Associate Cloud Engineer Exam Questions: Five Drills on the Commands You Must Know Cold
Fifty to sixty questions in two hours for $125, and six months of hands-on is the recommended baseline. This exam rewards people who have actually typed the commands - here are five that separate them.
- 50-60Questions
- 120 minTime
- $125Cost
- 3 yearsValid
Table of Contents
The Google Cloud Associate Cloud Engineer paper is 50-60 questions in 120 minutes and costs $125. Four domains, no published weights, and two hours for 50-60 questions. Access and security punches above its share because IAM appears inside questions from every other domain.
What follows is the question split by domain, then five practice questions written to Google Cloud’s published objectives, each with the reasoning for the right answer and for every wrong one. These are original practice items, not real exam content – the point is to show you how the questions are shaped and where the traps sit.
How the 50-60 questions split
Google Cloud lists the exam sections but does not publish percentage weights for this exam, so nobody can tell you an exact question count per domain. The honest version is below: the sections, and what an even split across a 55-question paper would look like.
| Domain | Weight | If even | |
|---|---|---|---|
| Set up a cloud solution environment | not published | ~14 | |
| Plan and implement a cloud solution | not published | ~14 | |
| Ensure the successful operation of a cloud solution | not published | ~14 | |
| Configure access and security | not published | ~14 |
Be sceptical of precise weightings. Sites quoting exact percentages for this exam are inventing them. Google Cloud has not published them, so revise the sections evenly and spend your extra time on whichever one you can least explain out loud.
Five practice questions
Answer each one before reading the key underneath it.
An application on Compute Engine needs to read a Cloud Storage bucket. What is the correct way to grant access?
- A Store a service account key file on the instance and reference it in code
- B Attach a service account to the instance and grant that account the storage role on the bucket
- C Make the bucket public and filter by IP address
- D Use the developer's own user credentials on the instance
Answer: B
Attaching a service account to the instance lets Google Cloud supply short-lived credentials automatically, so there is no key to leak or rotate. This is the recommended pattern.
Why the others fail
A A downloaded key on disk is a long-lived secret that must be rotated and can be exfiltrated - the pattern Google advises against.
C Making a bucket public to serve one application exposes it to everyone, and IP filtering is not an access control for object storage.
D Tying an application to a human's credentials breaks the moment that person leaves.
Objects must be retained for seven years for compliance, are almost never read, and cost must be minimised. Which storage class fits?
- A Standard
- B Nearline
- C Archive
- D Coldline
Answer: C
Archive is the lowest-cost class, intended for data accessed less than once a year, which matches long-term compliance retention.
Why the others fail
A Standard is priced for frequently accessed data and is the most expensive at rest.
B Nearline targets data read about monthly, so it is more expensive than necessary here.
D Coldline suits roughly quarterly access, still above the retention-only pattern described.
Which gcloud command sets the active project for subsequent commands?
- A gcloud projects create PROJECT_ID
- B gcloud config set project PROJECT_ID
- C gcloud init project PROJECT_ID
- D gcloud auth login PROJECT_ID
Answer: B
gcloud config set project writes the project into the active configuration, so later commands run against it without repeating the flag.
Why the others fail
A This creates a new project rather than selecting an existing one.
C gcloud init runs an interactive setup walkthrough; it is not this command's syntax.
D gcloud auth login authenticates an account and does not take a project argument this way.
A workload on GKE must keep serving during a node upgrade, with at least two replicas always available. Which object expresses that requirement?
- A A HorizontalPodAutoscaler with a minimum of two
- B A PodDisruptionBudget with minAvailable set to two
- C A ResourceQuota limiting pods to two
- D A readiness probe on the container
Answer: B
A PodDisruptionBudget constrains voluntary disruptions such as node drains during upgrades, keeping the stated number of pods available throughout.
Why the others fail
A Autoscaling responds to load. It does not stop a drain from evicting pods together.
C A quota caps resource consumption in a namespace and has nothing to do with availability during maintenance.
D A readiness probe controls whether a pod receives traffic, not how many are evicted at once.
At which level should an IAM role be granted so it applies to every project in a department automatically, including new ones?
- A On each project individually
- B On the folder containing those projects
- C On the individual resources inside each project
- D On the service account used by the applications
Answer: B
IAM policy is inherited down the resource hierarchy, so a role granted on a folder applies to every project it contains, including projects created later.
Why the others fail
A Per-project grants must be repeated for every new project, which is what the question rules out.
C Resource-level grants are even narrower and multiply the maintenance burden.
D Granting a role on a service account controls who can use that account, not what the department can access.
What catches people out
- At $125 this is Google's cheapest engineering exam, but the six-months-hands-on recommendation is real - it asks what you would type, not what you have read.
- IAM inheritance through organisation, folder, project and resource is tested constantly. Know which level a grant should sit at and why.
- Storage class questions are decided by access frequency in the stem. Match Standard, Nearline, Coldline and Archive to frequent, monthly, quarterly and yearly.
- The certification runs three years with a 20-question, $75 renewal exam - cheaper and shorter than sitting the full paper again.
What it really costs to pass
The sticker price is $125, but that is the cost of passing first time. The number worth budgeting is different.
- First attempt: $125.
- Resit: Google does not discount a resit, but holders inside the renewal window can take a 20-question renewal exam at $75 instead of the full $125 paper.
- Renewal: the credential lasts 3 years, so the honest cost is the fee divided across that period, plus whatever renewal Google Cloud requires at the end of it.
- Your time: 120 minutes in the chair, and realistically several weeks of preparation before it. That is the largest cost on this list and the only one you cannot pay to avoid.
There is no published pass mark. Google Cloud does not publish one for this exam, so you cannot calculate how many mistakes you can afford. Prepare for a comfortable margin rather than aiming at a threshold nobody has stated.
Who should sit it: there are no formal prerequisites, though Google recommends 6+ months of hands-on Google Cloud experience. Going in well under that bar is usually how people end up paying the fee twice.
How to prepare
A workable sequence for this exam, assuming you already work near the material:
- Read the official guide first. Everything on this page is secondary to what Google Cloud publishes at the link in the sidebar, and guides get revised.
- Work the heaviest domain until you can teach it. Use the table above to decide which one that is.
- Practise under the clock. 120 minutes for 50-60 questions is roughly 131 seconds each. Knowing the material and being able to apply it at that pace are different skills.
- Review every wrong answer to the level of the distractor. Being able to say why the other three options fail is what turns a 60% into a pass.
Frequently asked questions
How many questions are on the Associate Cloud Engineer exam?
Between 50 and 60 multiple-choice and multiple-select questions in two hours.
How much does the Associate Cloud Engineer exam cost?
$125 plus tax, with a $75 renewal exam available inside the renewal window.
How much experience do I need for Associate Cloud Engineer?
Google recommends at least six months of hands-on experience with Google Cloud. There are no formal prerequisites.
How long is the Associate Cloud Engineer certification valid?
Three years, after which you renew by exam or through the designated skills path.
Sources
Every figure on this page comes from the certifying body rather than a third-party summary:
- https://cloud.google.com/learn/certification/cloud-engineer
- https://services.google.com/fh/files/misc/associate_cloud_engineer_exam_guide_english.pdf
Checked September 2, 2026. Formats and fees change – confirm against Google Cloud before you pay for anything.