Deploy Your Google Cloud Knowledge Before Exam Day

Take on 25 practice questions across four Associate Cloud Engineer sections.
Start Free Practice
No Credit Card Required
HOW TO PREPARE

Everything You Need to Know First

Warm-up topics before the test.
  • Cloud Computing Fundamentals: General understanding of compute, storage, networking, and access management in the cloud.
  • Google Cloud Resource Hierarchy: Familiarity with organizations, folders, projects, and billing accounts.
  • Command Line Basics: Comfort working in a terminal, since questions often ask which gcloud command fits a task.
PRACTICE TEST

Put Your Knowledge to the Test

25 multiple-choice questions, including ones built around command output
Engineers need SSH access to VMs that have no external IP addresses. The company does not want to run a bastion host. The engineers already have the required IAP and OS Login permissions. What should the engineer configure?
A firewall rule allowing TCP 22 from 0.0.0.0/0 to every VM in the VPC network
IAP TCP forwarding with ingress allowed from 35.235.240.0/20 on TCP 22
Cloud NAT so that inbound SSH connections can reach the VMs
Temporary external IP addresses assigned during maintenance windows
B
IAP TCP forwarding tunnels SSH through Identity-Aware Proxy to the VM's internal address. The firewall must allow TCP 22 from IAP's range, 35.235.240.0/20, and users need the IAP-secured Tunnel User role. A firewall rule alone gives no path to a VM without an external IP, Cloud NAT does not accept inbound connections, and external IPs break the requirement.
Configuring access and security
25
Select One
An engineer runs the following command: gcloud storage ls --impersonate-service-account=deployer@prod.iam.gserviceaccount.com. The target service account already has the required Cloud Storage permissions, and the necessary APIs are enabled. Which of the following predefined roles grants the engineer permission to generate short-lived access tokens for impersonating that service account?
Service Account Token Creator (roles/iam.serviceAccountTokenCreator)
Service Account User (roles/iam.serviceAccountUser)
Service Account Key Admin (roles/iam.serviceAccountKeyAdmin)
Service Account Admin (roles/iam.serviceAccountAdmin)
A
The Service Account Token Creator role includes permission to generate short-lived access tokens for the target service account. Requests made with those tokens use the target service account's permissions. Service Account User permits attaching a service account to supported resources but does not by itself grant permission to generate impersonation tokens.
Configuring access and security
24
Select One
A GitHub Actions workflow in one repository must deploy to Google Cloud. The security team prohibits service account keys and wants only that repository to be trusted. What should the engineer configure?
A service account key stored as an encrypted GitHub secret
An OAuth client ID and refresh token stored for a dedicated deployment user account
Workload Identity Federation with an attribute condition on the repository
A public bucket that the workflow uses to upload artifacts
C
Workload Identity Federation exchanges GitHub's OIDC token for short-lived Google credentials, and an attribute condition restricts trust to the intended repository. A stored key is still a long-lived key, which the policy prohibits.
Configuring access and security
23
Select One
An engineer must grant one additional role to a service account on a project without affecting any existing IAM bindings. Which command should the engineer use?
gcloud projects set-iam-policy with a file containing only the new binding
gcloud iam roles create with the new role's permissions
gcloud iam service-accounts keys create for the service account
gcloud projects add-iam-policy-binding with the member and role
D
add-iam-policy-binding adds one binding and keeps the rest of the policy. set-iam-policy replaces the entire policy, roles create defines a custom role, and creating a key does not grant access.
Configuring access and security
22
Select One
An application's service account only needs to read objects in the bucket reports-prod. Which grant follows least privilege?
Viewer (roles/viewer) on the project that contains the bucket
Storage Object Viewer (roles/storage.objectViewer) on the reports-prod bucket
Storage Admin (roles/storage.admin) on the reports-prod bucket
Storage Object Viewer (roles/storage.objectViewer) on the whole project
B
Granting the object read role on the single bucket limits both actions and scope. The same role on the project covers every bucket, Viewer is broader, and Storage Admin adds write and delete permissions.
Configuring access and security
21
Select One
A Persistent Disk attached to a production VM needs a daily backup that is kept for 14 days and then deleted automatically. What should the engineer configure?
A cron job on the VM that copies the disk to Cloud Storage
A regional Persistent Disk replicated to a second zone
A snapshot schedule on the disk with 14-day retention
A monthly machine image exported to another project
C
Snapshot schedules create snapshots automatically and delete them after the retention period. A regional disk improves availability but is not a backup, and a custom cron job adds unnecessary maintenance.
Ensuring the successful operation of a cloud solution
20
Select One
An engineer wants an open-source AI agent that runs in the terminal and can help draft, explain, and run gcloud commands. Which tool fits?
Gemini CLI
gcloud interactive
Cloud Shell Editor
Cloud Code
A
Gemini CLI is an open-source AI agent for the terminal that can explain and run commands. gcloud interactive only offers autocompletion, and Cloud Shell Editor and Cloud Code are editors and IDE tools.
Ensuring the successful operation of a cloud solution
19
Select One
An engineer is investigating a sudden spike in errors on a Cloud Run service. The engineer wants an AI assistant in the Google Cloud console that analyzes related logs, metrics, and recent changes and suggests likely causes. Which tool fits?
Active Assist recommendations
Error Reporting
Cloud Trace
Gemini Cloud Assist
D
Gemini Cloud Assist is the AI assistant in the console that can help investigate issues using logs, metrics, and configuration context. Error Reporting groups errors, Cloud Trace shows latency, and Active Assist gives optimization recommendations.
Ensuring the successful operation of a cloud solution
18
Select One
A Compute Engine VM must send application log files and guest memory utilization metrics to Cloud Logging and Cloud Monitoring. What should the engineer install?
The legacy Monitoring and Logging agents
Google Cloud Managed Service for Prometheus
The Ops Agent
VM Manager OS inventory management
C
The Ops Agent is Google's current agent for collecting VM logs and metrics, including memory. The legacy agents are superseded, and Managed Service for Prometheus targets Prometheus metrics rather than guest logs.
Ensuring the successful operation of a cloud solution
17
Select One
A team must route selected application logs to a BigQuery dataset in a separate security project. Which two steps are required?
Install the Ops Agent on the BigQuery dataset's project
Create a log sink with the BigQuery dataset as its destination and a filter for the selected logs
Create a log-based metric for each selected log
Grant the sink's writer identity the BigQuery Data Editor role on the destination dataset
B
A sink selects entries with its filter and writes them as its writer identity, which needs write access to a dataset in another project. The Ops Agent, log-based metrics, and disabling _Default are not required for routing.
Ensuring the successful operation of a cloud solution
16
Select Two
D
VMs in a managed instance group take three minutes to start their application. Autohealing keeps recreating instances before they finish booting, even though they become healthy later. What should the engineer change?
Delete the health check from the autohealing policy
Increase the initial delay on the autohealing policy
Convert the group to an unmanaged instance group
Reduce the health check interval to one second
B
The initial delay gives new instances time to start before autohealing acts on health check results. Removing the health check disables autohealing, and a shorter interval would make premature recreation more likely.
Ensuring the successful operation of a cloud solution
15
Select One
A Cloud Run service has revisions api-00007 (stable) and api-00008 (new). The engineer wants 10% of requests to go to the new revision. Which command does this?
gcloud run deploy api --traffic=10
gcloud run revisions split api-00008 --percent=10
gcloud run services update api --traffic-split=api-00008:10,api-00007:90,rest:0
gcloud run services update-traffic api --to-revisions=api-00008=10,api-00007=90
D
update-traffic with --to-revisions assigns percentages to named revisions, which enables gradual rollouts and fast rollback. The other commands and flags do not exist in this form.
Ensuring the successful operation of a cloud solution
14
Select One
A team wants to deploy Google Cloud resources from Terraform configurations, with Google Cloud managing Terraform execution and state. Which service should it use?
Infrastructure Manager
Deployment Manager
Config Connector
Cloud Build with no Terraform step
A
Infrastructure Manager runs Terraform on Google Cloud and manages the state. Deployment Manager uses its own legacy template format, and Config Connector manages resources through Kubernetes objects rather than Terraform.
Planning and implementing a cloud solution
13
Select One
A public HTTPS application runs on backends in two regions. Users worldwide should reach it through a single anycast IP address, with traffic sent to the closest healthy backend. Which load balancer should the engineer choose?
Regional external passthrough Network Load Balancer
Internal Application Load Balancer
Global external Application Load Balancer
Regional external proxy Network Load Balancer
C
The global external Application Load Balancer serves HTTPS on a single anycast IP and routes users to the closest healthy backend across regions. The regional and internal options do not provide a global anycast frontend for public HTTPS.
Planning and implementing a cloud solution
12
Select One
Private VMs without external IP addresses need outbound internet access to download OS packages from public repositories. They must remain without external IP addresses and must not accept unsolicited inbound connections. Routing and egress firewall rules permit the traffic. What should the engineer configure?
Private Google Access on the subnet
Cloud NAT on a Cloud Router in the subnet's region
External IP addresses with an ingress deny-all firewall rule
A Cloud VPN tunnel to the on-premises network
B
Cloud NAT gives outbound internet access to VMs without external IPs and does not permit unsolicited inbound connections. Cloud NAT and Cloud Router are regional, so they must be in the subnet's region, even though the VPC itself is global. Private Google Access only reaches Google APIs and services, and adding external IPs breaks the requirement even with a deny-all ingress rule.
Planning and implementing a cloud solution
11
Select One
An IoT platform writes millions of time-series rows per second and reads them by row key with low latency. It does not need SQL joins or multi-row transactions. Which database fits best?
Cloud SQL for MySQL
BigQuery
Firestore
Bigtable
D
Bigtable is a wide-column NoSQL database built for very high write throughput and low-latency row-key access, a common fit for time-series data. BigQuery targets analytics, and Cloud SQL and Firestore are not designed for this ingestion rate.
Planning and implementing a cloud solution
10
Select One
Several Compute Engine VMs in one region need a shared POSIX file system that they mount over NFS. Which service fits?
Filestore
A zonal Persistent Disk attached to one VM
A Cloud Storage bucket
Local SSD on each VM
A
Filestore provides managed NFS file shares that many VMs can mount. A zonal disk attached to one VM is not shared, Cloud Storage is object storage, and Local SSD is local to one VM.
Planning and implementing a cloud solution
9
Select One
A checkpointed batch job can tolerate interruption, and cost matters more than guaranteed runtime. Which flag creates the VM with the appropriate provisioning model?
--preemptible-spot=true
--maintenance-policy=SPOT
--provisioning-model=SPOT
--spot-max-price=0.01
C
Spot VMs are created by setting the provisioning model to SPOT. The other flags are not valid gcloud options, and Spot VMs do not use a bid price.
Planning and implementing a cloud solution
8
Select One
Which command creates a GKE Autopilot cluster named web in the us-central1 region?
gcloud container clusters create web --autopilot --zone=us-central1-a
gcloud container clusters create-auto web --location=us-central1
gcloud gke autopilot create web --region=us-central1
kubectl create cluster web --mode=autopilot
B
Autopilot clusters are regional and are created with the create-auto command. clusters create creates Standard clusters, and kubectl does not create GKE clusters.
Planning and implementing a cloud solution
7
Select One
A team has a stateless HTTP container. It must scale to zero when idle, and the team does not need Kubernetes APIs or want to manage clusters. Which service fits best?
GKE Standard with the cluster autoscaler
GKE Autopilot
A Compute Engine managed instance group
Cloud Run
D
Cloud Run runs stateless containers without cluster management and scales to zero when there is no traffic. Both GKE modes expose Kubernetes and keep cluster infrastructure, and a managed instance group requires VM management.
Planning and implementing a cloud solution
6
Select One
The finance team wants detailed daily Google Cloud cost data that it can analyze with SQL and join with other business data. What should the engineer set up?
Cloud Billing export to BigQuery
A monthly download of the invoice PDF
A log sink that routes billing audit logs to Cloud Storage
A budget with alerts at 50%, 90%, and 100%
A
Billing export writes detailed cost data to BigQuery tables throughout the day, where it can be queried with SQL. Invoices are summaries, and budgets alert on thresholds rather than providing detailed data.
Setting up a cloud solution environment
5
Select One
A team wants billing to be disabled automatically on a sandbox project when spending exceeds its monthly budget. What should the engineer configure?
A budget with an email alert at 100% of the budget amount
A budget set to hard-cap mode so that all charges stop when the limit is reached
Programmatic budget notifications that trigger a function to disable billing
Lower the project's regional CPU quotas to zero at month end
C
Budgets only send notifications; they never stop charges by themselves, and there is no hard-cap mode. Automatic action requires programmatic notifications to Pub/Sub and code that responds, such as a function that disables billing on the project.
Setting up a cloud solution environment
4
Select One
A deployment script fails because the Cloud Run Admin API is not enabled in a new project. Which command enables it?
gcloud components install cloud-run-proxy --quiet
gcloud run services enable
gcloud apis activate run
gcloud services enable run.googleapis.com
D
APIs are enabled per project through Service Usage using the service's API name. gcloud components install adds CLI components on the local machine, and the other two commands do not exist.
Setting up a cloud solution environment
3
Select One
An engineer works in two projects and wants every subsequent gcloud command to target the project prod-app-123 by default. Which command should the engineer run?
gcloud projects describe prod-app-123
gcloud config set project prod-app-123
gcloud auth login prod-app-123
gcloud projects select prod-app-123
B
This sets the project property in the active gcloud configuration, so later commands use it by default. describe only shows project details, auth login authenticates an account, and projects select is not a gcloud command.
Setting up a cloud solution environment
2
Select One
A company wants to prevent every project in its Development folder from creating Compute Engine VMs that have external IP addresses. Developers must still be able to create VMs without external IPs. What should the engineer do?
Set the compute.vmExternalIpAccess organization policy on the folder
Attach an IAM deny policy to the Development folder that denies compute.instances.create
Create a firewall rule in each project that blocks all ingress from 0.0.0.0/0
Remove the Compute Instance Admin role from developers in the folder
A
The vmExternalIpAccess list constraint controls which VMs may have external IPs, and folder-level policies are inherited by every project beneath. An IAM deny on instance creation would block all VMs, and firewall rules do not stop IP assignment.
Setting up a cloud solution environment
1
Select One
DOMAIN Question 01/00

0 of 0 answered

A Course Built Around Your Needs

Google Cloud Professional Data Engineer Certification

Beginner
Associate
Professional
10.48
Hours
Play icon
Prepare for certification by learning to design, build, and secure data pipelines on GCP using services like BigQuery, Dataflow, Dataproc, Pub/Sub, and Cloud Storage.
Raghunandana Sanur
Details
WHY HANDS-ON PRACTICE

Knowledge, Earned by Doing

The Associate Cloud Engineer exam rewards platform judgment, not memorized console paths.

Build Real Exam Speed‍

You get 2 hours for the full exam. Repeated practice trains you to spot the constraint in a scenario fast, so you're not weighing every option under time pressure.

Know Your Weak Domains

Review every question you missed and spot the topics that need more work. Better to find them here than on exam day.

Realistic Scenario Questions

Exam-style questions,that are a mix of command recall and scenario-based items.

Reduce Exam-Day Anxiety‍

Familiarity with multiple-choice format removes surprises, so nerves don't cost you marks.

Reinforce Through Repetition

Spaced repetition on frequently tested concepts, like IAM roles, Compute Engine, and GKE, moves them from look it up to just know it.

Check Your Readiness‍

Google doesn't publish a passing score, so treat your result as a readiness check and identify topics to review before exam-day.

HEAR FROM OUR LEARNERS

Real Learners. Real Results

Alhamdulillah 🙏! Thrilled to announce that I am now officially a Certified Kubernetes Administrator (CKA)! While Kubernetes, cluster orchestration, and container security are already central to my daily DevSecOps work, earning this certification is a great validation of those hands-on skills.Thanks to Mumshad Mannambeth and the KodeKloud team—their course and hands-on labs helped me a lot in preparing for this exam.The learning never stops! 🚀

Read Full Post
Imtiaz Ali
DevOps | SRE | Multi-Cloud | DevSecOps

Freshly certified: Certified Kubernetes Administrator (CKA)! 🚀Passing this hands-on, live-terminal exam was a great challenge. Paired with my AWS Certified DevOps Engineer – Professional, it reinforces my focus on bridging enterprise multi-account cloud governance with production-grade Kubernetes runtime operations.A special shoutout and big thank you to Mumshad Mannambeth, the KodeKloud team, and the Cloud Native Computing Foundation (CNCF) and Kubernetes (Official) community. The Certified Kubernetes Administrator (CKA) course was hands-down the best preparation for the live terminal environment! 🛠️Next stop: continuing to build resilient, developer-first platform foundations!

Read Full Post
Gaurav Dubey
Cloud Architect | Platform Engineer | AWS DevOps Pro | CKA

Cherishing one of my dreams - CKS Certified! ✨Last year, in October, when I cracked my CKA, my colleagues asked, “When is CKS?” 😂And I was like… bro. 😅Because it felt so much bigger. I also knew it wasn’t just Kubernetes anymore, but Kubernetes with a special layer of security - yeah, tightened Kubernetes.Back then, I used to look up to CKS like a child gazing at one of the stars in the sky.⭐Now, fast forward to today - I cleared it last week and officially became a Certified Kubernetes Security Specialist (CKS), thanks to the Cloud Native Computing Foundation (CNCF), The Linux Foundation and my company Aivar Innovations. 🎉That moment felt so special, and I’m incredibly grateful to all my colleagues, friends, and family for all the support. ❤️A mention of the resources I used: KodeKloud by Mumshad Mannambeth and Kim Wüstkamp’s CKS courses. I also had my colleagues supporting me with my doubts and anxieties before the exam. 😂Looking forward to applying everything I’ve learned in my work and continuing to grow in the Cloud Native and Kubernetes space. 🚀So, cheers to everyone who dreams, aspires, and inspires. Keep going and keep up the good work! 🥂And as I always say - God, keep it coming!! ✨

Read Full Post
Rima Sidique
DevOps Engineer | AI & DevOps Enthusiast

I've successfully passed CKA certification. Shout-out to Mumshad Mannambeth for his great CKA course and labs and to Omkar Shelke Killercoda CKA scenarios. Links: - https://lnkd.in/eZPVHJeR- https://lnkd.in/eEVyZdaZ

Read Full Post
Gabriel Rodríguez
DevSecOps Engineer

🎉 The Kubernetes journey continues… and this time, happy to say I’m officially a Kubestronaut! 🧑🚀🚀🎖️ 1 out of 242 in France and 1 out of 4217 worldwide!⏳✈️ It’s been quite a journey. From my early days working with Kubernetes, thanks to the opportunity Prof. Timur Friedman gave me to contribute to the EdgeNet project, to securing my internship as a DevOps Engineer at Sonos, Inc. — and fast-forward five years, here I am today, a Senior DevOps Engineer at Sonos, Inc. working extensively with Kubernetes everyday.💌 A special thank you to Jose Alfredo Alvarez Aldana for your support, guidance, and for everything you taught me along the way. I was really lucky to have the opportunity to work alongside you early in my journey. 🙏💯 A big thank you to Mumshad Mannambeth for building KodeKloud! The platform has been incredibly helpful throughout this journey, both for learning and preparing for the exams.And of course, shout out to all the people who supported, challenged, and inspired me along the way. ❤️Never give up 💪Keep smiling 😃

Read Full Post
Rima Sidique
DevOps Engineer | AI & DevOps Enthusiast

Alhamdulillah 🙏! Thrilled to announce that I am now officially a Certified Kubernetes Administrator (CKA)! While Kubernetes, cluster orchestration, and container security are already central to my daily DevSecOps work, earning this certification is a great validation of those hands-on skills.Thanks to Mumshad Mannambeth and the KodeKloud team—their course and hands-on labs helped me a lot in preparing for this exam.The learning never stops! 🚀

Read Full Post
Imtiaz Ali
DevOps | SRE | Multi-Cloud | DevSecOps

Freshly certified: Certified Kubernetes Administrator (CKA)! 🚀Passing this hands-on, live-terminal exam was a great challenge. Paired with my AWS Certified DevOps Engineer – Professional, it reinforces my focus on bridging enterprise multi-account cloud governance with production-grade Kubernetes runtime operations.A special shoutout and big thank you to Mumshad Mannambeth, the KodeKloud team, and the Cloud Native Computing Foundation (CNCF) and Kubernetes (Official) community. The Certified Kubernetes Administrator (CKA) course was hands-down the best preparation for the live terminal environment! 🛠️Next stop: continuing to build resilient, developer-first platform foundations!

Read Full Post
Gaurav Dubey
Cloud Architect | Platform Engineer | AWS DevOps Pro | CKA

Cherishing one of my dreams - CKS Certified! ✨Last year, in October, when I cracked my CKA, my colleagues asked, “When is CKS?” 😂And I was like… bro. 😅Because it felt so much bigger. I also knew it wasn’t just Kubernetes anymore, but Kubernetes with a special layer of security - yeah, tightened Kubernetes.Back then, I used to look up to CKS like a child gazing at one of the stars in the sky.⭐Now, fast forward to today - I cleared it last week and officially became a Certified Kubernetes Security Specialist (CKS), thanks to the Cloud Native Computing Foundation (CNCF), The Linux Foundation and my company Aivar Innovations. 🎉That moment felt so special, and I’m incredibly grateful to all my colleagues, friends, and family for all the support. ❤️A mention of the resources I used: KodeKloud by Mumshad Mannambeth and Kim Wüstkamp’s CKS courses. I also had my colleagues supporting me with my doubts and anxieties before the exam. 😂Looking forward to applying everything I’ve learned in my work and continuing to grow in the Cloud Native and Kubernetes space. 🚀So, cheers to everyone who dreams, aspires, and inspires. Keep going and keep up the good work! 🥂And as I always say - God, keep it coming!! ✨

Read Full Post
Rima Sidique
DevOps Engineer | AI & DevOps Enthusiast

I've successfully passed CKA certification. Shout-out to Mumshad Mannambeth for his great CKA course and labs and to Omkar Shelke Killercoda CKA scenarios. Links: - https://lnkd.in/eZPVHJeR- https://lnkd.in/eEVyZdaZ

Read Full Post
Gabriel Rodríguez
DevSecOps Engineer

🎉 The Kubernetes journey continues… and this time, happy to say I’m officially a Kubestronaut! 🧑🚀🚀🎖️ 1 out of 242 in France and 1 out of 4217 worldwide!⏳✈️ It’s been quite a journey. From my early days working with Kubernetes, thanks to the opportunity Prof. Timur Friedman gave me to contribute to the EdgeNet project, to securing my internship as a DevOps Engineer at Sonos, Inc. — and fast-forward five years, here I am today, a Senior DevOps Engineer at Sonos, Inc. working extensively with Kubernetes everyday.💌 A special thank you to Jose Alfredo Alvarez Aldana for your support, guidance, and for everything you taught me along the way. I was really lucky to have the opportunity to work alongside you early in my journey. 🙏💯 A big thank you to Mumshad Mannambeth for building KodeKloud! The platform has been incredibly helpful throughout this journey, both for learning and preparing for the exams.And of course, shout out to all the people who supported, challenged, and inspired me along the way. ❤️Never give up 💪Keep smiling 😃

Read Full Post
Rima Sidique
DevOps Engineer | AI & DevOps Enthusiast
FAQs

Frequently Asked Questions

Is this practice test free ? 

Yes! This practice test is completely free. You can take it as many times as you like to practice and assess your knowledge.

Do I need to install anything ? 

No. You don’t need to install anything. The practice test is completely browser-based, so you can start practicing directly online. 

What if I'm new to this domain?

That's completely fine , mock tests aren't just for the final week before your exam. Taking one early gives you a baseline: you'll see which topics you already grasp, which ones you've never encountered, and how the real exam frames its questions. Every attempt comes with detailed explanations for each answer, so even the questions you get wrong become a study guide. We'd suggest starting with one full mock test, reviewing the explanations carefully, then working through the linked learning material before attempting the next one. 

How closely does this mock test match the real exam?

The question style and pattern closely mirror the real certification exam, the way scenarios are framed, the answer options, and the level of reasoning required are all modelled on it. The main difference is length: this mock has 25 sample questions, while the actual exam typically presents 50-60 questions of this type. So treat this as a representative sample rather than a full-length simulation. The style will feel familiar on exam day; the stamina and time pressure of a longer paper is something you'll want to prepare for separately.