Home
Google
Associate-Cloud-Engineer: Google Associate Cloud Engineer Dumps

Free Google Associate Cloud Engineer Exam Dumps July 2026

Here you can find all the free questions related with Google Associate Cloud Engineer (Associate Cloud Engineer) exam. You can also find on this page links to recently updated premium files with which you can practice for actual Google Associate Cloud Engineer Exam. These premium versions are provided as Associate Cloud Engineer exam practice tests, both as desktop software and browser based application, you can use whatever suits your style. Feel free to try the Google Associate Cloud Engineer Exam premium files for free, Good luck with your Google Associate Cloud Engineer Exam.

Question No: 1

MultipleChoice

You are building a product on top of Google Kubernetes Engine (GKE). You have a single GKE cluster. For each of your customers, a Pod is running in that cluster, and your customers can run arbitrary code inside their Pod. You want to maximize the isolation between your customers' Pods. What should you do?

Options

AUse Binary Authorization and whitelist only the container images used by your customers' Pods.

BUse the Container Analysis API to detect vulnerabilities in the containers used by your customers' Pods.

CCreate a GKE node pool with a sandbox type configured to gvisor. Add the parameter runtimeClassName: gvisor to the specification of your customers' Pods.

DUse the cos_containerd image for your GKE nodes. Add a nodeSelector with the value cloud.google.com/gke-os-distribution: cos_containerd to the specification of your customers' Pods.

Answer
CExplanation

GKE Sandbox provides an extra layer of security to prevent untrusted code from affecting the host kernel on your cluster nodes when containers in the Pod execute unknown or untrusted code. Multi-tenant clusters and clusters whose containers run untrusted workloads are more exposed to security vulnerabilities than other clusters. Examples include SaaS providers, web-hosting providers, or other organizations that allow their users to upload and run code. When you enable GKE Sandbox on a node pool, a sandbox is created for each Pod running on a node in that node pool. In addition, nodes running sandboxed Pods are prevented from accessing other Google Cloud services or cluster metadata. Each sandbox uses its own userspace kernel. With this in mind, you can make decisions about how to group your containers into Pods, based on the level of isolation you require and the characteristics of your applications.

Ref:https://cloud.google.com/kubernetes-engine/docs/concepts/sandbox-pods

Question No: 2

MultipleChoice

You need to configure IAM access audit logging in BigQuery for external auditors. You want to follow Google-recommended practices. What should you do?

Options

AAdd the auditors group to the 'logging.viewer' and 'bigQuery.dataViewer' predefined IAM roles.

BAdd the auditors group to two new custom IAM roles.

CAdd the auditor user accounts to the 'logging.viewer' and 'bigQuery.dataViewer' predefined IAM roles.

DAdd the auditor user accounts to two new custom IAM roles.

Answer
AExplanation

https://cloud.google.com/iam/docs/job-functions/auditing#scenario_external_auditors

Because if you directly add users to the IAM roles, then if any users left the organization then you have to remove the users from multiple places and need to revoke his/her access from multiple places. But, if you put a user into a group then its very easy to manage these type of situations. Now, if any user left then you just need to remove the user from the group and all the access got revoked

The organization creates a Google group for these external auditors and adds the current auditor to the group. This group is monitored and is typically granted access to the dashboard application. During normal access, the auditors' Google group is only granted access to view the historic logs stored in BigQuery. If any anomalies are discovered, the group is granted permission to view the actual Cloud Logging Admin Activity logs via the dashboard's elevated access mode. At the end of each audit period, the group's access is then revoked. Data is redacted using Cloud DLP before being made accessible for viewing via the dashboard application. The table below explains IAM logging roles that an Organization Administrator can grant to the service account used by the dashboard, as well as the resource level at which the role is granted.

Question No: 3

MultipleChoice

You are designing an application that lets users upload and share photos. You expect your application to grow really fast and you are targeting a worldwide audience. You want to delete uploaded photos after 30 days. You want to minimize costs while ensuring your application is highly available. Which GCP storage solution should you Choose?

Options

APersistent SSD on VM instances.

BCloud Filestore.

CMultiregional Cloud Storage bucket.

DCloud Datastore database.

Answer
CExplanation

Cloud Storage allows world-wide storage and retrieval of any amount of data at any time. We dont need to set up auto-scaling ourselves. Cloud Storage autoscaling is managed by GCP. Cloud Storage is an object store so it is suitable for storing photos. Cloud Storage allows world-wide storage and retrieval so cater well to our worldwide audience. Cloud storage provides us lifecycle rules that can be configured to automatically delete objects older than 30 days. This also fits our requirements. Finally, Google Cloud Storage offers several storage classes such as Nearline Storage ($0.01 per GB per Month) Coldline Storage ($0.007 per GB per Month) and Archive Storage ($0.004 per GB per month) which are significantly cheaper than any of the options above.

Ref:https://cloud.google.com/storage/docs

Ref:https://cloud.google.com/storage/pricing

Question No: 4

MultipleChoice

You built an application on Google Cloud Platform that uses Cloud Spanner. Your support team needs to monitor the environment but should not have access to table dat

a. You need a streamlined solution to grant the correct permissions to your support team, and you want to follow Google-recommended practices. What should you do?

Options

AAdd the support team group to the roles/monitoring.viewer role

BAdd the support team group to the roles/spanner.databaseUser role.

CAdd the support team group to the roles/spanner.databaseReader role.

DAdd the support team group to the roles/stackdriver.accounts.viewer role.

Answer
AExplanation

roles/monitoring.viewer provides read-only access to get and list information about all monitoring data and configurations. This role provides monitoring access and fits our requirements. roles/monitoring.viewer. is the right answer.

Ref:https://cloud.google.com/iam/docs/understanding-roles#cloud-spanner-roles

Question No: 5

MultipleChoice

You have developed an application that consists of multiple microservices, with each microservice packaged in its own Docker container image. You want to deploy the entire application on Google Kubernetes Engine so that each microservice can be scaled individually. What should you do?

Options

ACreate and deploy a Custom Resource Definition per microservice.

BCreate and deploy a Docker Compose File.

CCreate and deploy a Job per microservice.

DCreate and deploy a Deployment per microservice.

Answer
A

Question No: 6

MultipleChoice

Your company has a 3-tier solution running on Compute Engine. The configuration of the current infrastructure is shown below.

Each tier has a service account that is associated with all instances within it. You need to enable communication on TCP port 8080 between tiers as follows:

* Instances in tier #1 must communicate with tier #2.

* Instances in tier #2 must communicate with tier #3.

What should you do?

Options

A1. Create an ingress firewall rule with the following settings:* Targets: all instances* Source filter: IP ranges (with the range set to 10.0.2.0/24)* Protocols: allow all2. Create an ingress firewall rule with the following settings:* Targets: all instances* Source filter: IP ranges (with the range set to 10.0.1.0/24)* Protocols: allow all

B1. Create an ingress firewall rule with the following settings:* Targets: all instances with tier #2 service account* Source filter: all instances with tier #1 service account* Protocols: allow TCP:80802. Create an ingress firewall rule with the following settings:* Targets: all instances with tier #3 service account* Source filter: all instances with tier #2 service account* Protocols: allow TCP: 8080

C1. Create an ingress firewall rule with the following settings:* Targets: all instances with tier #2 service account* Source filter: all instances with tier #1 service account* Protocols: allow all2. Create an ingress firewall rule with the following settings:* Targets: all instances with tier #3 service account* Source filter: all instances with tier #2 service account* Protocols: allow all

D1. Create an egress firewall rule with the following settings:* Targets: all instances* Source filter: IP ranges (with the range set to 10.0.2.0/24)* Protocols: allow TCP: 80802. Create an egress firewall rule with the following settings:* Targets: all instances* Source filter: IP ranges (with the range set to 10.0.1.0/24)* Protocols: allow TCP: 8080

Answer
BExplanation

1. Create an ingress firewall rule with the following settings: ' Targets: all instances with tier #2 service account ' Source filter: all instances with tier #1 service account ' Protocols: allow TCP:8080 2. Create an ingress firewall rule with the following settings: ' Targets: all instances with tier #3 service account ' Source filter: all instances with tier #2 service account ' Protocols: allow TCP: 8080

Question No: 7

MultipleChoice

You're looking for the IP address of a specific instance that is running in your default zone. Which command and flag(s) could you use to return just the IP address?

Options

AThe gcloud compute list along with the filter and format flags.

BThe gcloud compute list along with the o flag and jsonpath value.

CThe gcloud compute instances list along with the o flag and jsonpath value.

DThe gcloud compute instances list along with the filter and format flags.

Answer
D

Question No: 8

MultipleChoice

Which of the following is a valid use case for using a primitive role?

Options

AWhen granting permission to a development project or to the development team.

BWhen there are more than 10 users.

CWhen creating a custom role requires more than 10 permissions.

DWhen granting permission to a production project, or to a third-party company.

Answer
A

Question No: 9

MultipleChoice

Which of the following is a valid use case for Flow Logs?

Options

ABlocking instances from communicating over certain ports.

BNetwork forensics.

CProxying SSL traffic.

DServing as a UDP relay.

Answer
B

Question No: 10

MultipleChoice

You've just created a new Google Cloud account. You're eager to start working with resources such as App Engine and Cloud Storage. However, you know that resources have requirements. Which of the following is required by Google Cloud in order to enable and use resources?

Options

AA Stackdriver account

BAn Organization

CA Project

DA Folder

Answer
C

Question No: 11

MultipleChoice

You're attempting to set up a new budget with some alerts. Your team lead asked you to use last months spending as a reference for the budget amount. What's the best way to configure this budget?

Options

ALocate the spending data from the File export; use that as the budget amount.

BLocate the spending data from the BigQuery export; use that as the budget amount.

CLook at the spending data and locate the amount; use that as the budget amount.

DUse the 'Last month's spend' option to allow Google Cloud to determine the budget amount.

Answer
D

Question No: 12

MultipleChoice

You're working as a Cloud Engineer for a small company. The lead developer needs to create some new projects in order to get started with deploying the codebase. She tried to create a project and received an error. She messaged you on Slack to ask for help, though, she couldn't recall the exact error message. You checked and found that she does have Project Creator permissions. Keeping in mind the principle of least privilege, what is the best role to grant her so that she can create billable projects?

Options

AThe 'Billing Account Administrator' role.

BThe 'Billing Account User' role.

CThe 'Project Owner' role.

DThe 'Billing Account Viewer' role.

Answer
B

Question No: 13

MultipleChoice

You keep attempting to execute a command, and while there's no error being thrown, you suspect something is going wrong. You want to check out the gcloud logs. However, you can't recall in which directory they're located. Your script skills are not what they could be, so you can't rely on using those fancy command line skills.

Which command could you run to show you where the log directory is located?

Options

Agoogle logs

Bgcloud info

Cgcloud logging

Dgcloud

Answer
B

Question No: 14

MultipleChoice

You need to deploy an application, which is packaged in a container image, in a new project. The application exposes an HTTP endpoint and receives very few requests per day. You want to minimize costs. What should you do?

Options

ADeploy the container on Cloud Run.

BDeploy the container on Cloud Run on GKE.

CDeploy the container on App Engine Flexible.

DDeploy the container on Google Kubernetes Engine, with cluster autoscaling and horizontal pod autoscaling enabled.

Answer
AExplanation

Cloud Run takes any container images and pairs great with the container ecosystem: Cloud Build, Artifact Registry, Docker. ... No infrastructure to manage: once deployed, Cloud Run manages your services so you can sleep well. Fast autoscaling. Cloud Run automatically scales up or down from zero to N depending on traffic.

https://cloud.google.com/run

Question No: 15

MultipleChoice

You're attempting to set up a File based Billing Export. Which of the following components are required?

Options

AA Cloud Storage bucket.

BA BigQuery dataset.

CA report prefix.

DA Budget and at least one alert.

Answer
C

Question No: 16

MultipleChoice

You've been asked to add Martha Jones as a member of the "Production Storefront App" project; Using the email address martha.jones@tardis.com with the App Engine Admin role. You browse to the IAM page in the console and attempt to add her, however, you get the following error.

"Email addresses and domains must be associated with an active Google Account or Google Apps account."

What's the most likely cause for this error?

Options

AMartha has already been added as a to this project as a different member.

BMartha has been denied access due to a policy on the Organization.

CMartha hasn't been added as a user inside the Company's G Suite account.

DMartha has an outstanding bill with Google and can't be added until the bill is paid.

Answer
C

Question No: 17

MultipleChoice

You're attempting to remove the zone property from the Compute Engine service, that was set with the incorrect value. Which command would accomplish your task?

Options

Agcloud config unset compute/zone

Bgcloud config unset zone

Cgcloud config configurations unset compute/zone

Dgcloud unset compute/zone

Answer
A

Question No: 18

MultipleChoice

Your boss has asked you to set up the CFO as a user inside Google Cloud. Before walking away, she said, "And obviously you know which role to assign him."

Which role was she likely talking about, and why is it obvious? (Select one role and one reason)

Options

AReason: This role will ensure the CFO has full access to the project.

BRole: Billing Account Viewer

CReason: This role will ensure the CFO has access to view the spending data.

DRole: Project Owner

ERole: Billing Account Admin

FReason:: This role will ensure the CFO can perform any billing task that they may need.

Answer
B, C

Question No: 19

MultipleChoice

You and your team have been working on a new application over the past couple weeks. While it's still in development, it's becoming a bit costly for your limited budget. The entire team had a meeting on Friday to talk about how to save money until you're able to launch. One of your team members suggested shutting down some services overnight and during the weekend. Though no official decision was made before leaving for the weekend, a junior team member sent out an email saying he found a solution to the problem.

When arriving at the office on Monday, you find that your project is no longer in the drop-down inside the Console. What's the most likely reason for the missing project?

Options

AThe project was moved to another account.

BYour trial credits expired, and the project was removed.

CThe engineer removed the project and attached all of the resources directly to the Organization.

DThe engineer clicked the 'shut down' link thinking it was like a light switch that he could toggle on and off.

Answer
D

Question No: 20

MultipleChoice

You're deploying an application to a Compute Engine instance, and it's going to need to make calls to read from Cloud Storage and Bigtable. You want to make sure you're following the principle of least privilege. What's the easiest way to ensure the code can authenticate to the required Google Cloud APIs?

Options

ACreate a new user account with the required roles. Store the credentials in Cloud Key Management Service and download them to the instance in code.

BUse the default Compute Engine service account and set its scopes. Let the code find the default service account using 'Application Default Credentials'.

CCreate a new service account and key with the required limited permissions. Set the instance to use the new service account. Edit the code to use the service account key.

DRegister the application with the Binary Registration Service and apply the required roles.

Answer
B

Limited Time Offer

25%

Off

Get Premium Associate Cloud Engineer Questions as Interactive Web-Based Practice Test or PDF