GCP Associate Cloud Engineer Practice Exam

What the GCP Associate Cloud Engineer exam covers

• Setting Up a Cloud Solution Environment144 questions
• Planning and Configuring a Cloud Solution147 questions
• Deploying and Implementing a Cloud Solution177 questions
• Ensuring Successful Operation of a Cloud Solution150 questions
• Configuring Access and Security123 questions

Free GCP Associate Cloud Engineer sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 741.

1. Question 1Setting Up a Cloud Solution Environment

   A mid-sized company is starting its cloud journey on Google Cloud. The CTO wants to ensure that each department - engineering, marketing, and finance - has its own isolated set of resources with separate billing. Which approach should you recommend?

   • ACreate separate folders for each department but use a single shared project
   • BCreate a single project and use labels to separate resources by department
   • CCreate a separate project per department, each with its own billing accountCorrect
   • DCreate separate VPCs within one project for each department's resources
   ✓ Correct answer: C

   In Google Cloud the project is the base unit of resource isolation, IAM boundaries, and billing association. Giving each department its own project under the organization node isolates their resources, and linking each project to its own Cloud Billing account produces cleanly separated invoices per department.

   Why the other options are wrong

   • AFolders can group projects, but a single shared project links to exactly one billing account, so departments get neither separate billing nor resource isolation.
   • BLabels are only metadata for filtering and cost breakdown; they do not isolate resources, and everything still shares one project and one billing account.
   • DMultiple VPCs in one project separate networking only; the resources still share one project's IAM and a single billing account, so billing is not separated.
2. Question 2Deploying and Implementing a Cloud Solution

   Your team needs to create multiple identical development environments on Google Cloud for a team of 20 developers. Each environment consists of a VPC, a GKE cluster, a Cloud SQL instance, and a Cloud Storage bucket. You want to automate the provisioning and ensure consistency. Which approach should you use?

   • AManually create one environment in the Console and use the Cloud Console's 'Duplicate' feature for the rest
   • BCreate a shell script with gcloud commands and run it 20 times with different parameters
   • CCreate a Deployment Manager template and deploy it once for all 20 developers to share
   • DWrite a Terraform module that defines all the resources and use terraform workspace or variable files to create each developer's environmentCorrect
   ✓ Correct answer: D

   A reusable Terraform module encapsulates the VPC, GKE cluster, Cloud SQL instance, and bucket once, and per-developer state is isolated with separate terraform workspaces or tfvars files. This gives declarative, idempotent, version-controlled provisioning so all 20 environments are identical and can be updated or torn down consistently from a single source of truth.

   Why the other options are wrong

   • AThe Cloud Console has no 'Duplicate' feature for environments, and manual creation is neither automated nor guaranteed to stay consistent.
   • BA shell script of gcloud commands is imperative and stateless, so keeping 20 environments identical is error-prone and there is no clean way to update or destroy them.
   • CDeploying one shared Deployment Manager stack for all 20 developers removes per-developer isolation, and Deployment Manager is Google's legacy IaC tool now superseded by Terraform and Infrastructure Manager.
3. Question 3Setting Up a Cloud Solution Environment

   Which command enables a specific API for a GCP project?

   • Agcloud config set api <API_NAME>
   • Bgcloud api activate <API_NAME>
   • Cgcloud projects enable-api <API_NAME>
   • Dgcloud services enable <API_NAME>Correct
   ✓ Correct answer: D

   `gcloud services enable SERVICE_NAME` (for example `gcloud services enable compute.googleapis.com`) turns on an API for the active or specified project so its resources can be used. The service name is the API's full endpoint, and the other listed forms are not valid gcloud syntax.

   Why the other options are wrong

   • A`gcloud config set` changes local CLI properties, not project API enablement.
   • B`gcloud api activate` is not a valid command; the correct group is `gcloud services`.
   • CThere is no `gcloud projects enable-api` subcommand; API enablement lives under `gcloud services`.
4. Question 4Deploying and Implementing a Cloud SolutionSelect all that apply

   You are deploying an application on Compute Engine that needs to interact with Cloud Storage and BigQuery. Which two steps should you take to securely provide access without using key files? (Choose two.)

   • AUse the default Compute Engine service account with the cloud-platform access scope
   • BCreate a custom service account with only the required IAM rolesCorrect
   • CAssign the custom service account to the Compute Engine instanceCorrect
   • DDownload a JSON key file and store it on the instance
   ✓ Correct answer: B, C

   The keyless pattern is to create a custom (least-privilege) service account granted only the specific Cloud Storage and BigQuery roles needed, then attach that service account to the Compute Engine instance. Applications on the instance obtain short-lived credentials automatically from the metadata server, so no key file is ever created, stored, or rotated.

   Why the other options are wrong

   • AUsing the default service account with the broad cloud-platform access scope grants far more access than required, violating least privilege, and is not the recommended approach.
   • DDownloading and storing a JSON key file introduces a long-lived credential that must be protected and rotated, exactly what an attached service account avoids.
5. Question 5Ensuring Successful Operation of a Cloud Solution

   Your team needs to perform a rolling update to a managed instance group (MIG) running a web application. You want to update instances gradually, ensuring that at least 80% of instances remain healthy during the update. How should you configure this?

   • ADelete all instances and let the MIG recreate them with the new template
   • BManually update each instance one at a time using gcloud compute instances update
   • CCreate a new MIG with the new template and use a load balancer to shift traffic
   • DUse gcloud compute instance-groups managed rolling-action start-update with --max-unavailable set to 20%Correct
   ✓ Correct answer: D

   A managed rolling update with gcloud compute instance-groups managed rolling-action start-update replaces instances gradually; setting --max-unavailable=20% keeps at least 80% of instances serving throughout the rollout, meeting the availability target.

   Why the other options are wrong

   • ADeleting every instance at once drops capacity to zero, the opposite of keeping 80% healthy.
   • BManually updating instances is slow, error-prone, and bypasses the MIG's controlled rollout and health checks.
   • CStanding up a parallel MIG and shifting traffic is a blue-green pattern that duplicates infrastructure; the requirement is a gradual in-place update.
6. Question 6Configuring Access and Security

   You need to allow a Cloud Function in Project A to write data to a BigQuery dataset in Project B. What should you configure?

   • ACreate a VPC peering connection between the two projects to share data
   • BCopy the BigQuery dataset to Project A so the function can access it locally
   • CGrant the function's service account the BigQuery Data Editor role on the Project B datasetCorrect
   • DCreate a shared VPC host and service project setup between them
   ✓ Correct answer: C

   Cross-project access is granted via IAM: give the Cloud Function's service account roles/bigquery.dataEditor on the target dataset in Project B, and it can write across the project boundary with no data copying or network setup.

   Why the other options are wrong

   • AVPC peering connects private networks; BigQuery access is authorized through IAM, not network peering.
   • BDuplicating the dataset creates stale copies and does not meet the need to write to the Project B dataset.
   • DShared VPC shares network resources across projects; it does not grant BigQuery data access.
7. Question 7Setting Up a Cloud Solution Environment

   A new subsidiary already has a Google Cloud organization tied to its own domain. The parent company wants to consolidate by moving the subsidiary's existing projects into a folder under the parent's organization. What is the recommended first step before the projects can be migrated?

   • AEngage Google Cloud support to migrate the projects, ensuring the appropriate Organization Administrator and Project Mover roles are in place for the cross-organization moveCorrect
   • BChange the billing account on each subsidiary project, which automatically relocates the projects to the parent organization
   • CDelete the subsidiary's organization node so the projects automatically attach to the parent organization
   • DRecreate every subsidiary project from scratch under the parent organization and redeploy all resources
   ✓ Correct answer: A

   Moving projects from one organization to a different organization is not a self-service action; it requires coordinating with Google Cloud support, and the appropriate Organization Administrator and Project Mover permissions must exist on both sides. This is the recommended first step before the projects can be migrated into the parent's folder.

   Why the other options are wrong

   • BChanging a project's billing account affects who pays for it and does not move the project between organizations.
   • CDeleting the subsidiary's organization node does not reparent its projects to the parent; it would orphan or remove access to those resources.
   • DRebuilding every project from scratch is unnecessary and error-prone, losing project IDs and history when the projects can be migrated instead.
8. Question 8Deploying and Implementing a Cloud SolutionSelect all that apply

   You are creating an instance template for a stateless web tier that will back an autoscaled MIG. Which TWO settings belong on the instance template rather than being applied later to the MIG?

   • AThe machine type (for example --machine-type=e2-standard-2)Correct
   • BThe startup script that installs and starts the web serverCorrect
   • CThe autoscaling min and max replica counts
   • DThe target distribution across zones in the region
   ✓ Correct answer: A, B

   An instance template defines the static blueprint for every VM in a MIG - including the machine type, boot disk image, startup script, network tags, and service account. Settings like autoscaling min/max replica counts and zone distribution policy are MIG-level properties configured after the template is created, because they govern the MIG's behavior as a group rather than individual VM configuration.

   Why the other options are wrong

   • CAutoscaling min and max replica counts are set on the MIG itself using gcloud compute instance-groups managed set-autoscaling, not on the instance template, because they control how many VMs the MIG maintains as a fleet.
   • DTarget distribution across zones is a regional MIG property set with --instance-redistribution-type or distribution policies on the MIG, not a per-instance template setting.
9. Question 9Ensuring Successful Operation of a Cloud Solution

   You manage a public DNS zone 'example-com' in Cloud DNS and need to point www.example.com to the IPv4 address 203.0.113.25. Which steps create this record correctly?

   • ACreate a TXT record set for www.example.com with the value 203.0.113.25
   • BReserve a static external IP named www and Cloud DNS will create the record automatically
   • CCreate an A record set for www.example.com with rrdatas=203.0.113.25 in the managed zone 'example-com'Correct
   • DCreate a CNAME record set for www.example.com pointing to 203.0.113.25
   ✓ Correct answer: C

   An A record (Address record) maps a hostname to an IPv4 address in DNS, making it the correct record type to point www.example.com to the IP 203.0.113.25. In Cloud DNS, you create a record set of type A in the managed zone 'example-com' with the target IP as the rrdata value, then execute the transaction to publish the change.

   Why the other options are wrong

   • AA TXT record stores arbitrary text data and is used for purposes like SPF, DKIM, and domain verification - it is not interpreted by DNS resolvers as an address mapping and would not cause browsers to route traffic to 203.0.113.25.
   • BReserving a static external IP in Compute Engine does not automatically create any DNS records - Cloud DNS and Compute Engine IP reservations are independent services; DNS records must always be created explicitly.
   • DA CNAME record maps a hostname to another hostname (canonical name), not to an IP address - pointing www.example.com to an IP like 203.0.113.25 with a CNAME record is invalid DNS and would fail.
10. Question 10Setting Up a Cloud Solution Environment

    A regulated enterprise must guarantee that engineers can only deploy resources in EU regions across every current and future project, and that this restriction cannot be bypassed by individual project owners. Which configuration BEST achieves this?

    • ASet the org policy constraint 'constraints/gcp.resourceLocations' at the organization node, allowing only EU regionsCorrect
    • BCreate a custom role that omits compute.instances.create outside europe-west and assign it organization-wide
    • CConfigure a VPC Service Controls perimeter that only includes EU regions and services
    • DApply the IAM condition 'resource.location startsWith europe' to every Owner role binding in each project
    ✓ Correct answer: A

    The resource location restriction constraint (constraints/gcp.resourceLocations) is a list constraint that limits the physical locations where location-based resources can be created. Setting it at the organization node means it is inherited by every existing and future folder and project, and because organization policies are evaluated independently of IAM and cannot be overridden by project owners (unless inheritance is explicitly allowed), it provides the enforced guardrail required. Google provides value groups like in:eu-locations to make EU-only enforcement straightforward.

    Why the other options are wrong

    • BA custom role only controls a single permission name and does not generically enforce location across all resource types and APIs.
    • CVPC Service Controls protect API data exfiltration across a service perimeter; they do not restrict the regions in which new resources may be created.
    • DIAM conditions on Owner bindings do not reliably constrain resource location for all services, are easy to bypass with other roles, and must be replicated everywhere - not a scalable enforced guardrail.

Related Google resources

• GCP Associate Cloud Engineer study guideKey concepts
• Google practice examsAll Google
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• Google Cloud Professional Cloud Security Engineer practice examRelated
• Google Cloud Professional Cloud Network Engineer practice examRelated
• Associate Google Workspace Administrator practice examRelated

GCP Associate Cloud Engineer practice exam FAQ