Free ACE practice exam: Google Cloud Associate Cloud Engineer exam guide (2026)
Format, the official domains and their weight, and the services and commands asked most often to pass the Google Cloud Associate Cloud Engineer.
The Associate Cloud Engineer (ACE) is Google Cloud’s entry-level technical certification. Unlike the Cloud Digital Leader, it does not test business concepts: it asks how to deploy, operate, and secure solutions, with real-world scenarios and plenty of gcloud, kubectl, and bq commands. It is the natural certification for system administrators, DevOps engineers, and developers working with Google Cloud.
The official exam guide was updated with the product names in use in 2026, so it pays to study with recent material: today you will see Gemini Enterprise Agent Platform (formerly Vertex AI), Cloud Run functions (formerly Cloud Functions), Artifact Registry instead of Container Registry, and gcloud storage instead of gsutil.
What you need to know about the exam
| Questions | 50-60 |
| Duration | 2 hours |
| Format | Multiple choice and multiple select |
| Reference cost | USD 125 (plus tax where applicable) |
| Languages | English, Japanese, Spanish, and Portuguese |
| Validity | 3 years |
| Prerequisites | None; Google recommends 6+ months of hands-on experience with Google Cloud |
Official domains and their weight
| Domain | Weight | Main content |
|---|---|---|
| Setting up a cloud solution environment | ~20% | Resource hierarchy, organization policies, IAM, Cloud Identity, quotas, billing, and budgets |
| Planning and implementing a cloud solution | ~30% | Compute Engine, GKE, Cloud Run, databases, storage, VPC networking, load balancers, and infrastructure as code |
| Ensuring the successful operation of a cloud solution | ~30% | Managing VMs, GKE, and Cloud Run, snapshots, Cloud Storage, networking, Cloud Logging, and Cloud Monitoring |
| Configuring access and security | ~20% | IAM policies, custom roles, and service accounts |
Domains 2 and 3 add up to 60% of the exam. It is a practical exam: rather than memorizing services, you need to know what to do and with which command.
Domain 1: setting up the environment (~20%)
Start with the resource hierarchy: organization, folders, and projects. IAM policies are inherited downward, and the effective policy is the union of all of them. Tell IAM (who can do something) apart from an organization policy (which configurations are allowed for everyone).
For identity, know Cloud Identity and Workforce Identity Federation. For billing, remember that budgets only alert, that the BigQuery export is for analyzing costs, and that quotas limit resources per project and region.
Domain 2: planning and implementing (~30%)
The broadest domain. You must choose compute well: Compute Engine for full control, GKE or GKE Autopilot for Kubernetes, and Cloud Run for serverless containers. Review managed instance groups, Spot VMs, and disks (Persistent Disk and Hyperdisk).
For data, distinguish Cloud SQL, AlloyDB, Spanner, Firestore, Bigtable, and BigQuery, plus the Cloud Storage classes. For networking, the VPC is global and subnets are regional; review Shared VPC, peering, firewall rules, Cloud VPN, Cloud Interconnect, load balancers, and Network Service Tiers.
Domain 3: operations (~30%)
This covers day-to-day tasks: SSHing in with IAP or OS Login, scheduling snapshots, scaling Pods in GKE, splitting traffic between Cloud Run revisions, and configuring object lifecycle management. For networking, Cloud NAT, Private Google Access, and Cloud DNS.
For observability, audit logs, the Log Router and sinks, the Ops Agent, and diagnostic tools such as Cloud Trace and Cloud Profiler.
Domain 4: access and security (~20%)
It revolves around service accounts and IAM roles. Typical questions: which role lets you attach an account to a VM (Service Account User), how to use its permissions without keys (impersonation), how to give a GKE Pod its own permissions, and how to connect an external pipeline with Workload Identity Federation. Also deny policies.
Commands that come up most
| Task | Command |
|---|---|
| Enable an API | gcloud services enable compute.googleapis.com |
| Grant a role on a project | gcloud projects add-iam-policy-binding |
| Configure kubectl for a cluster | gcloud container clusters get-credentials |
| Scale Pods on CPU | kubectl autoscale deployment |
| Split traffic in Cloud Run | gcloud run services update-traffic |
| Expand a subnet | gcloud compute networks subnets expand-ip-range |
| Upload files to Cloud Storage | gcloud storage cp |
| Estimate a query’s cost | bq query --dry_run |
Common mistakes that make people fail
- ▸Believing a budget stops spending. It only sends alerts; cutting spend has to be automated with Pub/Sub.
- ▸Forgetting that instance templates cannot be edited. To change a managed group you create a new template and run a rolling update.
- ▸Mixing up identity mechanisms. Workforce is for people, Workload is for external applications, and attached service accounts are for VMs and Google Cloud services.
- ▸Picking the wrong load balancer. Global web with TLS → global external Application Load Balancer; UDP or preserving the client IP → passthrough Network Load Balancer.
How to prepare with Brains4Cloud
- ▸ACE cheat sheet:
gcloud,kubectl, andbqcommands, comparison tables for compute, databases, load balancers, and identities, and a top 10 of the most-asked topics. - ▸Glossary: more than 60 Google Cloud terms explained with the context in which they appear on the exam.
- ▸Practice exam: 290 original questions aligned with the current guide, single and multiple select, with an explanation for every option. Create your free account and take your first mock exam.
Frequently asked questions
Is the ACE hard? Harder than the Cloud Digital Leader, because it is technical and asks about commands and configurations. With hands-on experience and about 6 to 8 weeks of steady study it is very achievable.
Do I need the Cloud Digital Leader first? No. The ACE has no prerequisites. The CDL helps if you are new to the cloud, but it is not required.
Can I take it in Spanish? Yes. The exam is offered in English, Japanese, Spanish, and Portuguese.
How long does the certification last? Three years. To renew it there is a shorter renewal exam.
Put what you learned to the test
Original practice exams with detailed explanations. No brain dumps.