CertKata

GCP-ACE Practice Questions — Free

The Associate Cloud Engineer is Google Cloud's counterpart to SAA-C03 or AZ-104: an associate-level exam for engineers who deploy and operate workloads on Google Cloud as part of the job. It is hands-on and command-line heavy rather than conceptual, and if you have never run a gcloud command, expect to.

Its four domains follow a project from first setup to steady running. Planning and implementing a cloud solution and ensuring its successful operation are the two largest, and between them they carry most of the exam; setting up the environment and configuring access and security make up the rest in equal parts.

The exam checks that you can actually operate a project: IAM roles and how policy is inherited down the resource hierarchy, GKE and Cloud Run, VPC networking and firewall rules, Cloud SQL and Cloud Storage, and the monitoring and logging that keep all of it running. Expect questions to ask how you would do something with gcloud, not only where the setting lives in the console.

How GCP-ACE is weighted

  1. Set up a cloud solution environment20%
  2. Plan and implement a cloud solution30%
  3. Ensure the successful operation of a cloud solution30%
  4. Configure access and security20%

Set up a cloud solution environment

4 questions

  1. Question 1 of 25

    An engineer needs the organization ID to use in a gcloud command. Which command retrieves it?

    • A.gcloud iam org
    • B.gcloud config get org
    • C.gcloud organizations listCorrect
    • D.gcloud projects describe

    Answer: C

    organizations list shows organizations the account can see with their IDs.

  2. Question 2 of 25

    That engineer needs the Compute Engine API enabled in the new project from the command line. What command does this?

    • A.gcloud api add compute --project=PROJECT_ID
    • B.gcloud projects enable-api compute.googleapis.com
    • C.gcloud services enable compute.googleapis.comCorrect
    • D.gcloud compute enable --project=PROJECT_ID

    Answer: C

    gcloud services enable turns on a specific API for the current project.

  3. Question 3 of 25 · multiple response

    Which of the following can be applied at the folder level in the resource hierarchy? (Select TWO)

    • A.Organization policy constraintsCorrect
    • B.Instance templates
    • C.Firewall rules
    • D.IAM policiesCorrect

    Answers: A, D

    IAM and organization policies inherit from folders; firewall rules and templates are project-level resources.

  4. Question 4 of 25

    A project must be prevented from being accidentally deleted. What should be applied?

    • A.A budget on the project
    • B.A retention policy on the project
    • C.A firewall rule on the VPC
    • D.A lien on the projectCorrect

    Answer: D

    A lien blocks project deletion until it is removed.

Plan and implement a cloud solution

8 questions

  1. Question 5 of 25 · multiple response

    Which of the following are valid Cloud NAT characteristics? (Select TWO)

    • A.Requires external IPs on VMs
    • B.Provides outbound-only connectivityCorrect
    • C.Is regional and attached to a Cloud RouterCorrect
    • D.Provides inbound access to VMs

    Answers: B, C

    Cloud NAT is regional, uses a Cloud Router, and is outbound-only.

  2. Question 6 of 25

    A bucket's objects must be served over HTTPS as a static website behind a custom domain with CDN. What should front the bucket?

    • A.Cloud NAT with a static IP mapped to the custom domain
    • B.An external Application Load Balancer with a backend bucket and CDNCorrect
    • C.An internal passthrough load balancer with a bucket backend
    • D.A Cloud VPN gateway terminating TLS for the bucket

    Answer: B

    A backend bucket behind the external HTTP(S) load balancer supports custom domains, TLS, and CDN.

  3. Question 7 of 25

    A Pub/Sub topic must deliver messages to a Cloud Run service via HTTP. What subscription type is needed?

    • A.A push subscription targeting the service URLCorrect
    • B.A BigQuery subscription writing to a table
    • C.No subscription, since topics deliver directly
    • D.A pull subscription polled by the service

    Answer: A

    Push subscriptions deliver messages to an HTTP endpoint such as a Cloud Run service.

  4. Question 8 of 25

    An engineer must add a label to an existing VM. Which command does this?

    • A.gcloud compute instances update VM --tag=env=prod --zone=ZONE
    • B.gcloud labels set VM env=prod --zone=ZONE --resource=instance
    • C.gcloud compute instances add-labels VM --labels=env=prod --zone=ZONECorrect
    • D.gcloud compute instances tag VM --label=env=prod --zone=ZONE

    Answer: C

    add-labels attaches key-value labels to an instance.

  5. Question 9 of 25

    An engineer must create a bucket named data-archive in the EU multi-region from the CLI. Which command is correct?

    • A.gcloud storage buckets create gs://data-archive --location=EUCorrect
    • B.gcloud buckets create data-archive --location=europe
    • C.gcloud storage new gs://data-archive --multi-region=EU
    • D.gsutil buckets create data-archive --region=EU --class=STANDARD

    Answer: A

    gcloud storage buckets create with --location creates the bucket in the specified location.

  6. Question 10 of 25

    A BigQuery dataset must expire tables automatically after 7 days. What setting applies?

    • A.A retention policy on the dataset
    • B.A budget alert on the dataset's storage cost
    • C.Default table expiration on the datasetCorrect
    • D.A lifecycle rule on the dataset's storage

    Answer: C

    Default table expiration removes tables after the configured period.

  7. Question 11 of 25 · multiple response

    Which of the following are valid Cloud VPN gateway types? (Select TWO)

    • A.Classic VPNCorrect
    • B.HA VPNCorrect
    • C.Global VPN
    • D.Zonal VPN

    Answers: A, B

    HA VPN and Classic VPN are the two gateway types.

  8. Question 12 of 25

    A signed URL must let an external user download one object for 1 hour without a Google account. Which command creates it?

    • A.gcloud iam sign gs://bucket/obj --duration=1h
    • B.gcloud storage public gs://bucket/obj --temp=1h
    • C.gsutil share gs://bucket/obj --expires=1h
    • D.gcloud storage sign-url gs://bucket/obj --duration=1hCorrect

    Answer: D

    sign-url generates a time-limited URL for a specific object.

Ensure the successful operation of a cloud solution

9 questions

  1. Question 13 of 25

    A Cloud Run service's logs must be streamed live in the terminal. Which command does this?

    • A.gcloud run tail SVC --region=REGION --follow
    • B.gcloud logging watch --service=SVC --region=REGION
    • C.kubectl logs -f service/SVC --namespace=cloud-run
    • D.gcloud run services logs tail SVC --region=REGIONCorrect

    Answer: D

    services logs tail streams a Cloud Run service's logs.

  2. Question 14 of 25

    A data disk must be detached from a running VM before it is attached elsewhere. Which command detaches it?

    • A.gcloud compute disks unmount DISK --instance=VM --zone=ZONE
    • B.gcloud compute instances remove-disk VM --disk=DISK --zone=ZONE
    • C.gcloud compute instances detach-disk VM --disk=DISK --zone=ZONECorrect
    • D.gcloud compute disks detach DISK --from-instance=VM --zone=ZONE

    Answer: C

    detach-disk removes a persistent disk from an instance so it can be attached to another VM.

  3. Question 15 of 25

    A GKE deployment must scale from 2 to 10 replicas based on CPU. What object should be created?

    • A.A HorizontalPodAutoscalerCorrect
    • B.A StatefulSet with ordinal pods
    • C.A Job with parallelism set
    • D.A DaemonSet on every node

    Answer: A

    HPA adjusts replica count based on observed metrics such as CPU.

  4. Question 16 of 25 · multiple response

    Which of the following are valid kubectl commands for viewing resource usage? (Select TWO)

    • A.kubectl usage pods
    • B.kubectl top podsCorrect
    • C.kubectl top nodesCorrect
    • D.kubectl metrics nodes

    Answers: B, C

    kubectl top shows CPU and memory for pods and nodes; the others are not real commands.

  5. Question 17 of 25

    A VM must be deleted but its boot disk kept. Which flag applies?

    • A.--keep-disks=bootCorrect
    • B.--retain-disk
    • C.--no-delete-boot
    • D.--save-disks

    Answer: A

    keep-disks preserves specified disks when deleting the instance.

  6. Question 18 of 25

    An engineer must start a stopped VM. Which command does this?

    • A.gcloud vm start VM --zone=ZONE --wait
    • B.gcloud compute instances start VM --zone=ZONECorrect
    • C.gcloud compute run VM --zone=ZONE --start
    • D.gcloud compute instances boot VM --zone=ZONE

    Answer: B

    instances start powers on a stopped instance.

  7. Question 19 of 25

    A team needs to compare CPU usage of two VMs on the same chart. What Metrics Explorer feature helps?

    • A.An IAM binding granting both VMs the same viewer role
    • B.Filtering and grouping by instance name on the CPU metricCorrect
    • C.A log sink routing both VMs' CPU logs to one bucket
    • D.A budget alert scoped to the two VMs' resource group

    Answer: B

    Metrics Explorer filters and groups let multiple resources appear on one chart.

  8. Question 20 of 25 · multiple response

    Which of the following are ways to observe a Cloud SQL instance's performance? (Select TWO)

    • A.Cloud DNS query logs
    • B.Cloud Monitoring metrics for the instanceCorrect
    • C.VPC Flow Logs on the instance
    • D.Query Insights on the instanceCorrect

    Answers: B, D

    Monitoring metrics and Query Insights show database performance; DNS and flow logs do not.

  9. Question 21 of 25

    A team needs to confirm a load balancer's backends are healthy before cutting over DNS. Where is backend health shown?

    • A.Cloud DNS records that point at the load balancer's IP
    • B.The IAM & Admin page for the backend's service account
    • C.Cloud Billing's cost report for the load balancer resource
    • D.The backend service health status or get-healthCorrect

    Answer: D

    get-health reports each backend's health check state.

Configure access and security

4 questions

  1. Question 22 of 25

    A team must audit which VMs have the default service account with Editor. What tool lists service accounts across projects?

    • A.Cloud NAT gateway configuration exported per project
    • B.Cloud Asset Inventory, or service-accounts list per projectCorrect
    • C.Cloud CDN cache hit statistics queried for each project
    • D.Cloud DNS managed zone listings queried for each project

    Answer: B

    Asset Inventory queries IAM and resource data across the hierarchy.

  2. Question 23 of 25

    A user must be granted Owner on a project, but the organization requires justification. What is the minimum-privilege alternative for most tasks?

    • A.Owner, regardless of the organization's justification requirement
    • B.Viewer only, with no ability to make any changes
    • C.Editor plus specific admin roles as neededCorrect
    • D.No role at all until the justification has been approved

    Answer: C

    Editor covers most changes; Owner adds IAM and billing management that is rarely needed.

  3. Question 24 of 25

    A pod on GKE must not run as root. What Kubernetes setting enforces this?

    • A.A Service annotation forbidding root containers
    • B.A ResourceQuota limiting root-owned pods
    • C.securityContext.runAsNonRoot: true in the pod specCorrect
    • D.A NetworkPolicy denying traffic from root processes

    Answer: C

    The pod security context controls the user the container runs as.

  4. Question 25 of 25

    A user must be granted permission to view logs but not resources. Which role fits?

    • A.roles/logging.viewerCorrect
    • B.roles/editor on the project
    • C.roles/logging.admin
    • D.roles/viewer on the project

    Answer: A

    logging.viewer grants read access to logs only.

20 more free after signup, then the full 480-question bank for $12.

Get 20 more free questions