Read this the night before or on exam morning. It assumes you’ve studied the notes and is here to refresh, not to teach.
Exam day
- About 50 to 60 questions in 120 minutes, multiple choice and multiple select. Results are pass or fail; Google does not publish a passing score. Cost is 125 USD.
- Official guide sections: setting up the environment about 20%, planning about 17.5%, deploying about 25%, operations about 20%, access and security about 17.5%. This site groups planning and deploying into one domain.
- About 2 minutes per question. No penalty for guessing, so answer everything and flag the hard ones.
- Hands-on practice with gcloud and the console is the best preparation. Many questions are “which command” or “what do you do next”.
How to read an ACE question
| The question says | Pick |
|---|---|
| Least privilege, minimum permissions | Predefined role at the lowest scope; custom role if no predefined fits |
| Least operational overhead, fully managed | Cloud Run, Autopilot, managed services |
| Without keys, most secure for workloads | Attached service account, impersonation, Workload Identity Federation |
| Cost-effective, fault tolerant batch | Spot VMs, colder storage classes, lifecycle rules |
| Global, strongly consistent relational | Spanner |
| Analytics on large data with SQL | BigQuery |
| No external IP but needs SSH | IAP TCP forwarding |
| Across many projects | Folder or organization level policy, aggregated sinks, metrics scope |
Elimination tricks
- Answers using deprecated or retired products are usually wrong: Container Registry (use Artifact Registry), Cloud Debugger, legacy Monitoring and Logging agents (use Ops Agent), preemptible VMs (Spot VMs), Cloud Deployment Manager (Terraform or Infrastructure Manager).
- Answers granting Owner or Editor are almost never right when least privilege is asked.
- The command must match the resource scope: zonal needs
--zone, regional needs--region, global needs neither. - In choose TWO questions each pick is a different needed piece.
Product pickers
| Workload | Choose |
|---|---|
| Stateless container, scale to zero | Cloud Run |
| Small event-driven code | Cloud Run functions |
| Kubernetes, minimal node management | GKE Autopilot |
| Kubernetes with node control, GPUs, privileged | GKE Standard |
| Full OS control, lift and shift | Compute Engine |
| Relational MySQL/PostgreSQL/SQL Server, regional | Cloud SQL |
| Faster PostgreSQL | AlloyDB |
| Relational, global scale | Spanner |
| Huge throughput key-value/time series | Bigtable |
| Document data for apps | Firestore |
| Data warehouse | BigQuery |
| Cache | Memorystore |
| Messaging and event ingest | Pub/Sub |
| Stream or batch pipelines | Dataflow |
| Shared NFS | Filestore |
| Cloud Storage class | Min duration |
|---|---|
| Standard | none |
| Nearline | 30 days |
| Coldline | 90 days |
| Archive | 365 days |
| Connectivity | Choose |
|---|---|
| Quick encrypted link to on premises | HA VPN with Cloud Router |
| High bandwidth private link | Dedicated or Partner Interconnect |
| VPC to VPC, not transitive | VPC Network Peering |
| Central network for many projects, same organization | Shared VPC |
| Outbound internet for private VMs | Cloud NAT |
Commands to know cold
gcloud config set project ID gcloud services enable X.googleapis.com
gcloud projects add-iam-policy-binding P --member=... --role=...
gcloud compute instances create|list|stop|ssh gcloud compute instance-templates create
gcloud compute instance-groups managed create|set-autoscaling|rolling-action
gcloud compute disks snapshot gcloud compute images create --source-disk
gcloud container clusters create|create-auto|get-credentials
gcloud container node-pools create|update kubectl get|describe|logs|scale|rollout|autoscale
gcloud run deploy|services update-traffic gcloud functions deploy --gen2
gcloud storage cp|rsync|buckets update --lifecycle-file
gcloud sql instances create|backups create|connect gcloud logging read|sinks create
gcloud iam service-accounts create|keys create|add-iam-policy-binding
gcloud iam roles create --permissions gcloud auth print-access-token --impersonate-service-account
gcloud compute networks create --subnet-mode=custom
gcloud compute firewall-rules create gcloud compute networks subnets expand-ip-range
bq query|load|ls -j gcloud billing projects link
Numbers and defaults
| Thing | Value |
|---|---|
| Spot VM preemption notice | 30 seconds, no 24 hour limit |
| Deleted project recovery | 30 days |
| Firewall priority | 0 to 65535, lower wins; implied deny ingress, allow egress |
| IAP forwarding source range | 35.235.240.0/20 |
| LB health check ranges | 130.211.0.0/22 and 35.191.0.0/16 |
Cloud Logging _Default / _Required retention |
30 days / 400 days |
| Admin Activity audit logs | Always on; Data Access off by default |
| Access token lifetime | 1 hour by default |
| Cloud Run default concurrency | 80 |
Regional cluster --num-nodes |
Per zone |
| Subnet range | Can expand, never shrink |
| Service account keys | Last resort, no expiry by default |
| Cloud SQL HA | --availability-type=REGIONAL, standby in another zone |
| BigQuery time travel | 7 days default |
Common traps
- Budgets alert only; they don’t stop spending.
set-iam-policyreplaces the whole policy.- Instance templates are immutable; create a new one and roll it out.
- Node pool machine type can’t change; create a new pool.
- A log sink exports nothing until its writer identity has access to the destination.
- Deploying something that runs as a service account needs
serviceAccountUseron it. - Org policy limits what can be configured; IAM limits who can act.