ACE study guide: Associate Cloud Engineer domains and a 6-week plan

The Google Cloud Associate Cloud Engineer (ACE) exam tests whether you can set up, deploy, run and secure workloads on Google Cloud day to day. It is the hands-on associate certification: less about architecture on a whiteboard, more about which command, setting or service gets a real task done. You answer 50 to 60 multiple-choice and multiple-select questions in two hours, online or at a test centre.

ACE at a glance

Details as of September 2026 — confirm on the official exam page before booking.

The certification is valid for three years. Google also offers a shorter renewal exam for holders of an active certification who are within the renewal window.

Who this exam is for

There is no formal prerequisite. Google recommends six months or more of hands-on experience with Google Cloud. The exam guide describes someone who deploys and secures applications and infrastructure, monitors operations across multiple projects, and maintains enterprise solutions to meet performance targets, using AI tooling to help with common platform tasks.

In practice that means cloud engineers, administrators moving to Google Cloud, and developers who own their deployments. If you want a business-level view of Google Cloud first, the [Cloud Digital Leader study guide](/blog/cdl-study-guide) covers the foundational exam. If you already design systems for others, the [Professional Cloud Architect study guide](/blog/pca-study-guide) is the natural next step after ACE.

What the exam covers

The exam guide has four sections. Google's exam page notes that the exam was updated for recent branding changes, so study with current product names: for example, Agent Runtime on Gemini Enterprise Agent Platform (formerly Vertex AI Agent Engine) and Agent Platform Workbench (formerly Vertex AI Workbench).

Setting up a cloud solution environment (~20%)

This section covers the foundations every project sits on: building a resource hierarchy of organisation, folders and projects, applying organisation policies, granting IAM roles, managing users and groups in Cloud Identity, enabling APIs, checking quotas and requesting increases, and verifying which products are available in which regions and zones. Newer items include Cloud Asset Inventory with Gemini Cloud Assist and Workforce Identity Federation. Billing is its own task: creating billing accounts, linking projects, setting budgets and alerts, and exporting billing data. The judgement tested is placement: at which level of the hierarchy a policy or role belongs, and what inherits from it.

Planning and implementing a cloud solution (~30%)

The broadest section. Compute questions ask you to choose between Compute Engine, GKE, Cloud Run, Cloud Run functions and Agent Runtime for a workload; to launch instances with the right availability policy, disk type (zonal or regional Persistent Disk, Hyperdisk) and machine type, including Spot VMs; to build autoscaled managed instance groups from templates; and to deploy GKE clusters as Autopilot, regional or private. Event-driven deployments using Pub/Sub, Cloud Storage notifications and Eventarc also appear, as does the choice between GPUs and TPUs.

Data questions cover picking the right product from Cloud SQL, BigQuery, Firestore, Spanner, Bigtable, AlloyDB, Memorystore, Pub/Sub, Dataflow and Managed Service for Apache Kafka, and the right Cloud Storage class. Networking questions cover custom-mode VPCs, Shared VPC, VPC Network Peering, firewall rules and Cloud NGFW policies with secure Tags and service accounts, Cloud VPN versus Cloud Interconnect, load balancer choice and Network Service Tiers. A tooling task covers Terraform, Config Connector, Helm and Fabric FAST, plus AI-assisted planning with Gemini CLI, Google Antigravity, Gemini Cloud Assist and Application Design Center.

Ensuring the successful operation of a cloud solution (~30%)

This section is about running what you built. Compute tasks include connecting to instances, snapshots and images, GKE node pools and Kubernetes resources, horizontal and vertical Pod autoscaling, Autopilot resource requests, Cloud Run revisions, traffic splitting and autoscaling, attaching GPUs and TPUs, deploying an agent to Agent Runtime, and managing notebooks and Cloud Workstations. Storage tasks cover bucket security and lifecycle rules, querying and backing up databases, estimating storage cost, checking Dataflow and BigQuery job status, Database Center and customer-managed encryption keys.

Networking tasks include resizing subnets, reserving static IPs, custom routes, Cloud DNS and Cloud NAT. Monitoring and logging is dense: alerting policies, custom metrics, audit and VPC Flow Logs, log buckets and routers, exporting logs to BigQuery or external systems, Cloud Trace and Cloud Profiler, the Ops Agent, Managed Service for Prometheus, Personalized Service Health, Active Assist and Cloud Hub. The judgement here is diagnostic: given a symptom, which tool shows you the cause.

Configuring access and security (~20%)

The final section covers IAM policies and inheritance, basic, predefined and custom roles, and service accounts in depth: creating them, granting least privilege, attaching them to resources, impersonation, short-lived credentials, using a service account from a GKE application and provisioning Workload Identity Federation. The key skill is picking the narrowest role and the credential that avoids long-lived keys.

A 6-week study plan

This plan assumes six to eight hours a week and a Google Cloud project where you can build and delete things. Keep a budget alert on it from day one, which is also exam material. Time follows the weights, with the two 30% sections given the most room.

Week 1: Environment and billing (20%). Create a small hierarchy with a folder and two projects, apply an organisation policy, grant roles at different levels and see what inherits. Set a budget, link a billing account and turn on billing export to BigQuery.

Week 2: Compute choices (part of 30%). Launch a VM, build an instance template and an autoscaled managed instance group, and try a Spot VM. Deploy the same container to Cloud Run and to a GKE Autopilot cluster, then write down in one line each when you would choose Compute Engine, GKE, Cloud Run or Cloud Run functions.

Week 3: Data, storage and networking (rest of 30%). Build a custom-mode VPC with two subnets, firewall rules and a Cloud NAT gateway. Compare storage classes and set a lifecycle rule. Make a table of the database products by data model, scale and regional reach, because product-choice questions are common. Finish with a short look at Terraform and Gemini Cloud Assist.

Week 4: Operating compute and data (part of 30%). Add and resize a GKE node pool, configure Pod autoscaling, split traffic between two Cloud Run revisions, schedule snapshots and back up a Cloud SQL instance. Take mixed domain papers on sections 2 and 3 and note which answers you got wrong for the same reason.

Week 5: Monitoring, logging and IAM (rest of 30% + 20%). Install the Ops Agent, create an alerting policy and a log sink to BigQuery, and find an audit log entry for a change you made. Then work through service accounts: create one, grant it a narrow role, impersonate it, and let a GKE workload use it without a key file.

Week 6: Rehearsal. Sit a full-length mock in two hours, review every question including the ones you got right, target the weakest section, then sit a second mock later in the week. Our [guide to using practice exams](/blog/how-to-use-practice-exams-effectively) explains how to review without memorising answers, and the [study plan template](/blog/cloud-certification-study-plan-template) helps if you need to stretch this over more weeks.

Common traps

• Granting roles too broadly. When one option grants a basic role such as Editor and another grants a predefined role that covers the task, the narrow role is almost always right. The same applies to granting at the project versus the resource level.
• Reaching for service account keys. Downloading a JSON key is rarely the best answer. Look for impersonation, attached service accounts, Workload Identity Federation or short-lived credentials first.
• Confusing where a setting lives. Organisation policies, IAM roles, firewall rules and quotas each apply at different levels. Read what scope the question is asking about before choosing.
• Missing the operational-effort constraint. "Least management overhead" usually points to a managed or serverless option such as Cloud Run or GKE Autopilot, not a self-managed VM.
• Mixing up storage and database products. Bigtable, Spanner, Firestore, Cloud SQL and AlloyDB solve different problems. Learn each one's data model and scale, not just its name.
• Multiple-select questions. Choose exactly the number of answers asked for, and test each one against the scenario on its own.
• Studying with old product names. Older courses use Vertex AI names and miss Cloud NGFW and the Gemini tools.

How to practise

CertifyCloudx has original ACE practice questions written against the current Google exam guide, covering all four sections with an explanation for every option. Our article on [how CertifyCloudx practice questions are written](/blog/how-certifycloudx-practice-questions-are-written) describes the method.

• Full-length timed mock exams at the real exam's two hours
• Domain papers of up to 25 questions each (60 minutes per 25)
• Multiple-select questions alongside single-answer ones
• Free practice sets on the free plan, up to 10 questions a day, no card needed

Start with the [ACE practice questions](/certifications/gcp-associate-cloud-engineer).

Frequently asked questions

How hard is the Associate Cloud Engineer exam?

It is an associate-level exam, but it is broad. Google recommends six months or more of hands-on experience, and the questions reward people who have actually configured the services.

How long should I prepare for ACE?

With some prior cloud experience, six weeks at six to eight hours a week is a reasonable range. If you are new to both cloud and Linux administration, allow longer and spend more of it in a real Google Cloud project.

Do I need Cloud Digital Leader before ACE?

No. Google lists no prerequisite for ACE. Cloud Digital Leader is useful if you want a business-level overview first, but most engineers go straight to ACE.

How long is the ACE certification valid?

Three years. Google offers a shorter renewal exam for holders of an active certification who are within the renewal eligibility period; check the official exam page for current details.

Are CertifyCloudx questions taken from the real exam?

No. All CertifyCloudx questions are original and written from Google's public exam guide. Using leaked questions breaks the exam agreement and does not prepare you for scenario reasoning.

CertifyCloudx is independent and not affiliated with Google. Associate Cloud Engineer is a trademark of its owner. All CertifyCloudx practice questions are original.