Google Cloud Associate Cloud Engineer (ACE) practice questions and exam guide

What does 'gcloud config set project my-project-id' do?

1. Creates a new project
2. Sets the active project for subsequent gcloud commands in your local configuration
3. Deletes the project
4. Restarts the project
5. Backs up the project

Answer: B — Sets the active project for subsequent gcloud commands in your local configuration

Sets the default project for gcloud commands in the current configuration. Avoids having to pass --project=... on every command. Configurations are stored in ~/.config/gcloud. Use 'gcloud config configurations' to manage multiple.

You want to ensure only signed container images can run on GKE. Which feature?

1. Binary Authorization (enforce attestation policies on GKE/Cloud Run)
2. Cloud Armor
3. VPC Service Controls
4. Shielded GKE Nodes only

Answer: A — Binary Authorization (enforce attestation policies on GKE/Cloud Run)

Binary Authorization requires images to have attestations from trusted authorities before they can be deployed. Cloud Armor is WAF. VPC SC is API perimeter. Shielded Nodes provide boot integrity but not image signing enforcement.

Which firewall rule has highest priority?

1. Allow always beats deny
2. Higher number wins
3. All rules tie, evaluated alphabetically
4. Lower priority number = higher precedence (e.g., priority 100 beats 1000)

Answer: D — Lower priority number = higher precedence (e.g., priority 100 beats 1000)

GCP firewall priority is 0-65535, lower number = higher precedence. Rules with the same priority: deny beats allow. Default rules (deny ingress, allow egress) sit at priority 65535.

Deploying a Cloud Function gen2 from local source, which command form is correct?

1. gcloud functions deploy NAME --gen2 --runtime=nodejs20 --trigger-http --source=. --region=R
2. gcloud run deploy NAME --function
3. gcloud functions create NAME --container
4. gcloud beta deploy function NAME

Answer: A — gcloud functions deploy NAME --gen2 --runtime=nodejs20 --trigger-http --source=. --region=R

Gen2 Cloud Functions deploy via 'gcloud functions deploy --gen2' with runtime, trigger, source, and region. Gen2 functions are built on Cloud Run + Eventarc under the hood but use the functions command. The other variants are not valid syntax.

A team needs read-only access to logs for debugging without write/delete. Which role?

1. roles/logging.viewer (or roles/logging.privateLogViewer for Data Access logs)
2. roles/owner
3. roles/logging.admin
4. roles/logging.logWriter

Answer: A — roles/logging.viewer (or roles/logging.privateLogViewer for Data Access logs)

logging.viewer grants read access to non-private logs; privateLogViewer adds Data Access logs. Owner/admin grants too much. logWriter only writes logs (used by apps), not read.

Which is the typical use of Identity-Aware Proxy (IAP)?

1. Replace IAM
2. Provide context-aware access control to applications and VMs — users authenticate via Google identity, IAP enforces access without VPN
3. Encrypt disks
4. Backup data
5. Run containers

Answer: B — Provide context-aware access control to applications and VMs — users authenticate via Google identity, IAP enforces access without VPN

IAP guards HTTP-based apps and SSH/RDP to VMs. Users authenticate to Google, IAP enforces IAM-bound access policy. Eliminates need for VPN for many remote access scenarios. Foundation of BeyondCorp zero-trust model.

A team wants budget alerts at 50%, 90%, and 100% of forecasted monthly spend. Where is this configured?

1. Cloud Monitoring alerting policy on logs
2. Per-project quota page
3. Billing → Budgets & alerts → create budget with thresholds
4. Org Policy Service

Answer: C — Billing → Budgets & alerts → create budget with thresholds

Budgets are created in Cloud Billing under Budgets & alerts. You set scope, amount, and threshold rules (percent of budget/forecast). Cloud Monitoring is for resource metrics; quotas limit usage; org policies set constraints, not spending alerts.

Which IAM role lets a user manage IAM policies for ALL service accounts in a project?

1. roles/iam.serviceAccountUser
2. roles/iam.serviceAccountAdmin (create/delete/manage SAs and their IAM)
3. roles/iam.serviceAccountTokenCreator (impersonation)
4. roles/owner only

Answer: B — roles/iam.serviceAccountAdmin (create/delete/manage SAs and their IAM)

serviceAccountAdmin manages SAs and policies on them. serviceAccountUser allows attaching SAs to resources. TokenCreator allows impersonation/short-lived tokens. Owner is too broad.

Memorystore offers managed:

1. Postgres and MySQL
2. Cassandra and MongoDB
3. Redis and Memcached
4. Elasticsearch and Kafka

Answer: C — Redis and Memcached

Memorystore provides managed Redis and Memcached for in-memory caching. Postgres/MySQL/SQL Server are Cloud SQL. Cassandra/Mongo/Elasticsearch/Kafka are not Memorystore offerings (some have third-party marketplace versions).

What does the gcloud flag '--format=json' do?

1. Reformats source code
2. Restarts gcloud
3. Encrypts output
4. Saves to file
5. Returns command output in JSON for scripting/parsing

Answer: E — Returns command output in JSON for scripting/parsing

gcloud supports multiple output formats: table (default), json, yaml, csv, value(...). --format=json is invaluable for scripting and piping to jq. ACE exam may test gcloud flag knowledge.

Default encryption at rest for Cloud Storage is:

1. None unless customer enables
2. Google-managed keys (always on, transparent); optional CMEK (Cloud KMS) or CSEK (customer-supplied)
3. Customer-supplied keys only
4. AES-128 with no rotation

Answer: B — Google-managed keys (always on, transparent); optional CMEK (Cloud KMS) or CSEK (customer-supplied)

All Cloud Storage data is encrypted at rest with Google-managed keys by default. Customers can use CMEK via Cloud KMS or CSEK (provide raw key). AES-256 with periodic rotation.

Workload Identity (GKE) binds:

1. Kubernetes ServiceAccount ↔ Google Service Account via roles/iam.workloadIdentityUser
2. GKE node ↔ project Owner
3. Pods to org admins
4. Containers to firewall tags

Answer: A — Kubernetes ServiceAccount ↔ Google Service Account via roles/iam.workloadIdentityUser

Workload Identity links KSAs to GSAs through the workloadIdentityUser role on the GSA, enabling per-pod identity to GCP APIs without keys. Other options are not how Workload Identity works.

Cloud SQL?

Managed MySQL, PostgreSQL, SQL Server. Regional.

Cloud NAT?

Allow private VMs to reach internet (outbound only). Managed service.

Snapshots?

Point-in-time backup of persistent disk. Incremental, regional or global.

Lifecycle rules?

Auto-transition or delete objects based on age, size, etc.

Need: archive old data cheaply?

Cloud Storage Archive class with lifecycle rules.

BigQuery?

Serverless data warehouse. SQL queries on petabytes. Pay per query.