EnglishDeutschFrançaisEspañolPortuguês

Google Cloud · GCP-ACE · Intermediate

Associate Cloud Engineer — Practice Questions and Mock Exam

The Associate Cloud Engineer certification validates hands-on ability to deploy applications, monitor operations, and manage enterprise solutions on Google Cloud.

Practice for freeTry a practice question first
Try a practice question firstPractice for free
Start practicing GCP-ACE freeBuy GCP-ACE access for $29.99
55Questions per Pass-IT mock exam
120minPass-IT mock exam time limit

Checked against Google Cloud · August 2026 · Current exam version

Try Pass-IT

See what learning with Pass-IT is like.

Answer a GCP-ACE sample question and read the explanation with its source. Right here, with no sign-up.

Configuring access and security1 / 5

Your application on Compute Engine needs to write data to a Pub/Sub topic and read from Cloud Storage. You want to follow the principle of least privilege. Which approach should you use?

AlexFull explanation from Alex

Google Cloud best practice is to create dedicated service accounts with only the IAM roles needed. For writing to Pub/Sub, assign roles/pubsub.publisher. For reading from Cloud Storage, assign roles/storage.objectViewer. The Editor basic role grants overly broad permissions across all services, violating least privilege. Storing API keys on VMs is insecure and unnecessary when using service accounts. The default Compute Engine service account often has the Editor role, which is too permissive for production. Always create purpose-specific service accounts. Ref: cloud.google.com/iam/docs/best-practices

Sourcecloud.google.com

Planning and implementing a cloud solution3 / 5

You need to create a Compute Engine instance template that uses a custom image you've already created. Which gcloud command creates this template?

AlexFull explanation from Alex

The correct command is gcloud compute instance-templates create, which creates an instance template under the compute service. The --image flag specifies the boot disk image, and --machine-type sets the VM size. Instance templates define reusable VM configurations for managed instance groups. The other options use invalid command syntax: instances create-template confuses the instances subcommand, instance-groups create-template wrongly puts template creation under instance groups, and templates create is not a valid gcloud compute path. Ref: docs.cloud.google.com/compute/docs/instance-templates/create-instance-templates

Sourcecloud.google.com

Planning and implementing a cloud solution4 / 5

You need to select a managed database service for a globally distributed application that requires strong consistency, relational semantics, and horizontal scaling. Which Google Cloud service should you use?

AlexFull explanation from Alex

Cloud Spanner is the only Google Cloud managed database that provides global distribution with strong consistency and relational semantics (SQL, schemas, ACID transactions). Spanner uses TrueTime for external consistency — the strictest consistency guarantee, stronger than serializability or linearizability. It scales horizontally across regions while maintaining strong consistency, unlike traditional relational databases that sacrifice consistency for distribution. Spanner supports both SQL (GoogleSQL and PostgreSQL dialects) and schemaless data models. It provides automatic sharding, replication, and failover. Spanner is designed for mission-critical applications requiring 99.999% availability (multi-region configurations). Cloud SQL provides regional relational databases but doesn't support global distribution. Firestore provides global distribution for document data but without relational semantics. BigQuery is for analytics, not transactional workloads. Exam tip: Global + strong consistency + relational + ACID = Cloud Spanner. Cloud SQL = regional only. Firestore = NoSQL. 99.999% = multi-region Spanner.

Sourcecloud.google.com

Configuring access and security5 / 5

You need to allow VMs in a private subnet (no external IP addresses) to download software packages from the internet while preventing inbound connections from the internet. Which service should you use?

AlexFull explanation from Alex

Cloud NAT (Network Address Translation) allows VMs in a private subnet without external IP addresses to access the internet for outbound connections (egress) while preventing unsolicited inbound connections. Configure Cloud NAT on a Cloud Router in the same region as your subnet. Cloud NAT is a distributed, software-defined managed service — it doesn't depend on any VMs or a single gateway device. It automatically scales NAT IP addresses and provides high availability. Cloud NAT preserves network bandwidth (no reduction per VM) and supports logging for connection tracking. VMs with external IPs don't use Cloud NAT — they use 1:1 NAT automatically. Cloud NAT supports both Public NAT (internet access) and Private NAT (VPC-to-VPC or on-premises). Each Cloud NAT gateway is regional and associated with one Cloud Router and one VPC network. Cloud NAT does not affect ingress traffic. Exam tip: Cloud NAT = egress-only internet access for private VMs. Distributed, managed, auto-scaling. Regional per Cloud Router. No ingress.

Sourcecloud.google.com

How to prepare for GCP-ACE with Pass-IT.

Currently 439 practice questions for GCP-ACE, with new ones added regularly. Focus on what you still need to learn.

Get past difficult questions.

Understand why an answer is correct. Alex explains the concepts and answers your follow-up questions so you can apply what you learn to the next task.

Meet Alex →

Conversation preview · GCP-ACE

Creating an instance template

  1. You

    Which gcloud command creates the reusable VM template?

  2. Alex · AI tutor

    Use gcloud compute instance-templates create.

    Read the documentation ↗
  3. You

    Where do I specify my existing custom image?

  4. Alex · AI tutor

    Use the --image flag when creating the template.

    Read the documentation ↗

Make your study time count.

Practice at your level.
For new practice sessions, Pass-IT adjusts the difficulty based on your previous answers.

Learn from mistakes.
Incorrect answers automatically become flashcards. When you review them, you rate how confidently you remember; Pass-IT schedules the next review.

See how focused practice works →

Animated feature preview

Turn your mistakes into knowledge you can rely on.

How Pass-IT works

Your review

Answered a question incorrectly?

Pass-IT saves it for your review.

GCP-ACE · Question excerpt

Creating an instance template

View the full question

You need to create a Compute Engine instance template that uses a custom image you've already created. Which gcloud command creates this template?

Understand the correct answer.

gcloud compute instance-templates create my-template --image my-custom-image --machine-type e2-medium

Create the instance template with --image pointing to the custom image.

Read the documentation ↗

How confidently do you remember?

During review, you assess how well you still know the answer.

Correct after hesitating

Pass-IT schedules your next review.

The date depends on your self-assessment and previous reviews.

Simplified demonstration. No learning progress is saved.

Practice for the moment that counts.

Take a full mock exam with a time limit and find out whether you can finish in time.

Your GCP-ACE mock exam

Questions
55
Minutes
120

Illustration of an exam session

  1. Start
  2. Answer questions
  3. Finish

Length and time limit of the Pass-IT mock exam.

Go into your exam with more confidence.

Your Readiness Score helps you assess whether you are ready for the exam. Results by exam domain show you where you should keep practicing.

Your money back if you fail despite 80% Readiness.
If your Readiness Score is at least 80% when you take the exam and you still fail, we refund the Pass-IT purchase price for this certification.

For active, paid access. Submit proof of failing within 14 days.

Further guarantee conditions

You need at least 80% Readiness and active, paid access to the certification when you take the exam. Take the exam within your access period and submit official proof of failing within 14 days after the exam.

For purchases through Apple or Google, refunds are handled by the respective store. See the full terms for further details.

Read the guarantee terms →

The Readiness Score describes your practice progress, not a probability of passing.

Guarantee requirement

80%

At least 80% Readiness
when you take the exam

Money back if you fail

Question counts and mock exam settings from the current Pass-IT catalog.

Exam domains

What you practice for GCP-ACE.

Exam topics, relevant practice and sources you can check.

Cloud environment setupSee the guide for weighting70 QuestionsPass-IT questions

Set up the projects, identities and billing needed for a cloud environment.

  • Organize resources into organizations and projects, apply policies, and manage users, groups and federated workforce access.
  • Enable services and observability, check regions and quotas, and inspect resources with Cloud Asset Inventory and Gemini Cloud Assist.
  • Link projects to billing accounts and configure budgets, alerts and billing exports.
Official certification objectives
Deploying cloud solutionsSee the guide for weighting151 QuestionsPass-IT questions

Choose and deploy compute, data and networking resources.

  • Match workloads to Compute Engine, GKE, Cloud Run or Agent Runtime; configure storage, autoscaling and accelerators.
  • Choose databases and storage by data needs, then load data and plan redundancy across regions.
  • Build VPCs, firewall policies and hybrid connections, and select load balancers and Network Service Tiers.
  • Deploy repeatable configurations with Terraform or other infrastructure tools and use AI assistance for planning and implementation.
Official certification objectives
Operating cloud solutionsSee the guide for weighting132 QuestionsPass-IT questions

Maintain deployed services and use operational data to investigate problems.

  • Manage VM snapshots, GKE resources and scaling, Cloud Run revisions, agents, notebooks and developer environments.
  • Manage storage lifecycles, queries, backups and encryption keys, and inspect database and processing jobs.
  • Maintain subnet ranges, addresses, routes, Cloud DNS, Cloud NAT and firewall policies.
  • Use metrics, alerts, logs and diagnostic tools to investigate application health and optimize resource use.
Official certification objectives
Access and workload identitiesSee the guide for weighting86 QuestionsPass-IT questions

Control what people and applications can do in Google Cloud.

  • Read and create IAM policies, understand inherited access, and choose predefined or custom roles.
  • Assign service accounts to resources with only the permissions their workloads need.
  • Use impersonation, short-lived credentials and Workload Identity Federation to authenticate applications, including GKE workloads.
Official certification objectives
Question formats you can practice
Multiple Choice
Select one answer.
Multiple Response
Select multiple applicable answers.

These are practice formats in Pass-IT. See the Official certification objectives for the official exam requirements.

Frequently asked questions

Your preparation

How much study time should I plan for GCP-ACE?

For planning, Pass-IT estimates roughly 50–120 hours. Relevant experience may put you toward the lower end; starting from scratch may put you toward the higher end. Your needs may fall outside this range. This is not a time requirement from Google Cloud or a promise that you will be exam-ready within that time.

What experience do you need for Associate Cloud Engineer?

Google sets no formal prerequisite and recommends at least six months of hands-on Google Cloud work. The exam leans heavily on gcloud command syntax and IAM role selection, so console familiarity alone tends to leave gaps.

Using Pass-IT

What language are Pass-IT questions in?

Questions in the app are currently in English. Translations of the sample questions on this page apply only to this preview. Check with Google Cloud for the languages available for the official exam.

How long does my GCP-ACE access last?

Access covers this certification for 12 months. You pay once, with no automatic renewal.

When does the money-back guarantee apply?

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days. Guarantee terms

About the GCP-ACE exam

Where can I take the GCP-ACE exam?

Online-proctored (Pearson VUE) or onsite-proctored at testing centers.

What happens if you fail Associate Cloud Engineer?

Google's waiting periods escalate sharply: 14 days after a first failure, 60 days after a second and a full year after a third, with a maximum of four attempts in any two-year period. That makes a second attempt much more expensive in time than on most exams, so it is worth being genuinely ready rather than treating the first sitting as a trial run.

How long is Associate Cloud Engineer valid?

Three years. Google offers a shorter renewal exam during the eligibility window before expiry, so you do not have to sit the full certification again.

Your preparation for GCP-ACE

$29.99one-time

12 months of access for GCP-ACE · No automatic renewal

Buy GCP-ACE access

Questions in the app are currently in English.

Try 20 questions for freeFree account required. No credit card.

Already have an account? Log in

Prefer a subscription? View subscriptions →

Money back if you fail with at least 80% Readiness, for eligible purchases under the guarantee terms.

Guarantee terms

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days.

Full guarantee terms →

Related certifications

Associate Data PractitionerAssociate Google Workspace AdministratorCloud Digital LeaderGenerative AI LeaderAll Google Cloud certifications →