This is the free Google Associate Cloud Engineer practice question bank —
160 of 314 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-04-24.
Every answer is verified against official Google documentation —
see our methodology.
Question 1
Your company wants to migrate your data from an on-premises relational database to Google Cloud. Your current database can no longer scale with respect to the growth of your users, and you expect the number of users to rapidly grow. You need to choose a relational database that allows you to globally scale while minimizing your management and administration efforts. You also want to follow Google-recommended practices. What should you do?
A. Use Cloud SQL.
B. Use Spanner.
C. Use Firestore.
D. Use BigQuery.
Show Answer
Correct Answer: B
Explanation: Cloud Spanner is a fully managed, globally distributed relational database that provides horizontal scaling, strong consistency, and minimal operational overhead. It is Google’s recommended solution for rapidly growing, mission‑critical relational workloads that need global scale.
Question 1
You are the Google Cloud systems administrator for your organization. User A reports that they received an error when attempting to access the Cloud SQL database in their Google Cloud project, while User B can access the database. You need to troubleshoot the issue for User A, while following Google-recommended practices. What should you do first?
A. Confirm that network firewall rules are not blocking traffic for User
B. Verify that User A has the Identity and Access Management (IAM) Project Owner role assigned.
C. Review recent configuration changes that may have caused unintended modifications to permissions.
D. Review the error message that User A received.
Show Answer
Correct Answer: D
Explanation: Google-recommended troubleshooting starts with understanding the exact failure. Reviewing the specific error message User A received provides immediate insight into whether the issue is IAM permissions, network access, authentication, or configuration, and guides the next steps. Checking roles, firewall rules, or recent changes should be done after identifying what the error indicates.
Question 2
Your company is active in the European Economic Area (EEA), and will adopt Google Cloud for its workloads. Projects are currently structured within different folders. You need to ensure any resources that will be deployed are using Google Cloud locations within the EEA by using the Organization Policy Service resource locations constraint. What should you do?
A. Configure the policy at the folder level, and add all allowed locations to the policy.
B. Configure the policy at the organization level, and add all allowed locations to the policy.
C. Configure the policy at the folder level, and add all disallowed locations to the policy.
D. Configure the policy at the organization level, and add all disallowed locations to the policy.
Show Answer
Correct Answer: B
Explanation: Applying the resource locations constraint at the organization level ensures that all existing and future folders and projects inherit the restriction, preventing resource creation outside the EEA anywhere in the hierarchy. Defining allowed locations explicitly enforces compliance by permitting only EEA regions, providing centralized and consistent governance.
Question 3
You are writing a shell script that includes a few gcloud CLI commands to access some Google Cloud resources. You want to test the script in your local development environment with a service account in the most secure way. What should you do?
A. Generate an ID token for the service account. Use the token with the gcloud CLI commands.
B. Enable service account impersonation, and use the gcloud config set command to use it by default.
C. Download the service account key file and save it in a secure location. Set the GOOGLE_APPLICATION_CREDENTIALS environment variable to the key file.
D. Download the service account key file, and use it to generate an access token. Use the token with the gcloud CLI commands.
Show Answer
Correct Answer: B
Explanation: Service account impersonation is the most secure approach for local testing because it avoids creating and managing long‑lived service account keys. By impersonating the service account via gcloud, authentication uses short‑lived credentials tied to your user identity and IAM permissions. Downloading key files or manually handling tokens increases the risk of credential leakage, and ID tokens are not appropriate for general gcloud CLI access.
Question 4
Your company is closely monitoring their cloud spend. You need to allow different teams to monitor their Google Cloud costs. You must ensure that team members receive notifications when their cloud spend reaches certain thresholds and give team members the ability to create dashboards for additional insights with detailed billing data. You want to follow Google-recommended practices and minimize engineering costs. What should you do?
A. Deploy Grafana to Compute Engine. Create a dashboard for each team that uses the data from the Cloud Billing API. Ask each team to create their own alerts in Cloud Monitoring.
B. Set up alerts for each team based on required thresholds. Create a shell script to read data from the Cloud Billing API, and push the results to BigQuery. Grant team members access to BigQuery.
C. Deploy Grafana to Compute Engine. Create a dashboard for each team that uses the data from the Cloud Billing Budget API. Ask each team to create their own alerts in Grafana.
D. Set up alerts for each team based on required thresholds. Set up billing exports to BigQuery. Grant team members access to BigQuery.
Show Answer
Correct Answer: D
Explanation: Google-recommended best practice for cost monitoring is to use Cloud Billing Budgets and alerts for threshold notifications, and export detailed billing data to BigQuery for analysis. BigQuery billing export provides granular, queryable cost data with minimal engineering effort, and teams can build their own dashboards (for example with Looker Studio) without maintaining custom scripts or Grafana infrastructure. This minimizes operational overhead while meeting all requirements.
Question 5
Your company plans to migrate its on-premises PostgreSQL database to Google Cloud. The workloads are demanding, requiring fast transactional and analytical performance. You need to select a fully managed database service on Google Cloud. Your solution must also be able to synchronously replicate and optimize the storage layer. What should you do?
A. Migrate the database to Cloud SQL for PostgreSQL by using Database Migration Service.
B. Use the psql client installed on a Compute Engine instance. Connect to the Cloud SQL instance to perform the database migration.
C. Migrate the database to AlloyDB for PostgreSQL by using Database Migration Service.
D. Create a Compute Engine instance. Install and configure PostgreSQL on the instance, and migrate the database.
Show Answer
Correct Answer: C
Explanation: The requirements call for a fully managed PostgreSQL-compatible service with very high transactional and analytical performance, along with synchronous replication and an optimized storage layer. AlloyDB for PostgreSQL is designed specifically for these demanding workloads, offering a decoupled, highly optimized storage layer and synchronous replication. Database Migration Service natively supports migrating PostgreSQL into AlloyDB, making option C the best choice.
Question 6
You are deploying a large, multi-tiered application with more than 1,000 IP addresses in a Google Cloud project that needs to be securely isolated. The application includes the:
1. web tier with frontend servers for public traffic,
2. application tier with servers running core application logic that only need access from the web tier, and
3. database tier with database servers that only need access from the application tier.
You want to minimize cost, complexity, and administrative overhead in the network architecture. What should you do?
A. Create a /24 Shared VPC with separate subnets for each tier. Use firewall rules that reference network tags to control traffic.
B. Create one custom mode /16 VPC with three subnets. Place each tier in its own subnet and use firewall rules that reference IP subnets to control traffic.
C. Deploy each tier into a separate custom mode /16 VPUse VPC Network Peering to securely connect each custom mode VPManage firewall rules individually in each VP
D. Deploy each tier in a /24 VPC by using network tags to identify instances. Implement firewall rules for fine-grained network segmentation.
Show Answer
Correct Answer: B
Explanation: A single custom-mode VPC with appropriately sized address space and separate subnets per tier provides secure isolation while minimizing cost and operational overhead. Using subnet-level separation with firewall rules allows clear, scalable access control between tiers without the complexity and cost of multiple VPCs, peering, or Shared VPC administration. A /16 VPC easily accommodates over 1,000 IPs, and subnet-based firewall rules are simpler and more maintainable than managing many network tags.
Question 7
You ate managing an application deployed on Cloud Run. The development team has released a new version of the application. You want to deploy and redirect traffic to this new version of the application. To ensure traffic to the new version of the application is served with no startup time, you want to ensure that there are two idle instances available for incoming traffic before adjusting the traffic flow. You also want to minimize administrative overhead. What should you do?
A. Ensure the checkbox “Serve this revision immediately” is unchecked when deploying the new revision. Before changing the traffic rules, use a traffic simulation tool to send load to the new revision.
B. Configure service autoscaling and set the minimum number of instances to 2.
C. Configure revision autoscaling for the new revision and set the minimum number of instances to 2.
D. Configure revision autoscaling for the existing revision and set the minimum number of instances to 2.
Show Answer
Correct Answer: C
Explanation: Cloud Run scaling settings such as minimum instances are configured per revision, not per service. To ensure the new version has two warm (idle) instances ready before shifting traffic and to minimize operational effort, you should set the minimum number of instances to 2 on the new revision. This guarantees no cold-start latency when traffic is redirected.
Question 8
You assist different engineering teams in deploying their infrastructure on Google Cloud. Your company has defined certain practices required for all workloads. You need to provide the engineering teams with a solution that enables teams to deploy their infrastructure independently without having to know all implementation details of the company’s required practices. What should you do?
A. Configure organization policies to enforce your company's required practices. Ask the teams to provision their infrastructure by using the Google Cloud console.
B. Create a service account per team, and grant the service account the Project Editor role. Ask the teams to provision their infrastructure through the Google Cloud CLI (gcloud CL), while impersonating their dedicated service account.
C. Write Terraform modules for each component that are compliant with the company's required practices, and ask teams to implement their infrastructure through these modules.
D. Provide training for all engineering teams you work with to understand the company’s required practices. Allow the engineering teams to provision the infrastructure to best meet their needs.
Show Answer
Correct Answer: C
Explanation: The goal is to let teams deploy infrastructure independently while automatically complying with company-required practices, without needing to know all implementation details. Terraform modules (or blueprints) encapsulate those standards—such as security, networking, IAM, and logging—into reusable components. Teams consume the modules with simple inputs, while compliance is enforced by design. Organization policies alone are insufficient, training does not enforce consistency, and broad editor roles increase risk without embedding best practices.
Question 9
You are migrating your company’s on-premises compute resources to Google Cloud. You need to deploy batch processing jobs that run every night. The jobs require significant CPU and memory for several hours but can tolerate interruptions. You must ensure that the deployment is cost-effective. What should you do?
A. Use the M1 machine series on Compute Engine.
B. Containerize the batch processing jobs and deploy them on Compute Engine.
C. Use Spot VMs on Compute Engine.
D. Use custom machine types on Compute Engine.
Show Answer
Correct Answer: C
Explanation: The jobs are batch, run on a schedule, require high resources for limited hours, and can tolerate interruptions. Spot VMs (formerly preemptible VMs) provide steep discounts compared to regular VMs and are specifically designed for fault-tolerant, interruptible workloads like batch processing, making them the most cost-effective choice.
$19
Get all 314 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.