Practice Exam: Associate Cloud Engineer

Question bank: 100 · timed mock exam: 120 min

Official exam page on the vendor's site (opens in a new tab) Official exam guide (opens in a new tab) Official prep course (opens in a new tab)

Exam guide: format, domains and how to prepare

Compare: Google Associate Cloud Engineer vs Google Professional Cloud Architect

  • Planning and implementing a cloud solution 30 questions
  • Ensuring the successful operation of a cloud solution 30 questions
  • Setting up a cloud solution environment 20 questions
  • Configuring access and security 20 questions
Study mode (free) Exam mode (subscribers)

Free: 25 questions in study mode, all domains, no account.

Subscription: the 100 questions of this certification, the timed exam mode, and all other certifications too.

Subscribe · €9.99 / month

Secure card payment (Stripe) · No commitment · Cancel online

How to prepare for Associate Cloud Engineer with InfraPrep

The 100 questions cover 4 domains: Planning and implementing a cloud solution, Ensuring the successful operation of a cloud solution, Setting up a cloud solution environment, Configuring access and security. 25 of them are free, without an account.

Study mode

Answer at your pace: each answer is corrected straight away, with an explanation and the link to the documentation it relies on.

Exam mode

A timed exam of 120 minutes, with a question map to flag and come back to questions before you submit.

Results by domain

Your score is broken down by domain, so you know what to review first.

Original questions

Every question is written from the public documentation, never copied from the exam. You can contest an answer from study mode.

10 free sample questions

Question 1 Setting up a cloud solution environment

A company's Google Workspace account already has a Cloud Platform organization resource. An administrator wants to create a second, fully separate organization resource for a new business unit, reusing the same Google Workspace account. What happens?

  1. The new business unit's folder becomes its own root node, unrelated to the existing organization's policies
  2. The new business unit's resources have no parent, since it is treated as a separate account structure
  3. A second, independent organization resource is created automatically for the new business unit
  4. A Google Workspace or Cloud Identity account can be associated with exactly one organization resource
Show the answer and the explanation

Correct answer: D

A Google Workspace or Cloud Identity account can be associated with exactly one organization resource. Any new project created under that account is placed in the existing hierarchy, not a new one.

Source: official documentation

Question 2 Planning and implementing a cloud solution

A developer has a small Python HTTP service, has never used Docker, and wants the fastest path to a managed, scale-to-zero serverless deployment on Google Cloud without first learning containerization. What should they use, and is Docker required?

  1. GKE Autopilot; a container image is mandatory before any deployment
  2. Cloud Run; Docker knowledge is required because Cloud Run only accepts pre-built container images
  3. Compute Engine; Docker does not apply to virtual machines
  4. Cloud Run; containerization is optional
Show the answer and the explanation

Correct answer: D

While the serverless platform uses container technology, containerization is entirely optional: you can submit raw code in Python, Go, Node.js, or Java, and Cloud Run automatically builds, secures, and deploys it.

Source: official documentation

Question 3 Ensuring the successful operation of a cloud solution

An administrator wants automatic daily snapshots of several persistent disks, retained for a fixed number of days, without manually running a snapshot command each day. What Compute Engine feature fits, and how is it applied?

  1. An instance template, which manages each disk's snapshot lifecycle automatically
  2. A firewall rule that triggers a backup whenever ingress traffic is detected
  3. A one-time manual snapshot, repeated by an external cron job, since Compute Engine has no built-in scheduling
  4. A snapshot schedule, a resource policy applied to one or more persistent disk or Hyperdisk volumes
Show the answer and the explanation

Correct answer: D

Creating a snapshot schedule creates a resource policy that you can apply to one or more persistent disk or Hyperdisk volumes, and a retention setting such as max_retention_days controls how many days each snapshot is kept before deletion.

Source: official documentation

Question 4 Configuring access and security

A team creates a custom IAM role bundling exactly the permissions their support engineers need, to enforce least privilege. After Google Cloud launches a feature that requires an additional permission, who is responsible for updating the custom role to grant it?

  1. Only predefined roles require maintenance; custom roles are static snapshots
  2. The team itself: you maintain custom roles as responsibilities or features change
  3. No one; custom roles cannot be modified once created
  4. Google Cloud automatically updates every custom role whenever new permissions are introduced
Show the answer and the explanation

Correct answer: B

Custom roles help enforce the principle of least privilege by bundling only the permissions needed, but you are responsible for maintaining custom roles, including updating them as users' responsibilities change or to let users access new features that require additional permissions.

Source: official documentation

Question 5 Setting up a cloud solution environment

A security team wants a role that grants access to exactly the set of permissions they choose themselves, rather than a role that Google Cloud defines and maintains for a specific service. Which IAM role type should they use?

  1. Basic role
  2. Predefined role
  3. Service-managed role
  4. Custom role
Show the answer and the explanation

Correct answer: D

Custom roles provide granular access according to a user-specified list of permissions: the team chooses exactly which permissions to bundle.

Source: official documentation

Question 6 Planning and implementing a cloud solution

A team needs ten identical web-server VMs that must autoscale with load and be recreated automatically if one crashes. Built from an instance template, which Compute Engine grouping mechanism fits, and why not the alternative?

  1. An unmanaged instance group, because MIGs cannot autoheal failed instances
  2. Neither type supports autoscaling; a load balancer alone must be configured manually
  3. A managed instance group (MIG)
  4. An unmanaged instance group, because it lets the team add heterogeneous VMs freely
Show the answer and the explanation

Correct answer: C

Managed instance groups (MIGs) let you operate apps on multiple identical VMs and provide automated services such as autoscaling and autohealing.

Source: official documentation

Question 7 Ensuring the successful operation of a cloud solution

An operator runs `gcloud container node-pools delete` on a Standard-cluster node pool that still hosts running workloads governed by PodDisruptionBudgets. By default, does GKE respect those PodDisruptionBudgets before removing the nodes?

  1. Yes, GKE always drains pods according to their PodDisruptionBudget settings before deleting a node pool
  2. No: GKE doesn't respect PodDisruptionBudgets when deleting a node pool, so workloads are deleted
  3. GKE refuses the deletion until every PodDisruptionBudget affecting the pool is removed
  4. PodDisruptionBudgets only apply to Autopilot-managed node pools, which cannot be deleted at all
Show the answer and the explanation

Correct answer: B

Deleting a node pool deletes the nodes and all running workloads, and by default GKE doesn't respect PodDisruptionBudget settings when deleting node pools.

Source: official documentation

Question 8 Configuring access and security

An on-call engineer needs temporary elevated access to resolve an incident, without permanently changing their IAM policies or being handed a long-lived service account key. What technique does IAM support for this?

  1. Grant the engineer the Owner role permanently, then remember to revoke it afterward
  2. Impersonation is not supported; only the identity that created a service account can ever use its permissions
  3. Service account impersonation: authenticate as the service account to gain its permissions temporarily
  4. Download and share a service account JSON key with the engineer for the duration of the incident
Show the answer and the explanation

Correct answer: C

When an authenticated principal authenticates as a service account to gain the service account's permissions, this is called impersonating the service account; impersonation is useful to change a user's permissions, for example to temporarily grant elevated access, without changing that user's IAM policies.

Source: official documentation

Question 9 Setting up a cloud solution environment

An administrator manages dozens of projects and wants to request quota increases once, at the organization level, instead of repeating the request in every project's console. What does the documentation say about this?

  1. All quota increases can be requested only at the organization level
  2. In most cases, quota increase adjustments must be made at the project level
  3. Quota increases can be requested exclusively through Cloud Customer Care, never from the console
  4. Quota decreases are not supported at any level
Show the answer and the explanation

Correct answer: B

In most cases, quota increase adjustments must be made at the project level. Only a limited number of products support organization-level quota increase adjustments.

Source: official documentation

Question 10 Planning and implementing a cloud solution

A team wants to cut Compute Engine costs for a fault-tolerant batch job and is evaluating Spot VMs. What should they know about Spot VMs, according to the documentation?

  1. They offer up to 91% discount versus on-demand pricing
  2. They can only be used as GKE nodes, never as standalone Compute Engine instances
  3. They are guaranteed not to be preempted as long as the job runs for less than 24 hours
  4. They cost the same as on-demand VMs but run from a separate, reserved capacity pool
Show the answer and the explanation

Correct answer: A

Spot VMs are available at much lower prices, up to 91% discounts for many machine types, GPUs, TPUs, and local SSDs, compared to on-demand pricing, but Compute Engine might preempt Spot VMs at any time, such as when it needs the resources for other tasks.

Source: official documentation

Frequently asked questions

Are there free questions, and do I need an account?

Yes. 25 questions of this certification are free in study mode, across all its domains, without a subscription and without registration. The account is created when you subscribe, at checkout.

How does the subscription work, and can I cancel?

One monthly subscription covers all certifications and the timed practice exams. There is no minimum period. You cancel online, at any time, with the "Cancel your contract" function in My account; cancellation takes effect at the end of the month already paid, and no further payment is taken.

Where do the questions come from?

Every question is original, written from the vendor's public documentation. Each answer comes with an explanation and a link to the documentation page it relies on. InfraPrep is not affiliated with the vendors, and certification names belong to their owners.

In which language are the questions?

The questions are written in English, also on the French version of the site.

Is the catalog updated?

Yes, the catalog changes over time: new certifications and new questions are added.