Associate Cloud Engineer Free Practice Questions — Page 7
Question 60
You just installed the Google Cloud CLI on your new corporate laptop. You need to list the existing instances of your company on Google Cloud. What must you do before you run the gcloud compute instances list command? (Choose two.)
A. Run gcloud auth login, enter your login credentials in the dialog window, and paste the received login token to gcloud CLI.
B. Create a Google Cloud service account, and download the service account key. Place the key file in a folder on your machine where gcloud CLI can find it.
C. Download your Cloud Identity user account key. Place the key file in a folder on your machine where gcloud CLI can find it.
D. Run gcloud config set compute/zone $my_zone to set the default zone for gcloud CLI.
E. Run gcloud config set project $my_project to set the default project for gcloud CLI.
Show Answer
Correct Answer: A, E
Explanation: Before listing Compute Engine instances, you must authenticate the gcloud CLI with an account that has permission (A). You also must set the default project so gcloud knows which project's resources to list (E). Setting a default zone is optional for listing instances, and service account or user keys are not required for interactive CLI use.
Question 61
You are planning to migrate your on-premises data to Google Cloud. The data includes:
• 200 TB of video files in SAN storage
• Data warehouse data stored on Amazon Redshift
• 20 GB of PNG files stored on an S3 bucket
You need to load the video files into a Cloud Storage bucket, transfer the data warehouse data into BigQuery, and load the PNG files into a second Cloud Storage bucket. You want to follow Google-recommended practices and avoid writing any code for the migration. What should you do?
A. Use gcloud storage for the video files, Dataflow for the data warehouse data, and Storage Transfer Service for the PNG files.
B. Use Transfer Appliance for the videos, BigQuery Data Transfer Service for the data warehouse data, and Storage Transfer Service for the PNG files.
C. Use Storage Transfer Service for the video files, BigQuery Data Transfer Service for the data warehouse data, and Storage Transfer Service for the PNG files.
D. Use Cloud Data Fusion for the video files, Dataflow for the data warehouse data, and Storage Transfer Service for the PNG files.
Show Answer
Correct Answer: B
Explanation: The 200 TB of video files reside on on‑premises SAN storage, which is not a supported source for Storage Transfer Service and would be inefficient to move over the network at that scale. Google‑recommended practice for very large on‑premises datasets is to use Transfer Appliance. Amazon Redshift to BigQuery migration is natively supported and automated by BigQuery Data Transfer Service without custom code. The 20 GB of PNG files stored in Amazon S3 are best migrated using Storage Transfer Service, which is designed for S3‑to‑Cloud Storage transfers. This combination follows best practices and avoids writing any code.
Question 62
The core business of your company is to rent out construction equipment at large scale. All the equipment that is being rented out has been equipped with multiple sensors that send event information every few seconds. These signals can vary from engine status, distance traveled, fuel level, and more. Customers are billed based on the consumption monitored by these sensors. You expect high throughput – up to thousands of events per hour per device – and need to retrieve consistent data based on the time of the event. Storing and retrieving individual signals should be atomic. What should you do?
A. Create files in Cloud Storage as data comes in.
B. Create a file in Filestore per device, and append new data to that file.
C. Ingest the data into Cloud SQL. Use multiple read replicas to match the throughput.
D. Ingest the data into Bigtable. Create a row key based on the event timestamp.
Show Answer
Correct Answer: D
Explanation: This workload requires very high write throughput, low-latency reads, atomic writes per signal, and efficient time-based access. Cloud Bigtable is designed for large-scale time-series and event data with consistent performance. Using a row key that incorporates the event timestamp (often combined with device ID) enables efficient, ordered retrieval by time while maintaining atomic reads/writes at the row level. Cloud Storage and Filestore are file-based and not suited for atomic, high-frequency event ingestion, and Cloud SQL does not scale cost-effectively to thousands of events per hour per device.
Question 63
You are in charge of provisioning access for all Google Cloud users in your organization. Your company recently acquired a startup company that has their own Google Cloud organization. You need to ensure that your Site Reliability Engineers (SREs) have the same project permissions in the startup company's organization as in your own organization. What should you do?
A. In the Google Cloud console for your organization, select Create role from selection, and choose destination as the startup company's organization.
B. In the Google Cloud console for the startup company, select Create role from selection and choose source as the startup company's Google Cloud organization.
C. Use the gcloud iam roles copy command, and provide the Organization ID of the startup company's Google Cloud Organization as the destination.
D. Use the gcloud iam roles copy command, and provide the project IDs of all projects in the startup company's organization as the destination.
Show Answer
Correct Answer: C
Explanation: To give SREs the same project permissions across two organizations, you need to copy the custom IAM roles that define those permissions. The supported and scalable way to do this is to copy the roles at the organization level using the gcloud iam roles copy command with the destination set to the startup company’s Organization ID. This makes the roles available consistently across all projects in that organization. Copying roles project by project is impractical and unnecessary, and console-based role creation does not support bulk copying across organizations.
Question 64
You need to extract text from audio files by using the Speech-to-Text API. The audio files are pushed to a Cloud Storage bucket. You need to implement a fully managed, serverless compute solution that requires authentication and aligns with Google-recommended practices. You want to automate the call to the API by submitting each file to the API as the audio file arrives in the bucket. What should you do?
A. Create an App Engine standard environment triggered by Cloud Storage bucket events to submit the file URI to the Google Speech-to-TextAPI.
B. Run a Kubernetes job to scan the bucket regularly for incoming files, and call the Speech-to-Text API for each unprocessed file.
C. Run a Python script by using a Linux cron job in Compute Engine to scan the bucket regularly for incoming files, and call the Speech-to-Text API for each unprocessed file.
D. Create a Cloud Function triggered by Cloud Storage bucket events to submit the file URI to the Google Speech-to-Text API.
Show Answer
Correct Answer: D
Explanation: A Cloud Function triggered by Cloud Storage events is a fully managed, serverless solution that automatically reacts when new audio files arrive in the bucket. It natively integrates with Cloud Storage triggers, scales automatically, uses a service account for secure authentication to the Speech-to-Text API, and requires no infrastructure management. This approach aligns directly with Google-recommended event-driven, serverless architectures.
Question 65
You are configuring service accounts for an application that spans multiple projects. Virtual machines (VMs) running in the web-applications project need access to BigQuery datasets in the crm-databases project. You want to follow Google-recommended practices to grant access to the service account in the web-applications project. What should you do?
A. Grant "project owner" for web-applications appropriate roles to crm-databases.
B. Grant "project owner" role to crm-databases and the web-applications project.
C. Grant "project owner" role to crm-databases and roles/bigquery.dataViewer role to web-applications.
D. Grant roles/bigquery.dataViewer role to crm-databases and appropriate roles to web-applications.
Show Answer
Correct Answer: D
Explanation: VMs in the web-applications project use a service account that must access BigQuery data stored in the crm-databases project. Google-recommended practice is to follow the principle of least privilege and grant permissions to the service account at the resource it needs to access, not broad project-wide owner roles. Therefore, grant the BigQuery-specific role (such as roles/bigquery.dataViewer) on the crm-databases project to the service account, and grant only appropriate, minimal roles within the web-applications project. Any option involving Project Owner is overly permissive and not recommended.
Question 66
You are building a backend service for an ecommerce platform that will persist transaction data from mobile and web clients. After the platform is launched, you expect a large volume of global transactions. Your business team wants to run SQL queries to analyze the data. You need to build a highly available and scalable data store for the platform. What should you do?
A. Create a multi-region Cloud Spanner instance with an optimized schema.
B. Create a multi-region Firestore database with aggregation query enabled.
C. Create a multi-region Cloud SQL for PostgreSQL database with optimized indexes.
D. Create a multi-region BigQuery dataset with optimized tables.
Show Answer
Correct Answer: A
Explanation: The system must handle a very large volume of global transactions, be highly available, scale horizontally, and support SQL queries. Cloud Spanner is designed for exactly this use case: it provides globally distributed, strongly consistent, horizontally scalable relational storage with ANSI SQL support and multi-region high availability. Firestore is not ideal for complex SQL analytics, Cloud SQL does not scale globally at very high transaction volumes, and BigQuery is optimized for analytics rather than transactional workloads.
Question 67
Your Dataproc cluster runs in a single Virtual Private Cloud (VPC) network in a single subnetwork with range 172.16.20.128/25. There are no private IP addresses available in the subnetwork. You want to add new VMs to communicate with your cluster using the minimum number of steps. What should you do?
A. Modify the existing subnet range to 172.16.20.0/24.
B. Create a new Secondary IP Range in the VPC and configure the VMs to use that range.
C. Create a new VPC network for the VMs. Enable VPC Peering between the VMs'VPC network and the Dataproc cluster VPC network.
D. Create a new VPC network for the VMs with a subnet of 172.32.0.0/16. Enable VPC network Peering between the Dataproc VPC network and the VMs VPC network. Configure a custom Route exchange.
Show Answer
Correct Answer: A
Explanation: The subnetwork has exhausted its primary IP range. In Google Cloud, you can expand an existing subnet’s primary IPv4 range by reducing the prefix length (for example, from /25 to /24) as long as the expanded range stays within the same address block. This is a single operation and immediately provides more private IPs for new VMs in the same VPC and subnet. The other options require additional configuration steps (secondary ranges, new VPCs, or peering) and are not minimal.
Question 68
You have deployed an application on a Compute Engine instance. An external consultant needs to access the Linux-based instance. The consultant is connected to your corporate network through a VPN connection, but the consultant has no Google account. What should you do?
A. Instruct the external consultant to use the gcloud compute ssh command line tool by using Identity-Aware Proxy to access the instance.
B. Instruct the external consultant to use the gcloud compute ssh command line tool by using the public IP address of the instance to access it.
C. Instruct the external consultant to generate an SSH key pair, and request the public key from the consultant. Add the public key to the instance yourself, and have the consultant access the instance through SSH with their private key.
D. Instruct the external consultant to generate an SSH key pair, and request the private key from the consultant. Add the private key to the instance yourself, and have the consultant access the instance through SSH with their public key.
Show Answer
Correct Answer: C
Explanation: The consultant does not have a Google account, so options that rely on gcloud or IAM-based access (including IAP SSH via gcloud) are not appropriate for a straightforward exam scenario. The standard and supported way to grant SSH access to a Linux Compute Engine VM without a Google account is to use SSH key–based authentication: have the consultant generate an SSH key pair, add the public key to the instance or project metadata, and allow access using the consultant’s private key. Sharing or managing private keys is insecure, and IAP is unnecessary given the existing VPN connectivity.
Question 69
You want to enable your development team to deploy new features to an existing Cloud Run service in production. To minimize the risk associated with a new revision, you want to reduce the number of customers who might be affected by an outage without introducing any development or operational costs to your customers. You want to follow Google-recommended practices for managing revisions to a service. What should you do?
A. Ask your customers to retry access to your service with exponential backoff to mitigate any potential problems after the new revision is deployed.
B. Gradually roll out the new revision and split customer traffic between the revisions to allow rollback in case a problem occurs.
C. Send all customer traffic to the new revision, and roll back to a previous revision if you witness any problems in production.
D. Deploy your application to a second Cloud Run service, and ask your customers to use the second Cloud Run service.
Show Answer
Correct Answer: B
Explanation: Cloud Run supports traffic splitting between revisions, which is a Google‑recommended practice for safe deployments. Gradually rolling out a new revision limits the blast radius of failures, allows quick rollback if issues arise, and requires no changes or added operational burden for customers.
$19
Get all 314 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.