Google Cloud Associate Cloud Engineer — Practice Questions flashcards

6 of 60 questions free to study here · 4 topics · the whole deck is built into Willys

Multiple-choice practice questions, one best answer each, on projects and billing, gcloud, choosing compute and storage, VPC networking, GKE, Cloud Run, operations and IAM.

Get the app All Google Cloud Associate Cloud Engineer decks

Practice deck · part of Google Cloud Associate Cloud Engineer · written against: Associate Cloud Engineer exam guide (current). Updated 2026-10-10.

Study the free sample

6 questions from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.

The 6 sample questions as a list

A startup created several projects with personal Gmail accounts. It now wants an Organization resource so it can manage all projects centrally under its company domain. What must it set up first?

A) A top-level folder for each team in the console
B) A Shared VPC host project for the whole company
C) A billing account linked to every one of the existing projects
D) A Cloud Identity or Google Workspace account for the domain

D) A Cloud Identity or Google Workspace account for the domain

The Organization resource is tied to a Google Workspace or Cloud Identity account for the company's domain, so that identity comes first. Folders and billing links are organised under the Organization once it exists, not before.
Setting Up the Environment › Resource Hierarchy
The Owner role is granted at the organization level. In one sensitive project, the security team must make sure nobody can delete a specific kind of resource, whatever roles they inherit. Which feature should they use?

A) A Viewer binding on the project for everyone
B) A narrower custom role granted on the project
C) An IAM condition on the project-level binding
D) An IAM deny policy for that permission

D) An IAM deny policy for that permission

Deny policies are checked before allow policies and override them, so they can block a permission that is granted higher up. Adding a narrower binding at the project does not help, because allow policies are a union and a lower level cannot remove inherited access.
Setting Up the Environment › Resource Hierarchy
A legacy application needs a specific Linux distribution, custom kernel settings and software installed by hand. Which compute option fits?

A) App Engine standard environment
B) GKE Autopilot clusters
C) Compute Engine virtual machines
D) Cloud Run services

C) Compute Engine virtual machines

Compute Engine is IaaS, giving full control of the operating system and kernel. The managed platforms run your code or containers on infrastructure you do not configure at that level.
Planning and Implementing › Choosing Compute
Each time an image is uploaded to a Cloud Storage bucket, a short piece of code should create a thumbnail. The team wants the least operations work. Which option fits best?

A) A Cloud Run function triggered by the Cloud Storage event
B) A Compute Engine VM that polls the bucket for new images every minute
C) A GKE Deployment that watches the bucket for changes
D) An App Engine flexible app that lists new objects

A) A Cloud Run function triggered by the Cloud Storage event

Cloud Run functions (formerly Cloud Functions) run small pieces of code in response to events such as a new object in a bucket, with no servers to manage. A polling VM would work but runs and costs money even when nothing is uploaded.
Planning and Implementing › Choosing Compute
Persistent Disks on a fleet of VMs must be backed up every night, with backups older than two weeks removed automatically. What is the best approach?

A) Attach a snapshot schedule to the disks
B) Run a cron job that calls gcloud on each VM
C) Add a lifecycle rule to the snapshot bucket
D) Create a weekly machine image of every VM

A) Attach a snapshot schedule to the disks

A snapshot schedule is a resource policy with a frequency and a retention period, so snapshots are taken and cleaned up automatically. A cron job calling gcloud compute disks snapshot would need its own scripting for clean-up and fails silently if the VM is down.
Operations › Snapshots and Images
A team that only manages Compute Engine instances currently holds the Editor role on a production project. An audit asks for least privilege. What should be done?

A) Keep Editor but grant it only through a Google group
B) Keep Editor and add the Viewer role to the team as well
C) Replace Editor with a predefined Compute Engine role
D) Replace Editor with the Owner role for the team lead

C) Replace Editor with a predefined Compute Engine role

Basic roles such as Editor carry thousands of permissions across services, while predefined roles cover one service. Granting through a group is good practice for managing members, but the group would still hold far too many permissions.
Access and Security › IAM Roles

Unlock the whole deck

You are studying a free 6-question sample. All 60 questions of Google Cloud Associate Cloud Engineer — Practice Questions, the other 2 Google Cloud Associate Cloud Engineer decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.

Get the app

In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.

More Google Cloud Associate Cloud Engineer decks

Setup and Planning Deploying and Operating

← All Google Cloud Associate Cloud Engineer decks, with the study guide and topic outline.

About these cards

Review status: Second-reader reviewed, with corrections applied.

Checked against:

Checked against the Google Cloud Associate Cloud Engineer exam guide, setting up the environment, planning and implementing, operations and access sections — topic outline only; no text copied.
Checked against Google Cloud documentation for the resource hierarchy, Cloud Billing, the Google Cloud CLI, Compute Engine, GKE, Cloud Run, Cloud Storage, the database products, VPC, Cloud Load Balancing, Cloud VPN, Cloud NAT, Infrastructure Manager, Cloud Monitoring, Cloud Logging and IAM (reference only; no sentences reproduced).

These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.

Google Cloud is a trademark of Google LLC. This product is not affiliated with, sponsored by, or endorsed by Google.

Use of these pages is covered by our Terms of Use.