Cloud Engineer Associate Cloud Engineer v1.0 2 — Questions and Answers
Question 1: Your team needs to grant a developer read-only access to all Cloud Storage buckets in a project without affecting other resources. Which IAM role should you assign at the project level?
- roles/storage.objectViewer (Correct answer)
- roles/storage.admin
- roles/viewer
- roles/storage.legacyBucketReader
Correct answer: roles/storage.objectViewer
roles/storage.objectViewer grants read access to objects in all buckets within the project without broader project-level permissions.
Question 2: A GKE cluster needs to pull private container images from Artifact Registry in the same project. What is the recommended approach?
- Grant the node pool's service account roles/artifactregistry.reader (Correct answer)
- Use the default Compute Engine service account with no changes
- Embed Docker credentials as a Kubernetes Secret
- Enable the Artifact Registry API and no further action is needed
Correct answer: Grant the node pool's service account roles/artifactregistry.reader
Assigning roles/artifactregistry.reader to the node pool's service account follows least-privilege and is the GCP-recommended method.
Question 3: You want to deploy a containerized batch job that runs to completion and does not need to serve HTTP traffic. Which Google Cloud service is most appropriate?
- Cloud Run Jobs (Correct answer)
- Cloud Run Services
- App Engine Standard
- Cloud Functions
Correct answer: Cloud Run Jobs
Cloud Run Jobs are designed for containerized workloads that run to completion rather than serving ongoing requests.
Question 4: A Cloud SQL instance is running out of storage. Which setting should you enable to avoid downtime from a full disk?
- Automatic storage increase (Correct answer)
- Read replicas
- Failover replica
- Point-in-time recovery
Correct answer: Automatic storage increase
Enabling automatic storage increase allows Cloud SQL to expand disk capacity automatically when it reaches a threshold.
Question 5: Which gcloud command lists all VM instances across every zone in a project?
- gcloud compute instances list --zones=all
- gcloud compute instances list (Correct answer)
- gcloud compute instances list --global
- gcloud compute instances describe --all-zones
Correct answer: gcloud compute instances list
gcloud compute instances list without zone flags returns instances from all zones in the current project by default.
Question 6: You need to schedule a lightweight script to run every 5 minutes without managing servers. Which service combination is most cost-effective?
- Cloud Scheduler triggering a Cloud Function (Correct answer)
- Compute Engine cron job
- GKE CronJob
- Cloud Composer DAG
Correct answer: Cloud Scheduler triggering a Cloud Function
Cloud Scheduler invoking a Cloud Function is serverless, scales to zero, and is cheapest for infrequent lightweight tasks.
Question 7: A VPC network has a firewall rule allowing SSH from 0.0.0.0/0. You want to restrict SSH access to only your corporate IP range (203.0.113.0/24). What is the correct action?
- Create a higher-priority deny rule for 0.0.0.0/0 and an allow rule for 203.0.113.0/24
- Delete the existing allow rule and create a new allow rule for 203.0.113.0/24
- Change the existing rule's source range to 203.0.113.0/24 (Correct answer)
- Add 203.0.113.0/24 as a target tag on the existing rule
Correct answer: Change the existing rule's source range to 203.0.113.0/24
Editing the source IP range of the existing firewall rule directly restricts SSH to the specified corporate range.
Cloud Engineer Associate Cloud Engineer v1.0 2
Your team needs to grant a developer read-only access to all Cloud Storage buckets in a project without affecting other resources.
Which IAM role should you assign at the project level?