This is the free Google Associate Cloud Engineer practice question bank —
170 of 323 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-08-06.
Every answer is verified against official Google documentation —
see our methodology.
Question 1
You are managing your company's archival records that are stored in a Cloud Storage bucket using the Multi-Regional storage class. These objects are rarely accessed after 90 days but must be retained indefinitely to meet regulatory compliance requirements. You need to implement a cost-effective process that automatically transitions these objects to the lowest-cost storage class suitable for long-term retention immediately after the 90-day period. What should you do?
A. Enable Object Versioning on the bucket, and create an Object Lifecycle Management rule that sets the daysSinceNoncurrentTime condition to 90 days, transitioning noncurrent versions to Archive storage.
B. Create an Object Lifecycle Management rule on the bucket that specifies an age condition of 90 days and uses the SetStorageClass action to transition the objects to Archive storage.
C. Create a nightly scheduled Cloud Run function that uses the Cloud Storage API to change the storage class of all objects older than 90 days to Archive storage.
D. Create an Object Lifecycle Management rule on the bucket that specifies the createdBefore condition set to 90 days ago and uses the Delete action to remove the objects.
Show Answer
Correct Answer: B
Explanation: Use Cloud Storage Object Lifecycle Management with an age condition of 90 days and the SetStorageClass action to automatically transition objects to Archive storage. Archive is the lowest-cost storage class for long-term retention, and lifecycle rules are the managed, automated approach. Option A applies only to noncurrent object versions with versioning enabled, C unnecessarily requires custom code, and D deletes data, which violates the retention requirement.
Question 2
You are responsible for Google Cloud governance at your company and recently implemented a new, automated process for provisioning Google Cloud projects. You have discovered several projects that were manually created before the implementation of this new process. You need to identify the creators of these projects to inform them of the new process. What should you do?
A. Review the value of the creator label attached to the project to find the project’s creator.
B. Use Resource Manager to identify the responsible department from the folder and project hierarchy.
C. Review the Cloud Billing account linked to the project, and then contact the owner of that billing account.
D. Use the IAM page in the Google Cloud console to identify the user with the Owner role.
Show Answer
Correct Answer: D
Explanation: Projects do not automatically have a creator label, folder hierarchy identifies organizational placement rather than the individual creator, and the Cloud Billing account owner is not necessarily the project creator. The IAM policy on a manually created project typically includes the user who created it with the Owner role (especially for older manually created projects), making the IAM page the best way to identify whom to contact.
Question 3
You manage IAM policies for your organization’s Google Cloud project. A new operations team needs the capability to start, stop, and reset existing Compute Engine VM instances within this project for basic troubleshooting. Due to strict security requirements, the operations team must be prevented from deleting any instances or modifying any networking or configuration settings. You need to grant the minimum necessary permissions to the team members. What should you do?
A. Grant the operations team the roles/writer IAM role, and add the resource.type =='compute.googleapis.com/Instance' condition to the role.
B. Grant the operations team the predefined roles/compute.instanceAdmin.v1 IAM role on the project. Apply an IAM condition to exclude the compute.instances.delete permission.
C. Create a custom IAM role that includes only the compute.instances.start, compute.instances.stop, and compute.instances.reset permissions. Assign this role to the operations team on the project.
D. Grant the operations team the predefined roles/compute.viewer IAM role to allow them to view the instances. Instruct them to use the Google Cloud Console’s basic actions such as starting, stopping, and resetting.
Show Answer
Correct Answer: C
Explanation: The principle of least privilege requires granting only the permissions needed: compute.instances.start, compute.instances.stop, and compute.instances.reset. A custom IAM role containing just these permissions allows basic VM lifecycle troubleshooting without permitting deletion, instance reconfiguration, or networking changes. The predefined Compute Instance Admin role is too broad, IAM Conditions cannot selectively remove individual permissions from a role, the Writer role is overly permissive, and the Viewer role does not allow start/stop/reset actions.
Question 4
You are managing resources in a Google Cloud project. A new service account needs the ability to invoke a Cloud Run service. You need to gain the permissions to modify IAM policies for service accounts while adhering to the principle of least privilege. What should you do?
A. Request the roles/iam.serviceAccountAdmin role for your user account.
B. Request the roles/run.invoker role for your user account.
C. Request the Editor role for your user account.
D. Request the Owner role for your user account.
Show Answer
Correct Answer: A
Explanation: To grant a service account the ability to invoke a Cloud Run service, you need to modify IAM bindings. Among the options, the least-privilege role that provides administrative control over service accounts is roles/iam.serviceAccountAdmin. The Run Invoker role only allows invoking Cloud Run services and does not grant permission to manage IAM policies. Editor and Owner are overly broad and violate the principle of least privilege.
Question 5
You are managing logging for your organization by aggregating logs into a centralized Google Cloud project. The aggregated logs come from two source projects: one for a frontend application and one for a backend application. You need to grant the frontend development team access to view all logs originating from the frontend project and only error-level logs from the backend project. The team must not be able to view any other logs. You want to follow the principle of least privilege and develop a cost-efficient solution. What should you do?
A. • In the centralized logging project, craft a query that combines all logs from the frontend project and error-level logs from the backend project, and grant the logging.viewer IAM role. • Save and share this query with the frontend team for them to use in the Logs Explorer. • Request the frontend team not to use any other query.
B. • Create two separate log sinks in the centralized project. • Configure one sink to route all frontend logs to a new, dedicated Cloud Storage bucket. • Configure a second sink to route only the error-level logs from the backend project to that same bucket. • Grant the frontend team read-only access to this bucket.
C. • Grant the frontend team the logging.viewer IAM role on both the frontend project and the backend project. • Instruct the developers to use a specific filter in the Logs Explorer to find the logs they need.
D. • In the centralized logging project, create a log view on the bucket that contains the aggregated logs. • Filter the view to include all logs from the frontend project and only logs with a severity level of ERROR from the backend project. • Grant the frontend team the logging.viewAccessor IAM role on this specific view.
Show Answer
Correct Answer: D
Explanation: Log views on Cloud Logging buckets allow you to restrict visibility to a filtered subset of logs. By creating a log view that includes all logs from the frontend project and only ERROR-severity logs from the backend project, then granting the frontend team the logging.viewAccessor role on that view, you enforce least privilege. The other options rely on user compliance, overgrant access, or introduce unnecessary routing and Cloud Storage complexity.
Question 6
You are troubleshooting a complex application failure. You found several cryptic error messages containing no personally identifiable information (PII) in Cloud Logging that you do not recognize. You need to understand the meaning of these logs and determine what actions to take as quickly as possible. What should you do first?
A. Manually copy the error messages, and search for them in public forums and documentation.
B. Use Cloud Profiler to analyze the application’s performance during the time of the errors.
C. Use the “Explain this log entry” feature in Logs Explorer, and start a conversation with Gemini.
D. Search the application source code to determine the cause of the errors.
Show Answer
Correct Answer: C
Explanation: The fastest first step is to use the Logs Explorer 'Explain this log entry' feature with Gemini. It is designed to interpret unfamiliar log messages, explain likely causes, and suggest troubleshooting actions directly from Cloud Logging. The prompt notes the logs contain no PII, aligning with using this AI-assisted feature. Cloud Profiler analyzes performance rather than explaining log errors, manually searching is slower, and inspecting source code is better after understanding the error context.
Question 7
You work for a large company that recently acquired three smaller startups. All of the startups’ Google Cloud resources must be centrally managed under a single Google Cloud organization. However, each startup has its own budget and financial reporting structure. You need to ensure that each startup receives a separate monthly invoice for its Google Cloud consumption. What should you do?
A. Create a Google Cloud organization with a folder for each startup. Share a single Cloud Billing account, and use the detailed billing export to allocate costs.
B. Create a Google Cloud organization with a folder for each startup. Configure each startup to have its own Cloud Billing account.
C. Create a Google Cloud organization for each startup. Configure each startup to have its own Cloud Billing account.
D. Create a Google Cloud organization for each startup. Share a single Cloud Billing account, and use the detailed billing export to allocate costs.
Show Answer
Correct Answer: B
Explanation: A single Google Cloud organization can contain folders for each startup, satisfying the requirement for centralized management. Separate Cloud Billing accounts allow each startup to receive its own monthly invoice while remaining under the same organization. Multiple organizations would violate the requirement for a single organization, and a shared billing account would not produce separate invoices.
Question 8
You are managing Google Cloud infrastructure with Terraform. The Terraform configuration files are stored in a Git repository. You need to implement a solution that enables multiple team members to work on the Terraform configurations concurrently without conflicts and ensures that sensitive values are not persisted to local machines. What should you do?
A. Configure a local backend in Terraform, and deploy all changes by using a shared account on a bastion server.
B. Configure a Cloud Storage backend in Terraform.
C. Configure a local backend in Terraform, and store the state file in a Git repository.
D. Configure a local backend in Terraform, and manually share the Terraform state file with team members after every change.
Show Answer
Correct Answer: B
Explanation: A remote Cloud Storage backend centralizes Terraform state, supports state locking (when configured with GCS-supported mechanisms in modern Terraform), enables safe collaboration among multiple team members, and keeps sensitive state data off local machines. Local backends, Git-stored state, or manually shared state files are not appropriate for concurrent collaborative workflows and risk conflicts and exposure of sensitive values.
Question 9
Your organization has created hundreds of service accounts for different applications hosted on-premises and in other clouds that use Google Cloud APIs. You need to audit the service account keys that have been created and identify the keys that are older than 90 days.
What should you do?
A. Execute the gcloud asset search-all-resources --scope="organizations/[ORG_ID]" --query="createTime < [DATE_90_DAYS_AGO]" --asset-types="apikeys.googleapis.com/Key" --order-by="createTime" command.
B. Execute the gcloud iam service-accounts list --filter="createTime < [DATE_90_DAYS_AGO]" command.
C. Execute the gcloud tans keys list --filter="createTime < [DATE_90_DAYS_AGO]" command.
D. Execute the gcloud asset search-all-resources --scope="organizations/[ORG_ID]" --query="createTime < [DATE_90_DAYS_AGO]" --asset-types="iam.googleapis.com/ServiceAccountKey" --order-by="createTime" command.
Show Answer
Correct Answer: D
Explanation: To audit service account keys across an organization and identify keys older than 90 days, use Cloud Asset Inventory to search ServiceAccountKey assets. The asset type for service account keys is iam.googleapis.com/ServiceAccountKey, and filtering on createTime identifies older keys. The other options either target API keys, list service accounts rather than keys, or use an invalid command.
Question 10
You are deploying a new internal web application behind an internal Application Load Balancer. The application must be accessible from both the VPC network and on-premises network using the domain name internal.altostrat.com. This name must not be resolvable from the public internet. Your on-premises network is connected to the VPC network by using Cloud VPN, and you have configured an inbound server policy. You need to resolve the domain name with the least administrative overhead. What should you do?
A. Create an A record on the on-premises DNS server that points to the load balancer’s IP address.
B. Create a Cloud DNS managed private zone, authorize the VPC network to use it, and add an A record that points to the load balancer’s IP address.
C. Create a Cloud DNS managed public zone, and add an A record that points to the load balancer’s IP address.
D. On each employee’s workstation, edit the local HOSTS file to map the domain name to the load balancer’s IP address.
Show Answer
Correct Answer: B
Explanation: A Cloud DNS private managed zone authorized for the VPC allows the internal name to resolve only within the authorized network. With an inbound server policy already configured, on-premises DNS clients can resolve records in the private zone over the Cloud VPN. This keeps the name private and minimizes administrative overhead. A requires manual DNS management on-premises only, C exposes the name publicly, and D is not scalable.
$19
Get all 323 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.