This is the free Google Associate Cloud Engineer practice question bank —
170 of 323 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-10-13.
Every answer is verified against official Google documentation —
see our methodology.
Question 1
Your customer has implemented a solution that uses Cloud Spanner and notices some read latency-related performance issues on one table. This table is accessed only by their users using a primary key. The table schema is shown below.
You want to resolve the issue. What should you do?
A. Remove the profile_picture field from the table.
B. Add a secondary index on the person_id column.
C. Change the primary key to not have monotonically increasing values.
D. Create a secondary index using the following Data Definition Language (DDL):
Show Answer
Correct Answer: C
Explanation: The primary key is a sequential, monotonically increasing ID. In Cloud Spanner, this can concentrate activity on the end of the key range and create hotspots, which can hurt performance. Use a key design that distributes values across the key space. A secondary index on person_id is redundant because the primary key is already indexed; an index on other columns would not help primary-key lookups.
Question 1
You need to set up a policy so that videos stored in a specific Cloud Storage Regional bucket are moved to Coldline after 90 days, and then deleted after one year from their creation. How should you set up the policy?
A. Use Cloud Storage Object Lifecycle Management using Age conditions with SetStorageClass and Delete actions. Set the SetStorageClass action to 90 days and the Delete action to 275 days (365 ג€" 90)
B. Use Cloud Storage Object Lifecycle Management using Age conditions with SetStorageClass and Delete actions. Set the SetStorageClass action to 90 days and the Delete action to 365 days.
C. Use gsutil rewrite and set the Delete action to 275 days (365-90).
D. Use gsutil rewrite and set the Delete action to 365 days.
Show Answer
Correct Answer: B
Explanation: Use Cloud Storage Object Lifecycle Management with an Age condition of 90 days to change the storage class to Coldline, and a separate Age condition of 365 days to delete the object. Age is measured from the object's creation time, and changing storage class through lifecycle management does not reset that time.
Question 1
You are managing your company's archival records that are stored in a Cloud Storage bucket using the Multi-Regional storage class. These objects are rarely accessed after 90 days but must be retained indefinitely to meet regulatory compliance requirements. You need to implement a cost-effective process that automatically transitions these objects to the lowest-cost storage class suitable for long-term retention immediately after the 90-day period. What should you do?
A. Enable Object Versioning on the bucket, and create an Object Lifecycle Management rule that sets the daysSinceNoncurrentTime condition to 90 days, transitioning noncurrent versions to Archive storage.
B. Create an Object Lifecycle Management rule on the bucket that specifies an age condition of 90 days and uses the SetStorageClass action to transition the objects to Archive storage.
C. Create a nightly scheduled Cloud Run function that uses the Cloud Storage API to change the storage class of all objects older than 90 days to Archive storage.
D. Create an Object Lifecycle Management rule on the bucket that specifies the createdBefore condition set to 90 days ago and uses the Delete action to remove the objects.
Show Answer
Correct Answer: B
Explanation: Use Cloud Storage Object Lifecycle Management with an age condition of 90 days and the SetStorageClass action to automatically transition objects to Archive storage. Archive is the lowest-cost storage class for long-term retention, and lifecycle rules are the managed, automated approach. Option A applies only to noncurrent object versions with versioning enabled, C unnecessarily requires custom code, and D deletes data, which violates the retention requirement.
Question 2
Your company has a 3-tier solution running on Compute Engine. The configuration of the current infrastructure is shown below.
Each tier has a service account that is associated with all instances within it. You need to enable communication on TCP port 8080 between tiers as follows:
* Instances in tier #1 must communicate with tier #2.
* Instances in tier #2 must communicate with tier #3.
What should you do?
A. 1. Create an ingress firewall rule with the following settings: ג€¢ Targets: all instances ג€¢ Source filter: IP ranges (with the range set to 10.0.2.0/24) ג€¢ Protocols: allow all 2. Create an ingress firewall rule with the following settings: ג€¢ Targets: all instances ג€¢ Source filter: IP ranges (with the range set to 10.0.1.0/24) ג€¢ Protocols: allow all
B. 1. Create an ingress firewall rule with the following settings: ג€¢ Targets: all instances with tier #2 service account ג€¢ Source filter: all instances with tier #1 service account ג€¢ Protocols: allow TCP:8080 2. Create an ingress firewall rule with the following settings: ג€¢ Targets: all instances with tier #3 service account ג€¢ Source filter: all instances with tier #2 service account ג€¢ Protocols: allow TCP: 8080
C. 1. Create an ingress firewall rule with the following settings: ג€¢ Targets: all instances with tier #2 service account ג€¢ Source filter: all instances with tier #1 service account ג€¢ Protocols: allow all 2. Create an ingress firewall rule with the following settings: ג€¢ Targets: all instances with tier #3 service account ג€¢ Source filter: all instances with tier #2 service account ג€¢ Protocols: allow all
D. 1. Create an egress firewall rule with the following settings: ג€¢ Targets: all instances ג€¢ Source filter: IP ranges (with the range set to 10.0.2.0/24) ג€¢ Protocols: allow TCP: 8080 2. Create an egress firewall rule with the following settings: ג€¢ Targets: all instances ג€¢ Source filter: IP ranges (with the range set to 10.0.1.0/24) ג€¢ Protocols: allow TCP: 8080
Show Answer
Correct Answer: B
Explanation: Create ingress rules on tier #2 and tier #3, targeting each tier’s service account and using the preceding tier’s service account as the source. Allow only TCP port 8080, so only the required tier-to-tier traffic is permitted.
Question 2
You are deploying an application to a Compute Engine VM in a managed instance group. The application must be running at all times, but only a single instance of the VM should run per GCP project. How should you configure the instance group?
A. Set autoscaling to On, set the minimum number of instances to 1, and then set the maximum number of instances to 1.
B. Set autoscaling to Off, set the minimum number of instances to 1, and then set the maximum number of instances to 1.
C. Set autoscaling to On, set the minimum number of instances to 1, and then set the maximum number of instances to 2.
D. Set autoscaling to Off, set the minimum number of instances to 1, and then set the maximum number of instances to 2.
Show Answer
Correct Answer: A
Explanation: Enable autoscaling with both the minimum and maximum set to 1. The group is constrained to one instance, while the minimum size of 1 lets the autoscaler restore the group to that size if it falls below the minimum. A single VM cannot guarantee uninterrupted service during replacement, so true continuous availability would require redundancy.
Question 2
You are responsible for Google Cloud governance at your company and recently implemented a new, automated process for provisioning Google Cloud projects. You have discovered several projects that were manually created before the implementation of this new process. You need to identify the creators of these projects to inform them of the new process. What should you do?
A. Review the value of the creator label attached to the project to find the project’s creator.
B. Use Resource Manager to identify the responsible department from the folder and project hierarchy.
C. Review the Cloud Billing account linked to the project, and then contact the owner of that billing account.
D. Use the IAM page in the Google Cloud console to identify the user with the Owner role.
Show Answer
Correct Answer: D
Explanation: Projects do not automatically have a creator label, folder hierarchy identifies organizational placement rather than the individual creator, and the Cloud Billing account owner is not necessarily the project creator. The IAM policy on a manually created project typically includes the user who created it with the Owner role (especially for older manually created projects), making the IAM page the best way to identify whom to contact.
Question 3
You created an instance of SQL Server 2017 on Compute Engine to test features in the new version. You want to connect to this instance using the fewest number of steps. What should you do?
A. Install a RDP client on your desktop. Verify that a firewall rule for port 3389 exists.
B. Install a RDP client in your desktop. Set a Windows username and password in the GCP Console. Use the credentials to log in to the instance.
C. Set a Windows password in the GCP Console. Verify that a firewall rule for port 22 exists. Click the RDP button in the GCP Console and supply the credentials to log in.
D. Set a Windows username and password in the GCP Console. Verify that a firewall rule for port 3389 exists. Click the RDP button in the GCP Console, and supply the credentials to log in.
Show Answer
Correct Answer: B
Explanation: Connecting to the Windows VM requires an RDP client and Windows login credentials. The Google Cloud Console’s RDP button does not provide a browser-based session where you can enter those credentials. Port 3389 is typically allowed by the default Windows VM firewall rule, so checking it is not an additional required step.
Question 3
You are building a pipeline to process time-series data. Which Google Cloud Platform services should you put in boxes 1,2,3, and 4?
A. Cloud Pub/Sub, Cloud Dataflow, Cloud Datastore, BigQuery
B. Firebase Messages, Cloud Pub/Sub, Cloud Spanner, BigQuery
C. Cloud Pub/Sub, Cloud Storage, BigQuery, Cloud Bigtable
D. Cloud Pub/Sub, Cloud Dataflow, Cloud Bigtable, BigQuery
Show Answer
Correct Answer: D
Explanation: Cloud Pub/Sub ingests the incoming time-series data, and Cloud Dataflow processes the stream. Cloud Bigtable is suited to storing large-scale time-series data, while BigQuery supports analytics.
Question 3
You manage IAM policies for your organization’s Google Cloud project. A new operations team needs the capability to start, stop, and reset existing Compute Engine VM instances within this project for basic troubleshooting. Due to strict security requirements, the operations team must be prevented from deleting any instances or modifying any networking or configuration settings. You need to grant the minimum necessary permissions to the team members. What should you do?
A. Grant the operations team the roles/writer IAM role, and add the resource.type =='compute.googleapis.com/Instance' condition to the role.
B. Grant the operations team the predefined roles/compute.instanceAdmin.v1 IAM role on the project. Apply an IAM condition to exclude the compute.instances.delete permission.
C. Create a custom IAM role that includes only the compute.instances.start, compute.instances.stop, and compute.instances.reset permissions. Assign this role to the operations team on the project.
D. Grant the operations team the predefined roles/compute.viewer IAM role to allow them to view the instances. Instruct them to use the Google Cloud Console’s basic actions such as starting, stopping, and resetting.
Show Answer
Correct Answer: C
Explanation: The principle of least privilege requires granting only the permissions needed: compute.instances.start, compute.instances.stop, and compute.instances.reset. A custom IAM role containing just these permissions allows basic VM lifecycle troubleshooting without permitting deletion, instance reconfiguration, or networking changes. The predefined Compute Instance Admin role is too broad, IAM Conditions cannot selectively remove individual permissions from a role, the Writer role is overly permissive, and the Viewer role does not allow start/stop/reset actions.
Question 4
You deployed a new application inside your Google Kubernetes Engine cluster using the YAML file specified below.
You check the status of the deployed pods and notice that one of them is still in PENDING status:
You want to find out why the pod is stuck in pending status. What should you do?
A. Review details of the myapp-service Service object and check for error messages.
B. Review details of the myapp-deployment Deployment object and check for error messages.
C. Review details of myapp-deployment-58ddbbb995-lp86m Pod and check for warning messages.
D. View logs of the container in myapp-deployment-58ddbbb995-lp86m pod and check for warning messages.
Show Answer
Correct Answer: C
Explanation: Describe the pending Pod and review its status, events, and warning messages. These often reveal why it cannot be scheduled, such as insufficient resources or scheduling constraints. Container logs are generally not available when the container has not started.
$19
Get all 323 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
