{"id":12990,"date":"2026-09-16T05:52:10","date_gmt":"2026-09-16T05:52:10","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=12990"},"modified":"2026-09-16T05:52:10","modified_gmt":"2026-09-16T05:52:10","slug":"google-associate-cloud-engineer-practice-test-questions-and-exam-dumps-part2-q21-40","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/google-associate-cloud-engineer-practice-test-questions-and-exam-dumps-part2-q21-40\/","title":{"rendered":"Google Associate Cloud Engineer Practice Test Questions and Exam Dumps Part2 Q21-40"},"content":{"rendered":"

View Full Google Associate Cloud Engineer Exam Dumps<\/a> and Practice Test Dumps<\/b><\/p>\n

 <\/p>\n

Q21. Which Google Cloud service should you use to store sensitive application credentials such as API keys and passwords?<\/b><\/p>\n

1)<\/b> Cloud Storage<\/span>
\n<\/span>2)<\/b> Secret Manager<\/span>
\n<\/span>3)<\/b> BigQuery<\/span>
\n<\/span>4)<\/b> Cloud Scheduler<\/span><\/p>\n

Correct Answer: 2)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

Secret Manager is designed to securely store, manage, and retrieve sensitive information such as API keys, passwords, certificates, and other application credentials. Applications can access secrets without embedding sensitive values directly into source code or configuration files. Secret Manager also supports versioning and IAM-based access control, allowing administrators to restrict which identities can access particular secrets. Cloud Storage is intended for object data, BigQuery provides analytics, and Cloud Scheduler executes scheduled jobs. Using Secret Manager helps reduce the risk of exposing credentials through source repositories or application configuration while providing centralized control over sensitive application data.<\/span><\/p>\n

Q22. A company needs to deploy an application across multiple Compute Engine VMs using the same configuration. Which resource should be created first?<\/b><\/p>\n

1)<\/b> Instance template<\/span>
\n<\/span>2)<\/b> Cloud DNS record<\/span>
\n<\/span>3)<\/b> Storage bucket<\/span>
\n<\/span>4)<\/b> BigQuery table<\/span><\/p>\n

Correct Answer: 1)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

An instance template defines the configuration used to create Compute Engine virtual machine instances consistently. It can specify properties such as machine type, boot disk image, network configuration, labels, and service account settings. Managed instance groups commonly use instance templates to create identical VM instances and support scaling, automatic repair, and rolling updates. Creating an instance template helps ensure that every VM in the group uses a standardized configuration. Cloud DNS records, Storage buckets, and BigQuery tables serve different purposes. When multiple Compute Engine instances need to be created with the same configuration, an instance template is the appropriate starting point.<\/span><\/p>\n

Q23. Which Google Cloud service allows applications to execute code in response to events without managing servers?<\/b><\/p>\n

1)<\/b> Cloud Functions<\/span>
\n<\/span>2)<\/b> Compute Engine<\/span>
\n<\/span>3)<\/b> Cloud SQL<\/span>
\n<\/span>4)<\/b> Cloud Storage<\/span><\/p>\n

Correct Answer: 1)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

Cloud Functions provides a serverless execution environment for running code in response to events or HTTP requests. Developers can deploy individual functions without managing the underlying virtual machines or operating system. Functions can respond to events from Google Cloud services and other supported sources, making them useful for event-driven processing, automation, lightweight APIs, and background tasks. Compute Engine requires VM management, Cloud SQL provides managed relational databases, and Cloud Storage provides object storage. Cloud Functions is therefore appropriate when an application needs small, event-driven pieces of code that can scale automatically without requiring administrators to manage server infrastructure.<\/span><\/p>\n

Q24. A Compute Engine VM needs persistent block storage that remains available even if the VM is deleted. Which storage option should be used?<\/b><\/p>\n

1)<\/b> Persistent Disk<\/span>
\n<\/span>2)<\/b> Cloud DNS<\/span>
\n<\/span>3)<\/b> Pub\/Sub topic<\/span>
\n<\/span>4)<\/b> Cloud Monitoring<\/span><\/p>\n

Correct Answer: 1)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

Persistent Disk provides durable block storage for Compute Engine virtual machines. Persistent disks are independent storage resources that can remain available even when a VM is deleted, depending on the configured deletion behavior. They can be attached to VM instances and used for operating system disks or application data. This makes Persistent Disk useful when workloads require durable block storage rather than temporary local storage. Cloud DNS manages domain resolution, Pub\/Sub handles messaging, and Cloud Monitoring collects operational metrics. Administrators should also select an appropriate disk type and size based on performance, capacity, availability, and workload requirements.<\/span><\/p>\n

Q25. Which Google Cloud service provides a managed Kubernetes environment for deploying containerized applications?<\/b><\/p>\n

1)<\/b> Cloud Run<\/span>
\n<\/span>2)<\/b> Google Kubernetes Engine<\/span>
\n<\/span>3)<\/b> Cloud Storage<\/span>
\n<\/span>4)<\/b> Cloud SQL<\/span><\/p>\n

Correct Answer: 2)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

Google Kubernetes Engine, or GKE, is a managed Kubernetes service that allows organizations to deploy and operate containerized applications using Kubernetes. Google Cloud manages significant parts of the Kubernetes infrastructure while providing access to Kubernetes capabilities such as deployments, services, autoscaling, and workload management. Cloud Run is a fully managed container execution platform but does not provide the same Kubernetes control plane and orchestration model. Cloud Storage provides object storage, while Cloud SQL provides relational database capabilities. GKE is appropriate when a development team needs Kubernetes features and control while reducing the operational burden associated with managing Kubernetes infrastructure.<\/span><\/p>\n

Q26. A company wants to prevent users from accessing a Cloud Storage bucket anonymously. Which configuration should be enabled?<\/b><\/p>\n

1)<\/b> Public access prevention<\/span>
\n<\/span>2)<\/b> Cloud Scheduler<\/span>
\n<\/span>3)<\/b> Cloud NAT<\/span>
\n<\/span>4)<\/b> BigQuery reservations<\/span><\/p>\n

Correct Answer: 1)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

Cloud Storage public access prevention can be used to prevent buckets and objects from being exposed publicly through IAM or access control configurations. This is useful for organizations that need to enforce a security policy requiring storage resources to remain private. Instead of relying on individual administrators to avoid granting public access, public access prevention provides a stronger organizational safeguard. Cloud Scheduler is used for scheduled tasks, Cloud NAT provides outbound internet connectivity for private resources, and BigQuery reservations relate to analytical workloads. When an organization needs to ensure that Cloud Storage data cannot be publicly exposed, public access prevention is an appropriate control.<\/span><\/p>\n

Q27. Which Google Cloud service provides managed outbound internet connectivity for resources that do not have external IP addresses?<\/b><\/p>\n

1)<\/b> Cloud NAT<\/span>
\n<\/span>2)<\/b> Cloud DNS<\/span>
\n<\/span>3)<\/b> Cloud Storage<\/span>
\n<\/span>4)<\/b> Cloud Logging<\/span><\/p>\n

Correct Answer: 1)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

Cloud NAT provides network address translation for resources that need to initiate outbound connections to the internet without requiring external IP addresses. It is commonly used with private Compute Engine instances that need to download updates, access external APIs, or communicate with public services while remaining unreachable from unsolicited inbound internet traffic. Cloud NAT supports outbound connectivity while keeping the instances private. Cloud DNS handles domain resolution, Cloud Storage provides object storage, and Cloud Logging handles logs. Using Cloud NAT can therefore help organizations maintain private VM configurations while still allowing controlled outbound internet access.<\/span><\/p>\n

Q28. Which Google Cloud service provides a managed message queue for publishing and consuming application events asynchronously?<\/b><\/p>\n

1)<\/b> Cloud Pub\/Sub<\/span>
\n<\/span>2)<\/b> Cloud SQL<\/span>
\n<\/span>3)<\/b> Compute Engine<\/span>
\n<\/span>4)<\/b> Cloud DNS<\/span><\/p>\n

Correct Answer: 1)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

Cloud Pub\/Sub is a managed messaging service that supports asynchronous communication between independent application components. Publishers send messages to topics, while subscribers receive messages through subscriptions. This architecture allows producers and consumers to operate independently and at different speeds, improving application scalability and resilience. Pub\/Sub can also support event-driven architectures and data ingestion pipelines. Cloud SQL is designed for relational data, Compute Engine provides virtual machines, and Cloud DNS manages DNS records. When an application requires a managed messaging system that decouples services and supports asynchronous event delivery, Cloud Pub\/Sub is an appropriate Google Cloud service.<\/span><\/p>\n

Q29. An administrator wants to assign permissions to a group of users instead of configuring each user individually. Which IAM principal should be used?<\/b><\/p>\n

1)<\/b> Individual user account only<\/span>
\n<\/span>2)<\/b> Google Group<\/span>
\n<\/span>3)<\/b> Compute Engine disk<\/span>
\n<\/span>4)<\/b> VPC subnet<\/span><\/p>\n

Correct Answer: 2)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

Google Groups can be used as IAM principals so that permissions can be granted to a group rather than individually to every user. This simplifies access management because administrators can add or remove users from the group without changing the IAM policy each time. Group-based permissions are especially useful for organizations with teams that share similar responsibilities. When a user’s role changes, administrators can update group membership rather than manually modifying multiple resource policies. Compute Engine disks and VPC subnets are infrastructure resources, not IAM principals. Using groups can therefore make permissions easier to manage and support more consistent access control.<\/span><\/p>\n

Q30. Which IAM concept determines whether an identity can perform a specific operation on a Google Cloud resource?<\/b><\/p>\n

1)<\/b> Permission<\/span>
\n<\/span>2)<\/b> Region<\/span>
\n<\/span>3)<\/b> Machine type<\/span>
\n<\/span>4)<\/b> Storage class<\/span><\/p>\n

Correct Answer: 1)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

An IAM permission determines whether an identity is allowed to perform a specific action on a Google Cloud resource. Permissions are typically included within IAM roles, and administrators grant appropriate roles to users, groups, or service accounts. For example, a role may contain permissions allowing an identity to view or modify Compute Engine resources. Regions determine resource locations, machine types define VM characteristics, and storage classes determine object-storage behavior. Understanding the relationship between principals, roles, and permissions is fundamental to Google Cloud access management. Administrators should grant only the permissions necessary for a workload or user to perform its required responsibilities.<\/span><\/p>\n

Q31. A company needs to deploy a static website using files stored in Google Cloud. Which service can host the website content?<\/b><\/p>\n

1)<\/b> Cloud Storage<\/span>
\n<\/span>2)<\/b> Cloud SQL<\/span>
\n<\/span>3)<\/b> Cloud Pub\/Sub<\/span>
\n<\/span>4)<\/b> Cloud Scheduler<\/span><\/p>\n

Correct Answer: 1)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

Cloud Storage can host static website content consisting of files such as HTML, CSS, JavaScript, images, and other static resources. A storage bucket can be configured for website-related use cases, while additional services can be used for custom domains, HTTPS, caching, or more advanced delivery requirements. Cloud SQL is a relational database service, Pub\/Sub provides messaging, and Cloud Scheduler handles scheduled jobs. Static website hosting is appropriate when the application does not require server-side processing. For dynamic applications that need backend execution, developers may instead consider services such as Cloud Run or Compute Engine.<\/span><\/p>\n

Q32. Which Google Cloud service provides a globally distributed relational database with strong consistency and horizontal scalability?<\/b><\/p>\n

1)<\/b> Cloud SQL<\/span>
\n<\/span>2)<\/b> Cloud Spanner<\/span>
\n<\/span>3)<\/b> Cloud Storage<\/span>
\n<\/span>4)<\/b> Bigtable<\/span><\/p>\n

Correct Answer: 2)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

Cloud Spanner is a managed relational database service designed for global scale, strong consistency, and high availability. It combines relational database capabilities, including SQL and transactional consistency, with horizontal scalability across regions. This makes it useful for applications that need a globally distributed relational database rather than a database limited to a smaller deployment footprint. Cloud SQL provides managed traditional relational databases, Cloud Storage provides object storage, and Bigtable is a NoSQL database. Cloud Spanner is particularly appropriate for mission-critical applications that require relational semantics while operating at large scale across multiple geographic locations.<\/span><\/p>\n

Q33. Which command-line tool is commonly used to interact with Google Cloud resources from a terminal?<\/b><\/p>\n

1)<\/b> gcloud<\/span>
\n<\/span>2)<\/b> kubectl only<\/span>
\n<\/span>3)<\/b> npm<\/span>
\n<\/span>4)<\/b> git<\/span><\/p>\n

Correct Answer: 1)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

The Google Cloud CLI provides the <\/span>gcloud<\/span> command-line tool for managing many Google Cloud resources from a terminal. Administrators and developers can use it to create and manage Compute Engine resources, configure projects, work with IAM, deploy applications, and perform many other cloud operations. <\/span>kubectl<\/span> is primarily used to interact with Kubernetes clusters, while npm manages Node.js packages and git manages source-code repositories. The <\/span>gcloud<\/span> tool is particularly useful for automation, scripting, administration, and CI\/CD workflows where cloud operations need to be performed programmatically rather than through the Google Cloud console.<\/span><\/p>\n

Q34. A team wants to monitor an application and automatically receive an alert when an important metric exceeds a threshold. What should they configure?<\/b><\/p>\n

1)<\/b> Cloud Storage lifecycle rule<\/span>
\n<\/span>2)<\/b> Cloud Monitoring alerting policy<\/span>
\n<\/span>3)<\/b> Cloud DNS record<\/span>
\n<\/span>4)<\/b> Pub\/Sub topic only<\/span><\/p>\n

Correct Answer: 2)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

A Cloud Monitoring alerting policy evaluates selected metrics or conditions and can send notifications when a defined threshold or condition is met. For example, an administrator could create an alert when CPU utilization remains above a specific percentage for a defined period. Notification channels can be configured so that responsible teams receive alerts through supported methods. A Pub\/Sub topic may be used as one possible notification destination, but creating a topic alone does not evaluate monitoring conditions. Cloud Storage lifecycle rules manage stored objects, while Cloud DNS manages domain resolution. Alerting policies are therefore the appropriate mechanism for automated metric-based operational notifications.<\/span><\/p>\n

Q35. Which Google Cloud service can automatically scale a serverless container application based on incoming requests?<\/b><\/p>\n

1)<\/b> Cloud Run<\/span>
\n<\/span>2)<\/b> Cloud Storage<\/span>
\n<\/span>3)<\/b> Cloud DNS<\/span>
\n<\/span>4)<\/b> Cloud SQL<\/span><\/p>\n

Correct Answer: 1)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

Cloud Run automatically manages the infrastructure required to execute containerized applications and can scale application instances based on incoming traffic. This makes it useful for HTTP services, APIs, web applications, and other workloads packaged as containers. When demand increases, Cloud Run can create additional instances, while instances can scale down when demand decreases according to configured behavior. Cloud Storage handles object storage, Cloud DNS provides DNS management, and Cloud SQL provides relational databases. Cloud Run is particularly useful when developers want container flexibility and automatic scaling without having to manage virtual machines or Kubernetes clusters.<\/span><\/p>\n

Q36. An organization needs to transfer large amounts of data into Google Cloud from an on-premises environment. Which service can be used for an offline physical data transfer?<\/b><\/p>\n

1)<\/b> Transfer Appliance<\/span>
\n<\/span>2)<\/b> Cloud DNS<\/span>
\n<\/span>3)<\/b> Cloud Scheduler<\/span>
\n<\/span>4)<\/b> Cloud Monitoring<\/span><\/p>\n

Correct Answer: 1)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

Google Cloud Transfer Appliance is designed for moving large volumes of data to Google Cloud using a physical appliance. Instead of transferring all data over an internet connection, an organization can load data onto the appliance and send it to Google for ingestion into cloud storage. This can be useful when datasets are extremely large, network bandwidth is limited, or online transfer would take an impractical amount of time. Cloud DNS, Cloud Scheduler, and Cloud Monitoring provide networking, scheduling, and observability capabilities. Transfer Appliance is therefore a suitable option for large-scale offline data migration scenarios.<\/span><\/p>\n

Q37. Which Google Cloud resource organizes services and resources into a logical administrative boundary and is required for many Google Cloud operations?<\/b><\/p>\n

1)<\/b> Project<\/span>
\n<\/span>2)<\/b> Subnet<\/span>
\n<\/span>3)<\/b> Zone<\/span>
\n<\/span>4)<\/b> Instance template<\/span><\/p>\n

Correct Answer: 1)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

A Google Cloud project provides a fundamental organizational and administrative boundary for resources and services. Resources such as Compute Engine instances, Cloud Storage buckets, APIs, and many other services are associated with projects. Projects also provide a context for billing, IAM policies, service usage, and resource organization. Folders and organizations can be used above the project level for broader management, while subnets and zones represent networking and resource-location concepts. Understanding projects is essential because many Google Cloud commands and APIs require a project context before resources can be created, managed, or accessed.<\/span><\/p>\n

Q38. Which Google Cloud concept determines the physical or geographic area where a resource is deployed?<\/b><\/p>\n

1)<\/b> IAM role<\/span>
\n<\/span>2)<\/b> Region or zone<\/span>
\n<\/span>3)<\/b> Service account<\/span>
\n<\/span>4)<\/b> Firewall rule<\/span><\/p>\n

Correct Answer: 2)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

Google Cloud uses regions and zones to define the geographic locations where resources are deployed. A region represents a geographic area containing multiple zones, while a zone is a deployment area within a region. Many Compute Engine resources are associated with a specific zone or region, depending on their type. Choosing an appropriate location can affect latency, availability, compliance, and disaster-recovery design. IAM roles control permissions, service accounts provide identities, and firewall rules control network traffic. Understanding the distinction between regions and zones is important when designing highly available and geographically appropriate Google Cloud architectures.<\/span><\/p>\n

Q39. A company wants to give an application temporary access to a Cloud Storage object without making the entire bucket public. Which option is appropriate?<\/b><\/p>\n

1)<\/b> Signed URL<\/span>
\n<\/span>2)<\/b> Public IAM role for all users<\/span>
\n<\/span>3)<\/b> Disable authentication<\/span>
\n<\/span>4)<\/b> Delete the bucket<\/span><\/p>\n

Correct Answer: 1)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

A signed URL can provide temporary, controlled access to a specific Cloud Storage resource without requiring the entire bucket or object to be publicly accessible. The URL contains authorization information and can be configured with an expiration time and permitted operation. This approach is useful when an application needs to allow a user to download or upload an object for a limited period. Granting public access to an entire bucket would provide much broader exposure than necessary. Signed URLs are therefore useful for delegated, temporary access scenarios where the organization wants to maintain the overall privacy of its Cloud Storage resources.<\/span><\/p>\n

Q40. Which Google Cloud service should an administrator use to inspect detailed activity records showing administrative actions performed on cloud resources?<\/b><\/p>\n

1)<\/b> Cloud Audit Logs<\/span>
\n<\/span>2)<\/b> Cloud Storage<\/span>
\n<\/span>3)<\/b> Cloud Scheduler<\/span>
\n<\/span>4)<\/b> Cloud Run<\/span><\/p>\n

Correct Answer: 1)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

Cloud Audit Logs provides records of activities and operations performed on Google Cloud resources. Audit logs can help organizations investigate administrative changes, monitor access, support security investigations, and satisfy auditing requirements. Different audit log categories capture different types of activity, including administrative operations and access to certain data. Administrators can use Cloud Logging tools to view and analyze these records. Cloud Storage, Cloud Scheduler, and Cloud Run address storage, scheduling, and application execution rather than auditing administrative activity. Audit logging is therefore an important capability for understanding who performed actions on cloud resources and when those actions occurred.<\/span><\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

View Full Google Associate Cloud Engineer Exam Dumps and Practice Test Dumps   Q21. Which Google Cloud service should you use to store sensitive application credentials such as API keys and passwords? 1) Cloud Storage 2) Secret Manager 3) BigQuery 4) Cloud Scheduler Correct Answer: 2) Explanation: Secret Manager is designed to securely store, manage, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/12990"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=12990"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/12990\/revisions"}],"predecessor-version":[{"id":13027,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/12990\/revisions\/13027"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=12990"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=12990"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=12990"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}