GCP — The Associate Certification Cheatsheet.

The Google Associate Cloud Engineer (ACE) exam (120 min, multiple-choice/select) tests whether you can deploy and operate on GCP. It's mostly "pick the right service" + "least- privilege IAM" + "right gcloud command". Updated for the current exam guide, which now has four sections: setting up the environment (~20%), planning & implementing (~30%), ensuring successful operation (~30%), and access & security (~20%). This sheet follows those domains, then gcloud, exam-style Q&A, what to keep in mind, and the common mistakes.

0. What changed in the new syllabus

• Four sections, not five — planning and implementing merged into one ~30% section; operations is the other ~30%.
• App Engine is gone from the guide; "Cloud Functions" is now Cloud Run functions. Deployment Manager and Cloud Marketplace are out too.
• AI tooling is in scope: Gemini Cloud Assist (analyze resources, assist Monitoring), Gemini CLI, Google Antigravity, Application Design Center, and deploying agents to Agent Runtime on Gemini Enterprise Agent Platform (formerly Vertex AI Agent Engine). Know when you'd use each, plus GPUs vs TPUs.
• Firewalls upgraded: legacy VPC firewall rules and Cloud Next-Generation Firewall (NGFW) policies with secure Tags and service accounts in rules.
• Bigger data menu: AlloyDB, Dataflow, Pub/Sub, Managed Service for Apache Kafka, NetApp Volumes, Managed Lustre, Storage Transfer Service, and Database Center for fleet management.
• IaC beyond Terraform: Fabric FAST, Config Connector, and Helm are named explicitly.
• Identity federation, both kinds: Workforce Identity Federation (humans via external IdP) in section 1; Workload Identity Federation (CI/workloads, keyless) in section 4 — plus SA impersonation and short-lived credentials.
• Observability got deeper: Managed Service for Prometheus, log buckets/analytics/routers, custom metrics, Personalized Service Health, Active Assist, Cloud Hub, Query Insights, index advisor, Ops Agent.
• Compute odds and ends: OS Login, VM Manager, Hyperdisk, Spot VMs (the current name — "preemptible" is legacy), Eventarc, Cloud Workstations, HPA/VPA, Autopilot pod resource requests, traffic splitting.

1. Resource hierarchy & environment

Organization → Folder → Project → Resources. IAM and Organization Policies inherit downward. The Project is the unit of billing, quota, API enablement, and isolation — every resource lives in exactly one.

• Organization — root node, tied to a Cloud Identity / Workspace domain.
• Folders — group projects by team/env; apply policy/IAM at the folder.
• Org Policies — guardrails (constraints): restrict regions, block external IPs, enforce uniform bucket access, disable SA key creation. Different from IAM (who can do what) — org policy = what's allowed at all.
• Cloud Identity — manage users & groups; grant IAM to groups, not individuals.
• APIs — must be enabled per project (gcloud services enable).
• Cloud Asset Inventory — search/export resource + IAM metadata across the org (snapshots, exports to BigQuery); the new guide pairs it with Gemini Cloud Assist for analyzing resources.
• Workforce Identity Federation — let human users from an external IdP (Okta, Azure AD) access GCP without Cloud Identity accounts. (Contrast with Workload Identity Federation in §3 — workloads, not people.)
• Quotas — per-project hard limits; view in console/gcloud compute project-info describe, request increases (not instant). Different from budgets (alerts) and org policy (allowed at all).
• Observability setup — provisioning Cloud Monitoring/Logging products per project is now an explicit section-1 task, not an afterthought.
• Resource scope: global (VPC, images, snapshots), regional (subnets, regional MIGs, regional disks), zonal (VMs, zonal disks). Verify product availability per region/zone before planning.

2. Billing

• A billing account (paid via a payments profile) is linked to one or more projects. A project with no billing account can't use paid resources.
• Budgets + alerts — set a budget on a billing account/project; alerts at % thresholds (email/Pub/Sub). Budgets notify, they don't cap spend.
• Billing export — export detailed billing to BigQuery for analysis; labels for cost attribution.
• IAM roles: billing.admin, billing.user (link projects), billing.viewer.

3. IAM & Service Accounts (study #1)

Thing	What
Member / principal	User, group, domain, or service account.
Role	Basic (owner/editor/viewer — avoid), Predefined (per-service, e.g. roles/storage.objectViewer), Custom (exact permissions).
Policy (binding)	member + role attached to a resource. Inherited down the hierarchy.
Service Account (SA)	Identity for workloads. Has its own IAM roles; others get iam.serviceAccountUser to act as it.

• Least privilege: predefined/custom roles over basic; grant to groups; scope at the lowest node.
• Workload Identity (GKE) / attached SAs (GCE) so pods/VMs auth without key files.
• SA keys are a liability — prefer keyless (Workload Identity Federation for external/CI). Org policy can disable key creation.
• SA impersonation — a user/SA with roles/iam.serviceAccountTokenCreator mints short-lived credentials for another SA (gcloud --impersonate-service-account). The exam's preferred answer for "human needs SA powers temporarily" — never key download.
• Google-managed SAs (service agents) — created automatically per service; don't delete or strip their roles, that's a classic outage cause.
• Workforce vs Workload IF: Workforce = external people via IdP; Workload = external workloads/CI exchanging OIDC/SAML tokens for GCP creds. Both keyless.

gcloud projects add-iam-policy-binding PROJECT \
  --member="group:devs@ex.com" --role="roles/compute.viewer"
gcloud iam service-accounts create app-sa --display-name "app"
gcloud iam roles create myRole --project P --permissions=storage.objects.get
gcloud projects get-iam-policy PROJECT      # audit who has what

4. Compute (study #3)

• Compute Engine — VMs (IaaS). Machine families: E2/N2 (general), C2 (compute), M (memory). Spot VMs (current name; "preemptible" is the legacy term) = up to ~90% cheaper, can be reclaimed any time, no SLA — batch/fault-tolerant only. Custom machine types. Sustained-use + committed-use discounts.
• Instance templates — immutable VM blueprint; Managed Instance Group (MIG) uses a template for autoscaling, autohealing (health checks), rolling updates, regional (multi-zone) spread.
• OS Login — SSH access managed through IAM (roles/compute.osLogin) instead of metadata SSH keys — centralized, auditable, the exam-preferred answer. VM Manager — patch/inventory/config management for VM fleets.
• Disks — zonal/regional Persistent Disk, plus Hyperdisk (newer, per-disk tunable IOPS/throughput) for high-performance workloads.
• GKE — managed Kubernetes. Standard (you manage nodes) vs Autopilot (Google manages nodes, per-pod billing — you set pod resource requests, not node sizes). Regional clusters (multi-zone control plane) and private clusters (nodes without external IPs) are explicitly on the guide. Node pools, cluster autoscaler, HPA/VPA, Workload Identity, StatefulSets.
• Cloud Run — serverless containers, scale to zero, request/CPU billing, any language. Revisions + traffic splitting (canary/gradual rollout), min/max instances for autoscaling.
• Cloud Run functions — the current name for Cloud Functions: event-driven code triggered by Pub/Sub, Cloud Storage object changes, HTTP, or Eventarc (routes events from 90+ sources).
• Agent Runtime on Gemini Enterprise Agent Platform (formerly Vertex AI Agent Engine) — managed runtime for deploying AI agents; Workbench notebooks for ML dev. Know it as the "deploy an AI agent" answer.
• GPUs vs TPUs — GPUs: general accelerated compute, broad framework support, attachable to VMs/GKE. TPUs: Google's matrix-math ASICs for large-scale ML training/inference (TensorFlow/JAX-first). Exam wants the selection logic, not internals.
• Cloud Workstations — managed, preconfigured cloud developer environments (the "secure standardized dev env" answer).
• App Engine — removed from the current guide. Recognize it in legacy questions; don't pick it for new designs.

Pick: VM control → Compute Engine; orchestrated containers → GKE; stateless container no infra → Cloud Run; event-driven glue → Cloud Run functions (+ Eventarc); AI agent → Agent Runtime.

gcloud compute instances create vm1 --machine-type e2-medium --zone us-central1-a
gcloud compute instance-templates create tmpl --machine-type e2-small
gcloud compute instance-groups managed create mig --template tmpl --size 3 --region us-central1
gcloud compute instance-groups managed set-autoscaling mig --max-num-replicas 10 --target-cpu-utilization 0.6
gcloud container clusters create-auto c1 --region us-central1
gcloud run deploy svc --image REGION-docker.pkg.dev/P/repo/img --region us-central1 --allow-unauthenticated

5. Storage & databases (study #4, #7)

• Cloud Storage (GCS) — object storage. Classes: Standard (hot), Nearline (~30d), Coldline (~90d), Archive (~365d). Lifecycle rules transition/delete by age; versioning; uniform bucket-level access; signed URLs. Dual/multi-region buckets for redundancy.
• Persistent Disk / Hyperdisk (block, VM-attached); Filestore (managed NFS); NetApp Volumes (enterprise NFS/SMB file); Managed Lustre (HPC parallel file system).
• Loading data — CLI upload for small, Storage Transfer Service for large/recurring/cross-cloud transfers (S3 → GCS), Transfer Appliance for offline bulk.

Need	Database
Managed relational (MySQL/Postgres/SQL Server), regional	Cloud SQL
Global, horizontally-scaling relational, strong consistency	Cloud Spanner
Serverless NoSQL document, mobile/web, realtime	Firestore
Wide-column, massive throughput, time-series/IoT	Bigtable
Serverless analytics / data warehouse (SQL over huge data)	BigQuery
Postgres-compatible, higher performance/HA than Cloud SQL	AlloyDB
In-memory cache	Memorystore (Redis/Memcached)
Async messaging / event ingestion	Pub/Sub (or Managed Kafka if you need Kafka compatibility)
Managed batch/stream data processing (Beam)	Dataflow

Database Center — single dashboard to manage/monitor the whole database fleet (health, security posture) — new on the guide. Multi-region redundancy (cross-region replicas, dual-region buckets) is an explicit exam consideration.

gsutil mb -c standard -l us gs://my-bucket ; gsutil cp f gs://my-bucket/
gsutil lifecycle set lifecycle.json gs://my-bucket
gcloud sql instances create db1 --database-version POSTGRES_15 --tier db-custom-2-7680 --region us-central1
bq query --use_legacy_sql=false 'SELECT count(*) FROM ds.t'

6. Networking (study #2)

Component	Role
VPC	Global resource; subnets are regional (with a CIDR). Auto or custom mode.
Firewall rules	VPC-level, stateful, by network tag / SA; priority-ordered; implied allow-egress + deny-ingress.
Cloud NGFW policies	Next-gen firewall: hierarchical/global/regional policies (org/folder/network scope), rules using secure Tags (IAM-governed) and SAs; intrusion prevention on higher tiers. The guide now names both legacy rules and NGFW.
Network Service Tiers	Premium (default — Google's global backbone, global LB, best performance) vs Standard (public internet transit, regional LB only, cheaper).
Routes	Where traffic goes (default to internet GW, custom for NAT/VPN).
Cloud NAT	Outbound internet for VMs with no external IP (private instances).
Cloud Load Balancing	Global external HTTP(S) (anycast IP, L7) ; regional/internal (L4 TCP/UDP). Backend services + health checks + MIGs/NEGs.
Cloud VPN / Interconnect	VPN (IPsec over internet) vs Interconnect (dedicated/partner private link) to on-prem.
Cloud DNS	Managed DNS (public + private zones).
Shared VPC / Peering	Share one VPC across projects / connect two VPCs.

gcloud compute networks create vpc1 --subnet-mode custom
gcloud compute networks subnets create sn --network vpc1 --range 10.0.0.0/24 --region us-central1
gcloud compute firewall-rules create allow-ssh --network vpc1 --allow tcp:22 --source-ranges 35.235.240.0/20
gcloud compute routers create r --network vpc1 --region us-central1
gcloud compute routers nats create nat --router r --region us-central1 --auto-allocate-nat-external-ips --nat-all-subnet-ip-ranges

7. Infrastructure automation & CI/CD

• Terraform — the standard IaC; google provider; remote state in a GCS backend. (Deployment Manager is gone from the guide.)
• The guide's wider IaC menu: Fabric FAST (Google's opinionated Terraform landing-zone framework), Config Connector (manage GCP resources as Kubernetes CRDs), Helm (Kubernetes app packaging/charts).
• AI-assisted tooling — Gemini CLI (terminal AI agent), Gemini Cloud Assist (in-console analysis/help), Google Antigravity (agentic dev environment), Application Design Center (AI-assisted architecture design). Know what each is; the exam asks selection, not usage depth.
• Cloud Build — managed CI/CD; cloudbuild.yaml steps build/test/deploy; triggers on repo push; runs as a service account.
• Artifact Registry — store container images + language packages (replaces Container Registry).
• Typical flow: push → Cloud Build builds image → push to Artifact Registry → deploy to Cloud Run/GKE.

gcloud builds submit --tag REGION-docker.pkg.dev/P/repo/img
gcloud artifacts repositories create repo --repository-format docker --location REGION
# Terraform: backend "gcs" { bucket = "tf-state"  prefix = "prod" }

8. Operations — monitoring & logging (study #8)

• Cloud Monitoring — metrics, dashboards, uptime checks, alerting policies (condition + notification channel), custom metrics from apps/logs. The Ops Agent collects VM metrics/logs — installing/configuring it is an explicit exam task.
• Cloud Logging — centralized logs; log routers/sinks export to GCS/BigQuery/Pub/Sub (or on-prem); log buckets + Log Analytics (SQL over logs); log-based metrics; retention.
• Managed Service for Prometheus — GKE-native Prometheus metrics without running your own — the "we already use Prometheus" answer.
• Audit-adjacent logs — VPC Flow Logs, firewall logs, data-access audit logs — configuring these is on the guide.
• Error Reporting — groups + surfaces application exceptions.
• Cloud Trace / Profiler / Query Insights / index advisor — latency traces, CPU+heap profiling, and database query diagnostics (Cloud SQL/AlloyDB) respectively.
• Personalized Service Health — GCP-incident status scoped to your projects. Active Assist — idle-resource/rightsizing recommendations. Cloud Hub — app-centric view of active events + health.
• Cloud Asset Inventory — inventory + change history of resources/IAM.

gcloud logging read 'severity>=ERROR' --limit 20 --freshness 1h
gcloud logging sinks create to-bq bigquery.googleapis.com/projects/P/datasets/logs --log-filter='resource.type="gce_instance"'
gcloud monitoring dashboards list

9. Security (study throughout)

• IAM least privilege + groups + custom roles (see §3).
• Org Policies — restrict regions, block external IP on VMs, enforce uniform bucket access, disable SA keys.
• Cloud Armor — WAF + DDoS protection in front of the global HTTP(S) LB (IP allow/deny, rules, rate limiting).
• Encryption: at rest by default (Google-managed); CMEK (your keys in Cloud KMS) for control; CSEK (you supply keys); in transit via TLS.
• Secret Manager — store/rotate secrets with IAM + versioning (don't put secrets in env/code/images).
• Audit Logs: Admin Activity (always on), Data Access (opt-in), System Event, Policy Denied. Access Transparency logs Google access.
• VPC Service Controls — perimeter to stop data exfiltration from managed services.

gcloud secrets create db-pass --replication-policy automatic
echo -n 's3cr3t' | gcloud secrets versions add db-pass --data-file=-
gcloud kms keyrings create kr --location us ; gcloud kms keys create k --keyring kr --location us --purpose encryption

10. Backup, recovery & troubleshooting

• Snapshots for persistent disks (incremental, can schedule); machine images for whole VMs.
• Cloud SQL automated backups + PITR; export to GCS; cross-region replicas for DR.
• GCS versioning + dual/multi-region buckets for durability; Object Lifecycle for retention.
• Troubleshooting: IAM denied → check effective roles + org policy + audit logs; VM unreachable → firewall rule/tag, external IP, routes (use the connectivity test / SSH-in-browser); app errors → Logging + Error Reporting.

11. gcloud / gsutil / bq essentials

gcloud init ; gcloud auth login ; gcloud auth application-default login
gcloud config set project P ; gcloud config set compute/region us-central1
gcloud config configurations list   # switch between projects/accounts
gcloud projects list ; gcloud services enable run.googleapis.com
gcloud compute instances list ; gcloud compute ssh vm1 --zone us-central1-a
gcloud container clusters get-credentials c1 --region us-central1   # then kubectl
gcloud iam service-accounts list ; gcloud projects get-iam-policy P
gsutil ls / cp / rsync / iam ch ; bq ls / query / mk

12. Exam-style Q&A

• Resource hierarchy & inheritance?Org → Folder → Project → Resource. IAM + org policies inherit downward. Project = billing/quota/API/isolation unit.
• Basic vs predefined vs custom roles?Basic (owner/editor/viewer) too broad — avoid in prod. Predefined = service-scoped least privilege. Custom = your exact permission set.
• How should a VM/pod authenticate to GCP services?Attached service account (GCE) or Workload Identity (GKE) — never a downloaded SA key. WIF for external/CI.
• Cloud Run vs GKE vs App Engine vs Functions?Cloud Run = stateless containers, scale to zero. GKE = full Kubernetes. App Engine = PaaS. Functions = event-driven snippets.
• MIG benefits?Autoscaling, autohealing (health checks recreate bad VMs), rolling updates, regional spread — from an instance template.
• VPC scope vs AWS?GCP VPC is global; subnets regional. Firewall rules at the VPC by tag/SA + priority.
• Cloud SQL vs Spanner vs Bigtable vs BigQuery?SQL = regional relational OLTP; Spanner = global relational at scale; Bigtable = wide-column high-throughput NoSQL; BigQuery = serverless analytics warehouse (OLAP, not app reads).
• Which storage class for archived data accessed yearly?Archive (cheapest storage, highest retrieval/min-duration). Nearline ~30d, Coldline ~90d, Standard hot.
• How do private VMs reach the internet?Cloud NAT (outbound only, no external IP). Inbound via a load balancer.
• How do you give private VMs access without public IPs to Google APIs?Private Google Access on the subnet (and Cloud NAT for general egress).
• Budgets vs quotas?Budgets alert on spend (don't cap). Quotas are hard limits on resource/API usage (request increases). Org policy restricts what's allowed at all.
• CMEK vs default encryption?Data is encrypted at rest by default (Google-managed keys). CMEK uses your Cloud KMS keys for control/rotation/audit; CSEK = you supply the key.
• How to protect a public app from DDoS/bad IPs?Cloud Armor (WAF + rate limiting + IP rules) on the global HTTP(S) load balancer.
• Where do secrets go?Secret Manager (IAM + versioning + rotation) — not env vars, code, or images.
• Which audit log is always on?Admin Activity. Data Access logs are opt-in (can be large). Access Transparency logs Google support access.
• How to export billing for analysis?Enable billing export to BigQuery; query + label for cost attribution.
• CI/CD on GCP?Cloud Build (triggers, cloudbuild.yaml) builds → Artifact Registry stores images → deploy to Cloud Run/GKE. Terraform for infra (state in GCS).
• VM unreachable — how to debug?Check firewall rule + target tag/SA, external IP / Cloud NAT, routes; use Connectivity Tests and SSH-in-browser; then VM serial console + logs.
• Workforce vs Workload Identity Federation?Workforce = external humans (Okta/Azure AD) into GCP without Cloud Identity accounts. Workload = external workloads/CI exchange OIDC/SAML tokens for GCP creds. Both keyless.
• Human needs to act as a service account temporarily?SA impersonation via roles/iam.serviceAccountTokenCreator + short-lived credentials (gcloud --impersonate-service-account). Never download a key.
• Cheapest compute for fault-tolerant batch?Spot VMs (up to ~90% off, reclaimable, no SLA). Wrong for anything stateful/user-facing.
• Legacy firewall rules vs Cloud NGFW?Legacy = per-VPC rules with network tags. NGFW = hierarchical/global/regional policies with IAM-governed secure Tags + SAs, org/folder scope, IPS features. Know both exist.
• Premium vs Standard network tier?Premium (default): Google backbone, global LB, best performance. Standard: public-internet transit, regional LB only, cheaper.
• Cloud SQL vs AlloyDB?Both managed Postgres-compatible; AlloyDB for higher performance/HA/analytics-on-OLTP needs; Cloud SQL for standard regional workloads (and MySQL/SQL Server).
• GPU or TPU?GPU: general accelerated compute, broad frameworks. TPU: large-scale ML training/inference, TensorFlow/JAX-first. Selection logic only.
• Move 100 TB from S3 to GCS?Storage Transfer Service (scheduled, managed, cross-cloud). Transfer Appliance for offline. Not gsutil cp.
• Team already runs Prometheus on GKE?Managed Service for Prometheus — keep PromQL, drop the self-run stack.
• SSH access for a team, centrally managed?OS Login (IAM-based SSH) — not metadata keys per VM.
• Deploy an AI agent to a managed runtime?Agent Runtime on Gemini Enterprise Agent Platform (formerly Vertex AI Agent Engine).

13. What to keep in mind

• Every question is a selection question. The exam gives a requirement and four plausible services. Train the mapping ("global relational → Spanner", "keyless CI auth → WIF"), not feature trivia.
• Least privilege is the tiebreaker. When two answers both work, the one with narrower roles, no SA keys, no external IPs, and lower scope wins. Owner/Editor in prod is always wrong.
• Managed beats self-run. If a managed service covers the requirement, the exam wants it over DIY-on-VMs — that's the point of the platform.
• Know the three control planes apart: IAM (who can do what), org policy (what's allowed at all), quotas (how much), budgets (alert on spend). Questions deliberately blur them.
• Scope words are load-bearing. "Global", "regional", "zonal", "multi-region" in the question usually eliminate half the options (VPC global, subnets regional, VMs zonal; global HTTP(S) LB vs regional L4).
• gcloud structure over memorized flags: gcloud <service> <resource> <verb>. The exam tests recognizing the right command shape, not flag spelling.
• New-syllabus names count. Spot (not preemptible), Cloud Run functions (not Cloud Functions), Artifact Registry (not Container Registry), NGFW policies, Agent Runtime/GEAP. Old names in an answer are often the trap.
• Cost questions want the mechanism: lifecycle rules, Spot, committed-use discounts, Standard tier, Active Assist recommendations, billing export + labels for attribution.
• ~2 min per question. Flag and move on; unanswered = wrong, so answer everything.

14. Common mistakes

• Downloading SA keys when attached SAs, Workload Identity, impersonation, or WIF are options — the single most-tested anti-pattern.
• Picking basic roles (Owner/Editor/Viewer) where a predefined role exists.
• BigQuery for app reads — it's an analytics warehouse (OLAP), not a transactional backend. Same trap in reverse: Cloud SQL for petabyte analytics.
• Spanner "because global sounds better" — it's the answer only when the question says global/multi-region relational + horizontal scale; otherwise Cloud SQL (or AlloyDB for performance).
• Treating budgets as caps — budgets only alert. Hard limits are quotas; prevention is org policy.
• AWS habits: assuming VPC is regional (it's global, subnets regional), looking for NACLs (firewall rules/NGFW policies instead), expecting security groups per instance (target tags/SAs instead).
• Forgetting Cloud NAT / Private Google Access for private VMs — answers that add external IPs "so it can reach the internet" are wrong.
• Spot/preemptible for stateful or user-facing workloads — reclaim can happen any time.
• Secrets in env vars, code, or images instead of Secret Manager.
• Deleting/stripping Google-managed service agents — breaks services silently.
• Enabling Data Access audit logs everywhere without thinking — they're opt-in for a reason (volume/cost); Admin Activity is the always-on one.
• Answering with removed services — App Engine, Deployment Manager, Container Registry are off the current guide; their presence in an option is usually the distractor.
• Ignoring the cheapest-correct rule — when two designs meet the requirement, the exam wants the cheaper one (Standard tier, lifecycle to Archive, Spot for batch).

15. Study priority order

1. IAM + Service Accounts (incl. impersonation, WIF/Workforce IF)
2. VPC networking + Cloud NGFW + network tiers
3. Compute Engine (Spot, OS Login, MIGs)
4. GKE (Autopilot, private/regional clusters, HPA/VPA)
5. Cloud Run + Cloud Run functions + Eventarc
6. Cloud Storage + Storage Transfer Service
7. Databases (Cloud SQL, AlloyDB, Spanner, BigQuery, Bigtable, Firestore)
8. Monitoring & Logging (Ops Agent, Managed Prometheus, log routers)
9. Load Balancers
10. Terraform + Cloud Build + the AI-tooling name map (Gemini Cloud Assist / CLI, Agent Runtime)

Exam: 120 min, multiple-choice + multiple-select, ~6 months hands-on recommended. Lean on the "right service for the requirement" framing and least-privilege defaults — then run §13's mindset and §14's mistake list the night before.