CertSafari

    Free Google Associate Cloud Engineer Sample Questions

    35 free sample questions from our bank of 344+, covering every exam domain, with answers and detailed explanations. Updated August 2026.

    Practice all 344 questions in quiz mode

    Domain 1: Setting up a cloud solution environment

    Subdomain 1.1: Setting up cloud projects and accounts

    1.You need to find all Cloud Storage buckets across your entire Google Cloud Organization that are publicly accessible. You want to do this programmatically and efficiently without writing custom scripts to iterate through every project. Which service should you use?

    1. A.Cloud Logging
    2. B.Cloud Asset Inventory
    3. C.Security Command Center
    4. D.Cloud Monitoring
    Show answer & explanation

    Correct answer: B — Cloud Asset Inventory

    • A. Cloud Logging is designed for storing, searching, and analyzing log data and events. While it tracks access events, it is not an inventory or policy analysis tool and cannot efficiently query the current state of all resources across an organization to find public buckets.
    • B. Cloud Asset Inventory is the correct choice because it provides organization-wide visibility into resources and IAM policies. It supports programmatic APIs such as searchAllResources and AnalyzeIamPolicy, which allow you to efficiently identify resources accessible to 'allUsers' or 'allAuthenticatedUsers' across all projects without iterating through them individually.
    • C. Security Command Center (SCC) provides security insights and posture management, and while it may flag public buckets as security findings, Cloud Asset Inventory is the fundamental service for performing programmatic, organization-wide inventory and IAM policy analysis.
    • D. Cloud Monitoring focuses on performance metrics, health checks, and uptime monitoring. It does not have the capability to audit IAM policies or enumerate the accessibility status of storage buckets.

    Subdomain 1.1: Setting up cloud projects and accounts

    2.What is the primary difference between an IAM policy and an Organization Policy in Google Cloud?

    1. A.IAM policies restrict *who* can take action, while Organization Policies restrict *what* actions can be taken on resources.
    2. B.IAM policies apply only to users, while Organization Policies apply only to service accounts.
    3. C.IAM policies are inherited top-down, while Organization Policies are inherited bottom-up.
    4. D.IAM policies are used for billing administration, while Organization Policies are used for network security.
    Show answer & explanation

    Correct answer: A — IAM policies restrict *who* can take action, while Organization Policies restrict *what* actions can be taken on resources.

    • A. Correct. IAM policies focus on identity management, defining 'who' (users, groups, service accounts) can perform specific actions by granting them roles. Organization Policies focus on resource governance, defining constraints on 'what' can be done with resources (e.g., restricting allowed locations or disabling external IP addresses), acting as guardrails for the entire organization.
    • B. Incorrect. IAM policies apply to all identities, including users, groups, domains, and service accounts. Organization Policies are applied at the resource hierarchy level (Organization, Folder, Project) and create constraints that apply to the resources themselves, regardless of the identity attempting the action.
    • C. Incorrect. Both IAM policies and Organization Policies follow the standard Google Cloud resource hierarchy inheritance model, which is top-down (from Organization to Folders to Projects to individual resources).
    • D. Incorrect. IAM is the primary mechanism for access control across all services, not just billing. Organization Policies are broad governance tools used to enforce compliance and security standards, not limited strictly to network security.

    Subdomain 1.1: Setting up cloud projects and accounts

    3.You are deploying a new application that uses the Cloud Vision API. During load testing, your application starts receiving HTTP 429 Too Many Requests errors. What is the most likely cause and solution?

    1. A.You have run out of billing credits; add a new credit card.
    2. B.You have exceeded the rate quota for the Cloud Vision API; request a quota increase or implement exponential backoff.
    3. C.The Cloud Vision API is down in your region; switch to a different region.
    4. D.Your service account lacks the roles/vision.user role; grant the role.
    Show answer & explanation

    Correct answer: B — You have exceeded the rate quota for the Cloud Vision API; request a quota increase or implement exponential backoff.

    • A. Incorrect. HTTP 429 specifically indicates rate-limiting, whereas billing exhaustion or payment issues typically result in HTTP 403 Forbidden errors or service suspension. Adding a credit card does not address request frequency limits.
    • B. Correct. HTTP 429 Too Many Requests is the standard status code indicating that the client has exceeded the API's rate quota. To resolve this, you can request a quota increase via the Google Cloud Console or implement client-side strategies such as exponential backoff, retrying requests, or batching to reduce request frequency.
    • C. Incorrect. A regional outage or service downtime would typically result in HTTP 500 Internal Server Error or HTTP 503 Service Unavailable. Additionally, Cloud Vision is a global service; 429 errors denote too many requests at the account/project level rather than regional unavailability.
    • D. Incorrect. Permission and authorization issues (missing IAM roles) result in HTTP 403 Forbidden or HTTP 401 Unauthorized errors. While granting the roles/vision.user role provides necessary access, it does not resolve throttling due to quota limits.

    Subdomain 1.2: Managing billing configuration

    4.Your data science team uses BigQuery heavily. You want to set up a budget of $500 specifically for BigQuery usage across all projects, without tracking Compute Engine or Cloud Storage costs in this budget. How should you configure this?

    1. A.Create a budget and apply a filter for the 'BigQuery' service.
    2. B.Create a separate billing account exclusively for BigQuery usage.
    3. C.Apply a 'bigquery' label to all datasets and filter the budget by that label.
    4. D.Set a custom quota limit of $500 in the BigQuery API settings.
    Show answer & explanation

    Correct answer: A — Create a budget and apply a filter for the 'BigQuery' service.

    • A. Correct. Cloud Billing budgets allow you to scope costs by specific services. By creating a budget and filtering specifically for the 'BigQuery' service, you can track spending for that service across all projects linked to the billing account while excluding costs from other services like Compute Engine or Cloud Storage.
    • B. Incorrect. Creating a separate billing account for a single service is unnecessary and introduces significant administrative overhead. Google Cloud's billing features provide granular visibility and filtering within a single account, making this approach inefficient.
    • C. Incorrect. While budgets can filter by labels, dataset-level labels are not consistently applied to all BigQuery-related costs for billing purposes. Filtering by the service itself is the native, reliable, and simpler method for tracking total BigQuery spend.
    • D. Incorrect. API quotas control resource consumption (such as the number of requests or volume of data processed) to prevent abuse or limit scale, but they do not control dollar spend. To monitor and alert on financial thresholds, you must use Billing budgets.

    Subdomain 1.2: Managing billing configuration

    5.The finance director wants to receive email alerts when the monthly cloud spend exceeds $10,000. However, company policy dictates that the finance director cannot be granted any IAM roles on the Cloud Billing account. How can you send them the alerts?

    1. A.Create a Cloud Monitoring email notification channel with their email address and link it to the budget.
    2. B.Add their email address as a Project Owner on the project with the highest spend.
    3. C.Set up an auto-forwarding rule in the email inbox of an existing Billing Account Admin.
    4. D.It is not possible; budget alert emails can only be sent to Billing Account Admins and Users.
    Show answer & explanation

    Correct answer: A — Create a Cloud Monitoring email notification channel with their email address and link it to the budget.

    • A. Correct. Cloud Billing budgets allow you to link Cloud Monitoring notification channels (such as email, SMS, or Slack). This feature enables you to send alerts to any specified recipient without requiring them to have IAM roles or permissions on the Billing account.
    • B. Incorrect. Adding the user as a Project Owner grants excessive project-level permissions and does not inherently trigger budget alerts for the Billing account. This also violates the principle of least privilege.
    • C. Incorrect. While technically possible within an external email system, this is a manual, unreliable workaround. It is not a native GCP configuration and does not align with best practices for automated infrastructure monitoring.
    • D. Incorrect. While default budget notifications are sent to Billing Account Admins and Users, the integration with Cloud Monitoring notification channels provides the flexibility to notify arbitrary email addresses and third-party services.

    Subdomain 1.2: Managing billing configuration

    6.You want to prevent developers from creating any new billable resources in a specific sandbox project, but you do not want to delete the project or remove their IAM access. What is the simplest way to achieve this?

    1. A.Disable billing on the sandbox project.
    2. B.Remove the Project Viewer role from all developers.
    3. C.Set a Cloud Billing budget for the project to $0.
    4. D.Delete the default VPC network in the project.
    Show answer & explanation

    Correct answer: A — Disable billing on the sandbox project.

    • A. Disabling billing on the sandbox project is the most direct and simplest method to prevent the creation of new billable resources. Most Google Cloud services require an active billing account to be linked to the project for resource provisioning. This approach does not affect the existing IAM permissions or delete the project metadata.
    • B. Removing the Project Viewer role is ineffective because it is a read-only role. To prevent resource creation, one would need to remove roles like Editor or Owner. Furthermore, the requirement states that IAM access should not be removed.
    • C. Cloud Billing budgets are monitoring and alerting tools. They trigger notifications when spending reaches certain thresholds but do not automatically stop resource creation or disable services unless complex custom automation (like Cloud Functions triggered by Pub/Sub) is implemented.
    • D. Deleting the default VPC only prevents the creation of resources that require that specific network. It does not stop developers from creating other billable resources (like Cloud Storage buckets) or from simply creating a new VPC to house new resources.

    Domain 2: Planning and implementing a cloud solution

    Subdomain 2.1: Planning and implementing compute resources

    7.Which command is used to configure the kubectl command-line tool to connect to a specific Google Kubernetes Engine (GKE) cluster?

    1. A.gcloud compute instances get-credentials
    2. B.gcloud container clusters get-credentials
    3. C.kubectl config set-cluster
    4. D.gcloud auth login
    Show answer & explanation

    Correct answer: B — gcloud container clusters get-credentials

    • A. Incorrect. The gcloud compute group is used for managing Compute Engine VM instances. There is no standard 'get-credentials' subcommand under gcloud compute instances intended for configuring kubectl.
    • B. Correct. The command 'gcloud container clusters get-credentials <cluster-name>' retrieves the cluster's endpoint and authentication data from GKE and updates the local kubeconfig file, allowing kubectl to communicate with the specified cluster.
    • C. Incorrect. While 'kubectl config set-cluster' can be used to manually define cluster entries in a kubeconfig file, it does not automatically fetch the GKE-specific endpoint or authentication certificates required to connect to a managed Google Kubernetes Engine cluster.
    • D. Incorrect. 'gcloud auth login' authenticates your local gcloud CLI session with Google Cloud, but it does not populate the kubeconfig file with the cluster-specific endpoint and credentials required by kubectl.

    Subdomain 2.1: Planning and implementing compute resources

    8.What are the key characteristics of Spot VMs in Google Cloud?(Select 3)

    1. A.They are significantly cheaper than standard VMs.
    2. B.They provide a guaranteed minimum uptime of 24 hours.
    3. C.Compute Engine can reclaim them with a 30-second warning.
    4. D.They are ideal for fault-tolerant, batch workloads.
    5. E.They automatically live migrate during host maintenance.
    6. F.They require the use of a custom machine type.
    Show answer & explanation

    Correct answers: A, C, D — They are significantly cheaper than standard VMs.; Compute Engine can reclaim them with a 30-second warning.; They are ideal for fault-tolerant, batch workloads.

    • A. Correct. Spot VMs are offered at steep discounts (often 60-91% cheaper) compared to regular on-demand VMs because they utilize excess Compute Engine capacity.
    • B. Incorrect. Spot VMs do not provide any guaranteed minimum uptime. While the older Preemptible VMs had a 24-hour maximum runtime limit, Spot VMs have no such limit but still offer no availability guarantees.
    • C. Correct. Compute Engine provides a 30-second termination notice via the metadata server before reclaiming a Spot VM, allowing the application to perform shutdown scripts or checkpointing.
    • D. Correct. Because they can be interrupted at any time, Spot VMs are ideal for workloads that are stateless, fault-tolerant, or batch-oriented, such as data processing and CI/CD pipelines.
    • E. Incorrect. Spot VMs cannot live migrate to other hosts during maintenance events. Instead, they are terminated (preempted) when the host needs maintenance or resources are required elsewhere.
    • F. Incorrect. Spot VMs can use any machine type, including predefined shared-core types, standard types, and custom machine types.

    Subdomain 2.1: Planning and implementing compute resources

    9.You want to grant a new developer SSH access to a specific Compute Engine VM using OS Login. Which two steps must you perform?(Select 2)

    1. A.Add their SSH key to the project metadata.
    2. B.Ensure 'enable-oslogin=TRUE' is set in the project or instance metadata.
    3. C.Grant the developer the 'roles/compute.osLogin' IAM role.
    4. D.Grant the developer the 'roles/compute.networkAdmin' IAM role.
    5. E.Create a local Linux user account on the VM for the developer.
    Show answer & explanation

    Correct answers: B, C — Ensure 'enable-oslogin=TRUE' is set in the project or instance metadata.; Grant the developer the 'roles/compute.osLogin' IAM role.

    • A. Incorrect. Adding SSH keys to project metadata is the legacy method of managing access. When OS Login is enabled, VM/project metadata SSH keys are ignored for accounts managed by OS Login.
    • B. Correct. Enabling OS Login by setting the 'enable-oslogin=TRUE' metadata value at the project or instance level is a mandatory step to activate the feature on Compute Engine instances.
    • C. Correct. To use OS Login, users must be granted either the 'roles/compute.osLogin' (standard user access) or 'roles/compute.osAdminLogin' (administrator/sudo access) IAM role.
    • D. Incorrect. The 'roles/compute.networkAdmin' role grants permissions to manage VPC networks and firewall rules, but it does not provide access to log into VM instances via SSH.
    • E. Incorrect. One of the primary benefits of OS Login is that it automatically provisions and manages Linux user accounts based on the user's IAM identity, removing the need for manual account creation.

    Subdomain 2.4: Planning and implementing resources through infrastructure as code

    10.A CI/CD pipeline failed unexpectedly during a `terraform apply` operation. When you try to run Terraform locally, you receive an error stating that the state is locked. You have verified that no other pipelines or users are currently running Terraform. How should you resolve this?

    1. A.Delete the terraform.tfstate file from the remote backend.
    2. B.Run terraform force-unlock with the lock ID provided in the error message.
    3. C.Run terraform state rm to clear the locked resources.
    4. D.Run terraform untaint on the entire configuration.
    Show answer & explanation

    Correct answer: B — Run terraform force-unlock with the lock ID provided in the error message.

    • A. Deleting the terraform.tfstate file is a destructive action that removes Terraform's record of managed resources. This causes resource drift and would force Terraform to attempt to recreate existing resources, potentially causing major infrastructure issues. It does not safely address the locking mechanism.
    • B. The terraform force-unlock command is the standard procedure for manually releasing a state lock when a process (like a CI/CD pipeline) crashes before it can release the lock. Since you have verified no other processes are running, providing the unique Lock ID to this command will safely clear the lock.
    • C. The terraform state rm command is used to remove specific resources from the state file so that Terraform stops managing them. It does not interact with backend locking mechanisms and would lead to orphaned resources.
    • D. The terraform untaint command (replaced by terraform apply -replace in newer versions) is used to remove a 'tainted' flag from a resource that was marked for recreation. It has no effect on the state lock held by the remote backend.

    Subdomain 2.4: Planning and implementing resources through infrastructure as code

    11.Your organization wants to implement a GitOps workflow where developers can provision Google Cloud resources (like Cloud SQL and Pub/Sub) by committing YAML manifests to a Git repository. The cluster should automatically sync these manifests and create the GCP resources. Which two tools combined fulfill this requirement?(Select 2)

    1. A.Config Connector
    2. B.Anthos Config Management (Config Sync)
    3. C.Terraform CLI
    4. D.Google Cloud Deployment Manager
    5. E.Helm
    Show answer & explanation

    Correct answers: A, B — Config Connector; Anthos Config Management (Config Sync)

    • A. Config Connector is a Kubernetes add-on that allows you to manage Google Cloud resources using Kubernetes Custom Resource Definitions (CRDs). It provides the logic required for a Kubernetes cluster to provision and manage infrastructure like Cloud SQL or Pub/Sub based on YAML manifests applied to the cluster.
    • B. Anthos Config Management (specifically the Config Sync component) provides the GitOps control loop. It continuously monitors a Git repository for changes to YAML manifests and automatically synchronizes those manifests to the Kubernetes cluster. When combined with Config Connector, it enables the full Git-to-GCP resource workflow.
    • C. While Terraform CLI is a standard tool for infrastructure as code, it is typically executed via a CI/CD pipeline or manually. It does not natively provide an in-cluster reconciliation loop that automatically syncs manifests from a Git repository to maintain state in the GitOps fashion described.
    • D. Google Cloud Deployment Manager is a declarative infrastructure management tool, but it does not integrate as an in-cluster GitOps controller. It lacks the automatic synchronization mechanism between a Git repository and a Kubernetes cluster.
    • E. Helm is a package manager for Kubernetes. While it can be used to deploy applications and could theoretically package Config Connector resources, it does not provide the continuous synchronization and reconciliation required for a GitOps workflow.

    Subdomain 2.4: Planning and implementing resources through infrastructure as code

    12.You manage a Cloud Storage bucket using Config Connector in your GKE cluster. A developer accidentally deletes the bucket directly via the Google Cloud Console. Assuming the Kubernetes manifest for the bucket is still present and applied in the cluster, what will Config Connector do?

    1. A.It will do nothing, as Config Connector only creates resources once.
    2. B.It will recreate the bucket to match the desired state defined in the Kubernetes manifest.
    3. C.It will automatically delete the Kubernetes manifest to match the real-world state.
    4. D.It will send an email alert to the cluster administrator but take no corrective action.
    Show answer & explanation

    Correct answer: B — It will recreate the bucket to match the desired state defined in the Kubernetes manifest.

    • A. Incorrect. Config Connector is not a one-time provisioning tool. It operates as a Kubernetes controller that runs a continuous reconciliation loop to ensure the real-world resources match the declared manifests in the cluster.
    • B. Correct. Config Connector ensures that the actual state of Google Cloud resources matches the desired state defined in Kubernetes manifests. If a managed resource like a Cloud Storage bucket is deleted out-of-band (via the Console or CLI), the reconciliation loop will detect the drift and recreate the resource to restore the desired state.
    • C. Incorrect. Config Connector uses the Kubernetes manifest as the source of truth. It reconciles the cloud environment to match the manifest; it does not modify or delete the manifest to reflect manual changes made in the Google Cloud Console.
    • D. Incorrect. While Config Connector will record events and update the 'status' field of the Kubernetes resource for administrators to inspect, its primary purpose is to take active corrective action. It does not send email alerts by default.

    Subdomain 2.2: Planning and implementing storage and data solutions

    13.You need to process a continuous stream of user activity logs from Pub/Sub, aggregate the data into 5-minute windows, and write the results to BigQuery. You want a serverless solution that can handle both stream and batch processing using Apache Beam. Which service should you deploy?

    1. A.Dataproc
    2. B.Dataflow
    3. C.Cloud Run
    4. D.Cloud Functions
    Show answer & explanation

    Correct answer: B — Dataflow

    • A. Dataproc is a managed service for running Hadoop and Spark clusters. While it can handle big data workloads and now offers a serverless mode, it is not the native or primary runner for Apache Beam pipelines, and it typically requires more configuration for streaming windowing compared to Dataflow.
    • B. Dataflow is the correct choice because it is a fully managed, serverless service specifically designed to execute Apache Beam pipelines. It provides built-in support for both batch and streaming processing, handles autoscaling of resources, and manages complex event-time semantics such as the 5-minute windowing required for this scenario, along with native connectors for Pub/Sub and BigQuery.
    • C. Cloud Run is a serverless platform for running containerized applications, typically used for stateless HTTP-driven microservices. It does not provide the specialized framework or native Apache Beam integration needed to manage windowed stream processing and event-time watermarks.
    • D. Cloud Functions are event-driven, lightweight serverless functions. They are not suitable for high-volume streaming data processing that requires complex windowing or stateful aggregations (like 5-minute windows), nor do they serve as an Apache Beam runner.

    Subdomain 2.2: Planning and implementing storage and data solutions

    14.You have a local directory containing thousands of small configuration files that you need to upload to a Cloud Storage bucket. You want to perform this upload from your local terminal using parallel composite uploads to maximize speed. Which command should you use?

    1. A.gcloud compute scp
    2. B.bq load
    3. C.gcloud storage cp -r
    4. D.gsutil mv
    Show answer & explanation

    Correct answer: C — gcloud storage cp -r

    • A. gcloud compute scp is used to securely copy files between a local machine and a Google Compute Engine VM instance via SSH. It is not designed for direct uploads to Cloud Storage buckets.
    • B. bq load is a BigQuery command used specifically for loading data into BigQuery tables. It is not a general-purpose tool for uploading files to Cloud Storage.
    • C. gcloud storage cp -r is the recommended command for modern, high-performance transfers to Cloud Storage. The 'gcloud storage' component (the next-generation CLI) uses a faster implementation than the legacy 'gsutil' tool, automatically handling parallelism and optimizations like composite uploads to maximize throughput for large volumes of files.
    • D. gsutil mv is used to move files (copying them and then deleting the source). While the legacy gsutil tool supports parallelism via the -m flag, the option provided lacks the flag. Furthermore, gcloud storage is now preferred over gsutil for performance-critical uploads.

    Subdomain 2.2: Planning and implementing storage and data solutions

    15.Which TWO Google Cloud database services provide fully managed, relational database capabilities with support for SQL queries and ACID transactions?(Select 2)

    1. A.Cloud Spanner
    2. B.Cloud Bigtable
    3. C.Firestore
    4. D.Cloud SQL
    5. E.Memorystore
    Show answer & explanation

    Correct answers: A, D — Cloud Spanner; Cloud SQL

    • A. Correct. Cloud Spanner is a fully managed, horizontally scalable relational database that provides strong consistency and full ACID transactions across rows and regions. It supports a SQL dialect (ANSI SQL) and is designed for global scale mission-critical transactional workloads.
    • B. Incorrect. Cloud Bigtable is a fully managed NoSQL wide-column store optimized for low-latency, high-throughput workloads and time-series data. It does not provide a relational SQL interface or multi-row ACID transactions.
    • C. Incorrect. Firestore is a NoSQL document database. While it supports ACID transactions at the document level, it is not a relational database and does not support standard SQL queries or relational joins.
    • D. Correct. Cloud SQL is a fully managed relational database service compatible with MySQL, PostgreSQL, and SQL Server. It provides standard SQL query capabilities, ACID transactions, and handles maintenance tasks like backups and replication.
    • E. Incorrect. Memorystore is an in-memory data store service for Redis and Memcached, primarily used for caching and session management. It is not a relational database and does not support SQL or ACID transactional guarantees for persistent data.

    Subdomain 2.3: Planning and implementing networking resources

    16.You need to create a VPC network for a new application. The application will be deployed in the `us-central1` and `europe-west1` regions. You want full control over the IP ranges used in each region to avoid conflicts with your on-premises network. What should you do?

    1. A.Create an auto mode VPC network.
    2. B.Create a custom mode VPC network and define subnets in the required regions.
    3. C.Create a default VPC network and delete the unused subnets.
    4. D.Create a Shared VPC and attach the regions as service projects.
    Show answer & explanation

    Correct answer: B — Create a custom mode VPC network and define subnets in the required regions.

    • A. Incorrect. An auto mode VPC network automatically creates subnets in every Google Cloud region using predefined /20 IP ranges. This lack of manual control over CIDR ranges makes it difficult to avoid IP address conflicts with existing on-premises infrastructure.
    • B. Correct. A custom mode VPC network allows you to manually define subnets in only the regions you require (such as us-central1 and europe-west1) and specify the exact CIDR ranges for each. This provides the necessary control to ensure there are no overlapping IP addresses with your on-premises network.
    • C. Incorrect. The default VPC is an auto-mode network with pre-created subnets and Google-assigned ranges. While you can delete unused subnets, it is not the standard or efficient way to manage custom IP ranges, and it doesn't provide the level of control required during the network creation phase.
    • D. Incorrect. Shared VPC is a feature used to share a VPC network from a host project with other service projects for centralized administration. It is an architecture for resource sharing, not a mechanism for defining regional IP allocation; the underlying network would still need to be a custom mode VPC to meet your requirements.

    Subdomain 2.3: Planning and implementing networking resources

    17.You are deploying a multi-tier application with web, application, and database tiers. You want to ensure that only the application tier instances can communicate with the database tier instances on port 5432. You want to use the most secure method recommended by Google Cloud that is not easily bypassed by users with instance admin rights. What should you use as the source and target in your firewall rule?

    1. A.Source: Web tier network tags; Target: Database tier network tags.
    2. B.Source: Application tier network tags; Target: Database tier network tags.
    3. C.Source: Application tier service account; Target: Database tier service account.
    4. D.Source: Application tier IP addresses; Target: Database tier IP addresses.
    Show answer & explanation

    Correct answer: C — Source: Application tier service account; Target: Database tier service account.

    • A. Incorrect. This configuration would allow the web tier (rather than the application tier) to access the database. Furthermore, network tags are less secure than service accounts because they can be easily modified by users with instance admin permissions.
    • B. Incorrect. While network tags can be used to filter traffic, they are not the most secure method. Users with instance admin rights (specifically the compute.instances.setTag permission) can modify tags on the fly, making this method easier to bypass than service account-based rules.
    • C. Correct. Google Cloud recommends using service accounts for firewall rules to provide stronger, identity-based security. Service accounts are more secure than network tags because changing an instance's service account requires the 'iam.serviceAccounts.actAs' permission and typically requires the instance to be stopped, making it much harder for a standard instance admin to bypass.
    • D. Incorrect. Using IP addresses for firewall rules is brittle and operationally difficult in cloud environments where instances are ephemeral and IPs can change. It does not provide the identity-based protection offered by service accounts.

    Subdomain 2.3: Planning and implementing networking resources

    18.You have two custom VPC networks, `vpc-a` and `vpc-b`, in the same Google Cloud project. You need instances in `vpc-a` to communicate with instances in `vpc-b` using internal IP addresses. You want to minimize latency and avoid routing traffic through the public internet. What is the most straightforward way to achieve this?

    1. A.Set up a Cloud VPN tunnel between `vpc-a` and `vpc-b`.
    2. B.Configure VPC Network Peering between `vpc-a` and `vpc-b`.
    3. C.Create a Shared VPC and attach both networks to it.
    4. D.Use Cloud Router to advertise the routes between the two networks.
    Show answer & explanation

    Correct answer: B — Configure VPC Network Peering between `vpc-a` and `vpc-b`.

    • A. Incorrect. While Cloud VPN can connect two VPCs, it is generally used for connecting VPCs to on-premises environments. VPN traffic introduces additional latency due to encryption/decryption and may traverse public internet endpoints, which does not meet the requirement for minimal latency compared to peering.
    • B. Correct. VPC Network Peering allows internal IP address connectivity across two VPC networks with the lowest possible latency. Traffic stays entirely within Google Cloud's internal network and does not traverse the public internet. It is the most straightforward way to connect independent VPCs in the same or different projects.
    • C. Incorrect. Shared VPC is a centralized networking model that allows multiple projects to share a single host VPC network. It is not a tool used to 'attach' or bridge two existing, independent VPC networks together.
    • D. Incorrect. Cloud Router is used to dynamically exchange routes via BGP, typically when using Cloud VPN or Cloud Interconnect. By itself, Cloud Router does not provide the underlying connectivity between two VPC networks.

    Domain 3: Ensuring successful operation of a cloud solution

    Subdomain 3.4: Monitoring and logging

    19.Your microservices-based application is experiencing high latency. You need to identify which specific service in the request chain is causing the delay. Which Google Cloud tool should you use?

    1. A.Cloud Profiler
    2. B.Cloud Trace
    3. C.Cloud Monitoring
    4. D.Cloud Logging
    Show answer & explanation

    Correct answer: B — Cloud Trace

    • A. Cloud Profiler is used for continuous profiling of CPU and memory usage to optimize application performance at the code level. It helps find performance hotspots within a specific service, but it is not designed to track request flow or latency across multiple microservices.
    • B. Cloud Trace is a distributed tracing system that collects latency data from your applications and displays it in the Google Cloud Console. It provides a detailed breakdown (spans) of how much time each service in the request chain contributes to the overall latency, making it the ideal tool for identifying bottlenecks in microservices architectures.
    • C. Cloud Monitoring (formerly Stackdriver Monitoring) provides visibility into the performance, uptime, and overall health of your infrastructure and applications via metrics, dashboards, and alerts. While it can surface aggregate latency trends, it does not provide the per-request distributed tracing required to pinpoint a specific hop in a service chain.
    • D. Cloud Logging is used for storing, searching, and analyzing log data. While logs can be used for manual correlation and debugging individual services, they lack the built-in distributed trace visualization and timing data provided by Cloud Trace for identifying end-to-end request delays.

    Subdomain 3.4: Monitoring and logging

    20.You need to track every time a user downloads an object from a specific Cloud Storage bucket named `my-secure-data-bucket`. Which two steps are required to achieve this?(Select 2)

    1. A.Enable Data Access audit logs for the Cloud Storage API.
    2. B.Enable Admin Activity audit logs for the Cloud Storage API.
    3. C.Configure the audit log policy to track `ADMIN_READ` operations.
    4. D.Configure the audit log policy to track `DATA_READ` operations.
    5. E.Install the Ops Agent on the Cloud Storage bucket.
    Show answer & explanation

    Correct answers: A, D — Enable Data Access audit logs for the Cloud Storage API.; Configure the audit log policy to track `DATA_READ` operations.

    • A. Correct. Data Access audit logs record API calls that read or modify user-provided data, including object download operations (e.g., `storage.objects.get`). These logs are disabled by default for most services and must be explicitly enabled to capture data-level access events.
    • B. Incorrect. Admin Activity audit logs capture administrative operations such as creating or deleting buckets and are enabled by default. However, they do not record user data access like object downloads.
    • C. Incorrect. `ADMIN_READ` entries cover administrative metadata read operations (e.g., viewing bucket permissions), not the reading of the object data itself. Downloading an object is not an administrative read action.
    • D. Correct. `DATA_READ` audit log entries specifically record API calls that read user-provided data, such as downloading object contents. Configuring the audit log policy to include `DATA_READ` for the Cloud Storage API is required to track download activity.
    • E. Incorrect. The Ops Agent is used for monitoring and logging within virtual machine instances (Compute Engine). It cannot be installed on a Cloud Storage bucket, which is a fully managed serverless storage service.

    Subdomain 3.4: Monitoring and logging

    21.Google Cloud provides several diagnostic tools to help research application issues. Which of the following statements correctly describe these tools?(Select 3)

    1. A.Cloud Trace tracks how requests propagate through your application and identifies latency bottlenecks.
    2. B.Cloud Profiler continuously analyzes CPU and memory usage of production applications to identify resource-intensive code.
    3. C.Query Insights helps identify performance bottlenecks in Cloud Spanner and Cloud SQL databases.
    4. D.Cloud Trace automatically restarts failing Compute Engine instances.
    5. E.Cloud Profiler requires you to export logs to BigQuery before analysis.
    6. F.Query Insights is used to optimize BigQuery SQL queries.
    Show answer & explanation

    Correct answers: A, B, C — Cloud Trace tracks how requests propagate through your application and identifies latency bottlenecks.; Cloud Profiler continuously analyzes CPU and memory usage of production applications to identify resource-intensive code.; Query Insights helps identify performance bottlenecks in Cloud Spanner and Cloud SQL databases.

    • A. Correct. Cloud Trace is a distributed tracing system that collects latency data from applications and displays it as traces and spans. It tracks how requests propagate through your application, helping to identify latency bottlenecks across services and RPC calls.
    • B. Correct. Cloud Profiler is a statistical, low-overhead profiler that continuously analyzes CPU, heap, and contention profiles from production applications. This helps identify resource-intensive code paths to optimize performance and reduce costs.
    • C. Correct. Query Insights is a diagnostic tool specifically designed for managed databases like Cloud SQL and Cloud Spanner. it provides visibility into database performance by identifying slow queries and high-resource usage patterns.
    • D. Incorrect. Cloud Trace is an observability tool for latency analysis, not a management tool. Restarting failing Compute Engine instances is a function of Managed Instance Groups (MIGs) using health checks and auto-healing.
    • E. Incorrect. Cloud Profiler does not require exporting logs to BigQuery. It collects profiling data directly via an agent or library and provides its own visualization and analysis interface within the Google Cloud Console.
    • F. Incorrect. Query Insights is used for Cloud SQL and Cloud Spanner. BigQuery has its own built-in query execution details and analysis tools to help optimize SQL performance.

    Subdomain 3.1: Managing compute resources

    22.Which of the following `gcloud` commands is used to view a list of all currently running Compute Engine instances in your active project?

    1. A.gcloud compute instances list
    2. B.gcloud compute vms get
    3. C.gcloud compute instances describe
    4. D.gcloud compute list-instances
    Show answer & explanation

    Correct answer: A — gcloud compute instances list

    • A. Correct. `gcloud compute instances list` is the standard command to list all Compute Engine instances in the active project. It displays a summary table including critical details such as name, zone, machine type, status, and IP addresses.
    • B. Incorrect. This is not a valid `gcloud` command. In the Google Cloud SDK, Compute Engine resources are managed under the `instances` group rather than `vms`, and `get` is not a standard verb for listing resources.
    • C. Incorrect. `gcloud compute instances describe` is used to retrieve detailed metadata for a specific instance. It requires an instance name as an argument and cannot be used to list all instances in a project.
    • D. Incorrect. This option uses incorrect command syntax. The `gcloud` CLI generally follows the structure of `gcloud [service] [resource] [action]`. Therefore, the correct verb and resource order is `gcloud compute instances list`.

    Subdomain 3.1: Managing compute resources

    23.Your Cloud Run application experiences intermittent "cold starts" when traffic suddenly spikes after periods of inactivity, leading to high latency for the first few requests. You want to eliminate these cold starts while minimizing costs. What is the most appropriate configuration?

    1. A.Set the --max-instances flag to a higher number.
    2. B.Set the --min-instances flag to a value greater than 0.
    3. C.Increase the CPU and memory limits for the container.
    4. D.Change the execution environment to gen2.
    Show answer & explanation

    Correct answer: B — Set the --min-instances flag to a value greater than 0.

    • A. Setting the --max-instances flag increases the upper scaling limit to handle traffic peaks, but it does not prevent Cloud Run from scaling down to zero during idle periods. Thus, it has no impact on preventing cold starts.
    • B. Setting --min-instances to a value greater than 0 (such as 1) ensures that a specific number of container instances remain warm and ready to handle requests at all times. This effectively eliminates cold starts for the initial requests after a period of inactivity while minimizing costs by only keeping a small number of instances active.
    • C. While increasing CPU and memory might slightly reduce the initialization time of a container, it does not stop the service from scaling to zero. Consequently, the container must still be provisioned and started upon the first request, which is the root cause of high latency.
    • D. The Gen2 execution environment provides faster startup times and improved performance, but it does not change the default scale-to-zero behavior of Cloud Run. Without configuring minimum instances, cold starts will still occur when the service is idle.

    Subdomain 3.1: Managing compute resources

    24.You are configuring a GKE cluster in Project A to pull container images from an Artifact Registry repository located in Project B. Which TWO steps are required to ensure the GKE cluster can successfully pull the images?(Select 2)

    1. A.Identify the service account used by the GKE nodes in Project A.
    2. B.Grant the roles/artifactregistry.reader role to the GKE node service account on the Artifact Registry repository in Project B.
    3. C.Create a VPC Network Peering connection between Project A and Project B.
    4. D.Enable the Kubernetes Engine API in Project B.
    5. E.Grant the roles/container.developer role to the Compute Engine default service account in Project A.
    Show answer & explanation

    Correct answers: A, B — Identify the service account used by the GKE nodes in Project A.; Grant the roles/artifactregistry.reader role to the GKE node service account on the Artifact Registry repository in Project B.

    • A. Correct. To configure cross-project permissions, you must first identify the specific service account that the GKE nodes are using (either the Compute Engine default service account or a custom service account assigned to the node pool). This identity is what needs the permissions in Project B.
    • B. Correct. In order for GKE nodes in one project to access an Artifact Registry repository in another, the nodes' service account must be granted the 'Artifact Registry Reader' (roles/artifactregistry.reader) role. This permission must be granted on the repository or the project (Project B) where the images are stored.
    • C. Incorrect. VPC Network Peering is used for internal IP connectivity between VPC networks. Artifact Registry is accessed via Google's service APIs, which are typically reached over HTTPS; network peering is not a requirement for IAM-based repository access.
    • D. Incorrect. The Kubernetes Engine API needs to be enabled in the project where the GKE cluster resides (Project A). Project B only needs the Artifact Registry API enabled to host the repository.
    • E. Incorrect. The 'container.developer' role is used to manage GKE clusters (like creating deployments or viewing pods), but it does not provide the specific permissions required by the node infrastructure to pull images from Artifact Registry.

    Subdomain 3.2: Managing storage and data solutions

    25.You are running a complex SQL query in BigQuery that processes terabytes of data. You want to save the results of this query directly to a new table in a different dataset for further analysis by another team. How should you execute this query using the command-line interface?

    1. A.Run the query in the Cloud Console, export the results to a CSV, and upload it to the new table.
    2. B.Use the `bq query` command with the `--destination_table` flag.
    3. C.Use the `bq extract` command to move the query results.
    4. D.Create a materialized view in the source dataset using `gcloud bigquery views create`.
    Show answer & explanation

    Correct answer: B — Use the `bq query` command with the `--destination_table` flag.

    • A. Running queries in the Cloud Console and manually exporting to CSV is highly inefficient for terabytes of data and subject to browser and UI result size limits. It also introduces unnecessary intermediate steps such as downloading and re-uploading data, which is not suitable for large-scale operations.
    • B. The `bq query` command with the `--destination_table` flag is the correct and most efficient method for writing query results directly to a permanent table. This approach is highly scalable, handles large result sets automatically, and allows you to specify a destination table in any dataset or project where you have write permissions.
    • C. The `bq extract` command is specifically used for exporting existing BigQuery tables to external storage formats (like CSV, Parquet, or Avro) in Google Cloud Storage. It cannot be used to execute a SQL query and save its results to another BigQuery table.
    • D. Materialized views are used for performance optimization and caching within the same dataset. They are not intended for moving one-off query results to a different dataset for external team analysis. Furthermore, `bq` is the primary CLI tool for BigQuery operations, rather than `gcloud`.

    Subdomain 3.2: Managing storage and data solutions

    26.You manage a large fleet of Cloud SQL and AlloyDB instances spread across multiple Google Cloud projects. You need a centralized view to quickly identify which databases have missing backups or are exposed to the public internet. Which tool should you use?

    1. A.Security Command Center
    2. B.Database Center
    3. C.Cloud Monitoring Dashboards
    4. D.Network Intelligence Center
    Show answer & explanation

    Correct answer: B — Database Center

    • A. Security Command Center is primarily focused on general security posture and vulnerability management. While it can identify instances with public IPs as a security risk, it is not designed to provide a centralized inventory of database-specific management details like backup status across a large fleet of Cloud SQL and AlloyDB instances.
    • B. Database Center is specifically designed to provide a centralized management and monitoring view for database fleets (Cloud SQL and AlloyDB) across multiple projects. It surfaces configuration and compliance details, such as backup status and public internet exposure, allowing administrators to quickly identify and remediate health or security issues.
    • C. Cloud Monitoring Dashboards are used to visualize time-series metrics and logs. While they can be customized to show performance data, they do not natively provide a centralized, configuration-focused inventory view of database backup settings or network exposure across projects without extensive manual setup.
    • D. Network Intelligence Center provides insights into network topology, connectivity tests, and reachability. It is focused on networking infrastructure and performance rather than the management of database services or their specific backup configurations.

    Subdomain 3.3: Managing networking resources

    27.You have a custom mode VPC network named `my-vpc`. You need to deploy new Compute Engine instances in the `us-west1` region, but no subnet exists there yet. You need to create a subnet with the CIDR range `10.10.0.0/20` using the Google Cloud CLI. Which command should you use?

    1. A.gcloud compute networks create-subnet my-subnet --network=my-vpc --region=us-west1 --range=10.10.0.0/20
    2. B.gcloud compute networks subnets create my-subnet --network=my-vpc --region=us-west1 --range=10.10.0.0/20
    3. C.gcloud compute subnets create my-subnet --vpc=my-vpc --region=us-west1 --cidr=10.10.0.0/20
    4. D.gcloud compute networks subnets add my-subnet --network=my-vpc --region=us-west1 --addresses=10.10.0.0/20
    Show answer & explanation

    Correct answer: B — gcloud compute networks subnets create my-subnet --network=my-vpc --region=us-west1 --range=10.10.0.0/20

    • A. Incorrect. This command uses `create-subnet`, which is not a valid syntax for the gcloud compute CLI. Subnets are managed as a sub-resource under networks, requiring the command group `gcloud compute networks subnets create`.
    • B. Correct. The proper gcloud command to create a subnet in a custom-mode VPC is `gcloud compute networks subnets create [NAME]`. The flags `--network`, `--region`, and `--range` are the standard and required parameters to define the parent VPC, the location, and the CIDR block respectively.
    • C. Incorrect. This command uses the wrong flag names. In the Google Cloud CLI for subnet creation, `--network` is used instead of `--vpc`, and `--range` is used instead of `--cidr`.
    • D. Incorrect. The verb `add` is not used for creating new subnet resources; the correct subcommand is `create`. Furthermore, the `--addresses` flag is not used to specify a subnet's primary CIDR range; that is handled by the `--range` flag.

    Subdomain 3.3: Managing networking resources

    28.Your development team has exhausted the IP addresses in their subnet (10.0.0.0/24). You need to double the number of available IP addresses in this subnet without recreating any existing instances. What should you do?

    1. A.Run gcloud compute networks subnets expand-ip-range dev-subnet --region=us-central1 --prefix-length=23.
    2. B.Run gcloud compute networks subnets update dev-subnet --region=us-central1 --add-secondary-range=10.0.1.0/24.
    3. C.Run gcloud compute networks subnets expand-ip-range dev-subnet --region=us-central1 --prefix-length=25.
    4. D.Create a new subnet with a /23 range and migrate the instances.
    Show answer & explanation

    Correct answer: A — Run gcloud compute networks subnets expand-ip-range dev-subnet --region=us-central1 --prefix-length=23.

    • A. Correct. The `gcloud compute networks subnets expand-ip-range` command allows you to increase the IP range of an existing subnet without affecting existing instances. A /24 subnet has 256 addresses; changing the prefix length to /23 provides 512 addresses, effectively doubling the capacity.
    • B. Incorrect. Adding a secondary IP range is primarily used for Alias IP ranges, such as those used by GKE pods and services. It does not expand the primary range used for the primary internal IP addresses of VM instances.
    • C. Incorrect. In CIDR notation, a higher prefix number represents a smaller range. A /25 prefix would reduce the available addresses from 256 to 128, which is the opposite of the requirement. Furthermore, Google Cloud subnets can only be expanded, not shrunk.
    • D. Incorrect. Migrating instances to a new subnet is more disruptive and usually requires recreating the VM or its network interface. Expanding the existing subnet in-place is the recommended, non-disruptive way to increase capacity.

    Subdomain 3.3: Managing networking resources

    29.You have a Compute Engine instance running a legacy database that relies on a hardcoded internal IP address. The instance currently has an ephemeral internal IP. You need to ensure the IP address does not change if the instance is stopped and started. What should you do?

    1. A.Promote the ephemeral internal IP address to a static internal IP address.
    2. B.Create a new static internal IP address and restart the instance to attach it.
    3. C.Configure a Cloud NAT to map the ephemeral IP to a static IP.
    4. D.Add a network tag to the instance to lock the ephemeral IP address.
    Show answer & explanation

    Correct answer: A — Promote the ephemeral internal IP address to a static internal IP address.

    • A. Correct. Google Cloud allows you to promote an in-use ephemeral internal IP address to a static internal IP address. This ensures that the current address remains reserved for the instance even if it is stopped and started, which is necessary when applications have hardcoded dependencies on that specific IP.
    • B. Incorrect. Creating a 'new' static internal IP address would typically result in a different address being assigned to the resource, which would break the hardcoded configuration. Additionally, you cannot simply 'attach' a new primary internal IP to an existing network interface via a simple restart; it usually requires modifying the network interface configuration.
    • C. Incorrect. Cloud NAT is used to allow instances without external IP addresses to reach the internet for outbound traffic. It does not manage internal IP address assignment or persistence.
    • D. Incorrect. Network tags are metadata tags used to identify instances for firewall rules and routing purposes. They have no impact on the IP address assignment or its persistence.

    Domain 4: Configuring access and security

    Subdomain 4.1: Managing Identity and Access Management (IAM)

    30.You need to create a custom IAM role that combines specific permissions from Compute Engine and Cloud SQL. You have defined the role in a YAML file named 'custom-role.yaml'. Which command should you use to create this role at the project level?

    1. A.gcloud iam roles create [ROLE_ID] --project=[PROJECT_ID] --file=custom-role.yaml
    2. B.gcloud projects roles create [ROLE_ID] --file=custom-role.yaml
    3. C.gcloud iam custom-roles apply --project=[PROJECT_ID] --file=custom-role.yaml
    4. D.gcloud iam policies create [ROLE_ID] --project=[PROJECT_ID] --file=custom-role.yaml
    Show answer & explanation

    Correct answer: A — gcloud iam roles create [ROLE_ID] --project=[PROJECT_ID] --file=custom-role.yaml

    • A. Correct. This command uses the correct syntax for creating a custom IAM role. In the Google Cloud CLI, the 'gcloud iam roles create' command is the standard way to create custom roles at either the project or organization level. The '--project' flag scopes the role to the specific project, and the '--file' flag allows you to import the role configuration from a YAML or JSON file.
    • B. Incorrect. This command group ('gcloud projects roles') does not exist in the standard Google Cloud SDK. Custom roles are managed under the 'gcloud iam roles' command group.
    • C. Incorrect. This is not a valid gcloud command. Role creation uses the 'create' subcommand, and 'custom-roles apply' is not part of the IAM CLI hierarchy.
    • D. Incorrect. IAM policies are used to define bindings (who has what role), whereas IAM roles define the sets of permissions themselves. 'gcloud iam policies create' is not the correct command for defining a custom role.

    Subdomain 4.1: Managing Identity and Access Management (IAM)

    31.A developer reports they are getting a 'Permission Denied' error when trying to create a new Pub/Sub topic. You check their IAM roles and see they have 'roles/pubsub.subscriber' at the project level. Why are they unable to create the topic?

    1. A.The subscriber role only allows consuming messages from existing subscriptions, not creating topics.
    2. B.The subscriber role must be granted at the folder level to create topics.
    3. C.Pub/Sub topics can only be created by project Owners.
    4. D.The developer also needs the roles/pubsub.viewer role to create topics.
    Show answer & explanation

    Correct answer: A — The subscriber role only allows consuming messages from existing subscriptions, not creating topics.

    • A. Correct. The 'roles/pubsub.subscriber' role is specifically designed for consuming messages from existing subscriptions and does not include the 'pubsub.topics.create' permission. To create topics, a user needs a role like 'roles/pubsub.admin' or a primitive role like 'roles/editor'.
    • B. Incorrect. IAM roles define specific permissions regardless of where they are applied in the resource hierarchy. Granting a role at the folder level expands the scope of the role to all projects within that folder, but it does not add new permissions (like topic creation) to a role that doesn't already have them.
    • C. Incorrect. While project Owners have the permission to create Pub/Sub topics, they are not the only ones. The 'roles/pubsub.admin' role and the primitive 'roles/editor' role also grant the necessary permissions to create topics.
    • D. Incorrect. The 'roles/pubsub.viewer' role provides read-only access to Pub/Sub resources, allowing a user to list or view topics and subscriptions. It does not provide the 'pubsub.topics.create' permission needed to resolve the error.

    Subdomain 4.1: Managing Identity and Access Management (IAM)

    32.Which of the following are valid identity types that can be granted an IAM role in Google Cloud?(Select 3)

    1. A.Google Account
    2. B.Service Account
    3. C.API Key
    4. D.Google Group
    5. E.OAuth 2.0 Access Token
    6. F.SSH Key
    Show answer & explanation

    Correct answers: A, B, D — Google Account; Service Account; Google Group

    • A. A Google Account represents a developer, administrator, or any other person who interacts with Google Cloud. It is a valid IAM identity and can be granted roles using its associated email address (e.g., Gmail or Google Workspace account).
    • B. A Service Account is a machine identity intended for applications, services, and compute workloads. Unlike human accounts, they are used for automated processes and are first-class IAM identities that can be granted specific roles.
    • C. An API Key is a simple credential string used to authenticate requests to certain APIs for quota and billing purposes. It is not considered an identity (principal) and cannot be assigned IAM roles.
    • D. A Google Group is a collection of Google accounts and service accounts. Assigning a role to a group grants that role to all members of the group, providing a highly efficient way to manage permissions for multiple users at once.
    • E. An OAuth 2.0 Access Token is a temporary credential used to authorize a session. It is not a persistent identity that can be granted roles within an IAM policy.
    • F. SSH Keys are used for secure, OS-level access to Linux virtual machine instances. They are not IAM identities and do not map to the IAM system for resource permission management.

    Subdomain 4.2: Managing service accounts

    33.What is the standard email address format for the default Compute Engine service account?

    1. A.[PROJECT_ID]@developer.gserviceaccount.com
    2. B.[PROJECT_NUMBER]-compute@developer.gserviceaccount.com
    3. C.compute@[PROJECT_ID].iam.gserviceaccount.com
    4. D.[PROJECT_NUMBER]@cloudservices.gserviceaccount.com
    Show answer & explanation

    Correct answer: B — [PROJECT_NUMBER]-compute@developer.gserviceaccount.com

    • A. Incorrect. This format does not match the standard email address format for the default Compute Engine service account. The default account specifically requires the project number and the '-compute' suffix.
    • B. Correct. This is the standard email address format for the default Compute Engine service account, which is automatically created when the Compute Engine API is enabled. It uses the numeric project number followed by '-compute' and the domain 'developer.gserviceaccount.com'.
    • C. Incorrect. This is not a valid standard service account format for Compute Engine. While user-managed service accounts use the 'iam.gserviceaccount.com' domain, the default Compute Engine service account uses 'developer.gserviceaccount.com'.
    • D. Incorrect. This format ([PROJECT_NUMBER]@cloudservices.gserviceaccount.com) is used by the Google APIs Service Agent, which is a Google-managed service account used to perform internal tasks on your behalf, not the Compute Engine default service account.

    Subdomain 4.2: Managing service accounts

    34.Which IAM role is required for a user to generate short-lived credentials, such as OAuth access tokens or signed JWTs, for a service account?

    1. A.roles/iam.serviceAccountUser
    2. B.roles/iam.serviceAccountKeyAdmin
    3. C.roles/iam.serviceAccountTokenCreator
    4. D.roles/iam.securityAdmin
    Show answer & explanation

    Correct answer: C — roles/iam.serviceAccountTokenCreator

    • A. Incorrect. The roles/iam.serviceAccountUser role grants the iam.serviceAccounts.actAs permission, allowing a principal to attach a service account to a resource (like a VM). It does not grant permissions to mint OAuth tokens or sign JWTs directly.
    • B. Incorrect. The roles/iam.serviceAccountKeyAdmin role is used to create and manage long-lived service account keys (JSON/PKCS12 files). It does not provide the capability to generate short-lived credentials or perform cryptographic signing via the API.
    • C. Correct. The roles/iam.serviceAccountTokenCreator role provides the necessary permissions (such as iam.serviceAccounts.getAccessToken and iam.serviceAccounts.signJwt) to impersonate a service account and generate short-lived credentials like OAuth access tokens, ID tokens, and signed JWTs or blobs.
    • D. Incorrect. The roles/iam.securityAdmin role is a broad role for managing IAM policies and security configurations. While powerful, it does not specifically grant the permissions needed to mint short-lived tokens for a service account unless combined with other roles.

    Subdomain 4.2: Managing service accounts

    35.A service account `data-processor@project-a.iam.gserviceaccount.com` needs to query a BigQuery dataset located in `project-b`. How should you configure the IAM permissions?

    1. A.In `project-a`, grant the service account the BigQuery Data Viewer role.
    2. B.In `project-b`, grant the service account `data-processor@project-a.iam.gserviceaccount.com` the BigQuery Data Viewer role on the dataset and the BigQuery Job User role on the project.
    3. C.Create a new service account in `project-b` and link it to the service account in `project-a$.
    4. D.Enable VPC Service Controls to bridge `project-a` and `project-b`.
    Show answer & explanation

    Correct answer: B — In `project-b`, grant the service account `data-processor@project-a.iam.gserviceaccount.com` the BigQuery Data Viewer role on the dataset and the BigQuery Job User role on the project.

    • A. Incorrect. Granting roles in Project A only affects resources within that project. IAM permissions must be granted in the project where the resource (the BigQuery dataset) resides, which is Project B.
    • B. Correct. To query a dataset in BigQuery across projects, the service account needs two things in the destination project (Project B): the `roles/bigquery.dataViewer` role to read the data (which can be granted at the dataset or project level) and the `roles/bigquery.jobUser` role at the project level to authorize the compute resources needed to run the query job.
    • C. Incorrect. Creating a secondary service account and attempting to 'link' them is not a standard IAM practice for cross-project access. You can simply add the email address of the service account from Project A directly to the IAM policy of Project B.
    • D. Incorrect. VPC Service Controls are designed to create security perimeters to mitigate data exfiltration risks. They do not replace or grant the IAM permissions required for a service account to access a dataset.

    Want the full experience?

    These are just samples. Practice the full Google Associate Cloud Engineer question bank in quiz mode — free, no signup, with domain practice and exam simulation.

    Practice all 344 questions in quiz mode