Pass Your Associate-Cloud-Engineer Exam at the First Try with 100% Real Exam Questions
New Google Associate-Cloud-Engineer Dumps & Questions Updated on 2026
NEW QUESTION # 49
You need to select and configure compute resources for a set of batch processing jobs. These jobs take around 2 hours to complete and are run nightly. You want to minimize service costs.
What should you do?
- A. Select Google Kubernetes Engine. Use a single-node cluster with a small instance type.
- B. Select Compute Engine. Use preemptible VM instances of the appropriate standard machine type.
- C. Select Compute Engine. Use VM instance types that support micro bursting.
- D. Select Google Kubernetes Engine. Use a three-node cluster with micro instance types.
Answer: B
NEW QUESTION # 50
You have downloaded and installed the gcloud command line interface (CLI) and have authenticated with your Google Account. Most of your Compute Engine instances in your project run in the europe-west1-d zone.
You want to avoid having to specify this zone with each CLI command when managing these instances. What should you do?
- A. Set the europe-west1-d zone as the default zone using the gcloud config subcommand.
- B. In the Settings page for Compute Engine under Default location, set the zone to europe-west1-d.
- C. Create a Metadata entry on the Compute Engine page with key compute/zone and value europe-west1-d.
- D. In the CLI installation directory, create a file called default.conf containing zone=europe-west1-d.
Answer: D
NEW QUESTION # 51
You created several resources in multiple Google Cloud projects. All projects are linked to different billing accounts. To better estimate future charges, you want to have a single visual representation of all costs incurred. You want to include new cost data as soon as possible. What should you do?
- A. Visit the Cost Table page to get a CSV export and visualize it using Data Studio.
- B. Configure Billing Data Export to BigQuery and visualize the data in Data Studio.
- C. Fill all resources in the Pricing Calculator to get an estimate of the monthly cost.
- D. Use the Reports view in the Cloud Billing Console to view the desired cost information.
Answer: B
Explanation:
https://cloud.google.com/billing/docs/how-to/visualize-data
NEW QUESTION # 52
Your finance team wants to view the billing report for your projects. You want to make sure that the finance team does not get additional permissions to the project. What should you do?
- A. Add the group for the finance team to roles/billing admin role.
- B. Add the group for the finance team to roles/billing project/Manager role.
- C. Add the group for the finance team to roles/billing viewer role.
- D. Add the group for the finance team to roles/billing user role.
Answer: C
Explanation:
Explanation
"Billing Account Viewer access would usually be granted to finance teams, it provides access to spend information, but does not confer the right to link or unlink projects or otherwise manage the properties of the billing account." https://cloud.google.com/billing/docs/how-to/billing-access
NEW QUESTION # 53
You need to track and verity modifications to a set of Google Compute Engine instances in your Google Cloud project. In particular, you want to verify OS system patching events on your virtual machines (VMs). What should you do?
- A. Review the Compute Engine activity logs Select and review the System Event logs
- B. Install the Cloud Logging Agent In Cloud Logging review the Compute Engine syslog logs
- C. Review the Compute Engine activity logs Select and review the Admin Event logs
- D. Install the Cloud Logging Agent In Cloud Logging, review the Compute Engine operation logs
Answer: C
NEW QUESTION # 54
You need to reduce GCP service costs for a division of your company using the fewest possible steps. You need to turn off all configured services in an existing GCP project. What should you do?
- A. 1. Verify that you are assigned the Organizational Administrators IAM role for this project.
2. Switch to the project in the GCP console, locate the resources and delete them. - B. 1. Verify that you are assigned the Project Owners IAM role for this project.
2. Switch to the project in the GCP console, locate the resources and delete them. - C. 1. Verify that you are assigned the Project Owners IAM role for this project.
2. Locate the project in the GCP console, click Shut down and then enter the project ID. - D. 1. Verify that you are assigned the Organizational Administrator IAM role for this project.
2. Locate the project in the GCP console, enter the project ID and then click Shut down.
Answer: C
Explanation:
Explanation
https://cloud.google.com/run/docs/tutorials/gcloud
https://cloud.google.com/resource-manager/docs/creating-managing-projects
https://cloud.google.com/iam/docs/understanding-roles#primitive_roles
You can shut down projects using the Cloud Console. When you shut down a project, this immediately happens: All billing and traffic serving stops, You lose access to the project, The owners of the project will be notified and can stop the deletion within 30 days, The project will be scheduled to be deleted after 30 days.
However, some resources may be deleted much earlier.
NEW QUESTION # 55
You have deployed multiple Linux instances on Compute Engine. You plan on adding more instances in the coming weeks. You want to be able to access all of these instances through your SSH client over me Internet without having to configure specific access on the existing and new instances. You do not want the Compute Engine instances to have a public IP. What should you do?
- A. Configure Cloud Identity-Aware Proxy (or HTTPS resources
- B. Configure Cloud Identity-Aware Proxy for SSH and TCP resources.
- C. Create an SSH keypair and store the public key as a project-wide SSH Key
- D. Create an SSH keypair and store the private key as a project-wide SSH Key
Answer: B
Explanation:
Explanation
https://cloud.google.com/iap/docs/using-tcp-forwarding
NEW QUESTION # 56
A company wants to build an application that stores images in a Cloud Storage bucket and wants to generate thumbnails as well as resize the images. They want to use a google managed service that can scale up and scale down to zero automatically with minimal effort. You have been asked to recommend a service. Which GCP service would you suggest?
- A. Google Kubernetes Engine
- B. Google Compute Engine
- C. Google App Engine
- D. Cloud Functions
Answer: D
Explanation:
Cloud Functions is Google Cloud's event-driven serverless compute platform. It automatically scales based on the load and requires no additional configuration. You pay only for the resources used.
Ref: https://cloud.google.com/functions
While all other options i.e. Google Compute Engine, Google Kubernetes Engine, Google App Engine support autoscaling, it needs to be configured explicitly based on the load and is not as trivial as the scale up or scale down offered by Google's cloud functions.
NEW QUESTION # 57
You need to select and configure compute resources for a set of batch processing jobs. These jobs take around
2 hours to complete and are run nightly. You want to minimize service costs. What should you do?
- A. Select Google Kubernetes Engine. Use a single-node cluster with a small instance type.
- B. Select Compute Engine. Use preemptible VM instances of the appropriate standard machine type.
- C. Select Compute Engine. Use VM instance types that support micro bursting.
- D. Select Google Kubernetes Engine. Use a three-node cluster with micro instance types.
Answer: B
Explanation:
Explanation
If your apps are fault-tolerant and can withstand possible instance preemptions, then preemptible instances can reduce your Compute Engine costs significantly. For example, batch processing jobs can run on preemptible instances. If some of those instances stop during processing, the job slows but does not completely stop.
Preemptible instances complete your batch processing tasks without placing additional workload on your existing instances and without requiring you to pay full price for additional normal instances.
https://cloud.google.com/compute/docs/instances/preemptible
NEW QUESTION # 58
You deployed an App Engine application using gcloud app deploy, but it did not deploy to the intended project. You want to find out why this happened and where the application deployed. What should you do?
- A. Go to Deployment Manager and review settings for deployment of applications.
- B. Check the web-application.xml file for your application and check project settings.
- C. Go to Cloud Shell and run gcloud config list to review the Google Cloud configuration used for deployment.
- D. Check the app.yaml file for your application and check project settings.
Answer: C
Explanation:
Explanation
C:\GCP\appeng>gcloud config list
[core]
account = [email protected]
disable_usage_reporting = False
project = my-first-demo-xxxx
https://cloud.google.com/endpoints/docs/openapi/troubleshoot-gce-deployment
NEW QUESTION # 59
You want to configure 10 Compute Engine instances for availability when maintenance occurs. Your requirements state that these instances should attempt to automatically restart if they crash. Also, the instances should be highly available including during system maintenance. What should you do?
- A. Create an instance templated for the instances. Set 'Automatic Restart' to off. Set 'On-host maintenance' to Terminate VM instances. Add the instance template to an instance group.
- B. Create an instance group for the instances. Set the 'Autohealing' health check to healthy (HTTP).
- C. Create an instance template for the instances. Set the 'Automatic Restart' to on. Set the 'On-host maintenance' to Migrate VM instance. Add the instance template to an intsance group.
- D. Create an instance group for the instance. Verify that the 'Advanced creation options' setting for 'do not retry machine creation' is set to off.
Answer: A
NEW QUESTION # 60
You need to create a custom VPC with a single subnet. The subnet's range must be as large as possible.
Which range should you use?
- A. 10.0.0.0/8
- B. 172.16.0.0/12
- C. 192.168.0.0/16
- D. .00.0.0/0
Answer: A
Explanation:
https://cloud.google.com/vpc/docs/vpc#manually_created_subnet_ip_ranges
NEW QUESTION # 61
Your team has developed a stateless application which requires it to be run directly on virtual machines. The application is expected to receive a fluctuating amount of traffic and needs to scale automatically. You need to deploy the application. What should you do?
- A. Deploy the application on Cloud Functions and configure the maximum number instances.
- B. Deploy the application on a Kubernetes Engine cluster and configure node pool autoscaling.
- C. Deploy the application on a managed instance group and configure autoscaling.
- D. Deploy the application on Cloud Run and configure autoscaling.
Answer: C
Explanation:
A managed instance group is a group of identical virtual machines that are created from a common instance template and are managed by the Compute Engine service. A managed instance group can scale automatically based on the load or a schedule, and can distribute the traffic across the instances using a load balancer. A managed instance group is a suitable choice for deploying a stateless application that requires to be run directly on virtual machines and needs to scale automatically. You can use the Google Cloud console, the Cloud SDK (gcloud), or the REST API to create and manage a managed instance group.
The other options are not correct because they either do not meet the requirements of the application, or they do not run the application directly on virtual machines. Option A is not correct because Cloud Run is a serverless platform that runs stateless containers, not virtual machines. Option B is not correct because a Kubernetes Engine cluster is a managed Kubernetes service that runs containerized applications, not virtual machines. Option D is not correct because Cloud Functions is a serverless platform that runs single-purpose functions, not virtual machines.
Reference:
Managed instance groups
Autoscaling groups of instances
Creating and starting a managed instance group
NEW QUESTION # 62
A company has a popular multi-player mobile game hosted in its on-premises datacenter. The current infrastructure can no longer keep up with demand and the company is considering a move to the cloud.
Which solution should a Solutions Architect recommend as the MOST scalable and cost-effective solution to meet these needs?
- A. AWS Lambda and Amazon API Gateway
- B. Amazon EC2 and Amazon Elastic Transcoder
- C. Amazon S3 and Amazon CloudFront
- D. Amazon EC2 and an Application Load Balancer
Answer: A
NEW QUESTION # 63
You create a Deployment with 2 replicas in a Google Kubernetes Engine cluster that has a single preemptible node pool. After a few minutes, you use kubectl to examine the status of your Pod and observe that one of them is still in Pending status:
What is the most likely cause?
- A. The node pool is configured with a service account that does not have permission to pull the container image used by the pending Pod.
- B. The pending Pod was originally scheduled on a node that has been preempted between the creation of the Deployment and your verification of the Pods' status. It is currently being rescheduled on a new node.
- C. Too many Pods are already running in the cluster, and there are not enough resources left to schedule the pending Pod.
- D. The pending Pod's resource requests are too large to fit on a single node of the cluster.
Answer: C
Explanation:
* The pending Pods resource requests are too large to fit on a single node of the cluster. Too many Pods are already running in the cluster, and there are not enough resources left to schedule the pending Pod.
is the right answer.
* When you have a deployment with some pods in running and other pods in the pending state, more often than not it is a problem with resources on the nodes. Heres a sample output of this use case. We see that the problem is with insufficient CPU on the Kubernetes nodes so we have to either enable auto- scaling or manually scale up the nodes.
NEW QUESTION # 64
You are using Container Registry to centrally store your company's container images in a separate project. In another project, you want to create a Google Kubernetes Engine (GKE) cluster. You want to ensure that Kubernetes can download images from Container Registry. What should you do?
- A. Create a service account, and give it access to Cloud Storage. Create a P12 key for this service account and use it as an imagePullSecrets in Kubernetes.
- B. Configure the ACLs on each image in Cloud Storage to give read-only access to the default Compute Engine service account.
- C. In the project where the images are stored, grant the Storage Object Viewer IAM role to the service account used by the Kubernetes nodes.
- D. When you create the GKE cluster, choose the Allow full access to all Cloud APIs option under
`Access scopes'.
Answer: C
Explanation:
IAM permissions
IAM permissions determine who can access resources. All users, service accounts, and other identities that interact with Container Registry must have the appropriate Cloud Storage permissions.
By default, Google Cloud use default service accounts to interact with resources within the same project. For example, the Cloud Build service account can both push and pull images when Container Registry is in the same project.
You must configure or modify permissions yourself if:
You are using a service account in one project to access Container Registry in a different project You are using a default service account with read-only access to storage, but you want to both pull and push images You are using a custom service account to interact with Container Registry
https://cloud.google.com/container-registry/docs/access-control
NEW QUESTION # 65
You need to produce a list of the enabled Google Cloud Platform APIs for a GCP project using the gcloud command line in the Cloud Shell. The project name is my-project. What should you do?
- A. Run gcloud info to view the account value, and then run gcloud services list --account <Account>.
- B. Run gcloud init to set the current project to my-project, and then run gcloud services list --available.
- C. Run gcloud projects describe <project ID> to verify the project value, and then run gcloud services list
--available. - D. Run gcloud projects list to get the project ID, and then run gcloud services list --project <project ID>.
Answer: D
NEW QUESTION # 66
You created an instance of SQL Server 2017 on Compute Engine to test features in the new version. You want to connect to this instance using the fewest number of steps. What should you do?
- A. Set a Windows username and password in the GCP Console. Verify that a firewall rule for port 3389 exists. Click the RDP button in the GCP Console, and supply the credentials to log in.
- B. Set a Windows password in the GCP Console. Verify that a firewall rule for port 22 exists. Click the RDP button in the GCP Console and supply the credentials to log in.
- C. Install a RDP client in your desktop. Set a Windows username and password in the GCP Console. Use the credentials to log in to the instance.
- D. Install a RDP client on your desktop. Verify that a firewall rule for port 3389 exists.
Answer: A
Explanation:
https://cloud.google.com/compute/docs/instances/connecting-to-windows#remote-desktop-connection-app
https://cloud.google.com/compute/docs/instances/windows/generating-credentials
https://cloud.google.com/compute/docs/instances/connecting-to-windows#before-you-begin
NEW QUESTION # 67
You need to create an autoscaling managed instance group for an HTTPS web application. You want to make sure that unhealthy VMs are recreated. What should you do?
- A. In the Instance Template, add a startup script that sends a heartbeat to the metadata server.
- B. In the Instance Template, add the label 'health-check'.
- C. Select Multi-Zone instead of Single-Zone when creating the Managed Instance Group.
- D. Create a health check on port 443 and use that when creating the Managed Instance Group.
Answer: D
Explanation:
https://cloud.google.com/compute/docs/instance-groups/autohealing-instances-in-migs#setting_up_an_autohealing_policy
NEW QUESTION # 68
(You are managing the security configuration of your company's Google Cloud organization. The Operations team needs specific permissions on both a Google Kubernetes Engine (GKE) cluster and a Cloud SQL instance. Two predefined Identity and Access Management (IAM) roles exist that contain a subset of the permissions needed by the team. You need to configure the necessary IAM permissions for this team while following Google-recommended practices. What should you do?)
- A. Grant the team the IAM roles of Kubernetes Engine Admin and Cloud SQL Admin.
- B. Create a custom IAM role that combines the permissions from the two relevant predefined roles.
- C. Create a custom IAM role that includes only the required permissions from the predefined roles.
- D. Grant the team the two predefined IAM roles.
Answer: C
Explanation:
Granting more permissions than necessary violates the principle of least privilege, a fundamental security best practice. While option A grants the necessary permissions (as subsets exist in two predefined roles), it might also grant more permissions than the Operations team strictly requires for their tasks on GKE and Cloud SQL.
Option D is too broad; 'Admin' roles grant extensive permissions that likely exceed the specific needs.
Google Cloud's best practices strongly recommend adhering to the principle of least privilege. Creating a custom role allows you to precisely define the set of permissions the Operations team needs for their specific tasks on the GKE cluster and the Cloud SQL instance, without granting any unnecessary permissions. This minimizes the potential blast radius in case of accidental or malicious actions.
Google Cloud Documentation References:
IAM best practices: https://cloud.google.com/iam/docs/best-practices - This document explicitly recommends granting the minimum necessary permissions.
Creating and managing custom roles: https://cloud.google.com/iam/docs/creating-managing-custom-roles - This explains how to create roles tailored to specific job functions.
Understanding roles: https://cloud.google.com/iam/docs/understanding-roles - This outlines the concepts of predefined and custom roles and their use cases.
NEW QUESTION # 69
You are developing a new web application that will be deployed on Google Cloud Platform. As part of your release cycle, you want to test updates to your application on a small portion of real user traffic. The majority of the users should still be directed towards a stable version of your application. What should you do?
- A. Deploy the application on Kubernetes Engine For a now release, create a new deployment for the new version Update the service e to use the now deployment.
- B. Deploy me application on App Engine For each update, create a new version of the same service Configure traffic splitting to send a small percentage of traffic to the new version
- C. Deploy the application on App Engine For each update, create a new service Configure traffic splitting to send a small percentage of traffic to the new service.
- D. Deploy the application on Kubernetes Engine For a new release, update the deployment to use the new version
Answer: A
Explanation:
Keyword, Version, traffic splitting, App Engine supports traffic splitting for versions before releasing.
NEW QUESTION # 70
The core business of your company is to rent out construction equipment at large scale. All the equipment that is being rented out has been equipped with multiple sensors that send event information every few seconds. These signals can vary from engine status, distance traveled, fuel level, and more. Customers are billed based on the consumption monitored by these sensors.
You expect high throughput - up to thousands of events per hour per device - and need to retrieve consistent data based on the time of the event. Storing and retrieving individual signals should be atomic. What should you do?
- A. Ingest the data into Bigtable. Create a row key based on the event timestamp.
- B. Ingest the data into Cloud SQL. Use multiple read replicas to match the throughput.
- C. Create a file in Filestore per device, and append new data to that file.
- D. Create files in Cloud Storage as data comes in.
Answer: A
NEW QUESTION # 71
You are building an application that processes data files uploaded from thousands of suppliers. Your primary goals for the application are data security and the expiration of aged dat a. You need to design the application to:
* Restrict access so that suppliers can access only their own data.
* Give suppliers write access to data only for 30 minutes.
* Delete data that is over 45 days old.
You have a very short development cycle, and you need to make sure that the application requires minimal maintenance. Which two strategies should you use? (Choose two.)
- A. Build a lifecycle policy to delete Cloud Storage objects after 45 days.
- B. Develop a script that loops through all Cloud Storage buckets and deletes any buckets that are older than 45 days.
- C. Build a Cloud function that triggers a timer of 45 days to delete objects that have expired.
- D. Use signed URLs to allow suppliers limited time access to store their objects.
- E. Set up an SFTP server for your application, and create a separate user for each supplier.
Answer: A,D
Explanation:
(A) Object Lifecycle Management
Delete
The Delete action deletes an object when the object meets all conditions specified in the lifecycle rule.
Exception: In buckets with Object Versioning enabled, deleting the live version of an object causes it to become a noncurrent version, while deleting a noncurrent version deletes that version permanently.
https://cloud.google.com/storage/docs/lifecycle#delete
(B) Signed URLs
This page provides an overview of signed URLs, which you use to give time-limited resource access to anyone in possession of the URL, regardless of whether they have a Google account
https://cloud.google.com/storage/docs/access-control/signed-urls
NEW QUESTION # 72
Your company uses a large number of Google Cloud services centralized in a single project. All teams have specific projects for testing and development. The DevOps team needs access to all of the production services in order to perform their job. You want to prevent Google Cloud product changes from broadening their permissions in the future. You want to follow Google-recommended practices. What should you do?
- A. Create a custom role that combines the required permissions. Grant the DevOps team the custom role on the organization level.
- B. Create a custom role that combines the required permissions. Grant the DevOps team the custom role on the production project.
- C. Grant all members of the DevOps team the role of Project Editor on the organization level.
- D. Grant all members of the DevOps team the role of Project Editor on the production project.
Answer: C
Explanation:
Understanding IAM custom roles
Key Point: Custom roles enable you to enforce the principle of least privilege, ensuring that the user and service accounts in your organization have only the permissions essential to performing their intended functions.
Basic concepts
Custom roles are user-defined, and allow you to bundle one or more supported permissions to meet your specific needs. Custom roles are not maintained by Google; when new permissions, features, or services are added to Google Cloud, your custom roles will not be updated automatically.
When you create a custom role, you must choose an organization or project to create it in. You can then grant the custom role on the organization or project, as well as any resources within that organization or project.
https://cloud.google.com/iam/docs/understanding-custom-roles#basic_concepts
NEW QUESTION # 73
......
The Google Associate-Cloud-Engineer exam itself consists of multiple-choice questions that are designed to test the candidate's knowledge and understanding of the Google Cloud platform. Candidates will have two hours to complete the exam, and they must achieve a passing score of 70% or higher to earn the certification. Upon passing the exam, candidates will receive a digital badge that they can use to showcase their credentials to potential employers.
The Associate-Cloud-Engineer Certification Exam is a great way to demonstrate to potential employers or clients that you have the knowledge and skills required to manage Google Cloud Platform services. Google Associate Cloud Engineer Exam certification also provides you with the opportunity to enhance your career prospects and increase your earning potential.
Updated Exam Associate-Cloud-Engineer Dumps with New Questions: https://www.testinsides.top/Associate-Cloud-Engineer-dumps-review.html
Dumps to Pass your Associate-Cloud-Engineer Exam with 100% Real Questions and Answers: https://drive.google.com/open?id=18rmIUNdRu_A_UGnfuJVkMkTULDC5jgGY