ACE Practice Test

The Google Associate Cloud Engineer (ACE) is a associate-level Google Cloud certification. The exam has 50 questions, runs 120 minutes, costs $125, and requires a passing score of ~70% (Google does not publish). CertSharp provides 500 exam-style ACE practice questions — 30 free with no credit card — each with a detailed explanation.

1. Question 2Setting up a cloud solution environmentEasy

   A developer needs to use the BigQuery API in a new project. After creating the project, what must the developer do to start calling BigQuery endpoints?

   • A

     Enable the BigQuery API in the project

   • B

     Create a service account with BigQuery admin role

   • C

     Install the BigQuery client library

   • D

     Create a Cloud Storage bucket for query results

   Show answer & explanation

   Correct answer: A — Enable the BigQuery API in the project

   Even after project creation, APIs are not automatically enabled. You must explicitly enable each API you intend to use (e.g., bigquery.googleapis.com). Enabling an API makes its services available to the project, after which authentication and authorization are required.

2. Question 3Setting up a cloud solution environmentMedium

   What is the recommended way to automate the creation of new projects with standard configurations (e.g., enabled APIs, IAM roles, billing)?

   • A

     Use the Cloud Console and manually replicate settings

   • B

     Use Cloud Functions triggered by Pub/Sub

   • C

     Use Cloud Deployment Manager or Terraform with the google_project resource

   • D

     Use the gcloud command with shell scripts and store state locally

   Show answer & explanation

   Correct answer: C — Use Cloud Deployment Manager or Terraform with the google_project resource

   Infrastructure as Code (IaC) tools like Terraform or Deployment Manager are best practices for automating project creation and configuration. They provide declarative definitions, state management, version control, and idempotency. Scripts with gcloud are harder to maintain and share state.

3. Question 4Setting up a cloud solution environmentHard

   You are asked to ensure that all traffic between two Compute Engine instances in the same VPC is encrypted. Is this automatically provided?

   • A

     Yes, but it works at the application layer and requires manual IPSec tunnels per instance pair you operate

   • B

     Yes, intra-VPC traffic between internal IPs is encrypted at the network layer

   • C

     No, you would configure application-level encryption yourself for data in transit

   • D

     No, the protection takes effect when the instances share the same zone

   Show answer & explanation

   Correct answer: B — Yes, intra-VPC traffic between internal IPs is encrypted at the network layer

   Google Cloud encrypts VM-to-VM traffic in transit at the network layer by default when instances communicate over internal IP addresses within a VPC, requiring no setup (B). Option A is wrong because no manual IPSec tunnels are needed and the encryption is not application-layer. Option C is wrong because in-transit encryption is provided automatically. Option D is wrong because the protection is not tied to a single zone.

4. Question 5Setting up a cloud solution environmentMedium

   You are setting up a new Google Cloud organization. You want to apply different policies to the development and production environments. What is the best practice to achieve this?

   • A

     Create separate, unrelated Google accounts for each environment and manage their policies in isolation

   • B

     Use folders for development and production, then apply organization policies at the folder level

   • C

     Apply policies at the project level for each individual project rather than grouping them together

   • D

     Use labels to differentiate environments and then apply policies through external scripts and automation

   Show answer & explanation

   Correct answer: B — Use folders for development and production, then apply organization policies at the folder level

   Folders are the ideal mechanism to group projects that share common policies and permissions, so you create a Development folder and a Production folder and apply organization policies and IAM at the folder level for inheritance. Option A wastes effort and breaks centralized management. Option C does not scale and is error-prone across many projects. Option D relies on custom scripts because labels are metadata and do not enforce policy by themselves.

5. Question 6Setting up a cloud solution environmentHard

   You are setting up a Shared VPC to allow multiple projects to use a common VPC network. In which project should the Shared VPC network be created?

   • A

     In each service project individually

   • B

     In the organization-level network project

   • C

     In a separate host project

   • D

     In the project that needs the most compute resources

   Show answer & explanation

   Correct answer: C — In a separate host project

   Shared VPC uses a 'host project' that contains the actual VPC network. 'Service projects' attach to the host project and can use subnets in that VPC. The host project must be enabled for Shared VPC. This centralizes network administration while delegating compute resource management.

6. Question 7Setting up a cloud solution environmentMedium

   Which IAM role type in Google Cloud grants the broadest set of permissions and should be avoided for day-to-day operations in favor of least-privilege alternatives?

   • A

     Basic roles (Owner, Editor, Viewer) applied at the project level for wide access

   • B

     Custom roles scoped to a team's specific job functions and resource types

   • C

     Predefined roles scoped to a single service and applied to a specific principal

   • D

     Organization-level predefined roles that grant scoped access across the projects in the org

   Show answer & explanation

   Correct answer: A — Basic roles (Owner, Editor, Viewer) applied at the project level for wide access

   Basic roles (Owner, Editor, Viewer) predate Google Cloud's fine-grained IAM model and grant the broadest access, so answer A is correct; Owner gives full control including billing and IAM management and should be used sparingly. Custom roles (B) are scoped to specific permissions and follow least privilege. Predefined roles (C) are limited to a single service, and organization-level predefined roles (D) are still constrained to specific actions, unlike Owner which is unrestricted.

7. Question 8Setting up a cloud solution environmentHard

   A solution requires very low latency between Compute Engine instances and a Cloud Storage bucket. Which location strategy should you choose?

   • A

     Multi-region bucket, instances in any region

   • B

     Dual-region bucket, instances in one of the two regions

   • C

     Any location, as latency is not a concern for Cloud Storage

   • D

     Regional bucket in the same region as the instances

   Show answer & explanation

   Correct answer: D — Regional bucket in the same region as the instances

   For lowest latency, place the bucket in the same region as your Compute Engine instances. Cloud Storage is zonal/regional; data access from within the same region avoids cross-region network latency and egress charges. Multi-region adds complexity and may increase latency.

8. Question 9Setting up a cloud solution environmentMedium

   Your organization manages employee identities in on-premises Active Directory and needs users to authenticate to GCP projects using their existing corporate credentials. Which Google Cloud service provides centralized user and group management with GCP IAM integration?

   • A

     Cloud Identity

   • B

     Google Cloud Directory Sync (GCDS)

   • C

     Cloud IAM

   • D

     BeyondCorp Enterprise

   Show answer & explanation

   Correct answer: A — Cloud Identity

   Cloud Identity is Google's Identity-as-a-Service platform for managing users, groups, and devices, integrating with GCP IAM to control resource access using corporate credentials. GCDS (B) is a synchronization tool that replicates identities from Active Directory into Cloud Identity; it is a provisioning agent, not the identity service itself. Cloud IAM (C) manages permissions and policies but does not store or provision user identities. BeyondCorp Enterprise (D) provides context-aware zero-trust access control, not identity provisioning.

9. Question 10Setting up a cloud solution environmentHard

   A developer reports that they cannot access a Cloud SQL instance from a Compute Engine VM even though firewall rules seem correct. What is the most likely missing configuration?

   • A

     The VM must have a public IP address

   • B

     Cloud SQL requires a private service connection or authorized networks configuration

   • C

     The VM must be in the same zone as Cloud SQL

   • D

     The VM must have the Cloud SQL Proxy installed

   Show answer & explanation

   Correct answer: B — Cloud SQL requires a private service connection or authorized networks configuration

   Cloud SQL is not automatically reachable from VPC networks. You must either (1) configure private services access to allow private IP connectivity, or (2) add the VM's public IP to the Cloud SQL authorized networks (less secure). The Cloud SQL Proxy is an alternative but not mandatory if private IP is set up.