Coding N Concepts
Google Cloud Associate Cloud Engineer (ACE) Exam Questions
Page content
Comprehensive list of Free Google Cloud Associate Cloud Engineer (ACE) exam questions, grouped by official exam domain, curated for cracking the exam with confidence.
Disclaimer: Google Cloud is a protected Brand. These exam questions are neither endorsed by nor affiliated with Google. These are not the official Google Cloud exam questions/dumps. These questions are created from the official Google Cloud documentation and the publicly published Associate Cloud Engineer exam guide. These questions cover all the objectives of the ACE official exam, and once you go through these questions and their concepts, you are more than ready to crack the exam in first attempt.
Note: The real ACE exam is 100% multiple choice and multiple select — there are no hands-on, performance-based tasks. The questions below are scenario-based practice questions, in the same format as our other certification posts, meant to solidify your understanding of every ACE exam domain before exam day.
Overview
- This is an Associate level certification for cloud engineers who deploy applications, monitor operations, and manage Google Cloud solutions.
- No prerequisites, but Google recommends 6+ months of hands-on experience with Google Cloud.
- The exam costs 125 USD (plus tax where applicable).
- You need to answer 50 to 60 multiple choice and multiple select questions in 2 hours, delivered online-proctored (remote) or onsite at a Pearson VUE testing center.
- Google does not publish a specific passing score for this exam.
- The certification is valid for 3 years.
- Associate Cloud Engineer Exam Guide (PDF) and Official Exam Page for more details.
50 Practice Questions
| # | Domain | Weight | Questions below |
|---|---|---|---|
| 1 | Setting up a cloud solution environment | 20% | 10 |
| 2 | Planning and implementing a cloud solution | 30% | 15 |
| 3 | Ensuring the successful operation of a cloud solution | 30% | 15 |
| 4 | Configuring access and security | 20% | 10 |
Domain 1: Setting up a cloud solution environment (20%)
A city government’s Google Cloud organization has three folders: “Production”, “Development”, and “Shared-Services”. The security team wants a constraint that disables external IP addresses on VM instances to apply automatically to every current and future project in the “Production” folder, without configuring it separately for each project.
⬜ A. Apply the organization policy constraint constraints/compute.vmExternalIpAccess directly to each project inside Production individually
⬜ B. Apply the constraint at the organization node and use IAM conditions to scope it to Production only
✅ C. Apply the constraint on the “Production” folder so it is inherited by all projects and sub-folders beneath it
⬜ D. Create a custom IAM role that denies the compute.instances.setMetadata permission for Production projects
Correct answer: C
Organization policy constraints applied at a folder node are inherited down the resource hierarchy by every project and sub-folder beneath it, so a single policy set on “Production” automatically covers current and future projects there.
Why other options are incorrect
A. Applying the constraint project-by-project works but does not scale and must be repeated for every new project, defeating the goal of automatic inheritance.
B. Organization policies are not scoped using IAM conditions; IAM conditions apply to IAM role bindings, not to Organization Policy Service constraints.
D. IAM roles and permissions control who can perform actions; they cannot disable a resource configuration option like external IP assignment — that is what organization policy constraints are for.
A data analytics team needs a small set of engineers to run BigQuery jobs and read datasets, but the built-in BigQuery Admin role grants far more permissions than required, including deleting datasets and managing IAM policies. What should the cloud administrator do to follow the principle of least privilege?
⬜ A. Grant the engineers the primitive Editor role, which includes BigQuery permissions along with broad project-wide access
✅ B. Grant the predefined roles/bigquery.jobUser and roles/bigquery.dataViewer roles instead of BigQuery Admin
⬜ C. Grant BigQuery Admin but use IAM Conditions to restrict it to business hours only
⬜ D. Create a service account with BigQuery Admin and have engineers impersonate it for all queries
Correct answer: B
The predefined BigQuery Job User and BigQuery Data Viewer roles grant exactly the permissions needed to run queries and read data, without administrative permissions like dataset deletion or IAM policy management — matching the principle of least privilege.
Why other options are incorrect
A. The primitive Editor role is even broader than BigQuery Admin, granting write access across most services in the project, which is the opposite of least privilege.
C. An IAM Condition can restrict when a role applies, but BigQuery Admin still grants the same overly broad set of permissions during allowed hours.
D. Having engineers impersonate an admin service account still ultimately grants admin-level permissions to the engineers’ workflow; impersonation is indirection, not a reduction in privilege.
Source: Choose which type of role to use
A company with 200 engineers onboards and offboards staff frequently and wants new hires on the “data-team” to automatically receive the same set of IAM roles on relevant projects as soon as they join, without an administrator manually granting roles to each new user account.
✅ A. Create a Google Group in Cloud Identity, grant IAM roles to the group, and add or remove members as staffing changes
⬜ B. Grant IAM roles directly to each user’s individual Google Account and update policies whenever staffing changes
⬜ C. Create a new custom IAM role for every new engineer that copies permissions from an existing engineer
⬜ D. Use Workforce Identity Federation to map each new hire’s corporate directory attribute directly to a project-level primitive role
Correct answer: A
Google Cloud IAM best practice is to bind roles to Cloud Identity Google Groups rather than individual users; access changes as staffing changes simply by adding or removing group membership, with no per-user IAM policy edits required.
Why other options are incorrect
B. Binding roles to individual accounts requires manual IAM policy updates for every hire and departure, which does not scale and is exactly what the team wants to avoid.
C. Creating a brand-new custom role per engineer is unnecessary overhead and does not automatically apply to new hires without manual role creation and assignment.
D. Workforce Identity Federation is for federating external identity providers so workforce users can authenticate without Google-managed accounts; it is not the mechanism for automatically applying a reusable set of project IAM roles to new hires — group-based IAM binding is.
Source: Create and manage Google groups in the Google Cloud console
A developer just created a brand-new Google Cloud project and immediately tries to run gcloud compute instances create, but the command fails with an error indicating the Compute Engine API is not enabled for the project. What is the correct way to resolve this before creating the instance?
⬜ A. Request a quota increase for the Compute Engine API from Cloud Quotas
⬜ B. Grant the developer the Owner role at the organization level
⬜ C. Recreate the project inside a folder that already has Compute Engine enabled
✅ D. Run gcloud services enable compute.googleapis.com (or enable it under “APIs & Services” in the console) for the project
Correct answer: D
APIs must be explicitly enabled per project using the Service Usage API before their resources can be created; gcloud services enable compute.googleapis.com (or the equivalent console action) enables the Compute Engine API for that specific project.
Why other options are incorrect
A. A quota increase adjusts a numeric limit on an already-enabled service; it has no effect if the API itself has never been enabled.
B. Holding the Owner role controls what the developer is authorized to do, but it does not itself enable any API for the project.
C. API enablement is a per-project setting managed through Service Usage; it is not inherited automatically from a folder, and there is no concept of a folder having “Compute Engine enabled” for its child projects.
Source: gcloud services enable
The operations team wants to be paged automatically via Slack whenever the average CPU utilization of a production Compute Engine instance group exceeds 90% for 5 minutes. Which Google Cloud Observability capability should they configure?
⬜ A. A Cloud Logging log-based metric with no alerting configured, reviewed manually each morning
✅ B. A Cloud Monitoring alerting policy with a metric-threshold condition and a Slack notification channel
⬜ C. A budget alert on the billing account tied to compute spend
⬜ D. An organization policy constraint that blocks instances from exceeding 90% CPU
Correct answer: B
Cloud Monitoring alerting policies let you define a condition on a metric (such as CPU utilization exceeding a threshold for a set duration) and attach notification channels, including Slack, so the team is paged automatically when the condition is met.
Why other options are incorrect
A. A log-based metric without an attached alerting policy requires someone to manually check it, which does not meet the requirement for automatic paging.
C. Budget alerts notify on billing spend thresholds, not on runtime performance metrics like CPU utilization.
D. Organization policy constraints govern resource configuration options (such as disabling features), not runtime behavior; there is no constraint that throttles or blocks high CPU usage.
Source: Alerting overview
A team’s batch-processing job is being throttled because it needs to create 50 Compute Engine instances simultaneously in us-central1, but the project’s regional CPU quota only allows 24 vCPUs. What should they do to run the job without redesigning the architecture?
⬜ A. Move the workload to a different Google Cloud organization that has no quotas
⬜ B. Contact Google Cloud sales to purchase additional committed use discounts
✅ C. Request a quota increase for the relevant CPU quota in that region from the Quotas page (IAM & Admin) or via the Cloud Quotas API
⬜ D. Delete the default VPC network to free up additional compute quota
Correct answer: C
Quotas are per-project, per-region limits that can be raised by submitting a quota increase request through the Quotas page in the console or the Cloud Quotas API; approval typically restores the ability to create the needed number of instances.
Why other options are incorrect
A. Quotas are enforced per project regardless of which organization it belongs to, and Google Cloud projects always have quotas; there is no quota-free organization.
B. Committed use discounts are a pricing mechanism for reduced rates on sustained usage; they do not raise or bypass regional resource quotas.
D. Deleting the default VPC network has no effect on Compute Engine CPU quota, which is unrelated to VPC network configuration.
Source: View and manage quotas
A security team needs to answer “which Compute Engine firewall rules and IAM policies existed on this project 20 days ago” for an audit, without having manually taken snapshots at the time. Which Google Cloud service is designed for this?
✅ A. Cloud Asset Inventory, which retains a history of resource metadata changes and lets you query state as of a past point in time
⬜ B. Recommender, which only provides forward-looking cost and security recommendations
⬜ C. VPC Flow Logs, which capture only network traffic metadata, not IAM policy changes
⬜ D. Security Command Center Standard tier, which does not retain historical resource metadata the way Cloud Asset Inventory does
Correct answer: A
Cloud Asset Inventory keeps up to 35 days of create, update, and delete history for asset metadata — including firewall rule configurations and IAM policies — and supports querying or exporting that historical state, making it possible to answer “what existed 20 days ago.”
Why other options are incorrect
B. Recommender surfaces forward-looking suggestions (cost, security, performance) based on current usage; it does not provide historical point-in-time resource state.
C. VPC Flow Logs record network traffic metadata between instances; they do not capture firewall rule definitions or IAM policy history.
D. Security Command Center focuses on security findings and posture, and relies on Cloud Asset Inventory data under the hood rather than providing its own independent historical asset timeline.
Source: Cloud Asset Inventory overview
An enterprise wants its employees to sign in to the Google Cloud console using their existing Okta credentials, without Google managing separate passwords for each employee and without syncing every employee into Cloud Identity as a Google-managed user.
⬜ A. Enable Workload Identity Federation and configure Okta as an attribute-based workload pool
⬜ B. Deploy Google Cloud Directory Sync (GCDS) to continuously sync all Okta users into Cloud Identity
⬜ C. Create individual Cloud Identity accounts for each employee and enable 2-Step Verification
✅ D. Configure Workforce Identity Federation with Okta as the external identity provider so employees federate in via SAML or OIDC without Google-managed accounts
Correct answer: D
Workforce Identity Federation lets an external identity provider such as Okta authenticate workforce users (employees, partners, contractors) via SAML or OIDC; it is sync-less, meaning Google Cloud does not store or manage a separate Google account or password for each user.
Why other options are incorrect
A. Workload Identity Federation is designed for non-human workloads (applications or services running outside Google Cloud) to access Google Cloud resources, not for human employees signing in to the console — that is what Workforce Identity Federation is for.
B. GCDS synchronizes directory users into Cloud Identity as Google-managed accounts, which is exactly what the requirement says to avoid.
C. Manually creating individual Cloud Identity accounts still means Google manages separate credentials per employee, contradicting the requirement to use existing Okta credentials without Google-managed accounts.
Source: Workforce Identity Federation
A cloud administrator creates a new Google Cloud project for a proof-of-concept, but when trying to create a Cloud Storage bucket, the console shows “billing is not enabled for this project” and most APIs cannot be used. What must the administrator do first?
⬜ A. Set an IAM policy granting the Billing Account Administrator role to the project itself
✅ B. Link the project to an active Cloud Billing account, either at project creation or afterward through the Billing page
⬜ C. Enable a budget on the project so charges can start being tracked
⬜ D. Request a quota increase for the project’s billing budget
Correct answer: B
Most resource creation on Google Cloud requires the project to be linked to an active Cloud Billing account; this is done from the Billing page in the console (or with gcloud billing projects link), either during project creation or afterward.
Why other options are incorrect
A. The Billing Account Administrator IAM role is granted to a principal such as a user or group so they can manage a billing account; granting it “to the project” does not link the project to a billing account.
C. Budgets track and alert on spending after billing is already enabled for a project; creating a budget does not itself enable billing.
D. There is no such thing as a “billing budget quota” to increase; quotas govern resource usage limits, not the billing-linkage status of a project.
A finance manager sets up a Cloud Billing budget of $5,000/month for a project with alert thresholds at 50%, 90%, and 100%, sent to their email. After the project’s spend reaches 100% of the budget in the middle of the month, what happens by default?
⬜ A. Google Cloud automatically disables billing for the project, stopping all resource usage
⬜ B. All running Compute Engine instances are automatically stopped to prevent further charges
✅ C. The finance manager receives an email alert, but spending continues uninterrupted unless automated actions are separately configured to cap or stop usage
⬜ D. The project’s quota for every service is automatically reduced to zero
Correct answer: C
By default, Cloud Billing budgets and budget alerts only send notifications (email, or a Pub/Sub message that can drive custom automation) when a threshold is crossed; they do not automatically disable billing, stop instances, or cap spending unless the administrator explicitly builds or enables that automated response.
Why other options are incorrect
A. Budgets do not automatically disable project billing; that would require a separately built automation reacting to the budget’s Pub/Sub notification.
B. Reaching a budget threshold does not trigger any automatic instance shutdown; instances keep running and continue to incur charges.
D. Budget alerts have no effect on service quotas; quotas and budgets are independent mechanisms.
Domain 2: Planning and implementing a cloud solution (30%)
A team is building a stateless REST API that receives unpredictable, bursty traffic — sometimes zero requests for hours — and wants to avoid managing servers, clusters, or scaling configuration, while paying only for actual request-handling time. Which compute option best fits?
✅ A. Cloud Run, which runs stateless containers on a fully managed serverless platform that scales automatically, including to zero
⬜ B. A GKE Standard cluster with a fixed 3-node pool, so the API always has capacity to absorb bursts
⬜ C. A single Compute Engine e2-standard-4 VM running the container with a static IP address
⬜ D. A zonal managed instance group with a fixed instance count of 5 machines
Correct answer: A
Cloud Run is Google Cloud’s fully managed serverless platform for stateless containers; it scales automatically based on incoming requests, including down to zero instances during idle periods, and bills only for the resources used while handling requests.
Why other options are incorrect
B. A GKE Standard cluster with a fixed node pool requires the team to manage cluster and node infrastructure, and fixed nodes keep incurring cost even when there is zero traffic.
C. A single always-on VM has no automatic scaling for bursts, represents a single point of failure, and keeps incurring cost during idle periods.
D. A managed instance group with a fixed instance count does not scale to zero or automatically respond to bursty traffic; it still requires managing an instance template and health checks.
Source: What is Cloud Run
A platform team manages 300 Compute Engine VMs across many projects. Currently, whenever an engineer joins or leaves the team, someone must manually add or remove that engineer’s SSH public key in each VM’s instance metadata — an error-prone, hard-to-audit process. Which feature should they enable to centralize SSH access control through IAM instead?
⬜ A. VPC firewall rules that allow SSH only from the corporate office IP range
⬜ B. Shielded VM, to cryptographically verify each engineer’s identity before SSH
⬜ C. Adding the SSH keys to project-wide metadata instead of per-instance metadata
✅ D. OS Login, which links each engineer’s Google identity to their Linux OS user account and grants or revokes SSH access via IAM roles
Correct answer: D
OS Login links a user’s Google identity to a Linux OS user account; SSH access is then granted or revoked centrally by assigning or removing IAM roles such as roles/compute.osLogin, so access changes take effect immediately across all VMs without touching per-instance metadata.
Why other options are incorrect
A. Firewall rules control network-level reachability (which source IPs can reach port 22); they do not manage or audit per-user SSH key authorization.
B. Shielded VM protects boot integrity and detects rootkits/bootkits; it has nothing to do with managing which individual users can SSH into a VM.
C. Moving keys to project-wide metadata still requires manually adding and removing individual SSH keys and does not use IAM roles for centralized, auditable, instantly revocable access.
Source: About OS Login
A team runs a stateful database on a single Compute Engine VM and wants the underlying disk to keep serving with no data loss if the entire zone the VM is running in becomes unavailable, without relying on database-level replication. Which storage option should they choose?
⬜ A. A zonal Persistent Disk with daily scheduled snapshots
✅ B. A Regional Persistent Disk, which synchronously replicates data across two zones in the same region
⬜ C. Local SSD, which offers the highest IOPS but is physically attached to a single server
⬜ D. A Cloud Storage bucket configured with the Standard storage class, mounted as a filesystem
Correct answer: B
Regional Persistent Disk synchronously replicates data between two zones in the same region, providing high availability for disk data through a single zonal failure without requiring the database itself to implement replication.
Why other options are incorrect
A. Zonal Persistent Disk snapshots are point-in-time backups taken on a schedule, not synchronous replication; there is a data-loss window between the last snapshot and the zone failure, and restoring requires manual intervention.
C. Local SSD is physically attached to the host server, and its data is lost if that server or its zone fails; it cannot survive a zonal outage.
D. Cloud Storage is an object storage service, not designed to be mounted as low-latency, POSIX-style block storage for a running database.
Source: Build highly available services using regional persistent disks
A web application’s traffic varies significantly between weekdays and weekends. The team wants Compute Engine to automatically add or remove VM instances based on average CPU utilization, using a consistent, versioned VM configuration for every instance it creates. What should they set up?
⬜ A. A single Compute Engine VM resized manually with gcloud compute instances set-machine-type during peak hours
⬜ B. Multiple independent VMs created from separate gcloud compute instances create commands with matching configurations
✅ C. A managed instance group (MIG) built from an instance template, with autoscaling configured on a CPU-utilization target
⬜ D. An unmanaged instance group behind a load balancer, with an administrator manually adding VMs when Cloud Monitoring shows high CPU
Correct answer: C
A managed instance group built from an instance template ensures every instance is created with the same versioned configuration, and an autoscaler attached to the MIG can automatically add or remove instances based on a target metric such as average CPU utilization.
Why other options are incorrect
A. Manually resizing a single VM does not scale out or in automatically and typically requires stopping and restarting the instance, causing downtime.
B. Independently created VMs are not managed as a group; there is no automatic scaling, health-based recreation, or template versioning across them.
D. An unmanaged instance group does not support autoscaling or automated health checking, and relying on a person to manually add VMs does not meet the requirement for automatic scaling.
Source: Autoscaling groups of instances
A regulated fintech company is deploying a GKE cluster and requires that worker nodes must not be reachable from, or able to directly reach, the public internet, while still allowing engineers to manage the cluster from the corporate network. Which GKE configuration should they use?
✅ A. A private cluster, where nodes are provisioned with only internal IP addresses, combined with authorized networks restricting control plane access
⬜ B. A zonal Standard cluster with default networking, where nodes receive ephemeral external IPs
⬜ C. A GKE Autopilot cluster with public endpoint access enabled for all IP ranges (0.0.0.0/0)
⬜ D. A cluster in the default VPC with a firewall rule allowing SSH from anywhere
Correct answer: A
In a GKE private cluster, nodes are provisioned with only internal IP addresses, preventing direct inbound or outbound internet access to the nodes; pairing this with authorized networks for the control plane restricts cluster management access to trusted ranges such as the corporate network.
Why other options are incorrect
B. Default networking with ephemeral external node IPs gives nodes public internet reachability, which is the opposite of the stated requirement.
C. Enabling public control plane access for 0.0.0.0/0 exposes the cluster’s management endpoint to the entire internet rather than restricting it to trusted networks.
D. Allowing SSH from anywhere widens exposure to the nodes rather than restricting their internet reachability, and does not address node IP configuration at all.
Source: About network isolation in GKE
A retailer wants to run ad-hoc SQL analytics over many years of point-of-sale transaction data, totaling tens of terabytes, with fast query response and no need to manage servers or clusters. Which Google Cloud data product is the best fit?
⬜ A. Cloud SQL for MySQL, scaled to the largest available machine type
⬜ B. Firestore, using collection group queries across all transaction documents
⬜ C. Memorystore for Redis, with transaction data cached in memory
✅ D. BigQuery, a serverless, highly scalable enterprise data warehouse designed for fast SQL analytics over large datasets
Correct answer: D
BigQuery is a serverless, fully managed enterprise data warehouse purpose-built for running fast SQL analytics over very large datasets, without requiring the team to provision or manage any servers or clusters.
Why other options are incorrect
A. Cloud SQL is a relational OLTP database with vertical scaling limits on a single instance; it is not designed for ad-hoc analytical scans over tens of terabytes of historical data.
B. Firestore is a NoSQL document database optimized for application data and low-latency lookups, not for large-scale ad-hoc SQL analytics across years of transactions.
C. Memorystore for Redis is an in-memory cache with limited capacity and no durability guarantees suited to being a system of record; it is not designed to hold years of historical transaction data for analytics.
Source: BigQuery overview
A hospital must retain patient imaging records for regulatory compliance for at least 7 years and expects to access any given file less than once per year, but occasionally needs to retrieve a specific file immediately when requested by auditors. Which Cloud Storage class minimizes storage cost while meeting the retrieval need?
⬜ A. Standard storage class, since it has no minimum storage duration and the lowest per-request retrieval fees
✅ B. Archive storage class, the lowest-cost class, intended for data accessed less than once a year while still retrievable within milliseconds
⬜ C. Nearline storage class, since its 30-day minimum storage duration matches monthly compliance reviews
⬜ D. A Persistent Disk snapshot stored in the same zone as the compute instance that originally wrote the data
Correct answer: B
Archive is Cloud Storage’s lowest-cost storage class, intended for data accessed less than once a year, such as long-term compliance archives and disaster recovery data, while still allowing millisecond retrieval when a file is needed.
Why other options are incorrect
A. Standard storage has the highest per-GB storage price among the classes, making it the most expensive choice for data that is rarely accessed over a 7-year retention period.
C. Nearline is intended for data accessed roughly once a month, not once a year, and its access pattern and 30-day minimum storage duration are mismatched to this hospital’s once-a-year-or-less access profile.
D. Persistent Disk snapshots are backups of VM disks, not a general-purpose durable archival storage product, and are not priced or designed for long-term compliance archiving.
Source: Storage classes
A global fintech company needs a relational database for a payments ledger that must scale horizontally across regions to handle massive write throughput, while still guaranteeing strong consistency and ACID transactions across all replicas. Cloud SQL’s single-instance model can’t meet the scale requirement. Which product should they choose?
⬜ A. Bigtable, since it offers unlimited horizontal scale for structured payment records
⬜ B. Cloud SQL with read replicas in every region to distribute the write load
✅ C. Cloud Spanner, a horizontally scalable, globally distributed relational database that provides strong consistency and ACID transactions
⬜ D. Firestore in Datastore mode, configured in a multi-region location for strong consistency
Correct answer: C
Cloud Spanner is a horizontally scalable, globally distributed relational database that combines a relational schema with strong (external) consistency and ACID transactions, purpose-built for workloads that outgrow a single-instance relational database like Cloud SQL.
Why other options are incorrect
A. Bigtable is a NoSQL wide-column store without a relational schema, joins, or multi-row ACID transactions across arbitrary keys, so it does not fit a relational payments ledger requirement.
B. Cloud SQL read replicas scale read throughput, not write throughput; all writes still go through a single primary instance, which remains the scaling bottleneck.
D. Firestore is a NoSQL document database; even in Datastore mode it lacks relational schema and SQL joins needed for a relational ledger.
Source: Cloud Spanner
A media company currently stores 200 TB of video assets in an Amazon S3 bucket and wants to migrate them to Cloud Storage on a recurring schedule, with built-in retry, filtering, and validation, without writing custom migration scripts. Which Google Cloud tool should they use?
✅ A. Storage Transfer Service, which supports scheduled, managed transfers from Amazon S3 and other sources directly into Cloud Storage
⬜ B. gsutil rsync run manually once per day from an administrator’s laptop
⬜ C. Cloud Data Fusion, a visual ETL tool intended for building custom data pipelines with transformation logic
⬜ D. BigQuery Data Transfer Service, since it can load any file type from S3 into a Cloud Storage bucket
Correct answer: A
Storage Transfer Service is purpose-built for large-scale, scheduled, and managed data transfers into Cloud Storage from sources such as Amazon S3, S3-compatible storage, and other Cloud Storage buckets, with built-in scheduling, retries, and transfer validation.
Why other options are incorrect
B. Running gsutil rsync manually from a laptop is not scheduled or managed at scale, lacks the reliability guarantees needed for 200 TB, and requires the laptop to remain online for the transfer to complete.
C. Cloud Data Fusion is designed for building visual ETL/data transformation pipelines, not as the simplest, purpose-built tool for a straightforward object migration from S3.
D. BigQuery Data Transfer Service loads data into BigQuery tables from supported sources; it does not transfer arbitrary files into a Cloud Storage bucket.
An enterprise’s network security team wants sole control over creating subnets, routes, and firewall rules, while individual application teams — each working in their own project — should be able to deploy VMs and GKE clusters into those centrally managed networks without being able to modify network configuration themselves. Which Google Cloud networking approach fits this requirement?
⬜ A. VPC Network Peering between each application team’s own independent VPC and a central “hub” VPC
⬜ B. A separate VPC network duplicated in every application team’s project and kept in sync manually
⬜ C. Granting every application team’s project the Network Admin role on its own project’s default VPC
✅ D. Shared VPC, where a host project holds the centrally managed VPC network and application teams’ service projects attach to it to deploy resources using its subnets
Correct answer: D
Shared VPC lets a host project centrally hold and administer the VPC network — subnets, routes, and firewall rules — while application teams work in service projects attached to that host project, deploying VMs and GKE clusters into the shared subnets without being able to modify the network configuration themselves.
Why other options are incorrect
A. VPC Network Peering connects two independently administered VPC networks as peers; each side still manages its own network configuration, so it does not centralize control with the security team.
B. Manually duplicating a VPC network across projects is not centralized administration, does not scale, and is prone to configuration drift.
C. Granting each application team’s project the Network Admin role on its own VPC gives that team full control over its own networking, which is the opposite of centralizing control with the security team.
Source: Shared VPC
A team has web-tier and database-tier VMs in the same VPC network and wants a firewall rule that allows TCP:5432 only from the web-tier VMs to the database-tier VMs, regardless of which subnet or IP range the web-tier VMs happen to get, and without maintaining a manually updated list of IP addresses. What should they use to define the rule’s source and target?
⬜ A. Source and destination IP address ranges (CIDR blocks) covering the entire VPC’s primary subnet
✅ B. Target tags (or service accounts) applied to the database-tier VMs, and a matching source tag (or service account) applied to the web-tier VMs
⬜ C. A single firewall rule with direction set to both INGRESS and EGRESS and no source or target specified
⬜ D. Cloud NAT configuration applied to the database-tier VMs to restrict inbound connections
Correct answer: B
VPC firewall rules can use network tags or service accounts to identify sources and targets, decoupling the rule from specific IP addresses so it continues to apply correctly to exactly the intended instances even as IP addresses or subnets change.
Why other options are incorrect
A. A rule scoped to the entire subnet’s CIDR range would apply to every instance on that subnet, not just the web-tier VMs, and still requires tracking IP ranges manually as instances change.
C. A single firewall rule can only specify one direction (INGRESS or EGRESS), and omitting a source or target would apply the rule far more broadly than intended.
D. Cloud NAT provides outbound internet connectivity for instances without external IP addresses; it does not control which internal instances can reach which other internal instances on a specific port.
Source: VPC firewall rules
A manufacturing company needs a private, high-bandwidth (10 Gbps), low-latency connection between its on-premises data center and its Google Cloud VPC that does not traverse the public internet, and it already has a presence in a colocation facility where Google has a point of presence. Which connectivity option best fits?
⬜ A. Cloud VPN using HA VPN, since it can deliver up to 10 Gbps over an IPsec tunnel across the public internet
⬜ B. VPC Network Peering directly between the on-premises router and the Google Cloud VPC
✅ C. Dedicated Interconnect, which provides a direct physical, private connection between the on-premises network and Google’s network at a colocation facility
⬜ D. A Shared VPC host project configured to allow on-premises traffic through Google’s front-end load balancers
Correct answer: C
Dedicated Interconnect provides a direct, private physical connection (available at 10, 100, or 400 Gbps) between an on-premises network and Google’s network at a shared colocation facility, keeping traffic off the public internet — matching the private, high-bandwidth, low-latency requirement.
Why other options are incorrect
A. Cloud VPN, including HA VPN, tunnels traffic over the public internet using IPsec encryption; it does not provide a private, off-internet path even though it can reach high throughput.
B. VPC Network Peering connects two Google Cloud VPC networks to each other; it is not a mechanism for connecting an on-premises data center to Google Cloud.
D. Shared VPC centralizes network administration across Google Cloud projects; it is not a hybrid connectivity method for linking an on-premises data center to Google Cloud.
Source: Cloud Interconnect overview
A company runs a web application with backends in multiple Google Cloud regions and wants a single anycast IP address that routes each user’s HTTPS request to the closest healthy regional backend, with support for URL-based routing to different backend services. Which load balancer type should they deploy?
✅ A. The Global external Application Load Balancer, which uses a single global anycast IP and can route by URL path or host to backends across multiple regions
⬜ B. An internal passthrough Network Load Balancer, scoped to a single region’s internal IP range
⬜ C. A regional external Application Load Balancer deployed separately in each region, each with its own IP address
⬜ D. Cloud DNS geo-based routing alone, without any load balancer in front of the backends
Correct answer: A
The Global external Application Load Balancer provides a single global anycast IP address, automatically routes users to the closest healthy backend across multiple regions, and supports host- and path-based URL routing to different backend services.
Why other options are incorrect
B. An internal passthrough Network Load Balancer only serves clients within a single region over internal IP addresses; it is not designed for global, internet-facing HTTPS traffic.
C. Deploying a separate regional load balancer in each region means each one has its own IP address, so there is no single global anycast IP and no automatic nearest-region routing across them.
D. DNS-based geo routing alone provides no health checking, TLS termination, or URL-based routing to backend services, so it cannot substitute for a load balancer.
A platform team wants to define their Google Cloud infrastructure — VPCs, GKE clusters, IAM bindings — as version-controlled configuration files so the same environment can be reproducibly created, reviewed via pull requests, and torn down in a predictable, repeatable way. Which tooling approach fits this requirement?
⬜ A. Manually clicking through the Google Cloud console and documenting each step in a wiki page for future reference
⬜ B. A shell script of sequential gcloud commands with no state tracking of what has already been created
⬜ C. Cloud Shell used interactively each time infrastructure needs to be recreated
✅ D. Terraform, using the Google Cloud provider to declare desired infrastructure state in version-controlled configuration files applied through a plan/apply workflow
Correct answer: D
Terraform is a declarative infrastructure-as-code tool; using the Google Cloud provider, the desired state of resources is defined in version-controlled configuration files, and Terraform tracks state so that plan and apply can reproducibly create, update, or destroy infrastructure in a predictable way.
Why other options are incorrect
A. Manually clicking through the console produces changes that are neither version-controlled nor guaranteed to be reproducible, since a wiki page can drift from what was actually clicked.
B. A plain sequence of gcloud commands has no state tracking, so there is no reliable way to know what has already been created or to safely reconcile configuration drift.
C. Cloud Shell is just a terminal environment; running commands interactively there still requires manually repeating steps each time and provides no state management or repeatable plan/apply workflow.
A cloud architect is designing a new multi-tier application architecture on Google Cloud and wants AI-assisted help generating an initial architecture diagram from a natural-language description, along with suggested Terraform code, directly within the Google Cloud console. Which Google Cloud capability should they use?
⬜ A. Cloud Asset Inventory, which generates architecture diagrams automatically from natural-language prompts
✅ B. Gemini Cloud Assist, including its Application Design Center, which uses natural-language input to help design architectures and generate infrastructure-as-code such as Terraform
⬜ C. Security Command Center, which recommends architecture changes based only on active threat findings
⬜ D. Recommender, which only surfaces cost and performance recommendations for existing deployed resources
Correct answer: B
Gemini Cloud Assist, including the Application Design Center, provides AI-assisted, natural-language architecture design within the Google Cloud console and can generate infrastructure-as-code such as Terraform, kubectl manifests, or Cloud CLI commands from that design.
Why other options are incorrect
A. Cloud Asset Inventory is a metadata inventory and history service for existing resources; it does not generate architecture diagrams from natural-language descriptions.
C. Security Command Center focuses on detecting threats and assessing security posture; it does not provide general-purpose, natural-language architecture design assistance.
D. Recommender surfaces recommendations (such as rightsizing or IAM cleanup) for resources that already exist; it does not help design a new architecture from a natural-language description or generate Terraform for it.
Source: Gemini Cloud Assist
Domain 3: Ensuring the successful operation of a cloud solution (30%)
Your team runs a public marketing website served from a global external Application Load Balancer. You want to be notified by email and SMS within a few minutes whenever the website becomes unreachable from multiple locations around the world. What should you do?
⬜ A. Create a Cloud Function that pings the website every minute and sends an email if the request fails.
✅ B. Create a Cloud Monitoring uptime check for the website, then create an alerting policy that triggers on the uptime check and attach email and SMS notification channels.
⬜ C. Enable Cloud Logging on the load balancer and create a log-based metric that counts 5xx responses, with no alerting policy attached.
⬜ D. Configure a Cloud Armor security policy to block traffic when the backend is unhealthy.
Correct answer: B
Cloud Monitoring uptime checks test endpoint availability from multiple global locations; pairing an uptime check with an alerting policy and notification channels (email, SMS, etc.) is the built-in way to get notified of outages.
Why other options are incorrect
A. This reinvents functionality Cloud Monitoring already provides natively, with more operational overhead and no built-in multi-location checks.
C. A log-based metric with no alerting policy attached will never notify anyone, and 5xx counts alone don’t capture a fully unreachable endpoint the way an uptime check does.
D. Cloud Armor is a WAF/DDoS protection tool for load balancers; it does not send notifications or monitor availability.
Your application writes structured log entries to Cloud Logging that include a severity=ERROR field. You want to automatically alert your on-call team if error log entries exceed 50 per minute for 5 consecutive minutes, without changing the application code. What should you do?
⬜ A. Manually search Cloud Logging every hour for error spikes.
✅ B. Create a log-based metric that counts matching error log entries, then create a Cloud Monitoring alerting policy that triggers when that metric exceeds the threshold over the specified duration.
⬜ C. Export logs to BigQuery and run a saved SQL query every night.
⬜ D. Set the log bucket’s retention period to 400 days so errors are never lost.
Correct answer: B
Cloud Logging supports user-defined log-based metrics derived from a log filter; that metric can then drive a Cloud Monitoring alerting policy with a threshold and duration condition, exactly matching this requirement.
Why other options are incorrect
A. Manual searches don’t scale, aren’t real-time, and don’t page an on-call team automatically.
C. Nightly BigQuery queries introduce unacceptable delay for near-real-time on-call alerting and still require custom notification logic to be built.
D. Retention period affects how long logs are stored, not whether or when anyone is alerted about an error spike.
Source: Log-based metrics overview
You manage a fleet of Compute Engine VMs behind an external Application Load Balancer, organized in a managed instance group (MIG). Traffic to the application varies significantly throughout the day. You want the number of VMs to automatically increase during peak hours and decrease during off-peak hours based on average CPU usage, without manual intervention. What should you configure?
⬜ A. A single Compute Engine VM with a larger machine type.
✅ B. An autoscaling policy on the managed instance group based on average CPU utilization.
⬜ C. A Cloud Scheduler job that resizes the instance group at fixed times every day.
⬜ D. A health check that restarts VMs whenever CPU usage is high.
Correct answer: B
A MIG autoscaler can automatically add or remove instances to maintain a target average CPU utilization (or other signals), which is the standard mechanism for reactive, elastic capacity.
Why other options are incorrect
A. Vertical scaling to one large VM removes horizontal elasticity and high availability, and resizing a VM typically requires downtime.
C. A fixed daily schedule doesn’t respond to the actual variability in traffic described, unlike CPU-based autoscaling which reacts to real demand.
D. Health checks manage instance health and replacement, not capacity scaling.
Source: Autoscaling groups of instances
Your application runs as a Deployment on a Google Kubernetes Engine (GKE) Standard cluster. During a load test, pod CPU usage spikes and some pods stay in a Pending state because there is not enough allocatable capacity on any existing node. You want the cluster to automatically add pod replicas when CPU usage is high and automatically add nodes when there isn’t enough room to schedule pods. Which two GKE features should you enable? (Choose two.)
⬜ A. Node auto-repair
✅ B. Horizontal Pod Autoscaler (HPA)
⬜ C. Vertical Pod Autoscaler (VPA) in recommendation-only mode
✅ D. Cluster autoscaler
Correct answer: B and D
HPA automatically increases or decreases the number of pod replicas based on observed CPU (or other) metrics, while the cluster autoscaler automatically resizes node pools by adding or removing nodes based on pending pods and their resource requests — directly addressing both symptoms described.
Why other options are incorrect
A. Node auto-repair replaces unhealthy nodes; it does not add capacity for scheduling or scale pod replica counts.
C. VPA in recommendation-only mode only advises on resource requests; it does not automatically change pod resources or add cluster capacity.
Source: About GKE cluster autoscaling
You are rolling out a new version of an App Engine standard environment service and want to gradually shift a percentage of traffic to the new version while ensuring that any given end user’s browser session is consistently routed to the same version for the whole test, to avoid a confusing mixed experience. Which traffic-splitting method should you use?
⬜ A. IP address–based splitting
✅ B. Cookie-based splitting
⬜ C. Deploying the new version with no traffic split, then switching 100% at once
⬜ D. Deleting the old version so only the new version can serve traffic
Correct answer: B
Cookie-based traffic splitting sets a cookie on the user’s browser after the first request so subsequent requests from that browser are consistently routed to the same version — ideal for A/B testing or gradual rollouts where session consistency matters.
Why other options are incorrect
A. IP-based splitting hashes the client’s IP address; it is less precise because many users share IPs behind NATs or corporate proxies, and it doesn’t guarantee the same consistency cookie-based splitting does.
C. An all-at-once cutover is not a gradual rollout and provides no way to test with partial traffic first.
D. Deleting the old version removes any ability to split traffic or roll back, sending 100% of traffic immediately to the untested new version.
Source: Splitting traffic
You deployed a new revision of a Cloud Run service. Before sending it all production traffic, you want to send only 10% of traffic to the new revision while the remaining 90% continues to go to the last known-good revision, so you can monitor error rates before a full rollout. What should you do?
⬜ A. Delete the old revision so only the new revision can receive traffic.
✅ B. Use gcloud run services update-traffic (or the console Traffic tab) to split traffic between the new and previous revisions by percentage.
⬜ C. Create a second Cloud Run service and manually load-balance between them using DNS round robin.
⬜ D. Set the new revision’s minimum instance count to 10% of the old revision’s maximum instance count.
Correct answer: B
Cloud Run natively supports splitting traffic across multiple revisions of the same service by percentage, enabling canary-style gradual rollouts before shifting 100% of traffic to a new revision.
Why other options are incorrect
A. Deleting the old revision removes your fallback and sends 100% of traffic to the new, unproven revision instead of just 10%.
C. Cloud Run already provides native revision-level traffic splitting; standing up a second service with DNS-based balancing is unnecessary and loses Cloud Run’s built-in rollback and tagging features.
D. Instance counts control scaling capacity, not the percentage of traffic routed to a given revision.
Your company stores application log files in a Cloud Storage bucket. Logs are frequently accessed for the first 30 days, occasionally accessed for the next 60 days, rarely needed after that, and must be deleted entirely once they are 365 days old for compliance reasons. You want this handled automatically with no application changes. What should you do?
⬜ A. Manually move objects between buckets using a cron job on a Compute Engine VM.
✅ B. Configure an Object Lifecycle Management rule that transitions the storage class to Nearline after 30 days, to Coldline after 90 days, and deletes objects after 365 days.
⬜ C. Enable Object Versioning on the bucket.
⬜ D. Set the bucket’s default storage class to Archive so all new objects immediately use the cheapest tier.
Correct answer: B
Object Lifecycle Management (OLM) lets you define rules with Age conditions that automatically trigger SetStorageClass and Delete actions on objects, matching the tiered retention and expiration requirement exactly.
Why other options are incorrect
A. This reinvents native functionality that Cloud Storage already provides, adding unnecessary operational overhead and failure risk.
C. Object Versioning preserves prior versions of overwritten or deleted objects; it does not change an object’s storage class over time or expire objects on a schedule.
D. Defaulting to Archive class would make the first 30 days of frequently accessed logs expensive to retrieve, and doesn’t implement the tiered transition/expiration policy described.
Source: Configuration examples for Object Lifecycle Management
Your production Cloud SQL for PostgreSQL instance must remain available with minimal downtime if the primary zone in a region experiences an outage, with failover to a standby happening automatically. What should you do?
⬜ A. Create a read replica in a different region and manually promote it if the primary fails.
✅ B. Enable the high availability (HA) configuration for the instance, which provisions a standby instance in a different zone with synchronous replication and automatic failover.
⬜ C. Take manual on-demand backups every hour.
⬜ D. Increase the instance’s machine type to have more vCPUs.
Correct answer: B
Cloud SQL’s HA configuration creates a standby instance in a different zone of the same region, keeps it synchronized using regional persistent disks, and automatically fails over if the primary becomes unavailable.
Why other options are incorrect
A. Read replicas support manual promotion, not automatic failover, and are typically used for read scaling or cross-region disaster recovery rather than automated same-region HA.
C. Backups protect against data loss but do not provide automatic failover or reduce downtime during a zonal outage.
D. A larger machine type improves performance, not availability during an outage.
Your read-heavy reporting application is putting sustained load on your Cloud SQL for MySQL primary instance, causing degraded write performance. You want to offload reporting queries without impacting the primary’s write throughput and without requiring automatic failover behavior. What should you do?
⬜ A. Enable the high availability configuration on the primary instance.
✅ B. Create one or more read replicas and point the reporting application at the replica endpoint(s).
⬜ C. Increase the storage size of the primary instance.
⬜ D. Add more application server VMs behind a load balancer.
Correct answer: B
Cloud SQL read replicas are read-only copies kept in sync through replication and can serve read traffic such as reporting queries, offloading the primary instance without affecting its write path.
Why other options are incorrect
A. HA provisions a standby for automatic failover during outages; that standby is not intended to serve regular application read traffic the way a replica is.
C. Increasing storage size addresses capacity, not query contention on the primary.
D. Adding more application servers increases the number of clients querying the same primary instance; it does not offload database read load.
You need a recurring, fully managed way to back up all documents in your Firestore database to Cloud Storage every night without writing custom export code. What should you use?
⬜ A. Enable Cloud Storage Object Versioning on a bucket linked to Firestore.
✅ B. Use Cloud Scheduler together with the managed export feature (gcloud firestore export) to export data to a Cloud Storage bucket on a schedule.
⬜ C. Manually download each document using the Firestore console every day.
⬜ D. Enable point-in-time recovery, which fully replaces the need for any export.
Correct answer: B
Firestore’s managed export/import feature, invoked via gcloud firestore export and scheduled with Cloud Scheduler (plus a trigger such as Cloud Functions), writes a consistent backup of your database to a Cloud Storage bucket — the supported way to automate recurring backups.
Why other options are incorrect
A. Object Versioning applies to objects already stored in a Cloud Storage bucket; it has no relationship to exporting Firestore data.
C. Manual console downloads do not scale and are not a fully managed, recurring process.
D. Point-in-time recovery lets you recover to a moment within a limited retention window; it is a different capability from a scheduled export and doesn’t substitute for exporting to Cloud Storage for long-term or cross-project archival.
You are deploying a custom TCP application (not HTTP) on Compute Engine and need the backend VMs to see the original client’s source IP address directly, without relying on headers like X-Forwarded-For. Which type of Google Cloud load balancer should you use?
⬜ A. External Application Load Balancer (global HTTP(S))
✅ B. External passthrough Network Load Balancer
⬜ C. Cloud CDN
⬜ D. Cloud Armor
Correct answer: B
The external passthrough Network Load Balancer is a pass-through, regional Layer 4 load balancer: it does not proxy or terminate connections, so backend VMs see the client’s actual source IP address, and it supports arbitrary TCP/UDP traffic, not just HTTP(S).
Why other options are incorrect
A. The external Application Load Balancer is a reverse proxy for HTTP(S) traffic; backends see the load balancer’s IP and must read the client IP from the X-Forwarded-For header instead.
C. Cloud CDN caches HTTP(S) content at the edge; it is not a load balancer type and doesn’t apply to a custom TCP application.
D. Cloud Armor provides WAF/DDoS protection for proxy-based load balancers; it does not preserve client source IPs at the backend on its own.
Your organization runs internal services on VM instances inside a VPC network and wants those VMs to resolve internal hostnames like db.internal.example.com to private IP addresses, without exposing these DNS records to the public internet. What should you configure?
⬜ A. A Cloud DNS public zone for example.com.
✅ B. A Cloud DNS private zone visible only within the specified VPC network(s).
⬜ C. A public A record pointing to the VM’s external IP address.
⬜ D. A Cloud NAT gateway.
Correct answer: B
A Cloud DNS private zone is resolvable only from the VPC networks you authorize, letting you serve internal-only DNS names — such as internal hostnames mapped to private IPs — without publishing them externally.
Why other options are incorrect
A. A public zone publishes records to the internet-facing DNS system, the opposite of what’s required here.
C. A public A record to an external IP both exposes the record publicly and requires the VM to have an external IP, neither of which is desired.
D. Cloud NAT provides outbound internet connectivity for instances without external IPs; it has no role in internal name resolution.
Source: DNS zones overview
You create a new custom-mode VPC network named prod-vpc and launch two Compute Engine VMs into it, each in a different subnet. When you try to ping one VM from the other using their internal IP addresses, the ping fails. What is the most likely cause?
⬜ A. Custom-mode VPC networks do not support internal VM-to-VM communication under any configuration.
✅ B. A custom-mode VPC network does not automatically include a rule allowing internal traffic between subnets; you must create an explicit ingress firewall rule to allow it.
⬜ C. The VMs are using ephemeral external IP addresses, which blocks all internal traffic.
⬜ D. ICMP (ping) is permanently blocked on all Google Cloud networks by default and cannot be enabled.
Correct answer: B
Unlike the auto mode default network (which comes with a preconfigured “allow internal” rule), a custom-mode VPC network is created with no implied allow-internal ingress rule — only the implied allow-egress and implied deny-ingress rules exist by default — so the administrator must explicitly create firewall rules permitting VM-to-VM traffic.
Why other options are incorrect
A. Custom-mode VPCs fully support internal communication once appropriate firewall rules exist; the network mode itself is not the limiter.
C. External IP assignment status has no bearing on whether internal-IP-to-internal-IP traffic is allowed; that is governed by firewall rules.
D. ICMP is not blocked platform-wide; whether it’s allowed depends entirely on the firewall rules configured for the network.
Source: VPC firewall rules
An operations engineer wants to use Cloud Deployment Manager to define and deploy new Google Cloud infrastructure for a project starting today. As of 2026, what should you tell them?
⬜ A. Deployment Manager is the current recommended tool for all new infrastructure-as-code projects on Google Cloud.
✅ B. Deployment Manager’s standard support has already ended (April 1, 2026), with a full shutdown planned for June 30, 2027; Google recommends migrating to Infrastructure Manager (which uses Terraform) or another IaC tool such as Terraform directly.
⬜ C. Deployment Manager was shut off completely and is no longer usable as of January 2026.
⬜ D. Deployment Manager only supports deploying Compute Engine resources, so it must be paired with gcloud for everything else.
Correct answer: B
Google has published a formal deprecation timeline for Cloud Deployment Manager: standard support ended April 1, 2026, extended support runs through March 31, 2027, and the service fully shuts down June 30, 2027. Google recommends migrating configurations to Infrastructure Manager (Terraform-based), using the DM Convert tool, or adopting another IaC technology such as Terraform directly.
Why other options are incorrect
A. It is explicitly deprecated with a published shutdown timeline, not the current recommendation for new infrastructure projects.
C. It has not been shut off; it remains usable through extended support until March 31, 2027, and fully until June 30, 2027.
D. Deployment Manager supports deploying most Google Cloud resource types through its declarative configurations and templates, not only Compute Engine.
Source: Deployment Manager deprecation
Your team manages Google Cloud infrastructure using Terraform. Before applying any change to a shared production environment, you want to (1) see exactly what resources will be created, changed, or destroyed, and (2) ensure the change is reviewed by a teammate before it is applied. Which two practices should you follow? (Choose two.)
✅ A. Run terraform plan and review its output (or a saved plan file) before applying, requiring that output to be reviewed/approved (e.g., in a pull request or CI pipeline) prior to terraform apply.
⬜ B. Skip terraform plan entirely and run terraform apply -auto-approve to save time.
✅ C. Store Terraform state remotely (e.g., in a Cloud Storage backend with locking) so the team works from a single source of truth and avoids concurrent conflicting applies.
⬜ D. Manually edit resources in the Cloud Console after every terraform apply to fine-tune them.
Correct answer: A and C
terraform plan shows the proposed diff (create/change/destroy) so it can be reviewed before any change is made, and a remote backend with state locking (such as a Cloud Storage bucket) keeps a single, consistent state file and prevents simultaneous, conflicting applies by different team members.
Why other options are incorrect
B. -auto-approve skips the review step entirely, which is the opposite of the stated goal of reviewing the diff before applying.
D. Manual console edits after terraform apply cause configuration drift between real infrastructure and the Terraform state/config, undermining IaC as the single source of truth.
Domain 4: Configuring access and security (20%)
Your operations team needs the ability to start, stop, and reset Compute Engine VM instances as part of routine maintenance, but they should not be able to create new instances, delete instances, or modify firewall rules. Granting the Editor primitive role would give far more access than needed. What is the best approach?
⬜ A. Grant the Editor primitive role since it is the simplest option.
⬜ B. Grant the predefined roles/compute.instanceAdmin.v1 role, since it includes exactly start/stop/reset and nothing else.
✅ C. Create a custom IAM role containing only the specific permissions needed (e.g., compute.instances.start, compute.instances.stop, compute.instances.reset, compute.instances.get, compute.instances.list) and grant that role to the team.
⬜ D. Grant the Viewer primitive role and ask the team to request temporary Owner access whenever maintenance is needed.
Correct answer: C
When no predefined role matches the exact set of permissions required, Google recommends creating a custom role scoped to only the needed permissions, following the principle of least privilege.
Why other options are incorrect
A. Editor is a broad primitive role granting create, modify, and delete permissions across most services, far exceeding what’s needed and violating least privilege.
B. roles/compute.instanceAdmin.v1 grants full lifecycle control of instances, including create and delete, plus access to related resources like disks — broader than just start/stop/reset.
D. Viewer is read-only and cannot start or stop instances; routinely elevating to Owner for maintenance is excessive access and poor security practice.
Source: Choose which type of role to use
A contractor needs temporary access to view logs in a project, but only for the next 30 days, after which the access should automatically expire without anyone needing to remember to revoke it. What should you do?
⬜ A. Grant the roles/logging.viewer role and set a calendar reminder to manually remove it in 30 days.
✅ B. Grant the roles/logging.viewer role with an IAM Condition that expires the binding on a specific date 30 days from now.
⬜ C. Create a new project just for the contractor and delete the entire project after 30 days.
⬜ D. Grant the Owner role and tell the contractor to self-revoke access after 30 days.
Correct answer: B
IAM Conditions let you attach a CEL-based condition, including a date/time expression, to a role binding so that access automatically stops applying after a specified date, with no manual follow-up required.
Why other options are incorrect
A. This relies on a manual process that can be forgotten or missed, defeating the goal of automatic expiration.
C. Creating and deleting an entire project is unnecessary overhead just to time-box access to logs.
D. Granting Owner is excessive privilege for viewing logs, and relying on the contractor to self-revoke is not a reliable or auditable control.
Source: Overview of IAM Conditions
Your organization has the resource hierarchy Organization > Folder “Finance” > Project “billing-prod”. A user is granted the roles/viewer role at the Organization level. A project administrator on “billing-prod” wants to prevent that same user from viewing resources in just that one project, while still allowing them to view resources in every other project. Can this be done by editing only the IAM allow policy on the “billing-prod” project?
⬜ A. Yes, adding a “deny Viewer” binding on the project’s allow policy will override the inherited grant for that project only.
✅ B. No; IAM allow policies are inherited down the resource hierarchy and are additive, so removing (or never adding) project-level access is not sufficient — the org-level grant still applies to that project.
⬜ C. Yes, because project-level policies always take precedence over organization-level policies.
⬜ D. No, because roles granted at the organization level can never be viewed or audited from the project level.
Correct answer: B
Google Cloud IAM allow policies are inherited down the resource hierarchy, and the effective policy on a resource is the union of the policy set directly on it plus all policies inherited from ancestors; a lower-level allow policy cannot revoke a permission granted at a higher level (a separate IAM Deny policy would be needed for that).
Why other options are incorrect
A. Standard IAM allow policies have no “deny” binding; permissions are only additive at the resource level.
C. Project-level policies do not override or replace inherited organization-level grants; they combine with them.
D. Organization-level grants remain visible and auditable from lower levels using IAM tools such as Policy Analyzer; this statement is simply false.
Your security team is reviewing how application code authenticates to Google Cloud APIs and wants to reduce the risk associated with long-lived service account JSON keys. Which two practices should you recommend? (Choose two.)
⬜ A. Download a new service account key and hardcode it directly into your application’s source code repository for convenience.
✅ B. Where possible, avoid creating downloadable service account keys altogether, using service account impersonation (short-lived credentials) or attached service accounts (e.g., Workload Identity Federation for GKE, Compute Engine attached accounts) instead.
⬜ C. Never rotate service account keys once created, since rotation increases risk.
✅ D. If a downloadable key is truly unavoidable, restrict its permissions to least privilege, store it securely (e.g., in Secret Manager), and rotate or delete it regularly.
Correct answer: B and D
Google’s guidance is to prefer keyless authentication mechanisms (impersonation, attached service accounts, Workload Identity Federation) whenever possible, and when a key truly must exist, to scope it tightly, store it securely, and rotate it regularly — minimizing the blast radius of any long-lived credential.
Why other options are incorrect
A. Hardcoding keys in source control is a common cause of credential leaks and is explicitly discouraged.
C. Never rotating a long-lived key increases risk over time; Google recommends periodic rotation (or better, eliminating keys entirely) for any key that must exist.
Pods running in your GKE cluster need to call Google Cloud APIs (e.g., Cloud Storage, BigQuery) using the permissions of a Google service account. Your security policy prohibits exporting and storing service account key files anywhere in the cluster. What should you use?
⬜ A. Mount a downloaded service account JSON key as a Kubernetes Secret and reference it from each pod.
✅ B. Enable Workload Identity Federation for GKE, which lets Kubernetes service accounts impersonate Google service accounts without needing an exported key.
⬜ C. Disable IAM entirely for the cluster’s project.
⬜ D. Grant the GKE nodes’ default service account the Owner role at the project level.
Correct answer: B
Workload Identity Federation for GKE lets a Kubernetes service account authenticate as, and inherit the IAM permissions of, a Google service account using short-lived, automatically rotated credentials, with no service account key files needed anywhere in the cluster.
Why other options are incorrect
A. This is exactly the key-file approach the security policy prohibits, and Kubernetes Secrets holding raw keys are a common exfiltration risk.
C. Disabling IAM is not a meaningful action and would remove all access control rather than solving the authentication problem.
D. Granting Owner to the node service account is unrelated to the authentication mechanism and severely violates least privilege, since every pod on every node would effectively gain project-wide Owner access.
Your compliance team wants all access to a sensitive Cloud Storage bucket to be governed solely through IAM policies, with no possibility of a per-object ACL granting access that bypasses IAM review. What should you do?
⬜ A. Grant roles/storage.objectViewer at the project level and simply stop creating new ACLs going forward, leaving existing per-object ACLs untouched.
✅ B. Enable uniform bucket-level access on the bucket, which disables ACLs and makes IAM the sole access control mechanism for that bucket and its objects.
⬜ C. Delete every object and re-upload it without specifying an ACL.
⬜ D. Set the bucket’s default object ACL to private for newly created objects only.
Correct answer: B
Uniform bucket-level access disables fine-grained ACLs (at both the bucket and object level) for a bucket, so all access is controlled exclusively by Cloud IAM — satisfying the requirement that no ACL can bypass IAM review.
Why other options are incorrect
A. Leaving existing ACLs untouched means any prior per-object ACL grant can still take effect, since ACLs and IAM are both evaluated together in fine-grained access mode.
C. Re-uploading objects doesn’t disable ACL evaluation for the bucket, and newly created objects could still receive ACLs later.
D. This only changes the default ACL applied to newly created objects; ACL evaluation itself remains enabled for the bucket, and non-default ACLs could still be set.
Source: Uniform bucket-level access
A compliance requirement mandates that your organization capture every read of objects in a specific set of sensitive Cloud Storage buckets, including reads by users with legitimate IAM permissions. You check Cloud Logging and find that object read events are not being recorded. What is the correct fix?
⬜ A. Grant the auditors the roles/owner role so they can see everything.
✅ B. Enable Data Access audit logs (the DATA_READ log type) for the Cloud Storage service in the project’s or organization’s audit configuration.
⬜ C. Nothing can be done; Cloud Storage cannot log read access under any configuration.
⬜ D. Enable Admin Activity audit logs, since they also capture object reads.
Correct answer: B
Object reads are recorded as Data Access audit logs (DATA_READ), which — unlike Admin Activity logs — are disabled by default for most services (with an exception for some BigQuery logging) and must be explicitly enabled in the IAM Audit Logs configuration.
Why other options are incorrect
A. Granting broader IAM roles to auditors changes their access, not what gets logged; it doesn’t enable read logging.
C. Cloud Storage does support Data Access (read) audit logging once explicitly enabled; it is simply off by default.
D. Admin Activity audit logs record configuration and metadata changes, not reads of object data, and are always on regardless — they will never capture object GET operations.
Source: Enable Data Access audit logs
Your security team wants to detect active threats such as malware, outbound DDoS activity, and cryptomining across your Google Cloud organization, in addition to basic misconfiguration findings. Which Security Command Center capability should they use?
⬜ A. Security Command Center Standard tier alone, which includes full threat detection at no additional cost.
✅ B. Security Command Center Premium (or higher) tier, which adds capabilities such as Event Threat Detection and Container Threat Detection on top of the misconfiguration/vulnerability findings available in Standard.
⬜ C. Cloud Armor, since it fully replaces the need for Security Command Center.
⬜ D. VPC Flow Logs alone, since they automatically generate threat alerts without any additional service.
Correct answer: B
Security Command Center’s Standard tier focuses on foundational security health and misconfiguration findings, while the Premium (and Enterprise) tiers add advanced threat detection services such as Event Threat Detection and Container Threat Detection needed to identify active malware, DDoS, and cryptomining behavior.
Why other options are incorrect
A. Standard tier does not include the advanced threat detection services described; those require Premium or Enterprise.
C. Cloud Armor is a WAF/DDoS mitigation product for load balancers; it does not provide organization-wide threat detection findings the way Security Command Center does.
D. VPC Flow Logs are raw network telemetry; they don’t analyze traffic or generate threat findings on their own without a detection service consuming them.
An administrator wants to create a custom IAM role that can be assigned across every project inside a specific folder, and tries to create the custom role directly at the folder level. What will happen?
⬜ A. The custom role is created successfully at the folder level and can immediately be used on any project inside that folder.
✅ B. Custom roles cannot be defined at the folder level; the administrator must create the custom role at the organization level (so it can be granted across the folder’s projects) or individually at each project level.
⬜ C. The folder will automatically be converted into a project so the custom role can be created.
⬜ D. Custom roles can only be created scoped to an individual resource, such as a single Cloud Storage bucket.
Correct answer: B
Google Cloud IAM only supports defining custom roles at the organization level or the project level; there is no folder-level custom role resource, so a role intended for use across a folder’s projects must be created at the organization level instead.
Why other options are incorrect
A. This is not supported; the IAM console and API do not allow creating a custom role scoped directly to a folder.
C. Folders are never converted into projects as part of custom role creation.
D. Custom roles are created at the org or project level and can then be granted at various resource levels; they are not “created” scoped to an individual resource like a single bucket.
Source: Create and manage custom roles
You discover that a Cloud Storage bucket containing internal documents has allUsers granted the Storage Object Viewer role, making every object in the bucket publicly readable on the internet. You need to remove this public access immediately and prevent it from being re-added by mistake in the future. What should you do?
✅ A. Remove the allUsers IAM binding from the bucket, and additionally enable the “Public access prevention” setting (or the equivalent organization policy) so public access cannot be re-granted.
⬜ B. Rename the bucket, since public access does not carry over to buckets with a different name.
⬜ C. Set the bucket’s storage class to Archive, which automatically blocks public reads.
⬜ D. Do nothing, since allUsers only grants access to authenticated Google accounts, not the general public.
Correct answer: A
allUsers is a special identifier meaning literally anyone on the internet, so removing that IAM binding immediately revokes public read access; enabling public access prevention (as a bucket-level setting or an organization policy constraint) then blocks any future attempt to grant allUsers or allAuthenticatedUsers access, preventing recurrence.
Why other options are incorrect
B. Renaming a bucket does not remove existing IAM bindings; the objects, still carrying the public grant, would remain exposed under the new name.
C. Storage class affects cost and retrieval characteristics only; it has no effect on access control or public exposure.
D. allUsers specifically means anyone on the internet, including anonymous, unauthenticated requests; allAuthenticatedUsers is the separate identifier limited to any authenticated Google account.
Source: Public access prevention
Related Certification Exams
- AWS Certified Cloud Practitioner Exam Questions — the equivalent foundational-to-associate level cloud cert on AWS.
- Microsoft Azure Fundamentals (AZ-900) Exam Questions — the equivalent entry-level cert on Azure.
