CPU-based autoscaling evaluates utilization across the managed instance group, not one observed instance in isolation. One VM running at 70% does not require a scale-out when the other two VMs make the group's average CPU utilization remain below the 60% target. The group therefore has no CPU-based reason to add an instance.

Question 3 Single choice

You are deploying a large, multi-tiered application with more than 1,000 IP addresses in a Google Cloud project that needs to be securely isolated. The application includes the:

1. web tier with frontend servers for public traffic,
2. application tier with servers running core application logic that only need access from the web tier, and
3. database tier with database servers that only need access from the application tier.

You want to minimize cost, complexity, and administrative overhead in the network architecture.

What should you do?

A
Create a /24 Shared VPC with separate subnets for each tier. Use firewall rules that reference network tags to control traffic.
B
Create one custom mode /16 VPC with three subnets. Place each tier in its own subnet and use firewall rules that reference IP subnets to control traffic.
C
Deploy each tier into a separate custom mode /16 VPC. Use VPC Network Peering to securely connect each custom mode VPC. Manage firewall rules individually in each VPC.
D
Deploy each tier in a /24 VPC by using network tags to identify instances. Implement firewall rules for fine-grained network segmentation.

Show answer and explanation

Correct answer: B

Explanation

One custom mode /16 VPC supplies enough address space for more than 1,000 addresses without the overhead of maintaining and peering multiple VPCs. Place the web, application, and database tiers in three separate subnets. Firewall rules referencing those IP subnets can then permit web-to-application and application-to-database traffic while blocking unneeded paths.

Question 4 Single choice

You need to host an application on a Compute Engine instance in a project shared with other teams. You want to prevent the other teams from accidentally causing downtime on that application.

Which feature should you use?

A
Use a Shielded VM.
B
Use a Preemptible VM.
C
Use a sole-tenant node.
D
Enable deletion protection on the instance.

Show answer and explanation

Correct answer: D

Explanation

Enable deletion protection on the instance to block accidental deletion of the VM hosting the production application. This directly addresses a common action that would cause downtime in a shared project. Shielded VM protects boot integrity, sole tenancy controls host placement, and preemptibility would increase interruption risk.

Question 5 Multiple choice

You need to create and manage service accounts for your workloads running on Google Cloud. You want to follow Google-recommended practices.

What should you do? (Choose two.)

A
Create as few service accounts as possible.
B
Delete any unused service accounts immediately.
C
Create single-purpose service accounts.
D
Manage service accounts as resources.
E
Use random names for the service accounts.

Show answer and explanation

Correct answers: C, D

Explanation

Single-purpose service accounts isolate workload identities and permissions, making least-privilege grants and impact analysis easier than sharing one identity across unrelated workloads. Managing service accounts as resources means applying IAM controls, ownership, and lifecycle practices to each account itself. Together, these practices make access easier to review and maintain.

Question 6 Single choice

You need to verify that a Google Cloud Platform service account was created at a particular time.

What should you do?

A
Filter the Activity log to view the Configuration category. Filter the Resource type to Service Account.
B
Filter the Activity log to view the Configuration category. Filter the Resource type to Google Project.
C
Filter the Activity log to view the Data Access category. Filter the Resource type to Service Account.
D
Filter the Activity log to view the Data Access category. Filter the Resource type to Google Project.

Show answer and explanation

Correct answer: A

Explanation

Service account creation is a resource configuration change. Filter the Activity log to view the Configuration category, then filter the Resource type to Service Account. This narrows the records to administrative changes involving service accounts, where the creation event and its timestamp can be verified.

Question 7 Single choice

Your company has multiple projects linked to a single billing account in Google Cloud. You need to visualize the costs with specific metrics that should be dynamically calculated based on company-specific criteria. You want to automate the process.

What should you do?

A
In the Google Cloud console, visualize the costs related to the projects in the Reports section.
B
In the Google Cloud console, visualize the costs related to the projects in the Cost breakdown section.
C
In the Google Cloud console, use the export functionality of the Cost table. Create a Looker Studiodashboard on top of the CSV export.
D
Configure Cloud Billing data export to BigOuery for the billing account. Create a Looker Studio dashboard on top of the BigOuery export.

Show answer and explanation

Correct answer: D

Explanation

Configure Cloud Billing data export to BigQuery for the shared billing account, then build the Looker Studio dashboard over that export. The recurring export supplies structured billing records across the linked projects, while BigQuery can calculate company-specific metrics dynamically without repeated manual CSV exports.

Question 8 Single choice

You received a JSON file that contained a private key of a Service Account in order to get access to several resources in a Google Cloud project. You downloaded and installed the Cloud SDK and want to use this private key for authentication and authorization when performing gcloud commands.

What should you do?

A
Use the command gcloud auth login and point it to the private key.
B
Use the command gcloud auth activate-service-account and point it to the private key.
C
Place the private key file in the installation directory of the Cloud SDK and rename it to
"credentials.json".
D
Place the private key file in your home directory and rename it to
"GOOGLE_APPLICATION_CREDENTIALS".

Show answer and explanation

Correct answer: B

Explanation

The private key belongs to a service account, so the CLI must activate that service account identity rather than start an interactive user login. Use gcloud auth activate-service-account and point the command to the private key file. Renaming or relocating the file does not itself load the credentials into gcloud, and GOOGLE_APPLICATION_CREDENTIALS is an environment variable name rather than a key filename.

Question 9 Single choice

You have a 20 GB file that you need to securely share with some contractors. They need it as fast as possible.

Which steps would get them the file quickly and securely?

A
Using composite objects and parallel uploads to upload the file to Cloud Storage quickly. Then generate a signed URL and securely share it with the contractors.
B
Set up a VPC with a custom subnet. Create a subnet tunnel. Upload the file to a network share. Grant the contractors temporary access.
C
Upload the file to Bigtable using the bulk data import tool. Then provide the contractors with read access to the database.
D
Upload the file to Cloud Storage. Grant the allAuthenticated users token view permissions.

Show answer and explanation

Correct answer: A

Explanation

Parallel uploads split the large transfer into concurrent work, and composite objects combine the uploaded components in Cloud Storage, reducing the time needed to place the 20 GB file. After upload, a signed URL grants contractors controlled access to that specific object without assigning broad bucket or database permissions.

Question 10 Single choice

The storage costs for your application logs have far exceeded the project budget. The logs are currently being retained indefinitely in the Cloud Storage bucket myapp-gcp-ace-logs. You have been asked to remove logs older than 90 days from your Cloud Storage bucket. You want to optimize ongoing Cloud Storage spend.

What should you do?

A
Write a script that runs gsutil Is -| gs://myapp-gcp-ace-logs/** to find and remove items older than 90
days. Schedule the script with cron.
B
Write a lifecycle management rule in JSON and push it to the bucket with gsutil lifecycle set config-
json-file.
C
Write a lifecycle management rule in XML and push it to the bucket with gsutil lifecycle set config-xml-file.
D
Write a script that runs gsutil Is -Ir gs://myapp-gcp-ace-logs/** to find and remove items older than 90 days. Repeat this process every morning.

Show answer and explanation

Correct answer: B

Explanation

A bucket lifecycle rule applies the age-based deletion policy automatically as objects become older than 90 days. Defining the rule in JSON and applying it with gsutil lifecycle set makes retention an ongoing bucket policy, eliminating the maintenance and failure risk of repeatedly listing and deleting objects with a custom script.