Sep-2026 Google Associate-Cloud-Engineer Certification Real 2026 Mock Exam
Associate-Cloud-Engineer Exam Questions and Valid PMP Dumps PDF
NEW QUESTION # 239
Your team has developed a stateless application which requires it to be run directly on virtual machines. The application is expected to receive a fluctuating amount of traffic and needs to scale automatically. You need to deploy the application. What should you do?
- A. Deploy the application on a Kubernetes Engine cluster and configure node pool autoscaling.
- B. Deploy the application on Cloud Run and configure autoscaling.
- C. Deploy the application on a managed instance group and configure autoscaling.
- D. Deploy the application on Cloud Functions and configure the maximum number instances.
Answer: C
Explanation:
A managed instance group (MIG) is a group of identical virtual machines (VMs) that you can manage as a single entity. You can use a MIG to deploy and maintain a stateless application that runs directly on VMs. A MIG can automatically scale the number of VMs based on the load or a schedule. A MIG can also automatically heal the VMs if they become unhealthy or unavailable. A MIG is suitable for applications that need to run on VMs rather than containers or serverless platforms.
B is incorrect because Kubernetes Engine is a managed service for running containerized applications on a cluster of nodes. It is not necessary to use Kubernetes Engine if the application does not use containers and can run directly on VMs.
C is incorrect because Cloud Functions is a serverless platform for running event-driven code in response to triggers. It is not suitable for applications that need to run continuously and handle HTTP requests.
D is incorrect because Cloud Run is a serverless platform for running stateless containerized applications. It is not suitable for applications that do not use containers and can run directly on VMs.
Reference:
Managed instance groups documentation
Choosing a compute option for Google Cloud
NEW QUESTION # 240
You have been asked to build backend using Clojure and host it on Google Cloud with full freedom of choosing OS, applications, libraries, etc. Which service will you prefer?
- A. Compute Engine
- B. Cloud Function
- C. App Engine Standard
- D. CloudRun
Answer: A
NEW QUESTION # 241
Your organization has user identities in Active Directory. Your organization wants to use Active Directory as their source of truth for identities. Your organization wants to have full control over the Google accounts used by employees for all Google services, including your Google Cloud Platform (GCP) organization. What should you do?
- A. Ask each employee to create a Google account using self signup. Require that each employee use their company email address and password.
- B. Export users from Active Directory as a CSV and import them to Cloud Identity via the Admin Console.
- C. Use the cloud Identity APIs and write a script to synchronize users to Cloud Identity.
- D. Use Google Cloud Directory Sync (GCDS) to synchronize users into Cloud Identity.
Answer: D
NEW QUESTION # 242
You have a Dockerfile that you need to deploy on Kubernetes Engine. What should you do?
- A. Use kubectl app deploy <dockerfilename>.
- B. Create a docker image from the Dockerfile and upload it to Cloud Storage.
Create a Deployment YAML file to point to that image.
Use kubectl to create the deployment with that file. - C. Create a docker image from the Dockerfile and upload it to Container Registry.
Create a Deployment YAML file to point to that image.
Use kubectl to create the deployment with that file. - D. Use gcloud app deploy <dockerfilename>.
Answer: C
Explanation:
Create the image prior to deployment:
https://cloud.google.com/kubernetes-engine/docs/tutorials/hello-app
You cant deploy a docker file
NEW QUESTION # 243
Your organization has a dedicated person who creates and manages all service accounts for Google Cloud projects. You need to assign this person the minimum role for projects. What should you do?
- A. Add the user to roles/iam.securityAdmin role.
- B. Add the user to roles/iam.serviceAccountAdmin role.
- C. Add the user to roles/iam.serviceAccountUser role.
- D. Add the user to roles/iam.roleAdmin role.
Answer: C
Explanation:
Explanation/Reference: https://cloud.google.com/iam/docs/creating-managing-service-accounts
NEW QUESTION # 244
Your customer has implemented a solution that uses Cloud Spanner and notices some read latency-related performance issues on one table. This table is accessed only by their users using a primary key. The table schema is shown below.
You want to resolve the issue. What should you do?
- A. Option B
- B. Option A
- C. Option D
- D. Option C
Answer: D
Explanation:
As mentioned in Schema and data model, you should be careful when choosing a primary key to not accidentally create hotspots in your database. One cause of hotspots is having a column whose value monotonically increases as the first key part, because this results in all inserts occurring at the end of your key space. This pattern is undesirable because Cloud Spanner divides data among servers by key ranges, which means all your inserts will be directed at a single server that will end up doing all the work. https://cloud.
google.com/spanner/docs/schema-design#primary-key-prevent-hotspots
NEW QUESTION # 245
You create a Deployment with 2 replicas in a Google Kubernetes Engine cluster that has a single preemptible node pool. After a few minutes, you use kubectl to examine the status of your Pod and observe that one of them is still in Pending status:
What is the most likely cause?
- A. The pending Pod's resource requests are too large to fit on a single node of the cluster.
- B. The pending Pod was originally scheduled on a node that has been preempted between the creation of the Deployment and your verification of the Pods' status. It is currently being rescheduled on a new node.
- C. Too many Pods are already running in the cluster, and there are not enough resources left to schedule the pending Pod.
- D. The node pool is configured with a service account that does not have permission to pull the container image used by the pending Pod.
Answer: C
Explanation:
* The pending Pods resource requests are too large to fit on a single node of the cluster. Too many Pods are already running in the cluster, and there are not enough resources left to schedule the pending Pod.
is the right answer.
* When you have a deployment with some pods in running and other pods in the pending state, more often than not it is a problem with resources on the nodes. Heres a sample output of this use case. We see that the problem is with insufficient CPU on the Kubernetes nodes so we have to either enable auto- scaling or manually scale up the nodes.
NEW QUESTION # 246
You created a Google Cloud Platform project with an App Engine application inside the project. You initially configured the application to be served from the us-central region. Now you want the application to be served from the asia-northeast1 region. What should you do?
- A. Create a new GCP project and create an App Engine application inside this new project. Specify asia-northeast1 as the region to serve your application.
- B. Create a second App Engine application in the existing GCP project and specify asia-northeast1 as the region to serve your application.
- C. Change the region property setting in the existing App Engine application from us-central to asia-northeast1.
- D. Change the default region property setting in the existing GCP project to asia-northeast1.
Answer: A
Explanation:
https://cloud.google.com/appengine/docs/flexible/managing-projects-apps-billing#:~:text=Each%20Cloud%20pr Two App engine can't be running on the same project: you can check this easy diagram for more info:https://cloud.google.com/appengine/docs/standard/an-overview-of-app-engine#components_of_an_applicati And you can't change location after setting it for your app Engine.https://cloud.google.com/appengine/docs/standard/locations App Engine is regional and you cannot change an apps region after you set it. Therefore, the only way to have an app run in another region is by creating a new project and targeting the app engine to run in the required region (asia-northeast1 in our case).
Ref: https://cloud.google.com/appengine/docs/locations
NEW QUESTION # 247
You need to monitor resources that are distributed over different projects in Google Cloud Platform. You want to consolidate reporting under the same Stackdriver Monitoring dashboard. What should you do?
- A. Use Shared VPC to connect all projects, and link Stackdriver to one of the projects.
- B. Configure a single Stackdriver account for one of the projects. In Stackdriver, create a Group and add the other project names as criteria for that Group.
- C. Configure a single Stackdriver account, and link all projects to the same account.
- D. For each project, create a Stackdriver account. In each project, create a service account for that project and grant it the role of Stackdriver Account Editor in all other projects.
Answer: C
Explanation:
When you intially click on Monitoring(Stackdriver Monitoring) it creates a workspac(a stackdriver account) linked to the ACTIVE(CURRENT) Project from which it was clicked.
Now if you change the project and again click onto Monitoring it would create an another workspace(a stackdriver account) linked to the changed ACTIVE(CURRENT) Project, we don't want this as this would not consolidate our result into a single dashboard(workspace/stackdriver account).
If you have accidently created two diff workspaces merge them under Monitoring > Settings > Merge Workspaces > MERGE.
If we have only one workspace and two projects we can simply add other GCP Project under Monitoring > Settings > GCP Projects > Add GCP Projects.
https://cloud.google.com/monitoring/settings/multiple-projects
Nothing about groupshttps://cloud.google.com/monitoring/settings?hl=en
NEW QUESTION # 248
You have created a code snippet that should be triggered whenever a new file is uploaded to a Cloud Storage bucket. You want to deploy this code snippet. What should you do?
- A. Use Cloud Functions and configure the bucket as a trigger resource.
- B. Use App Engine and configure Cloud Scheduler to trigger the application using Pub/Sub.
- C. Use Google Kubernetes Engine and configure a CronJob to trigger the application using Pub/Sub.
- D. Use Dataflow as a batch job, and configure the bucket as a data source.
Answer: B
Explanation:
https://cloud.google.com/scheduler/docs/tut-pub-sub
NEW QUESTION # 249
You create a Deployment with 2 replicas in a Google Kubernetes Engine cluster that has a single preemptible node pool. After a few minutes, you use kubectl to examine the status of your Pod and observe that one of them is still in Pending status:
What is the most likely cause?
- A. The pending Pod's resource requests are too large to fit on a single node of the cluster.
- B. The pending Pod was originally scheduled on a node that has been preempted between the creation of the Deployment and your verification of the Pods' status. It is currently being rescheduled on a new node.
- C. Too many Pods are already running in the cluster, and there are not enough resources left to schedule the pending Pod.
- D. The node pool is configured with a service account that does not have permission to pull the container image used by the pending Pod.
Answer: C
Explanation:
The pending Pods resource requests are too large to fit on a single node of the cluster. Too many Pods are already running in the cluster, and there are not enough resources left to schedule the pending Pod. is the right answer.
When you have a deployment with some pods in running and other pods in the pending state, more often than not it is a problem with resources on the nodes. Heres a sample output of this use case. We see that the problem is with insufficient CPU on the Kubernetes nodes so we have to either enable auto-scaling or manually scale up the nodes.
NEW QUESTION # 250
Your company wants to standardize the creation and management of multiple Google Cloud resources using Infrastructure as Code. You want to minimize the amount of repetitive code needed to manage the environment. What should you do?
- A. Develop templates for the environment using Cloud Deployment Manager.
- B. Use the Cloud Console interface to provision and manage all related resources.
- C. Create a bash script that contains all requirement steps as gcloudcommands.
- D. Use curlin a terminal to send a REST request to the relevant Google API for each individual resource.
Answer: A
Explanation:
Explanation/Reference: https://cloud.google.com/deployment-manager/docs/fundamentals (see templates)
NEW QUESTION # 251
You are hosting an application on bare-metal servers in your own data center. The application needs access to Cloud Storage. However, security policies prevent the servers hosting the application from having public IP addresses or access to the internet. You want to follow Google-recommended practices to provide the application with access to Cloud Storage. What should you do?
- A. 1. Use nslookup to get the IP address for storage.googleapis.com.2. Negotiate with the security team to be able to give a public IP address to the servers.3. Only allow egress traffic from those servers to the IP addresses for storage.googleapis.com.
- B. 1. Using Cloud VPN, create a VPN tunnel to a Virtual Private Cloud (VPC) in Google Cloud Platform (GCP).2. In this VPC, create a Compute Engine instance and install the Squid proxy server on this instance.3. Configure your servers to use that instance as a proxy to access Cloud Storage.
- C. 1. Using Cloud VPN or Interconnect, create a tunnel to a VPC in GCP.2. Use Cloud Router to create a custom route advertisement for 199.36.153.4/30. Announce that network to your on-premises network through the VPN tunnel.3. In your on-premises network, configure your DNS server to resolve *.googleapis.com as a CNAME to restricted.googleapis.com.
- D. 1. Use Migrate for Compute Engine (formerly known as Velostrata) to migrate those servers to Compute Engine.2. Create an internal load balancer (ILB) that uses storage.googleapis.com as backend.
3. Configure your new instances to use this ILB as proxy.
Answer: C
Explanation:
Our requirement is to follow Google recommended practices to achieve the end result. Configuring Private Google Access for On-Premises Hosts is best achieved by VPN/Interconnect + Advertise Routes + Use restricted Google IP Range.
* Using Cloud VPN or Interconnect, create a tunnel to a VPC in GCP
* Using Cloud Router to create a custom route advertisement for 199.36.153.4/30. Announce that network to your on-premises network through the VPN tunnel.
* In your on-premises network, configure your DNS server to resolve *.googleapis.com as a CNAME to restricted.googleapis.com is the right answer right, and it is what Google recommends.
Ref: https://cloud.google.com/vpc/docs/configure-private-google-access-hybrid
* You must configure routes so that Google API traffic is forwarded through your Cloud VPN or Cloud Interconnect connection, firewall rules on your on-premises firewall to allow the outgoing traffic, and DNS so that traffic to Google APIs resolves to the IP range youve added to your routes.
* You can use Cloud Router Custom Route Advertisement to announce the Restricted Google APIs IP addresses through Cloud Router to your on-premises network. The Restricted Google APIs IP range is
199.36.153.4/30. While this is technically a public IP range, Google does not announce it publicly. This IP range is only accessible to hosts that can reach your Google Cloud projects through internal IP ranges, such as through a Cloud VPN or Cloud Interconnect connection. Without having a public IP address or access to the internet, the only way you could connect to cloud storage is if you have an internal route to it.
* So Negotiate with the security team to be able to give public IP addresses to the servers is not right.
Following Google recommended practices is synonymous with using Googles services (Not quite, but it is at least for the exam !!).
* So In this VPC, create a Compute Engine instance and install the Squid proxy server on this instance is not right.
* Migrating the VM to Compute Engine is a bit drastic when Google says it is perfectly fine to have Hybrid Connectivity architectures https://cloud.google.com/hybrid-connectivity.
So,
* Use Migrate for Compute Engine (formerly known as Velostrata) to migrate these servers to Compute Engine is not right.
NEW QUESTION # 252
You are developing a financial trading application that will be used globally. Data is stored and queried using a relational structure, and clients from all over the world should get the exact identical state of the data. The application will be deployed in multiple regions to provide the lowest latency to end users. You need to select a storage option for the application data while minimizing latency. What should you do?
- A. Use Cloud Bigtable for data storage.
- B. Use Cloud Spanner for data storage.
- C. Use Cloud SQL for data storage.
- D. Use Firestore for data storage.
Answer: B
Explanation:
Explanation
Keywords, Financial data (large data) used globally, data stored and queried using relational structure (SQL), clients should get exact identical copies(Strong Consistency), Multiple region, low latency to end user, select storage option to minimize latency.
NEW QUESTION # 253
Your organization needs to grant users access to query datasets in BigQuery but prevent them from accidentally deleting the datasets. You want a solution that follows Google-recommended practices. What should you do?
- A. Add users to roles/bigquery dataEditor role only, instead of roles/bigquery dataOwner.
- B. Create a custom role by removing delete permissions, and add users to that role only.
- C. Create a custom role by removing delete permissions. Add users to the group, and then add the group to the custom role.
- D. Add users to roles/bigquery user role only, instead of roles/bigquery dataOwner.
Answer: C
Explanation:
Explanation
https://cloud.google.com/bigquery/docs/access-control#custom_roles
Custom roles enable you to enforce the principle of least privilege, ensuring that the user and service accounts in your organization have only the permissions essential to performing their intended functions.
NEW QUESTION # 254
You have several hundred microservice applications running in a Google Kubernetes Engine (GKE) cluster.
Each microservice is a deployment with resource limits configured for each container in the deployment.
You've observed that the resource limits for memory and CPU are not appropriately set for many of the microservices. You want to ensure that each microservice has right sized limits for memory and CPU. What should you do?
- A. Configure GKE cluster autoscaling.
- B. Modify the cluster's node pool machine type and choose a machine type with more memory and CPU.
- C. Configure a Horizontal Pod Autoscaler for each microservice.
- D. Configure a Vertical Pod Autoscaler for each microservice.
Answer: A
NEW QUESTION # 255
You have deployed an application on a single Compute Engine instance. The application writes logs to disk. Users start reporting errors with the application. You want to diagnose the problem.
What should you do?
- A. Navigate to Cloud Logging and view the application logs.
- B. Configure a health check on the instance and set a Consecutive successes?Healthy threshold value of 1.
- C. Connect to the instance's serial console and read the application logs.
- D. Install and configure the Ops agent and view the logs from Cloud Logging.
Answer: D
Explanation:
https://cloud.google.com/logging/docs/agent/ops-agent
https://cloud.google.com/logging/docs/agent/ops-agent/configuration
NEW QUESTION # 256
Your company uses a large number of Google Cloud services centralized in a single project. All teams have specific projects for testing and development. The DevOps team needs access to all of the production services in order to perform their job. You want to prevent Google Cloud product changes from broadening their permissions in the future. You want to follow Google-recommended practices. What should you do?
- A. Create a custom role that combines the required permissions. Grant the DevOps team the custom role on the production project.
- B. Grant all members of the DevOps team the role of Project Editor on the production project.
- C. Grant all members of the DevOps team the role of Project Editor on the organization level.
- D. Create a custom role that combines the required permissions. Grant the DevOps team the custom role on the organization level.
Answer: A
Explanation:
Understanding IAM custom roles
Key Point: Custom roles enable you to enforce the principle of least privilege, ensuring that the user and service accounts in your organization have only the permissions essential to performing their intended functions.
Basic concepts
Custom roles are user-defined, and allow you to bundle one or more supported permissions to meet your specific needs. Custom roles are not maintained by Google; when new permissions, features, or services are added to Google Cloud, your custom roles will not be updated automatically.
When you create a custom role, you must choose an organization or project to create it in. You can then grant the custom role on the organization or project, as well as any resources within that organization or project.
https://cloud.google.com/iam/docs/understanding-custom-roles#basic_concepts
NEW QUESTION # 257
You create a Deployment with 2 replicas in a Google Kubernetes Engine cluster that has a single preemptible node pool. After a few minutes, you use kubectl to examine the status of your Pod and observe that one of them is still in Pending status:
What is the most likely cause?
- A. The pending Pod's resource requests are too large to fit on a single node of the cluster.
- B. The pending Pod was originally scheduled on a node that has been preempted between the creation of the Deployment and your verification of the Pods' status. It is currently being rescheduled on a new node.
- C. Too many Pods are already running in the cluster, and there are not enough resources left to schedule the pending Pod.
- D. The node pool is configured with a service account that does not have permission to pull the container image used by the pending Pod.
Answer: C
NEW QUESTION # 258
After a recent security incident, your startup company wants better insight into what is happening in the Google Cloud environment. You need to monitor unexpected firewall changes and instance creation. Your company prefers simple solutions. What should you do?
- A. Use Cloud Logging filters to create log-based metrics for firewall and instance actions. Monitor the changes and set up reasonable alerts.
- B. Turn on Google Cloud firewall rules logging, and set up alerts for any insert, update, or delete events.
- C. Create a log sink to forward Cloud Audit Logs filtered for firewalls and compute instances to Cloud Storage.Use BigQuery to periodically analyze log events in the storage bucket.
- D. Install Kibana on a compute Instance. Create a log sink to forward Cloud Audit Logs filtered for firewalls and compute instances to Pub/Sub. Target the Pub/Sub topic to push messages to the Kibana instance. Analyze the logs on Kibana in real time.
Answer: A
Explanation:
This answer is the simplest and most effective way to monitor unexpected firewall changes and instance creation in Google Cloud. Cloud Logging filters allow you to specify the criteria for the log entries that you want to view or export. You can use the Logging query language to write filters based on the LogEntry fields, such as resource.type, severity, or protoPayload.methodName. For example, you can filter for firewall-related events by using the following query:
resource.type="gce_subnetwork" logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Ffirewall" You can filter for instance-related events by using the following query:
resource.type="gce_instance" logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Factivity_log" You can create log-based metrics from these filters to measure the rate or count of log entries that match the filter. Log-based metrics can be used to create charts and dashboards in Cloud Monitoring, or to set up alerts based on the metric values. For example, you can create an alert policy that triggers when the log-based metric for firewall changes exceeds a certain threshold in a given time interval. This way, you can get notified of any unexpected or malicious changes to your firewall rules.
Option B is incorrect because it is unnecessarily complex and costly. Installing Kibana on a compute instance requires additional configuration and maintenance. Creating a log sink to forward Cloud Audit Logs to Pub/Sub also incurs additional charges for the Pub/Sub service. Analyzing the logs on Kibana in real time may not be feasible or efficient, as it requires constant monitoring and manual intervention.
Option C is incorrect because Google Cloud firewall rules logging is a different feature from Cloud Audit Logs. Firewall rules logging allows you to audit, verify, and analyze the effects of your firewall rules by creating connection records for each rule that applies to traffic. However, firewall rules logging does not log the insert, update, or delete events for the firewall rules themselves. Those events are logged by Cloud Audit Logs, which record the administrative activities in your Google Cloud project.
Option D is incorrect because it is not a real-time solution. Creating a log sink to forward Cloud Audit Logs to Cloud Storage requires additional storage space and charges. Using BigQuery to periodically analyze log events in the storage bucket also incurs additional costs for the BigQuery service. Moreover, this option does not provide any alerting mechanism to notify you of any unexpected or malicious changes to your firewall rules or instances.
NEW QUESTION # 259
Your company has an existing GCP organization with hundreds of projects and a billing account. Your company recently acquired another company that also has hundreds of projects and its own billing account.
You would like to consolidate all GCP costs of both GCP organizations onto a single invoice. You would like to consolidate all costs as of tomorrow. What should you do?
- A. Migrate the acquired company's projects into your company's GCP organization. Link the migrated projects to your company's billing account.
- B. Configure the acquired company's billing account and your company's billing account to export the billing data into the same BigQuery dataset.
- C. Link the acquired company's projects to your company's billing account.
- D. Create a new GCP organization and a new billing account. Migrate the acquired company's projects and your company's projects into the new GCP organization and link the projects to the new billing account.
Answer: C
Explanation:
Explanation
https://cloud.google.com/resource-manager/docs/project-migration#oauth_consent_screen
https://cloud.google.com/resource-manager/docs/project-migration
NEW QUESTION # 260
Your customer has implemented a solution that uses Cloud Spanner and notices some read latency-related performance issues on one table. This table is accessed only by their users using a primary key. The table schema is shown below.
You want to resolve the issue. What should you do?
- A. Remove the profile_picture field from the table.
- B. Create a secondary index using the following Data Definition Language (DDL):
- C. Change the primary key to not have monotonically increasing values.
- D. Add a secondary index on the person_id column.
Answer: C
Explanation:
Schema design best practice #1: Do not choose a column whose value monotonically increases or decreases as the first key part for a high write rate table.
https://cloud.google.com/spanner/docs/schema-design#postgresql
NEW QUESTION # 261
You are deploying an application to a Compute Engine VM in a managed instance group. The application must be running at all times, but only a single instance of the VM should run per GCP project. How should you configure the instance group?
- A. Set autoscaling to Off, set the minimum number of instances to 1, and then set the maximum number of instances to 1.
- B. Set autoscaling to Off, set the minimum number of instances to 1, and then set the maximum number of instances to 2.
- C. Set autoscaling to On, set the minimum number of instances to 1, and then set the maximum number of instances to 2.
- D. Set autoscaling to On, set the minimum number of instances to 1, and then set the maximum number of instances to 1.
Answer: D
NEW QUESTION # 262
......
To prepare for the exam, candidates can take advantage of a variety of resources, including online courses, study guides, and practice tests. These resources can help candidates to gain a deeper understanding of the Google Cloud platform and its various components. Additionally, candidates can gain practical experience by working on real-world projects and collaborating with other professionals in the field.
Associate-Cloud-Engineer Question Bank: Free PDF Download Recently Updated Questions: https://freecert.test4sure.com/Associate-Cloud-Engineer-exam-materials.html