Free Associate Cloud Engineer practice test: 30 questions with answers

A regional managed instance group spreads VMs across zones and autoscaling adjusts capacity, and an external HTTP(S) load balancer distributes traffic across them. A single VM and a zonal group fail with their zone, and unmanaged VMs in one zone give no automatic scaling or zone resilience.

Cloud Run runs containers without cluster management, scales with request traffic, and can scale to zero when idle. A GKE node pool sized for peak adds cluster operations and idle cost, a continuously running managed group pays for idle VMs, and App Engine flexible instances do not scale to zero.

Cloud SQL for PostgreSQL provides managed backups and a standby for high availability in another zone. A hand-installed VM means the team runs backups and failover itself, Firestore is not PostgreSQL, and BigQuery is an analytics warehouse rather than a transactional database.

Cluster autoscaler adds nodes when pods cannot be scheduled and removes idle nodes within the configured minimum and maximum. The Horizontal Pod Autoscaler scales pods rather than nodes, a fixed large pool pays for idle capacity, and a time-based cron resize ignores actual demand.

Shared VPC lets a host project own the subnets while service projects deploy resources into them, which keeps network administration central. Per-project VPNs add complexity, putting all workloads in one project removes project separation, and copying ranges by hand causes conflicts.

Cloud Scheduler triggering a serverless job runs the work only when needed, with no servers to manage and no idle cost. A 24-hour VM and an idle GKE pool pay for idle time, and a manual laptop run depends on a person each night.

Coldline is designed for data read about once a quarter, with lower storage cost than Nearline or Standard and immediate retrieval. Standard costs more for rarely read data, Archive fits data read less than once a year and adds retrieval costs for quarterly reads, and Nearline suits monthly access.

A regional group distributes instances across zones, versioned golden images keep builds consistent, and rolling updates replace instances without a full outage. Local-only configuration is lost when an instance is replaced, and one VM with a static address is a single point of failure.

Project Editor lets the developer create and change resources without the owner's ability to manage IAM or delete the project. Owner grants IAM and deletion rights, Organization Administrator reaches far beyond the project, and a viewer role with organization-level compute permissions over-grants.

A dedicated service account with a narrow read role on the bucket, set as the service identity, gives scoped access with no key files. A key in the image is a credential leak, a public bucket exposes data to everyone, and sharing owner credentials is the worst option.

An organization policy constraint applied at the organization or folder level enforces the rule for current and future projects. A firewall rule blocks traffic but does not stop creation of external IPs, a document is not enforced, and denying instance creation for everyone would stop legitimate work.

Workload Identity lets a Kubernetes service account act as a Google service account without any key file. A key in a secret is still a stored credential, a public bucket removes access control, and owner on nodes gives every pod far more than it needs.

Secret Manager Secret Accessor lets a principal read secret values on the granted secret without managing them. Admin grants management rights, owner over-grants, and Viewer does not provide access to the secret payload.

Storage Object Viewer allows reading and listing objects without changing them, which matches the need. Storage Object Admin and Storage Admin both allow changes, and project owner gives far more than storage read access.

The IAM recommender identifies unused permissions to remove, and narrower predefined roles limit each workload to what it needs. Owner for every application is the opposite of least privilege, shared keys leak credentials, and disabling audit logs removes the record a reviewer needs.

Public access prevention blocks grants that would expose the bucket contents publicly and is enforced by Cloud Storage. A label does not enforce access, a description is advisory, and versioning restores older objects rather than preventing exposure.

An alerting policy on the CPU utilization metric with a duration condition fires only after the threshold holds for 10 minutes and notifies the channel. A log filter reviewed each morning is too slow, a polling function writes a file nobody watches, and audit logs record administrative activity.

A log sink to Cloud Storage with a lifecycle rule keeps logs for the audit period while moving older objects to cheaper classes. The default bucket retention is shorter than 400 days without a custom setting, a VM disk backup by hand is fragile, and deleting after seven days fails the requirement.

The serial port output shows the boot messages, which helps diagnose why the instance will not respond. Recreating the VM hides the evidence, copying logs needs an SSH login that is not available on an unresponsive VM, and restarting the project does not produce the serial output.

Shifting traffic back to the earlier revision restores service immediately, which is the fastest rollback. Deleting and redeploying takes much longer, editing in place is not a rollback, and waiting for errors to resolve themselves is not an operational response.

The Ops Agent collects logs and system and application metrics from the VM and sends them to Cloud Logging and Cloud Monitoring. The Cloud SQL proxy handles database connections, Cloud Scheduler does not copy files into logging, and Cloud Armor filters traffic rather than collecting telemetry.

Uptime checks, latency and error alerts, and log-based metrics surface degradation as it happens and notify the on-call team. A weekly summary and an unwatched dashboard detect problems too late.

Cloud Audit Logs Admin Activity records resource creation, deletion and configuration changes with the caller's identity. Serial output shows boot messages, storage access logs cover bucket reads, and CPU charts show load rather than who changed what.

An organization with a linked billing account and folders for teams gives a hierarchy where policies inherit and each project is billed. A shared project with owner access ignores least privilege, per-person folders and billing accounts fragment governance, and a single VM does not define structure at all.

gcloud init walks through authentication and sets defaults, and gcloud config set stores the project and region for later commands. Login alone does not set a project, and the other two command names are not gcloud commands.

A billing budget scoped to the project with threshold alerts notifies finance when spend crosses 80 percent. An instance schedule stops VMs without any budget logic, a logging sink to a spreadsheet is delayed and manual, and quotas limit resource counts rather than spend.

Disabling the default account or removing its broad role, and using dedicated user-managed accounts, is the standard control. Owner rights widen the risk, a comment is not an enforced control, and recreating the project does not change the default account's roles.

An organization policy on allowed resource locations is enforced for every project under the organization. A written reminder is not enforced, a startup script runs too late and only on VMs, and per-team IAM roles cannot restrict regions across all services.

Folders group projects so policies inherit, and labels make ownership and spend reportable. A single project for every environment removes separation, one shared service account links every project's risk, and turning off billing export removes the data finance needs.

Granting roles to a group means adding or removing a person from the group updates their access everywhere the group holds a role. Separate per-user copies create the admin work groups avoid, groups still need roles, and group access is not limited to the default project.