ExamFinch.com My Study

Cheat sheet

GCP ACE Cheat Sheet

Practice this exam

Setting Up Cloud Environment

  • 20% of exam
  • Resource Hierarchy Billing & Setup Org Policy Cloud Identity Quotas

Planning & Implementing

  • 30% of exam
  • Compute Choices GKE Data Products Storage Products VPC Networking IaC Tooling

Ensuring Successful Operations

  • 30% of exam
  • Compute Ops Storage & Data Ops Networking Ops Monitoring & Logging

Configuring Access & Security

  • 20% of exam
  • IAM Roles Service Accounts Workload Identity Least Privilege

Quick Facts

  • Exam ACE
  • Credential Associate Cloud Engineer
  • Time 2 hours
  • Questions 50-60
  • Fee $125
  • Level Associate
  • Validity 3 years
  • Domains 4 sections

Resource Hierarchy EN

  • Org -> Folder -> Project -> Resource
  • Org: top node Folder: optional group Project: billing unit Resource: instance

Resource Hierarchy EN

  • Organization Top hierarchy node
  • Folder Optional grouping layer
  • Project Billing + resource unit
  • IAM policy Grants permissions, additive
  • Org Policy Restricts allowed configs
  • Cloud Identity Users/groups directory
  • Workforce Identity Federation External IdP access
  • Standalone organization Separate admin boundary

Billing & Setup EN

  • Billing account Payment container
  • Budget Spend threshold target
  • Billing alert Notifies at % spend
  • Billing export Sends data to BigQuery
  • Quota Usage cap per project
  • API enablement Required before first call
  • Cloud Asset Inventory Point-in-time asset snapshot
  • Gemini Cloud Assist AI resource recommendations

Storage Access Tiers PL

  • Standard -> Nearline -> Coldline -> Archive
  • Standard: frequent Nearline: ~monthly Coldline: ~quarterly Archive: yearly+

GKE Autopilot vs Standard PL

Autopilot

  • Google manages nodes
  • Bill per Pod

Standard

  • You manage nodes
  • Bill per VM
  • Managed vs manual nodes

Compute Picker PL

  • Need full OS control → Compute Engine ( IaaS )
  • Fully managed, no nodes → GKE Autopilot ( Pod-based billing )
  • Need node-level control → GKE Standard ( You manage nodes )
  • Any container, long-running → Cloud Run ( Serverless, per request )
  • Single event trigger → Cloud Run functions ( No container build )
  • Deploy an AI agent → Agent Runtime ( Gemini platform )
  • Fault-tolerant batch job → Spot VM ( Steep discount, preemptible )
  • Odd vCPU-memory ratio → Custom machine type ( Pay exact size )

Compute Choices PL

  • Compute Engine Full OS control, IaaS
  • GKE Managed Kubernetes containers
  • Cloud Run Serverless containers, any runtime
  • Cloud Run functions Single-purpose event functions
  • Agent Runtime Hosts AI agents on Gemini
  • GPU General ML/graphics accelerator
  • TPU Google's deep-learning accelerator

GKE Autoscaling Modes PL

  • HPA scales out; VPA scales up
  • HPA: more Pods VPA: bigger Pods Don't mix same metric

Cloud Run vs Functions PL

Cloud Run

  • Any container/runtime
  • Long-running requests

Cloud Run functions

  • Single-purpose code
  • Event-triggered only
  • Container vs single function

Data & Storage Picker PL

  • Relational, single region → Cloud SQL
  • Relational, global scale → Spanner ( Strong consistency )
  • Mobile app document sync → Firestore ( Serverless NoSQL )
  • High-throughput time series → Bigtable ( Wide-column store )
  • SQL analytics warehouse → BigQuery ( Pay per scan )
  • Streaming event ingestion → Pub/Sub
  • Unstructured files or objects → Cloud Storage ( Pick access tier )
  • NFS or SMB shares → Filestore

Compute Engine Detail PL

  • Zonal Persistent Disk Single-zone disk
  • Regional Persistent Disk Synced across 2 zones HA
  • Hyperdisk Newer, tunable performance disk
  • Instance template Fixed VM config blueprint
  • Managed instance group Autoscaled identical VMs
  • OS Login IAM-tied SSH access
  • VM Manager Patch + inventory + config
  • Spot VM Cheap, preemptible capacity Cheap
  • Custom machine type Exact vCPU/memory ratio

VPN vs Interconnect PL

Cloud VPN

  • Encrypted internet tunnel
  • Fast to set up

Cloud Interconnect

  • Dedicated private circuit
  • Higher, steady bandwidth
  • Internet-based vs dedicated link

Connectivity Picker PL

  • Encrypted over internet → Cloud VPN ( Lower cost )
  • Dedicated private bandwidth → Cloud Interconnect ( Predictable latency )
  • Two separately owned VPCs → VPC Peering
  • Central host, many projects → Shared VPC ( Host owns subnets )
  • Distribute incoming traffic → Load balancer
  • Compare network routing cost → Network Service Tier

GKE Detail PL

  • GKE Autopilot Google manages nodes
  • GKE Standard You manage node pools
  • Regional cluster Control plane spans zones HA
  • Zonal cluster Single control-plane zone
  • Private cluster Nodes have no public IP
  • kubectl CLI for Kubernetes objects
  • get-credentials Pulls cluster auth to kubeconfig
  • Node pool Group of same-config nodes
  • HPA Adds/removes Pod replicas
  • VPA Resizes Pod requests/limits

Zonal vs Regional PD PL

Zonal PD

  • Single zone only
  • Lower cost

Regional PD

  • Synced 2 zones
  • Survives zone outage
  • Cheaper vs zone-resilient disk

Data Products PL

  • Cloud SQL Managed regional MySQL/Postgres
  • Spanner Global scale, strong consistency
  • Firestore Serverless document database
  • Bigtable High-throughput wide-column NoSQL
  • AlloyDB Postgres-compatible, high performance
  • BigQuery Serverless SQL data warehouse
  • Dataflow Managed stream/batch pipelines
  • Pub/Sub Event messaging service
  • Memorystore Managed Redis/Memcached cache

Shared VPC vs Peering PL

Shared VPC

  • Host owns subnets
  • Central network admin

VPC Peering

  • Two owned VPCs
  • Each keeps control
  • Centralized vs peer ownership

Storage Products PL

  • Cloud Storage Object storage buckets
  • Standard class Frequent access tier
  • Nearline class ~Monthly access, 30-day min
  • Coldline class ~Quarterly access, 90-day min
  • Archive class Rare access, 365-day min
  • Filestore Managed NFS file shares
  • Storage Transfer Service Bulk data migration tool

VPC Networking PL

  • Custom-mode VPC You define subnet ranges
  • Auto-mode VPC Pre-created subnets per region
  • Shared VPC Host project owns subnets
  • VPC Peering Connects two owned VPCs
  • Cloud NGFW Hierarchical firewall policies
  • VPC firewall rule Attaches to one VPC
  • Cloud VPN Encrypted internet tunnel
  • Cloud Interconnect Dedicated private circuit
  • Network Service Tier Premium vs Standard routing

IaC & AI Tooling PL

  • Terraform Declarative IaC, own state
  • Config Connector K8s-native GCP resources
  • Fabric FAST Google's opinionated Terraform framework
  • Helm Kubernetes package manager
  • Gemini CLI AI-assisted command-line help
  • Google Antigravity AI-assisted dev environment
  • Application Design Center Visual architecture planning tool

Audit Log Types OP

  • Admin Activity -> Data Access -> System Event
  • Admin: free, on Data Access: off default System: Google-generated

Monitoring vs Logging OP

Cloud Monitoring

  • Numeric metrics
  • Threshold alerts

Cloud Logging

  • Log entries
  • Search + filter
  • Metrics vs log records

Ops & Monitoring Picker OP

  • Metric crosses alert threshold → Cloud Monitoring alert
  • Search or filter logs → Cloud Logging
  • Latency across services → Cloud Trace
  • CPU or memory hotspot → Cloud Profiler
  • Slow SQL query → Query Insights ( Index advisor )
  • Long-term log retention → Log sink ( Export to BigQuery )
  • Check Google-side outage → Personalized Service Health
  • Optimize idle resources → Active Assist

Compute Operations OP

  • Snapshot Incremental disk backup
  • Image Bootable VM template
  • Traffic splitting Routes % across revisions
  • Node pool edit Add/remove/resize nodes
  • Cloud Workstations Managed dev environments
  • Workbench Managed AI notebooks
  • GPU/TPU attach Adds accelerator to workload

Trace vs Profiler OP

Cloud Trace

  • Request latency path
  • Cross-service timing

Cloud Profiler

  • Code CPU/memory use
  • Continuous sampling
  • Latency vs code execution

Storage & Data Ops OP

  • Lifecycle policy Auto-tiers or deletes objects
  • CMEK Customer-controlled encryption key
  • Database Center Fleet-wide DB health view
  • Backup/restore Point-in-time DB recovery
  • Job status Dataflow/BigQuery run state
  • Cost estimate Forecasts storage/data spend

Networking Ops OP

  • Subnet resize Expands IPv4 range
  • Static IP Reserved, non-changing address
  • Custom route Manual VPC routing rule
  • Cloud DNS Managed name resolution
  • Cloud NAT Outbound-only internet access
  • Firewall rule update Adjusts allow/deny live

Monitoring & Logging OP

  • Cloud Monitoring Metrics + alerting
  • Cloud Logging Log search + storage
  • Admin Activity logs Free, always on
  • Data Access logs Off by default
  • VPC Flow Logs Network traffic records
  • Log router/sink Routes logs to destinations
  • Cloud Trace Distributed request latency
  • Cloud Profiler Continuous code hotspot sampling
  • Query Insights SQL query performance view
  • Personalized Service Health Google-side outage status
  • Ops Agent VM metrics + logs collector
  • Active Assist Resource optimization recommender

IAM Role Types SE

  • Basic -> Predefined -> Custom
  • Basic: broad Predefined: scoped Custom: hand-picked

IAM Policy vs Org Policy SE

IAM policy

  • Grants who can act
  • Applies to identities

Org Policy

  • Restricts what's allowed
  • Applies to resources
  • Identity permission vs resource constraint

IAM Roles SE

  • Basic role Broad, project-wide access
  • Predefined role Curated, service-scoped access
  • Custom role Hand-picked permission set
  • Policy inheritance Flows top-down only
  • IAM binding Links identity to role
  • Deny policy Explicitly blocks permissions

Impersonation vs JSON Key SE

Impersonation

  • Short-lived, act-as
  • No key downloaded

JSON key

  • Long-lived credential
  • Standing leak risk
  • Temporary vs standing credential

Service Accounts SE

  • Service account Non-human IAM identity
  • Impersonation Act-as without downloading keys
  • Short-lived credential Auto-expiring, lower risk
  • JSON key Long-lived, higher risk
  • Workload Identity GKE Pods use Google SA
  • Workload Identity Federation External workload, no SA key
  • Minimum permissions Least-privilege grant practice

Common Traps

IAM Policy vs Org Policy

  • IAM grants permissions ≠ Org Policy restricts configs

Snapshot vs Image

  • Snapshot backs up disk ≠ Image boots new VM

Zonal vs Regional PD

  • Zonal is single zone ≠ Regional syncs two zones

Admin vs Data Access logs

  • Admin Activity is free ≠ Data Access is off

VPN vs Interconnect

  • VPN is encrypted internet ≠ Interconnect is private circuit

Basic vs Predefined roles

  • Basic roles are broad ≠ Predefined roles are scoped

HPA vs VPA

  • HPA adds Pod replicas ≠ VPA resizes Pod requests

Last Minute

  • 1. Weights: 20% / 30% / 30% / 20%
  • 2. IAM = permissions; Org Policy = configs
  • 3. Zonal PD = 1 zone, Regional = 2
  • 4. Autopilot = Google manages; Standard = you manage
  • 5. Cloud Run = containers; functions = single events
  • 6. VPN = encrypted internet; Interconnect = private link
  • 7. Monitoring = metrics; Logging = log entries
  • 8. Admin Activity logs = free, always on
  • 9. Basic roles = broad; predefined = scoped
  • 10. Snapshots = disk backup; images = boot VMs
  • 11. Long-lived keys = risk; use impersonation instead
  • 12. Shared VPC hosts; Peering = equal owners

Google Associate Cloud Engineer

  • Practice Questions 200 questions Study Guide 47 topics Cheat Sheet 118 facts Flashcards 50 cards Videos 1 video Blogs 1 blog Free CE Podcast