GCP ACE practice exam: 500 questions with full explanations

Questions on the exam

about 55 — vendor indicates, no fixed count published

Time allowed

120 minutes format →

Exam fee

$125 — vendor, checked September 4, 2026 detail →

500 practice exam questions for Google Associate Cloud Engineer, grouped by exam domain. Every question below shows all four options, which one is correct, and why each of the other three is not — the wrong answers are where most candidates lose marks.

Not sure where you stand? Take the free 5-min GCP ACE readiness check →

GCP ACE exam format →  ·  GCP ACE passing score →  · GCP ACE exam cost →

Questions by domain

• Deploying and implementing a cloud solution — 158 questions →
• Planning and configuring a cloud solution — 108 questions →
• Ensuring successful operation of a cloud solution — 96 questions →
• Configuring access and security — 77 questions →
• Setting up a cloud solution environment — 61 questions →

Sample questions

Spot VMs: Which Compute Engine pricing model is most appropriate?

1. Sustained Use Discounts (SUDs)

   Incorrect. Sustained Use Discounts are automatic discounts applied when you use a VM for more than 25% of a month. They apply to N1, N2, N2D, and C2 machine types. For 4-6 hour batch jobs run occasionally, SUDs would provide minimal discount and are far less impactful than Spot pricing.
2. Spot VMs ✓

   Correct. Spot VMs offer up to 91% discount over on-demand pricing. They can be preempted by Google when capacity is needed, but since the jobs can be checkpointed and restarted, preemption is handled gracefully. Spot VMs are the evolution of Preemptible VMs with no maximum 24-hour runtime constraint.
3. On-demand (standard) pricing

   Incorrect. Standard on-demand pricing is the most expensive option. Since cost reduction is the primary goal and the workload tolerates interruption with checkpointing, there is no reason to use full-price VMs.
4. Committed Use Discounts (CUDs) — 1-year commitment

   Incorrect. Committed Use Discounts (55-70% savings) require a 1 or 3-year commitment for a specific amount of compute. While cost-effective for steady-state workloads, they are not ideal for intermittent batch jobs and don't provide the same savings as Spot VMs for batch workloads.

All 158 Deploying and implementing a cloud solution questions →

Memory-optimized machine family: Which Compute Engine machine family is designed for this requirement?

1. General-purpose machine family (N2 series)

   Incorrect. N2 general-purpose machines balance CPU and memory for a wide range of workloads but top out at far less than 12 TB RAM. They are not designed for extreme memory requirements.
2. Memory-optimized machine family (M2 series) ✓

   Correct. The M2 memory-optimized machine family is designed specifically for memory-intensive workloads like in-memory databases and analytics. M2 instances offer up to 12 TB of RAM, making them the correct choice for this scenario.
3. Accelerator-optimized machine family (A2 series)

   Incorrect. A2 accelerator-optimized instances are designed for GPU-intensive workloads like machine learning training and HPC. While they can have significant RAM, they are not the family optimized for multi-TB in-memory analytics without GPU requirements.
4. Compute-optimized machine family (C2 series)

   Incorrect. C2 compute-optimized instances prioritize high per-core CPU performance (Intel Cascade Lake) for CPU-intensive tasks like scientific modeling. They are not designed for ultra-high memory configurations.

All 108 Planning and configuring a cloud solution questions →

An alerting policy with a metric threshold condition: What should they configure in Cloud Monitoring?

1. An uptime check in Cloud Monitoring targeting the production Compute Engine instances that pages the SRE team when connectivity probes fail for over 5 minutes

   Incorrect. Uptime checks only verify endpoint reachability over HTTP, HTTPS, or TCP; they never measure CPU utilization, so they cannot alert on the described performance threshold.
2. A Cloud Logging log-based alert that parses VM log entries for CPU warnings and sends a PagerDuty notification to the SRE team whenever that pattern recurs on production instances

   Incorrect. Log-based alerts fire on log-text patterns, but CPU utilization is a metric, not a log entry, so a Cloud Monitoring metric-threshold alerting policy is the correct tool.
3. An alerting policy with a metric threshold condition on compute.googleapis.com/instance/cpu/utilization, a 5-minute alignment window, and a PagerDuty notification channel ✓

   Correct. Cloud Monitoring alerting policies consist of conditions (metric type, threshold, duration) and notification channels. The CPU utilization metric is compute.googleapis.com/instance/cpu/utilization. A condition duration of 5 minutes ensures the alert fires only if the threshold is sustained. PagerDuty is a supported notification channel.
4. A Cloud Scheduler job that polls the Cloud Monitoring API every minute and invokes PagerDuty whenever any instance reports CPU utilization above 80 percent

   Incorrect. A custom Cloud Scheduler polling loop is far more complex to build and maintain than Cloud Monitoring's native, managed alerting policies designed for exactly this case.

All 96 Ensuring successful operation of a cloud solution questions →

The action is denied because an IAM Deny policy takes: What happens?

1. The action is allowed because the Folder-level roles/editor grant includes storage.objects.create, and Folder grants inherit down

   Incorrect. While IAM allow policies do inherit down the hierarchy (Folder editor to Project permissions), IAM Deny policies take precedence over all allow policies. The explicit deny at the Project level overrides the inherited allow from the Folder.
2. The action is denied because an IAM Deny policy takes precedence over allow bindings at any level of the resource hierarchy ✓

   Correct. IAM Deny policies were introduced to explicitly block specific permissions regardless of allow policies. When an IAM Deny policy denies a permission, that deny takes precedence over any allow bindings at any level of the resource hierarchy. The project-level deny on storage.objects.create prevents the action.
3. The action is denied because Project-level policies always override Folder-level policies regardless of deny policies

   Incorrect. In standard IAM allow policy inheritance, more specific (lower in hierarchy) allow policies do not 'override' broader ones - they are additive. The reason the action is denied is specifically because of the IAM Deny policy, not because project policies override folder policies in general.
4. The action is allowed because the Organization-level viewer role provides baseline access that cannot be revoked at lower levels

   Incorrect. IAM allow policies are additive and inherited (you can't revoke an inherited allow via another allow), but IAM Deny policies can explicitly block permissions at any level. The deny policy overrides the viewer role's permissions.

All 77 Configuring access and security questions →

A Google Cloud Project: What is the most fundamental unit of organization you should create first?

1. A Google Cloud Project ✓

   Correct. A Google Cloud Project is the fundamental organizing unit in GCP. It provides a logical boundary for resources, enables separate billing, and controls access via IAM. Every GCP resource must belong to a project.
2. A Google Cloud Folder

   Incorrect. Folders are used to group projects within an organization for policy inheritance and organizational hierarchy, but resources are not deployed directly into folders — they belong to projects.
3. A Google Cloud Organization

   Incorrect. An Organization is the top-level node in the GCP resource hierarchy and represents your company domain. It contains folders and projects, but is not the unit where resources are deployed or where billing is tracked at the team level.
4. A Billing Account

   Incorrect. A Billing Account is used to pay for GCP usage, but it is not a resource container. One billing account can be linked to multiple projects, but it does not provide resource isolation on its own.

All 61 Setting up a cloud solution environment questions →

gcloud container clusters get-credentials [CLUSTER]: Which sequence of commands is correct?

1. kubectl create deployment [NAME] --image=[IMAGE] --replicas=3 --port=8080, then gcloud container clusters get-credentials [CLUSTER] --region [REGION]

   Incorrect. kubectl needs cluster credentials configured before it can reach the GKE API server, so running kubectl create before gcloud ... get-credentials fails with an authentication error.
2. gcloud container clusters create [CLUSTER] --region [REGION] --num-nodes=3, then kubectl run [NAME] --image=[IMAGE] --replicas=3 --port=8080

   Incorrect. The cluster already exists, so gcloud container clusters create is wrong, and kubectl run creates a single Pod rather than a 3-replica Deployment as required.
3. gcloud container clusters get-credentials [CLUSTER] --region [REGION], then kubectl create deployment [NAME] --image=[IMAGE] --replicas=3 --port=8080 ✓

   Correct. First, gcloud container clusters get-credentials fetches the cluster credentials and configures kubectl's kubeconfig. Then kubectl create deployment creates the Deployment with the specified image, replica count, and port.
4. gcloud compute instances list --zones [ZONE], then kubectl apply -f deployment.yaml --namespace default --context [CLUSTER]

   Incorrect. gcloud compute instances list shows VMs and never configures kubectl; credentials must come from gcloud container clusters get-credentials before any kubectl apply.

All 158 Deploying and implementing a cloud solution questions →

GKE Autopilot mode: Which GKE mode should they choose?

1. GKE Regional Cluster

   Incorrect. A GKE Regional Cluster distributes the control plane and nodes across multiple zones for high availability. Like Private Cluster, it is a cluster topology configuration, not a management mode — it does not automate node lifecycle management.
2. GKE Standard mode

   Incorrect. GKE Standard mode gives you full control over node configuration, node pool management, and cluster settings. While Google manages the control plane, you are responsible for managing, scaling, and patching the nodes.
3. GKE Autopilot mode ✓

   Correct. GKE Autopilot is a fully managed mode where Google manages the entire cluster infrastructure — nodes, node pools, scaling, patching, and security hardening. You pay per Pod resource requests and only interact with the Kubernetes control plane to deploy workloads.
4. GKE Private Cluster

   Incorrect. A GKE Private Cluster is a network configuration option (nodes have only private IP addresses) that applies to both Standard and Autopilot modes. It is not an operational mode that eliminates node management.

All 108 Planning and configuring a cloud solution questions →

Create a log sink that routes all audit logs to a Cloud: What is the most efficient solution?

1. Enable Cloud Audit Logs and configure them to write directly to BigQuery with a 5-year dataset expiration

   Incorrect. While a log sink to BigQuery is valid for audit log analysis, BigQuery is more expensive for long-term archiving than Cloud Storage. For pure retention/compliance purposes, Cloud Storage is more cost-effective. Additionally, audit logs are already automatically generated — you don't need to 'enable' them to write to BigQuery.
2. Configure Cloud Monitoring to archive all audit logs for 5 years

   Incorrect. Cloud Monitoring handles metrics and alerting, not log archiving. Log archiving is managed through Cloud Logging's log sinks and destinations.
3. Upgrade to Cloud Logging's Premium tier to extend retention to 5 years

   Incorrect. Cloud Logging does not have a 'Premium tier' with extended retention as of the current exam scope. Log buckets in Cloud Logging can be configured with custom retention (up to 3650 days = 10 years), but the standard solution for multi-year compliance archiving is exporting to Cloud Storage via a log sink.
4. Create a log sink that routes all audit logs to a Cloud Storage bucket with a 5-year retention policy ✓

   Correct. Log sinks export log entries to external destinations (Cloud Storage, BigQuery, Pub/Sub, or another log bucket). A Cloud Storage bucket with a 5-year Object Lifecycle Management policy or retention policy provides cost-effective long-term storage for compliance audit logs.

All 96 Ensuring successful operation of a cloud solution questions →

GCP ACE exam: the facts

How many questions are on the GCP ACE exam?

Around 55. The vendor does not publish a fixed count for GCP ACE, so this is the figure it indicates rather than a guaranteed number.

How long is the GCP ACE exam?

120 minutes. Across 55 questions that is about 131 seconds per question.

What topics does the GCP ACE exam cover?

5 domains: Deploying and implementing a cloud solution, Ensuring successful operation of a cloud solution, Setting up a cloud solution environment, Planning and configuring a cloud solution, Configuring access and security. Weights: Deploying and implementing a cloud solution 0.25%, Ensuring successful operation of a cloud solution 0.2%, Setting up a cloud solution environment 0.2%, Planning and configuring a cloud solution 0.175%, Configuring access and security 0.175%.

How many GCP ACE practice exam questions does Certsqill have?

500, spread across 5 exam domains. Every one shows all options, which is correct, and why each of the others is not.