GCP Associate Cloud Engineer (ACE): a 5-week study plan

If you want one GCP cert on your résumé and you write code for a living, ACE is the one. It's $125, around 50 multiple choice and multiple select questions, two hours, and the syllabus is the cleanest "what does a working cloud engineer actually do on GCP" tour you'll find. No marketing fluff like CDL, no architectural fan service like PCA — just IAM, Compute Engine, GKE, networking basics, Cloud Storage, billing, and the gcloud CLI.

Anecdotally, pass rates for prepared candidates sit around 70%+. Google doesn't publish official numbers (and never will — they don't even tell you your score, just pass / fail), so take that figure as ballpark. The exam isn't easy, but it's fair: study the right things and you pass.

Where ACE sits relative to other associate certs

ACE is a tier easier than AWS Solutions Architect Associate (SAA-C03). SAA-C03 is broader — more services, more design tradeoffs, longer questions. ACE is tighter in scope and more procedural — "what gcloud command does X", "which IAM role grants Y", "which storage class for Z access pattern". If you've passed SAA-C03 cold, ACE is two to three weeks of vocabulary translation. Going the other direction is harder.

	GCP ACE	AWS SAA-C03	AZ-104
Cost	$125	$150	$165
Length	2h, ~50 q	130 min, 65 q	~120 min, 40-60 q
Validity	3 years	3 years	1 year, free renewal
Difficulty	Moderate	Moderate-hard	Moderate
Style	Procedural / hands-on	Architectural	Mixed

What ACE actually tests

Five domains, weighted roughly evenly:

1. Setting up a cloud solution environment. Projects, billing accounts, gcloud CLI, Cloud Shell, enabling APIs, IAM at the project / folder / organization level. If you don't know the resource hierarchy cold, you're going to lose easy points.
2. Planning and configuring a cloud solution. Choosing the right compute (GCE vs. GKE vs. Cloud Run vs. App Engine vs. Cloud Functions), data storage (Cloud Storage classes, Cloud SQL, Firestore, Bigtable), and basic networking.
3. Deploying and implementing a cloud solution. Actually doing it — gcloud compute instances create, deploying to GKE with kubectl, Cloud Run revisions, marketplace deployments, deployment manager / Terraform basics.
4. Ensuring successful operation. Monitoring, logging, error reporting, autoscaling configuration, basic incident response.
5. Configuring access and security. IAM roles (primitive vs. predefined vs. custom), service accounts, audit logging, organization policies.

There are no case studies. No long scenario reading. Most questions are 2-4 sentence stems with four answer choices. The "select all that apply" questions are the ones that bite — partial credit doesn't exist.

The 5-week plan

Assumes 8-10 hours per week. Compress to 3 weeks if you have GCP production experience; stretch to 7 if you're coming in cold.

Week 1 — IAM, projects, billing, the gcloud CLI

This is the boring foundation and it's where most under-preparation happens. Get the resource hierarchy ingrained: organization → folders → projects → resources. Know that IAM policies inherit downward and are additive (you can't deny via lower-level policy unless you use deny policies, which is a separate construct).

Lab work: spin up a fresh GCP account (free tier gives you $300 in credits over 90 days, plus an always-free tier). Create an organization if you can. Create folders and nested projects. Assign roles using both the console and gcloud projects add-iam-policy-binding. Set up a billing alert. Create a service account and use it to authenticate locally with gcloud auth activate-service-account.

Read the IAM documentation page on roles end-to-end. Memorize the difference between basic / predefined / custom roles and when each is appropriate (hint: never use basic in production).

Week 2 — Compute Engine and GKE

Compute Engine is the workhorse and it shows up on a third of the exam. Know instance types, machine families (E2, N2, C3, T2D), preemptible / Spot VMs, instance templates, managed instance groups, autoscaling policies, and live migration. Practice gcloud compute commands until they're muscle memory.

GKE: clusters (standard vs. Autopilot — Autopilot is increasingly the default exam answer for "we want managed Kubernetes without ops overhead"), node pools, workload identity (the right way to authenticate pods to GCP services — never use node service accounts in production), basic kubectl operations.

Lab work: deploy a sample app to GCE behind a managed instance group with autoscaling. Then redeploy the same app to a GKE Autopilot cluster. Notice what changes and what doesn't.

Week 3 — Cloud Storage, networking, and the rest of compute

Cloud Storage classes (Standard, Nearline, Coldline, Archive), lifecycle rules, signed URLs, uniform vs. fine-grained access. The exam loves storage class selection questions: 30-day-old logs accessed once a quarter for compliance? Coldline. Hot user uploads for a web app? Standard. Don't overthink.

Networking: VPC, subnets (regional, not zonal — common gotcha), firewall rules (default-deny inbound, default-allow outbound, priority rules), Cloud NAT, Cloud DNS, basic load balancing (global external HTTP(S) vs. regional internal). PCA-level networking depth isn't required, but you do need to know the shapes.

Other compute: Cloud Run (scales to zero, request-based billing, second-gen execution environment), Cloud Functions (event-driven, HTTP triggers, Pub/Sub triggers), App Engine Standard vs. Flex (mostly legacy now — App Engine questions are getting rarer).

Week 4 — Operations, deployment, databases

Cloud Operations suite: Logging, Monitoring, Trace, Profiler, Error Reporting. Know that Cloud Logging has a default 30-day retention and that you set up sinks to export logs to BigQuery / Cloud Storage / Pub/Sub for longer retention or analysis. Know basic alerting policy structure.

Deployment: Cloud Build, Artifact Registry (which replaced Container Registry — Container Registry is deprecated, don't pick it as an answer), Deployment Manager (legacy) vs. Terraform (preferred). Cloud Deploy for continuous delivery to GKE / Cloud Run.

Databases at the ACE level: Cloud SQL (managed Postgres / MySQL / SQL Server, regional, max 64 TB), Firestore (NoSQL document, two modes — Native and Datastore), Bigtable (NoSQL wide-column, ms latency at petabyte scale), Spanner (relational, globally consistent, expensive — wrong answer 95% of the time on the associate exam).

Week 5 — Practice exams and gap fill

Three to five full-length practice exams under timed conditions. Aim for 80%+ before scheduling the real one. Whatever you keep getting wrong, go back and read the actual GCP documentation page for that service — not the practice answer explanation, the real docs. The exam writers pull language directly from documentation.

Spend any remaining time on Cloud Skills Boost labs (free with the Innovators program signup). The labs are cheaply written but they get you reps with the console and gcloud, which matters because some exam questions essentially describe a console screenshot in text.

What to skip

You don't need deep BigQuery (that's the data certs). You don't need Vertex AI internals (that's PMLE / GAIL). You don't need security command center, VPC Service Controls, or org policies beyond the basics (that's PCSE). You don't need hybrid networking or Interconnect (that's PCNE). ACE is wide and shallow; later certs go deep on slices.

Bottom line

ACE is the right first GCP cert for any working engineer. Five weeks of evening study, $125, and you have a credential that recruiters and partner-tier programs both recognize. It's also a clean stepping stone: the material rolls forward into PCA, PCD, and PCNE without much waste.

Studying now? Browse the ACE question bank on CertLabPro or start a timed practice exam. If you're already past ACE, PCA is the next logical step.