If you go hunting for GCP Associate Cloud Engineer exam questions and answers, you will find two categories of result: illegal dumps, and generic study guides that list the domains at you. Neither tells you what the questions actually look like. So here are the seven recurring question shapes on the ACE, what each one is really testing, and how to not get caught.
Quick facts first so we are working from the same baseline: two hours, 50–60 multiple choice and multiple select questions, $125 USD plus tax, three-year validity, online-proctored or test centre. Passing is around 70%, though Google does not publish it officially.
And a warning that people on r/googlecloud repeat constantly and newcomers ignore: the real exam is noticeably harder than Google's sample questions. Maybe 10% harder, in the sense that the option wording is tighter and the distractors are closer together. Do not calibrate on the sample set.
1. "Which command does X?" — gcloud recall
The most straightforward type and the one where preparation pays off directly.
Which command creates a new instance with a specific service account attached?
You need gcloud compute instances create with --service-account and --scopes. There is no reasoning here, only whether you have typed the command before.
How to prepare: actually use the CLI. Do not read the reference. Spin up a free-tier project and create, list, describe, and delete every resource type by hand. gcloud, gsutil, bq, kubectl. The commands you have typed are the commands you remember at question 41 when you are tired.
2. "Which IAM role should you grant?" — least privilege
Extremely common. You get a person, a task, and four roles.
The rule that solves most of them: the exam always wants the most restrictive role that still accomplishes the task. Never Owner, almost never Editor. Know the predefined roles for the common services — roles/storage.objectViewer vs roles/storage.objectAdmin, roles/compute.instanceAdmin vs roles/compute.viewer — and know that when no predefined role fits neatly, the answer is a custom role.
The second rule: grant at the lowest level of the hierarchy that works. If one project needs it, grant on the project, not the folder or the org.
3. "Where does this belong in the resource hierarchy?" — org design
Organisation, folder, project, resource. Questions test whether you understand inheritance and where policy applies.
Know that IAM policies are inherited downward and are additive — you cannot revoke an inherited permission with a lower-level policy, which is a genuinely counterintuitive rule and therefore examined. Org policy constraints, by contrast, can be enforced at a high level and restrict everything below.
Projects are the billing and isolation boundary. When a question says "separate teams must not see each other's resources and must be billed separately," the answer is separate projects, essentially always.
4. "Which storage/database service?" — the classic sorting question
Same as at professional level, gentler.
- Object data, static assets, backups → Cloud Storage (then pick the class from the access pattern: Standard, Nearline 30-day, Coldline 90-day, Archive 365-day)
- Relational, existing MySQL/Postgres, modest scale → Cloud SQL
- Relational plus global horizontal scale → Spanner (expensive; only when the stem demands it)
- Wide-column, huge writes, time-series, no joins → Bigtable
- Mobile/web app document store with realtime sync → Firestore
- Analytics over huge datasets, SQL, no transactions → BigQuery
Read the lifecycle rule questions carefully. "Move to cheaper storage after 30 days, delete after a year" is a lifecycle policy with two actions, and the answer options like to give you one action only.
5. "How do you deploy this container?" — GKE and Cloud Run
Know gcloud container clusters create, node pools, and the difference between Standard and Autopilot (Autopilot when the stem says "minimise operational overhead / no node management").
Know the Kubernetes object vocabulary: Deployment for stateless, StatefulSet for stable identity, DaemonSet for one-per-node, Service types (ClusterIP internal, NodePort, LoadBalancer external), Ingress for HTTP routing. Horizontal Pod Autoscaler versus cluster autoscaler — pods versus nodes, and questions do try to blur them.
Cloud Run is the answer when the workload is a stateless HTTP container, traffic is spiky, and nobody wants to manage a cluster.
6. "What is wrong / why is this failing?" — troubleshooting
Underrated category. A VM cannot reach the internet, a bucket is not publicly readable, a pod is stuck in Pending.
The mental checklist that resolves most of them: firewall rules (default VPC allows egress, restricts ingress), routes, whether the VM has an external IP or needs Cloud NAT, IAM permissions on the service account, and quota. A pod stuck Pending is nearly always insufficient node resources or an unschedulable node selector.
Cloud NAT specifically: the answer whenever private instances need outbound internet without external IPs. Recognise that phrasing.
7. "Which pricing/commitment option?" — cost
Sustained use discounts apply automatically. Committed use discounts require a 1 or 3 year commitment and suit predictable baseline load. Spot/preemptible VMs are up to ~80% cheaper but can be reclaimed with 30 seconds notice — correct for batch, fault-tolerant, and stateless workers; never correct for a database or anything the stem calls critical.
How to put it together
Nine weeks is the commonly reported timeline, and it matches my experience — call it seven if you already work in AWS or Azure, since the concepts port and only the names change.
Split it: four weeks hands-on in a free-tier project doing the console and the CLI for every service, three weeks on IAM/networking/pricing detail, and the last two weeks on nothing but timed question sets. That last block is non-negotiable. I ran free GCP ACE practice questions in twenty-question blocks and tracked which of the seven shapes above I was losing points on, which turned out to be IAM roles and lifecycle rules, both fixable in an afternoon once identified.
Two exam-day habits worth building now. Read the last sentence first — the requirement lives there and it reframes the whole scenario. And watch for "select two", because under time pressure people miss it and get an otherwise-known question wrong for free.
The ACE is a fair exam. It is broader than it is deep, it punishes people who only read, and it rewards anyone who has genuinely clicked around a project for a couple of months. Full ACE domain breakdown on ExamCert if you want to check your coverage before booking.
Top comments (0)