Google Associate Cloud Engineer

Before anyone can practice SRE on Google Cloud, someone has to be able to actually operate Google Cloud: stand up a project without leaving the billing account wide open, get a workload running on the right compute service, wire up basic monitoring, and not lock an entire team out of a resource with a badly scoped IAM binding. The Google Associate Cloud Engineer (commonly shortened to ACE) is Google's entry-level, technical credential for exactly that — deploying, monitoring, and maintaining GCP resources — and it's usually the first Google Cloud certification an SRE ends up holding, often well before the Professional Cloud DevOps Engineer this course's certifications hub already covers in depth. This page covers what the ACE actually tests, how it relates to that Professional-tier exam and to the SRE discipline this course teaches, the official domains, and who should bother sitting it.

What the ACE actually is, and who it's for

☺ Like you're 10: It's a closed-book, multiple-choice test about running Google Cloud day to day — no live console, no terminal, just scenarios and the best answer among four or five.

The Google Associate Cloud Engineer is Google Cloud's own associate-tier, technical certification, aimed at people who deploy and maintain workloads and infrastructure on GCP. Unlike the CKA, it's a knowledge-based exam: multiple-choice and multiple-select questions, delivered proctored — either at a physical testing center or online with a remote proctor. There's no live cluster or live project to build or break during the exam itself; you're reasoning through a described scenario and picking the option Google considers correct, not typing gcloud commands against a real environment on the clock.

It sits deliberately at the "can you operate this" altitude, not the "should this exist" altitude. It doesn't ask you to design a multi-region disaster-recovery architecture from scratch — that's Professional Cloud Architect territory — and it doesn't ask you to build a CI/CD pipeline or apply SRE practice formally — that's the Professional Cloud DevOps Engineer this course already covers. The ACE asks something narrower and more mechanical: given a project that mostly already exists, can you set it up correctly, deploy the right resource for the job, keep it running, and secure access to it.

Why this is usually the first Google Cloud credential an SRE holds

☺ Like you're 10: This one teaches you to safely drive the car; the Professional exam teaches you to run the whole reliability program for the fleet. Most people need to know how to drive first.

This course's certifications hub already covers the Professional Cloud DevOps Engineer in depth — the exam whose domains include bootstrapping a Google Cloud organization, building CI/CD pipelines, applying SRE practices to a service, and implementing service monitoring strategies. Every one of those Professional-tier domains quietly assumes you already have ACE-level fluency underneath it. You can't sensibly "bootstrap a Google Cloud organization" if you've never created a project or assigned an IAM role by hand; you can't "implement service monitoring strategies" if Cloud Monitoring and Cloud Logging are unfamiliar tools rather than ones you've already used to watch a real workload.

That's the relationship this page is built around: the ACE is the operational bedrock, and the Professional Cloud DevOps Engineer is what gets built on top of it. Sitting the ACE first means the Professional exam's SRE-practice and monitoring-strategy domains read as "the deeper version of something I already know," rather than as unfamiliar console screens on top of unfamiliar ideas at the same time.

Neither exam substitutes for the other, and the two are complementary rather than redundant. See the certifications hub for the full comparison against every credential this course tracks, including the Professional Cloud DevOps Engineer's own domain breakdown and logistics.

The official domains

☺ Like you're 10: Five topics, roughly in the order you'd actually do them — set the environment up, plan what to build, build it, keep it running, and lock it down.

Google's own Associate Cloud Engineer exam guide publishes five domains. Unlike AWS's associate-tier exams, Google doesn't publish explicit percentage weights for this exam — the guide lists domains and their competencies without a scored breakdown, so treat the order below as the exam guide's own structure, not a percentage you can budget study time against. In practice, the deploying-and-implementing and ensuring-successful-operation domains carry the most exam real estate simply because they cover the most services.

Setting up a cloud solution environment

• Setting up cloud projects and accounts — creating a project, establishing the resource hierarchy (organization → folders → projects), assigning users to predefined IAM roles
• Managing billing configuration — linking a project to a billing account, setting up budgets and alerts in Cloud Billing, configuring billing export to BigQuery
• Installing and configuring the command-line interface (CLI) — installing the Cloud SDK, initializing gcloud, using Cloud Shell, managing multiple named gcloud configurations

Planning and configuring a cloud solution

• Planning and estimating GCP product use with the Google Cloud Pricing Calculator
• Planning and configuring compute resources — choosing among Compute Engine, GKE, Cloud Run, App Engine, and Cloud Functions for a given workload shape
• Planning and configuring data storage options — choosing among Cloud Storage, Cloud SQL, Cloud Spanner, Firestore, Bigtable, and BigQuery based on structure, consistency, and scale
• Planning and configuring network resources — VPC design, subnet IP ranges, choosing the right Cloud Load Balancing option

Deploying and implementing a cloud solution

• Deploying and implementing Compute Engine resources — instances, instance templates, managed instance groups (MIGs), snapshots and custom images
• Deploying and implementing Google Kubernetes Engine resources — creating a cluster, deploying and exposing a workload with kubectl
• Deploying and implementing App Engine, Cloud Run, and Cloud Functions resources
• Deploying and implementing data solutions — provisioning a Cloud SQL instance, creating a Cloud Storage bucket, loading data into BigQuery
• Deploying and implementing networking resources — creating VPCs and subnets, configuring firewall rules, setting up a load balancer, configuring Cloud DNS
• Deploying a solution using Cloud Marketplace, and deploying infrastructure as code (Deployment Manager or Terraform on Google Cloud)

Ensuring successful operation of a cloud solution

• Managing Compute Engine resources — connecting via SSH or Identity-Aware Proxy, resizing MIGs, taking and restoring snapshots
• Managing GKE resources — scaling workloads, checking rollout status, reading Pod logs
• Managing App Engine and Cloud Run resources — traffic splitting, revisions
• Managing storage and database solutions — bucket lifecycle policies, Cloud SQL backups and read replicas
• Managing networking resources — adding subnets, updating firewall rules, reserving static IPs
• Monitoring and logging — Cloud Monitoring dashboards and alerting policies, Cloud Logging log-based metrics and sinks, uptime checks

Configuring access and security

• Managing identity and access management (IAM) — assigning predefined versus custom roles at project, folder, or organization level, applying least privilege
• Managing service accounts — creating them, granting roles, managing keys, attaching them to workloads
• Viewing audit logs — Admin Activity, Data Access, System Event, and Policy Denied logs in Cloud Logging

What you actually need to know: the SRE-relevant landmarks

☺ Like you're 10: Here's the real substance behind those bullet points — the commands and choices that show up again on the exam, and again in a real on-call rotation.

Projects, IAM, and the resource hierarchy

Everything in GCP hangs off a resource hierarchy — organization, then folders, then projects, then the resources themselves — and IAM policies inherit downward through it. Getting this wrong is the single most common source of both exam questions and real production incidents: grant a role at the organization level that should have been scoped to one project, and every project underneath silently inherits it. The exam expects you to know predefined roles (broad, service-specific, like roles/compute.admin) versus custom roles (a hand-picked set of permissions) versus the old, dangerous basic roles (Owner, Editor, Viewer, which grant far more than most workloads need).

# Project setup and least-privilege IAM — the exam's favorite opening move
gcloud projects create ace-demo-2026 --organization=123456789012
gcloud config set project ace-demo-2026
gcloud billing projects link ace-demo-2026 --billing-account=012345-6789AB-CDEF01

# grant a predefined role scoped to ONE project, not the organization
gcloud projects add-iam-policy-binding ace-demo-2026 \
  --member="user:jane@example.com" \
  --role="roles/compute.instanceAdmin.v1"

# service accounts do the work workloads shouldn't do with a human's credentials
gcloud iam service-accounts create ace-deployer \
  --display-name="ACE deploy service account"
gcloud projects add-iam-policy-binding ace-demo-2026 \
  --member="serviceAccount:ace-deployer@ace-demo-2026.iam.gserviceaccount.com" \
  --role="roles/storage.objectAdmin"

Choosing the right compute service, not just the familiar one

A recurring exam shape presents a workload and asks which compute product fits it best, and the "obvious" answer — Compute Engine, because it's the one everyone learns first — is often wrong. A stateless HTTP service that scales to zero between requests points at Cloud Run; a short-lived event handler points at Cloud Functions; a workload that genuinely needs full control over the OS, custom kernel modules, or licensed software points at Compute Engine; anything needing container orchestration across many services points at GKE. Within Compute Engine itself, a Managed Instance Group with autoscaling is the difference between a single VM that pages someone when it dies and a self-healing fleet that replaces an unhealthy instance without anyone noticing.

# instance template + MIG with autoscaling — the ACE's version of "don't run one VM alone"
gcloud compute instance-templates create web-template \
  --machine-type=e2-medium \
  --image-family=debian-12 \
  --image-project=debian-cloud

gcloud compute instance-groups managed create web-mig \
  --base-instance-name=web \
  --template=web-template \
  --size=2 \
  --zone=us-central1-a

gcloud compute instance-groups managed set-autoscaling web-mig \
  --zone=us-central1-a \
  --max-num-replicas=6 \
  --target-cpu-utilization=0.6

# GKE: the container-orchestration answer when a MIG isn't enough
gcloud container clusters create-auto ace-cluster --region=us-central1
kubectl create deployment web --image=gcr.io/ace-demo-2026/web:latest
kubectl expose deployment web --type=LoadBalancer --port=80 --target-port=8080

Storage and databases, matched to the shape of the data

The exam quietly rules out the "popular" answer through a single detail in the scenario, the same way AWS's associate exams do. Relational data with transactions and joins points at Cloud SQL; that same relational shape at global scale with strong consistency points at Cloud Spanner instead; a flexible document model for a mobile or web app points at Firestore; wide-column data at massive throughput and low latency — the classic time-series or IoT shape — points at Bigtable; analytical queries over huge, mostly-append-only datasets point at BigQuery. Cloud Storage's own storage classes follow a similar logic — Standard, Nearline, Coldline, and Archive trade retrieval speed and minimum-storage-duration commitments against cost, and a lifecycle rule that ages objects down that ladder automatically is usually the answer an exam scenario about "reducing storage cost" is fishing for.

Monitoring and logging: proving the resource is actually healthy

The "ensuring successful operation" domain is where the ACE gets closest to this course's own territory, and it's worth taking seriously rather than skimming. Cloud Monitoring dashboards and alerting policies, Cloud Logging's log-based metrics and log sinks, and uptime checks against a public endpoint are the raw primitives — the ACE only asks whether you can configure them, not whether you can turn them into a defensible SLO or a paging policy that doesn't burn out whoever's on call. Monitoring and observability covers that next layer directly, and incident management and on-call covers what happens once one of these alerts actually fires in production rather than in a scenario question.

Exam logistics — verify before you book

☺ Like you're 10: Here's the shape of the test as Google generally publishes it — but prices and formats have moved before, so check Google's own page before you pay.

The figures below are what Google Cloud publishes on its own certification page and what candidates consistently report. Treat this as a planning snapshot, not a guarantee — Google revises certification logistics without much advance notice.

Who should sit it — and who should skip it

☺ Like you're 10: If GCP tickets keep landing on your desk and you keep reaching for a search engine, that's the signal. If you already operate GCP daily, spend the money on the next rung instead.

Sit it if you're new to Google Cloud specifically — you might already be a strong SRE on another platform, or new to the discipline entirely, but either way you don't yet have working muscle memory for GCP's console and CLI. The ACE closes exactly that gap efficiently, and for many employers it also doubles as a hiring signal independent of what it personally teaches you.

Skip it, or at least deprioritize it, if any of these describe you. You already operate GCP projects daily and would be studying material you use every week — go straight to the Professional Cloud DevOps Engineer instead. You work primarily on a different cloud — this course also profiles AWS Solutions Architect Associate and Azure Administrator Associate (AZ-104), the comparable rungs on those platforms. Or your actual gap is SRE practice itself rather than console fluency — the vendor-neutral SRE Foundation or this course's own SRE Practitioner profile teaches the practice with no cloud console attached at all.

Where it sits in the ladder, and what to do next

☺ Like you're 10: It's the entry technical rung. There's a non-technical badge below it and harder Professional badges above it.

Google's certification portfolio is a floor plan, not a straight line. Cloud Digital Leader sits below the ACE as the foundational, non-technical credential — no hands-on skills tested, just cloud concepts and business value, aimed at people who work alongside technical teams rather than building anything themselves. Above the ACE sit Google's Professional-tier exams, each looking at GCP from a different chair: Professional Cloud Architect for design-time decisions across the whole platform, and this course's own Professional Cloud DevOps Engineer for CI/CD and SRE practice specifically — the natural next stop once this page's fundamentals are solid. Google also publishes Professional-tier exams for security, networking, data, and machine learning that sit at the same altitude but off to the side, worth considering only if that's the specific gap you're closing.

If your platform runs on a different cloud, or you want the equivalent credential there for comparison, this course also profiles AWS Solutions Architect Associate and Azure Administrator Associate (AZ-104) — both sit at a comparable associate altitude on their respective clouds, though none of the three map their domains onto each other one for one. For infrastructure certifications that aren't cloud-specific at all, CKA and HashiCorp Terraform Associate cover the substrate and the provisioning layer respectively, and pair naturally with whichever cloud credential you choose. Full comparisons across every certification this course tracks live on the certifications hub.

How to prepare using this site

☺ Like you're 10: Here's the map from each exam domain to the exact pages here that teach the underlying idea, so you're not starting from zero.

This course teaches SRE as a discipline rather than as a GCP certification study guide, so it runs deeper than the ACE on error budgets, incident response, and postmortems, and lighter on pure console mechanics — creating a project, wiring up a VPC by hand — which is best learned directly in the GCP console and Google's own documentation, exactly where the exam itself sends you. Everything below is genuine ACE-adjacent material already on this site.