GCP Associate Cloud Engineer Cheat Sheet: Services, IAM and Networking on One Page

GCP Associate Cloud Engineer Exam at a Glance

The Google Cloud Associate Cloud Engineer exam validates your ability to deploy applications, monitor operations, and manage enterprise solutions. Here are the essential facts:

• Number of questions: 50 multiple-choice and multiple-select questions
• Time limit: 2 hours (plus 15-minute introduction)
• Format: Remote proctored or at a testing center
• Passing score: 70% (based on scaled scoring)
• Cost: $125 (plus tax, if applicable)
• Validity: 3 years

The exam covers four domains with specific weightings: If you're preparing for this exam, GCP Associate Cloud Engineer Difficulty: Why Google Exams Feel Different is essential reading.

Domain	Weight
1. Setting up a cloud solution environment	25%
2. Planning and configuring a cloud solution	25%
3. Deploying and implementing a cloud solution	25%
4. Ensuring successful operation of a cloud solution	25%

Note: These weights are approximate and may shift slightly. Always refer to the official exam guide.

Domain 1: Setting Up a Cloud Solution Environment (25%)

This domain tests your ability to set up cloud projects, billing, and IAM. Key concepts: Our post on GCP Associate Cloud Engineer Study Plan: 10-Week Roadmap for Beginners covers this further.

• Cloud projects: Understand resource hierarchy (Organization > Folders > Projects > Resources). Know how to create and manage projects using Cloud Console, Cloud Shell, and gcloud commands.
• Billing accounts: Link and unlink billing accounts to projects, set up budgets and alerts, and export billing data to BigQuery for analysis.
• IAM roles: Differentiate between basic (Owner, Editor, Viewer), predefined (e.g., roles/compute.admin), and custom roles. Know how to grant roles to users, groups, and service accounts.
• Service accounts: Create and manage service accounts, assign roles, and use them for authentication in Compute Engine and other services.
• Cloud Shell and gcloud: Use gcloud commands to manage resources, configure properties (like region and zone), and automate tasks.
• APIs: Enable and disable Google Cloud APIs for projects.

Domain 2: Planning and Configuring a Cloud Solution (25%)

This domain covers planning compute, storage, and network resources. Key concepts:

• Compute options: Choose between Compute Engine (VMs), Google Kubernetes Engine (GKE), Cloud Run, and Cloud Functions based on use case (e.g., containerized, serverless, event-driven).
• Storage options: Select the right storage: Cloud Storage (object storage), Cloud SQL (relational), Cloud Spanner (horizontally scalable relational), Firestore (NoSQL document), Bigtable (NoSQL wide-column), and Memorystore (Redis/Memcached).
• Networking: Plan VPC networks, subnets, firewall rules, and routes. Understand IP addressing, including private and public IPs, and use of Cloud NAT for outbound internet without external IPs.
• Load balancing: Choose between HTTP(S), SSL Proxy, TCP Proxy, and Network load balancers. Understand global vs. regional load balancing.
• Pricing: Estimate costs using the Pricing Calculator, understand sustained use discounts, committed use discounts, and preemptible VMs.
• Quotas: Check and manage project quotas for resources like CPU, IP addresses, and API requests.

Domain 3: Deploying and Implementing a Cloud Solution (25%)

This domain focuses on deployment and infrastructure automation. Key concepts:

• Compute Engine: Create and configure VM instances, manage disks, snapshots, and images. Use instance templates and managed instance groups for autoscaling.
• Kubernetes Engine: Deploy containerized applications using GKE. Understand pods, deployments, services, and ingress. Use kubectl commands.
• Cloud Run and Cloud Functions: Deploy serverless workloads. Configure triggers (HTTP, Cloud Pub/Sub, Cloud Storage events) and set scaling parameters.
• Cloud Storage: Create buckets, set storage classes (Standard, Nearline, Coldline, Archive), and manage object lifecycle and versioning.
• Cloud SQL and Cloud Spanner: Create instances, configure databases, and manage users and connections.
• Infrastructure as Code: Use Deployment Manager templates or Terraform to provision resources. Understand the basics of writing and applying templates.
• Cloud Marketplace: Deploy solutions from the Marketplace, such as VMs with preconfigured software.

Domain 4: Ensuring Successful Operation of a Cloud Solution (25%)

This domain covers monitoring, logging, and cost management. Key concepts: If this interests you, GCP Professional Cloud Architect Cheat Sheet: Architecture Decisions at a Glance goes into more detail.

• Cloud Monitoring: Create dashboards, set up alerting policies, and use uptime checks. Understand metrics like CPU utilization, network traffic, and disk I/O.
• Cloud Logging: View and export logs to BigQuery or Cloud Storage. Use logs-based metrics and exclusions.
• Cloud Audit Logs: Monitor admin activity, data access, and system events for security and compliance.
• Cost management: Use budgets and alerts, analyze billing reports, and identify cost optimization opportunities (e.g., right-sizing VMs, deleting unused resources).
• Identity and Access Management (IAM): Review and refine IAM policies, use conditions for fine-grained access, and audit access with Cloud Audit Logs.
• Resource management: Use labels to organize resources, manage quotas, and plan for capacity.
• Disaster recovery: Implement backup and restore strategies for Compute Engine (snapshots), Cloud SQL (backups), and Cloud Storage (versioning).

Common Exam Traps and Gotchas

Many candidates stumble on tricky questions. Here are common traps to watch out for:

• Confusing IAM roles: Basic roles (Owner/Editor/Viewer) are broad; predefined roles are more specific. For example, roles/compute.instanceAdmin doesn't allow creating VMs unless you also have roles/compute.networkAdmin to create network resources. Always check the exact permissions.
• Mixing up global and regional resources: VPC networks are global, but subnets are regional. Firewall rules can be global or regional. Load balancers: HTTP(S) is global, Network is regional.
• Storage class selection: Choosing the wrong storage class for access frequency. Remember: Nearline (30 days), Coldline (90 days), Archive (365 days) minimum storage durations.
• Preemptible VMs: They can be terminated at any time, but they are not for stateful workloads. They are cheaper but not covered by SLAs.
• gcloud vs. Cloud Console: Some tasks can only be done via gcloud (e.g., certain IAM roles). The exam may test if you know the right tool.
• Firewall rules: Default deny all ingress, allow all egress. Specific rules override defaults. When creating a VM, you must allow SSH (port 22) via a firewall rule.
• Cloud NAT vs. Cloud VPN: Cloud NAT allows outbound internet for private instances; Cloud VPN connects your VPC to on-premises network.
• Deployment Manager vs. Terraform: Both are IaC tools, but Deployment Manager is Google's native. Terraform is third-party but widely used.

Final Tips

Use this cheat sheet as a quick reference during your final revision. Focus on hands-on practice with gcloud commands and the Cloud Console. Review the official documentation for each service. Good luck!

If you want a schedule that fits your available time, a free Google Cloud Associate Cloud Engineer study plan can guide your remaining preparation.

Spot the patterns the exam uses to trip people up — Google Cloud Associate Cloud Engineer practice exam questions will show you.

A quick free Google Cloud Associate Cloud Engineer readiness check can show which topics still need attention.