Associate Cloud Engineer

Last checked October 22, 2026 against the official Google Cloud exam page.

1. Question 1Plan and implement a cloud solution

   A web application on Compute Engine must scale with traffic, distribute requests across zones, and keep serving when one zone fails. Which architecture meets these needs?

   1. AA single large VM in one zone with a static external IP and a daily snapshot for recovery
   2. BA regional managed instance group behind an external HTTP(S) load balancer with autoscaling enabled
   3. CA zonal managed instance group with autoscaling and a DNS record that points to one VM's address
   4. DSeveral unmanaged VMs in one zone, each with its own public IP that users are told to choose from manually
   Show answer and explanationHide answer

   Correct answer: B

   A regional managed instance group spreads VMs across zones and autoscaling adjusts capacity, and an external HTTP(S) load balancer distributes traffic across them. A single VM and a zonal group fail with their zone, and unmanaged VMs in one zone give no automatic scaling or zone resilience.

2. Question 2Configure access and security

   A developer needs to deploy resources to one project but must not be able to change IAM policies or delete the project. Which role assignment follows least privilege?

   1. AOrganization Administrator on the organization so that the developer can reach any future project quickly
   2. BProject Editor on the project, which lets the developer deploy and change resources while leaving IAM policy edits to the owner
   3. CProject Owner on the project, with a note in the change ticket that explains the restriction
   4. DBasic Viewer on the project plus a custom role that grants all compute permissions at the organization level
   Show answer and explanationHide answer

   Correct answer: B

   Project Editor lets the developer create and change resources without the owner's ability to manage IAM or delete the project. Owner grants IAM and deletion rights, Organization Administrator reaches far beyond the project, and a viewer role with organization-level compute permissions over-grants.

3. Question 3Ensure the successful operation of a cloud solution

   A team wants an alert in Cloud Monitoring when a VM's CPU stays above 80 percent for 10 minutes, delivered to the on-call channel. Which configuration is needed?

   1. AAn alerting policy on the CPU utilization metric with a 10-minute duration condition and a notification channel
   2. BA scheduled Cloud Function that runs top on the VM every minute and writes the output to a text file
   3. CA Cloud Logging filter that counts CPU lines in the syslog file, reviewed by the operator each morning
   4. DA Cloud Audit Logs sink to a bucket, which the team checks once a week for any CPU-related entries
   Show answer and explanationHide answer

   Correct answer: A

   An alerting policy on the CPU utilization metric with a duration condition fires only after the threshold holds for 10 minutes and notifies the channel. A log filter reviewed each morning is too slow, a polling function writes a file nobody watches, and audit logs record administrative activity.

4. Question 4Set up a cloud solution environment

   A new team needs to start building on Google Cloud. The company wants resources grouped by project, billed to the finance account, and governed by company-wide policies. Which structure should the engineer set up first?

   1. ACreate a single VM in the default project and run every team's workloads on it until a formal structure is approved
   2. BCreate a folder for each engineer and a separate billing account for every project so that costs are separated by person
   3. CCreate one shared project for everyone, with all teams using the default service account and the owner role on it
   4. DCreate an organization resource with a billing account linked, then create projects under folders for each team
   Show answer and explanationHide answer

   Correct answer: D

   An organization with a linked billing account and folders for teams gives a hierarchy where policies inherit and each project is billed. A shared project with owner access ignores least privilege, per-person folders and billing accounts fragment governance, and a single VM does not define structure at all.

5. Question 5Plan and implement a cloud solution

   A team deploys a stateless container-based API that receives HTTP requests with unpredictable traffic. The team wants no cluster management and scaling to zero when idle. Which service fits best?

   1. AGoogle Kubernetes Engine in Standard mode with a fixed node pool sized for peak traffic
   2. BCloud Run
   3. CCompute Engine managed instance group with a minimum of ten VMs that run continuously
   4. DApp Engine flexible environment with manually created VM instances kept running overnight
   Show answer and explanationHide answer

   Correct answer: B

   Cloud Run runs containers without cluster management, scales with request traffic, and can scale to zero when idle. A GKE node pool sized for peak adds cluster operations and idle cost, a continuously running managed group pays for idle VMs, and App Engine flexible instances do not scale to zero.