Google Cloud Associate Cloud Engineer Practice Exam

• A. Project number
• B. Project label
• C. Project name
• D. Project ID Correct answer

Option D is correct because the project ID is the globally unique identifier that gcloud accepts in --project and it is permanent once the project is created. The project name and labels can be changed later, and the project number is assigned by Google rather than chosen during creation.

• A. Link the project to an active Cloud Billing account, then retry enabling the API. Correct answer
• B. Grant yourself the Service Usage Admin role on the project, then retry enabling the API.
• C. Move the project into a folder where billing is already enabled, then retry enabling the API.
• D. Request a Compute Engine quota increase for the project, then retry enabling the API.

Option A is correct because enabling most APIs, including Compute Engine, requires the project to be linked to an active Cloud Billing account. Service Usage Admin permissions, folder placement and quota increases do not satisfy the billing requirement.

• A. Folders, organization, projects, resources
• B. Organization, folders, projects, resources Correct answer
• C. Billing account, organization, folders, projects
• D. Organization, projects, folders, resources

Option B is correct because the hierarchy runs organization, then folders, then projects, then resources. A billing account is not part of this hierarchy, and folders always sit between the organization and its projects.

• A. Compute Engine instances in the linked projects are stopped until the next billing month begins.
• B. The billing account is suspended and the linked projects lose their billing association.
• C. New API requests in the linked projects are rejected until the budget amount is raised.
• D. Billing administrators receive an email alert, and the linked projects continue to run normally. Correct answer

Option D is correct because budget alerts are notifications only: billing administrators are emailed at the thresholds, and nothing is stopped, suspended or rejected. Capping spend requires separate automation, for example a Pub/Sub-triggered function that disables billing.

• A. Export the CLOUDSDK_CORE_PROJECT environment variable in your shell profile for the project you use most often.
• B. Run gcloud config set project before every session and unset the value when you finish working.
• C. Run gcloud auth login for each account in turn and rely on the latest account's default project.
• D. Create one gcloud configuration per project and switch with gcloud config configurations activate. Correct answer

Option D is correct because a gcloud configuration bundles account, project, zone and region, and switching with gcloud config configurations activate changes all of them together. Environment variables, repeated set commands and auth login only handle part of the context and are easy to get wrong.

• A. Provision the worker VMs as Spot VMs Correct answer
• B. Purchase a three-year committed use discount for the worker VMs
• C. Run the worker VMs on sole-tenant nodes
• D. Create the worker VMs with a custom machine type that has fewer vCPUs

Option A is correct because Spot VMs offer the deepest discount for fault-tolerant work that can tolerate Google reclaiming the capacity. A committed use discount (B) is a long-term commitment for steady workloads, sole-tenant nodes (C) cost more, and a smaller custom machine (D) does not reduce the per-unit price in the way Spot does.

• A. Create a GKE Standard cluster whose node pools use Spot VMs with a Pod disruption budget
• B. Create a GKE Autopilot cluster and deploy the workloads to it Correct answer
• C. Create a GKE Standard cluster with node auto-provisioning and the cluster autoscaler enabled
• D. Create a GKE Standard regional cluster and enable node auto-upgrade on its node pool

Option B is correct because GKE Autopilot manages nodes, patching and scaling for you and bills per Pod resource requests. The Standard cluster options (A, C, D) still have node pools that the team must size, configure or pay for as VMs.

• A. Deploy the image as a Cloud Run service with the minimum number of instances set to 0 Correct answer
• B. Deploy the image to an App Engine flexible environment service with automatic scaling enabled
• C. Run the container on a Compute Engine VM created with a Container-Optimized OS image
• D. Deploy the image to a GKE Autopilot cluster as a Deployment exposed through a LoadBalancer Service

Option A is correct because Cloud Run scales stateless containers to zero when idle, so you pay nothing at idle and operate no cluster. App Engine flexible (B) always keeps at least one instance running, a Compute Engine VM (C) bills while running, and a GKE Autopilot cluster (D) is still a cluster to operate and has a charge.

• A. Automatic restart in the instance template's scheduling settings so failed VMs reboot after a crash
• B. An autohealing policy on the group that uses a health check against the application's HTTP endpoint Correct answer
• C. A Cloud Monitoring alerting policy on an uptime check that notifies the on-call engineer
• D. An autoscaling policy that adds VMs when the group's average CPU utilization rises above 60 percent

Option B is correct because autohealing uses an application-level health check to recreate VMs that are running but not serving. Automatic restart (A) only reacts to VM crashes or host events, an alerting policy (C) only notifies a human, and autoscaling (D) changes capacity based on load, not health.

• A. Coldline storage
• B. Standard storage
• C. Nearline storage
• D. Archive storage Correct answer

Option D is correct because Archive has the lowest storage price and suits data accessed less than once a year and kept for years, such as closed financial records. Coldline (A), Nearline (C) and Standard (B) all cost more per GB stored, and their lower retrieval costs do not matter for yearly reads.

• A. Enable an autoscaler that targets 60% average CPU utilization
• B. Turn on the automatic restart option in the instance template
• C. Set the group's update policy to proactive with a maximum surge of three instances
• D. Add an autohealing policy backed by a health check on the application port Correct answer

Option D is correct because an autohealing policy uses an application-level health check to detect a hung process and recreates the VM even though it is still RUNNING. Autoscaling (A) only changes group size, automatic restart (B) reacts to VM-level failures or host events rather than application hangs, and a proactive update policy (C) controls rollouts, not repair.

• A. Raise the maximum number of instances to 100
• B. Set the per-instance concurrency to 1000 requests
• C. Set the minimum number of instances to 1 Correct answer
• D. Increase the request timeout to 900 seconds

Option C is correct because setting minimum instances to 1 keeps a warm container instance ready, avoiding cold starts after idle periods. Maximum instances (A), concurrency (B) and request timeout (D) do not keep an instance running when there is no traffic.

• A. Attach GPU accelerators to the existing node pool's VMs through Compute Engine
• B. Enable the cluster autoscaler on the current pool so it adds GPU nodes on demand
• C. Convert the cluster to Autopilot so GPUs are attached to Pods automatically
• D. Add a GPU node pool and target it from the batch Pods with a node selector Correct answer

Option D is correct because GPUs are attached per node pool in GKE Standard, so a separate GPU pool targeted by a node selector leaves the web Pods untouched. Existing node pool VMs cannot be given GPUs through Compute Engine (A), the autoscaler only adds nodes of the pool's existing type (B), and converting to Autopilot (C) is not possible in place and is unnecessary.

• A. Change the machine type while the VM keeps running
• B. Stop the VM, change its machine type to a larger one, and start it again Correct answer
• C. Create a machine image of the VM and deploy a larger replacement from it
• D. Add a local SSD to the VM and move the database cache onto it

Option B is correct because the machine type of a Compute Engine VM can only be changed while the instance is stopped, and the boot disk and internal IP are preserved. Changing it while running (A) is not supported, a replacement from a machine image (C) is a new VM that would not keep the same identity by default, and a local SSD (D) adds no memory.

• A. Create a new instance template that specifies the larger machine type Correct answer
• B. Start a rolling update on the group that applies the new template Correct answer
• C. Edit the machine type in the existing instance template
• D. Resize the group to zero and then back to its original size
• E. Stop each VM in the group and change its machine type with gcloud compute instances set-machine-type

Options A and B are correct because instance templates are immutable, so a larger machine type means a new template, and a rolling update then replaces the VMs gradually so serving capacity is kept. Editing the existing template (C) is not possible, resizing to zero (D) removes all capacity, and changing each VM by hand (E) bypasses the group and is lost when the group recreates instances.

• A. Grant the Security Reviewer role (roles/iam.securityReviewer)
• B. Grant the Service Usage Consumer role (roles/serviceusage.serviceUsageConsumer)
• C. Grant the Viewer role (roles/viewer) Correct answer
• D. Grant the Browser role (roles/browser)

Option C is correct because the Viewer role (roles/viewer) grants read-only access to all resources in the project and no permission to change anything. Security Reviewer only lets you inspect IAM and security policies, Service Usage Consumer is about consuming APIs, and Browser only lets you browse the resource hierarchy, so none of them give visibility into every resource.

• A. Grant the Compute Instance Admin (v1) role to the company's email domain on the project
• B. Create one service account with the Compute Instance Admin (v1) role and let the developers impersonate it
• C. Create a custom role with the compute.instances.* permissions and bind it to each developer's user account on the project
• D. Grant Compute Instance Admin (v1) on the project to a Google group containing the developers Correct answer

Option D is correct because binding the role to a Google group means developers are added or removed through group membership, with no IAM policy edits. Granting to the whole company domain is far too broad, a shared service account to impersonate defeats individual accountability and still needs per-user bindings, and binding to each user account requires a policy edit for every change.

• A. Grant the Compute Viewer role together with the Service Account User role on the project
• B. Create a custom role with the compute.instances.get, list, start and stop permissions and grant it to the operator Correct answer
• C. Grant Compute Instance Admin (v1) and enforce an organization policy constraint that blocks instance creation and deletion
• D. Edit the predefined Compute Instance Admin (v1) role in the project to remove its create and delete permissions

Option B is correct because a custom role containing only compute.instances.get, list, start and stop gives exactly the required capabilities. Compute Viewer plus Service Account User cannot start or stop VMs, an organization policy constraint cannot block specific IAM permissions like create and delete, and predefined roles cannot be edited.

• A. Signed URLs for each object, generated with an expiry of 31 March 2027
• B. An IAM condition on the contractor's binding that allows access only while request.time is before 2027-04-01 Correct answer
• C. A retention policy on each bucket that expires on 31 March 2027
• D. An expiry date on a service account key that the contractor uses to reach the buckets

Option B is correct because an IAM condition on request.time makes the binding stop granting access automatically after the date, with nothing to run or maintain. Signed URLs are per object and do not cover bucket-level access through IAM, a retention policy controls how long objects are kept rather than who can read them, and a service account key expiry does not remove the role binding.

• A. Project IAM Admin
• B. Security Reviewer
• C. Editor Correct answer
• D. Service Account User
• E. Viewer Correct answer

Options C (Editor) and E (Viewer) are correct because the basic roles are Owner, Editor and Viewer, and they grant broad permissions across most Google Cloud services in a project. Project IAM Admin, Security Reviewer and Service Account User are predefined roles scoped to specific tasks, not basic roles.