GCP Associate Cloud Engineer Practice Exam

What the GCP Associate Cloud Engineer exam covers

• Setting up a cloud solution environment148 questions
• Planning and implementing a cloud solution335 questions
• Ensuring the successful operation of a cloud solution155 questions
• Configuring access and security128 questions

Free GCP Associate Cloud Engineer practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 766.

1. Question 1Setting up a cloud solution environment

   A mid-sized company is starting its cloud journey on Google Cloud. The CTO wants to ensure that each department - engineering, marketing, and finance - has its own isolated set of resources with separate billing. Which approach should you recommend?

   • ACreate separate folders for each department but use a single shared project
   • BCreate a single project and use labels to separate resources by department
   • CCreate a separate project per department, each with its own billing accountCorrect
   • DCreate separate VPCs within one project for each department's resources
   ✓ Correct answer: C

   In Google Cloud the project is the base unit of resource isolation, IAM boundaries, and billing association. Giving each department its own project under the organization node isolates their resources, and linking each project to its own Cloud Billing account produces cleanly separated invoices per department.

   Why the other options are wrong

   • AFolders can group projects, but a single shared project links to exactly one billing account, so departments get neither separate billing nor resource isolation.
   • BLabels are only metadata for filtering and cost breakdown; they do not isolate resources, and everything still shares one project and one billing account.
   • DMultiple VPCs in one project separate networking only; the resources still share one project's IAM and a single billing account, so billing is not separated.
2. Question 2Ensuring the successful operation of a cloud solution

   Your company's Cloud Logging is generating 50 GB of logs per day, resulting in high storage costs. Many of the logs are debug-level logs from non-production environments that do not need to be retained. How should you reduce logging costs?

   • ADelete all log entries older than 24 hours from the sink
   • BCreate exclusion filters on the _Default sink to drop non-production debug logsCorrect
   • CUpgrade to a higher Cloud Logging pricing tier for volume discounts
   • DDisable Cloud Logging entirely for non-production projects
   ✓ Correct answer: B

   Cloud Logging bills primarily for ingestion into log buckets, so adding an exclusion filter on the _Default sink that matches debug-severity logs from non-production projects stops those entries from being ingested and billed. You set it with gcloud logging sinks update _Default --add-exclusion. This cuts volume while preserving important production logs.

   Why the other options are wrong

   • ADeleting entries older than 24 hours is not how Logging cost works; you control it through retention and exclusions, and short retention still incurs ingestion charges.
   • CThere is no higher tier that discounts volume this way; ingestion is billed per GiB, so reducing volume, not upgrading, lowers cost.
   • DDisabling Logging entirely for non-production removes useful logs you may still need for debugging and is broader than excluding only debug-level entries.
3. Question 3Setting up a cloud solution environment

   What happens when you shut down (delete) a GCP project?

   • AAll resources are immediately and permanently deleted
   • BOnly compute resources are deleted; storage resources are retained
   • CThe project enters a 30-day recovery period before permanent deletionCorrect
   • DThe project is archived and can be restored at any time
   ✓ Correct answer: C

   Deleting (shutting down) a project moves it to a pending-deletion state for about 30 days rather than removing it instantly. During that window an owner can restore it with `gcloud projects undelete`; after the window the project and all its resources are permanently deleted. Resources stop functioning during the pending period.

   Why the other options are wrong

   • ADeletion is not immediate; the project first spends about 30 days in a recoverable pending-deletion state.
   • BDeletion applies to the whole project; storage is not selectively retained while compute is removed.
   • DRecovery is time-limited to roughly 30 days, not indefinite archival that can be restored at any time.
4. Question 4Planning and implementing a cloud solutionSelect all that apply

   You are creating a Pub/Sub messaging system for your application. Which two resources must you create? (Choose two.)

   • AA Pub/Sub subscriptionCorrect
   • BA Pub/Sub broker
   • CA Pub/Sub topicCorrect
   • DA Pub/Sub queue
   ✓ Correct answer: A, C

   In Pub/Sub, publishers send messages to a topic, and each subscription attached to that topic delivers a copy of those messages to a subscriber. You therefore need both a topic to publish to and at least one subscription to receive from. Pub/Sub is fully managed, so there is no broker or queue resource to create.

   Why the other options are wrong

   • BPub/Sub is a fully managed service with no broker resource to provision; routing is handled internally between topics and subscriptions.
   • DPub/Sub has no 'queue' resource type; message buffering and delivery are handled by subscriptions, not a separately created queue.
5. Question 5Ensuring the successful operation of a cloud solutionSelect all that apply

   StreamLine Corp is monitoring their Cloud Run services. Which two metrics are available in Cloud Monitoring for Cloud Run without any additional configuration? (Choose two.)

   • ADatabase query performance metrics
   • BApplication-specific custom metrics
   • CRequest count and request latencyCorrect
   • DContainer instance count and billable instance timeCorrect
   ✓ Correct answer: C, D

   Cloud Run sends built-in metrics to Cloud Monitoring with no setup: request count and request latency describe traffic and performance, while container instance count and billable instance time describe scaling and cost. Anything application-specific requires you to instrument custom metrics.

   Why the other options are wrong

   • ADatabase query metrics come from the database service such as Cloud SQL, not from the Cloud Run request layer.
   • BCustom metrics exist only after you instrument your code to write them; they are not provided automatically.
6. Question 6Configuring access and security

   Which IAM entity should you use to allow a GKE workload to authenticate to other GCP services without using service account keys?

   • AWorkload IdentityCorrect
   • BService account key file mounted as a Kubernetes secret
   • CUser account with OAuth token
   • DAPI key
   ✓ Correct answer: A

   Workload Identity Federation for GKE maps a Kubernetes service account to a Google service account, so Pods pull short-lived credentials from the metadata server and call Google Cloud APIs without any exported key file. This removes long-lived key management and is Google's recommended way for GKE workloads to authenticate.

   Why the other options are wrong

   • BA mounted service account key file is exactly the long-lived key the requirement rules out; keys can leak and must be rotated by hand.
   • CA user account with an OAuth token represents a human identity and is not intended for unattended workload authentication.
   • DAn API key only identifies a project for a limited set of APIs and carries no IAM identity for service-to-service calls.
7. Question 7Setting up a cloud solution environment

   Before enabling the Cloud SQL Admin API on a new project, your team wants to confirm which other APIs that service depends on so nothing is missed. Which gcloud command shows the dependency and metadata details for the sqladmin.googleapis.com service?

   • Agcloud services info sqladmin.googleapis.com
   • Bgcloud services operations describe sqladmin.googleapis.com
   • Cgcloud services list sqladmin.googleapis.com
   • Dgcloud services describe sqladmin.googleapis.comCorrect
   ✓ Correct answer: D

   'gcloud services describe' retrieves the full service configuration from the Service Usage API, including the display name, documentation URI, dependencies on other services, and current enablement state. For sqladmin.googleapis.com this reveals which dependent APIs will also need to be enabled, preventing surprises during deployment. This is the right first step before running 'gcloud services enable' on a new project.

   Why the other options are wrong

   • Agcloud services info is not a valid subcommand - the correct subcommand for retrieving metadata about a specific service is 'gcloud services describe'.
   • Bgcloud services operations describe is used to retrieve the status of a long-running operation returned by a previous services command - it does not describe the service itself or show its dependencies.
   • Cgcloud services list is used to enumerate all services (with optional filters) and does not accept a service name as an argument to retrieve metadata about a single service.
8. Question 8Planning and implementing a cloud solutionSelect all that apply

   You are deploying a containerized app to fully managed Cloud Run from source code (no prebuilt image). Which TWO statements about gcloud run deploy --source are correct?

   • ACloud Run uses Cloud Build to build the container image automatically, using a Dockerfile or buildpacks if presentCorrect
   • BThe built image is stored in Artifact Registry before the service is deployedCorrect
   • CYou must first run docker build and docker push to Artifact Registry yourself before the --source flag will deploy
   • DThe --source flag can only be used with Cloud Functions deployments, not with Cloud Run services
   ✓ Correct answer: A, B

   'gcloud run deploy --source' uploads your code, triggers a Cloud Build build from your Dockerfile or buildpacks, stores the resulting image in Artifact Registry, then deploys it as a new Cloud Run revision - all in one workflow, with no manual docker commands needed.

   Why the other options are wrong

   • CRunning docker build and push yourself is the manual flow that --source exists to avoid; with --source, Cloud Build creates and pushes the image for you.
   • D--source is a valid, commonly used gcloud run deploy flag; Cloud Functions instead uses gcloud functions deploy with a source directory.
9. Question 9Configuring access and security

   You need to grant the user jdoe@example.com the Compute Viewer role (roles/compute.viewer) on the project my-prod-project. Which gcloud command grants this single binding without overwriting the rest of the project's IAM policy?

   • Agcloud projects set-iam-policy my-prod-project --member="user:jdoe@example.com" --role="roles/compute.viewer"
   • Bgcloud projects add-iam-policy-binding my-prod-project --member="user:jdoe@example.com" --role="roles/compute.viewer"Correct
   • Cgcloud iam roles add my-prod-project --member="user:jdoe@example.com" --role="roles/compute.viewer"
   • Dgcloud projects update my-prod-project --add-member="user:jdoe@example.com" --role="roles/compute.viewer"
   ✓ Correct answer: B

   The 'gcloud projects add-iam-policy-binding' command performs a read-modify-write of the IAM policy by adding exactly one new binding without disturbing existing bindings. Specifying the project, member in the format 'user:email', and the full role name is sufficient to grant the role. This is the safe, atomic way to add a single binding compared to set-iam-policy, which replaces the entire policy.

   Why the other options are wrong

   • A'gcloud projects set-iam-policy' replaces the entire IAM policy with a new policy provided from a file - it does not accept individual --member and --role flags and would overwrite all existing bindings if misused.
   • C'gcloud iam roles add' is not a valid gcloud command - roles are created with 'gcloud iam roles create' or modified with 'gcloud iam roles update'; granting a role to a member uses the add-iam-policy-binding command.
   • D'gcloud projects update' modifies project metadata such as name or labels - it does not have --add-member or --role flags and cannot modify IAM bindings.
10. Question 10Planning and implementing a cloud solutionSelect all that apply

    When planning Cloud Storage for a new workload, an architect must choose storage classes and account for their cost trade-offs. Which TWO statements are correct?

    • AArchive class has the lowest storage price but the highest retrieval/access cost and a 365-day minimum storage durationCorrect
    • BColdline has a 90-day minimum storage duration and suits data accessed roughly once per quarterCorrect
    • CChanging an object's storage class always requires re-uploading the object from the client application
    • DStandard class incurs the highest at-rest storage price and also charges the highest per-GB retrieval fees
    ✓ Correct answer: A, B

    Cloud Storage classes trade lower at-rest price for higher access cost and longer minimums: Standard (frequent), Nearline (30-day, ~monthly), Coldline (90-day, ~quarterly), and Archive (365-day, lowest price, highest retrieval cost). Lifecycle rules or a class-change operation move objects server-side without re-uploading.

    Why the other options are wrong

    • CAn object's class can change via lifecycle rules or a server-side rewrite/class-change; re-uploading from the client is not required.
    • DStandard has the highest storage price but the lowest retrieval fees; colder classes like Coldline and Archive carry the higher retrieval costs.

Who this GCP Associate Cloud Engineer practice exam is for

This practice set is for anyone preparing for the GCP Associate Cloud Engineer exam at the intermediate level - from first-time candidates building a foundation to experienced Google practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this GCP Associate Cloud Engineer practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real GCP Associate Cloud Engineer exam.

Related Google resources

• GCP Associate Cloud Engineer study guideKey concepts
• Google practice examsAll Google
• Certification pathWhere this fits
• GCP Associate Cloud Engineer vs Cloud ArchitectComparison
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• Google Cloud Associate Data Practitioner practice examRelated
• Google Cloud Generative AI Leader practice examRelated
• Google Cloud Professional Cloud Architect practice examRelated

GCP Associate Cloud Engineer practice exam FAQ