ACE practice questions and answers
All 12 questions from Practice Test 1 for Google Associate Cloud Engineer, with the correct answer and a full explanation for each — including why the other options are wrong. Free to read, no signup.
What this set covers
Questions are weighted to match the official ACE exam guide. The real exam is 50–60 questions in 120 minutes with a pass mark of Not published (~70%).
- Setting Up a Cloud Solution Environment2 q · 17%
- Planning and Configuring a Cloud Solution3 q · 18%
- Deploying and Implementing a Cloud Solution3 q · 25%
- Ensuring Successful Operation of a Cloud Solution2 q · 20%
- Configuring Access and Security2 q · 20%
Which resource sits directly above projects in the Google Cloud resource hierarchy and lets you apply policies to a group of projects?
- AFolder✓
- BBilling account
- CVPC network
- DService account
Correct answer: A — Folder
The hierarchy is Organization → Folders → Projects → Resources, and IAM policies and org policies are inherited downward. Billing accounts pay for projects but are not part of the policy hierarchy.
Resource hierarchyAn application running on a Compute Engine VM needs to write objects to a Cloud Storage bucket. What is the recommended way to grant that access?
- AAttach a service account to the VM and grant it the Storage Object Creator role on the bucket.✓
- BDownload a service account key file onto the VM.
- CMake the bucket publicly writable.
- DUse the personal credentials of the developer via gcloud auth login.
Correct answer: A — Attach a service account to the VM and grant it the Storage Object Creator role on the bucket.
Attaching a service account gives the VM automatically rotated credentials through the metadata server — no key files to leak. Key files are long-lived secrets, public write access is dangerous, and personal credentials break when the person leaves.
Service accounts for Compute EngineA workload runs batch jobs that can be interrupted and restarted, and cost matters more than uptime. Which Compute Engine option is cheapest?
- ACommitted use discounts
- BSpot VMs✓
- CSole-tenant nodes
- DStandard on-demand VMs
Correct answer: B — Spot VMs
Spot VMs use spare capacity at a steep discount and can be preempted, which suits interruptible batch work. Committed use discounts need a one- or three-year commitment, and sole-tenant nodes cost more because the hardware is dedicated.
Spot VMsWhich storage class is designed for data accessed less than once a year, such as long-term regulatory archives?
- AStandard
- BNearline
- CColdline
- DArchive✓
Correct answer: D — Archive
Cloud Storage classes map to access frequency: Standard for hot data, Nearline for roughly monthly access, Coldline for quarterly, and Archive for yearly or less with the lowest storage price and highest retrieval cost.
Cloud Storage classesWhich command creates a GKE cluster in a specific zone using the gcloud CLI?
- Agcloud container clusters create my-cluster --zone us-central1-a✓
- Bgcloud compute clusters create my-cluster --zone us-central1-a
- Ckubectl create cluster my-cluster
- Dgcloud gke create my-cluster
Correct answer: A — gcloud container clusters create my-cluster --zone us-central1-a
GKE clusters are managed under `gcloud container clusters`. `kubectl` talks to an existing cluster and cannot create one, and the other command forms do not exist.
Creating a GKE clusterA team wants to run a stateless containerized web API that scales to zero when idle and requires no cluster management. Which service should they use?
- AGoogle Kubernetes Engine Standard
- BCloud Run✓
- CCompute Engine managed instance group
- DApp Engine flexible environment
Correct answer: B — Cloud Run
Cloud Run runs containers as a fully managed service, scales to zero, and charges per request time. GKE Standard means managing node pools, instance groups mean managing VMs, and App Engine flexible keeps at least one instance running.
Cloud Run overviewWhich IAM role type should you prefer when granting access, according to Google's best practices?
- ABasic roles such as Owner, Editor and Viewer
- BPredefined roles that match the job to be done✓
- CPrimitive roles at the organization level
- DThe Owner role scoped to a folder
Correct answer: B — Predefined roles that match the job to be done
Predefined roles follow least privilege by bundling only the permissions a specific task needs. Basic (primitive) roles are very broad and Google recommends avoiding them in production, especially at high scopes.
IAM roles overviewWhich service collects logs from Google Cloud resources and lets you build log-based metrics and alerts?
- ACloud Logging✓
- BCloud Trace
- CCloud Profiler
- DCloud Deploy
Correct answer: A — Cloud Logging
Cloud Logging stores and queries logs and can turn a log pattern into a metric that alerts. Trace shows request latency, Profiler analyses CPU and memory use in code, and Cloud Deploy runs delivery pipelines.
Cloud Logging overviewWhich database should be chosen for a globally distributed transactional application that needs strong consistency and horizontal scaling with SQL?
- ACloud SQL
- BCloud Spanner✓
- CFirestore
- DBigQuery
Correct answer: B — Cloud Spanner
Spanner is the globally distributed relational database with strong consistency and horizontal scale. Cloud SQL is regional managed MySQL/PostgreSQL/SQL Server, Firestore is a document database, and BigQuery is an analytics warehouse, not a transactional store.
Cloud Spanner overviewYou must give a Compute Engine instance in a private subnet outbound internet access for updates, with no external IP address. What should you configure?
- ACloud NAT on the subnet's region✓
- BAn external IP address on the instance
- CA firewall rule allowing egress to 0.0.0.0/0
- DPrivate Google Access only
Correct answer: A — Cloud NAT on the subnet's region
Cloud NAT gives outbound-only internet access to instances without external IPs. A firewall rule alone does not provide a path to the internet, and Private Google Access covers Google APIs only, not general internet endpoints.
Cloud NAT overviewWhich two statements about Google Cloud billing are correct? (Select TWO.)
- AA project must be linked to a billing account to use paid resources.✓
- BBudgets can send alerts when spend passes a threshold, and can trigger Pub/Sub notifications.✓
- CA billing account can only be linked to one project.
- DDeleting a project immediately refunds all charges.
- EBilling data cannot be exported for analysis.
Correct answer: A, B — A project must be linked to a billing account to use paid resources. · Budgets can send alerts when spend passes a threshold, and can trigger Pub/Sub notifications.
Paid resources need a linked billing account, and budgets raise alerts and can publish to Pub/Sub for automated responses. One billing account can pay for many projects, and billing data can be exported to BigQuery for analysis.
Cloud Billing conceptsWhich tool does Google recommend for declaring and deploying infrastructure as code on Google Cloud?
- ATerraform (including Infrastructure Manager)✓
- Bgcloud scripts stored in Cloud Storage
- CCloud Shell history files
- DThe Google Cloud console only
Correct answer: A — Terraform (including Infrastructure Manager)
Google supports Terraform as the main IaC option, and Infrastructure Manager runs Terraform configurations as a managed service. Shell scripts and console clicks are imperative and drift over time.
Infrastructure ManagerReady to try it under exam conditions?
Reading answers is not the same as recalling them with a clock running. Take the same 12 questions as a timed mock exam — 25 minutes, no feedback until you submit, then a score broken down by exam domain so you know what to study.
Start the timed ACE test →