Exam facts at a glance
- 50 questions, multiple choice + multiple select.
- 120 minutes. Average ~2 min 24 sec per question.
- $200 USD per attempt.
- Passing score not published; community estimates ~70%.
- Valid 3 years.
- Retake waits: 14 days → 60 days → 365 days.
- Online-proctored or test-centre delivery. Closed book.
- Full exam-format details: ACE Exam Guide 2026.
GCP resource hierarchy
One of the most-tested concepts on Domain 1:
Organization (1) └── Folders (many, nested up to 10 deep) └── Projects (many) └── Resources (VMs, buckets, clusters, etc.)IAM inheritance is downward. A role granted at organisation level applies to every folder, project, and resource beneath. A role granted at project level applies to every resource in that project. Resource-level bindings are most specific.
Billing accounts are linked to projects, not to organisations. One billing account can pay for many projects. One project has exactly one billing account.
Compute decision tree (memorise this)
Given a scenario, pick the compute option in this order:
- Scale-to-zero + HTTP-triggered + minimal ops → Cloud Run service.
- Scale-to-zero + event-triggered + single function → Cloud Functions gen 2.
- Container orchestration + low operational overhead → GKE Autopilot.
- Container orchestration + needs DaemonSets / privileged / custom CNI → GKE Standard.
- Web app / API with managed runtime + no infra ops → App Engine standard (or Cloud Run — Cloud Run is the modern default).
- Full OS control / long-running / specialised hardware → Compute Engine.
- Finite batch job, runs to completion → Cloud Run jobs or Batch.
See Compute Engine vs GKE vs Cloud Run for the detailed comparison.
Compute services at a glance
Choosing the right compute option is one of the most heavily tested ACE topics. This table is the fast-scan version of the decision tree above:
| Service | Management model | Billing unit | Scales to zero? | Best for |
|---|---|---|---|---|
| Compute Engine | You manage the OS/VM | Per VM (vCPU/memory-second) | No | Full OS control, long-running, specialised hardware |
| GKE Standard | You manage nodes | Per VM (node) | No (nodes persist) | Complex K8s needs: DaemonSets, privileged pods, custom CNI |
| GKE Autopilot | Google manages nodes | Per pod (CPU/mem/storage) | Pods scale down, not to true zero | Standard K8s workloads, low ops overhead |
| Cloud Run (services) | Fully managed | Per request / CPU-second | Yes | HTTP-triggered, request/response, minimal ops |
| Cloud Functions (gen 2) | Fully managed | Per invocation | Yes | Single-purpose, event-triggered functions |
| App Engine (standard) | Fully managed | Per instance-hour | Yes | Managed-runtime web apps, legacy but still tested |
Exam shortcut: when a scenario emphasises “minimal ops” or “no infrastructure to manage,” the answer is usually Cloud Run or Cloud Functions. When it mentions Kubernetes manifests, Helm charts, or container orchestration at scale without naming a specific node-level requirement, it is GKE Autopilot. Compute Engine and GKE Standard are correct only when the scenario explicitly demands something the managed options cannot do — full OS access, DaemonSets, privileged containers, or custom networking.
GKE Autopilot vs Standard
| Aspect | Autopilot | Standard |
|---|---|---|
| Node management | Google-managed | You manage |
| Billing | Per pod (CPU/memory/storage) | Per VM (node) |
| DaemonSets | Limited / restricted | Yes |
| Privileged containers | No | Yes |
| Custom CNI | No | Yes |
| Node-level access (SSH) | No | Yes |
| Best for | Standard web/API workloads, low ops | Complex requirements, node-level control |
Exam tell: “minimise operational overhead” or “team has no Kubernetes ops experience” → Autopilot. “Needs DaemonSets” or “privileged container” or “custom CNI” → Standard.
Cloud Run essentials
- Services: request/response model. Scales 0 to N. Has revisions and traffic splits.
- Jobs: finite batch work. Runs to completion, exits.
- Revisions: each deploy creates a new revision. Traffic splits between revisions (e.g., 90/10 canary).
- Min/max instances: control cold starts vs cost. min=0 means scale to zero.
- Concurrency: requests per container instance, default 80, max 1000.
- Public access: requires IAM binding
allUsers → roles/run.invoker. Otherwise 403. - VPC connector: for accessing private resources inside a VPC.
Cloud Storage classes
| Class | Access pattern | Min storage duration | Best for |
|---|---|---|---|
| Standard | Frequent | None | Active data, websites |
| Nearline | ~Monthly | 30 days | Backups, infrequent media |
| Coldline | ~Quarterly | 90 days | Disaster recovery |
| Archive | <Annual | 365 days | Compliance, long-term archive |
| Autoclass | Mixed / unpredictable | N/A | Variable access, hands-off |
Lifecycle policies: transition objects between classes (e.g., Standard → Nearline after 30 days) or delete objects after N days. Signed URLs: time-limited HTTPS URLs that grant access without IAM. Use for sharing with non-Google users. IAM beats ACLs: modern Google practice is uniform bucket-level access (UBLA) with IAM only.
Cloud SQL essentials
- Engines: MySQL, PostgreSQL, SQL Server.
- HA (high availability): synchronous replica in a different zone in the same region. Automatic failover.
- Read replicas: asynchronous, offload read traffic. Up to 10 replicas. Different region allowed.
- Automated backups: daily, retained 7 days by default.
- Point-in-time recovery (PITR): restore to any second within retention period, using binary logs.
- Connection: via Cloud SQL Auth Proxy (recommended), private IP (VPC-native), or public IP + authorised networks.
VPC and firewall rules
- VPCs are global. Subnets are regional (one CIDR range per region).
- Auto-mode: GCP creates a subnet per region automatically. Custom-mode: you create each subnet.
- Firewall rules: priority (0-65535, lower=higher priority), direction (ingress/egress), action (allow/deny), source/target.
- Default rules: allow all egress, allow ingress for SSH/RDP/ICMP from anywhere on the default network. Custom-mode VPCs have no default firewall rules.
- Source targeting: by IP range (CIDR), network tag, or service account.
- Private Google Access: enable on a subnet so VMs without external IPs can reach Google APIs.
- Cloud NAT: outbound internet for private VMs (no external IPs).
- VPC Peering: connect two VPCs (no transitive peering). Shared VPC: one host project shares network with service projects.
See GCP Networking Fundamentals for the deep dive.
Load balancers — which when
| LB type | Layer | Scope | Best for |
|---|---|---|---|
| Global external HTTP(S) | L7 | Global | Public web apps, multi-region |
| Regional external HTTP(S) | L7 | Regional | Single-region public apps |
| Internal HTTP(S) | L7 | Regional | Internal microservices |
| External TCP/UDP Network LB | L4 | Regional | Non-HTTP TCP/UDP traffic |
| Internal TCP/UDP Network LB | L4 | Regional | Internal TCP traffic |
IAM roles cheat sheet
Three role types, and the exam has a strong preference for one of them:
| Role type | Example | Granularity | Exam guidance |
|---|---|---|---|
| Primitive | roles/owner, roles/editor, roles/viewer | Very broad — applies to the whole project | Avoid. Rarely the right answer; treat it as a trap option. |
| Predefined | roles/compute.instanceAdmin, roles/storage.objectViewer | Scoped to a service and a job function | The expected answer for the large majority of IAM scenarios. |
| Custom | User-defined permission bundle | As narrow as you define it | Correct only when the scenario says no predefined role fits, or asks for least-privilege beyond what predefined roles offer. |
Bind a role at four possible levels (most specific wins / unions):
Organization → Folder → Project → ResourceCommon predefined roles to recognise:
roles/viewer,roles/editor,roles/owner(primitive — avoid)roles/compute.instanceAdmin.v1,roles/compute.networkAdminroles/container.admin,roles/container.developer(GKE)roles/storage.admin,roles/storage.objectViewer,roles/storage.objectCreatorroles/iam.serviceAccountUser,roles/iam.serviceAccountTokenCreatorroles/cloudsql.admin,roles/cloudsql.client,roles/cloudsql.instanceUserroles/run.admin,roles/run.invokerroles/logging.viewer,roles/monitoring.viewer
Full IAM concepts: GCP IAM Explained.
Service accounts and Workload Identity
The Google-recommended modern patterns (and what the exam expects):
- Attach SA directly to VMs and Cloud Run services. No JSON keys involved.
- Workload Identity for GKE: bind a Kubernetes SA to a Google SA. Pods get short-lived tokens.
- Service-account impersonation: short-lived access via
--impersonate-service-account. Avoids long-lived JSON keys. - Default service accounts: avoid using these for production workloads. Create user-managed SAs instead.
- JSON key files: almost always the wrong exam answer. If you see “download a service-account JSON key” in the options, suspect a trap.
Monitoring, logging, alerting
- Cloud Monitoring: metrics, dashboards, uptime checks, alert policies, notification channels.
- Cloud Logging: log buckets (default 30-day retention), log sinks (export to Pub/Sub, BigQuery, Cloud Storage), log-based metrics.
- Cloud Trace: distributed tracing for latency analysis.
- Cloud Profiler: CPU and heap profiling.
- Cloud Audit Logs: Admin Activity (always on, free), Data Access (opt-in, paid), System Event, Policy Denied.
- Alert policies: built on Cloud Monitoring metrics. Thresholds, duration windows, notification channels (email, SMS, Slack, PagerDuty, webhook).
gcloud quick-reference table
The commands the exam shows most often, grouped by the resource they touch — this is the scannable version, the full list follows below:
| Category | Command | What it does |
|---|---|---|
| Config | gcloud config set project PROJECT_ID | Sets the active project for subsequent commands |
| Config | gcloud services enable SERVICE.googleapis.com | Turns on an API for the current project |
| Compute | gcloud compute instances create NAME --machine-type=... | Creates a VM instance |
| Compute | gcloud compute instance-groups managed create NAME | Creates a managed instance group (autoscaling) |
| GKE | gcloud container clusters create NAME --autopilot | Creates a GKE Autopilot cluster |
| GKE | gcloud container clusters get-credentials NAME | Fetches kubeconfig so kubectl can reach the cluster |
| Cloud Run | gcloud run deploy SERVICE --image=IMAGE | Deploys a container image as a Cloud Run service |
| Cloud Run | gcloud run services update-traffic SERVICE --to-revisions=... | Splits traffic between revisions (canary releases) |
| IAM | gcloud projects add-iam-policy-binding PROJECT --member=... --role=... | Grants a role to a user or service account |
| IAM | gcloud iam service-accounts create NAME | Creates a user-managed service account |
| Storage | gcloud storage buckets create gs://BUCKET | Creates a Cloud Storage bucket |
| Storage | gcloud storage cp FILE gs://BUCKET/ | Uploads a file to a bucket |
| Networking | gcloud compute firewall-rules create NAME --allow=... | Creates a VPC firewall rule |
| Cloud SQL | gcloud sql instances create NAME --database-version=... | Creates a managed SQL instance |
30 must-know gcloud commands
Recognise the verb and the resource for each:
# Auth & config gcloud init gcloud auth login gcloud auth application-default login gcloud config set project PROJECT_ID gcloud config configurations create NAME gcloud projects list gcloud services enable SERVICE.googleapis.com # Compute Engine gcloud compute instances create NAME --machine-type=e2-medium --zone=us-central1-a gcloud compute instances list gcloud compute instances start/stop/delete NAME gcloud compute ssh NAME gcloud compute instance-templates create NAME ... gcloud compute instance-groups managed create NAME ... # GKE gcloud container clusters create NAME --region=us-central1 gcloud container clusters create NAME --autopilot --region=us-central1 gcloud container clusters get-credentials NAME --region=us-central1 gcloud container node-pools create NAME --cluster=CLUSTER ... # Cloud Run gcloud run deploy SERVICE --image=IMAGE --region=REGION gcloud run services list gcloud run services update-traffic SERVICE --to-revisions=REV1=90,REV2=10 # IAM gcloud iam service-accounts create NAME gcloud iam service-accounts keys create FILE --iam-account=SA_EMAIL # avoid in production gcloud projects add-iam-policy-binding PROJECT --member=USER --role=ROLE gcloud projects remove-iam-policy-binding PROJECT --member=USER --role=ROLE # Cloud Storage gcloud storage buckets create gs://BUCKET --location=us-central1 gcloud storage cp FILE gs://BUCKET/ gcloud storage rm gs://BUCKET/FILE gsutil iam ch user:USER@example.com:objectViewer gs://BUCKET # legacy syntax # Cloud SQL gcloud sql instances create NAME --database-version=POSTGRES_15 --tier=db-f1-micro --region=us-central1 gcloud sql instances listYou do not need to memorise every flag. Recognise the verb-resource pattern. If you see gcloud container clusters in an answer option, you should immediately know it is about GKE.
Top 5 trap-question patterns
- GKE Autopilot vs Standard — Autopilot is the answer when ops overhead is the constraint and no node-level requirements exist.
- Service-account JSON keys — almost always wrong. Use Workload Identity, impersonation, or direct SA attachment.
- Primitive IAM roles (Owner/Editor/Viewer) — almost always wrong. Use predefined or custom roles.
- Quota level confusion — VMs and CPU cores are regional quotas. “Autoscaler stopped at 20 VMs” → regional CPU quota.
- OS Login vs metadata SSH keys — modern projects use OS Login (IAM-based). Revoke access via IAM, not metadata.
Detailed explanations in How to Pass Google ACE on the First Try.
Exam-day pocket guide
If you can only review one section in the final hour before exam, review this:
- 50 questions, 120 minutes, ~2 min per question average. Flag long ones, return at the end.
- “Choose two” or “Choose three” questions: read the stem twice.
- When two answers look right: pick the more managed / serverless / IAM-based / regional one.
- JSON service-account keys: almost always wrong.
- Primitive IAM roles: almost always wrong.
- Autopilot beats Standard unless node-level needs are explicit.
- Cloud Run beats GKE unless container orchestration features are explicit.
- Multi-select questions: partial credit does not exist. Pick the full set or you lose the point.
- If frozen on a question past 4 minutes: flag, move on, return at the end.
Frequently asked questions
Can I use this cheat sheet during the Google ACE exam?
No. The ACE exam is closed book under proctored conditions, whether you take it online through Kryterion or in person at a Kryterion test centre. Notes, reference sheets, printed cheat sheets, and any external resource are strictly prohibited during the exam window — for online-proctored sessions, the proctor performs a full webcam room scan before you start specifically to catch anything that looks like a reference sheet, and being caught with one mid-exam can void your attempt entirely. The right way to use this cheat sheet is as a compression tool for review before you sit the exam, not as a resource you plan to consult during it. Read it in full early in your study to preview the scope of all five domains, then again in the final 48-72 hours before exam day as your last review pass, when you want breadth of recall rather than new learning.
Is there a printable PDF of the Google ACE cheat sheet?
A dedicated printable PDF version is coming soon, but you do not need to wait for it. This web version is deliberately structured with clean tables and lists so it works well for both on-screen review and browser printing right now — open the page, use your browser's print function (Ctrl+P on Windows, Cmd+P on Mac), and select "save as PDF" as the destination instead of a physical printer. That gives you a clean, offline-readable copy you can annotate, highlight, or read on a tablet without needing an internet connection during your final review session. Because the page updates periodically as Google revises exam content (most recently around GKE Autopilot defaults, Cloud Run jobs, and Workload Identity Federation), re-exporting a fresh PDF close to your exam date is safer than saving one early in your study and treating it as final.
How should I use this cheat sheet during study?
Read it end-to-end once at the start of week 1 of your study plan to preview the full scope of what ACE covers — this gives you a mental map before you dive into any single domain in depth. Then reference specific sections as you work through each domain during the middle weeks of your study: the compute decision tree while you cover Domain 2 and 3, the IAM tables while you cover Domain 5, and so on. Read it again in full during the final 48 hours before exam day as your last review pass, when the goal is fast recall rather than new learning. Do not treat it as your primary study material, though — it is a compression of concepts you should already understand from hands-on practice and deeper reading, not a substitute for actually running the gcloud commands and deploying real resources in a GCP project.
What is the most important section to memorise?
Two areas account for the largest share of trap-question failures on the real exam. First, the compute-selection decision tree — knowing cold when to pick Cloud Run, GKE Autopilot, GKE Standard, Compute Engine, Cloud Functions, or App Engine based on scenario cues like "minimal ops overhead" or "needs DaemonSets." Second, the IAM and service-account patterns — Workload Identity for GKE pods, service-account impersonation for short-lived access, and the strong preference for predefined roles over primitive roles (Owner, Editor, Viewer) or downloaded JSON keys. If you only have time to deeply internalise two sections of this cheat sheet before exam day, the compute-comparison table and the IAM roles table above are the two with the highest return on review time, because they recur across multiple exam domains rather than being confined to a single one.
Are the gcloud commands here exam-realistic?
Yes. These are the actual command shapes and verb-resource patterns the ACE exam shows in question stems and answer options — the exam frequently displays a real gcloud command or its output and asks what it does, what is wrong with it, or which flag is missing, so recognising these patterns quickly matters more than memorising exhaustive flag lists. You do not need to memorise every possible flag for every command, but you should be able to instantly recognise the verb and the resource being acted on (gcloud compute instances create, gcloud container clusters create, gcloud iam service-accounts create, gcloud storage buckets create, and similar) and know the two or three most common flags for each. The quick-reference table above groups these by category specifically so you can drill the pattern recognition rather than rote memorisation.
Pair the cheat sheet with practice
The cheat sheet is for review. The CertSharp question bank is for testing whether you have actually internalised it. 30 free ACE questions, no signup. $11.99 lifetime for the full 500.