Study guide · Summary
ACE Associate Cloud Engineer
The essentials of every exam domain, with the services the exam asks about most. Tap a service to see its details.
Associate~60 min read4 domains
What the exam covers
D1 · ~20% of the exam
Setting up a cloud solution environment
Resource hierarchy and projects
Organization
Root node, tied to a Cloud Identity or Google Workspace domain
Folders
Group projects by team or environment; they can be nested
Projects
Hold resources, enabled APIs and the billing link
Resources
VMs, buckets, databases and so on
| Task | How |
|---|---|
| Enable an API | gcloud services enable compute.googleapis.com |
| Restore a deleted project | gcloud projects undelete (fully deleted after 30 days) |
| Check quotas and request increases | Console quotas page; quotas are per project and region |
| Resource inventory | Cloud Asset Inventory; Gemini Cloud Assist to analyze it |
| Check availability | Not every product is in every region and zone |
A deleted project goes into soft delete and still counts against your project quota until it's fully deleted, after 30 days.
Organization policies
IAM says who can do something; organization policies say which configurations are allowed, no matter who tries. They're also inherited down the hierarchy.
| Constraint | Effect |
|---|---|
| gcp.resourceLocations | Limits where resources can be created |
| compute.vmExternalIpAccess | Defines which VMs can have an external IP |
| iam.allowedPolicyMemberDomains | Domain restricted sharing: only identities from allowed domains |
| iam.disableServiceAccountKeyCreation | Blocks creating service account keys |
Google offers managed versions of several constraints, such as iam.managed.disableServiceAccountKeyCreation and iam.managed.allowedPolicyMembers.
User and group identities
Users and groups are managed in Cloud Identity (manually or automatically). If the company already uses another identity provider, Workforce Identity Federation lets people sign in with SSO without syncing accounts.
Tap a service to see its details.
Billing
Tap a service to see its details.
An alerts-only budget doesn't stop spending. For a hard cap there are spend cap budgets, which pause supported services until you lift the limit.
Observability and networking from day one
The outline also covers setting up Google Cloud Observability (Logging and Monitoring) and the environment's base network. Both are covered in depth in domains 2 and 3.
D2 · ~30% of the exam
Planning and implementing a cloud solution
Choosing compute
Tap a service to see its details.
| Service | What you manage |
|---|---|
| Compute Engine | The whole VM: OS, patching, scaling (with MIGs) |
| GKE Standard | Nodes and node pools |
| GKE Autopilot | Only Pods and their resource requests |
| Cloud Run | The container |
| Cloud Run functions | Only the code |
For an autoscaled MIG: instance template + managed instance group (a regional MIG spreads VMs across zones). Spot VMs for fault-tolerant workloads; custom machine types to fit CPU and memory.
Storage and data
Tap a service to see its details.
| Other products in the outline | What it's for |
|---|---|
| AlloyDB | PostgreSQL-compatible, with a columnar engine for analytics |
| Memorystore | In-memory cache: Valkey, Redis and Redis Cluster (Memcached deprecated) |
| Pub/Sub | Asynchronous messaging between services |
| Dataflow | Batch and streaming data processing |
| Managed Service for Apache Kafka | Managed Kafka |
| Filestore / NetApp Volumes / Managed Lustre | File storage |
| Storage Transfer Service | Move large volumes into Cloud Storage |
Networking
Tap a service to see its details.
| Network Service Tier | Path | SLA | Scope |
|---|---|---|---|
| Premium (default) | Google's network | 99.99% | Global |
| Standard | Public internet / ISPs | 99.9% | Regional only |
| Load balancer | Traffic | Client IP |
|---|---|---|
| Application LB | HTTP / HTTPS | Not preserved by default |
| Proxy Network LB | TCP (optional SSL offload) | Not preserved by default |
| Passthrough Network LB | TCP, UDP, ESP, ICMP and more | Preserved |
Tooling: IaC and AI assistance
| Category | Tools in the outline |
|---|---|
| Infrastructure as Code | Terraform, Fabric FAST, Config Connector, Helm |
| AI assistance | Gemini CLI, Google Antigravity, Gemini Cloud Assist, Application Design Center |
D3 · ~30% of the exam
Ensuring the successful operation of a cloud solution
Operating compute
| Task | Key detail |
|---|---|
| Snapshots | Incremental; restored by creating a new disk; can be scheduled |
| SSH to private VMs | IAP: firewall from 35.235.240.0/20 and the IAP-secured Tunnel User role |
| GKE node pools | Add, edit, remove and autoscale without touching existing nodes |
| GKE autoscaling | HPA = replicas, VPA = each Pod's requests, cluster autoscaler = nodes |
| Cloud Run versions | New revision with no traffic, then gradual splitting |
| GPUs and TPUs | Attached to VMs or nodes depending on the workload |
| Developer environments | Cloud Workstations; notebooks in Workbench and BigQuery |
Tap a service to see its details.
Operating storage and data
| Cloud Storage class | Typical access | Minimum duration |
|---|---|---|
| Standard | Frequent | None |
| Nearline | About once a month or less | 30 days |
| Coldline | At most once a quarter | 90 days |
| Archive | Less than once a year | 365 days |
| Task | Key detail |
|---|---|
| Lifecycle | Rules to change class or delete objects by age |
| Soft delete | 7 days by default, configurable from 7 to 90 |
| Bucket Lock | Locking retention is irreversible; it can only be extended |
| Database backups | Cloud SQL, Firestore, Spanner, AlloyDB and Bigtable |
| Cloud SQL PITR | Always creates a new instance |
| BigQuery costs | Dry run to estimate; LIMIT doesn't reduce bytes read on non-clustered tables |
| Database fleet | Database Center |
| Encryption | Customer-managed encryption keys (CMEK) |
Operating the network
Tap a service to see its details.
| Task | Key detail |
|---|---|
| Expand a subnet | gcloud compute networks subnets expand-ip-range; can't be shrunk |
| Static IPs | Reserve external or internal IPs |
| Routes | Custom static routes in the VPC |
| DNS | Cloud DNS |
| Google APIs without an external IP | Private Google Access, enabled per subnet |
Monitoring and logging
Tap a service to see its details.
| Audit log | On by default? | Can it be disabled? |
|---|---|---|
| Admin Activity | Always | No |
| System Event | Always | No |
| Data Access | No (except BigQuery) | Yes |
| Policy Denied | Yes | No, but it can be excluded from storage |
| Diagnostic tool | What it's for |
|---|---|
| Cloud Trace | Request latency across services |
| Cloud Profiler | CPU and memory use per code function |
| Query Insights | Slow database queries |
| Personalized Service Health | Google Cloud incidents affecting your projects |
| Active Assist | Recommendations to optimize resources |
| Cloud Hub | Active events and application health |
D4 · ~20% of the exam
Configuring access and security
Managing IAM
Tap a service to see its details.
| Role type | When to use it |
|---|---|
| Basic (Owner, Editor, Viewer) | Avoid in production unless there's no alternative |
| Predefined | The preferred option: permissions for a specific service |
| Custom | When no predefined role fits; created at the organization or project level |
Deny policies are evaluated before allow policies and are inherited. A deny at the organization blocks the permission even if a role grants it lower down.
Service accounts
| Role or mechanism | What it allows |
|---|---|
| Service Account User | Attach a service account to a resource (VM, Cloud Run) |
| Service Account Token Creator | Impersonate the account and create short-lived credentials |
| Short-lived access token | 1 hour by default; up to 12 hours with an organization policy |
| Attached account | Code gets credentials without keys |
| Workload Identity Federation for GKE | Google Cloud permissions for Pods |
Access scopes are the legacy method. The recommended practice is to set the cloud-platform scope on the VM and control permissions with IAM on the service account.
Avoid service account keys: use attached accounts, impersonation or federation, and block key creation with an organization policy.
Tips for exam day
- Hierarchy: organization > folders > projects > resources. IAM is inherited downward; to remove an inherited permission, use a deny policy.
- Basic roles (avoid in production), predefined (preferred) and custom (only at organization or project level, never on a folder).
- An alerts-only budget doesn't stop spending. Spend cap budgets pause supported services; you can also automate with Pub/Sub.
- Compute Engine = full control. GKE Autopilot = Kubernetes without nodes. Cloud Run = containers that scale to zero. Cloud Run functions = event-driven code.
- Instance templates are immutable. To change a MIG: new template + rolling update.
- Global VPC, regional subnets. A subnet range can be expanded but not shrunk. Peering isn't transitive.
- Firewall: lower priority number wins; at equal priority, deny wins. Implied: deny ingress, allow egress.
- Cloud SQL = regional relational. Spanner = global relational (99.999%). Firestore = documents for apps. Bigtable = massive key-value. BigQuery = SQL analytics.
- Cloud Storage: Nearline 30 days, Coldline 90, Archive 365. Soft delete keeps deleted objects for 7 days by default.
- Service Account User = attach an account to a resource. Token Creator = impersonate it and create short-lived credentials (1 h by default, up to 12 h).
Was this guide helpful?