Google Cloud Associate Cloud Engineer (ACE) Practice Test

Google Cloud ACE practice test: what's covered

• Associate Cloud Engineer

Free Google Cloud ACE sample questions

1. Your organization wants IAM policies set on a parent node to be automatically inherited by everything beneath it, while keeping projects as the unit for billing and quota. Which resource hierarchy ordering, from broadest to narrowest, supports this?

   • A. Project then Folder then Organization then Resource
   • B. Organization then Folder then Project then Resource
   • C. Folder then Organization then Resource then Project
   • D. Resource then Project then Billing Account then Organization
   Show answer

   Correct: B. IAM policies inherit downward through Organization to Folder to Project to Resource, and a project is the billing and quota boundary. The other orderings are incorrect because the Organization is always the root node, not the Project, and a Billing Account is linked to projects rather than sitting inside the resource hierarchy.

2. A finance team needs all charges from twelve different development and production projects consolidated onto a single monthly invoice. As the billing administrator, how should you configure billing to meet this requirement?

   • A. Create one billing account per project so each invoice stays separate
   • B. Link all twelve projects to one billing account that produces a single invoice
   • C. Enable billing only on the production projects and skip the dev projects
   • D. Move billing configuration from the project level to the resource level
   Show answer

   Correct: B. A billing account can be linked to many projects, so consolidating all twelve onto one account produces a single invoice. Creating one account per project defeats consolidation, disabling billing on dev projects would stop those resources from running, and billing is not configured at the resource level because it attaches to projects.

3. You are tightening IAM on a project and want to follow least-privilege rather than handing out broad basic roles. Which approaches align with Google Cloud IAM best practices? (Choose TWO)

   • A. Grant predefined roles that map to the specific service permissions each user needs
   • B. Assign the basic Owner role to every developer for convenience and speed
   • C. Use custom roles to bundle only the exact permissions a job function requires
   • D. Share a single user account and password across the whole engineering team
   • E. Disable IAM entirely and rely only on network firewall rules for access
   Show answer

   Correct: A and C. Predefined roles and custom roles both enable least-privilege by granting only required permissions. Granting Owner to everyone is over-permissive and violates least privilege, sharing one account breaks individual accountability and auditing, and IAM cannot be disabled because firewall rules control network traffic, not API authorization.

4. An application running on a Compute Engine VM needs to call Cloud Storage and BigQuery APIs without you embedding any downloaded key files on the instance. Which identity should the workload use to authenticate?

   • A. A regular Google user account belonging to the developer
   • B. An attached service account whose credentials the VM obtains automatically
   • C. A service account key JSON file copied onto the instance disk
   • D. An API key generated from the project credentials page
   Show answer

   Correct: B. A service account attached to the VM lets the workload fetch short-lived tokens from the metadata server with no key files to manage. A user account is for humans, not workloads; copying a key JSON onto disk is exactly the long-lived secret you are trying to avoid; and API keys do not provide IAM-based authorization for these services.

5. Before migrating a workload to Google Cloud, your team must produce an upfront monthly cost estimate for the proposed Compute Engine, Cloud SQL, and networking resources. Which tool is designed for this pre-deployment estimation?

   • A. The Google Cloud Pricing Calculator for modeling estimated costs
   • B. Cloud Monitoring dashboards showing live resource metrics
   • C. The Cloud Billing reports page for past consumption charges
   • D. Cloud Trace latency analysis across the deployed services
   Show answer

   Correct: A. The Pricing Calculator is built to model costs of planned resources before deployment. Cloud Monitoring shows metrics of already-running resources, Billing reports show historical spend rather than forecasts for new resources, and Cloud Trace analyzes request latency, not cost, so none of those produce an upfront estimate.

Last updated: 2026-10-19

Google Cloud ACE practice test FAQ

Related practice tests

• Google Cloud Professional Cloud Architect practice test
• Google Professional Cloud DevOps Engineer practice test
• Google Professional Cloud Network Engineer practice test
• Google Cloud PCSE practice test
• Google Cloud Professional Data Engineer practice test
• Google Cloud GenAI-Leader practice test