100% Free Google Cloud Certified Associate-Cloud-Engineer Dumps PDF Demo Cert Guide Cover [Q196-Q213]

admin -

September 17, 2025

5/5 - (1 vote)

100% Free Google Cloud Certified Associate-Cloud-Engineer Dumps PDF Demo Cert Guide Cover

PDF Exam Material 2025 Realistic Associate-Cloud-Engineer Dumps Questions

Google Associate-Cloud-Engineer (Google Associate Cloud Engineer) Certification Exam is designed for individuals who want to demonstrate their understanding of Google Cloud Platform (GCP) and their ability to deploy, manage, and operate applications on GCP. Google Associate Cloud Engineer Exam certification is ideal for IT professionals who are responsible for managing and deploying applications on cloud platforms. Associate-Cloud-Engineer exam tests your knowledge of GCP services, networking, security, and application deployment.

Q196. You need a dynamic way of provisioning VMs on Compute Engine. The exact specifications will be in a dedicated configuration file. You want to follow Google’s recommended practices. Which method should you use?

Deployment Manager

Cloud Composer

Managed Instance Group

Unmanaged Instance Group

Explanation
https://cloud.google.com/deployment-manager/docs/configuration/create-basic-configuration

Q197. You are performing a monthly security check of your Google Cloud environment and want to know who has access to view data stored in your Google Cloud Project. What should you do?

Enable Audit Logs for all APIs that are related to data storage.

Review the IAM permissions for any role that allows for data access. Most Voted

Review the Identity-Aware Proxy settings for each resource.

Create a Data Loss Prevention job.

https://cloud.google.com/logging/docs/audit

Q198. You need to configure IAM access audit logging in BigQuery for external auditors. You want to follow Google-recommended practices. What should you do?

Add the auditors group to the `logging.viewer’ and `bigQuery.dataViewer’ predefined IAM roles.

Add the auditors group to two new custom IAM roles.

Add the auditor user accounts to the `logging.viewer’ and `bigQuery.dataViewer’ predefined IAM roles.

Add the auditor user accounts to two new custom IAM roles.

As per google best practices it is recommended to use predefined roles and create groups to control access to multiple users with same responsibility
https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations#groups-and- service-accounts .

Q199. You have a Linux server running on a custom network. There’s an allow firewall rule with an IP filter of 0.0.0.0/0 with a protocol/port of tcp:22. The logs on the instance show a constant stream of attempts from different IP addresses, trying to connect via SSH. You suspect this is a brute force attack.
How might you change the firewall rule to stop this from happening and still enable access for legit users?

Stop the instance.

Deny all traffic to port 22.

Change the port that SSH is running on in the instance and change the port number in the firewall rule.

Change the IP address range in the filter to only allow known IP addresses.

Q200. Your company has an existing GCP organization with hundreds of projects and a billing account. Your company recently acquired another company that also has hundreds of projects and its own billing account.
You would like to consolidate all GCP costs of both GCP organizations onto a single invoice. You would like to consolidate all costs as of tomorrow. What should you do?

Link the acquired company’s projects to your company’s billing account.

Configure the acquired company’s billing account and your company’s billing account to export the billing data into the same BigQuery dataset.

Migrate the acquired company’s projects into your company’s GCP organization. Link the migrated projects to your company’s billing account.

Create a new GCP organization and a new billing account. Migrate the acquired company’s projects and your company’s projects into the new GCP organization and link the projects to the new billing account.

Explanation/Reference: https://cloud.google.com/resource-manager/docs/migrating-projects-billing

Q201. You created a Kubernetes deployment by running kubectl run nginx image=nginx replicas=1. After a few days, you decided you no longer want this deployment. You identified the pod and deleted it by running kubectl delete pod. You noticed the pod got recreated.
* $ kubectlgetpods
* NAME READY STATUS RESTARTS AGE
* nginx-84748895c4-nqqmt 1/1 Running 0 9m41s
* $ kubectldeletepod nginx-84748895c4-nqqmt
* pod nginx-84748895c4-nqqmt deleted
* $ kubectlgetpods
* NAME READY STATUS RESTARTS AGE
* nginx-84748895c4-k6bzl 1/1 Running 0 25s
What should you do to delete the deployment and avoid pod getting recreated?

kubectl delete deployment nginx

kubectl delete -deployment=nginx

kubectl delete pod nginx-84748895c4-k6bzl -no-restart 2

kubectl delete inginx

This command correctly deletes the deployment. Pods are managed by kubernetes workloads (deployments).
When a pod is deleted, the deployment detects the pod is unavailable and brings up another pod to maintain the replica count. The only way to delete the workload is by deleting the deployment itself using the kubectl delete deployment command.
* $ kubectldeletedeployment nginx
* deployment.apps nginx deleted
Ref: https://kubernetes.io/docs/reference/kubectl/cheatsheet/#deleting-resources

Q202. You are running an application on multiple virtual machines within a managed instance group and have autoscaling enabled. The autoscaling policy is configured so that additional instances are added to the group if the CPU utilization of instances goes above 80%. VMs are added until the instance group reaches its maximum limit of five VMs or until CPU utilization of instances lowers to 80%. The initial delay for HTTP health checks against the instances is set to 30 seconds. The virtual machine instances take around three minutes to become available for users. You observe that when the instance group autoscales, it adds more instances then necessary to support the levels of end-user traffic. You want to properly maintain instance group sizes when autoscaling. What should you do?

Set the maximum number of instances to 1.

Decrease the maximum number of instances to 3.

Use a TCP health check instead of an HTTP health check.

Increase the initial delay of the HTTP health check to 200 seconds.

The reason is that when you do health check, you want the VM to be working. Do the first check after initial setup time of 3 mins = 180 s < 200 s is reasonable.
The reason why our autoscaling is adding more instances than needed is that it checks 30 seconds after launching the instance and at this point, the instance isnt up and isnt ready to serve traffic. So our autoscaling policy starts another instance again checks this after 30 seconds and the cycle repeats until it gets to the maximum instances or the instances launched earlier are healthy and start processing traffic which happens after 180 seconds (3 minutes). This can be easily rectified by adjusting the initial delay to be higher than the time it takes for the instance to become available for processing traffic.So setting this to 200 ensures that it waits until the instance is up (around 180-second mark) and then starts forwarding traffic to this instance.
Even after a cool out period, if the CPU utilization is still high, the autoscaler can again scale up but this scale- up is genuine and is based on the actual load.
Initial Delay Seconds This setting delays autohealing from potentially prematurely recreating the instance if the instance is in the process of starting up. The initial delay timer starts when the currentAction of the instance is VERIFYING.
Ref: https://cloud.google.com/compute/docs/instance-groups/autohealing-instances-in-migs

Q203. You are planning to migrate the following on-premises data management solutions to Google Cloud:
* One MySQL cluster for your main database
* Apache Kafka for your event streaming platform
* One Cloud SQL for PostgreSQL database for your analytical and reporting needs You want to implement Google-recommended solutions for the migration. You need to ensure that the new solutions provide global scalability and require minimal operational and infrastructure management. What should you do?

Migrate from MySQL to Cloud SQL, from Kafka to Pub/Sub, and from Cloud SQL for PostgreSQL to BigQuery.

Migrate from MySQL to Cloud Spanner, from Kafka to Pub/Sub, and from Cloud SQL for PostgreSQL to BigQuery.

Migrate from MySQL to Cloud Spanner, from Kafka to Memorystore, and from Cloud SQL for PostgreSQL to Cloud SQL.

Migrate from MySQL to Cloud SQL, from Kafka to Memorystore, and from Cloud SQL for PostgreSQL to Cloud SQL.

Cloud Spanner, Pub/Sub, and BigQuery are Google-recommended solutions for migrating your on-premises data management solutions to Google Cloud. They provide global scalability and require minimal operational and infrastructure management. Here is why:
Cloud Spanner is a fully managed, relational database service that offers strong consistency, high availability, and horizontal scalability across regions and continents. It is compatible with MySQL and can handle high-throughput OLTP workloads. It is a good choice for migrating your main database from MySQL to Google Cloud, as it can support your application’s performance, availability, and growth requirements.
Pub/Sub is a fully managed, real-time messaging service that allows you to send and receive messages between independent applications. It is compatible with Apache Kafka and can handle high-volume event streaming and data ingestion. It is a good choice for migrating your event streaming platform from Kafka to Google Cloud, as it can support your application’s reliability, scalability, and flexibility requirements.
BigQuery is a fully managed, serverless data warehouse that offers fast SQL queries, high scalability, and low cost. It is compatible with Cloud SQL for PostgreSQL and can handle complex analytical and reporting needs. It is a good choice for migrating your analytical and reporting database from Cloud SQL for PostgreSQL to Google Cloud, as it can support your application’s speed, efficiency, and innovation requirements.
The other options are not correct because they either do not provide the required scalability, performance, or functionality. Option A is not correct because Cloud SQL is a regional, managed database service that does not offer the same level of scalability, availability, and consistency as Cloud Spanner. Option C is not correct because Memorystore is a regional, managed in-memory data store that does not offer the same level of functionality, durability, and integration as Pub/Sub. Option D is not correct because Cloud SQL is a regional, managed database service that does not offer the same level of scalability, performance, and cost-effectiveness as BigQuery.
Reference:
Migrating from MySQL to Cloud Spanner
Migrating from Apache Kafka to Cloud Pub/Sub
Migrating from Cloud SQL for PostgreSQL to BigQuery

Q204. You are managing several Google Cloud Platform (GCP) projects and need access to all logs for the past 60 days. You want to be able to explore and quickly analyze the log contents. You want to follow Google- recommended practices to obtain the combined logs for all projects. What should you do?

Navigate to Stackdriver Logging and select resource.labels.project_id=”*”

Create a Stackdriver Logging Export with a Sink destination to a BigQuery dataset. Configure the table expiration to 60 days.

Create a Stackdriver Logging Export with a Sink destination to Cloud Storage. Create a lifecycle rule to delete objects after 60 days.

Configure a Cloud Scheduler job to read from Stackdriver and store the logs in BigQuery. Configure the table expiration to 60 days.

* Navigate to Stackdriver Logging and select resource.labels.project_id=*. is not right.
Log entries are held in Stackdriver Logging for a limited time known as the retention period which is 30 days (default configuration). After that, the entries are deleted. To keep log entries longer, you need to export them outside of Stackdriver Logging by configuring log sinks.
Ref: https://cloud.google.com/blog/products/gcp/best-practices-for-working-with-google-cloud-audit-logging
* Configure a Cloud Scheduler job to read from Stackdriver and store the logs in BigQuery. Configure the table expiration to 60 days. is not right.
While this works, it makes no sense to use Cloud Scheduler job to read from Stackdriver and store the logs in BigQuery when Google provides a feature (export sinks) that does exactly the same thing and works out of the box.
Ref: https://cloud.google.com/logging/docs/export/configure_export_v2
* Create a Stackdriver Logging Export with a Sink destination to Cloud Storage. Create a lifecycle rule to delete objects after 60 days. is not right.
You can export logs by creating one or more sinks that include a logs query and an export destination.
Supported destinations for exported log entries are Cloud Storage, BigQuery, and Pub/Sub.
Ref: https://cloud.google.com/logging/docs/export/configure_export_v2
Sinks are limited to exporting log entries from the exact resource in which the sink was created: a Google Cloud project, organization, folder, or billing account. If it makes it easier to exporting from all projects of an organication, you can create an aggregated sink that can export log entries from all the projects, folders, and billing accounts of a Google Cloud organization.
Ref: https://cloud.google.com/logging/docs/export/aggregated_sinks
Either way, we now have the data in Cloud Storage, but querying logs information from Cloud Storage is harder than Querying information from BigQuery dataset. For this reason, we should prefer Big Query over Cloud Storage.
* Create a Stackdriver Logging Export with a Sink destination to a BigQuery dataset. Configure the table expiration to 60 days. is the right answer.
You can export logs by creating one or more sinks that include a logs query and an export destination.
Supported destinations for exported log entries are Cloud Storage, BigQuery, and Pub/Sub.
Ref: https://cloud.google.com/logging/docs/export/configure_export_v2
Sinks are limited to exporting log entries from the exact resource in which the sink was created: a Google Cloud project, organization, folder, or billing account. If it makes it easier to exporting from all projects of an organication, you can create an aggregated sink that can export log entries from all the projects, folders, and billing accounts of a Google Cloud organization.
Ref: https://cloud.google.com/logging/docs/export/aggregated_sinks
Either way, we now have the data in a BigQuery Dataset. Querying information from a Big Query dataset is easier and quicker than analyzing contents in Cloud Storage bucket. As our requirement is to Quickly analyze the log contents, we should prefer Big Query over Cloud Storage.
Also, You can control storage costs and optimize storage usage by setting the default table expiration for newly created tables in a dataset. If you set the property when the dataset is created, any table created in the dataset is deleted after the expiration period. If you set the property after the dataset is created, only new tables are deleted after the expiration period.
For example, if you set the default table expiration to 7 days, older data is automatically deleted after 1 week.
Ref: https://cloud.google.com/bigquery/docs/best-practices-storage

Q205. Your organization uses G Suite for communication and collaboration. All users in your organization have a G Suite account. You want to grant some G Suite users access to your Cloud Platform project. What should you do?

Create a CSV sheet with all users’ email addresses. Use the gcloud command line tool to convert them into Google Cloud Platform accounts.

Grant them the required IAM roles using their G Suite email address.

In the G Suite console, add the users to a special group called [email protected]. Rely on the default behavior of the Cloud Platform to grant users access if they are members of this group.

Enable Cloud Identity in the GCP Console for your domain.

Reference:
Default behavior does not grant access to the “your GCP Project” Default behavior allow only create billing account and project – When the organization is created, all users in your domain are automatically granted Project Creator and Billing Account Creator IAM roles at the organization level. This enables users in your domain to continue creating projects with no disruption.

Q206. You create a Deployment with 2 replicas in a Google Kubernetes Engine cluster that has a single preemptible node pool. After a few minutes, you use kubectl to examine the status of your Pod and observe that one of them is still in Pending status:

What is the most likely cause?

The pending Pod’s resource requests are too large to fit on a single node of the cluster.

Too many Pods are already running in the cluster, and there are not enough resources left to schedule the pending Pod.

The node pool is configured with a service account that does not have permission to pull the container image used by the pending Pod.

The pending Pod was originally scheduled on a node that has been preempted between the creation of the Deployment and your verification of the Pods’ status. It is currently being rescheduled on a new node.

Q207. Your company’s infrastructure is on-premises, but all machines are running at maximum capacity. You want to burst to Google Cloud. The workloads on Google Cloud must be able to directly communicate to the workloads on-premises using a private IP range. What should you do?

In Google Cloud, configure the VPC as a host for Shared VPC.

In Google Cloud, configure the VPC for VPC Network Peering.

Create bastion hosts both in your on-premises environment and on Google Cloud. Configure both as proxy servers using their public IP addresses.

Set up Cloud VPN between the infrastructure on-premises and Google Cloud.

Explanation
“Google Cloud VPC Network Peering allows internal IP address connectivity across two Virtual Private Cloud (VPC) networks regardless of whether they belong to the same project or the same organization.”
https://cloud.google.com/vpc/docs/vpc-peering
while
“Cloud Interconnect provides low latency, high availability connections that enable you to reliably transfer data between your on-premises and Google Cloud Virtual Private Cloud (VPC) networks.”
https://cloud.google.com/network-connectivity/docs/interconnect/concepts/overview and
“HA VPN is a high-availability (HA) Cloud VPN solution that lets you securely connect your on-premises network to your VPC network through an IPsec VPN connection in a single region.”
https://cloud.google.com/network-connectivity/docs/vpn/concepts/overview

Q208. You need to monitor resources that are distributed over different projects in Google Cloud Platform. You want to consolidate reporting under the same Stackdriver Monitoring dashboard. What should you do?

Use Shared VPC to connect all projects, and link Stackdriver to one of the projects.

For each project, create a Stackdriver account. In each project, create a service account for that project and grant it the role of Stackdriver Account Editor in all other projects.

Configure a single Stackdriver account, and link all projects to the same account.

Configure a single Stackdriver account for one of the projects. In Stackdriver, create a Group and add the other project names as criteria for that Group.

When you intially click on Monitoring(Stackdriver Monitoring) it creates a workspac(a stackdriver account) linked to the ACTIVE(CURRENT) Project from which it was clicked.
Now if you change the project and again click onto Monitoring it would create an another workspace(a stackdriver account) linked to the changed ACTIVE(CURRENT) Project, we don’t want this as this would not consolidate our result into a single dashboard(workspace/stackdriver account).
If you have accidently created two diff workspaces merge them under Monitoring > Settings > Merge Workspaces > MERGE.
If we have only one workspace and two projects we can simply add other GCP Project under Monitoring > Settings > GCP Projects > Add GCP Projects.
https://cloud.google.com/monitoring/settings/multiple-projects
Nothing about groups https://cloud.google.com/monitoring/settings?hl=en

Q209. You are building a product on top of Google Kubernetes Engine (GKE). You have a single GKE cluster. For each of your customers, a Pod is running in that cluster, and your customers can run arbitrary code inside their Pod. You want to maximize the isolation between your customers’ Pods. What should you do?

Use Binary Authorization and whitelist only the container images used by your customers’ Pods.

Use the Container Analysis API to detect vulnerabilities in the containers used by your customers’ Pods.

Create a GKE node pool with a sandbox type configured to gvisor. Add the parameter runtimeClassName: gvisor to the specification of your customers’ Pods.

Use the cos_containerd image for your GKE nodes. Add a nodeSelector with the value cloud.google.com/gke-os-distribution: cos_containerd to the specification of your customers’ Pods.

Reference:
https://cloud.google.com/kubernetes-engine/sandbox/

Q210. You want to run a single caching HTTP reverse proxy on GCP for a latency-sensitive website. This specific reverse proxy consumes almost no CPU. You want to have a 30-GB in-memory cache, and need an additional
2 GB of memory for the rest of the processes. You want to minimize cost. How should you run this reverse proxy?

Create a Cloud Memorystore for Redis instance with 32-GB capacity.

Run it on Compute Engine, and choose a custom instance type with 6 vCPUs and 32 GB of memory.

Package it in a container image, and run it on Kubernetes Engine, using n1-standard-32 instances as nodes.

Run it on Compute Engine, choose the instance type n1-standard-1, and add an SSD persistent disk of
32 GB.

Explanation
What is Google Cloud Memorystore?
Overview. Cloud Memorystore for Redis is a fully managed Redis service for Google Cloud Platform.
Applications running on Google Cloud Platform can achieve extreme performance by leveraging the highly scalable, highly available, and secure Redis service without the burden of managing complex Redis deployments.

Q211. Your company uses BigQuery for data warehousing. Over time, many different business units in your company have created 1000+ datasets across hundreds of projects. Your CIO wants you to examine all datasets to find tables that contain an employee_ssn column. You want to minimize effort in performing this task. What should you do?

Go to Data Catalog and search for employee_ssn in the search box.

Write a shell script that uses the bq command line tool to loop through all the projects in your organization.

Write a script that loops through all the projects in your organization and runs a query on INFORMATION_SCHEMA.COLUMNS view to find the employee_ssn column.

Write a Cloud Dataflow job that loops through all the projects in your organization and runs a query on INFORMATION_SCHEMA.COLUMNS view to find employee_ssn column.

Data Catalog allows you to discover, manage, and understand data assets across Google Cloud Platform. Data Catalog API natively indexes Cloud BigQuery, Cloud Storage, and Cloud Pub/Sub data assets.
The Data Catalog API can be used to:
Search for data assets across different projects and GCP resources
Create tags and tag templates to add structured business metadata unique to your organization Automate the tagging process of data assets as part of a data ingestion pipeline
https://cloud.google.com/data-catalog/docs/how-to/search

Q212. Your developers have created an application that needs to be able to make calls to Cloud Storage and BigQuery. The code is going to run inside a container and will run on Kubernetes Engine and on-premises.
What’s the best way for them to authenticate to the Google Cloud services?

Create a service account, grant it the least viable privileges to the required services, generate and download a key. Use the key to authenticate inside the application.

Use the default service account for App Engine which already has the required permissions.

Use the default service account for Compute Engine which already has the required permissions.

Create a service account, with editor permissions, generate and download a key. Use the key to authenticate inside the application.

Q213. Your company is moving from an on-premises environment to Google Cloud Platform (GCP). You have multiple development teams that use Cassandra environments as backend databases. They all need a development environment that is isolated from other Cassandra instances. You want to move to GCP quickly and with minimal support effort. What should you do?

1. Build an instruction guide to install Cassandra on GCP.
2. Make the instruction guide accessible to your developers.

1. Advise your developers to go to Cloud Marketplace.
2. Ask the developers to launch a Cassandra image for their development work.

1. Build a Cassandra Compute Engine instance and take a snapshot of it.
2. Use the snapshot to create instances for your developers.

1. Build a Cassandra Compute Engine instance and take a snapshot of it.
2. Upload the snapshot to Cloud Storage and make it accessible to your developers.

3. Build instructions to create a Compute Engine instance from the snapshot so that developers can do it themselves.

Loading …