CertKata

Google Cloud Associate Cloud Engineer — Free Essentials

Key facts distilled from CertKata's GCP-ACE question bank. Free to read — no account needed.

Organization, folder, project, resource

The hierarchy is organization, then folders, then projects, then resources. Regions and zones are locations, not hierarchy levels - a region contains zones and each zone is an independent failure domain. IAM and organization policies attached to a folder inherit to every project inside it, which makes a folder the right boundary for delegating a department or isolating a subsidiary; firewall rules and instance templates are project-level and do not inherit. A project is the boundary for IAM, billing and quota, and a deleted project is recoverable for 30 days.

IAM role types: basic, predefined, custom

IAM has three role types - basic, predefined and custom; there is no zonal role type. Owner, Editor and Viewer are the basic roles: Editor covers most changes and Owner adds IAM and billing management that is rarely needed, so granting Owner where Editor suffices is the classic over-grant. Predefined roles are the least-privilege answer - compute.viewer for read-only Compute Engine, storage.admin for buckets and objects only, logging.viewer for logs, cloudsql.client to connect through the proxy. gcloud iam roles create defines a custom role.

gcloud: init, configurations, and how defaults resolve

gcloud init walks through authentication, project selection and default region. After that, config set project changes the default project, compute/region and compute/zone set the Compute Engine defaults, and config get-value reads a property back. Named configurations bundle account, project and region so a whole context switches with one activate, and configurations list marks the active one. Flags override configured defaults for a single invocation, so --project targets another project without changing context. --quiet suppresses prompts for scripting.

GKE cluster shapes: Autopilot, Standard, zonal, regional

Kubernetes control plane and worker node components, connected only through the API serverCONTROL PLANEetcdschedulercontrollermanagerapi-servervia API serverWORKER NODEkubeletkube-proxycontainerruntimepodsAll control-plane ↔ node traffic goes through the api-server

Autopilot manages the nodes and bills by pod requests; Standard means you configure node pools yourself, which is what lets one cluster mix machine types so GPU workloads land on GPU nodes. Clusters are zonal or regional, and a regional cluster replicates both the control plane and the nodes across zones. Private clusters give nodes internal IPs only, and VPC-native clusters take pod and service IPs from secondary ranges on the subnet. Release channels manage upgrades; maintenance windows control when they land.

Cloud Storage: classes, lifecycle and versioning

The classes are Standard, Nearline, Coldline and Archive - Archive is cheapest for data touched less than once a year; Warmline, Hotline and Glacier are not Google Cloud terms. Buckets are regional, dual-region or multi-regional, never zonal, and location plus default-storage-class are set at creation. Lifecycle rules act on object age with SetStorageClass, Delete and AbortIncompleteMultipartUpload, and can target noncurrent versions. Versioning retains copies of overwritten or deleted objects; retention policies block deletion until the period passes.

This is a preview. Get the full GCP-ACE cheat sheet — every domain, bundled with the practice question bank.

Sign up for the full version