Pass Google Associate-Cloud-Engineer Actual Free Exam Q&As Updated Dump Jun 14, 2026
Latest Associate-Cloud-Engineer Actual Free Exam Updated 335 Questions
Google Associate-Cloud-Engineer (Google Associate Cloud Engineer) exam is a certification exam offered by Google Cloud Platform (GCP) to test the skills of individuals who want to become certified as Google Cloud engineers. Associate-Cloud-Engineer exam is designed to assess the candidate's ability to deploy, manage, and scale applications and infrastructure on GCP. The Google Associate Cloud Engineer exam is intended for individuals who have a foundational knowledge of GCP and its services and are looking to validate their skills and knowledge in the field.
Google Associate-Cloud-Engineer certification is an exam that is designed for those individuals who are looking to establish themselves as a Google Cloud engineer. The Google Cloud platform is a powerful tool that provides users with the ability to create and manage complex applications and data systems. With the Associate-Cloud-Engineer certification, individuals can demonstrate their knowledge and expertise in using this platform to create innovative solutions for their clients.
NEW QUESTION # 107
An application generates daily reports in a Compute Engine virtual machine (VM). The VM is in the project corp-iot-insights. Your team operates only in the project corp-aggregate-reports and needs a copy of the daily exports in the bucket corp-aggregate-reports-storage. You want to configure access so that the daily reports from the VM are available in the bucket corp-aggregate-reports-storage and use as few steps as possible while following Google-recommended practices. What should you do?
- A. Grant the VM Service Account the role Storage Object Creator on corp-aggregate-reports-storage.
- B. Create a Shared VPC network between both projects. Grant the VM Service Account the role Storage Object Creator on corp-iot-insights.
- C. Move both projects under the same folder.
- D. Make corp-aggregate-reports-storage public and create a folder with a pseudo-randomized suffix name. Share the folder with the IoT team.
Answer: A
Explanation:
Predefined roles
The following table describes Identity and Access Management (IAM) roles that are associated with Cloud Storage and lists the permissions that are contained in each role. Unless otherwise noted, these roles can be applied either to entire projects or specific buckets.
Storage Object Creator (roles/storage.objectCreator) Allows users to create objects. Does not give permission to view, delete, or overwrite objects.
https://cloud.google.com/storage/docs/access-control/iam-roles#standard-roles
NEW QUESTION # 108
You need to create an autoscaling managed instance group for an HTTPS web application. You want to make sure that unhealthy VMs are recreated. What should you do?
- A. In the Instance Template, add a startup script that sends a heartbeat to the metadata server.
- B. In the Instance Template, add the label 'health-check'.
- C. Create a health check on port 443 and use that when creating the Managed Instance Group.
- D. Select Multi-Zone instead of Single-Zone when creating the Managed Instance Group.
Answer: C
Explanation:
https://cloud.google.com/compute/docs/instance-groups/autohealing-instances-in-migs#setting_up_an_autohealin
NEW QUESTION # 109
You are using Container Registry to centrally store your company's container images in a separate project. In another project, you want to create a Google Kubernetes Engine (GKE) cluster. You want to ensure that Kubernetes can download images from Container Registry. What should you do?
- A. Create a service account, and give it access to Cloud Storage. Create a P12 key for this service account and use it as an imagePullSecrets in Kubernetes.
- B. When you create the GKE cluster, choose the Allow full access to all Cloud APIs option under 'Access scopes'.
- C. Configure the ACLs on each image in Cloud Storage to give read-only access to the default Compute Engine service account.
- D. In the project where the images are stored, grant the Storage Object Viewer IAM role to the service account used by the Kubernetes nodes.
Answer: D
Explanation:
Configure the ACLs on each image in Cloud Storage to give read-only access to the default Compute Engine service account. is not right.
As mentioned above, Container Registry ignores permissions set on individual objects within the storage bucket so this isnt going to work.
Ref: https://cloud.google.com/container-registry/docs/access-control
NEW QUESTION # 110
You have a Compute Engine instance hosting a production application. You want to receive an email if the instance consumes more than 90% of its CPU resources for more than 15 minutes. You want to use Google services. What should you do?
- A. 1. Create a consumer Gmail account.
2.Write a script that monitors the CPU usage.
3.When the CPU usage exceeds the threshold, have that script send an email using the Gmail account and smtp.gmail.com on port 25 as SMTP server. - B. 1. Create a Stackdriver Workspace, and associate your GCP project with it.
2.Write a script that monitors the CPU usage and sends it as a custom metric to Stackdriver.
3.Create an uptime check for the instance in Stackdriver. - C. 1. In Stackdriver Logging, create a logs-based metric to extract the CPU usage by using this regular expression: CPU Usage: ([0-9] {1,3}) %
2.In Stackdriver Monitoring, create an Alerting Policy based on this metric.
3.Configure your email address in the notification channel. - D. 1. Create a Stackdriver Workspace, and associate your Google Cloud Platform (GCP) project with it.
2.Create an Alerting Policy in Stackdriver that uses the threshold as a trigger condition.
3.Configure your email address in the notification channel.
Answer: D
Explanation:
Specifying conditions for alerting policies This page describes how to specify conditions for alerting policies.
The conditions for an alerting policy define what is monitored and when to trigger an alert. For example, suppose you want to define an alerting policy that emails you if the CPU utilization of a Compute Engine VM instance is above 80% for more than 3 minutes. You use the conditions dialog to specify that you want to monitor the CPU utilization of a Compute Engine VM instance, and that you want an alerting policy to trigger when that utilization is above 80% for 3 minutes. https://cloud.google.com/monitoring/alerts/ui-conditions-ga
https://cloud.google.com/monitoring/alerts/using-alerting-ui https://cloud.google.com/monitoring/support
/notification-options
NEW QUESTION # 111
During a recent audit of your existing Google Cloud resources, you discovered several users with email addresses outside of your Google Workspace domain.
You want to ensure that your resources are only shared with users whose email addresses match your domain.
You need to remove any mismatched users, and you want to avoid having to audit your resources to identify mismatched users. What should you do?
- A. Create a Cloud Scheduler task to regularly scan your resources and delete mismatched users.
- B. Set an organizational policy constraint to limit identities by domain to automatically remove mismatched users.
- C. Set an organizational policy constraint to limit identities by domain, and then retroactively remove the existing mismatched users.
- D. Create a Cloud Scheduler task to regularly scan your projects and delete mismatched users.
Answer: C
Explanation:
https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints This list constraint defines the set of domains that email addresses added to Essential Contacts can have. By default, email addresses with any domain can be added to Essential Contacts. The allowed/denied list must specify one or more domains of the form @example.com. If this constraint is active and configured with allowed values, only email addresses with a suffix matching one of the entries from the list of allowed domains can be added in Essential Contacts. This constraint has no effect on updating or removing existing contacts.
constraints/essentialcontacts.allowedContactDomains
NEW QUESTION # 112
You need to select and configure compute resources for a set of batch processing jobs. These jobs take around 2 hours to complete and are run nightly. You want to minimize service costs. What should you do?
- A. Select Compute Engine. Use preemptible VM instances of the appropriate standard machine type.
- B. Select Google Kubernetes Engine. Use a single-node cluster with a small instance type.
- C. Select Compute Engine. Use VM instance types that support micro bursting.
- D. Select Google Kubernetes Engine. Use a three-node cluster with micro instance types.
Answer: A
NEW QUESTION # 113
You want to run a single caching HTTP reverse proxy on GCP for a latency-sensitive website. This specific reverse proxy consumes almost no CPU. You want to have a 30-GB in-memory cache, and need an additional 2 GB of memory for the rest of the processes. You want to minimize cost. How should you run this reverse proxy?
- A. Run it on Compute Engine, choose the instance type n1-standard-1, and add an SSD persistent disk of 32 GB.
- B. Package it in a container image, and run it on Kubernetes Engine, using n1-standard-32 instances as nodes.
- C. Create a Cloud Memorystore for Redis instance with 32-GB capacity.
- D. Run it on Compute Engine, and choose a custom instance type with 6 vCPUs and 32 GB of memory.
Answer: D
NEW QUESTION # 114
You are the project owner of a GCP project and want to delegate control to colleagues to manage buckets and files in Cloud Storage. You want to follow Google-recommended practices. Which IAM roles should you grant your colleagues?
- A. Storage Object Creator
- B. Storage Object Admin
- C. Storage Admin
- D. Project Editor
Answer: C
Explanation:
Explanation
Storage Admin (roles/storage.admin) Grants full control of buckets and objects.
When applied to an individual bucket, control applies only to the specified bucket and objects within the bucket.
firebase.projects.get
resourcemanager.projects.get
resourcemanager.projects.list
storage.buckets.*
storage.objects.*
https://cloud.google.com/storage/docs/access-control/iam-roles
This role grants full control of buckets and objects. When applied to an individual bucket, control applies only to the specified bucket and objects within the bucket.
Ref: https://cloud.google.com/iam/docs/understanding-roles#storage-roles
NEW QUESTION # 115
You need to set up permissions for a set of Compute Engine instances to enable them to write data into a particular Cloud Storage bucket. You want to follow Google-recommended practices. What should you do?
- A. Create a service account with an access scope. Use the access scope 'https://www.googleapis.com/auth/devstorage.write_only'.
- B. Create a service account and add it to the IAM role 'storage.objectCreator' for that bucket.
- C. Create a service account and add it to the IAM role 'storage.objectAdmin' for that bucket.
- D. Create a service account with an access scope. Use the access scope 'https://www.googleapis.com/auth/cloud-platform'.
Answer: D
Explanation:
Reference:
https://towardsdatascience.com/enlightened-datalab-notebooks-35ce8ef374c0
NEW QUESTION # 116
You have a virtual machine that is currently configured with 2 vCPUs and 4 GB of memory. It is running out of memory. You want to upgrade the virtual machine to have 8 GB of memory. What should you do?
- A. Rely on live migration to move the workload to a machine with more memory.
- B. Stop the VM, change the machine type to n1-standard-8, and start the VM.
- C. Stop the VM, increase the memory to 8 GB, and start the VM.
- D. Use gcloud to add metadata to the VM. Set the key to required-memory-size and the value to 8 GB.
Answer: C
Explanation:
In Google compute engine, if predefined machine types don't meet your needs, you can create an instance with custom virtualized hardware settings. Specifically, you can create an instance with a custom number of vCPUs and custom memory, effectively using a custom machine type. Custom machine types are ideal for the following scenarios:
1. Workloads that aren't a good fit for the predefined machine types that are available to you.
2. Workloads that require more processing power or more memory but don't need all of the upgrades that are provided by the next machine type level.
In our scenario, we only need a memory upgrade. Moving to a bigger instance would also bump up the CPU which we don't need so we have to use a custom machine type. It is not possible to change memory while the instance is running so you need to first stop the instance, change the memory and then start it again. See below a screenshot that shows how CPU/Memory can be customized for an instance that has been stopped.
Ref: https://cloud.google.com/compute/docs/instances/creating-instance-with-custom-machine-type
NEW QUESTION # 117
You create a Deployment with 2 replicas in a Google Kubernetes Engine cluster that has a single preemptible node pool. After a few minutes, you use kubectl to examine the status of your Pod and observe that one of them is still in Pending status:
What is the most likely cause?
- A. The pending Pod was originally scheduled on a node that has been preempted between the creation of the Deployment and your verification of the Pods' status. It is currently being rescheduled on a new node.
- B. The node pool is configured with a service account that does not have permission to pull the container image used by the pending Pod.
- C. The pending Pod's resource requests are too large to fit on a single node of the cluster.
- D. Too many Pods are already running in the cluster, and there are not enough resources left to schedule the pending Pod.
Answer: D
NEW QUESTION # 118
Your company runs its Linux workloads on Compute Engine instances. Your company will be working with a new operations partner that does not use Google Accounts. You need to grant access to the instances to your operations partner so they can maintain the installed tooling.
What should you do?
- A. Enable Cloud IAP for the Compute Engine instances, and add the operations partner as a Cloud IAP Tunnel User.
- B. Tag all the instances with the same network tag.
Create a firewall rule in the VPC to grant TCP access on port 22 for traffic from the operations partner to instances with the network tag. - C. Set up Cloud VPN between your Google Cloud VPC and the internal network of the operations partner.
- D. Ask the operations partner to generate SSH key pairs, and add the public keys to the VM instances.
Answer: B
Explanation:
https://cloud.google.com/vpc/docs/firewalls
NEW QUESTION # 119
You have developed a containerized web application that will serve Internal colleagues during business hours.
You want to ensure that no costs are incurred outside of the hours the application is used. You have just created a new Google Cloud project and want to deploy the application. What should you do?
- A. Deploy the container on Cloud Run for Anthos, and set the minimum number of instances to zero
- B. Deploy the container on App Engine flexible environment with autoscaling. and set the value min_instances to zero in the app yaml
- C. Deploy the container on App Engine flexible environment with manual scaling, and set the value instances to zero in the app yaml
- D. Deploy the container on Cloud Run (fully managed), and set the minimum number of instances to zero.
Answer: D
Explanation:
https://cloud.google.com/kuberun/docs/architecture-overview#components_in_the_default_installation
NEW QUESTION # 120
You have a development project with appropriate IAM roles defined. You are creating a production project and want to have the same IAM roles on the new project, using the fewest possible steps. What should you do?
- A. In the Google Cloud Platform Console, use the `create role from role' functionality.
- B. Use gcloud iam roles copy and specify the production project as the destination project.
- C. In the Google Cloud Platform Console, use the `create role' functionality and select all applicable permissions.
- D. Use gcloud iam roles copy and specify your organization as the destination organization.
Answer: B
Explanation:
Cloud SDK gcloud iam roles copy can be used to copy the roles to different organization or project.Refer GCP documentation - Cloud SDK IAM Copy Rolegcloud iam roles copy - create a role from an existing role--dest-organization=DEST_ORGANIZATION (The organization of the destination role)--dest-project=DEST_PROJECT (The project of the destination role).
NEW QUESTION # 121
You want to find out when users were added to Cloud Spanner Identity Access Management (IAM) roles on your Google Cloud Platform (GCP) project. What should you do in the GCP Console?
- A. Open the Cloud Spanner console to review configurations.
- B. Go to the Stackdriver Logging console, review admin activity logs, and filter them for Cloud Spanner IAM roles.
- C. Go to the Stackdriver Monitoring console and review information for Cloud Spanner.
- D. Open the IAM & admin console to review IAM policies for Cloud Spanner roles.
Answer: B
Explanation:
https://cloud.google.com/monitoring/audit-logging
NEW QUESTION # 122
You need to select and configure compute resources for a set of batch processing jobs. These jobs take around 2 hours to complete and are run nightly. You want to minimize service costs.
What should you do?
- A. Select Compute Engine. Use preemptible VM instances of the appropriate standard machine type.
- B. Select Google Kubernetes Engine. Use a single-node cluster with a small instance type.
- C. Select Compute Engine. Use VM instance types that support micro bursting.
- D. Select Google Kubernetes Engine. Use a three-node cluster with micro instance types.
Answer: A
NEW QUESTION # 123
Your coworker has helped you set up several configurations for gcloud. You've noticed that you're running commands against the wrong project. Being new to the company, you haven't yet memorized any of the projects. With the fewest steps possible, what's the fastest way to switch to the correct configuration?
- A. Run gcloud config list followed by gcloud config activate.
- B. Re-authenticate with the gcloud auth login command and select the correct configurations on login.
- C. Run gcloud configurations list followed by gcloud configurations activate .
- D. Run gcloud config configurations list followed by gcloud config configurations activate.
Answer: D
Explanation:
Explanation
as gcloud config configurations list can help check for the existing configurations and activate can help switch to the configuration.
gcloud config configurations list lists existing named configurations
gcloud config configurations activate activates an existing named configuration Obtains access credentials for your user account via a web-based authorization flow. When this command completes successfully, it sets the active account in the current configuration to the account specified. If no configuration exists, it creates a configuration named default.
NEW QUESTION # 124
A team of data scientists infrequently needs to use a Google Kubernetes Engine (GKE) cluster that you manage. They require GPUs for some long-running, non-restartable jobs. You want to minimize cost. What should you do?
- A. Create a node pool with preemptible VMs and GPUs attached to those VMs.
- B. Create a VerticalPodAutscaler for those workloads.
- C. Create a node pool of instances with GPUs, and enable autoscaling on this node pool with a minimum size of 1.
- D. Enable node auto-provisioning on the GKE cluster.
Answer: A
NEW QUESTION # 125
You have an application on a general-purpose Compute Engine instance that is experiencing excessive disk read throttling on its Zonal SSD Persistent Disk. The application primarily reads large files from disk. The disk size is currently 350 GB. You want to provide the maximum amount of throughput while minimizing costs.
What should you do?
- A. Migrate to use a Regional SSD on the instance.
- B. Increase the allocated CPU to the instance.
- C. Migrate to use a Local SSD on the instance.
- D. Increase the size of the disk to 1 TB.
Answer: C
Explanation:
Standard persistent disks are efficient and economical for handling sequential read/write operations, but they aren't optimized to handle high rates of random input/output operations per second (IOPS). If your apps require high rates of random IOPS, use SSD persistent disks. SSD persistent disks are designed for single-digit millisecond latencies. Observed latency is application specific.
NEW QUESTION # 126
Your team is running an on-premises ecommerce application. The application contains a complex set of microservices written in Python, and each microservice is running on Docker containers. Configurations are injected by using environment variables. You need to deploy your current application to a serverless Google Cloud cloud solution. What should you do?
- A. Use your existing CI/CD pipeline Use the generated Docker images and deploy them to Cloud Run.
Update the configurations and the required endpoints. - B. Use the existing codebase and deploy each service as a separate Cloud Function Update the configurations and the required endpoints.
- C. Use your existing continuous integration and delivery (CI/CD) pipeline. Use the generated Docker images and deploy them to Cloud Function. Use the same configuration as on-premises.
- D. Use your existing codebase and deploy each service as a separate Cloud Run Use the same configurations as on-premises.
Answer: A
NEW QUESTION # 127
Your company is closely monitoring their cloud spend. You need to allow different teams to monitor their Google Cloud costs. You must ensure that team members receive notifications when their cloud spend reaches certain thresholds and give team members the ability to create dashboards for additional insights with detailed billing data. You want to follow Google-recommended practices and minimize engineering costs. What should you do?
- A. Deploy Grafana to Compute Engine. Create a dashboard for each team that uses the data from the Cloud Billing API. Ask each team to create their own alerts in Cloud Monitoring.
- B. Deploy Grafana to Compute Engine. Create a dashboard for each team that uses the data from the Cloud Billing Budget API. Ask each team to create their own alerts in Grafana.
- C. Set up alerts for each team based on required thresholds. Set up billing exports to BigQuery. Grant team members access to BigQuery.
- D. Set up alerts for each team based on required thresholds. Create a shell script to read data from the Cloud Billing API and push the results to BigQuery. Grant team members access to BigQuery.
Answer: C
Explanation:
This solution leverages the native, fully-managed Google Cloud services for cost monitoring, which minimizes engineering costs and follows best practices.
* Threshold Notifications: The native Cloud Billing Budgets feature (as referenced in Question 14) is used to set up automated alerts when spend reaches certain thresholds.
* Detailed Insights/Dashboards: The most scalable and cost-effective way to provide detailed billing data for analysis, custom queries, and custom dashboards is to use Cloud Billing Export to BigQuery.
BigQuery can handle massive amounts of data and allows teams to query the data and use BI tools (like Google Looker Studio, which is often used with BigQuery) to create their own dashboards.
* Cost/Overhead Minimization: Options A, B, and C introduce custom scripts (B) or external/self- managed tools like Grafana on Compute Engine (A and C), which directly contradict the goal of minimizing engineering costs. Using BigQuery Export is the fully managed, recommended data solution.
Reference: Google Cloud Billing documentation, specifically the "Exporting Cloud Billing data to BigQuery" guide and the "Setting and managing budgets and budget alerts" guide.
NEW QUESTION # 128
Your company uses a large number of Google Cloud services centralized in a single project. All teams have specific projects for testing and development. The DevOps team needs access to all of the production services in order to perform their job. You want to prevent Google Cloud product changes from broadening their permissions in the future. You want to follow Google-recommended practices. What should you do?
- A. Create a custom role that combines the required permissions. Grant the DevOps team the custom role on the organization level.
- B. Grant all members of the DevOps team the role of Project Editor on the production project.
- C. Grant all members of the DevOps team the role of Project Editor on the organization level.
- D. Create a custom role that combines the required permissions. Grant the DevOps team the custom role on the production project.
Answer: D
Explanation:
Understanding IAM custom roles
Key Point: Custom roles enable you to enforce the principle of least privilege, ensuring that the user and service accounts in your organization have only the permissions essential to performing their intended functions.
Basic concepts
Custom roles are user-defined, and allow you to bundle one or more supported permissions to meet your specific needs. Custom roles are not maintained by Google; when new permissions, features, or services are added to Google Cloud, your custom roles will not be updated automatically.
When you create a custom role, you must choose an organization or project to create it in. You can then grant the custom role on the organization or project, as well as any resources within that organization or project.
https://cloud.google.com/iam/docs/understanding-custom-roles#basic_concepts
NEW QUESTION # 129
You are running multiple microservices in a Kubernetes Engine cluster. One microservice is rendering images. The microservice responsible for the image rendering requires a large amount of CPU time compared to the memory it requires. The other microservices are workloads that are optimized for n1-standard machine types. You need to optimize your cluster so that all workloads are using resources as efficiently as possible.
What should you do?
- A. Create a node pool with compute-optimized machine type nodes for the image rendering microservice.
Use the node pool with general-purpose machine type nodes for the other microservices - B. Configure the required amount of CPU and memory in the resource requests specification of the image rendering microservice deployment.
Keep the resource requests for the other microservices at the default - C. Use the node pool with general-purpose machine type nodes for lite mage rendering microservice .
Create a nodepool with compute-optimized machine type nodes for the other microservices - D. Assign the pods of the image rendering microservice a higher pod priority than the older microservices
Answer: A
NEW QUESTION # 130
......
Online Questions - Valid Practice Associate-Cloud-Engineer Exam Dumps Test Questions: https://gocertify.actual4labs.com/Google/Associate-Cloud-Engineer-actual-exam-dumps.html