Associate Cloud Engineer

Question 1

A startup is deploying a stateless Python web application that receives highly variable traffic, including long idle periods overnight. The team has no operations staff and wants a fully managed platform that automatically scales down to zero instances when there is no traffic to minimize cost, while requiring the least configuration effort. Which compute option should they choose?

Accepted Answer

App Engine standard environment with automatic scaling

Answer

A Compute Engine managed instance group with autoscaling based on CPU utilization

Answer

A GKE Standard cluster running the app as a Deployment with a Horizontal Pod Autoscaler

Answer

App Engine flexible environment with automatic scaling

Question 2

A critical firewall rule protecting your production VPC was unexpectedly deleted, causing a brief security exposure. Your security team asks you to identify exactly which user or service account deleted the firewall rule and when. Which Google Cloud audit log type should you examine to find this information?

Accepted Answer

Admin Activity audit logs

Answer

Data Access audit logs

Answer

System Event audit logs

Answer

Policy Denied audit logs

Question 3

Your data analytics team needs to run ad-hoc SQL queries across several petabytes of historical clickstream data stored as structured tables. Queries run a few times a day, must return aggregated results within minutes, and the team does not want to manage any servers or provision capacity in advance. Which Google Cloud data service should you choose?

Accepted Answer

BigQuery

Answer

Cloud SQL for PostgreSQL with a high-memory instance

Answer

Cloud Bigtable with a large SSD cluster

Answer

Firestore in Native mode

Question 4

A financial analytics company is building a platform that ingests millions of stock trade events per second and must support single-digit millisecond read latency for key-based lookups. The access pattern is always by a row key (symbol + timestamp), and the total dataset is expected to grow into the hundreds of terabytes. The team does not need SQL joins or ACID multi-row transactions. Which Google Cloud data service should they choose?

Accepted Answer

Cloud Bigtable

Answer

Cloud SQL for PostgreSQL with high-availability configuration

Answer

BigQuery with streaming inserts

Answer

Firestore in Native mode

Question 5

Your company's finance team wants a specific employee, Maria, to be able to create new Cloud Billing accounts for different departments directly under the organization. Maria should not receive broad administrative rights over the organization itself. Which action grants Maria the minimum access needed to create new billing accounts?

Accepted Answer

Grant Maria the Billing Account Creator role (roles/billing.creator) at the organization level

Answer

Grant Maria the Organization Administrator role (roles/resourcemanager.organizationAdmin) at the organization level

Answer

Grant Maria the Billing Account Administrator role (roles/billing.admin) on an existing billing account

Answer

Grant Maria the Billing Account User role (roles/billing.user) at the organization level

Question 6

Your company is onboarding to Google Cloud for the first time. You have been asked to create the very first billing account so that projects can be linked and start incurring charges. When you attempt to create the billing account in the Google Cloud console, what is required before the billing account can be successfully set up?

Accepted Answer

A Cloud Billing payment profile that includes a valid form of payment (such as a credit card or bank account) and business/tax information

Answer

At least one existing project that has already been linked to a different billing account

Answer

The Billing Account Administrator IAM role granted at the organization node

Answer

A committed use discount contract signed with Google Cloud sales

Question 7

Your company acquired a small startup that has one Google Cloud project running production workloads under its own separate billing account. Finance wants the acquired project's charges to appear on your organization's existing billing account starting next month, with no downtime for the running resources. What should you do?

Accepted Answer

In the acquired project's billing settings, change the billing account to your organization's billing account, ensuring you have the Billing Account Administrator role on the target account and Project Billing Manager on the project.

Answer

Delete the acquired project and recreate it under your organization's billing account, then redeploy all resources.

Answer

Close the startup's billing account, which will automatically reassign its linked projects to your organization's billing account.

Answer

Export the startup's billing data to a BigQuery dataset in your organization so the charges consolidate onto your billing account.

Question 8

Your company has a single Cloud Billing account managed by the finance team. A project lead named Priya needs the ability to link the new projects she creates to the existing billing account, but finance does not want her to be able to modify billing account settings, view all account cost data across the organization, or manage other users' billing roles. Following least privilege, which IAM role should you grant Priya on the billing account?

Accepted Answer

Billing Account User (roles/billing.user)

Answer

Billing Account Administrator (roles/billing.admin)

Answer

Billing Account Viewer (roles/billing.viewer)

Answer

Project Billing Manager (roles/billing.projectManager)

Question 9

Your finance team lead needs to view and download the monthly invoices and payment history for your organization's billing account, but she should not be able to modify billing settings, link projects, or change the payment method. You want to follow the principle of least privilege. Which IAM role should you grant her on the billing account?

Accepted Answer

Billing Account Viewer

Answer

Billing Account Administrator

Answer

Billing Account User

Answer

Billing Account Costs Manager

Question 10

Your finance team wants automated cost controls for a development project. When the project's spending reaches its monthly budget, an internal system must automatically trigger a script that disables billing on the project to prevent further charges. You are configuring the budget in the Google Cloud console. Which budget setting must you enable so your automation can react to budget threshold events programmatically?

Accepted Answer

Connect a Pub/Sub topic to the budget so threshold notifications are published as messages

Answer

Add the finance team's email addresses to the budget's email notification recipients

Answer

Enable a Cloud Monitoring notification channel on the budget alert

Answer

Set the budget scope to the entire billing account instead of a single project

Question 11

Your finance team wants detailed, near-real-time billing data (including labels and per-SKU usage) available for SQL analysis. As the project owner with the required billing permissions, what is the correct way to make this data continuously available?

Accepted Answer

In Billing > Billing export, enable Detailed usage cost export and select a BigQuery dataset as the destination

Answer

Manually download the monthly CSV invoice from the billing console and upload it to a Cloud Storage bucket each month

Answer

Create a Cloud Monitoring dashboard that charts the billing account's spend metrics for the finance team

Answer

Run 'gcloud billing accounts list' on a daily schedule and pipe the output into a BigQuery table

Question 12

Your finance team wants to perform detailed, granular analysis of Google Cloud spending using SQL queries, including custom dashboards that break down costs by label and SKU over time. They need the raw, itemized billing data available for querying. As the Associate Cloud Engineer, what should you configure to meet this requirement?

Accepted Answer

Configure Cloud Billing data export to a BigQuery dataset.

Answer

Set up a Cloud Billing budget with alert thresholds and enable programmatic notifications via Pub/Sub.

Answer

Export the billing reports as CSV files from the Cost Table page each month.

Answer

Enable Cloud Billing data export to a Cloud Storage bucket in Parquet format.

Question 13

Your finance team wants to build a chargeback report in BigQuery that combines resource usage costs with the current list prices for each SKU so they can model potential savings from committed use discounts. You have already enabled standard usage cost export to BigQuery. What additional configuration must you perform in the Cloud Billing console?

Accepted Answer

Enable the pricing data export to the same or another BigQuery dataset for the billing account

Answer

Enable detailed usage cost export, which automatically includes SKU list prices

Answer

Grant the finance team the Billing Account Viewer role so pricing appears in the usage export table

Answer

Create a Cloud Monitoring metric that scrapes SKU prices and writes them to BigQuery

Question 14

Your company is a Google Cloud reseller managing workloads for several independent client organizations. Finance requires that each client's charges appear on a separate invoice while all invoices roll up under your company's single payments profile for consolidated payment. Which approach should you use?

Accepted Answer

Create a separate Cloud Billing subaccount for each client under your master billing account, then link each client's projects to their subaccount.

Answer

Create one billing account and use budget alerts with per-client labels to split the charges at invoice time.

Answer

Create a completely separate payments profile and billing account for each client so invoices are fully isolated.

Answer

Link all client projects to a single billing account and use BigQuery billing export to generate separate reports per client.

Question 15

Your company has one Cloud Billing account that pays for all Google Cloud usage. The finance team wants each of the three business units to see and manage its own subset of projects and spending, while the overall payment and invoicing must remain centralized under the single master billing account. What should you do to give each business unit a view into and control over only its own projects' costs, without creating separate paid invoices?

Accepted Answer

Group each business unit's projects into folders, then grant each unit the Billing Account Viewer role on the master billing account so they can filter reports by folder.

Answer

Create a separate self-serve Cloud Billing account for each business unit and link that unit's projects to it.

Answer

Grant each business unit the Billing Account Administrator role on the single master billing account and rely on project-level filtering.

Answer

Use budgets and alerts scoped to each business unit's projects and share Cloud Monitoring dashboards with the respective teams.

Question 16

Your organization has a single billing account linked to 40 projects. The finance team wants to identify which specific project incurred the highest Compute Engine costs last month, and they want to do this directly in the Cloud Console without setting up any external tooling or exports. What is the most direct way to provide this information?

Accepted Answer

Open the Billing account's Reports page and group costs by project, then filter by the Compute Engine service.

Answer

Enable a BigQuery billing export and write a SQL query that aggregates cost by project.

Answer

Create a separate budget with alerts for each of the 40 projects and compare the alert thresholds.

Answer

Ask each project owner to open the project's Compute Engine dashboard and report their monthly spend.

Question 17

Your finance team wants to be notified before a project's monthly spending exceeds its allocated budget, not just after the actual costs cross the threshold. They want an alert triggered when the projected end-of-month cost is expected to reach 100% of the $5,000 budget. As the Cloud Engineer, how should you configure this in a Cloud Billing budget?

Accepted Answer

Create a budget of $5,000 and add an alert threshold rule based on forecasted spend set to 100%.

Answer

Create a budget of $5,000 and add an alert threshold rule based on actual spend set to 100%.

Answer

Set a budget of $5,000 and configure a Cloud Monitoring alerting policy on the billing metric with a 100% forecasted threshold.

Answer

Create a budget of $5,000 and enable programmatic budget notifications to Pub/Sub, then write a Cloud Function to predict spend.

Question 18

A manufacturing company is deploying thousands of IoT sensors that will emit device metrics at very high throughput (hundreds of thousands of writes per second). The team needs a fully managed database optimized for time-series and high-volume single-key lookups, with low-latency reads and writes, that can scale horizontally. Which Google Cloud data service should they choose?

Accepted Answer

Cloud Bigtable

Answer

Cloud SQL for PostgreSQL

Answer

Firestore in Native mode

Answer

BigQuery

Question 19

Your company is decommissioning an old development project. Finance wants to ensure no further charges accrue for the resources in that specific project, but the same billing account is still actively used by dozens of other production projects. What should you do?

Accepted Answer

Disable billing on the individual project by unlinking it from the billing account.

Answer

Close the entire billing account so that all charges stop immediately.

Answer

Set a budget of $0 with an alert threshold on the billing account.

Answer

Remove the Billing Account User role from all members of the project.

Question 20

Your company runs several internal microservices on Compute Engine VMs within a single VPC network. Developers need to reach these services using friendly hostnames like api.internal.example.com instead of internal IP addresses, and these names must NOT be resolvable from the public internet. What should you configure?

Accepted Answer

Create a Cloud DNS private managed zone for internal.example.com and authorize the VPC network to use it

Answer

Create a Cloud DNS public managed zone for internal.example.com and add A records for each service

Answer

Add entries mapping each hostname to its internal IP in the /etc/hosts file of every VM manually

Answer

Register internal.example.com with an external domain registrar and point it to the VMs' external IPs

Question 21

Your team runs a photo-sharing app. Whenever a user uploads an original image to a Cloud Storage bucket, you must automatically generate a thumbnail and write it to a second bucket. The processing code takes a few seconds per image, there is no steady traffic pattern, and the team wants to avoid managing any servers or clusters. Which compute option best fits this requirement?

Accepted Answer

Deploy a Cloud Function triggered by the Cloud Storage object finalize event.

Answer

Create a Compute Engine managed instance group that polls the bucket for new objects.

Answer

Run a GKE Standard cluster with a Deployment that watches the bucket.

Answer

Deploy the code to App Engine standard and configure a cron job to scan the bucket every minute.

Question 22

Your security team needs to retain and analyze all Cloud Audit Logs from a production project for at least two years, and they want to run SQL queries against the log data to investigate access patterns. By default, admin activity logs are only retained for 400 days in Cloud Logging. What should you configure to meet these requirements?

Accepted Answer

Create a log sink in Cloud Logging that exports the audit logs to a BigQuery dataset.

Answer

Increase the retention period of the _Default log bucket to 730 days.

Answer

Create a log-based metric for the audit logs and build a Cloud Monitoring dashboard.

Answer

Enable Data Access audit logs and download the entries manually each month.

Question 23

Your compliance team requires that application logs for a production project be retained for 400 days, but the default _Default log bucket in Cloud Logging keeps logs for only 30 days. You want to meet the requirement with the least ongoing operational effort and without exporting logs to another service. What should you do?

Accepted Answer

Edit the retention period of the _Default log bucket (or create a custom log bucket) and set it to 400 days.

Answer

Create a Pub/Sub sink that streams all logs to a Cloud Function that writes them to a Cloud Storage bucket with a 400-day lifecycle rule.

Answer

Create a scheduled Cloud Run job that copies logs from Cloud Logging to BigQuery every night and deletes them after 400 days.

Answer

Enable Data Access audit logs on the project so that logs are automatically retained for one year.

Question 24

Your team runs a fleet of Compute Engine VMs and needs Cloud Monitoring dashboards to show detailed guest-level metrics such as disk I/O and process-level CPU usage. Currently the dashboards only display default hypervisor-level metrics like network traffic and disk throughput reported by the VM instance. What should you do to collect the additional guest-level metrics?

Accepted Answer

Install and configure the Ops Agent on each VM instance.

Answer

Enable Cloud Monitoring at the project level in the Cloud Console.

Answer

Create a log-based metric that extracts disk I/O values from the system logs.

Answer

Grant the Monitoring Viewer role to the VM service account.

Question 25

Your team runs a fleet of IoT gateway devices that push a custom metric named 'device/heartbeat' to Cloud Monitoring every 60 seconds. Operations wants to be paged automatically if any device stops reporting its heartbeat entirely, indicating the gateway has gone offline. What is the most appropriate way to configure this alerting policy in Cloud Monitoring?

Accepted Answer

Create an alerting policy with a metric-absence condition on 'device/heartbeat', grouped by device, that triggers when data is missing for a chosen duration.

Answer

Create a metric-threshold alerting policy that fires when 'device/heartbeat' is greater than 0 for 5 minutes.

Answer

Create an uptime check pointed at each device's IP address and alert when the check fails.

Answer

Create a log-based metric that counts heartbeat log entries and alert when the count exceeds a threshold.

Question 26

You operate a fleet of Compute Engine VMs behind a load balancer. Operations wants to be paged only when BOTH average CPU utilization exceeds 85% AND request latency exceeds 500ms for a sustained 5-minute window, to avoid noisy alerts during isolated spikes. Using Cloud Monitoring, what is the correct way to configure this?

Accepted Answer

Create a single alerting policy with two conditions and set the policy trigger to fire only when all conditions are met (combined with AND logic).

Answer

Create two separate alerting policies, one for CPU and one for latency, each with its own notification channel.

Answer

Create a single alerting policy with two conditions and set the trigger to fire when any condition is met (OR logic).

Answer

Create a log-based metric that counts high-CPU log entries and alert when the count exceeds a threshold.

Question 27

Your team runs a fleet of Compute Engine VMs behind Cloud Monitoring. You created an alerting policy on CPU utilization that fires every time a brief scheduled cron job spikes CPU above 90% for a few seconds, generating dozens of false pages each night. You want to reduce these transient alerts without raising the threshold value. What should you configure on the alerting condition?

Accepted Answer

Increase the retest window (duration) so the condition must remain violated for a sustained period before the alert triggers

Answer

Change the notification channel from PagerDuty to email so alerts arrive less urgently

Answer

Add a log-based metric that counts cron job executions and alert on that instead

Answer

Reduce the alerting policy's auto-close duration so alerts resolve faster

Question 28

Your team runs a fleet of Compute Engine VMs hosting a memory-intensive application. In Cloud Monitoring you can see CPU utilization for each VM, but you cannot find any memory usage metrics to build a dashboard chart. What must you do to collect and visualize per-VM memory utilization?

Accepted Answer

Install the Ops Agent on the VMs so that memory metrics are collected and reported to Cloud Monitoring.

Answer

Enable the Compute Engine API in the project to expose additional built-in memory metrics.

Answer

Create a log-based metric that parses memory values from the serial console output.

Answer

Grant the Monitoring Viewer role to the VM service account so it can publish memory data.

Question 29

Your operations team manages hundreds of Compute Engine VMs across several environments. VMs are tagged with a label 'env' set to values like 'prod', 'staging', or 'dev'. You want a single Cloud Monitoring construct that automatically includes any new VM tagged 'env:prod' so dashboards and alerting policies always reflect the current production fleet without manual updates. What should you configure?

Accepted Answer

Create a Monitoring group with a membership criterion that matches the label 'env = prod'.

Answer

Create a static list of resource names in each alerting policy and update it whenever a VM is added.

Answer

Create a log-based metric filtered on the 'env' label and build the dashboard from that metric.

Answer

Create separate custom dashboards per VM and use dashboard folders to organize them.

Question 30

Your company runs three separate Google Cloud projects: a shared monitoring project called 'ops-central', plus 'app-prod' and 'app-staging' that host workloads. The operations team wants to view Compute Engine and log-based metrics from both workload projects in a single set of dashboards inside 'ops-central', without duplicating agents or copying data. What should you do?

Accepted Answer

In the 'ops-central' project, configure a metrics scope and add 'app-prod' and 'app-staging' as monitored projects.

Answer

Create a logging sink in each workload project that exports metrics to a Pub/Sub topic in 'ops-central'.

Answer

Enable VPC Network Peering between the three projects so metrics can be shared over the internal network.

Answer

Install the Ops Agent in 'ops-central' and point each workload VM's agent configuration to write to 'ops-central'.

Question 31

Your team runs a customer-facing service on Compute Engine behind an HTTP(S) load balancer. Customers complain about occasional slow responses, but the average latency shown on your existing dashboard looks fine. You need to investigate whether a small percentage of requests are experiencing high latency. In Cloud Monitoring Metrics Explorer, what should you do to surface this behavior?

Accepted Answer

Chart the load balancer total latency metric and apply a 95th percentile aligner/reducer to view tail latency

Answer

Chart the load balancer request count metric and apply a sum aggregation across all backends

Answer

Chart the load balancer latency metric and apply a mean aligner grouped by backend zone

Answer

Create an uptime check against the load balancer frontend and view its latency graph

Question 32

Your operations team uses PagerDuty for on-call incident management. You have created an alerting policy in Cloud Monitoring that detects high error rates on a production Cloud Run service. You need incidents to automatically open PagerDuty tickets when the alert fires, with the least operational overhead. What should you do?

Accepted Answer

Configure a PagerDuty notification channel in Cloud Monitoring using the PagerDuty integration key, then attach it to the alerting policy.

Answer

Create a Pub/Sub notification channel in Cloud Monitoring and write a Cloud Function that forwards messages to the PagerDuty API.

Answer

Export the alerting policy logs to BigQuery and schedule a query that calls the PagerDuty API when new error rows appear.

Answer

Add an email notification channel that sends to the team's shared inbox, which PagerDuty polls for new alerts.

Question 33

Your team runs a stateless web application on a single Compute Engine instance. Occasionally the application process hangs, and you must manually SSH in and restart the VM. You want Cloud Monitoring to automatically detect when the HTTP endpoint stops responding and immediately notify your on-call engineer's email, with the least operational effort. Which combination should you configure?

Accepted Answer

Create an uptime check against the HTTP endpoint, then create an alerting policy that triggers on the uptime check failure and sends to an email notification channel.

Answer

Install the Ops Agent and create a log-based metric that counts HTTP 500 errors, then alert when the count exceeds zero.

Answer

Create a Cloud Scheduler job that curls the endpoint every minute and writes results to a Pub/Sub topic subscribed by a Cloud Function that emails the team.

Answer

Enable the Compute Engine autohealing health check on a managed instance group and configure email alerts from the instance group.

Question 34

Your team runs a payment API on Cloud Run and has defined a Cloud Monitoring service with a 99.9% availability SLO over a rolling 28-day window. On-call engineers complain they receive too many alerts for tiny, temporary error blips that never threaten the monthly target, yet they still want to be paged quickly when a real outage is rapidly consuming the error budget. Which Cloud Monitoring feature should you configure to meet both needs?

Accepted Answer

An SLO burn-rate alerting policy that pages only when the error budget is being consumed faster than a defined threshold over a lookback window

Answer

A metric-threshold alerting policy that fires whenever the request error rate exceeds 0.1% for 1 minute

Answer

An uptime check against the Cloud Run URL with a notification channel to the on-call PagerDuty service

Answer

A log-based metric counting 5xx responses with an alert on every non-zero value

Question 35

You operate a set of Compute Engine VMs running a web application. Operations reports that a snapshot schedule attached to the boot disks is not producing new snapshots, and you need to quickly confirm whether the schedule is actually executing. Using only Cloud Console, what is the fastest way to verify recent snapshot creation activity for these disks?

Accepted Answer

Open Compute Engine > Snapshots and check the creation timestamps of recent snapshots to see if they match the schedule interval.

Answer

Create a Cloud Monitoring uptime check against the VMs to detect whether the disks are reachable.

Answer

Enable the Cloud Monitoring agent on each VM and build a dashboard that plots disk I/O throughput.

Answer

Request a quota increase for persistent disk snapshots in the affected region.

Question 36

Your team runs a public-facing web application served from a Compute Engine instance behind a global HTTP(S) load balancer at https://shop.example.com. Operations wants to be notified within a few minutes whenever the site becomes unreachable from multiple geographic regions. Using the least operational effort, what should you configure in Cloud Monitoring?

Accepted Answer

Create an uptime check targeting the URL https://shop.example.com with checks from multiple regions, then attach an alerting policy that fires when the check fails.

Answer

Install the Ops Agent on the VM and create a log-based metric that counts HTTP 500 responses, then alert on that metric.

Answer

Create a dashboard widget showing the load balancer request count and manually review it during business hours.

Answer

Write a Cloud Run job that curls the URL every minute and writes results to Cloud Logging, then create an alert on the log entries.

Question 37

Your company runs three separate Google Cloud projects: one for production, one for staging, and one for development. The operations team wants to view Compute Engine and application metrics from all three projects in a single set of Cloud Monitoring dashboards and configure alerting policies that span them. What should you do?

Accepted Answer

Create a metrics scope in one project (the scoping project) and add the other two projects as monitored projects.

Answer

Enable the Cloud Monitoring API separately in each project and manually copy dashboard configurations between them.

Answer

Export metrics from all three projects to BigQuery and build dashboards using Looker Studio.

Answer

Move all three projects into the same folder so that Cloud Monitoring automatically aggregates their metrics.

Question 38

Your team has built a stateless REST API packaged as a Docker container. Traffic is unpredictable and often drops to zero at night. You want a fully managed platform that scales automatically, charges only when requests are being served, and requires no cluster management. Which service should you deploy to?

Accepted Answer

Cloud Run

Answer

Google Kubernetes Engine (GKE) Standard

Answer

Compute Engine managed instance group

Answer

App Engine flexible environment

Question 39

Your team has deployed a customer-facing API to Cloud Run in the us-central1 region. The service currently responds at its default run.app URL, but the marketing team wants it served from api.example.com with a valid TLS certificate that is automatically provisioned and renewed. You own the example.com domain and can edit its DNS records. What is the recommended way to achieve this with the least ongoing maintenance?

Accepted Answer

Create a Cloud Run domain mapping for api.example.com, verify domain ownership, and add the DNS records Cloud Run provides so Google manages the certificate automatically.

Answer

Purchase a TLS certificate from a third-party CA, upload it to Cloud Run as a secret, and mount it into the container to terminate HTTPS.

Answer

Add a CNAME record pointing api.example.com directly to the run.app URL and rely on the existing run.app certificate to cover the custom domain.

Answer

Reserve a static external IP, attach it to the Cloud Run service, and configure the certificate manually on the container's web server.

Question 40

You deployed a new revision of a Cloud Run service, but users immediately begin reporting errors. The previous revision was working correctly and is still listed in the service's revision history. You need to restore service availability as quickly as possible using the least effort. What should you do?

Accepted Answer

Route 100% of traffic to the previous known-good revision using 'gcloud run services update-traffic --to-revisions'.

Answer

Delete the broken revision so Cloud Run automatically serves the earlier revision.

Answer

Rebuild the container image from the previous source commit and deploy it as a new revision.

Answer

Redeploy the service with '--no-traffic' and manually restart all running instances.

Question 41

Your team has a Python script that processes a daily CSV export from a partner. The job runs for about 8 minutes, needs 2 GB of memory, and must execute automatically once every night at 02:00. There is no incoming HTTP traffic and no need for the code to run at any other time. You want the most cost-effective managed option with minimal infrastructure to maintain. What should you do?

Accepted Answer

Deploy the script as a Cloud Run job and trigger it on a schedule with Cloud Scheduler.

Answer

Deploy the script to a Compute Engine VM with a cron entry that runs the job at 02:00 each day.

Answer

Package the script as an HTTP Cloud Function (2nd gen) and invoke it nightly via Cloud Scheduler.

Answer

Create a managed instance group with autoscaling that scales up at 02:00 to run the batch script.

Question 42

Your team runs a lightweight REST API on Cloud Run. Each container can safely handle many simultaneous requests because most time is spent waiting on downstream calls. During load tests, you notice Cloud Run is spinning up far more instances than expected, increasing cost. You want to reduce the number of instances by allowing each instance to process more requests at once. Which action should you take?

Accepted Answer

Increase the per-instance concurrency setting for the service

Answer

Increase the maximum number of instances on the service

Answer

Increase the CPU and memory allocated to each instance

Answer

Set a minimum number of instances to keep containers warm

Question 43

Your team runs a public-facing REST API on Cloud Run. During an unexpected traffic surge, Cloud Run scaled out to hundreds of container instances, causing a large unexpected bill and exhausting your downstream Cloud SQL connection pool. You need to cap how many instances the service can create while keeping the deployment otherwise unchanged. What should you do?

Accepted Answer

Deploy a new revision with the --max-instances flag set to an appropriate ceiling on the Cloud Run service.

Answer

Set the --concurrency flag to 1 so that each instance handles only one request at a time.

Answer

Request a lower quota for the Cloud Run API in the project via a quota decrease request.

Answer

Add a Cloud Monitoring alerting policy on instance count and manually delete instances when it fires.

Question 44

Your team deployed a new revision of a Cloud Run service. You want to send only 10% of live traffic to the new revision while keeping 90% on the previous stable revision, so you can monitor error rates before a full rollout. Which action accomplishes this?

Accepted Answer

Run 'gcloud run services update-traffic' specifying the two revisions with --to-revisions and their respective percentages

Answer

Redeploy the service twice with '--max-instances' set proportionally to control the traffic percentages

Answer

Create two separate Cloud Run services and place an internal load balancer in front to split traffic 90/10

Answer

Use 'gcloud run deploy' with the '--no-traffic' flag, which automatically routes 10% of requests to the newest revision

Question 45

A developer deployed a service to Cloud Run named 'orders-api'. Users report intermittent HTTP 500 errors. You need to quickly inspect the container's stdout/stderr output for the specific failing requests without leaving the managed platform, using the least amount of setup. What should you do?

Accepted Answer

Open the 'orders-api' service in the Cloud Run section of the Console and view the automatically collected logs in the LOGS tab.

Answer

Install the Ops Agent inside the container image, redeploy the service, and view the metrics in Cloud Monitoring.

Answer

Create a Cloud Logging export sink to BigQuery and run SQL queries to find the 500 responses.

Answer

SSH into the underlying Compute Engine instance backing the Cloud Run service and tail the container log file.

Question 46

A retail company is building a new order-management application that requires strong transactional consistency, complex SQL joins across orders, customers, and inventory tables, and full ACID compliance. The team wants a fully managed relational database and expects a moderate dataset well under 10 TB. Which Google Cloud data service should they choose?

Accepted Answer

Cloud SQL for PostgreSQL

Answer

Firestore in Native mode

Answer

Bigtable

Answer

BigQuery

Question 47

Your team runs a transactional web application backed by a Cloud SQL for PostgreSQL instance. The analytics team runs heavy read-only reporting queries that are slowing down the primary database and affecting customer-facing transactions. You need to offload these reporting queries without changing the application's write path or migrating to a different database engine. What should you do?

Accepted Answer

Create a Cloud SQL read replica and direct the analytics team's reporting queries to the replica's connection endpoint.

Answer

Increase the machine type of the primary Cloud SQL instance to handle both the transactional and reporting workloads.

Answer

Enable high availability (HA) on the Cloud SQL instance and point the reporting queries to the standby instance.

Answer

Export the database to BigQuery on a nightly schedule and have the analytics team query BigQuery instead.

Question 48

Your team stores application log files in a Cloud Storage bucket. The logs are frequently accessed for the first 30 days for troubleshooting, rarely accessed between 30 and 365 days for occasional audits, and must be retained for 7 years for compliance but are almost never read after the first year. You want to minimize storage costs while keeping the data in the same bucket. What should you do?

Accepted Answer

Create a lifecycle rule that transitions objects to Nearline after 30 days and to Archive after 365 days.

Answer

Create a lifecycle rule that deletes objects after 30 days and re-uploads them to a Coldline bucket.

Answer

Set the bucket's default storage class to Archive so all objects are stored at the lowest cost from creation.

Answer

Create a lifecycle rule that transitions objects to Standard after 30 days and to Nearline after 365 days.

Question 49

Your company hosts a media catalog whose image assets are served to a web application with users across North America, Europe, and Asia. The assets are accessed constantly and read latency for the global audience must be minimized while ensuring high availability. Which Cloud Storage bucket configuration should you choose when creating the bucket?

Accepted Answer

A multi-region bucket (for example, the 'us' or a suitable multi-region location) using the Standard storage class

Answer

A regional bucket in us-central1 using the Standard storage class

Answer

A regional bucket in us-central1 using the Nearline storage class

Answer

A dual-region bucket spanning two European regions using the Coldline storage class

Question 50

Your company keeps compliance documents in Cloud Storage. Analysts access each document roughly once a month, and the data must remain immediately available with millisecond retrieval when requested. You want to minimize storage cost without introducing retrieval latency for these occasional reads. Which storage class should you choose?

Accepted Answer

Nearline storage

Answer

Standard storage

Answer

Coldline storage

Answer

Archive storage

Question 51

Your company stores private product manuals in a Cloud Storage bucket that has uniform bucket-level access enabled and no public access. A partner needs to download one specific PDF file directly, but the partner does not have a Google account and you must not grant any long-term IAM permissions. The download link should stop working after 2 hours. What should you do?

Accepted Answer

Generate a signed URL for the object with a 2-hour expiration and send it to the partner.

Answer

Add allUsers as a Storage Object Viewer on the bucket, then remove the binding after 2 hours.

Answer

Grant the partner's email address the Storage Object Viewer role on the object using an IAM condition.

Answer

Make the bucket public and rely on the object's lifecycle rule to delete the file after 2 hours.

Question 52

Your team needs to host a static marketing website (HTML, CSS, JavaScript, and images) that will be accessed frequently by users worldwide. The content is read constantly and rarely changes. You want the most cost-effective and operationally simple way to serve this content directly from Cloud Storage. Which storage class should you choose for the bucket?

Accepted Answer

Standard storage class

Answer

Nearline storage class

Answer

Coldline storage class

Answer

Archive storage class

Question 53

Your team is deploying a new Cloud Storage bucket that will hold thousands of objects for an internal analytics application. Security requires that access be managed centrally and consistently using only IAM policies, and they explicitly want to prevent anyone from setting per-object ACLs that could accidentally expose individual files. What should you configure when creating the bucket?

Accepted Answer

Enable uniform bucket-level access on the bucket

Answer

Enable fine-grained access control and rely on object ACLs

Answer

Make the bucket public and restrict access with a firewall rule

Answer

Enable Object Versioning to control who can read objects

Question 54

A Compute Engine VM running Ubuntu has a boot disk that is nearly full. Your team decides to increase the boot disk size from 20 GB to 100 GB. You use the Cloud Console to resize the persistent disk to 100 GB, but after rebooting, the operating system still reports only 20 GB of available space. What should you do to make the additional space usable?

Accepted Answer

Grow the partition and resize the file system on the running VM (e.g., using growpart and resize2fs).

Answer

Detach the disk and reattach it so the guest OS re-reads the new capacity.

Answer

Create a snapshot of the disk and restore it to a new 100 GB disk.

Answer

Change the disk type from standard persistent disk to SSD persistent disk.

Question 55

Your team runs a memory-intensive in-memory caching application on Compute Engine. Benchmarking shows the workload needs 6 vCPUs but requires 60 GB of RAM to hold the working set. Standard predefined machine types either give too little memory (n2-standard-6 has 24 GB) or waste vCPUs and money (n2-highmem-8 has 8 vCPUs and 64 GB). You want to minimize cost while meeting both requirements. What should you do?

Accepted Answer

Create a custom machine type with 6 vCPUs and 60 GB of memory (using extended memory if needed).

Answer

Use the n2-highmem-8 predefined type and disable two vCPUs in the guest OS to save cost.

Answer

Use the n2-standard-6 predefined type and attach a Local SSD to compensate for the missing memory.

Answer

Deploy the application on a sole-tenant node so you can allocate exactly 6 vCPUs and 60 GB.

Question 56

Your team runs a stateless order-processing service on Compute Engine. Traffic is steady during business hours but spikes unpredictably during promotions. You want the number of identical VMs to grow and shrink automatically based on demand, while ensuring instances that fail health checks are automatically recreated. Which configuration should you use?

Accepted Answer

Create a managed instance group from an instance template with autoscaling enabled based on CPU utilization and enable autohealing with a health check.

Answer

Create an unmanaged instance group and manually add VMs, then attach a health check to recreate failed instances.

Answer

Deploy a single large VM with a custom machine type and resize it manually before each promotion.

Answer

Create multiple standalone VMs from a snapshot and place them behind a load balancer without an instance group.

Question 57

A running Compute Engine VM named 'app-prod-1' in zone us-central1-a must be relocated to zone us-central1-f because the current zone is being decommissioned for your workload. You need to move the instance with minimal manual reconfiguration and while preserving its disks and configuration. Which action should you take?

Accepted Answer

Run 'gcloud compute instances move app-prod-1 --zone us-central1-a --destination-zone us-central1-f'

Answer

Create a new instance in us-central1-f and manually detach and reattach the persistent disks using the Cloud Console

Answer

Edit the instance in the Cloud Console and change the Zone field under the machine configuration, then save

Answer

Use 'gcloud compute instances update app-prod-1 --zone us-central1-f' to change the zone in place

Question 58

Your team runs a nightly batch rendering job on Compute Engine. The job is fault-tolerant, can be restarted at any time, and does not need to complete within a strict deadline. Management wants to minimize compute costs as much as possible. Which VM configuration should you choose?

Accepted Answer

Spot VMs in a managed instance group

Answer

Standard on-demand VMs in a managed instance group with autoscaling based on CPU

Answer

Sole-tenant nodes to isolate the workload on dedicated hardware

Answer

Standard on-demand VMs with a committed use discount for 3 years

Question 59

A Compute Engine Linux VM fails to complete SSH login after a recent kernel and fstab change, and you suspect the boot process is hanging or dropping into emergency mode. SSH connections time out, so you cannot log in normally. You need to inspect the boot messages and interact with the OS to fix the misconfiguration without deleting the instance. What should you do?

Accepted Answer

Enable and connect to the interactive serial console for the instance to view boot output and log in to correct the configuration.

Answer

Create a snapshot of the boot disk and restore it to a brand-new instance in a different zone.

Answer

Increase the instance's machine type to a larger size so the boot process has more resources to complete.

Answer

Add a firewall rule allowing TCP port 22 from your IP address to restore SSH access.

Question 60

Your team runs a production application on a single Compute Engine VM with a 500 GB persistent disk. Management requires automated daily backups of the disk with 14-day retention, minimal ongoing operational effort, and the ability to restore quickly if the disk is corrupted. What should you do?

Accepted Answer

Create a resource policy that defines a snapshot schedule with a 14-day retention period and attach it to the persistent disk.

Answer

Write a cron job on the VM that runs 'gcloud compute disks snapshot' each night and manually delete snapshots older than 14 days.

Answer

Create a custom image from the disk each day using Cloud Scheduler and store the images in a Cloud Storage bucket with a lifecycle rule.

Answer

Enable regional persistent disk replication so the disk is automatically copied to a second zone for backup.

Question 61

A team runs a Java application on a single Compute Engine VM. The application writes structured logs to a file at /var/log/app/output.log, but these logs do not appear in Cloud Logging. Metrics such as CPU usage are visible in Cloud Monitoring. What should you do to get the application's file-based logs into Cloud Logging with the least ongoing effort?

Accepted Answer

Install and configure the Ops Agent on the VM, adding a logging receiver and pipeline that tails /var/log/app/output.log.

Answer

Write a cron job that uses gcloud logging write to push each new line of the log file to Cloud Logging every minute.

Answer

Enable Data Access audit logs for Compute Engine in the project's IAM audit configuration.

Answer

Create a log-based metric that reads directly from the file path and exports it to Cloud Logging.

Question 62

You are a cloud engineer who regularly switches between three different Google Cloud projects (dev, staging, and prod), each requiring a different account and default region. You want to switch your active gcloud environment quickly without re-entering the account, project, and region each time. What is the recommended approach using the gcloud CLI?

Accepted Answer

Create a separate named gcloud configuration for each environment with 'gcloud config configurations create' and switch between them using 'gcloud config configurations activate'.

Answer

Run 'gcloud init' each time you need to switch projects and re-select the account and project interactively.

Answer

Install three separate copies of the Cloud SDK in different directories, one per environment, and add each to your PATH.

Answer

Set the CLOUDSDK_CORE_PROJECT environment variable in your shell profile so gcloud always uses the correct project.

Question 63

Your team runs several Compute Engine VMs in a private subnet with no external IP addresses. These VMs need to download OS security patches from public repositories on the internet, but they must not be reachable from the internet inbound. You want a fully managed solution that requires minimal ongoing maintenance. What should you configure?

Accepted Answer

Configure Cloud NAT on a Cloud Router for the subnet's region

Answer

Assign ephemeral external IP addresses to each VM and create an egress firewall rule allowing outbound traffic

Answer

Deploy a Compute Engine instance as a NAT gateway and add a custom route with that instance as the next hop

Answer

Create an external HTTP(S) Load Balancer in front of the VMs to broker outbound connections

Question 64

Your team is building a new application that will run on Compute Engine VMs in the us-east1 region. Company policy requires that you avoid the automatically created default subnets and instead control the exact IP address range used. You need to create a VPC network and a single subnet with the CIDR range 10.20.0.0/20 in us-east1. Which approach should you take?

Accepted Answer

Create a VPC network in custom mode, then create a subnet in us-east1 with the primary IP range 10.20.0.0/20.

Answer

Create a VPC network in auto mode, then delete all subnets except the one in us-east1 and edit its range to 10.20.0.0/20.

Answer

Create a VPC network in auto mode, which will automatically assign the 10.20.0.0/20 range to the us-east1 subnet.

Answer

Create a VPC network in custom mode, which automatically provisions a subnet in every region using ranges you define per project.

Exam domain	Exam weight	Practice
Setting up a cloud solution environment	20%	Practice this topic
Planning and implementing a cloud solution	30%	Practice this topic
Ensuring successful operation of a cloud solution	30%	Practice this topic
Configuring access and security	20%	Practice this topic

Associate Cloud Engineer (ACE) practice exam & study guide

Start studying ACE

All ACE study resources

ACE exam domains

Sample ACE questions

Key ACE terms

ACE frequently asked questions

Setting up a cloud solution environment (20%)

Planning and implementing a cloud solution (30%)

Ensuring successful operation of a cloud solution (30%)

Configuring access and security (20%)