About this Google Cloud Associate Cloud Engineer (ACE) GCP practice test

Google Cloud has carved out a massive market share by offering incredible data tools and world-class container orchestration, and the Associate Cloud Engineer (ACE) proves you can manage those tools in production. This exam avoids high-flown theoretical models to ask direct, operational questions: how do you form a gcloud command, how should you structure your folders for billing, and what container route makes sense for a microservice? Our review is built from the ground up for hands-on professionals who want to understand GCP's specific CLI syntax and compute choices.

Google Associate Cloud Engineer Practice Test sample questions

These starter questions help you launch a gcp mock test quickly. Swap them with your own worksheet, notebook, or textbook questions any time.

1. 1. Which Google Cloud service should you use to run containerised applications without managing the underlying infrastructure?

   • A) Compute Engine
   • B) Google Kubernetes Engine
   • C) Cloud Run
   • D) App Engine Standard

2. 2. What is the default network created when you set up a new Google Cloud project?

   • A) A custom VPC network
   • B) The default VPC network with auto-mode subnets
   • C) No network is created by default
   • D) A shared VPC

3. 3. Which command initialises the Google Cloud CLI and sets the default project and account?

   • A) gcloud auth login
   • B) gcloud init
   • C) gcloud config set project
   • D) gcloud setup

4. 4. What is the purpose of Cloud IAM in Google Cloud?

   • A) To manage virtual networks
   • B) To control who (identity) has what access (roles) to which Google Cloud resources
   • C) To encrypt data at rest
   • D) To monitor application performance

5. 5. Which storage class in Cloud Storage is best for data accessed less than once a year?

   • A) Standard
   • B) Nearline
   • C) Coldline
   • D) Archive

6. 6. What is a managed instance group (MIG) in Compute Engine?

   • A) A group of manually managed VMs
   • B) A set of identical VM instances managed as a single entity with autoscaling and auto-healing
   • C) A Kubernetes node pool
   • D) A Cloud Run service

7. 7. Which Google Cloud service provides a fully managed relational database compatible with MySQL and PostgreSQL?

   • A) Cloud Spanner
   • B) Cloud SQL
   • C) Cloud Bigtable
   • D) Firestore

8. 8. What is the purpose of a service account in Google Cloud?

   • A) A user account for Google Cloud Console
   • B) An identity for an application or VM instance to authenticate and authorise API calls
   • C) A billing account
   • D) A network identity

9. 9. Which networking component controls inbound and outbound traffic to VM instances?

   • A) Cloud Router
   • B) Cloud Load Balancing
   • C) VPC firewall rules
   • D) Cloud Armor

10. 10. What is the difference between regional and zonal resources in Google Cloud?

    • A) Regional resources span a continent; zonal resources span a country
    • B) Regional resources are replicated across multiple zones in a region; zonal resources exist in a single zone
    • C) Zonal resources are more expensive
    • D) There is no difference

11. 11. Which Google Cloud tool provides recommendations to reduce costs and improve performance?

    • A) Cloud Monitoring
    • B) Active Assist (Recommender)
    • C) Cloud Logging
    • D) Cloud Trace

12. 12. What command deploys a container image to Cloud Run?

    • A) gcloud run services update
    • B) gcloud run deploy
    • C) kubectl apply
    • D) gcloud app deploy

13. 13. What is Cloud Pub/Sub used for?

    • A) Storing relational data
    • B) Asynchronous messaging between services
    • C) Running containers
    • D) Managing DNS

14. 14. Which IAM role grants full access to all Google Cloud resources?

    • A) roles/editor
    • B) roles/viewer
    • C) roles/owner
    • D) roles/admin

15. 15. What is the purpose of Cloud Monitoring?

    • A) To manage IAM policies
    • B) To collect metrics, set alerting policies, and visualise performance data
    • C) To store application logs
    • D) To deploy applications

16. 16. Which Compute Engine feature automatically replaces unhealthy VM instances?

    • A) Autoscaling
    • B) Auto-healing in managed instance groups
    • C) Live migration
    • D) Preemptible VMs

17. 17. What is GKE Autopilot?

    • A) A managed Kubernetes mode where Google manages the cluster infrastructure and nodes
    • B) An autoscaling policy
    • C) A serverless function runtime
    • D) An auto-deployment tool

18. 18. What does the gcloud compute instances create command do?

    • A) Lists existing VM instances
    • B) Creates a new Compute Engine VM instance
    • C) Starts a stopped VM instance
    • D) Connects to a VM via SSH

19. 19. Which Google Cloud service stores application logs and allows log-based metrics and alerts?

    • A) Cloud Monitoring
    • B) Cloud Logging
    • C) Cloud Trace
    • D) Cloud Profiler

20. 20. What is a VPC peering connection used for?

    • A) Connecting a VPC to the internet
    • B) Connecting two VPC networks so resources in each can communicate using internal IP addresses
    • C) Creating a VPN tunnel
    • D) Setting up DNS

21. 21. Which storage option is best for hosting a static website on Google Cloud?

    • A) Compute Engine
    • B) Cloud SQL
    • C) Cloud Storage bucket with static website hosting enabled
    • D) Cloud Run

22. 22. What is the purpose of Binary Authorization in GKE?

    • A) To encrypt container images
    • B) To ensure only trusted container images are deployed to the cluster
    • C) To manage IAM roles
    • D) To enable autoscaling

23. 23. What does Cloud Spanner provide that Cloud SQL does not?

    • A) SQL support
    • B) Globally distributed, horizontally scalable relational database with strong consistency
    • C) Lower cost
    • D) MySQL compatibility

24. 24. What is the correct way to grant a user the ability to view billing information in Google Cloud?

    • A) Assign the roles/owner role
    • B) Assign the roles/billing.viewer role at the billing account level
    • C) Give them access to the project only
    • D) Add them to the billing admin group

25. 25. Which command exports data from a BigQuery table to Cloud Storage?

    • A) bq extract
    • B) bq export
    • C) gcloud bigquery export
    • D) bq load

26. 26. What is the purpose of Cloud Armor?

    • A) To manage SSL certificates
    • B) To protect applications against DDoS attacks and application-layer (Layer 7) threats
    • C) To encrypt disks
    • D) To monitor Kubernetes clusters

27. 27. In Google Cloud, what is a project?

    • A) A type of VM
    • B) The organisational container for resources, billing, APIs, and IAM policies
    • C) A network subnet
    • D) A storage bucket

28. 28. What is the purpose of Cloud CDN?

    • A) To manage DNS
    • B) To cache content at Google's global edge locations for faster delivery to users
    • C) To create VPN tunnels
    • D) To run serverless functions

29. 29. Which service provides a managed, serverless event-driven compute platform for running small functions?

    • A) Cloud Run
    • B) App Engine
    • C) Cloud Functions
    • D) GKE

30. 30. What should you do to prevent a specific VM instance from being deleted accidentally?

    • A) Assign it a reserved IP
    • B) Enable deletion protection on the instance
    • C) Move it to a different project
    • D) Assign the roles/viewer role

Answer key & quick explanations

Short answers for the sample questions above. Use this to self-check before generating a fresh AI-built mock test.

1. 1. Which Google Cloud service should you use to run containerised applications without managing the underlying infrastructure?

   C) Cloud Run

   Cloud Run runs stateless containers and automatically manages the underlying servers, scaling (including to zero) without any infrastructure to provision or patch. Compute Engine and GKE both still require you to manage VMs or cluster nodes to some degree, and App Engine Standard runs specific supported language runtimes rather than arbitrary containers.

2. 2. What is the default network created when you set up a new Google Cloud project?

   B) The default VPC network with auto-mode subnets

   Every new Google Cloud project automatically gets a 'default' VPC network with one auto-mode subnet per region, pre-configured with some default firewall rules, so resources can be created immediately without manual network setup. A custom VPC and a shared VPC both have to be deliberately created, and a network is in fact created by default unless you explicitly disable it.

3. 3. Which command initialises the Google Cloud CLI and sets the default project and account?

   B) gcloud init

   gcloud init walks you through authenticating, then choosing or creating a default project and configuration, which is the standard first command run after installing the CLI. gcloud auth login only handles authentication, gcloud config set project only changes one setting on an existing configuration, and 'gcloud setup' isn't a real command.

4. 4. What is the purpose of Cloud IAM in Google Cloud?

   B) To control who (identity) has what access (roles) to which Google Cloud resources

   Cloud IAM is Google Cloud's access-control system, letting you bind identities (users, groups, service accounts) to roles that define what actions they can take on specific resources. It doesn't manage networks, encrypt data at rest (that's handled transparently by the platform or Cloud KMS), or monitor performance — those are separate services.

5. 5. Which storage class in Cloud Storage is best for data accessed less than once a year?

   D) Archive

   Archive is the lowest-cost, coldest storage class in Cloud Storage, designed for data accessed less than once a year and tolerant of a longer retrieval time. Standard is for frequently accessed data, Nearline targets roughly monthly access, and Coldline targets roughly quarterly access — all warmer (and pricier) tiers than Archive.

6. 6. What is a managed instance group (MIG) in Compute Engine?

   B) A set of identical VM instances managed as a single entity with autoscaling and auto-healing

   A managed instance group keeps a set of identical VM instances running as a single unit, and can automatically scale the group up or down and replace unhealthy instances (auto-healing) without manual intervention. Manually managed VMs have none of that automation, a GKE node pool is a Kubernetes-specific concept, and Cloud Run doesn't use VM instance groups at all.

7. 7. Which Google Cloud service provides a fully managed relational database compatible with MySQL and PostgreSQL?

   B) Cloud SQL

   Cloud SQL is Google Cloud's fully managed relational database service, supporting MySQL, PostgreSQL, and SQL Server engines directly. Cloud Spanner is a separate globally-distributed relational database with a different consistency model, Bigtable is a wide-column NoSQL database, and Firestore is a document NoSQL database — none of them are MySQL/PostgreSQL-compatible in the same way.

8. 8. What is the purpose of a service account in Google Cloud?

   B) An identity for an application or VM instance to authenticate and authorise API calls

   A service account is an identity that an application, VM, or workload uses to authenticate to Google Cloud APIs and be authorized to perform specific actions, rather than a human logging into the console. It isn't a human user account, a billing account, or a network-layer identity.

9. 9. Which networking component controls inbound and outbound traffic to VM instances?

   C) VPC firewall rules

   VPC firewall rules are evaluated per network and control which inbound and outbound traffic is allowed to and from VM instances, based on criteria like IP ranges, protocols, ports, and tags. Cloud Router handles dynamic route exchange (e.g., with Cloud VPN or Interconnect), Cloud Load Balancing distributes traffic across backends rather than filtering it, and Cloud Armor adds edge-level protection in front of load balancers rather than being the base firewall mechanism for VM traffic.

10. 10. What is the difference between regional and zonal resources in Google Cloud?

    B) Regional resources are replicated across multiple zones in a region; zonal resources exist in a single zone

    A regional resource (like a regional managed instance group or a highly available Cloud SQL instance) is automatically replicated or made available across multiple zones within one region for resilience, while a zonal resource (like a single Compute Engine VM) exists in only one specific zone and is lost if that zone has an outage. Neither type spans a continent or country by definition, and the distinction very much matters for availability planning.

11. 11. Which Google Cloud tool provides recommendations to reduce costs and improve performance?

    B) Active Assist (Recommender)

    Active Assist, surfaced through the Recommender, analyzes your actual usage and configuration to suggest concrete cost, performance, and security improvements — like rightsizing an underused VM. Cloud Monitoring and Cloud Logging collect metrics and logs for you to analyze yourself, and Cloud Trace focuses on latency tracing within applications rather than giving optimization recommendations.

12. 12. What command deploys a container image to Cloud Run?

    B) gcloud run deploy

    gcloud run deploy builds (if needed) and deploys a container image as a new Cloud Run service or revision in one command. gcloud run services update only modifies an existing service's configuration rather than deploying a new image, kubectl apply is a Kubernetes-specific command unrelated to Cloud Run, and gcloud app deploy deploys to App Engine, a different service.

13. 13. What is Cloud Pub/Sub used for?

    B) Asynchronous messaging between services

    Cloud Pub/Sub is a fully managed messaging service used to decouple services by letting publishers send messages that subscribers process asynchronously, at their own pace. It isn't used for storing relational data, running containers, or managing DNS — those are handled by entirely different GCP services.

14. 14. Which IAM role grants full access to all Google Cloud resources?

    C) roles/owner

    roles/owner grants full control over all resources in a project, including the ability to manage IAM permissions and delete the project itself, making it the most powerful basic role. roles/editor can modify resources but can't manage IAM or billing, roles/viewer is read-only, and 'roles/admin' isn't a real, standalone IAM role name.

15. 15. What is the purpose of Cloud Monitoring?

    B) To collect metrics, set alerting policies, and visualise performance data

    Cloud Monitoring collects metrics from Google Cloud resources and (via agents) from on-premises or hybrid systems, and lets you build dashboards, set alerting policies, and visualize performance over time. Managing IAM policies, storing logs, and deploying applications are all handled by other, separate services (IAM, Cloud Logging, and various deployment tools respectively).

16. 16. Which Compute Engine feature automatically replaces unhealthy VM instances?

    B) Auto-healing in managed instance groups

    Auto-healing in a managed instance group continuously runs health checks against instances and automatically recreates any instance that fails them, without manual intervention. Autoscaling changes the number of instances based on load rather than replacing unhealthy ones specifically, live migration moves a running VM to different host hardware during maintenance rather than replacing it, and preemptible VMs are just a lower-cost, interruptible VM type unrelated to health-based replacement.

17. 17. What is GKE Autopilot?

    A) A managed Kubernetes mode where Google manages the cluster infrastructure and nodes

    GKE Autopilot is a mode of Google Kubernetes Engine where Google fully manages the node infrastructure — provisioning, scaling, and patching nodes automatically — so you only manage the workloads themselves. It isn't simply an autoscaling policy, a serverless function runtime (that's Cloud Functions), or a generic auto-deployment tool; it's a specific GKE operating mode for the cluster's underlying infrastructure.

18. 18. What does the gcloud compute instances create command do?

    B) Creates a new Compute Engine VM instance

    gcloud compute instances create provisions and starts a brand-new Compute Engine VM instance based on the parameters you specify (machine type, image, zone, and so on). Listing existing instances uses 'gcloud compute instances list', starting a stopped instance uses 'gcloud compute instances start', and connecting via SSH uses 'gcloud compute ssh' — all different commands.

19. 19. Which Google Cloud service stores application logs and allows log-based metrics and alerts?

    B) Cloud Logging

    Cloud Logging collects and stores log entries from Google Cloud resources and applications, and supports creating log-based metrics and log-based alerting policies from that log data. Cloud Monitoring focuses on metrics and dashboards rather than storing raw logs, Cloud Trace tracks request latency across services, and Cloud Profiler analyzes application CPU/memory performance — none of them are the primary log storage service.

20. 20. What is a VPC peering connection used for?

    B) Connecting two VPC networks so resources in each can communicate using internal IP addresses

    VPC peering connects two separate VPC networks (in the same or different projects/organizations) so resources in each can communicate directly using internal (private) IP addresses, without traversing the public internet. It isn't how you connect a VPC to the internet, isn't a VPN tunnel (a different, encrypted connectivity mechanism), and has nothing to do with DNS configuration.

21. 21. Which storage option is best for hosting a static website on Google Cloud?

    C) Cloud Storage bucket with static website hosting enabled

    A Cloud Storage bucket with static website hosting enabled can serve HTML, CSS, JS, and other static files directly over HTTP(S) at low cost, without needing a running server. Compute Engine and Cloud Run both involve running compute for content that doesn't need it, and Cloud SQL is a database service, not a static file host.

22. 22. What is the purpose of Binary Authorization in GKE?

    B) To ensure only trusted container images are deployed to the cluster

    Binary Authorization is a deploy-time security control for GKE that only allows container images to be deployed if they're signed and attested by trusted, configured authorities, blocking unverified or unauthorized images. It doesn't encrypt images itself, manage IAM roles, or control autoscaling — those are handled by separate mechanisms.

23. 23. What does Cloud Spanner provide that Cloud SQL does not?

    B) Globally distributed, horizontally scalable relational database with strong consistency

    Cloud Spanner offers horizontal scalability across regions with strong (external) consistency for a relational database, something Cloud SQL — which scales vertically and typically operates within a single region — doesn't provide. Both support SQL, and Cloud Spanner is generally more expensive and isn't MySQL-compatible, so those distinctions run the opposite direction from what the other options claim.

24. 24. What is the correct way to grant a user the ability to view billing information in Google Cloud?

    B) Assign the roles/billing.viewer role at the billing account level

    Billing-related IAM roles, like roles/billing.viewer, are granted at the billing account level (or inherited from a folder/organization tied to it) so a user can view billing and cost data without needing broader project permissions. roles/owner grants far more than billing visibility, project-only access doesn't include billing account details, and 'billing admin group' isn't itself an IAM role assignment mechanism.

25. 25. Which command exports data from a BigQuery table to Cloud Storage?

    A) bq extract

    The 'bq extract' command exports data from a BigQuery table into Cloud Storage, in formats like CSV, JSON, or Avro. 'bq export' and 'gcloud bigquery export' aren't real bq/gcloud commands, and 'bq load' does the opposite — it imports data into BigQuery rather than exporting it.

26. 26. What is the purpose of Cloud Armor?

    B) To protect applications against DDoS attacks and application-layer (Layer 7) threats

    Cloud Armor provides DDoS protection and Layer 7 (application-layer) security policies — like blocking specific IP ranges or filtering based on request attributes — for backends behind Google Cloud load balancers. It doesn't manage SSL certificates, encrypt disks, or monitor Kubernetes clusters; those are separate, unrelated services.

27. 27. In Google Cloud, what is a project?

    B) The organisational container for resources, billing, APIs, and IAM policies

    A Google Cloud project is the top-level container that groups your resources, billing account, enabled APIs, and IAM policies together — essentially the basic unit of organization and access control in GCP. It isn't a VM type, a network subnet, or a storage bucket; those all live inside a project, not the other way around.

28. 28. What is the purpose of Cloud CDN?

    B) To cache content at Google's global edge locations for faster delivery to users

    Cloud CDN caches eligible content at Google's globally distributed edge locations, so repeat requests are served from a location physically closer to the user, reducing latency and origin load. It doesn't manage DNS, create VPN tunnels, or run serverless functions — those are handled by Cloud DNS, Cloud VPN, and Cloud Functions/Cloud Run respectively.

29. 29. Which service provides a managed, serverless event-driven compute platform for running small functions?

    C) Cloud Functions

    Cloud Functions is Google Cloud's serverless, event-driven compute platform purpose-built for running small, single-purpose functions triggered by events like an HTTP request or a Pub/Sub message. Cloud Run also runs serverless containers but is built around full request/response services rather than small individual functions, App Engine is a broader PaaS platform for whole applications, and GKE requires managing a Kubernetes cluster.

30. 30. What should you do to prevent a specific VM instance from being deleted accidentally?

    B) Enable deletion protection on the instance

    Enabling deletion protection on a Compute Engine instance blocks it from being deleted — accidentally or otherwise — until that protection is explicitly turned off, which directly addresses the scenario described. A reserved IP only protects the address, not the instance itself, moving projects doesn't prevent deletion, and roles/viewer is a permissions setting unrelated to a specific instance's deletion protection flag.

Curriculum Mapping & Learning Guide

Use this breakdown to identify which skills each question tests and guide post-test review.

Google Cloud Associate Cloud Engineer (ACE) GCP units covered

1. Chapter 1: Setting Up the Cloud Environment: Restricting platform permissions using IAM roles, establishing folders, and initializing the gcloud environment.
2. Chapter 2: Planning & Configuring: Distinguishing Cloud SQL from Spanner, selecting container runtimes, and designing VPC networks.
3. Chapter 3: Deploying & Implementing: Launching Compute Engine instance groups, building container images, and updating serverless Cloud Run applications.
4. Chapter 4: Ensuring Successful Operation: Collecting logs via Cloud Logging, building monitoring dashboards, and configuring uptime alerts.
5. Chapter 5: Configuring Access & Security: Implementing service security boundaries, locking deletion options, and auditing Binary Authorization rules.