Setting Up Cloud Environment
20%of exam
Planning & Implementing
30%of exam
Ensuring Successful Operations
30%of exam
Configuring Access & Security
20%of exam
Quick Facts
- Exam
- ACE
- Credential
- Associate Cloud Engineer
- Time
- 2 hours
- Questions
- 50-60
- Fee
- $125
- Level
- Associate
- Validity
- 3 years
- Domains
- 4 sections
Resource Hierarchy
Org -> Folder -> Project -> Resource
Org: top nodeFolder: optional groupProject: billing unitResource: instance
Resource Hierarchy
- Organization
- Top hierarchy node
- Folder
- Optional grouping layer
- Project
- Billing + resource unit
- IAM policy
- Grants permissions, additive
- Org Policy
- Restricts allowed configs
- Cloud Identity
- Users/groups directory
- Workforce Identity Federation
- External IdP access
- Standalone organization
- Separate admin boundary
Billing & Setup
- Billing account
- Payment container
- Budget
- Spend threshold target
- Billing alert
- Notifies at % spend
- Billing export
- Sends data to BigQuery
- Quota
- Usage cap per project
- API enablement
- Required before first call
- Cloud Asset Inventory
- Point-in-time asset snapshot
- Gemini Cloud Assist
- AI resource recommendations
Storage Access Tiers
Standard -> Nearline -> Coldline -> Archive
Standard: frequentNearline: ~monthlyColdline: ~quarterlyArchive: yearly+
GKE Autopilot vs Standard
Autopilot
- Google manages nodes
- Bill per Pod
Standard
- You manage nodes
- Bill per VM
Managed vs manual nodes
Compute Picker
- Need full OS control→Compute Engine(IaaS)
- Fully managed, no nodes→GKE Autopilot(Pod-based billing)
- Need node-level control→GKE Standard(You manage nodes)
- Any container, long-running→Cloud Run(Serverless, per request)
- Single event trigger→Cloud Run functions(No container build)
- Deploy an AI agent→Agent Runtime(Gemini platform)
- Fault-tolerant batch job→Spot VM(Steep discount, preemptible)
- Odd vCPU-memory ratio→Custom machine type(Pay exact size)
Compute Choices
- Compute Engine
- Full OS control, IaaS
- GKE
- Managed Kubernetes containers
- Cloud Run
- Serverless containers, any runtime
- Cloud Run functions
- Single-purpose event functions
- Agent Runtime
- Hosts AI agents on Gemini
- GPU
- General ML/graphics accelerator
- TPU
- Google's deep-learning accelerator
GKE Autoscaling Modes
HPA scales out; VPA scales up
HPA: more PodsVPA: bigger PodsDon't mix same metric
Cloud Run vs Functions
Cloud Run
- Any container/runtime
- Long-running requests
Cloud Run functions
- Single-purpose code
- Event-triggered only
Container vs single function
Data & Storage Picker
- Relational, single region→Cloud SQL
- Relational, global scale→Spanner(Strong consistency)
- Mobile app document sync→Firestore(Serverless NoSQL)
- High-throughput time series→Bigtable(Wide-column store)
- SQL analytics warehouse→BigQuery(Pay per scan)
- Streaming event ingestion→Pub/Sub
- Unstructured files or objects→Cloud Storage(Pick access tier)
- NFS or SMB shares→Filestore
Compute Engine Detail
- Zonal Persistent Disk
- Single-zone disk
- Regional Persistent Disk
- Synced across 2 zonesHA
- Hyperdisk
- Newer, tunable performance disk
- Instance template
- Fixed VM config blueprint
- Managed instance group
- Autoscaled identical VMs
- OS Login
- IAM-tied SSH access
- VM Manager
- Patch + inventory + config
- Spot VM
- Cheap, preemptible capacityCheap
- Custom machine type
- Exact vCPU/memory ratio
VPN vs Interconnect
Cloud VPN
- Encrypted internet tunnel
- Fast to set up
Cloud Interconnect
- Dedicated private circuit
- Higher, steady bandwidth
Internet-based vs dedicated link
Connectivity Picker
- Encrypted over internet→Cloud VPN(Lower cost)
- Dedicated private bandwidth→Cloud Interconnect(Predictable latency)
- Two separately owned VPCs→VPC Peering
- Central host, many projects→Shared VPC(Host owns subnets)
- Distribute incoming traffic→Load balancer
- Compare network routing cost→Network Service Tier
GKE Detail
- GKE Autopilot
- Google manages nodes
- GKE Standard
- You manage node pools
- Regional cluster
- Control plane spans zonesHA
- Zonal cluster
- Single control-plane zone
- Private cluster
- Nodes have no public IP
- kubectl
- CLI for Kubernetes objects
- get-credentials
- Pulls cluster auth to kubeconfig
- Node pool
- Group of same-config nodes
- HPA
- Adds/removes Pod replicas
- VPA
- Resizes Pod requests/limits
Zonal vs Regional PD
Zonal PD
- Single zone only
- Lower cost
Regional PD
- Synced 2 zones
- Survives zone outage
Cheaper vs zone-resilient disk
Data Products
- Cloud SQL
- Managed regional MySQL/Postgres
- Spanner
- Global scale, strong consistency
- Firestore
- Serverless document database
- Bigtable
- High-throughput wide-column NoSQL
- AlloyDB
- Postgres-compatible, high performance
- BigQuery
- Serverless SQL data warehouse
- Dataflow
- Managed stream/batch pipelines
- Pub/Sub
- Event messaging service
- Memorystore
- Managed Redis/Memcached cache
Storage Products
- Cloud Storage
- Object storage buckets
- Standard class
- Frequent access tier
- Nearline class
- ~Monthly access, 30-day min
- Coldline class
- ~Quarterly access, 90-day min
- Archive class
- Rare access, 365-day min
- Filestore
- Managed NFS file shares
- Storage Transfer Service
- Bulk data migration tool
VPC Networking
- Custom-mode VPC
- You define subnet ranges
- Auto-mode VPC
- Pre-created subnets per region
- Shared VPC
- Host project owns subnets
- VPC Peering
- Connects two owned VPCs
- Cloud NGFW
- Hierarchical firewall policies
- VPC firewall rule
- Attaches to one VPC
- Cloud VPN
- Encrypted internet tunnel
- Cloud Interconnect
- Dedicated private circuit
- Network Service Tier
- Premium vs Standard routing
IaC & AI Tooling
- Terraform
- Declarative IaC, own state
- Config Connector
- K8s-native GCP resources
- Fabric FAST
- Google's opinionated Terraform framework
- Helm
- Kubernetes package manager
- Gemini CLI
- AI-assisted command-line help
- Google Antigravity
- AI-assisted dev environment
- Application Design Center
- Visual architecture planning tool
Audit Log Types
Admin Activity -> Data Access -> System Event
Admin: free, onData Access: off defaultSystem: Google-generated
Monitoring vs Logging
Cloud Monitoring
- Numeric metrics
- Threshold alerts
Cloud Logging
- Log entries
- Search + filter
Metrics vs log records
Ops & Monitoring Picker
- Metric crosses alert threshold→Cloud Monitoring alert
- Search or filter logs→Cloud Logging
- Latency across services→Cloud Trace
- CPU or memory hotspot→Cloud Profiler
- Slow SQL query→Query Insights(Index advisor)
- Long-term log retention→Log sink(Export to BigQuery)
- Check Google-side outage→Personalized Service Health
- Optimize idle resources→Active Assist
Compute Operations
- Snapshot
- Incremental disk backup
- Image
- Bootable VM template
- Traffic splitting
- Routes % across revisions
- Node pool edit
- Add/remove/resize nodes
- Cloud Workstations
- Managed dev environments
- Workbench
- Managed AI notebooks
- GPU/TPU attach
- Adds accelerator to workload
Trace vs Profiler
Cloud Trace
- Request latency path
- Cross-service timing
Cloud Profiler
- Code CPU/memory use
- Continuous sampling
Latency vs code execution
Storage & Data Ops
- Lifecycle policy
- Auto-tiers or deletes objects
- CMEK
- Customer-controlled encryption key
- Database Center
- Fleet-wide DB health view
- Backup/restore
- Point-in-time DB recovery
- Job status
- Dataflow/BigQuery run state
- Cost estimate
- Forecasts storage/data spend
Networking Ops
- Subnet resize
- Expands IPv4 range
- Static IP
- Reserved, non-changing address
- Custom route
- Manual VPC routing rule
- Cloud DNS
- Managed name resolution
- Cloud NAT
- Outbound-only internet access
- Firewall rule update
- Adjusts allow/deny live
Monitoring & Logging
- Cloud Monitoring
- Metrics + alerting
- Cloud Logging
- Log search + storage
- Admin Activity logs
- Free, always on
- Data Access logs
- Off by default
- VPC Flow Logs
- Network traffic records
- Log router/sink
- Routes logs to destinations
- Cloud Trace
- Distributed request latency
- Cloud Profiler
- Continuous code hotspot sampling
- Query Insights
- SQL query performance view
- Personalized Service Health
- Google-side outage status
- Ops Agent
- VM metrics + logs collector
- Active Assist
- Resource optimization recommender
IAM Role Types
Basic -> Predefined -> Custom
Basic: broadPredefined: scopedCustom: hand-picked
IAM Policy vs Org Policy
IAM policy
- Grants who can act
- Applies to identities
Org Policy
- Restricts what's allowed
- Applies to resources
Identity permission vs resource constraint
IAM Roles
- Basic role
- Broad, project-wide access
- Predefined role
- Curated, service-scoped access
- Custom role
- Hand-picked permission set
- Policy inheritance
- Flows top-down only
- IAM binding
- Links identity to role
- Deny policy
- Explicitly blocks permissions
Impersonation vs JSON Key
Impersonation
- Short-lived, act-as
- No key downloaded
JSON key
- Long-lived credential
- Standing leak risk
Temporary vs standing credential
Service Accounts
- Service account
- Non-human IAM identity
- Impersonation
- Act-as without downloading keys
- Short-lived credential
- Auto-expiring, lower risk
- JSON key
- Long-lived, higher risk
- Workload Identity
- GKE Pods use Google SA
- Workload Identity Federation
- External workload, no SA key
- Minimum permissions
- Least-privilege grant practice
Common Traps
IAM Policy vs Org Policy
IAM grants permissions ≠ Org Policy restricts configs
Snapshot vs Image
Snapshot backs up disk ≠ Image boots new VM
Zonal vs Regional PD
Zonal is single zone ≠ Regional syncs two zones
Admin vs Data Access logs
Admin Activity is free ≠ Data Access is off
VPN vs Interconnect
VPN is encrypted internet ≠ Interconnect is private circuit
Basic vs Predefined roles
Basic roles are broad ≠ Predefined roles are scoped
HPA vs VPA
HPA adds Pod replicas ≠ VPA resizes Pod requests
Last Minute
- 1.Weights: 20% / 30% / 30% / 20%
- 2.IAM = permissions; Org Policy = configs
- 3.Zonal PD = 1 zone, Regional = 2
- 4.Autopilot = Google manages; Standard = you manage
- 5.Cloud Run = containers; functions = single events
- 6.VPN = encrypted internet; Interconnect = private link
- 7.Monitoring = metrics; Logging = log entries
- 8.Admin Activity logs = free, always on
- 9.Basic roles = broad; predefined = scoped
- 10.Snapshots = disk backup; images = boot VMs
- 11.Long-lived keys = risk; use impersonation instead
- 12.Shared VPC hosts; Peering = equal owners
Buy on Amazon
Take courses on Udemy
Learning path on PluralsightSame family resources
Explore More Google Cloud Certifications
Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.
More From This Family
Videos and articles for deeper review.