Google Cloud

10 units, 26 lessons and 62 questions on Google Cloud. Includes a full-length ACE mock exam drawn in the published domain weights, marked with a per-domain breakdown. Free, and open without an account.

The exam it prepares for: Google Cloud Associate Cloud Engineer (ACE), 55 questions in 120 minutes, pass Not published by Google.

What is in it

The hierarchy

Organization, folders, projects. Everything hangs off it, including permissions.

  • The project is the unit — Every resource belongs to exactly one project. Projects group into folders, folders into an organization. Quotas, billing and permissions all attach somewhere on that tree.
  • Permissions flow downwards — An IAM binding at the organization or folder level is inherited by everything beneath it. There is no deny by inheritance in the basic model — a grant higher up cannot be taken away lower down without deny policies.

Identity

Service accounts, and the roles worth using.

  • Service accounts — A service account is an identity for a workload. Attach one to the resource and it gets short-lived credentials automatically; a downloaded key file is the thing to avoid.
  • Basic, predefined, custom — Basic roles — Owner, Editor, Viewer — predate IAM and are far too broad. Predefined roles are scoped to a service. Custom roles exist for when neither fits.

Compute and storage

Four ways to run code, four ways to keep bytes.

  • Compute Engine, GKE, Cloud Run, Functions — Compute Engine is a virtual machine. GKE is managed Kubernetes. Cloud Run runs a container per request with no cluster to keep. Functions runs a single handler per event.
  • Cloud Storage classes — Standard, Nearline, Coldline and Archive differ in storage price, retrieval cost and minimum storage duration — thirty, ninety and three hundred and sixty-five days respectively.

Networking

The part that surprises people arriving from AWS.

  • The VPC is global — A Google Cloud VPC spans every Region. Subnets are regional and live inside it, so two Regions can talk over private addresses without peering anything.
  • Firewall rules — Rules are set at the VPC level and are matched by network tags or service accounts rather than by attaching a group to an instance. Priority decides between overlapping rules.

Cost and guidance

Discounts you get without asking, and the framework worth reading.

  • Sustained use and committed use — Sustained use discounts apply automatically to instances that run for much of the month. Committed use discounts need a one or three year commitment and go deeper.
  • The Architecture Framework — Google's equivalent of a well-architected review, organised around operational excellence, security, reliability, cost optimisation and performance.

Section 1 · Setting up a cloud solution environment

Projects, the resource hierarchy, organization policy, Cloud Identity, quotas and billing. About 20% of the exam.

  • The resource hierarchy — Organization, then folders, then projects, then resources. IAM policy set at one level is inherited by everything beneath it, and a project is the unit of billing, quota and isolation.
  • Billing accounts, budgets and quotas — A billing account pays for many projects; budgets alert on forecast or actual spend; quotas cap what a project may consume and are raised by request. Billing exports to BigQuery are how real analysis is done.
  • More on projects and identity — Further practice on the hierarchy, Cloud Identity and gcloud configuration.

Section 2 · Planning and configuring a cloud solution

Choosing compute, storage and network products before deploying them. About 17.5% of the exam.

  • Choosing the compute product — Compute Engine when you need the machine, GKE when you need orchestration, Cloud Run for a container that scales to zero on requests, Cloud Functions for a single event handler. Spot VMs cut the price of interruptible work.
  • Choosing the storage and database product — Cloud Storage for objects, Cloud SQL for a managed relational database, Spanner when it must be relational and horizontally scalable, Firestore for documents, Bigtable for wide-column time series, BigQuery for analytics.
  • More on planning — Further practice on sizing, regions and network choices.

Section 3 · Deploying and implementing a cloud solution

Deploying Compute Engine, GKE, Cloud Run, data and network resources, and infrastructure as code. The largest section, about 25%.

  • Instance templates and managed instance groups — A template is the immutable definition of an instance; a managed instance group creates instances from it, replaces unhealthy ones and autoscales. Changing the template means a new version and a rolling update.
  • Networking: VPCs, firewall rules and connectivity — A VPC is global and its subnets are regional. Firewall rules are stateful, apply to instances by network tag or service account, and have an implied deny on ingress and allow on egress.
  • Deploying to GKE and Cloud Run — Autopilot manages the nodes; Standard leaves them to you. Cloud Run splits traffic between revisions by percentage, which is how a canary is done without a service mesh.
  • More on deploying — Further practice on Kubernetes objects, storage and deployment commands.

Section 4 · Ensuring successful operation

Managing what is running: instances, clusters, storage, networking, and monitoring and logging. About 20% of the exam.

  • Snapshots, images and machine management — A snapshot backs up a persistent disk incrementally; an image is what new instances boot from. Neither is a substitute for the other, and snapshot schedules are how backups become routine.
  • Monitoring, logging and diagnostics — Cloud Monitoring holds metrics and alerting policies; Cloud Logging holds logs, with sinks routing them to BigQuery or Cloud Storage. The Ops Agent is what puts guest metrics and logs into both.
  • More on operating — Further practice on day-two management and cost visibility.

Section 5 · Configuring access and security

IAM policies, role types and service accounts. About 17.5% of the exam.

  • IAM roles and policy inheritance — Basic roles (owner, editor, viewer) are broad and discouraged; predefined roles are per-service and least-privilege; custom roles exist when neither fits. Policies are inherited down the hierarchy and are additive.
  • Service accounts and impersonation — A service account is an identity for a workload. Attaching one to a resource is the way to avoid keys; impersonation lets a human borrow it temporarily and leaves an audit trail. Exported keys are the option of last resort.
  • More on access — Further practice on IAM structure and auditing.

Open the Google Cloud course · sit the ACE mock exam · try 10 practice questions first