Associate Cloud Engineer Free Practice Questions — Page 4
Question 30
Your company stores data from multiple sources that have different data storage requirements. These data include:
1. Customer data that is structured and read with complex queries
2. Historical log data that is large in volume and accessed infrequently
3. Real-time sensor data with high-velocity writes, which needs to be available for analysis but can tolerate some data loss
You need to design the most cost-effective storage solution that fulfills all data storage requirements. What should you do?
A. Use Firestore for customer data, Cloud Storage (Nearline) for historical logs, and Bigtable for sensor data.
B. Use Cloud SQL for customer data. Cloud Storage (Coldline) for historical logs, and BigQuery for sensor data.
C. Use Cloud SQL for customer data. Cloud Storage (Archive) for historical logs, and Bigtable for sensor data.
D. Use Spanner for all data.
Show Answer
Correct Answer: C
Explanation: Customer data is structured and queried with complex SQL, which fits Cloud SQL best and is more cost‑effective than Spanner. Historical log data is large and accessed infrequently, making Cloud Storage Archive the lowest‑cost appropriate tier. Real‑time sensor data requires very high write throughput and can tolerate some loss; Bigtable is designed for high‑velocity, time‑series ingestion and analytics. Other options either use less suitable databases (Firestore/BigQuery) or are unnecessarily expensive (Spanner).
Question 31
You are planning to migrate your containerized workloads to Google Kubernetes Engine (GKE). You need to determine which GKE option to use. Your solution must have high availability, minimal downtime, and the ability to promptly apply security updates to your nodes. You also want to pay only for the compute resources that your workloads use without managing nodes. You want to follow Google-recommended practices and minimize operational costs. What should you do?
A. Configure a Standard regional GKE duster.
B. Configure a Standard zonal GKE duster.
C. Configure a Standard multi-zonal GKE cluster.
D. Configure an Autopilot GKE cluster.
Show Answer
Correct Answer: D
Explanation: GKE Autopilot is Google‑recommended for most workloads and meets all requirements: high availability with regional control planes, minimal downtime via managed upgrades, automatic and prompt security patching, and no node management. You pay only for the CPU, memory, and storage your pods request, which minimizes operational effort and cost compared to Standard clusters.
Question 32
Your company would like to store invoices and other financial documents in Google Cloud. You need to identify a Google-managed solution to store this information for your company. You must ensure that the documents are kept for a duration of three years. Your company’s analysts need frequent access to invoices from the past six months. After six months, invoices should be archived for audit purposes only. You want to minimize costs and follow Google-recommended practices. What should you do?
A. Use Cloud Storage with Object Lifecycle Management to change the object storage class to Coldline after six months.
B. Use Cloud Storage with Object Lifecycle Management to change the object storage class to Standard after six months.
C. Store your documents on Filestore, and move the documents to Cloud Storage with object storage class set to Coldline after six months.
D. Store your documents on Filestore, and move the documents to Cloud Storage with object storage class set to Standard after six months.
Show Answer
Correct Answer: A
Explanation: Cloud Storage is the Google-recommended, fully managed service for storing documents and objects. Recent invoices require frequent access, which fits the Standard storage class initially. After six months, access is rare and primarily for audit purposes, making Coldline the most cost-effective option. Object Lifecycle Management can automatically transition objects after six months, minimizing operational overhead and cost while ensuring three-year retention.
Question 33
You are planning to migrate a database and a backend application to a Standard Google Kubernetes Engine (GKE) cluster. You need to prevent data loss and make sure there are enough nodes available for your backend application based on the demands of your workloads. You want to follow Google-recommended practices and minimize the amount of manual work required. What should you do?
A. Run your database as a StatefulSet. Configure cluster autoscaling to handle changes in the demands of your workloads.
B. Run your database as a single Pod. Run the resize command when you notice changes in the demands of your workloads.
C. Run your database as a DaemonSet. Run the resize command when you notice changes in the demands of your workloads.
D. Run your database as a Deployment. Configure cluster autoscaling to handle changes in the demands of your workloads.
Show Answer
Correct Answer: A
Explanation: Databases require stable network identities and persistent storage to prevent data loss, which is exactly what a StatefulSet provides and is the Google-recommended approach for stateful workloads on GKE. To ensure enough nodes are available for the backend application with minimal manual effort, enabling cluster autoscaling is the recommended practice, as it automatically adjusts node capacity based on workload demand. The other options either use inappropriate workload types for databases or require manual resizing.
Question 34
Your company uses a multi-cloud strategy that includes Google Cloud. You want to centralize application logs in a third-party software-as-a-service (SaaS) tool from all environments. You need to integrate logs originating from Cloud Logging, and you want to ensure the export occurs with the least amount of delay possible. What should you do?
A. Create a Cloud Logging sink and configure BigQuery as the destination. Configure the SaaS tool to query BigQuery to retrieve the logs.
B. Create a Cloud Logging sink and configure Pub/Sub as the destination. Configure the SaaS tool to subscribe to the Pub/Sub topic to retrieve the logs.
C. Create a Cloud Logging sink and configure Cloud Storage as the destination. Configure the SaaS tool to read the Cloud Storage bucket to retrieve the logs.
D. Use a Cloud Scheduler cron job to trigger a Cloud Function that queries Cloud Logging and sends the logs to the SaaS tool.
Show Answer
Correct Answer: B
Explanation: To achieve the least possible delay when exporting logs from Cloud Logging to a third-party SaaS, you should use a Cloud Logging sink with Pub/Sub as the destination. Pub/Sub streams log entries in near real time, enabling event-driven consumption. SaaS tools can subscribe directly to the topic (pull or push) and receive logs as they are generated. BigQuery and Cloud Storage introduce batching and query/read latency, and a scheduled Cloud Function is poll-based and slower.
Question 35
You are deploying an application to Cloud Run. Your application requires the use of an API that runs on Google Kubernetes Engine (GKE). You need to ensure that your Cloud Run service can privately reach the API on GKE, and you want to follow Google-recommended practices. What should you do?
A. Deploy an ingress resource on the GKE cluster to expose the API to the internet. Use Cloud Armor to filter for IP addresses that can connect to the API. On the Cloud Run service, configure the application to fetch its public IP address and update the Cloud Armor policy on startup to allow this IP address to call the API on ports 80 and 443.
B. Create an ingress firewall rule on the VPC to allow connections from 0.0.0.0/0 on ports 80 and 443.
C. Create an egress firewall rule on the VPC to allow connections to 0.0.0.0/ on ports 80 and 443.
D. Deploy an internal Application Load Balancer to expose the API on GKE to the VPC. Configure Cloud DNS with the IP address of the internal Application Load Balancer. Deploy a Serverless VPC Access connector to allow the Cloud Run service to call the API through the FQDN on Cloud DNS.
Show Answer
Correct Answer: D
Explanation: Cloud Run does not reside inside a VPC by default, so private access to GKE requires explicit VPC connectivity. Exposing the GKE API via an internal Application Load Balancer keeps the service private within the VPC and follows least‑privilege and security best practices. Cloud DNS provides internal name resolution for the service, and a Serverless VPC Access connector enables Cloud Run to send traffic into the VPC to reach the internal load balancer. The other options expose the service publicly or rely on overly broad firewall rules, which are not recommended.
Question 36
Your organization is migrating to Google Cloud. You want only users with company-issued Google accounts to access your Google Cloud environment. You must ensure that users of the same department can only access resources within their own department. You want to minimize operational costs while following Google-recommended practices. What should you do?
A. Assign users to the relevant Google Groups, and provide access to cloud resources through Identity and Access Management (IAM) roles. Periodically identify and remove non-company issued Google accounts.
B. Assign users to the relevant Google Groups, and provide access to cloud resources through Identity and Access Management (IAM) roles. Use organization policies to block non-company issued emails.
C. Create a folder for each department in Resource Manager. Grant the users of each department the Folder Admin role on the folder of their department.
D. Create a folder for each department in Resource Manager. Grant all company users the Folder Admin role on the organization level.
Show Answer
Correct Answer: B
Explanation: Using Google Groups with IAM roles is the recommended, scalable way to manage access in Google Cloud. Groups map cleanly to departments and allow centralized permission management with minimal operational overhead. Enforcing organization policies to block non-company email domains ensures that only company-issued Google accounts can access the environment, automatically and centrally. This satisfies the security requirements while minimizing ongoing administrative effort. Options involving Folder Admin roles overgrant permissions, and manually identifying non-company accounts increases operational cost.
Question 37
You are developing an application that will be deployed on Google Cloud. The application will use a service account to retrieve data from BigQuery. Before you deploy your application, you want to test the permissions of this service account from your local machine to ensure there will be no authentication issues. You want to ensure that you use the most secure method while following Google-recommended practices. What should you do?
A. Generate a service account key, and configure the gcloud CLI to use this key. Issue a relevant BigQuery request through the gdoud CLI to test the access.
B. Grant the service account the BigQuery Administrator IAM role to ensure the service account has all required access.
C. Configure the gcloud CLI to use service account impersonation. Issue a relevant BigQuery request through the gcloud CLI to test the access.
D. Configure the gcloud CLI with Application Default Credentials using your user account. Issue a relevant BigQuery request through the gcloud CLI to test the access.
Show Answer
Correct Answer: C
Explanation: Google recommends avoiding long-lived service account keys due to security risks. Service account impersonation lets you securely test permissions from your local machine using your own credentials without creating or storing keys. Configuring gcloud to impersonate the service account and issuing a BigQuery request validates the exact permissions the application will have, following least-privilege and best practices.
Question 38
You are the Organization Administrator for your company's Google Cloud resources. Your company has strict compliance rules that require you to be notified about any modifications to files and documents hosted on Cloud Storage. In a recent incident, one of your team members was able to modify files and you did not receive any notifications, causing other production jobs to fail. You must ensure that you receive notifications for all changes to files and documents in Cloud Storage while minimizing management overhead. What should you do?
A. View Cloud Audit logs for all Cloud Storage files in Logs Explorer. Filter by Admin Activity logs.
B. Enable Cloud Storage object versioning on your bucket. Configure Pub/Sub notifications for your Cloud Storage buckets.
C. Enable versioning on the Cloud Storage bucket. Set up a custom script that scans versions of Cloud Storage objects being modified and alert the admin by using the script.
D. Configure Object change notifications on the Cloud Storage buckets. Send the events to Pub/Sub.
Show Answer
Correct Answer: D
Explanation: The requirement is to receive notifications for all object changes in Cloud Storage with minimal management overhead. Configuring Cloud Storage object change notifications and sending events to Pub/Sub provides real-time, automated notifications for create, update, and delete operations and integrates easily with alerting systems. Enabling object versioning is not required for notifications and adds additional cost and operational overhead, while log review or custom scripts are more manual and less suitable for real-time alerting.
Question 39
You use Cloud Logging to capture application logs. You now need to use SQL to analyze the application logs in Cloud Logging, and you want to follow Google-recommended practices. What should you do?
A. Develop SQL queries by using Gemini for Google Cloud.
B. Enable Log Analytics for the log bucket and create a linked dataset in BigQuery.
C. Create a schema for the storage bucket and run SQL queries for the data in the bucket.
D. Export logs to a storage bucket and create an external view in BigQuery.
Show Answer
Correct Answer: B
Explanation: Google-recommended practice for analyzing Cloud Logging data with SQL is to enable Log Analytics on the log bucket. This natively integrates logs with BigQuery by creating a linked dataset, allowing direct, efficient SQL querying without manual exports or custom schemas. Other options add unnecessary complexity or are not the recommended approach.
$19
Get all 314 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.