Why the GCP ACE is the overlooked cert of 2026

Search any tech job board and you’ll find AWS certifications mentioned two to three times more often than GCP ones. That gap is closing fast. Google Cloud posted 29% year-over-year revenue growth in 2024, and enterprise adoption is accelerating as organisations bet on Google’s AI infrastructure — Vertex AI, TPUs, and Gemini integration — for their next wave of workloads. Employers hiring for GCP roles have a far smaller certified candidate pool to draw from than for AWS or Azure, which translates directly into negotiating leverage for those who hold the cert.

The ACE exam itself is $200 USD, runs for two hours, and contains approximately 50 multiple-choice and multiple-select questions. The passing threshold is not published, but most candidates report needing around 70–75% to pass. Unlike some vendor exams, GCP questions are scenario-heavy: they present a real operational situation and ask you to choose the right tool or configuration — not recall a product description.

The GCP mental model

Google Cloud organises everything around projects. A project is the billing boundary, the IAM boundary, and the resource container all at once. Before you touch any service, understand how projects, folders, and the organisation node relate to each other in the Resource Hierarchy — the exam will test this early and often.

The five exam domains

Google publishes the ACE exam guide at cloud.google.com. The five domains and their approximate weights are:

Domain 1 — Setting Up a Cloud Solution Environment (~17%)

This domain covers the foundation before you deploy anything: creating projects, configuring billing accounts and budgets, setting up the Google Cloud CLI (gcloud), and enabling APIs.

  • Resource Hierarchy: Organisation → Folders → Projects → Resources. IAM policies are inherited downward. Know how to grant access at the right level — over-privileged project-level grants are a common wrong-answer trap.
  • Billing accounts: You can link multiple projects to one billing account. Budget alerts use Cloud Monitoring and Pub/Sub, not hard spending caps — they notify but do not stop usage by default. Know how to configure programmatic billing export to BigQuery.
  • gcloud CLI: Know the structure of gcloud compute instances create, gcloud container clusters get-credentials, and gcloud config set project. The exam will show CLI commands and ask what they do.
  • APIs: Most GCP services require you to enable their API at the project level before use. Service accounts used by compute resources must have the right scope and role to call other service APIs.

Domain 2 — Planning and Configuring a Cloud Solution (~17%)

This domain tests your ability to choose the right compute and storage options for a given scenario. It’s where most candidates need the deepest preparation.

  • Compute decision tree: Compute Engine (VMs, full control) → GKE (containerised workloads, Kubernetes) → Cloud Run (serverless containers, scales to zero) → Cloud Functions (event-driven, lightest overhead). The exam answer for “a containerised app that gets no traffic overnight” is Cloud Run.
  • Compute Engine: Machine families (N2/E2 general purpose, C3 compute-intensive, M3 memory-intensive), preemptible vs Spot VMs (up to 91% cheaper, can be reclaimed with 30-second notice), sustained use discounts vs committed use contracts (1- or 3-year).
  • GKE modes: Standard (you manage nodes, full control) vs Autopilot (Google manages nodes, billed per pod). The exam answer for “minimise node management overhead” is GKE Autopilot.
  • Storage decision: Cloud Storage (object) → Persistent Disk/Hyperdisk (block, VM-attached) → Filestore (NFS) → Cloud SQL (relational, moderate scale) → Cloud Spanner (globally distributed relational) → Firestore (document, serverless) → Bigtable (wide-column, high-throughput analytics). Match the workload to the storage type.
  • Cloud Storage classes: Standard, Nearline (<once/month), Coldline (<once/quarter), Archive (<once/year). Classes are not auto-tiering by default — you configure lifecycle rules to move objects between them.
  • Networking: VPC networks in GCP are global (subnets are regional). Know VPC Peering (non-transitive, direct connection), Shared VPC (centralised host project, service projects consume subnets), and Cloud NAT (outbound internet for private instances, no NAT gateway VM required).

Domain 3 — Deploying and Implementing a Cloud Solution (~25%)

The largest domain by weight covers actually building things: spinning up compute, deploying containers, managing storage, and using infrastructure-as-code.

  • Compute Engine: Instance templates + Managed Instance Groups (MIGs) for auto-scaling. Stateful vs stateless MIGs. Startup scripts via instance metadata for bootstrapping. Creating snapshots for backup before destructive operations.
  • GKE: kubectl apply, Deployments vs StatefulSets, Services (ClusterIP / NodePort / LoadBalancer), Ingress for HTTP(S) routing with Google-managed certificates, Horizontal Pod Autoscaler, ConfigMaps and Secrets for configuration.
  • Cloud Run: Deploying a container image from Artifact Registry. Traffic splitting between revisions for canary releases. Minimum instances setting to eliminate cold starts. Concurrency limit (requests per container instance).
  • Storage operations: Creating Cloud SQL instances and importing data. Setting up Cloud Storage buckets with lifecycle policies. Using gsutil and the Storage Transfer Service for large-scale data migrations.
  • Infrastructure as Code: GCP’s native IaC tool is Deployment Manager (YAML). Terraform with the Google provider is more common in practice and is fair game. Know what terraform plan, apply, and state do in the context of GCP resources.
  • Cloud Build: GCP’s managed CI/CD. Triggers from Cloud Source Repositories or GitHub. Build steps in cloudbuild.yaml. Output images pushed to Artifact Registry. Know Cloud Build vs third-party CI tools — both appear in scenario questions.

Domain 4 — Ensuring Successful Operation (~22%)

Operations, monitoring, logging, and day-two management — the work that separates engineers who can deploy from those who can run production reliably.

  • Cloud Monitoring: GCP service metrics flow in automatically. For VM-level metrics (memory, disk, process) you need the Ops Agent installed on the instance. Custom metrics via the Monitoring API. Uptime checks for external health probing. Alerting policies with PagerDuty, Pub/Sub, or email notification channels.
  • Cloud Logging: All GCP service logs flow to Cloud Logging automatically. Log-based metrics let you trigger alerts from log events. Logs Router exports to BigQuery (analytics), Cloud Storage (archiving), or Pub/Sub (streaming pipelines). Default retention is 30 days for most logs, 400 days for Admin Activity audit logs.
  • Compute Engine operations: Live migration moves VMs between hosts during maintenance without downtime. SSH-in-browser via Identity-Aware Proxy (no bastion host needed). Machine type changes require stopping the instance first. Snapshots create point-in-time disk backups.
  • GKE operations: Node pool upgrades, release channels (Rapid / Regular / Stable) for cluster versioning, node auto-provisioning. Draining nodes before maintenance with kubectl drain. Pod disruption budgets to maintain availability during voluntary disruptions.
  • Cost management: Recommender API surfaces right-sizing suggestions. Billing exports to BigQuery for custom cost analysis. Labels for cost allocation across teams and environments. Committed Use Discounts (CUDs) for predictable workloads; Spot VMs for batch/fault-tolerant jobs.

Domain 5 — Configuring Access and Security (~19%)

Cloud IAM is the backbone of every GCP deployment, and this domain tests it from multiple angles — from resource hierarchy to workload identity to firewall rules.

  • IAM model: Principals (Google accounts, service accounts, groups, domains) + Roles (permission bundles) bound to Resources. Roles are Basic (Owner/Editor/Viewer — avoid in production), Predefined (service-specific, Google-managed), or Custom (you define the permission set).
  • Service accounts: The identity for GCP workloads. Application Default Credentials (ADC) automatically picks up the attached service account. Service account impersonation lets a principal act as a service account without downloading a key. Avoid downloading service account key files whenever possible.
  • Workload Identity: Allows GKE pods to authenticate as a Google service account without a key file, using the Kubernetes service account as a bridge. This is the exam’s preferred secure answer whenever a GKE workload needs to call GCP APIs.
  • VPC firewall rules: Stateful, applied at the instance level via target tags or service accounts. Evaluated by priority number (lower = higher priority). Ingress rules control inbound; egress rules control outbound. Default: implied deny-all ingress, allow-all egress.
  • Cloud Armor: GCP’s WAF and DDoS protection, attached to the Global HTTP(S) Load Balancer. Recommend it for public-facing web apps needing Layer 7 protection, rate limiting, or geographic IP blocking.
  • Secret Manager: Stores API keys, passwords, and certificates as versioned, auditable secrets. Prefer it over environment variables or ConfigMaps for sensitive values. Access is controlled via IAM (secretmanager.secretAccessor role).
  • Customer-Managed Encryption Keys (CMEK): GCP encrypts all data at rest by default with Google-managed keys. CMEK lets you use Cloud KMS keys you control, giving you key revocation capability at the cost of added operational responsibility.
The single most common ACE trap: confusing roles with permissions. You grant roles to principals, not permissions directly. A role is a named bundle of permissions. Custom roles let you craft a minimal permission set, but they require manual maintenance as Google adds new APIs over time.

Services you must know before exam day

If you can answer a scenario question involving any of these pairs without hesitation, you’re well-prepared:

Why it matters for cert candidates

The GCP ACE opens the door to every Google Cloud Professional certification — Cloud Architect, Data Engineer, DevOps Engineer, and Security Engineer. It also signals to employers that you can operate across all three major cloud platforms, not just AWS. With GCP market share growing and fewer certified candidates in the pool, passing the ACE in 2026 puts you in rare company. Average study time for candidates with some cloud background is 4–6 weeks at 1–2 hours per day. Build hands-on experience in a free-tier GCP project alongside your reading — scenario questions are much easier when you’ve actually navigated the console and run gcloud commands against real resources.

What comes after the ACE

The ACE is the only Associate-level GCP certification. From here the path forks into Professional exams based on your role:

Candidates who pass the ACE often report that the Professional Cloud Architect exam feels like a natural extension — deeper architecture trade-offs rather than entirely new services. Aim for PCA within 90 days of passing the ACE if architecture is your target role.

Ready to test your GCP knowledge? We have scenario-based Google Cloud practice questions covering IAM, compute, storage, networking, and operations — timed, randomised, and free.

Start GCP ACE Practice Questions →