Home Certifications Editorials

Exam overview and study plan

Associate Cloud Engineer Practice Questions

Associate Cloud Engineer

Read questions, check verified answers and discuss the reasoning. Use reading options to shape your revision, or switch to the simulator for timed practice.

View 48 free questions

48 questions in this view

Page 1 of 8

Question 1

You are deploying an application to Google Kubernetes Engine (GKE) that needs to call an external third-party API. You need to provide the external API vendor with a list of IP addresses for their firewall to allow traffic from your application. You want to follow Google-recommended practices and avoid any risk of interrupting traffic to the API due to IP address changes. What should you do?

Configure your GKE cluster with one node, and set the node to have a static external IP address. Ensure that the GKE cluster autoscaler is off. Send the external IP address of the node to the vendor to be added to the allowlist.
Configure your GKE cluster with private nodes. Configure a Cloud NAT instance with static IP addresses. Provide these IP addresses to the vendor to be added to the allowlist.
Configure your GKE cluster with private nodes. Configure a Cloud NAT instance with dynamic IP addresses. Provide these IP addresses to the vendor to be added to the allowlist.
Configure your GKE cluster with public nodes. Write a Cloud Run function that pulls the public IP addresses of each node in the cluster. Trigger the function to run every day with Cloud Scheduler. Send the list to the vendor by email every day.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

You are troubleshooting intermittent connection timeouts between a frontend-service and a user-service running on a private Google Kubernetes Engine (GKE) cluster. You suspect that a specific VPC firewall rule is incorrectly dropping the packets. You need definitive proof that this rule is the cause of the dropped connections. What should you do?

Review the Cloud Audit Logs in Cloud Logging to identify the timestamp and the identity of the user that last modified the suspected firewall rule.
Enable Firewall Rules Logging on the suspected firewall rule, and filter the logs in Cloud Logging for denied connections from that rule.
Examine the stdout logs from the frontend-service Pods in Cloud Logging to confirm the timeout error messages.
Enable VPC Flow Logs on the GKE cluster's subnet, and analyze the logs in Cloud Logging to identify the destination.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

You are migrating your on-premises workload to Google Cloud. Your company is implementing its Cloud Billing configuration and requires access to a granular breakdown of its Google Cloud costs. You need to ensure that the Cloud Billing datasets are available in BigQuery so you can conduct a detailed analysis of costs. What should you do?

Enable Cloud Billing on the project, and link a Cloud Billing account. Then, view the billing data table in the BigQuery dataset.
Enable the Cloud Billing data export to BigQuery when you create a Cloud Billing account.
Enable the BigQuery API, and ensure that the BigQuery User IAM role is selected. Change the BigQuery dataset to select a data location.
Create a Cloud Billing account. Enable the BigQuery Data Transfer Service API to export pricing data.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

You are implementing identity management in your cloud organization. You have many applications on-premises with Active Directory Kerberos credentials that need to authenticate with Google Cloud. You want to avoid managing sensitive secret rotations, and implement a solution that uses managed services. What should you do?

Use an API key stored in Secret Manager.
Use application default credentials with a Google Account.
Use a service account and service account key file stored in Secret Manager.
Use Workload Identity Federation.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 5

You manage a portfolio of Google Cloud projects that all use the same billing account. You receive an alert that one of the projects in your development environment has been compromised and is being used for resource-intensive, malicious activity, leading to a rapid increase in costs. You need to stop the financial impact of the compromised project immediately. What should you do?

Use a script to iterate through all zones and regions, stopping all running VMs and GKE clusters.
Disable billing for the compromised project.
Remove all IAM principals from the project, and apply a VPC Service Controls perimeter.
Contact Cloud Customer Care to report the abuse.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 6

Your company is migrating its workloads to Google Cloud due to an expiring data center contract. The on-premises environment and Google Cloud are not connected. You have decided to follow a lift-and-shift approach, and you plan to modernize the workloads in a future project. Several old applications connect to each other through hard-coded internal IP addresses. You want to migrate these workloads quickly without modifying the application code. You also want to maintain all functionality. What should you do?

Create a VPC with the same CIDR ranges as your on-premises network. When migrating individual workloads, assign each workload the same static internal IP address.
Migrate your DNS server first. Configure Cloud DNS with a forwarding zone to your migrated DNS server. Then migrate all other workloads with ephemeral internal IP addresses.
Migrate all workloads to a single VPC subnet. Configure Cloud NAT for the subnet and manually assign a static IP address to the Cloud NAT gateway.
Create a VPC with non-overlapping CIDR ranges compared to your on-premises network. When migrating individual workloads, assign each workload a new static internal IP address.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Page 1 of 8

Build confidence for exam day with expert-reviewed questions and realistic practice. Your next certification starts here.

Company

About Contact Our Authors FAQ

Trust and policies

Methodology Editorial policy Terms and conditions Privacy policy

Contact

ExamPrepare LLC5203 Juan Tabo Blvd STE 2BAlbuquerque, NM 87111[email protected]

© 2026 ExamPrepare LLC. All rights reserved. All certification names, exam codes and logos are the property of their respective owners. All associated trademark and copyright rights belong to those owners. ExamPrepare is not affiliated with, endorsed by, or sponsored by any certification vendor.