GoogleAssociate

Associate Cloud Engineer Cheat Sheet

Google Cloud Associate Cloud Engineer — Quick reference for the exam

CLI Commands

TOP= might appear on the exam

Projects, configuration, and billing6 cmds

gcloud config configurations create prod && gcloud config configurations activate prodTOP

Named configurations group account, project, region, and zone so you can switch environments with one command

gcloud config set project PROJECT_ID

Sets the default project for the active configuration

gcloud services enable compute.googleapis.com container.googleapis.comTOP

Enables APIs in the project. Typical error: "API not enabled" when creating a resource

gcloud billing projects link PROJECT_ID --billing-account=XXXXXX-XXXXXX-XXXXXXTOP

Links the project to a billing account. Requires Billing Account User on the account

gcloud projects undelete PROJECT_ID

Restores a deleted project while it is still in its recovery period (about 30 days)

gcloud components install kubectl

Installs kubectl in the local SDK. It comes preinstalled in Cloud Shell

Comparisons

Service	What you manage	When to choose it
Compute Engine	The whole VM: OS, patches, scaling (with MIGs)	Specific OS or drivers, legacy apps, full control
GKE Standard	Nodes and node pools (Google manages the control plane)	Kubernetes with node control (GPUs, special configurations)
GKE Autopilot	Only Pods and their resource requests	Kubernetes without managing nodes; you pay per Pod
Cloud Run	The container	Stateless containers with variable traffic; scales to zero
Cloud Run functions	Only the function code	Small code reacting to events (Cloud Storage, Pub/Sub, HTTP)
Agent Runtime	The AI agent	Deploying agents on Gemini Enterprise Agent Platform without infrastructure

Quick Reference

D1 · Setting up the environment (~20%)

HierarchyTOP

Organization > folders > projects > resources. IAM and policies are inherited downward

Effective policyTOP

Union of the resource’s policy and its ancestors’. To subtract: deny policies

Org Policy vs. IAMTOP

IAM = who can. Org Policy = which configurations are allowed (gcp.resourceLocations, vmExternalIpAccess)

Domain restriction

iam.allowedPolicyMemberDomains blocks granting roles to accounts outside the company

BudgetsTOP

Only alert (actual or forecasted). To cut spend: Pub/Sub plus a function

Billing exportTOP

To BigQuery: standard or detailed cost and pricing. Labels let you group costs

Quotas

Per-project and per-region limits; request increases in the console. Spot VMs consume them too

Metrics scope

A scoping project sees several projects’ metrics in Cloud Monitoring

D2 · Planning and implementing (~30%)

VPCTOP

Global; regional subnets. Implied rules: deny ingress, allow egress

Firewall priorityTOP

Lower number = higher priority. At equal priority, deny beats allow

Network Service TiersTOP

Premium (default, Google’s network) vs. Standard (cheaper, regional only)

Spot VMsTOP

Big discount, no 24-hour limit, reclaimable at any time

Disks

Regional PD / Hyperdisk Balanced HA survive a zone. Local SSD is ephemeral

Regional GKETOP

Control plane and nodes across zones. Zonal = a single control plane

IaC in the guide

Terraform, Fabric FAST, Config Connector, and Helm

AI-assisted tooling

Gemini CLI, Google Antigravity, Gemini Cloud Assist, and Application Design Center

D3 · Operations (~30%)

SnapshotsTOP

Incremental; restored by creating a new disk, not onto the existing one

HPA vs. VPA vs. autoscalerTOP

HPA = replicas. VPA = each Pod’s requests. Cluster autoscaler = nodes

Cloud RunTOP

Minimum instances avoid cold starts; the maximum protects the database

Soft delete

Cloud Storage keeps deleted objects for 7 days by default, even without versioning

Bucket LockTOP

Locked retention policy: nobody deletes early (WORM)

Cloud SQL PITRTOP

Creates a clone of the instance at a point in time

Log exclusions

Discard entries before storage and cut cost

DiagnosticsTOP

Trace = latency per service. Profiler = CPU per function. Query Insights = SQL queries

D4 · Access and security (~20%)

Role typesTOP

Basic (avoid), predefined (preferred), and custom (organization or project, not folder)

Deny policiesTOP

Evaluated before allow policies and inherited

IAM conditions

Limit by date (request.time) or resource name (resource.name)

Service Account UserTOP

Attach a service account to a resource (actAs)

Token CreatorTOP

Impersonate an account and create short-lived credentials (1 hour by default)

Service account keysTOP

Avoid them: iam.disableServiceAccountKeyCreation; use federation or attached accounts

Access scopes

Legacy mechanism; use cloud-platform and control access with IAM

Privileged Access Manager

Temporary elevated access, requested and approved (just in time)

Ready to practice?

Put what you learned to the test with original Associate Cloud Engineer exam questions.

Start Associate Cloud Engineer mock exam

Unlimited mock exams with the Pro plan

All Cheat Sheets