Google Cloud Engineer Associate Practice Exam

1. 1.You must grant a colleague permission to view all resources in the project my-app-prod using the command line, without giving them any ability to modify anything. Which gcloud command accomplishes this?

   • Agcloud compute instances add-iam-policy-binding my-app-prod --member=user:colleague@example.com --role=roles/viewer
   • Bgcloud iam roles create viewer --project=my-app-prod --member=user:colleague@example.com
   • Cgcloud projects add-iam-policy-binding my-app-prod --member=user:colleague@example.com --role=roles/editor
   • Dgcloud projects add-iam-policy-binding my-app-prod --member=user:colleague@example.com --role=roles/viewerCorrect answer

   Why

   Adding an IAM policy binding on the project with the roles/viewer role grants read-only access across the project's services. The add-iam-policy-binding subcommand modifies the project's IAM policy in place. The compute-scoped commands operate on a single resource rather than the project, and roles/editor would grant modification rights the requirement forbids.

2. 2.A new project has been created and your first deployment fails with an error stating that the Compute Engine API has not been used in the project before or is disabled. What must you do?

   • ARun gcloud services enable compute.googleapis.com on the projectCorrect answer
   • BRaise the budget threshold on the linked billing account
   • CGrant your account the Compute Admin role on the project
   • DRequest a quota increase for CPUs in the target region

   Why

   Enable the API on the project with gcloud services enable compute.googleapis.com, since APIs must be explicitly enabled per project before their resources can be created. The failure is not about IAM roles, quota, or billing thresholds: the message specifically reports that the service itself is not enabled, and granting roles or raising quota will not change that.

3. 3.Finance wants an email sent to the billing administrators when a project's forecasted monthly spend reaches ninety percent of the allocated amount, and wants spending to continue uninterrupted. What should you configure?

   • AAn organization policy that blocks resource creation above a cost limit
   • BA budget scoped to the project with a ninety percent forecasted-spend alert thresholdCorrect answer
   • CA quota override capping the project's vCPU usage
   • DUnlinking the billing account when the threshold is reached

   Why

   Create a budget on the billing account scoped to that project with an alert threshold rule at ninety percent, including forecasted spend. Budgets are notification mechanisms and do not stop resource usage, which matches the requirement that spending continue. Removing the billing account or applying a quota override would actually interrupt the workload.

4. 4.You need detailed, line-item Google Cloud usage and cost data that can be queried with SQL and joined against internal cost center tables. What should you set up?

   • ABudget alerts at multiple thresholds
   • BA monthly CSV download of the invoice
   • CThe cost breakdown report in the Cloud Console
   • DBilling export to a BigQuery datasetCorrect answer

   Why

   Configure Cloud Billing export to a BigQuery dataset, which continuously writes detailed usage and cost rows that can be queried with SQL and joined to other tables. The console reports offer summarized views without SQL access, a CSV download is a manual point-in-time snapshot, and budget alerts convey thresholds rather than line-item data.

5. 5.Your organization must ensure that every project created under the Production folder blocks the creation of Compute Engine instances with external IP addresses. What should you apply?

   • AAn egress firewall rule denying all internet-bound traffic in each project
   • BRemoving the Compute Admin role from all users in each project
   • CA Cloud Monitoring alert that fires when an external IP is assigned
   • DAn organization policy constraint denying external IPs, applied at the folderCorrect answer

   Why

   Apply the organization policy constraint that denies external IP addresses for VM instances at the Production folder, where it is inherited by all current and future descendant projects and enforced regardless of a caller's IAM role. Firewall rules do not prevent an address from being assigned, and per-project IAM changes neither cover new projects nor bind project Owners.

Practice all 65 questions

Frequently asked questions