How many Troubleshooting Scenario Questions questions are on this page?

This page has 6 Troubleshooting Scenario Questions scenario questions for the ACE exam, each with detailed explanations and wrong-answer analysis.

How should I approach ACE scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Google Associate Cloud Engineer questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Google Associate Cloud Engineer practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

ACE

exam code

Google Cloud

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1easymultiple choice

Full question →

A developer needs to run an interactive shell inside a running GKE Pod named 'api-pod-7d4f9' in the 'production' namespace to investigate a runtime issue. Which kubectl command opens an interactive shell?

A
kubectl ssh api-pod-7d4f9 -n production
Why wrong: `kubectl ssh` is not a valid kubectl command. Use `kubectl exec -it` to open an interactive shell.
B
kubectl exec -it api-pod-7d4f9 -n production -- /bin/bash
This command opens an interactive bash shell in the Pod. `-i` keeps stdin open, `-t` allocates a pseudo-TTY, `-n production` targets the correct namespace.
C
kubectl run debug --image=busybox --attach=api-pod-7d4f9
Why wrong: `kubectl run` creates a new Pod — it doesn't attach to an existing one. `--attach` is not used this way.
D
gcloud container exec api-pod-7d4f9 --namespace=production -- bash
Why wrong: `gcloud container exec` is not a valid command. Pod execution is managed through `kubectl exec`.

Full breakdown with real-world context →

Question 2hardmultiple choice

Full question →

Refer to the exhibit. An engineer runs this command and sees the output. The instance is unable to reach the internet. What is the most likely reason?

Network Topology

A
VPC firewall rules are blocking egress traffic.
Why wrong: Firewall may block but the primary issue is no external connectivity path.
B
The instance needs a Cloud NAT gateway for outbound connectivity.
Why wrong: Cloud NAT is a solution, but the root cause is no external IP. Without it, Cloud NAT alone doesn't fix the path.
C
The instance does not have a public IP address.
The output shows no accessConfigs, confirming no external IP.
D
The subnetwork is misconfigured.
Why wrong: Subnetwork configuration appears normal.

Full breakdown with real-world context →

Question 3mediummultiple choice

Full question →

Refer to the exhibit. An application running on this instance is unable to write to a Cloud Storage bucket. What is the most likely cause?

Exhibit

serviceAccounts:
  - email: '123456789-compute@developer.gserviceaccount.com'
    scopes:
    - 'https://www.googleapis.com/auth/devstorage.read_only'
    - 'https://www.googleapis.com/auth/logging.write'
    - 'https://www.googleapis.com/auth/pubsub'

A
The application is using the wrong authentication method
Why wrong: The instance uses its service account; scope is the issue.
B
The access scopes only allow read access to Cloud Storage
The scope is read_only, so write operations are denied regardless of IAM role.
C
The Cloud Storage bucket is in a different project
Why wrong: Cross-project access is possible with proper permissions; not indicated.
D
The service account does not have the storage.objectAdmin IAM role
Why wrong: The scope issue is more restrictive; even with IAM role, scope blocks write.

Full breakdown with real-world context →

Question 4easymultiple choice

Full question →

A developer deployed a new version of a Compute Engine instance but the startup script fails to run. The developer needs to debug the startup script. Which step should be taken first?

A
RDP into the instance and check the system logs.
Why wrong: RDP requires Windows and network access; not first step.
B
Check the instance's metadata for startup script errors.
Why wrong: Metadata contains the script but not its execution output.
C
Recreate the instance with a new image.
Why wrong: Redundant; does not help debug the issue.
D
Review the serial port 1 output in the Google Cloud console.
Serial port 1 displays boot and startup script logs.

Full breakdown with real-world context →

Question 5hardmultiple choice

Full question →

A company has just created a Google Cloud organization with multiple folders for different departments. The security team has set up organization policies, including a constraint that disables the creation of external IP addresses for VMs. However, the development team is unable to launch a VM instance because the 'External IP addresses' option is greyed out. They need to create a VM with an external IP for a temporary testing environment. The development team has the Project Owner role on their project. What should the company do to allow the development team to create VMs with external IPs while maintaining security?

A
Create a new folder for temporary testing and apply a policy exemption at the folder level, granting the development team the Organization Policy Administrator role on that folder.
Allows exception at a lower level without affecting other parts of the organization.
B
Grant the development team the Organization Policy Administrator role on their existing project to allow them to override the policy.
Why wrong: The Organization Policy Administrator role cannot override an organization-level constraint; policy exemptions must be applied at a lower level in the hierarchy.
C
Create a separate project outside the organization hierarchy to bypass the constraint.
Why wrong: Bypassing organization policies undermines security and is not a best practice.
D
Remove the organization policy constraint for the entire organization to allow external IPs.
Why wrong: Too broad; weakens security for all projects.

Full breakdown with real-world context →

Question 6hardmultiple choice

Read the full NAT/PAT explanation →

A company has a Compute Engine instance in the us-west1 region that does not have a public IP address. The instance is part of a VPC network that has a Cloud NAT gateway configured in the us-east1 region. The Cloud NAT gateway is configured to allow all traffic from the VPC subnet. The VPC has a default route (0.0.0.0/0) pointing to the default internet gateway. Firewall rules allow all egress traffic. The instance is unable to download updates from the internet. What is the most likely cause of this problem?

A
The instance's firewall rules block egress traffic to port 80.
Why wrong: Incorrect. The stem states that firewall rules allow all egress traffic.
B
The Cloud NAT gateway is in a different region than the instance.
Correct. Cloud NAT is region-scoped; instances can only use NAT gateways in the same region.
C
The instance's service account does not have the compute.instances.update permission.
Why wrong: Incorrect. The service account permissions are not required for internet access via Cloud NAT.
D
The VPC does not have a route for the instance's subnet to the internet gateway.
Why wrong: Incorrect. The VPC has a default route to the internet gateway, which is necessary but not sufficient without a NAT in the same region.

Full breakdown with real-world context →

These ACE practice questions are part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style ACE questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related ACE topic practice pages

Setting up a cloud solution environment practice questions

Planning and configuring a cloud solution practice questions

Deploying and implementing a cloud solution practice questions

Ensuring successful operation of a cloud solution practice questions

Configuring access and security practice questions

ACE fundamentals practice questions

ACE scenario practice questions

ACE troubleshooting practice questions

Practice scenarios

A developer needs to run an interactive shell inside a running GKE Pod named 'api-pod-7d4f9' in the 'production' namespace to investigate a runtime issue. Which kubectl command opens an interactive shell?

Refer to the exhibit. An engineer runs this command and sees the output. The instance is unable to reach the internet. What is the most likely reason?

Refer to the exhibit. An application running on this instance is unable to write to a Cloud Storage bucket. What is the most likely cause?

Exhibit

A developer deployed a new version of a Compute Engine instance but the startup script fails to run. The developer needs to debug the startup script. Which step should be taken first?