Google Associate Cloud Engineer Exam Guide 2026 (ACE)

The Google Associate Cloud Engineer (ACE) certification validates your ability to deploy applications, monitor operations, and manage GCP infrastructure using both the Google Cloud Console and the gcloud command-line interface. Unlike purely conceptual cloud exams, the ACE expects you to know how things are actually done in GCP — the right CLI syntax, the correct IAM role, the proper network configuration. This guide focuses on the five exam sections, the question types that most frequently cause candidates to stumble, and a case-based study approach that builds genuine operational readiness.

The Five ACE Exam Sections Explained

The ACE exam is organized into five sections, each covering a distinct phase of working with cloud solutions in GCP. These sections are not equally weighted, and the exam reflects real-world GCP engineering tasks throughout.

• Setting Up a Cloud Solution Environment (~17.5%): Creating and configuring GCP projects, billing accounts, and IAM policies. Managing APIs, enabling services, and setting up a GCP organization structure. This section also covers creating Cloud SDK environments and configuring Cloud Shell.
• Planning and Configuring a Cloud Solution (~17.5%): Selecting compute resources (Compute Engine, GKE, Cloud Run, App Engine, Cloud Functions), choosing storage options (Cloud Storage, Cloud SQL, Cloud Spanner, Firestore, Bigtable, BigQuery), designing network topologies (VPCs, subnets, firewall rules, load balancers, Cloud DNS), and estimating costs using the Google Cloud Pricing Calculator.
• Deploying and Implementing a Cloud Solution (~25%): The largest section. Covers deploying Compute Engine instances using gcloud and the console, deploying containerized workloads on GKE, deploying serverless applications (Cloud Run, Cloud Functions), managing storage objects (gsutil), and deploying infrastructure with Deployment Manager or Terraform.
• Ensuring Successful Operation of a Cloud Solution (~25%): Managing Compute Engine and GKE resources, configuring and viewing logs in Cloud Logging, using Cloud Monitoring to create dashboards and alerting policies, managing projects, and configuring Cloud Storage lifecycle policies.
• Configuring Access and Security (~15%): Managing IAM roles and service accounts, viewing audit logs, managing encryption keys with Cloud KMS, and configuring organization policies.

Hard Question Types: gcloud CLI Commands

The gcloud CLI is central to the ACE exam. A significant portion of questions present a task and ask which gcloud command achieves it, or present a command and ask what it does. Candidates who have only used the Cloud Console and never practiced with the CLI consistently report that gcloud questions are the most difficult part of the exam.

The most important gcloud command families to know are:

• gcloud compute instances: create, start, stop, delete, list, ssh, describe. Know the flags for machine type (--machine-type), zone (--zone), image (--image-family, --image-project), and startup scripts (--metadata startup-script).
• gcloud container clusters: create, get-credentials, resize, upgrade, delete. Know how to authenticate kubectl to a GKE cluster and the flags for node count and machine type.
• gcloud iam: service-accounts create, service-accounts add-iam-policy-binding, roles list, roles describe. Understand how to assign roles to service accounts and the difference between --member formats (user:, serviceAccount:, group:).
• gsutil: cp, mv, rm, ls, mb (make bucket), iam ch (change IAM), acl ch (change ACL). Know the difference between gsutil and gcloud storage commands since both appear in study materials.
• gcloud config: set project, set compute/zone, list. These configuration management commands appear in questions about switching between projects and setting defaults.

Hard Question Types: IAM Hierarchy and Inheritance

IAM questions are the second category where ACE candidates most frequently lose points. The GCP resource hierarchy (Organization → Folders → Projects → Resources) determines how IAM policies are inherited, and the exam tests whether you understand the implications of assigning roles at different levels.

The core rule is that IAM policies are inherited downward and cannot be restricted by a lower-level policy. If you grant a user the Compute Admin role at the folder level, they have that role across all projects in that folder, and a project-level IAM binding cannot remove it. This inheritance model frequently appears in questions about the principle of least privilege.

Service accounts are also heavily tested. Know the difference between user-managed and Google-managed service accounts, how to attach a service account to a Compute Engine instance (--service-account flag), and how to grant a service account permissions on a specific resource rather than at the project level.

GCP Console vs CLI: Exam Tips

The ACE exam tests both the Cloud Console and the gcloud CLI, but they are not interchangeable in exam questions. Some tasks are described in a scenario that implies a specific tool — for instance, a question about automating a repeated task or scripting a deployment strongly implies the CLI answer is correct, while a question about a one-time configuration task may accept either.

A practical study habit is to perform every lab or exercise twice: once using the Cloud Console to understand the visual structure of the service, and once using gcloud to build CLI fluency. This dual approach also helps you recognize when a question is asking about a Console-specific feature (like navigating the IAM policy troubleshooter) versus a CLI-centric workflow.

A Case-Based Study Approach for the ACE

The most effective study method for the ACE is building and operating real GCP architectures rather than passively reading documentation. GCP's free trial and always-free tier provide sufficient credits and free resources to build the scenarios the exam tests.

Work through these four case scenarios during your prep, performing every step via both Console and gcloud:

• Web application deployment: Create a VPC with public and private subnets, deploy a Compute Engine instance in the public subnet, configure a firewall rule to allow HTTP/HTTPS traffic, and place a Cloud Load Balancer in front of it.
• Container workload: Build a Docker image, push it to Artifact Registry, create a GKE Autopilot cluster, deploy the image as a Kubernetes Deployment, and expose it via a LoadBalancer Service.
• Serverless and storage: Create a Cloud Storage bucket, write a Cloud Function triggered by object uploads, and configure a Cloud Scheduler job to trigger a Cloud Run service on a schedule.
• Operations and monitoring: Set up a Cloud Monitoring dashboard for a Compute Engine instance, create an alerting policy that fires on high CPU utilization, and use Log Explorer to filter logs by severity and resource type.

How to Know You Are Ready to Sit the ACE

A reliable readiness signal for the ACE is answering practice questions without hesitation on gcloud command syntax, IAM role selection, and service selection questions. Hesitation on these three categories in practice is the clearest indicator that more hands-on work is needed.

Certify Copilot generates ACE-style practice questions that cover CLI syntax, IAM scenarios, and service selection in the scenario-based format the real exam uses. The AI-powered explanations break down each answer in context — explaining not just which gcloud command is correct but why the other options would fail or produce a different outcome. This is exactly the depth of understanding the ACE requires.