Important Google Associate Cloud Engineer Exam Questions

CertPrep • Google • Associate Cloud Engineer Exam Questions

Select Certification Providers

Select Certification Exam

Get Full Version

Google Associate Cloud Engineer Exam

Attempt the Google Cloud Certified practice test and solve real exam-like Associate Cloud Engineer questions to prepare efficiently and increase your chances of success. Our Google Associate Cloud Engineer practice questions match the actual Google Associate Cloud Engineer exam format, helping you enhance confidence and improve performance. With our Associate Cloud Engineer practice exam software, you can analyze your performance, identify weak areas, and work on them effectively to boost your final Google Cloud Certified exam score.

Vendor:	Google
Exam Name:	Google Associate Cloud Engineer
Registration Code:	Associate-Cloud-Engineer
Related Certification:	Google Cloud Certified Certification
Exam Audience:	Google Cloud Engineers, System Administrators,

Total Questions

363

Last Updated

08-08-2026

Exam Duration

120 MINUTES

Upgrade to Premium

GET FULL PDF

Question: 1

You are deploying an application to Google Kubernetes Engine (GKE) that needs to call an external third-party API. You need to provide the external API vendor with a list of IP addresses for their firewall to allow traffic from your application. You want to follow Google-recommended practices and avoid any risk of interrupting traffic to the API due to IP address changes. What should you do?

AConfigure your GKE cluster with one node, and set the node to have a static external IP address. Ensure that the GKE cluster autoscaler is off. Send the external IP address of the node to the vendor to be added to the allowlist.

BConfigure your GKE cluster with private nodes. Configure a Cloud NAT instance with static IP addresses. Provide these IP addresses to the vendor to be added to the allowlist.

CConfigure your GKE cluster with public nodes. Write a Cloud Function that pulls the public IP addresses of each node in the cluster. Trigger the function to run every day with Cloud Scheduler. Send the list to the vendor by email every day.

DConfigure your GKE cluster with private nodes. Configure a Cloud NAT instance with dynamic IP addresses. Provide these IP addresses to the vendor to be added to the allowlist.

Answer: B

Explanation:

The requirement is for a stable set of egress IP addresses from a GKE cluster for allowlisting by a third party, following best practices.

Option A is not recommended: Using a single node lacks scalability and high availability. Relying on a single node's static IP creates a single point of failure and doesn't align with GKE's design principles. Disabling autoscaling hinders elasticity.

Option C is complex and unreliable: Public nodes typically have ephemeral external IPs (unless manually configured per node, which is difficult to manage with autoscaling). Dynamically tracking and emailing IPs daily is operationally burdensome and prone to race conditions where the allowlist might lag behind IP changes.

Option D uses Cloud NAT but with dynamic IPs. Dynamic IPs change over time, making them unsuitable for stable firewall allowlists.

Option B is the Google-recommended practice: Configuring the GKE cluster with private nodes enhances security as nodes don't have direct external IPs. Cloud NAT provides managed network address translation for these private nodes to access the internet. By configuring Cloud NAT with a static allocation of external IP addresses, all egress traffic from the private GKE nodes will appear to originate from this stable, predictable set of IPs. This set can be given to the vendor for allowlisting without worrying about node IP changes due to scaling or maintenance.

This approach decouples the application's egress IP from the individual nodes, providing stability and adhering to the principle of least privilege (private nodes).

Cloud NAT Overview: 'Cloud NAT lets certain resources without external IP addresses create outbound connections to the internet.' - https://cloud.google.com/nat/docs/overview

Cloud NAT IP Addresses: 'When you configure a NAT gateway... You can configure the NAT gateway to automatically allocate regional external IP addresses... Alternatively, you can manually assign a fixed number of static external IP addresses to the gateway.' - https://cloud.google.com/nat/docs/overview#ip-addresses

GKE and Cloud NAT: 'Configure Cloud NAT with GKE... Use Case: You want a GKE pod to deterministically egress traffic from a static set of IP addresses that you control.' - https://cloud.google.com/nat/docs/gke-example

Private Clusters: 'Private nodes do not have endpoint-accessible external IP addresses.' - https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters

Question: 2

An application generates daily reports in a Compute Engine virtual machine (VM). The VM is in the project corp-iot-insights. Your team operates only in the project corp-aggregate-reports and needs a copy of the daily exports in the bucket corp-aggregate-reports-storage. You want to configure access so that the daily reports from the VM are available in the bucket corp-aggregate-reports-storage and use as few steps as possible while following Google-recommended practices. What should you do?

AMove both projects under the same folder.

BGrant the VM Service Account the role Storage Object Creator on corp-aggregate-reports-storage.

CCreate a Shared VPC network between both projects. Grant the VM Service Account the role Storage Object Creator on corp-iot-insights.

DMake corp-aggregate-reports-storage public and create a folder with a pseudo-randomized suffix name. Share the folder with the IoT team.

Answer: B

Explanation:

Predefined roles

The following table describes Identity and Access Management (IAM) roles that are associated with Cloud Storage and lists the permissions that are contained in each role. Unless otherwise noted, these roles can be applied either to entire projects or specific buckets.

Storage Object Creator (roles/storage.objectCreator) Allows users to create objects. Does not give permission to view, delete, or overwrite objects.

https://cloud.google.com/storage/docs/access-control/iam-roles#standard-roles

Question: 3

You have an object in a Cloud Storage bucket that you want to share with an external company. The object contains sensitive data. You want access to the content to be removed after four hours. The external company does not have a Google account to which you can grant specific user-based access privileges. You want to use the most secure method that requires the fewest steps. What should you do?

ACreate a signed URL with a four-hour expiration and share the URL with the company.

BSet object access to 'public' and use object lifecycle management to remove the object after four hours.

CConfigure the storage bucket as a static website and furnish the object's URL to the company. Delete the object from the storage bucket after four hours.

DCreate a new Cloud Storage bucket specifically for the external company to access. Copy the object to that bucket. Delete the bucket after four hours have passed.

Answer: A

Explanation:

Signed URLs are used to give time-limited resource access to anyone in possession of the URL, regardless of whether they have a Google account.https://cloud.google.com/storage/docs/access-control/signed-urls

Question: 4

You are managing a web application that needs to read objects from a shared Cloud Storage bucket. You need to grant a Cloud Run service access to objects in the existing bucket that are named with the site1-data/ prefix while ensuring that the Cloud Run service has access to new objects as they are uploaded. Your solution should require minimal work to implement and maintain. What should you do?

AEnable fine-grained access control, and configure the uploader to set a per object access control list for the Cloud Run service identity to have the READER role when objects with the site1-data/ prefix are uploaded.

BCreate a new bucket to store only objects with the site1-data/ prefix. Grant the Cloud Run service identity the roles/storage.objectViewer IAM role on the bucket.

CEnable uniform bucket-level access, and configure an IAM binding on the existing bucket. Grant the Cloud Run service identity the roles/storage.objectViewer IAM role on the bucket with an IAM condition for objects with the site1-data/ prefix.

DCreate a new bucket to store only objects with the site1-data/ prefix. Grant the Cloud Run service identity the roles/storage.objectViewer IAM role on the project.

Answer: C

Explanation:

The correct answer is C because the requirement is prefix-scoped read access in an existing shared bucket with minimal ongoing maintenance. Uniform bucket-level access centralizes access control through IAM instead of object ACLs. An IAM Condition can restrict the Storage Object Viewer role so the Cloud Run service identity can read only objects whose names match the site1-data/ prefix. This also covers new objects automatically as they are uploaded, as long as their object names match the prefix. Per-object ACLs require ongoing uploader configuration and are operationally fragile. Creating a new bucket changes the storage design and may require migration. Granting objectViewer at the project level is far too broad and violates least privilege.

Question: 5

You created a Google Cloud Platform project with an App Engine application inside the project. You initially configured the application to be served from the us-central region. Now you want the application to be served from the asia-northeast1 region. What should you do?

AChange the default region property setting in the existing GCP project to asia-northeast1.

BChange the region property setting in the existing App Engine application from us-central to asia-northeast1.

CCreate a second App Engine application in the existing GCP project and specify asia-northeast1 as the region to serve your application.

DCreate a new GCP project and create an App Engine application inside this new project. Specify asia-northeast1 as the region to serve your application.

Answer: D

Explanation:

https://cloud.google.com/appengine/docs/flexible/managing-projects-apps-billing#:~:text=Each%20Cloud%20project%20can%20contain%20only%20a%20single%20App%20Engine%20application%2C%20and%20once%20created%20you%20cannot%20change%20the%20location%20of%20your%20App%20Engine%20application.

Two App engine can't be running on the same project: you can check this easy diagram for more info:https://cloud.google.com/appengine/docs/standard/an-overview-of-app-engine#components_of_an_application

And you can't change location after setting it for your app Engine.https://cloud.google.com/appengine/docs/standard/locations

App Engine is regional and you cannot change an apps region after you set it. Therefore, the only way to have an app run in another region is by creating a new project and targeting the app engine to run in the required region (asia-northeast1 in our case).

Ref:https://cloud.google.com/appengine/docs/locations

SAVE TIME & QUICKLY PREPARE WITH REAL QUESTIONS

GET FULL ACCESS

Other Google Certification Exams

Generative AI Leader Exam

Generative AI Leader

Associate Google Workspace Administrator Exam

Associate Google Workspace Administrator

Professional Cloud Architect (PR000213) Exam

Google Cloud Architect Professional

Professional Cloud Security Engineer Exam

Professional Cloud Security Engineer

Professional Data Engineer Exam

Google Cloud Certified Professional Data Engineer

Professional Cloud DevOps Engineer Exam

Professional Cloud DevOps Engineer