CertifyDeck
Start for free
All cheat sheets
Associate Cloud Engineer · CHEAT SHEET

Google Cloud Certified Associate Cloud Engineer

Key concepts grouped by official exam weight.

Download as PDF (free, no sign-up)

1. Setting up a cloud solution environment

20–20%

Setting up cloud projects and accounts

  • The Google Cloud resource hierarchy runs from the organization (the root, which requires Cloud Identity or Google Workspace) to optional folders and to projects; each resource has exactly one parent. IAM roles and organization policies set at one level are inherited downwards, so folders group departments or environments and delegate their administration. Folders are created with gcloud resource-manager folders create.
  • Organization policies restrict which configurations are allowed (locations, service account keys, public access to Cloud Storage), while IAM decides who can act. They are set on the organization, folders or projects and are inherited; in list rules denied values take precedence, and a child's boolean rule replaces the parent's. Most are not retroactive.
  • To give access in a project you grant a role to a principal (user, group or service account) with gcloud projects add-iam-policy-binding, which adds a binding without overwriting the policy. Predefined or custom roles are preferred over basic roles, and grants should go to groups. IAM conditions allow expiring access, but not with legacy basic roles.
  • Cloud Identity centrally manages company-controlled users and groups. They can be created manually in the console or automated with Google Cloud Directory Sync from Active Directory (one-way sync, no passwords) plus SAML SSO, or with gcloud identity groups. Organizational units apply settings such as 2-step verification; access is managed with groups.
  • Each Google Cloud service must be enabled in the project before use, from the console API Library or with gcloud services enable, which accepts several services at once; gcloud services list shows enabled or available ones. The Service Usage Admin role is required. Disabling an API does not delete Cloud Storage or BigQuery data, and --force also disables dependent services.

Managing billing configuration

  • A Cloud Billing account defines who pays for the linked projects, operates in a single currency and is associated with a Google payments profile. In an organization, creating one requires the Billing Account Creator role. Country and currency cannot be changed, so another country needs another account. An Organization-type payments profile supports several users; an Individual one does not.
  • A project can use Google Cloud services only when it is linked to an active Cloud Billing account; each project links to one account, which can pay for many projects. You link or switch it with gcloud billing projects link, holding Billing Account User on the account and Project Billing Manager or Project Owner on the project. Disabling billing stops services and can delete resources.
  • Cloud Billing budgets compare actual or forecasted spend with an amount and send alerts when thresholds are crossed; they can cover the account, projects, folders, services or a label. By default they notify Billing Account Administrators and Users; Cloud Monitoring channels add other recipients. An alerts-only budget does not cap spend: automated responses use Pub/Sub notifications.
  • Cloud Billing exports standard usage cost, resource-level detailed cost, pricing and CUD metadata to BigQuery, each enabled separately. Use a FinOps project linked to the same billing account, a multi-region dataset (it backfills the previous month) without table expiration, and the Billing Account Costs Manager or Administrator role; pricing data needs the BigQuery Data Transfer Service API.

2. Planning and configuring a cloud solution

17–18%

Planning and configuring compute resources

  • Compute Engine is IaaS with self-managed VMs and full OS control. GKE runs Kubernetes workloads; in Autopilot Google manages the nodes and you pay for what Pods request. Cloud Run is serverless: services handle HTTP and scale to zero, jobs run to completion, worker pools process queues, and Cloud Run functions respond to events such as Cloud Storage changes.
  • Spot VMs (--provisioning-model=SPOT) use excess capacity at deep discounts but can be preempted at any time and have no SLA or automatic restart; use them for batch and stateless workloads, ideally in a MIG whose template uses spot. Custom machine types (n2-custom-VCPUS-MB) set vCPUs and memory when no predefined type fits, for example with per-CPU licensing.

Planning and configuring data storage options

  • Cloud SQL is the managed relational service for MySQL, PostgreSQL and SQL Server. Spanner is relational with strong global consistency and horizontal read and write scaling. Bigtable is single-keyed NoSQL for billions of rows at low latency, compatible with HBase. Firestore is a serverless document database. BigQuery is the serverless SQL analytics platform.
  • Cloud Storage offers Standard for frequently accessed data, Nearline for monthly reads, Coldline for quarterly reads and Archive for less than once a year; colder classes lower at-rest cost in exchange for access charges. For block storage, zonal Persistent Disk lives in one zone, while regional Persistent Disk replicates synchronously across two zones of a region for high availability.

Planning and configuring network resources

  • To choose a load balancer, consider the traffic type (Application for HTTP/HTTPS, proxy Network for TCP, passthrough Network for TCP, UDP and other protocols), external versus internal, and global versus regional. Global load balancers use one anycast IP and multi-region backends; regional ones keep TLS termination in one region. Only passthrough load balancers preserve the client source IP.
  • Google Cloud resources are global, regional or zonal. VPC networks with their routes and firewall rules, images and snapshots are global; subnets and regional static external IPs are usable only within their region; VMs and zonal disks only within their zone. Spreading resources across zones and regions reduces the risk of one outage affecting them all.
  • Premium Tier carries traffic on Google's backbone and optimizes for performance; Standard Tier uses ISP and transit networks and optimizes for cost. The tier is set per resource or as the project default, which only affects new resources. Global external load balancers, Cloud CDN and Cloud VPN are Premium only, while VMs, Cloud NAT and regional load balancers support Standard.

3. Deploying and implementing a cloud solution

25–25%

Deploying and implementing Compute Engine resources

  • When creating a VM you choose disks (pd-ssd for random IOPS, pd-standard for sequential I/O, extra disks attached with attach-disk), the maintenance policy (MIGRATE or TERMINATE, required with GPUs) and automatic restart (--restart-on-failure). SSH access is managed with OS Login (enable-oslogin=TRUE plus IAM) or with metadata keys, which block-project-ssh-keys can restrict per VM.
  • A MIG is always created from an instance template, which cannot be modified: to change the configuration you create a new one and set it on the group. With --region the MIG spreads VMs across zones. Autoscaling (set-autoscaling, with --max-num-replicas required) uses CPU, load balancing capacity, Monitoring metrics or schedules, and the initialization period avoids scaling on startup spikes.
  • OS Login links Linux accounts on VMs to Google identities and controls SSH access with IAM: roles/compute.osLogin grants access without sudo and roles/compute.osAdminLogin grants it with sudo. You turn it on with the enable-oslogin=TRUE metadata key on the project or instance (the instance value wins), and the compute.requireOsLogin constraint enforces it across an organization, folder or project.
  • VM Manager bundles Patch (on-demand or scheduled patching with a disruption budget and pre- and post-patch scripts), OS policies (installing and maintaining software on groups of VMs filtered by labels, OS family or zone) and OS inventory management. To enable it you turn on the OS Config API and set enable-osconfig=TRUE in project or VM metadata; the OS Config agent needs access to the package repositories.

Deploying and implementing Google Kubernetes Engine resources

  • You install kubectl with gcloud components install kubectl or with apt/yum, and it needs the gke-gcloud-auth-plugin to authenticate to GKE. gcloud container clusters get-credentials writes the cluster entry to kubeconfig and switches the current context; it needs container.clusters.get, included in roles/container.clusterViewer. For a single command against another cluster, use the kubectl --cluster flag.
  • In Autopilot (gcloud container clusters create-auto) Google manages nodes, scaling and security, and the cluster is always regional. A regional cluster replicates the control plane across several zones; a zonal cluster has a single control plane even if its nodes span several zones. With --enable-private-nodes the nodes have only internal IPs, and authorized networks or --enable-private-endpoint restrict access to the control plane.
  • On GKE, stateless applications are deployed as a Deployment and those needing a unique identity and persistent storage per Pod as a StatefulSet. You update them with kubectl set image, roll back with kubectl rollout undo and expose them with a Service; LoadBalancer creates a load balancer with a stable external IP. To pull from Artifact Registry, the nodes' account needs roles/artifactregistry.reader.

Deploying and implementing Cloud Run and Cloud Functions resources

  • Cloud Run deploys with gcloud run deploy from an image (--image) or from source (--source), built with a Dockerfile or with buildpacks through Cloud Build; a function also uses --function. --allow-unauthenticated grants roles/run.invoker to allUsers. Deploying requires roles/run.developer, roles/iam.serviceAccountUser on the service identity and read access to Artifact Registry.
  • Eventarc delivers audit log events, direct events such as Cloud Storage ones and Pub/Sub messages to Cloud Run as HTTP requests. The trigger (gcloud eventarc triggers create) uses an account with roles/run.invoker. For Cloud Storage, the bucket must be in the trigger's project and location, and its service agent needs roles/pubsub.publisher; an existing topic is set with --transport-topic.
  • Cloud Run (fully managed) runs HTTP services without clusters, with its own HTTPS endpoint on run.app, scale to zero and an ephemeral file system; Cloud Run jobs run tasks to completion. Cloud Run functions deploys only a function's code, which is built into a container and runs as a Cloud Run service. Knative serving, Google's managed Knative offering, runs serverless workloads on your own GKE clusters.

Deploying and implementing data solutions

  • Cloud SQL provides high availability with --availability-type=REGIONAL, with synchronous replication across two zones and automatic failover. In Firestore, --delete-protection prevents accidental deletion. A configurable dual-region bucket uses --location and --placement, and --uniform-bucket-level-access disables ACLs. Pub/Sub writes to BigQuery through a BigQuery subscription or Dataflow templates.
  • Local files are uploaded to Cloud Storage with gcloud storage cp (--recursive for directories) or gcloud storage rsync. bq load loads CSV from Cloud Storage: it appends by default, --replace overwrites and --skip_leading_rows skips headers. Storage Transfer Service runs managed, scheduled transfers from S3, Azure or other buckets. To import into Cloud SQL, the instance's service account needs bucket access.

Deploying and implementing networking resources

  • An auto mode VPC network creates one subnet per region inside 10.128.0.0/9; in custom mode you choose subnets and ranges, and Google recommends it for production. Converting from auto to custom is one-way. In Shared VPC, a host project shares subnets with service projects, and compute.networkUser is granted on the whole host project or on selected subnets.
  • VPC firewall rules are stateful, apply to ingress or egress, and the lowest priority number wins; at equal priority, deny wins. If nothing matches, ingress is denied and egress is allowed. Targets are defined with network tags or with stricter service accounts, and hierarchical firewall policies are associated with the organization or with folders.
  • VPC Network Peering connects two VPC networks, is configured on both sides, is not transitive and needs non-overlapping ranges, so two auto mode networks cannot be peered; dynamic routes are shared with --export-custom-routes and --import-custom-routes. Cloud VPN encrypts traffic to external networks with IPsec, and HA VPN uses BGP through Cloud Router.

Implementing resources through infrastructure as code

  • Terraform describes the end state of your infrastructure and, for teams, its state belongs in a Cloud Storage bucket with the gcs backend. Infrastructure Manager runs Terraform as a managed service, and Cloud Foundation Toolkit provides reusable modules. Config Connector manages Google Cloud resources with Kubernetes manifests, and Helm installs charts stored in Artifact Registry.

4. Ensuring successful operation of a cloud solution

20–20%

Managing Compute Engine resources

  • Without an external IP, you reach VMs over SSH with IAP TCP forwarding (--tunnel-through-iap), which needs 35.235.240.0/20 allowed and the IAP-secured Tunnel User role. OS Login controls SSH with IAM through roles/compute.osLogin and roles/compute.osAdminLogin. The serial console helps debug boot and network issues, and Windows credentials come from gcloud compute reset-windows-password.
  • gcloud compute instances list shows instances in every zone of the project and supports --filter and --format; gcloud compute instances describe returns a VM's full configuration, including its immutable ID. For a whole organization you use gcloud asset search-all-resources from Cloud Asset Inventory, and installed packages are queried with VM Manager OS inventory.
  • Standard and archive snapshots are incremental and survive disk deletion; archive snapshots cost less for long retention, and instant snapshots disappear with the disk. You create them with gcloud compute snapshots create, list them with gcloud compute snapshots list --filter, and schedule them with a snapshot-schedule policy attached through gcloud compute disks add-resource-policies.
  • Custom images are created with gcloud compute images create from a disk (--source-disk, plus --force if the VM is running) or from a snapshot (--source-snapshot), and image families point to the latest active image. You list them with gcloud compute images list --no-standard-images, retire them with images deprecate, and delete them irreversibly with images delete.

Managing Google Kubernetes Engine resources

  • To query a GKE cluster with kubectl you first get credentials with gcloud container clusters get-credentials, which updates kubeconfig. Then kubectl get nodes, kubectl get pods and kubectl get services list the inventory; -A or --all-namespaces covers every namespace, -o wide adds details such as each Pod's node, and -l filters by label, for example cloud.google.com/gke-nodepool for the nodes of a node pool.
  • GKE pulls images from Artifact Registry with the node service account: in the same project, roles/artifactregistry.reader plus an access scope with storage read access is enough. If the repository is in another project, grant the role there. Access scopes (storage-ro, storage-rw, cloud-platform) can only be set when the cluster or node pool is created.
  • In GKE Standard, node pools are created with gcloud container node-pools create, resized with gcloud container clusters resize (in regional clusters --num-nodes is per zone) and removed with gcloud container node-pools delete, which by default does not respect PodDisruptionBudgets. Google recommends a dedicated service account with roles/container.defaultNodeServiceAccount.
  • A StatefulSet gives each Pod a stable identifier and, through volumeClaimTemplates, its own PersistentVolumeClaim; it is governed by a headless Service (clusterIP: None) that publishes Pod IPs through DNS. A ClusterIP Service provides a stable internal IP and forwards from port to targetPort. kubectl scale and kubectl rollout undo scale and roll back.
  • The HorizontalPodAutoscaler changes the replica count based on CPU, memory or custom metrics (kubectl autoscale) and needs resource requests for percentage targets; it does not add nodes, which is the cluster autoscaler job. The VerticalPodAutoscaler adjusts CPU and memory requests: Off only recommends, and Auto evicts Pods to apply them.

Managing Cloud Run resources

  • Every deployment or configuration change in Cloud Run creates an immutable revision; an image tag is resolved to a digest at deploy time. gcloud run deploy --image deploys an image and --source builds the code with Cloud Build. With --no-traffic and --tag, a revision can be tested at its own URL without user traffic.
  • Cloud Run splits traffic between revisions with gcloud run services update-traffic: --to-revisions REV=PERCENT to roll back or split, LATEST for the newest revision and --to-latest to always send it 100 percent. After a split, later deployments keep it. In YAML, the percentages must add up to 100 and are applied with gcloud run services replace.
  • Cloud Run scales on requests and can scale to zero. Minimum instances (--min) keep instances warm to avoid cold starts and are billed; maximum instances (--max) cap scaling to control cost or database connections. Concurrency (--concurrency) sets how many requests each instance handles; use 1 for code that cannot run requests in parallel.

Managing storage and database solutions

  • Cloud Storage secures objects with bucket-level IAM roles (Object Viewer, Object Creator, Object User, Object Admin), uniform bucket-level access, which disables ACLs, and public access prevention. Signed URLs give temporary access without an account. A retention policy locked with Bucket Lock stops objects from being deleted or replaced.
  • Cloud Storage Object Lifecycle Management applies rules with one action (Delete, SetStorageClass or AbortIncompleteMultipartUpload) and conditions such as age, matchesPrefix, isLive or numNewerVersions. When several rules match, Delete wins and the cheapest class wins. Delete waits until retention is met. Apply it with gcloud storage buckets update --lifecycle-file.
  • Each service has its own query path: gcloud sql connect opens a client against Cloud SQL, gcloud spanner databases execute-sql runs SQL on Spanner and bq query does so on BigQuery. Federated queries use EXTERNAL_QUERY to read Cloud SQL, Spanner or AlloyDB from BigQuery without copying data. In Firestore, compound queries with a range clause need a composite index.
  • The Pricing Calculator estimates costs before deployment from your usage assumptions. In Cloud Storage, cost combines storage (based on each object's class), data processing (operations and retrieval fees for Nearline, Coldline and Archive) and network. In BigQuery, the INFORMATION_SCHEMA.TABLE_STORAGE view lets you forecast cost under logical or physical billing.
  • Cloud SQL offers automated and on-demand backups (gcloud sql backups create); restoring to the same instance overwrites its data, and point-in-time recovery always creates a new instance. Firestore lets you schedule daily or weekly backups with configurable retention, which are always restored to a new database and don't include TTL policies or Security Rules.

Managing networking resources

  • VPC networks are global and subnets are regional: you add one with gcloud compute networks subnets create, giving the network, primary range and region. Ranges can't overlap other subnets in the network or in peered networks, and should avoid on-premises ranges. IPv6 subnets exist only in custom mode, and Private Google Access can be enabled when the subnet is created.
  • A subnet's primary IPv4 range is expanded with gcloud compute networks subnets expand-ip-range and a smaller prefix length, without interrupting traffic. The expansion can't be undone or shrunk, so expand conservatively. Afterwards, review firewall rules that use the original range and, for GKE, the control plane authorized networks.
  • A static address is reserved with gcloud compute addresses create: --global for global load balancers, --region for VMs and regional load balancers, and --region with --subnet for internal addresses. An ephemeral address in use can be promoted to static without dropping traffic. Reserved addresses aren't released when the resource is deleted, and unassigned external ones are charged at a higher rate.
  • Cloud DNS offers public zones, visible on the internet, and private zones, visible only from authorized VPC networks; to publish a public zone, point the domain's name servers at the registrar to Cloud DNS. Cloud NAT gives resources without external IPs outbound internet access through a regional gateway tied to a Cloud Router, without allowing unsolicited inbound connections.

Monitoring and logging

  • A metric-threshold alerting policy notifies you when a metric is above or below a threshold for the whole retest window, which prevents alerts caused by a single measurement. Time series can be aggregated and grouped by labels such as zone. With several conditions, AND_WITH_MATCHING_RESOURCE requires the same resource to meet all of them.
  • User-defined metrics are best collected with OpenTelemetry (the Ops Agent OTLP receiver on Compute Engine) or the Monitoring API, writing against a suitable monitored resource such as generic_task rather than global. Log-based metrics are created in Cloud Logging as counters or distributions, only count entries received after creation, and can be charted and alerted on.
  • Logs are exported with sinks: Pub/Sub to stream them to external or on-premises tools, BigQuery to join them with business data, and Cloud Storage to archive them. The sink's writer identity needs permissions on the destination, aggregated sinks with --include-children cover folders or organizations, and already stored entries can only be copied to Cloud Storage with gcloud logging copy.
  • The Log Router evaluates each entry against the resource's sinks: _Required can't be modified, while _Default accepts exclusion filters, a new destination, or can be disabled. User-defined log buckets let you set retention and lock them with --locked; upgraded to Observability Analytics they support SQL and a linked BigQuery dataset without ingestion costs.
  • The Logs Explorer, the API and gcloud logging read use the Logging query language: field-operator-value comparisons joined by uppercase AND, OR and NOT, with an implicit AND between lines. Severity compares by numeric order, NOT on a missing field is true while != is false, and in gcloud logging read the --freshness flag widens the age of returned entries.

5. Configuring access and security

17–18%

Managing Identity and Access Management (IAM)

  • An allow policy holds role bindings (principals, a role and an optional condition) plus an etag and a version; it is attached to a resource and inherited by its descendants. gcloud projects add-iam-policy-binding adds one binding, while set-iam-policy replaces the whole policy and needs read-modify-write with the etag. get-iam-policy doesn't show inherited roles; use Policy Troubleshooter for that.
  • IAM has basic roles (very broad; not recommended in production), predefined roles (maintained by Google) and custom roles. Custom roles are created in an organization or a project, never a folder, and can only be granted there; they are managed with gcloud iam roles create, update, delete and undelete, and the DISABLED stage makes them ineffective without removing them from policies.

Managing service accounts

  • A service account is created with gcloud iam service-accounts create ID --display-name; its email is ID@PROJECT_ID.iam.gserviceaccount.com and the ID can't be changed. The required role is roles/iam.serviceAccountCreator. Google recommends one account per application, prefixes such as vm- and a description with a contact, and retrying with exponential backoff if a new account isn't visible yet.
  • A service account should get only the roles it needs, on the most specific resource possible, such as a bucket instead of the project. Access scopes don't replace IAM, the iam.automaticIamGrantsForDefaultServiceAccounts constraint stops default service accounts from getting Editor, and role recommendations point out permissions that aren't being used.
  • Attaching a service account to a resource (a VM, a Cloud Run service) requires iam.serviceAccounts.actAs, included in roles/iam.serviceAccountUser on the account. On Compute Engine you must stop the VM before changing the account and should use the cloud-platform scope; GKE uses Workload Identity Federation for GKE; across projects, iam.disableCrossProjectServiceAccountUsage must not be enforced.
  • A service account is also a resource with its own allow policy, viewed and changed with gcloud iam service-accounts get-iam-policy and add-iam-policy-binding. Anyone with roles/iam.serviceAccountAdmin can grant themselves impersonation, so grant access per account rather than per project. Disable an account before deleting it, because disabling keeps its bindings.
  • Impersonating a service account means an authenticated principal gets short-lived credentials for that account; it requires iam.serviceAccounts.getAccessToken, included in roles/iam.serviceAccountTokenCreator. It is used with --impersonate-service-account, the auth/impersonate_service_account property, or gcloud auth application-default login for client libraries, and it avoids keys.
Practice this certification