Google Associate Cloud Engineer practice exam: 10 free questions, every option explained

Several administrators and scripts grant roles in prj-hr-app. You need to add one binding for a new group with the LEAST risk of overwriting changes that others make at the same time. What should you do?

• ARun gcloud projects add-iam-policy-binding, which updates the current policy and uses its etag to detect concurrent changes
  Correct. add-iam-policy-binding reads the live policy, adds one binding, and writes it back with the etag, so a concurrent change isn't silently lost.
• BEdit a policy file that you downloaded last week and apply it with gcloud projects set-iam-policy
  set-iam-policy replaces the whole policy; a week-old file would drop every change made since it was downloaded.
• CDelete the etag field from your downloaded policy file before set-iam-policy so the update never fails
  Removing the etag turns off the concurrency check, so your write can overwrite bindings that others added in the meantime.
• DGrant the group the Owner role, so other administrators never need to edit the policy again
  A basic Owner grant is far too broad and doesn't address concurrent policy edits at all.

You run gcloud billing budgets create --billing-account=01A2B3-C4D5E6-F7A8B9 --display-name=web-prod --budget-amount=5000USD --threshold-rule=percent=0.9 --threshold-rule=percent=1.0,basis=forecasted-spend. Which statement describes the alerts this budget sends?

• ASpending in the billing account stops automatically once it reaches 5,000 USD
  Alerts-only budgets never stop spending; they only send notifications.
• BBoth alerts are based on forecasted spend, at 90% and at 100% of 5,000 USD
  Only the second rule sets basis=forecasted-spend; the first uses actual spend.
• CAlerts at 90% and 100% of actual spend, because the forecast basis applies only to next month's period
  The forecast rule compares the forecast for the current period, not the next period, with the budget amount.
• DAn alert at 90% of 5,000 USD actual spend, and one when forecasted spend reaches 5,000 USD
  Correct. A rule without a basis uses actual (current) spend; basis=forecasted-spend compares the end-of-period forecast with the amount.

A company still has infrastructure templates written for Cloud Deployment Manager, which reached end of support on March 31, 2026. The company wants the migration path that Google documents and to keep a managed Google Cloud service running the deployments. What should you recommend?

• ARewrite the templates in Terraform and deploy them with Infrastructure Manager
  Correct. Google documents migration from Deployment Manager, which reached end of support, to Infrastructure Manager, a managed service that runs Terraform.
• BKeep the templates and freeze all infrastructure changes
  The tool reached end of support, so freezing changes leaves templates on an unsupported service and blocks the business.
• CConvert the templates into Helm charts installed on a GKE cluster
  Helm installs applications on Kubernetes; it is not a replacement for infrastructure templates.
• DConvert the templates into Config Connector manifests on a new GKE cluster
  Config Connector can manage resources, but it means operating a GKE cluster and is not the documented managed migration target.

Exhibit (VPC firewall rules in vpc-shop): deny-all-in: INGRESS, deny, all protocols, source 0.0.0.0/0, all instances, priority 1000. allow-web: INGRESS, allow, tcp:443, source 0.0.0.0/0, target tag web, priority 1000. allow-iap-ssh: INGRESS, allow, tcp:22, source 35.235.240.0/20, all instances, priority 900. A client on the internet sends HTTPS to a VM tagged web. What happens?

• AThe connection is blocked, because at equal priority a deny rule wins over an allow rule.
  Correct. Both rules match at priority 1000, and deny overrides allow only at the same priority, which is the case here.
• BThe connection is allowed, because allow-web targets a specific tag and the more specific rule wins.
  Target specificity does not matter in VPC firewall rules; priority decides, then deny over allow at the same priority.
• CThe connection is allowed, because allow-web names a specific port while deny-all-in matches all ports.
  A narrower protocol or port does not win either; both rules match at priority 1000, so the deny applies.
• DThe connection is blocked by the implied deny ingress rule, because no rule has priority 0.
  The implied rule acts only when nothing matches; deny-all-in matches first. The fix is a lower number for allow-web, such as 900.

Which TWO statements about Cloud Storage storage classes are accurate? (Choose TWO.)

• AObjects in Archive storage are available within milliseconds, not hours
  Correct. Archive has no offline retrieval step; its data is available within milliseconds.
• BColdline storage has a 30-day minimum storage duration, like Nearline
  Coldline's minimum storage duration is 90 days; 30 days is Nearline's.
• CA bucket's new default class does not change objects already in it
  Correct. The default class applies to objects added later; existing objects keep their class unless rewritten or changed by a lifecycle rule.
• DNearline storage has no data retrieval fees
  Nearline, Coldline and Archive all charge retrieval fees; Standard does not.
• EStandard storage has a 30-day minimum storage duration
  Standard has no minimum storage duration.

Service checkout has revisions checkout-00012-abc (current, 100%) and checkout-00013-xyz (new). You must send 10% of traffic to the new revision and keep 90% on the current one. Which command should you run?

• Agcloud run services update-traffic checkout --to-latest --region=us-central1
  This sends 100% of traffic to the latest revision at once.
• Bgcloud run services update-traffic checkout --to-revisions=checkout-00012-abc=90,checkout-00013-xyz=10 --region=us-central1
  Correct. It assigns explicit percentages to each revision.
• Cgcloud run services update checkout --max-instances=10 --region=us-central1
  This caps the number of instances; it does not split traffic.
• Dgcloud run services update-traffic checkout --to-revisions=checkout-00012-abc=10,checkout-00013-xyz=90 --region=us-central1
  The percentages are reversed: 90% would go to the new revision.

A retail analytics team writes daily CSV extracts to gs://rt-extracts. Each extract is read often during its first 30 days, then about once a month for audits, and must be deleted three years after creation. You need to configure this MOST cost-effectively with the LEAST operational overhead. What should you do?

• AAdd lifecycle rules: SetStorageClass to ARCHIVE at age 30, and Delete at age 1095
  Archive targets data read less than once a year; monthly audit reads would add retrieval charges every time.
• BRun a daily Cloud Scheduler job that rewrites extracts older than 30 days to NEARLINE and deletes those older than three years
  It could work, but you must build, run and maintain the job; lifecycle rules do the same thing with no code.
• CKeep all extracts in STANDARD and add only a Delete lifecycle rule at age 1095
  Deletion is handled, but storing monthly-read data in Standard for three years costs more than Nearline.
• DAdd lifecycle rules: SetStorageClass to NEARLINE at age 30, and Delete at age 1095
  Correct. Nearline fits data read about once a month, and lifecycle rules apply both the class change and the deletion automatically with no code to run.

The standalone VM build-07 disappeared from prj-ci yesterday. You must find out who deleted it. Which Logs Explorer query should you start with?

• AlogName:"cloudaudit.googleapis.com%2Factivity" AND protoPayload.methodName:"compute.instances.delete"
  Correct. Deleting a VM is an administrative write, recorded in the Admin Activity audit log with the caller's identity.
• BlogName:"cloudaudit.googleapis.com%2Fdata_access" AND protoPayload.methodName:"compute.instances.delete"
  Data Access logs record reads and data writes; a VM deletion is an Admin Activity event.
• Cresource.type="gce_instance" AND severity>=ERROR
  A successful deletion is not logged as an error, so this query would likely miss it.
• DlogName:"cloudaudit.googleapis.com%2Fsystem_event" AND protoPayload.methodName:"compute.instances.delete"
  System Event logs record actions taken by Google systems, not a user deleting a standalone VM.

A finance analyst runs gcloud storage ls gs://fin-reports --impersonate-service-account=reporter@prj-fin.iam.gserviceaccount.com and gets PERMISSION_DENIED for iam.serviceAccounts.getAccessToken. The reporter account can read the bucket, and access must go only through that account. What is the LEAST privileged grant that fixes this?

• AThe Service Account User role on reporter@prj-fin.iam.gserviceaccount.com to the analyst
  Service Account User allows attaching the account to resources, not generating its tokens.
• BThe Storage Object Viewer role on gs://fin-reports to the analyst's own user account
  This gives the analyst direct access, which the requirement rules out.
• CThe Service Account Token Creator role on the analyst's user account to reporter
  The direction is reversed; the analyst needs the role on the service account.
• DThe Service Account Token Creator role on reporter@prj-fin.iam.gserviceaccount.com to the analyst
  Correct. Impersonation needs iam.serviceAccounts.getAccessToken on the target account, which Token Creator provides.

Pods in a GKE Autopilot cluster must query BigQuery. Which approach is BEST for giving them credentials, following Google-recommended practices?

• AA service account key stored as a Kubernetes Secret
  Keys are long-lived and can leak; they are the approach to avoid.
• BWorkload Identity Federation for GKE
  Correct. It gives each workload its own IAM identity with short-lived credentials and no keys.
• CGranting BigQuery roles to the node pool's service account
  Every Pod on those nodes would share the access, which breaks least privilege.
• DAn API key passed to the Pods as an environment variable
  API keys do not carry an IAM identity for BigQuery data access.