Google Cloud · GCP-ACE · Intermediate

Associate Cloud Engineer — Practice Questions and Mock Exam

Name: Pass-IT
Author: Pass-IT

Practice with realistic GCP-ACE questions aligned to the exam objectives. Alex explains every answer, and your readiness score shows what to study next.

Buy GCP-ACE access for $29.99 Take the free readiness check

One payment. Lifetime access to this certification.

Try 5 questions first →

55Questions

120minTime Limit

Checked against Google Cloud · August 2026Current exam version

Overview

About the exam

The Associate Cloud Engineer certification validates hands-on ability to deploy applications, monitor operations, and manage enterprise solutions on Google Cloud. It covers the full lifecycle of cloud solution management including project setup, compute and networking configuration, security, and operational monitoring.

This is the recommended starting point for IT professionals and engineers who work directly with Google Cloud. It demonstrates practical ability to use the Cloud Console, Cloud Shell, and gcloud CLI to manage real-world cloud infrastructure.

Exam domains

What's on the exam

Planning and implementing a solution and keeping it running in production each carry 30% of the exam, together accounting for three of every five questions. The first half of that split covers choosing compute (Compute Engine, GKE, Cloud Run, or serverless) and provisioning the storage, data, and networking layers underneath it, including Terraform or Config Connector for infrastructure as code. The second half moves past the initial build: connecting to running instances, resizing GKE node pools, reading Cloud Monitoring alerts, and filtering Cloud Logging output to chase down an application issue. Setting up the environment and configuring access split the remaining 40% evenly — resource hierarchy and billing controls on one side, IAM roles and service account permissions on the other.

That weighting favors candidates who have run a project past day one. Exam questions expect you to diagnose a live cluster or a misbehaving log pipeline under time pressure, a different skill than knowing how to provision one.

Exam blueprint: GCP-ACE

Setting up a cloud solution environment~20%

Stand up the resource hierarchy, IAM roles, and Cloud Identity setup a new project needs, and get billing under control with linked accounts, budgets, and spend alerts.

≈ 16 h

Planning and implementing a cloud solution~30%

Plan and implement compute resources across Compute Engine, GKE, and serverless platforms, and plan and implement storage, data, and networking resources such as VPCs, firewall rules, and load balancers. Also covers using infrastructure-as-code and AI-assisted tooling to provision cloud resources.

≈ 24 h

Ensuring the successful operation of a cloud solution~30%

Manage compute, storage, and networking resources in production, including instances, snapshots, GKE clusters, and IP addressing. Also covers monitoring and logging using Cloud Monitoring, Cloud Logging, and diagnostic tools to investigate application issues.

≈ 24 h

Configuring access and security~20%

Manage IAM policies and role assignments across the resource hierarchy, and create and manage service accounts including permissions, impersonation, and Workload Identity Federation.

≈ 16 h

Format

Exam format and question types

The exam draws 50–60 multiple-choice and multiple-select questions inside a 120-minute window, weighted roughly 80% single-answer to 20% multiple-select. Most items are scenario-based: a short description of a deployment or operational situation, followed by a decision about which gcloud command, IAM setting, networking configuration, or Kubernetes operation solves it.

Question types: GCP-ACE

Multiple Choice80%

Pick the single best answer from four or five options — the exam's bread and butter.

Multiple Response20%

More than one answer is correct and you need all of them; the question tells you how many to pick.

Google Cloud confirms these question types — a percentage split is not published; the shares reflect our exam-aligned question pool.

Try it now

Try five GCP-ACE questions

Five questions straight from our Associate Cloud Engineer pool. Answer one — Alex explains the why.

Configuring access and security1 / 5

Your application on Compute Engine needs to write data to a Pub/Sub topic and read from Cloud Storage. You want to follow the principle of least privilege. Which approach should you use?

AlexFull explanation from Alex

Google Cloud best practice is to create dedicated service accounts with only the IAM roles needed. For writing to Pub/Sub, assign roles/pubsub.publisher. For reading from Cloud Storage, assign roles/storage.objectViewer. The Editor basic role grants overly broad permissions across all services, violating least privilege. Storing API keys on VMs is insecure and unnecessary when using service accounts. The default Compute Engine service account often has the Editor role, which is too permissive for production. Always create purpose-specific service accounts. Ref: cloud.google.com/iam/docs/best-practices

Sourcecloud.google.com

Planning and implementing a cloud solution3 / 5

You need to create a Compute Engine instance template that uses a custom image you've already created. Which gcloud command creates this template?

AlexFull explanation from Alex

The correct command is gcloud compute instance-templates create, which creates an instance template under the compute service. The --image flag specifies the boot disk image, and --machine-type sets the VM size. Instance templates define reusable VM configurations for managed instance groups. The other options use invalid command syntax: instances create-template confuses the instances subcommand, instance-groups create-template wrongly puts template creation under instance groups, and templates create is not a valid gcloud compute path. Ref: docs.cloud.google.com/compute/docs/instance-templates/create-instance-templates

Sourcecloud.google.com

Planning and implementing a cloud solution4 / 5

You need to select a managed database service for a globally distributed application that requires strong consistency, relational semantics, and horizontal scaling. Which Google Cloud service should you use?

AlexFull explanation from Alex

Cloud Spanner is the only Google Cloud managed database that provides global distribution with strong consistency and relational semantics (SQL, schemas, ACID transactions). Spanner uses TrueTime for external consistency — the strictest consistency guarantee, stronger than serializability or linearizability. It scales horizontally across regions while maintaining strong consistency, unlike traditional relational databases that sacrifice consistency for distribution. Spanner supports both SQL (GoogleSQL and PostgreSQL dialects) and schemaless data models. It provides automatic sharding, replication, and failover. Spanner is designed for mission-critical applications requiring 99.999% availability (multi-region configurations). Cloud SQL provides regional relational databases but doesn't support global distribution. Firestore provides global distribution for document data but without relational semantics. BigQuery is for analytics, not transactional workloads. Exam tip: Global + strong consistency + relational + ACID = Cloud Spanner. Cloud SQL = regional only. Firestore = NoSQL. 99.999% = multi-region Spanner.

Sourcecloud.google.com

Configuring access and security5 / 5

You need to allow VMs in a private subnet (no external IP addresses) to download software packages from the internet while preventing inbound connections from the internet. Which service should you use?

AlexFull explanation from Alex

Cloud NAT (Network Address Translation) allows VMs in a private subnet without external IP addresses to access the internet for outbound connections (egress) while preventing unsolicited inbound connections. Configure Cloud NAT on a Cloud Router in the same region as your subnet. Cloud NAT is a distributed, software-defined managed service — it doesn't depend on any VMs or a single gateway device. It automatically scales NAT IP addresses and provides high availability. Cloud NAT preserves network bandwidth (no reduction per VM) and supports logging for connection tracking. VMs with external IPs don't use Cloud NAT — they use 1:1 NAT automatically. Cloud NAT supports both Public NAT (internet access) and Private NAT (VPC-to-VPC or on-premises). Each Cloud NAT gateway is regional and associated with one Cloud Router and one VPC network. Cloud NAT does not affect ingress traffic. Exam tip: Cloud NAT = egress-only internet access for private VMs. Distributed, managed, auto-scaling. Regional per Cloud Router. No ingress.

Sourcecloud.google.com

Question pool

310 questions, built like the exam

The GCP-ACE pool covers every exam domain and keeps growing with new questions. A mock exam asks 55 questions in one sitting, on the same 120-minute clock as the real thing.

Audit record: GCP-ACE

Spec check against Google CloudAugust 11, 2026

last verified against the official Google Cloud source

Blueprint coverage12 official objectives

across 4 domains, from the official exam guide

Pool size310 questions

= 5 full practice exams of 55 questions each — never the same question twice

Canonically validated310 of 310

each verified against official Google Cloud documentation — answer, options and explanation, source cited

Methodology openly documented.How questions are made →

Planning

Preparing for GCP-ACE

How long you'll need depends on how much hands-on experience you bring. The rest is set by the vendor: how the exam is delivered, how soon you can retake it, and how long the credential stays valid.

The exam runs through Pearson VUE, either online-proctored or at a testing center, and is offered in English, Japanese, Spanish, and Portuguese. The certification holds for 3 years; Google Cloud offers a shorter, 20-question renewal exam within the renewal eligibility period instead of requiring a full retake.

Your plan: GCP-ACE

Preparation

Study time50–120 h

typically around 50 h if you already work with this stack, around 120 h coming to it fresh

LevelIntermediate

Worth having firstNo formal prerequisites. Recommended 6+ months hands-on experience with Google Cloud.

Exam day & after

DeliveryOnline-proctored (Pearson VUE) or onsite-proctored at testing centers

Retake policy14-day wait after the first failed attempt, 60 days after the second, 365 days after the third. Maximum 4 attempts in a 2-year period.

Stays valid3 years

Certification valid for 3 years. Renewal exam available (20 questions, 1 hour, $75) within the renewal eligibility period.

Official guideView on vendor site

The hours are our own planning estimate — Google Cloud publishes no preparation time for this exam. A starting point for your calendar, not a target.

Watch out

Common pitfalls

IAM trips up candidates who haven't drawn the line between basic, predefined, and custom roles, or who default to broad grants instead of least privilege. The choice between Compute Engine, GKE, Cloud Run, and Cloud Functions comes up repeatedly, and picking correctly depends on tradeoffs the exam expects you to already know rather than reason out from scratch. VPC firewall rules and peering behave differently than candidates assume coming from a single-cloud-provider background, and unfamiliarity with everyday gcloud CLI syntax slows down console-only test-takers on questions that name a specific flag or command.

Watch list: GCP-ACE

01IAM Roles
Confusing basic, predefined, and custom roles, and not following least-privilege principles
02Compute Options
Not knowing when to choose Compute Engine vs. GKE vs. Cloud Run vs. Cloud Functions
03gcloud Commands
Unfamiliarity with common gcloud CLI commands for managing resources
04VPC Networking
Misunderstanding VPC subnets, firewall rules, and network peering configurations
05GKE vs Cloud Run
Choosing between container orchestration options without understanding their tradeoffs
06Billing and Quotas
Overlooking billing account structure, budgets, and quota management

Pass-IT trains you on exactly these weak spots — adaptive & spaced →

Questions

Frequently asked questions

What are common mistakes on the Associate Cloud Engineer exam?

Common pitfalls include: IAM Roles, Compute Options, gcloud Commands, VPC Networking, GKE vs Cloud Run, Billing and Quotas. Focus study time on these areas to avoid losing points.

What experience do you need for Associate Cloud Engineer?

Google sets no formal prerequisite and recommends at least six months of hands-on Google Cloud work. The exam leans heavily on gcloud command syntax and IAM role selection, so console familiarity alone tends to leave gaps.

What happens if you fail Associate Cloud Engineer?

Google's waiting periods escalate sharply: 14 days after a first failure, 60 days after a second and a full year after a third, with a maximum of four attempts in any two-year period. That makes a second attempt much more expensive in time than on most exams, so it is worth being genuinely ready rather than treating the first sitting as a trial run.

How long is Associate Cloud Engineer valid?

Three years. Google offers a shorter renewal exam during the eligibility window before expiry, so you do not have to sit the full certification again.

Which Associate Cloud Engineer domains carry the most weight?

Planning and implementing a cloud solution and ensuring successful operation are the heaviest at 30% each, with environment setup and access and security at 20% each. Google publishes these figures directly.

How should you study for Associate Cloud Engineer?

Around 80 hours is a realistic budget, and the areas that catch people are IAM roles, choosing between compute options and the difference between GKE and Cloud Run. Given the escalating retake waits, over-preparing is cheaper than a second attempt. Our guide sets out an order of attack. Read the GCP ACE study guide

Pass-IT is an independent study tool, not affiliated with or endorsed by Google Cloud; Google Cloud and exam names are trademarks of their respective owners.

One certification. One payment.

Full GCP-ACE access

Get the full question pool for this certification. Alex explains every answer, and your readiness score shows what to work on next.

Buy GCP-ACE access for $29.99One payment. Lifetime access to this certification.

Take the free readiness check20 questions. No card. See what to study before you buy.

Reach 80% readiness and pass — or your money back.

How the score works →