Associate Cloud Engineer Free Practice Questions — Page 2
Question 11
You are deploying a new frontend service for an online game. The service was built using a micro-frontend architecture and consists of multiple containers that interact using a service mesh. You need to control the number of compute instances that are running at a given time. What should you do?
A. Create a Compute Engine instance template using a container-optimized virtual machine (VM) instance, and create a startup script that installs Istio service mesh. Deploy the service, and create a managed instance group with a fixed number of instances to run the service.
B. Create a Cloud Run service specifying the minimum and maximum number of instances, and configure the service to use Cloud Service Mesh. Deploy all the containers to the service.
C. Create a Google Kubernetes Engine (GKE) Autopilot cluster, and enable Cloud Service Mesh. Deploy the service, and use vertical and horizontal Pod autoscaling to control the cluster size.
D. Create a Google Kubernetes Engine (GKE) Standard cluster with a node pool that has a fixed number of nodes. Enable the Cloud Service Mesh add-on, and deploy the service.
Show Answer
Correct Answer: D
Explanation: A micro-frontend composed of multiple containers that communicate through a service mesh is best suited to GKE with Cloud Service Mesh. The requirement is to control the number of compute instances running at a given time. A GKE Standard cluster with a node pool configured to a fixed size gives explicit control over the number of compute instances (nodes). Cloud Run scales instances dynamically within min/max bounds rather than keeping a fixed compute fleet, GKE Autopilot manages infrastructure automatically, and Compute Engine managed instance groups are not the typical platform for orchestrating multiple containers with a service mesh.
Question 12
You are the Google Cloud systems administrator for your organization. User A reports that they received an error when attempting to access the Cloud SQL database in their Google Cloud project, while User B can access the database. You need to troubleshoot the issue for User A, while following Google-recommended practices. What should you do first?
A. Confirm that network firewall rules are not blocking traffic for User
B. Verify that User A has the Identity and Access Management (IAM) Project Owner role assigned.
C. Review recent configuration changes that may have caused unintended modifications to permissions.
D. Review the error message that User A received.
Show Answer
Correct Answer: D
Explanation: The first step in troubleshooting is to gather information by reviewing the exact error message. Google-recommended troubleshooting practices begin with identifying the specific failure before investigating IAM roles, firewall rules, or recent configuration changes. Option B is inappropriate because Project Owner is excessive and violates least-privilege principles. Options A and C may be relevant later depending on the error, but not as the initial step.
Question 13
Your company wants to migrate your data from an on-premises relational database to Google Cloud. Your current database can no longer scale with respect to the growth of your users, and you expect the number of users to rapidly grow. You need to choose a relational database that allows you to globally scale while minimizing your management and administration efforts. You also want to follow Google-recommended practices. What should you do?
A. Use Cloud SQL.
B. Use Spanner.
C. Use Firestore.
D. Use BigQuery.
Show Answer
Correct Answer: B
Explanation: Cloud Spanner is Google's fully managed relational database designed for horizontal, global scaling with strong consistency and minimal operational overhead. Cloud SQL is managed but primarily scales vertically and is not intended for global-scale workloads. Firestore is a NoSQL document database, and BigQuery is an analytics data warehouse rather than an OLTP relational database.
Question 14
Your company is active in the European Economic Area (EEA), and will adopt Google Cloud for its workloads. Projects are currently structured within different folders. You need to ensure any resources that will be deployed are using Google Cloud locations within the EEA by using the Organization Policy Service resource locations constraint. What should you do?
A. Configure the policy at the folder level, and add all allowed locations to the policy.
B. Configure the policy at the organization level, and add all allowed locations to the policy.
C. Configure the policy at the folder level, and add all disallowed locations to the policy.
D. Configure the policy at the organization level, and add all disallowed locations to the policy.
Show Answer
Correct Answer: B
Explanation: The resource locations organization policy should be applied at the organization level to ensure it is inherited by all folders and projects, including future ones. For the resource locations constraint, you specify the allowed locations (the EEA regions/multi-regions) so that resources can only be created there. This provides centralized enforcement across the organization.
Question 15
You are writing a shell script that includes a few gcloud CLI commands to access some Google Cloud resources. You want to test the script in your local development environment with a service account in the most secure way. What should you do?
A. Generate an ID token for the service account. Use the token with the gcloud CLI commands.
B. Enable service account impersonation, and use the gcloud config set command to use it by default.
C. Download the service account key file and save it in a secure location. Set the GOOGLE_APPLICATION_CREDENTIALS environment variable to the key file.
D. Download the service account key file, and use it to generate an access token. Use the token with the gcloud CLI commands.
Show Answer
Correct Answer: B
Explanation: Service account impersonation is the recommended and most secure approach for local development with the gcloud CLI because it avoids creating and distributing long-lived service account keys. Configuring gcloud to impersonate the service account lets your user credentials obtain short-lived credentials for that service account. ID tokens are not used for general gcloud API access, and downloading service account keys is less secure.
Question 16
Your company is closely monitoring their cloud spend. You need to allow different teams to monitor their Google Cloud costs. You must ensure that team members receive notifications when their cloud spend reaches certain thresholds and give team members the ability to create dashboards for additional insights with detailed billing data. You want to follow Google-recommended practices and minimize engineering costs. What should you do?
A. Deploy Grafana to Compute Engine. Create a dashboard for each team that uses the data from the Cloud Billing API. Ask each team to create their own alerts in Cloud Monitoring.
B. Set up alerts for each team based on required thresholds. Create a shell script to read data from the Cloud Billing API, and push the results to BigQuery. Grant team members access to BigQuery.
C. Deploy Grafana to Compute Engine. Create a dashboard for each team that uses the data from the Cloud Billing Budget API. Ask each team to create their own alerts in Grafana.
D. Set up alerts for each team based on required thresholds. Set up billing exports to BigQuery. Grant team members access to BigQuery.
Show Answer
Correct Answer: D
Explanation: Use Cloud Billing Budgets and alerts to notify teams when spending reaches thresholds. Enable Cloud Billing export to BigQuery to provide detailed billing data that teams can query and use to build their own dashboards (for example, with Looker Studio). This follows Google-recommended managed services and minimizes engineering and operational overhead compared with maintaining custom scripts or Grafana deployments.
Question 17
Your company plans to migrate its on-premises PostgreSQL database to Google Cloud. The workloads are demanding, requiring fast transactional and analytical performance. You need to select a fully managed database service on Google Cloud. Your solution must also be able to synchronously replicate and optimize the storage layer. What should you do?
A. Migrate the database to Cloud SQL for PostgreSQL by using Database Migration Service.
B. Use the psql client installed on a Compute Engine instance. Connect to the Cloud SQL instance to perform the database migration.
C. Migrate the database to AlloyDB for PostgreSQL by using Database Migration Service.
D. Create a Compute Engine instance. Install and configure PostgreSQL on the instance, and migrate the database.
Show Answer
Correct Answer: C
Explanation: AlloyDB for PostgreSQL is Google Cloud's fully managed PostgreSQL-compatible database service designed for high-performance transactional and analytical workloads. It uses a distributed storage layer with synchronous replication and storage optimizations. Database Migration Service supports migration from on-premises PostgreSQL to AlloyDB. Cloud SQL does not provide the same storage architecture and performance characteristics described.
Question 18
You are deploying a large, multi-tiered application with more than 1,000 IP addresses in a Google Cloud project that needs to be securely isolated. The application includes the:
1. web tier with frontend servers for public traffic,
2. application tier with servers running core application logic that only need access from the web tier, and
3. database tier with database servers that only need access from the application tier.
You want to minimize cost, complexity, and administrative overhead in the network architecture. What should you do?
A. Create a /24 Shared VPC with separate subnets for each tier. Use firewall rules that reference network tags to control traffic.
B. Create one custom mode /16 VPC with three subnets. Place each tier in its own subnet and use firewall rules that reference IP subnets to control traffic.
C. Deploy each tier into a separate custom mode /16 VPUse VPC Network Peering to securely connect each custom mode VPManage firewall rules individually in each VP
D. Deploy each tier in a /24 VPC by using network tags to identify instances. Implement firewall rules for fine-grained network segmentation.
Show Answer
Correct Answer: B
Explanation: A single custom-mode /16 VPC with three subnets (web, application, and database) provides ample address space for over 1,000 IPs while keeping the design simple and low-cost. Subnets do not isolate traffic by themselves, so firewall rules enforce that only the web tier can reach the application tier and only the application tier can reach the database tier. This avoids the extra complexity and management overhead of multiple VPCs, Shared VPC, or VPC Peering.
Question 19
You ate managing an application deployed on Cloud Run. The development team has released a new version of the application. You want to deploy and redirect traffic to this new version of the application. To ensure traffic to the new version of the application is served with no startup time, you want to ensure that there are two idle instances available for incoming traffic before adjusting the traffic flow. You also want to minimize administrative overhead. What should you do?
A. Ensure the checkbox “Serve this revision immediately” is unchecked when deploying the new revision. Before changing the traffic rules, use a traffic simulation tool to send load to the new revision.
B. Configure service autoscaling and set the minimum number of instances to 2.
C. Configure revision autoscaling for the new revision and set the minimum number of instances to 2.
D. Configure revision autoscaling for the existing revision and set the minimum number of instances to 2.
Show Answer
Correct Answer: C
Explanation: To avoid cold starts for the newly deployed version before shifting traffic, configure a minimum of two instances for the new revision. Cloud Run minimum instances are applied at the revision level, allowing the new revision to keep two warm, idle instances ready before traffic is redirected. This minimizes administrative overhead compared with generating artificial traffic or configuring unrelated revisions.
Question 20
You assist different engineering teams in deploying their infrastructure on Google Cloud. Your company has defined certain practices required for all workloads. You need to provide the engineering teams with a solution that enables teams to deploy their infrastructure independently without having to know all implementation details of the company’s required practices. What should you do?
A. Configure organization policies to enforce your company's required practices. Ask the teams to provision their infrastructure by using the Google Cloud console.
B. Create a service account per team, and grant the service account the Project Editor role. Ask the teams to provision their infrastructure through the Google Cloud CLI (gcloud CL), while impersonating their dedicated service account.
C. Write Terraform modules for each component that are compliant with the company's required practices, and ask teams to implement their infrastructure through these modules.
D. Provide training for all engineering teams you work with to understand the company’s required practices. Allow the engineering teams to provision the infrastructure to best meet their needs.
Show Answer
Correct Answer: C
Explanation: Terraform modules encapsulate the organization's required practices and implementation details, allowing engineering teams to deploy infrastructure independently while consistently complying with company standards. Organization policies enforce certain constraints but do not provide reusable deployment implementations. Granting broad Editor access or relying on training does not ensure consistent implementation of required practices.
$19
Get all 323 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.