Google Cloud Associate Cloud Engineer
225 practice questions
Last reviewed: April 2026
Personal notes and resource links for your study journey
Filter by Certification
The Google Cloud Associate Cloud Engineer (ACE) validates the day-to-day skills of someone who deploys applications, monitors operations, and manages enterprise solutions on Google Cloud. It is the entry point into the technical GCP track and the most commonly required GCP cert on operations and platform-engineering job postings. The exam is heavy on the gcloud CLI, Cloud Console flows, and IAM mechanics — expect questions on creating projects, configuring billing, managing GKE / Compute Engine / Cloud Run workloads, setting up VPCs, and configuring Cloud Operations. Unlike the Professional tier, ACE focuses on doing the work rather than designing the architecture, so questions reward recall of exact commands and console paths.
Project, folder, organization hierarchy; billing accounts and budget alerts; gcloud CLI initialization; Cloud Shell. 20% — foundational and the easiest section to over-study.
Choosing compute (Compute Engine vs. GKE vs. Cloud Run vs. App Engine vs. Cloud Functions), choosing data services, sizing instances, networking primitives. 18%.
Largest domain at 24%. Hands-on deployment of GCE instances, GKE clusters, App Engine apps, Cloud Run services, Cloud SQL, Pub/Sub, and Dataproc. Expect gcloud syntax recall.
Cloud Logging, Cloud Monitoring, Cloud Trace, managed instance groups and autoscaling, GKE node pool management. 20%.
IAM roles, service accounts, viewing audit logs, basic VPC firewall rules. 18% — small but high-density. Predefined vs. custom roles is a frequent distractor pattern.
Services you'll encounter on the exam and why each one matters.
Resizable VM compute with machine families (general-purpose, compute-optimized, memory-optimized, GPU), custom machine types, preemptible / Spot VMs, and managed instance groups.
Why it's on the exam: Compute Engine anchors Deploying and Implementing a Cloud Solution — expect gcloud-driven VM provisioning, MIG autoscaling, and snapshot/image scenarios.
Managed Kubernetes with Standard and Autopilot modes, node pools, regional/zonal clusters, Workload Identity, and built-in Cloud Logging / Monitoring integration.
Why it's on the exam: GKE shows up in Planning and Configuring a Cloud Solution (cluster sizing, Autopilot vs. Standard) and Deploying and Implementing (kubectl + gcloud container clusters).
Fully managed serverless container platform with request-driven autoscaling to zero, Cloud Run jobs for batch, and concurrent-request configuration per instance.
Why it's on the exam: Cloud Run is the canonical "deploy a containerized service without managing nodes" answer in Deploying and Implementing a Cloud Solution.
PaaS for web apps with Standard environment (sandboxed, scale-to-zero) and Flexible environment (containerized, persistent), version-based traffic splitting.
Why it's on the exam: App Engine vs. Cloud Run vs. GKE selection is a recurring Planning and Configuring distractor; ACE tests when App Engine Standard is the right managed choice.
Object storage with Standard / Nearline / Coldline / Archive classes, bucket-level IAM, signed URLs, lifecycle policies, and Object Versioning.
Why it's on the exam: Bucket creation, storage-class selection, and IAM-vs-ACL access control are guaranteed Planning and Configuring and Configuring Access and Security topics.
Managed PostgreSQL, MySQL, and SQL Server with high-availability (regional) configuration, read replicas, automated backups, and point-in-time recovery.
Why it's on the exam: Cloud SQL HA configuration, read replicas, and connecting from GCE/GKE via Cloud SQL Auth Proxy thread through Deploying and Implementing scenarios.
Authoritative managed DNS with public and private zones, DNSSEC, routing policies (geo, weighted round-robin, failover), and DNS forwarding for hybrid setups.
Why it's on the exam: DNS configuration for internal services, private zones for VPC, and routing policies surface in Planning and Configuring a Cloud Solution.
Global software-defined networking with subnets, firewall rules, routes, Shared VPC, VPC Network Peering, and Private Google Access for serverless endpoints.
Why it's on the exam: VPC subnet design, firewall rules, and Shared VPC vs. Peering selection underpin Setting up a Cloud Solution Environment and Configuring Access and Security.
Global / regional Layer-4 and Layer-7 load balancing — Application LB (HTTP/HTTPS), Network LB (TCP/UDP/SSL Proxy), Internal LB, with Cloud CDN integration.
Why it's on the exam: Choosing the right LB type (external vs. internal, global vs. regional, L4 vs. L7) is a recurring Planning and Configuring distractor.
Serverless event-driven functions (1st gen and 2nd gen built on Cloud Run) triggered by HTTP, Pub/Sub, Cloud Storage events, Firestore, and Eventarc.
Why it's on the exam: Cloud Functions is the named answer for event-driven glue (e.g. "process objects uploaded to a bucket") under Deploying and Implementing a Cloud Solution.
Primary command-line interface for provisioning and managing every GCP resource, plus the browser-based Cloud Shell with persistent $HOME and pre-installed SDK.
Why it's on the exam: ACE is heavily gcloud-driven — expect to read and write `gcloud compute instances create`, `gcloud container clusters get-credentials`, `gcloud iam` commands across most domains.
Managed CI/CD service that runs build steps in containers, produces container images, signs them with Binary Authorization, and triggers on source repo events.
Why it's on the exam: Cloud Build is the canonical "build and push a container then deploy" answer in Deploying and Implementing scenarios involving Cloud Run or GKE.
Managed private Git hosting with mirroring from GitHub/Bitbucket, built-in browsing, and native Cloud Build / Cloud Run trigger integration.
Why it's on the exam: Connecting a repo to a Cloud Build trigger for automated deploys is a recurring Deploying and Implementing pattern.
Block storage for Compute Engine VMs (Standard / Balanced / SSD / Extreme PD, snapshots, regional PD for cross-zone resilience) plus Filestore managed NFS for shared POSIX storage.
Why it's on the exam: Disk-type selection (Balanced vs. SSD vs. Extreme), snapshot-based DR, and Filestore for shared file systems are Planning and Configuring distractors.
Globally distributed managed messaging with topics, push and pull subscriptions, dead-letter topics, ordering keys, and exactly-once delivery.
Why it's on the exam: Pub/Sub is the canonical decoupling and fan-out answer in Deploying and Implementing pipelines that involve Cloud Functions or Dataflow.
Globally distributed, strongly consistent relational database with horizontal scaling, automatic synchronous multi-region replication, and PostgreSQL interface.
Why it's on the exam: Spanner vs. Cloud SQL selection (global consistency / massive scale vs. regional managed Postgres/MySQL) is a frequent Planning and Configuring distractor at the ACE level.
Fine-grained access control with predefined and custom roles, service accounts, Workload Identity Federation, deny policies, and resource hierarchy inheritance.
Why it's on the exam: Configuring Access and Security (18%) is built on IAM — role binding at the right resource level, service-account impersonation, and least-privilege design.
Managed creation and rotation of cryptographic keys (software, HSM-backed Cloud HSM, externally managed Cloud EKM) used for envelope encryption of GCS, BigQuery, Persistent Disk, and Secret Manager.
Why it's on the exam: CMEK-backed encryption-at-rest for sensitive data is the standard Configuring Access and Security answer when default Google-managed encryption is insufficient.
Operations suite for log aggregation, metrics, uptime checks, alerting policies, dashboards, and Logs Explorer / Metrics Explorer queries across the resource hierarchy.
Why it's on the exam: Ensuring Successful Operation of a Cloud Solution (20%) is the dedicated observability domain — alerting policies, log sinks, and metric-based autoscaling questions land here.
Immutable Admin Activity, Data Access, System Event, and Policy Denied audit streams routed through Cloud Logging to BigQuery, GCS, or Pub/Sub sinks.
Why it's on the exam: Compliance and "who did what, when" scenarios under Configuring Access and Security cite Cloud Audit Logs as the named source of record.
$95k–$140k–$195k USD annual
Range reflects US-based cloud / DevOps engineers where GCP is the primary platform. FAANG L4 SRE TC clears $220k. Non-coastal markets and pure ops roles trend lower. The cert pairs well with Kubernetes (CKA) for the strongest single combination on GCP-shop job postings.
Source: levels.fyi 2025–2026 (Google L3–L4 cloud engineering, partner SE roles), U.S. BLS OEWS May 2024 (15-1244 network and computer systems administrators, 15-1241 computer network architects). Figures are approximate; actual compensation depends on role, region, and experience.
ACE is the most-requested GCP technical credential on US job boards, by a wide margin over the Professional certs. Google Cloud partners and resellers commonly require it within 90 days of hire for any technical role, and large GCP customers (Spotify, Snap, PayPal, Twitter/X, Wayfair, several major retailers) treat it as a baseline screening signal for cloud-engineering and SRE positions. Demand is heaviest in markets with strong GCP presence — SF Bay Area, NYC, London, Bangalore — but the cert is portable. ACE is also the natural prerequisite path for the Professional tier; most candidates who go on to PCA or PCDOE start here.
There are no formal prerequisites. Google recommends six months or more of hands-on Google Cloud experience, but motivated candidates without prior GCP experience can pass after working through the official Associate Cloud Engineer Learning Path on Google Cloud Skills Boost (around 40–60 hours of labs and reading) plus a few weekends of free-tier console practice.
If you have no cloud background at all, completing the Cloud Digital Leader (CDL) first or an AWS / Azure foundational cert will materially shorten your study time — many ACE questions assume baseline familiarity with cloud concepts, the shared-responsibility model, and basic networking. Strong Linux command-line and basic networking literacy (subnets, routes, firewall rules) are effectively required even though Google does not list them.
ACE is rated associate but is more hands-on than the comparable AWS Solutions Architect Associate or Azure Administrator. Plan on 60–100 hours of study over 6–10 weeks if GCP is new to you, or 25–40 hours over 3–4 weeks if you have meaningful AWS or Azure experience. The exam is 50–60 multiple-choice / multiple-select questions in 120 minutes, delivered through Pearson VUE (Google migrated from Kryterion / Webassessor in early 2026 — no exams Feb 23 through Mar 1 2026).
The most common stumbling block is gcloud CLI syntax — questions frequently show four nearly identical command variants and reward the candidate who has actually typed the commands rather than just read about them. Hands-on Qwiklabs / Skills Boost labs are not optional. Google does not publish numeric scores — only pass/fail. The credential is valid for three years and recertification requires re-passing the current exam.
Current exam guide refreshed in early 2024 to reflect the GA of Cloud Run jobs, updated Cloud Workstations content, and modernized GKE Autopilot questions.
Major refresh that introduced GKE Autopilot questions and consolidated the deployment domain. Retired the older 2019 blueprint.
ACE (Google Cloud Associate Cloud Engineer) is a a moderately difficult exam expecting practical hands-on experience plus solid understanding of best practices Associate-level exam. Most candidates need 80–150 hours of study spread over 6–12 weeks for associate-level exams. Most candidates who score consistently above the passing threshold on practice exams pass on their first attempt.
Most candidates need 80–150 hours of study spread over 6–12 weeks for associate-level exams. Time-to-pass varies widely by prior experience. Engineers with hands-on production experience in the underlying technology typically need less; candidates new to the platform should plan toward the upper end of that range.
ACE is a recognized credential in the GCP ecosystem and signals validated knowledge to employers, recruiters, and clients. Whether it is worth the time and fee for you depends on your role and goals — it tends to pay off most for cloud engineers, architects, and consultants who work with GCP day-to-day or want to move into roles that do.
The passing score for ACE is Not published. The exam contains 50 questions and lasts 2 hr.
The ACE exam fee is $125 USD. Fees are set by GCP and may vary by region; always confirm the current price on the official GCP certification page before booking.
Google Cloud Foundational and Associate certifications are valid for 3 years. Recertify by re-passing the current version of the exam.
Yes. You can take the exam online (proctored via the provider's secure browser, available 24/7 in most regions) or at an in-person Pearson VUE test center during business hours. Both formats use the same questions, time limit, and passing score.
CertLabPro provides 15 study modes across the practice question bank for ACE. The exam-simulation mode mirrors the real exam: 50 questions in 2 hr, with the same passing threshold of Not published. Browse mode lets you read every Q&A statically.