ACE — Google Cloud Associate Cloud Engineer Cheat Sheet

Use the tables for a quick pre-exam check. Expand a topic’s notes for explanations, examples, and additional distinctions.

ACE mental model

Environment setup: projects, billing, APIs, and CLI

Resource setup checklist

gcloud init
gcloud auth list
gcloud config configurations list

gcloud config set project PROJECT_ID
gcloud config set compute/region REGION
gcloud config set compute/zone ZONE

gcloud services list --enabled
gcloud services enable compute.googleapis.com run.googleapis.com container.googleapis.com

Resource hierarchy, IAM, and service accounts

Resource hierarchy

Compute and deployment selection

Compute service selection matrix

gcloud container clusters get-credentials CLUSTER_NAME --region REGION --project PROJECT_ID

kubectl get pods -A
kubectl get services -A
kubectl describe pod POD_NAME -n NAMESPACE
kubectl logs POD_NAME -n NAMESPACE
kubectl rollout status deployment/DEPLOYMENT_NAME -n NAMESPACE

## Compute Engine VM
gcloud compute instances create VM_NAME \
  --zone ZONE \
  --machine-type MACHINE_TYPE \
  --image-family IMAGE_FAMILY \
  --image-project IMAGE_PROJECT \
  --service-account SERVICE_ACCOUNT_EMAIL

## Cloud Run service
gcloud run deploy SERVICE_NAME \
  --image REGION-docker.pkg.dev/PROJECT_ID/REPOSITORY/IMAGE:TAG \
  --region REGION

## App Engine app
gcloud app deploy

## Cloud Functions
gcloud functions deploy FUNCTION_NAME \
  --gen2 \
  --runtime RUNTIME \
  --region REGION \
  --source . \
  --entry-point ENTRY_POINT \
  --trigger-http

    flowchart TD
	    A[Need to run application code] --> B{Need full OS control?}
	    B -->|Yes| C[Compute Engine]
	    B -->|No| D{Containerized?}
	    D -->|Yes| E{Need Kubernetes API/control?}
	    E -->|Yes| F[Google Kubernetes Engine]
	    E -->|No| G[Cloud Run]
	    D -->|No| H{Event-driven function?}
	    H -->|Yes| I[Cloud Functions]
	    H -->|No| J[App Engine or managed platform option]

Storage, databases, and analytics

Storage service selection

gcloud storage buckets create gs://BUCKET_NAME --location=REGION --uniform-bucket-level-access
gcloud storage cp FILE_NAME gs://BUCKET_NAME/PREFIX/
gcloud storage ls gs://BUCKET_NAME
gcloud storage rm gs://BUCKET_NAME/PREFIX/OBJECT_NAME

bq query --use_legacy_sql=false \
'SELECT name, COUNT(*) AS total
 FROM `PROJECT_ID.DATASET.TABLE`
 GROUP BY name
 ORDER BY total DESC
 LIMIT 10'

Networking and connectivity

VPC essentials

Security, secrets, and governance

Security service selection

Operations, observability, and troubleshooting

Observability service selection

gcloud logging read \
'resource.type="gce_instance" AND severity>=ERROR' \
--limit=20 \
--format=json

CI/CD and artifacts

Example minimal build/deploy pattern:

steps:
  - name: gcr.io/cloud-builders/docker
    args: ["build", "-t", "REGION-docker.pkg.dev/PROJECT_ID/REPO/APP:$COMMIT_SHA", "."]
  - name: gcr.io/cloud-builders/docker
    args: ["push", "REGION-docker.pkg.dev/PROJECT_ID/REPO/APP:$COMMIT_SHA"]
  - name: gcr.io/google.com/cloudsdktool/cloud-sdk
    args:
      - "gcloud"
      - "run"
      - "deploy"
      - "SERVICE_NAME"
      - "--image=REGION-docker.pkg.dev/PROJECT_ID/REPO/APP:$COMMIT_SHA"
      - "--region=REGION"

Backup, availability, and recovery patterns

Exam traps to review before practice

Final ACE review checklist

Before taking ACE practice sets, verify you can quickly answer:

• Which Google Cloud compute service fits VM, container, function, PaaS, and Kubernetes requirements.
• How to configure gcloud project, region, zone, authentication, and API enablement.
• How IAM inheritance, predefined roles, service accounts, and impersonation differ.
• When to use Cloud NAT, Private Google Access, VPC peering, Shared VPC, VPN, and Interconnect.
• Which storage/database service fits object, block, file, relational, document, wide-column, cache, and analytics workloads.
• How to troubleshoot permission, project/location, health check, serverless, GKE, and logging issues.
• How Cloud Monitoring, Cloud Logging, audit logs, alerts, and log sinks support operations.
• How labels, budgets, quotas, org policies, and billing export support governance and cost visibility.

High-yield ACE mindset

For most ACE scenarios, ask:

1. What is the workload? VM, container, serverless app, data pipeline, database, static content, analytics, or operations task.
2. What level of management is desired? Fully managed, serverless, managed platform, or self-managed infrastructure.
3. What is the scope? Organization, folder, project, region, zone, subnet, bucket, service account, or resource.
4. Who or what needs access? Human user, group, service account, workload identity, external identity, or Google-managed service.
5. What is the safest minimal change? Least privilege, no broad basic roles, no public access unless explicitly required.
6. What is the operational outcome? Deploy, scale, monitor, troubleshoot, back up, restore, update, or reduce cost.

Common ACE answer pattern

Projects, gcloud, and environment setup

ACE candidates should be comfortable with common administrative setup tasks.

gcloud review

Quick setup checklist

1. Create or select the correct project.
2. Confirm billing association if resources will be created.
3. Enable required APIs.
4. Set gcloud project, region, and zone.
5. Create least-privilege service accounts.
6. Grant only required IAM roles.
7. Deploy resources.
8. Configure monitoring, logging, and alerts.

Deployment and release management

ACE candidates should recognize common deployment paths and operationally safe release patterns.

Container deployment flow

1. Build container image.
2. Store image in Artifact Registry.
3. Deploy to Cloud Run, GKE, or another runtime.
4. Configure service account and environment settings.
5. Set traffic routing, scaling, and networking.
6. Monitor logs, metrics, and errors.

Common deployment tools

Security review

Least privilege checklist

• Use groups for human access where possible.
• Use service accounts for workloads.
• Grant roles at the lowest suitable level.
• Prefer predefined roles over basic roles.
• Use custom roles only when predefined roles are too broad.
• Avoid service account keys unless no safer option fits.
• Rotate and manage secrets in Secret Manager.
• Use Cloud KMS for encryption key management where customer-managed keys are required.
• Use audit logs and monitoring for sensitive actions.

Cost and billing review

ACE cost questions usually test operational awareness, not deep financial modeling.

Cost control tools and behaviors

Cost traps

• Budgets and alerts notify; they do not automatically stop all spending unless you build automation.
• Stopped VMs may still incur disk/IP-related charges.
• Cold storage can cost more if accessed frequently.
• Overprovisioned VMs and unused disks are common waste sources.
• Cross-region and internet egress can matter in architecture questions.

Reliability and backup review

Availability concepts

Backup and restore traps

• A snapshot is not the same as a machine image.
• Backups are only useful if restore is tested.
• High availability is not a substitute for backup.
• Replication can copy accidental deletes or bad writes.
• Regional/multi-region choices affect resilience, latency, and cost.

High-yield command and console tasks

You do not need to memorize every command, but you should recognize task-oriented command patterns.

Common ACE mistakes to eliminate

Mistake checklist

• Choosing the most powerful service instead of the simplest managed fit.
• Granting Owner/Editor instead of least-privilege roles.
• Forgetting service accounts are identities, not just configuration objects.
• Confusing Cloud Storage, Persistent Disk, and Filestore.
• Treating BigQuery as an OLTP database.
• Assuming private VMs can reach the internet without Cloud NAT or another egress path.
• Ignoring firewall rules when troubleshooting connectivity.
• Using public access when signed URLs, IAM, IAP, or private networking would be safer.
• Choosing Compute Engine when Cloud Run or App Engine would reduce operations.
• Choosing serverless when the scenario requires OS-level control.
• Ignoring region/zone scope.
• Forgetting to enable required APIs.
• Assuming monitoring exists without alert policies or uptime checks.
• Not checking logs before changing infrastructure.

Rapid scenario drills

Use these prompts to test your decision speed before moving into full original practice questions.

Scenario 1: Private VM needs updates

A VM has no external IP address. It must download operating system updates from the internet.

Best direction: Cloud NAT for outbound internet access, with appropriate routes/firewall behavior. Do not assign a public IP unless the scenario requires inbound public access.

Scenario 2: User needs to deploy using a service account

A developer can create VMs but cannot attach the required service account.

Best direction: Grant the user permission to use that service account, commonly via Service Account User on the service account, while keeping resource permissions least-privilege.

Scenario 3: Static website assets

A team needs to store and serve static objects.

Best direction: Cloud Storage for objects. Consider bucket IAM, public access requirements, signed URLs, lifecycle rules, and caching/CDN depending scenario.

Scenario 4: Stateless container API

A containerized HTTP API must scale down when idle and requires minimal infrastructure management.

Best direction: Cloud Run, with image in Artifact Registry, appropriate service account, ingress/auth configuration, and monitoring.

Scenario 5: Kubernetes-specific platform

The application team requires Kubernetes APIs, custom controllers, and Kubernetes-native deployment workflows.

Best direction: GKE, selecting Autopilot or Standard based on control requirements.

Scenario 6: Analytics over terabytes

A business team wants SQL analysis over very large datasets.

Best direction: BigQuery, not Cloud SQL.

Scenario 7: VM group must self-heal

A web tier runs on Compute Engine and must replace unhealthy instances automatically.

Best direction: Managed instance group with health check, instance template, autoscaling/autohealing as needed, and firewall rules allowing health checks.

Practice focus map

Use this map to guide topic drills in a question bank.

Put the review into practice