Google Associate Cloud Engineer Practice Exams
Last updated on Oct 21,2026- Exam Code: Associate Cloud Engineer
- Exam Name: Google Cloud Certified – Associate Cloud Engineer
- Certification Provider: Google
- Latest update: Oct 21,2026
You have been asked to migrate a docker application from datacenter to cloud. Your solution architect has suggested uploading docker images to GCR in one project and running an application in a GKE cluster in a separate project. You want to store images in the project img-278322 and run the application in the project prod-278986. You want to tag the image as acme_track_n_trace:v1. You want to follow Google-recommended practices.
What should you do?
- A . Run gcloud builds submit –tag gcr.io/img-278322/acme_track_n_trace
- B . Run gcloud builds submit –tag gcr.io/img-278322/acme_track_n_trace:v1
- C . Run gcloud builds submit –tag gcr.io/prod-278986/acme_track_n_trace
- D . Run gcloud builds submit –tag gcr.io/prod-278986/acme_track_n_trace:v1
B
Explanation:
Explanation
Run gcloud builds submit tag gcr.io/img-278322/acme_track_n_trace:v1. is the right answer.
This command correctly tags the image as acme_track_n_trace:v1 and uploads the image to the img-278322 project.
Ref: https://cloud.google.com/sdk/gcloud/reference/builds/submit
Your development team needs a new Jenkins server for their project. You need to deploy the server using the fewest steps possible.
What should you do?
- A . Download and deploy the Jenkins Java WAR to App Engine Standard.
- B . Create a new Compute Engine instance and install Jenkins through the command line interface.
- C . Create a Kubernetes cluster on Compute Engine and create a deployment with the Jenkins Docker image.
- D . Use GCP Marketplace to launch the Jenkins solution.
D
Explanation:
Reference: https://cloud.google.com/solutions/using-jenkins-for-distributed-builds-on-compute-engine
You want to add a new auditor to a Google Cloud Platform project. The auditor should be allowed to read, but not modify, all project items.
How should you configure the auditor’s permissions?
- A . Create a custom role with view-only project permissions. Add the user’s account to the custom role.
- B . Create a custom role with view-only service permissions. Add the user’s account to the custom role.
- C . Select the built-in IAM project Viewer role. Add the user’s account to this role.
- D . Select the built-in IAM service Viewer role. Add the user’s account to this role.
C
Explanation:
Reference: https://cloud.google.com/resource-manager/docs/access-control-proj
The primitive role roles/viewer provides read access to all resources in the project. The permissions in this role are limited to Get and list access for all resources. As we have an out of the box role that exactly fits our requirement, we should use this.
Ref: https://cloud.google.com/resource-manager/docs/access-control-proj
It is advisable to use the existing GCP provided roles over creating custom roles with similar permissions as this becomes a maintenance overhead. If GCP modifies how permissions are handled or adds/removes permissions, the default GCP provided roles are automatically updated by Google whereas if they were custom roles, the responsibility is with us and this adds to the operational overhead and needs to be avoided.
Several employees at your company have been creating projects with Cloud Platform and paying for it with their personal credit cards, which the company reimburses. The company wants to centralize all these projects under a single, new billing account.
What should you do?
- A . Contact [email protected] with your bank account details and request a corporate billing account for your company.
- B . Create a ticket with Google Support and wait for their call to share your credit card details over the phone.
- C . In the Google Platform Console, go to the Resource Manage and move all projects to the root Organization.
- D . In the Google Cloud Platform Console, create a new billing account and set up a payment method.
D
Explanation:
(https://cloud.google.com/resource-manager/docs/project-migration#change_billing_account)
https://cloud.google.com/billing/docs/concepts
https://cloud.google.com/resource-manager/docs/project-migration
You have been asked to set up Object Lifecycle Management for objects stored in storage buckets. The objects are written once and accessed frequently for 30 days. After 30 days, the objects are not read again unless there is a special need. The object should be kept for three years, and you need to minimize cost.
What should you do?
- A . Set up a policy that uses Nearline storage for 30 days and then moves to Archive storage for three years.
- B . Set up a policy that uses Standard storage for 30 days and then moves to Archive storage for three years.
- C . Set up a policy that uses Nearline storage for 30 days, then moves the Coldline for one year, and then moves to Archive storage for two years.
- D . Set up a policy that uses Standard storage for 30 days, then moves to Coldline for one year, and then moves to Archive storage for two years.
B
Explanation:
The key to understand the requirement is : "The objects are written once and accessed frequently for
30 days" Standard Storage
Standard Storage is best for data that is frequently accessed ("hot" data) and/or stored for only brief periods of time.
Archive Storage
Archive Storage is the lowest-cost, highly durable storage service for data archiving, online backup, and disaster recovery. Unlike the "coldest" storage services offered by other Cloud providers, your data is available within milliseconds, not hours or days. Archive Storage is the best choice for data that you plan to access less than once a year.
https://cloud.google.com/storage/docs/storage-classes#standard
You built an application on Google Cloud Platform that uses Cloud Spanner. Your support team needs to monitor the environment but should not have access to table data. You need a streamlined solution to grant the correct permissions to your support team, and you want to follow Google-recommended practices.
What should you do?
- A . Add the support team group to the roles/monitoring.viewer role
- B . Add the support team group to the roles/spanner.databaseUser role.
- C . Add the support team group to the roles/spanner.databaseReader role.
- D . Add the support team group to the roles/stackdriver.accounts.viewer role.
A
Explanation:
roles/monitoring.viewer provides read-only access to get and list information about all monitoring data and configurations. This role provides monitoring access and fits our requirements. roles/monitoring.viewer. is the right answer.
Ref: https://cloud.google.com/iam/docs/understanding-roles#cloud-spanner-roles
You create a new Google Kubernetes Engine (GKE) cluster and want to make sure that it always runs a supported and stable version of Kubernetes.
What should you do?
- A . Enable the Node Auto-Repair feature for your GKE cluster.
- B . Enable the Node Auto-Upgrades feature for your GKE cluster.
- C . Select the latest available cluster version for your GKE cluster.
- D . Select “Container-Optimized OS (cos)” as a node image for your GKE cluster.
B
Explanation:
Creating or upgrading a cluster by specifying the version as latest does not provide automatic upgrades. Enable node auto-upgrades to ensure that the nodes in your cluster are up-to-date with the latest stable version.
https://cloud.google.com/kubernetes-engine/versioning-and-upgrades
Node auto-upgrades help you keep the nodes in your cluster up to date with the cluster master version when your master is updated on your behalf. When you create a new cluster or node pool with Google Cloud Console or the gcloud command, node auto-upgrade is enabled by default.
Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-upgrades
You create a new Google Kubernetes Engine (GKE) cluster and want to make sure that it always runs a supported and stable version of Kubernetes.
What should you do?
- A . Enable the Node Auto-Repair feature for your GKE cluster.
- B . Enable the Node Auto-Upgrades feature for your GKE cluster.
- C . Select the latest available cluster version for your GKE cluster.
- D . Select “Container-Optimized OS (cos)” as a node image for your GKE cluster.
B
Explanation:
Creating or upgrading a cluster by specifying the version as latest does not provide automatic upgrades. Enable node auto-upgrades to ensure that the nodes in your cluster are up-to-date with the latest stable version.
https://cloud.google.com/kubernetes-engine/versioning-and-upgrades
Node auto-upgrades help you keep the nodes in your cluster up to date with the cluster master version when your master is updated on your behalf. When you create a new cluster or node pool with Google Cloud Console or the gcloud command, node auto-upgrade is enabled by default.
Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-upgrades
Your company set up a complex organizational structure on Google Could Platform. The structure includes hundreds of folders and projects. Only a few team members should be able to view the hierarchical structure. You need to assign minimum permissions to these team members and you want to follow Google-recommended practices.
What should you do?
- A . Add the users to roles/browser role.
- B . Add the users to roles/iam.roleViewer role.
- C . Add the users to a group, and add this group to roles/browser role.
- D . Add the users to a group, and add this group to roles/iam.roleViewer role.
C
Explanation:
We need to apply the GCP Best practices. roles/browser Browser Read access to browse the hierarchy for a project, including the folder, organization, and IAM policy. This role doesn’t include permission to view resources in the project. https://cloud.google.com/iam/docs/understanding-roles
After a recent security incident, your startup company wants better insight into what is happening in the Google Cloud environment. You need to monitor unexpected firewall changes and instance creation. Your company prefers simple solutions.
What should you do?
- A . Use Cloud Logging filters to create log-based metrics for firewall and instance actions. Monitor the changes and set up reasonable alerts.
- B . Install Kibana on a compute Instance. Create a log sink to forward Cloud Audit Logs filtered for firewalls and compute instances to Pub/Sub. Target the Pub/Sub topic to push messages to the Kibana instance.
Analyze the logs on Kibana in real time. - C . Turn on Google Cloud firewall rules logging, and set up alerts for any insert, update, or delete events.
- D . Create a log sink to forward Cloud Audit Logs filtered for firewalls and compute instances to Cloud Storage.
Use BigQuery to periodically analyze log events in the storage bucket.