2026 New Associate-Cloud-Engineer Exam Questions Real Google Dumps
Course 2026 Associate-Cloud-Engineer Test Prep Training Practice Exam Download
NEW QUESTION # 217
You have an application that receives SSL-encrypted TCP traffic on port 443. Clients for this application are located all over the world. You want to minimize latency for the clients. Which load balancing option should you use?
- A. SSL Proxy Load Balancer
- B. Internal TCP/UDP Load Balancer. Add a firewall rule allowing ingress traffic from 0.0.0.0/0on the target instances.
- C. HTTPS Load Balancer
- D. Network Load Balancer
Answer: A
Explanation:
Explanation/Reference: https://cloud.google.com/load-balancing/docs/ssl
NEW QUESTION # 218
You are using Data Studio to visualize a table from your data warehouse that is built on top of BigQuery. Data is appended to the data warehouse during the day. At night, the daily summary is recalculated by overwriting the table. You just noticed that the charts in Data Studio are broken, and you want to analyze the problem. What should you do?
- A. Use Cloud Debugger to find out why the data was not refreshed correctly
- B. In Cloud Logging create a filter for your Data Studio report
- C. Review the Error Reporting page in the Cloud Console to find any errors.
- D. Use the BigQuery interface to review the nightly Job and look for any errors
Answer: D
Explanation:
https://cloud.google.com/bigquery/docs/managing-jobs#view-job.
Cloud Debugger is for inspecting apps: https://cloud.google.com/debugger/docs.
NEW QUESTION # 219
You need to manage a third-party application that will run on a Compute Engine instance. Other Compute Engine instances are already running with default configuration. Application installation files are hosted on Cloud Storage. You need to access these files from the new instance without allowing other virtual machines (VMs) to access these files. What should you do?
- A. Create a new service account and assign this service account to the new instance Grant the service account permissions on Cloud Storage.
- B. Create the instance with the default Compute Engine service account Grant the service account permissions on Cloud Storage.
- C. Create the instance with the default Compute Engine service account Add metadata to the objects on Cloud Storage that matches the metadata on the new instance.
- D. Create a new service account and assign this service account to the new instance Add metadata to the objects on Cloud Storage that matches the metadata on the new instance.
Answer: A
NEW QUESTION # 220
You created a Google Cloud Platform project with an App Engine application inside the project.
You initially configured the application to be served from the us-central region. Now you want the application to be served from the asia-northeast1 region. What should you do?
- A. Change the default region property setting in the existing GCP project to asia-northeast1.
- B. Change the region property setting in the existing App Engine application from us-central to asia- northeast1.
- C. Create a new GCP project and create an App Engine application inside this new project.
Specify asia-northeast1 as the region to serve your application. - D. Create a second App Engine application in the existing GCP project and specify asia-northeast1 as the region to serve your application.
Answer: C
Explanation:
https://cloud.google.com/appengine/docs/flexible/nodejs/an-overview-of-app-engine
NEW QUESTION # 221
Your company has multiple projects linked to a single billing account in Google Cloud. You need to visualize the costs with specific metrics that should be dynamically calculated based on company-specific criteria. You want to automate the process. What should you do?
- A. In the Google Cloud console, visualize the costs related to the projects in the Cost breakdown section.
- B. In the Google Cloud console, use the export functionality of the Cost table. Create a Looker Studio dashboard on top of the CSV export.
- C. Configure Cloud Billing data export to BigQuery for the billing account. Create a Looker Studio dashboard on top of the BigQuery export.
- D. In the Google Cloud console, visualize the costs related to the projects in the Reports section.
Answer: C
Explanation:
Cloud Billing export to BigQuery enables you to export detailed Google Cloud billing data (such as usage, cost estimates, and pricing data) automatically throughout the day to a BigQuery dataset that you specify. Then you can access your Cloud Billing data from BigQuery for detailed analysis, or use a tool like Looker Studio to visualize your data.
https://cloud.google.com/billing/docs/how-to/export-data-bigquery
NEW QUESTION # 222
While looking at your application's source code in your private Github repo, you've noticed that a service account key has been committed to git. What steps should you take next?
- A. Delete the project and create a new one.
- B. Revoke the key, remove the key from Git, purge the Git history to remove all traces of the file, ensure the key is added to the .gitignore file.
- C. Contact Google Cloud Support
- D. Do nothing. Git is fine for keys if the repo is private.
Answer: B,C
NEW QUESTION # 223
Your organization has created hundreds of service accounts for different applications hosted on-premises and in other clouds that use Google Cloud APIs. You need to audit the service account keys that have been created and identify the keys that are older than 90 days. What should you do?
- A. Execute the gcloud asset search-all-resources --scope= " organizations/[ORG_ID] " --query= " createTime < [DATE_90_DAYS_AGO] " --asset-types= " apikeys.googleapis.com/Key " --order-by= " createTime " command.
- B. Execute the gcloud asset search-all-resources --scope= " organizations/[ORG_ID] " --query= " createTime < [DATE_90_DAYS_AGO] " --asset-types= " iam.googleapis.com/ServiceAccountKey " -- order-by= " createTime " command.
- C. Execute the gcloud kms keys list --filter= " createTime < [DATE_90_DAYS_AGO] " command.
- D. Execute the gcloud iam service-accounts list --filter= " createTime < [DATE_90_DAYS_AGO] " command.
Answer: B
Explanation:
The correct answer is C because Cloud Asset Inventory can search resources across an organization and filter by asset type and creation time. The asset type iam.googleapis.com/ServiceAccountKey directly targets service account keys, which is exactly what must be audited. Using organization scope is important because the question says there are hundreds of service accounts across applications, likely distributed across projects. Cloud KMS keys are encryption keys, not service account keys, so option A searches the wrong resource type. Listing service accounts only identifies service accounts, not their individual keys or key ages. API keys are different credentials from service account keys, so option D also targets the wrong asset type. Cloud Asset Inventory is the most scalable audit method here.
NEW QUESTION # 224
Your customer has implemented a solution that uses Cloud Spanner and notices some read latency-related performance issues on one table. This table is accessed only by their users using a primary key. The table schema is shown below.
You want to resolve the issue. What should you do?
- A. Option C
- B. Option D
- C. Option B
- D. Option A
Answer: A
Explanation:
As mentioned in Schema and data model, you should be careful when choosing a primary key to not accidentally create hotspots in your database. One cause of hotspots is having a column whose value monotonically increases as the first key part, because this results in all inserts occurring at the end of your key space. This pattern is undesirable because Cloud Spanner divides data among servers by key ranges, which means all your inserts will be directed at a single server that will end up doing all the work.https://cloud.
google.com/spanner/docs/schema-design#primary-key-prevent-hotspots
NEW QUESTION # 225
You want to permanently delete a Pub/Sub topic managed by Config Connector in your Google Cloud project.
What should you do?
- A. Use kubect1 to create the label deleted-by-cnrm and to change its value to true for the topic resource.
- B. Use kubect1 to delete the topic resource.
- C. Use gcloud CLI to delete the topic.
- D. Use gcloud CLI to update the topic label managed-by-cnrm to false.
Answer: B
NEW QUESTION # 226
You are deploying a large, multi-tiered application with more than 1,000 IP addresses in a Google Cloud project that needs to be securely isolated. The application includes the:
1. web tier with frontend servers for public traffic,
2. application tier with servers running core application logic that only need access from the web tier, and
3. database tier with database servers that only need access from the application tier.
You want to minimize cost, complexity, and administrative overhead in the network architecture.
What should you do?
- A. Deploy each tier into a separate custom mode /16 VPC. Use VPC Network Peering to securely connect each custom mode VPC. Manage firewall rules individually in each VPC.
- B. Deploy each tier in a /24 VPC by using network tags to identify instances. Implement firewall rules for fine-grained network segmentation.
- C. Create one custom mode /16 VPC with three subnets. Place each tier in its own subnet and use firewall rules that reference IP subnets to control traffic.
- D. Create a /24 Shared VPC with separate subnets for each tier. Use firewall rules that reference network tags to control traffic.
Answer: C
Explanation:
A single custom mode /16 VPC provides enough private IP space for over 1,000 addresses, keeps the application isolated within one project, and minimizes cost and complexity. Placing each tier in its own subnet and controlling traffic with subnet-based firewall rules gives clear, simple segmentation between web, app, and database tiers with low administrative overhead.
NEW QUESTION # 227
Your company has embraced a hybrid cloud strategy where some of the applications are deployed on Google Cloud. A Virtual Private Network (VPN) tunnel connects your Virtual Private Cloud (VPC) in Google Cloud with your company's on-premises network. Multiple applications in Google Cloud need to connect to an on-premises database server, and you want to avoid having to change the IP configuration in all of your applications when the IP of the database changes.
What should you do?
- A. Query the Compute Engine internal DNS from the applications to retrieve the IP of the database.
- B. Create a private zone on Cloud DNS, and configure the applications with the DNS name.
- C. Configure the IP of the database as custom metadata for each instance,
- D. Configure Cloud NAT for all subnets of your VPC to be used when egressing from the VM instances.
Answer: B
Explanation:
Cloud DNS offers DNS forwarding zones and DNS server policies to allow lookups of DNS names between your on-premises and Google Cloud environment. You have multiple options for configuring DNS forwarding. The following section lists best practices for hybrid DNS setup.
These best practices are illustrated in the Reference architectures for hybrid DNS.
https://cloud.google.com/dns/docs/best-
practices#best_practices_for_dns_forwarding_zones_and_server_policies
NEW QUESTION # 228
You are building a pipeline to process time-series data. Which Google Cloud Platform services should you put in boxes 1,2,3, and 4?
- A. Cloud Pub/Sub, Cloud Dataflow, Cloud Datastore, BigQuery
- B. Cloud Pub/Sub, Cloud Storage, BigQuery, Cloud Bigtable
- C. Firebase Messages, Cloud Pub/Sub, Cloud Spanner, BigQuery
- D. Cloud Pub/Sub, Cloud Dataflow, Cloud Bigtable, BigQuery
Answer: D
NEW QUESTION # 229
You recently deployed a new version of an application to App Engine and then discovered a bug in the release. You need to immediately revert to the prior version of the application. What should you do?
- A. On the App Engine Versions page of the GCP Console, route 100% of the traffic to the previous version.
- B. On the App Engine page of the GCP Console, select the application that needs to be reverted and click Revert.
- C. Deploy the original version as a separate application.
Then go to App Engine settings and split traffic between applications so that the original version serves 100% of the requests. - D. Run gcloud app restore.
Answer: C
NEW QUESTION # 230
You have created a new project in Google Cloud through the gcloud command line interface (CLI) and linked a billing account. You need to create a new Compute Engine instance using the CLI. You need to perform the prerequisite steps. What should you do?
- A. Grant yourself the IAM role of Computer Admin.
- B. Create a VPC network in the project.
- C. Create a Cloud Monitoring Workspace.
- D. Enable the compute googleapis.com API.
Answer: D
NEW QUESTION # 231
You have downloaded and installed the gcloud command line interface (CLI) and have authenticated with your Google Account. Most of your Compute Engine instances in your project run in the europe-west1-d zone. You want to avoid having to specify this zone with each CLI command when managing these instances. What should you do?
- A. Set the europe-west1-d zone as the default zone using the gcloud config subcommand.
- B. In the Settings page for Compute Engine under Default location, set the zone to europe-west1-d.
- C. Create a Metadata entry on the Compute Engine page with key compute/zone and value europe-west1-d.
- D. In the CLI installation directory, create a file called default.conf containing zone=europe-west1-d.
Answer: A
Explanation:
Change your default zone and region in the metadata server Note: This only applies to the default configuration. You can change the default zone and region in your metadata server by making a request to the metadata server. For example: gcloud compute project-info add-metadata \ --metadata google-compute-default-region=europe-west1,google-compute-default-zone=europe-west1-b The gcloud command-line tool only picks up on new default zone and region changes after you rerun the gcloud init command. After updating your default metadata, run gcloud init to reinitialize your default configuration. https://cloud.google.com/compute/docs/gcloud-compute#change_your_default_zone_and_region_in_the_metadata_server
NEW QUESTION # 232
You need to produce a list of the enabled Google Cloud Platform APIs for a GCP project using the gcloud command line in the Cloud Shell. The project name is my-project. What should you do?
- A. Run gcloud projects listto get the project ID, and then run gcloud services list -- project <project ID>.
- B. Run gcloud infoto view the account value, and then run gcloud services list --account
- C. Run gcloud initto set the current project to my-project, and then run gcloud services list -- available.
- D. Run gcloud projects describe <project ID>to verify the project value, and then run gcloud services list --available.
Answer: A
NEW QUESTION # 233
You are building a pipeline to process time-series data. Which Google Cloud Platform services should you put in boxes 1,2,3, and 4?
- A. Cloud Pub/Sub, Cloud Dataflow, Cloud Datastore, BigQuery
- B. Cloud Pub/Sub, Cloud Storage, BigQuery, Cloud Bigtable
- C. Firebase Messages, Cloud Pub/Sub, Cloud Spanner, BigQuery
- D. Cloud Pub/Sub, Cloud Dataflow, Cloud Bigtable, BigQuery
Answer: D
NEW QUESTION # 234
You are migrating a production-critical on-premises application that requires 96 vCPUs to perform its task.
You want to make sure the application runs in a similar environment on GCP. What should you do?
- A. When creating the VM, use Intel Skylake as the CPU platform.
- B. When creating the VM, use machine type n1-standard-96.
- C. Start the VM using Compute Engine default settings, and adjust as you go based on Rightsizing Recommendations.
- D. Create the VM using Compute Engine default settings. Use gcloud to modify the running instance to have 96 vCPUs.
Answer: B
Explanation:
Ref: https://cloud.google.com/compute/docs/machine-types#n1_machine_type
NEW QUESTION # 235
You are creating an application that will run on Google Kubernetes Engine. You have identified MongoDB as the most suitable database system for your application and want to deploy a managed MongoDB environment that provides a support SLA.
What should you do?
- A. Create a Cloud Bigtable cluster and use the HBase API
- B. Download a MongoDB installation package, and run it on a Managed Instance Group
- C. Download a MongoDB installation package and run it on Compute Engine instances
- D. Deploy MongoDB Alias from the Google Cloud Marketplace
Answer: B
NEW QUESTION # 236
You have a developer laptop with the Cloud SDK installed on Ubuntu. The Cloud SDK was installed from the Google Cloud Ubuntu package repository. You want to test your application locally on your laptop with Cloud Datastore. What should you do?
- A. Install the cloud-datastore-emulator component using the gcloud components install command.
- B. Export Cloud Datastore data using gcloud datastore export.
- C. Install the google-cloud-sdk-datastore-emulator component using the apt get install command.
- D. Create a Cloud Datastore index using gcloud datastore indexes create.
Answer: A
Explanation:
* The Datastore emulator provides local emulation of the production Datastore environment. You can use the emulator to develop and test your application
* locallyRef: https://cloud.google.com/datastore/docs/tools/datastore-emulator
NEW QUESTION # 237
You built an application on your development laptop that uses Google Cloud services. Your application uses Application Default Credentials for authentication and works fine on your development laptop. You want to migrate this application to a Compute Engine virtual machine (VM) and set up authentication using Google- recommended practices and minimal changes. What should you do?
- A. Assign appropriate access for Google services to the service account used by the Compute Engine VM.
- B. Create a service account with appropriate access for Google services, and configure the application to use this account.
- C. Store credentials for service accounts with appropriate access for Google services in a config file, and deploy this config file with your application.
- D. Store credentials for your user account with appropriate access for Google services in a config file, and deploy this config file with your application.
Answer: B
Explanation:
In general, Google recommends that each instance that needs to call a Google API should run as a service account with the minimum permissions necessary for that instance to do its job. In practice, this means you should configure service accounts for your instances with the following process: Create a new service account rather than using the Compute Engine default service account. Grant IAM roles to that service account for only the resources that it needs. Configure the instance to run as that service account. Grant the instance the
https://www.googleapis.com/auth/cloud-platform scope to allow full access to all Google Cloud APIs, so that the IAM permissions of the instance are completely determined by the IAM roles of the service account.
Avoid granting more access than necessary and regularly check your service account permissions to make sure they are up-to-date.
https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances#best_practices
NEW QUESTION # 238
You want to verify the IAM users and roles assigned within a GCP project named my-project. What should you do?
- A. Run gcloud iam service-accounts list. Review the output section.
- B. Navigate to the project and then to the IAM section in the GCP Console. Review the members and roles.
- C. Navigate to the project and then to the Roles section in the GCP Console. Review the roles and status.
- D. Run gcloud iam roles list. Review the output section.
Answer: C
NEW QUESTION # 239
You have an application that uses Cloud Spanner as a database backend to keep current state information about users. Cloud Bigtable logs all events triggered by users. You export Cloud Spanner data to Cloud Storage during daily backups. One of your analysts asks you to join data from Cloud Spanner and Cloud Bigtable for specific users. You want to complete this ad hoc request as efficiently as possible. What should you do?
- A. Create a dataflow job that copies data from Cloud Bigtable and Cloud Spanner for specific users.
- B. Create two separate BigQuery external tables on Cloud Storage and Cloud Bigtable. Use the BigQuery console to join these tables through user fields, and apply appropriate filters.
- C. Create a Cloud Dataproc cluster that runs a Spark job to extract data from Cloud Bigtable and Cloud Storage for specific users.
- D. Create a dataflow job that copies data from Cloud Bigtable and Cloud Storage for specific users.
Answer: B
Explanation:
"The Cloud Spanner to Cloud Storage Text template is a batch pipeline that reads in data from a Cloud Spanner table, optionally transforms the data via a JavaScript User Defined Function (UDF) that you provide, and writes it to Cloud Storage as CSV text files."
https://cloud.google.com/dataflow/docs/guides/templates/provided-batch#cloudspannertogcstext
"The Dataflow connector for Cloud Spanner lets you read data from and write data to Cloud Spanner in a Dataflow pipeline"
https://cloud.google.com/spanner/docs/dataflow-connector
https://cloud.google.com/bigquery/external-data-sources
NEW QUESTION # 240
......
Associate-Cloud-Engineer Exam Info and Free Practice Test Professional Quiz Study Materials: https://whizlabs.actual4dump.com/Google/Associate-Cloud-Engineer-actualtests-dumps.html