GCP ACE Practice / Study guide / Domain 3
GCP ACE Domain 3: Deploying & Implementing a Cloud Solution
Roughly ~22% of the Google Cloud Associate Cloud Engineer exam. What it
actually covers, the traps to know, and 8 free sample questions with full explanations.
Domain 3 carries the most weight on the real exam, and it's where planning turns into actual gcloud commands and console clicks. For Compute Engine, know instance templates and managed instance groups (MIGs) cold — MIGs are how you get autoscaling, autohealing, and rolling updates, and a huge share of "how do you deploy this at scale" questions resolve to "create an instance template, then a MIG from it." Custom images versus startup scripts versus baked containers is another recurring choice.
For GKE, expect questions on cluster types (zonal vs regional, and the tradeoffs of Autopilot vs Standard), deploying workloads (Deployments, Services, and how a LoadBalancer-type Service gets you an external IP), and node pool management — resizing, upgrading, and taints/tolerations at a conceptual level. You won't need deep Kubernetes YAML mastery for ACE, but you do need to recognize what each object is for.
Data-service deployment shows up too: creating a Cloud SQL instance with the right machine type and high-availability configuration, setting up a GCS bucket with the right location and access controls, and loading data into BigQuery. Round it out with networking implementation — firewall rules (source ranges, target tags, priority and the implied-deny-all default), HTTP(S) load balancers, and Cloud DNS record types. This domain rewards hands-on lab time more than any other; reading alone won't cement it.
Exam tips for this domain
- If a scenario says "scale automatically" or "replace unhealthy instances automatically," the answer is almost always a managed instance group, not a bare Compute Engine instance.
- VPC firewall rules default-deny ingress and default-allow egress; a missing firewall rule, not a broken app, is the most common reason a wrong answer says a connection "fails."
- Know the difference between a GKE Service of type LoadBalancer (external IP, L4) and an Ingress (HTTP(S) routing, L7) — the exam tests exactly this distinction.
Sample questions — Domain 3
These 8 questions are drawn from our full bank of 658 to show the style and
depth you'll get in the app. Each comes with the full explanation you'd see after answering
in a real practice session.
App Engine
Your repo has an app.yaml ready and you must deploy the App Engine app from source. Which command?
- gcloud app deployCorrect
- gcloud app push
- gcloud deploy app.yaml
- appcfg upload
Why: gcloud app deploy reads app.yaml and deploys a new version (optionally --no-promote to keep traffic on the old version). appcfg is long dead; the others don't exist.
Artifact Registry
Your CI machine has a locally built Docker image that must land in Artifact Registry. What are the steps to push it?
- Configure auth (gcloud auth configure-docker REGION-docker.pkg.dev), tag the image with the repo path, docker pushCorrect
- gsutil cp image.tar gs://registry
- kubectl push
- Attach the image to an email to Google
Why: Artifact Registry uses standard Docker protocol: configure the credential helper, tag REGION-docker.pkg.dev/PROJECT/REPO/IMAGE:TAG, push. Buckets and kubectl are not registries.
Batch
You must run thousands of independent containerized simulations with retries and machine provisioning handled for you. Which service is designed for this?
- Batch (or Cloud Run jobs for simpler cases)Correct
- Cloud DNS
- An HTTP load balancer
- Memorystore
Why: Batch schedules containerized/script jobs onto managed VM pools (Spot supported) with queues and retries. Cloud Run jobs cover simpler container-to-completion workloads; the others are unrelated.
BigQuery
You have a local CSV that must land in a new BigQuery table, letting BigQuery infer the schema. Which command?
- bq load --autodetect --source_format=CSV dataset.table ./data.csvCorrect
- gcloud bigquery import data.csv
- bq insert dataset.table data.csv
- gsutil cp data.csv bq://dataset
Why: bq load ingests local files or GCS URIs; --autodetect infers schema. BigQuery has its own bq CLI (not gcloud bigquery for loads), bq insert is for JSON streaming rows, and bq:// isn't a real scheme.
CI/CD
Your five-person team merges to the main branch several times a day. Each merge should automatically build a container image, push it to Artifact Registry, and deploy it to a staging Cloud Run service — with build logs kept for audits. Nobody wants to maintain a Jenkins server. What should you use?
- A Cloud Build trigger on the repository's main branch running a cloudbuild.yaml that builds, pushes, and deploysCorrect
- A cron job on a developer's workstation
- Manual builds every Friday
- A large VM running Jenkins, but only lightly maintained
Why: Cloud Build triggers give serverless CI on every merge with logged, IAM-governed builds and native Artifact Registry/Cloud Run integration. Workstation crons die with the laptop, Friday batches defeat continuous delivery, and 'lightly maintained Jenkins' is the server they explicitly refused.
Cloud Build
On every push to main, your container should be built and deployed to Cloud Run automatically. Which service provides the managed CI pipeline?
- Cloud Build with a trigger on the repo (cloudbuild.yaml builds and deploys)Correct
- Cloud Scheduler
- Pub/Sub alone
- A developer's laptop
Why: Cloud Build triggers watch repos (GitHub etc.), run build steps in managed workers, and can deploy to Cloud Run/GKE. Scheduler is time-based, and laptops are not CI.
Cloud DNS
You must point www.example.com at your load balancer's IP 203.0.113.10 using Cloud DNS. What do you set up?
- Create/verify a public zone for example.com, then add an A record for www → 203.0.113.10 (and delegate the domain's NS to Cloud DNS)Correct
- Add the IP to a firewall rule
- Create a private zone
- Rename the VM to www.example.com
Why: Public serving requires a public zone whose name servers the registrar delegates to, plus the A/AAAA record. Private zones only resolve inside chosen VPCs; names and firewall rules don't publish DNS.
Cloud Functions
An HTTP-triggered function needs to reject unauthenticated calls. What enforces this?
- Require authentication (no allUsers invoker); callers present IAM-signed identity tokensCorrect
- An if-statement checking a hardcoded password
- Only obscurity of the URL
- Turning off logging
Why: Serverless invocation is gated by IAM: grant roles/cloudfunctions.invoker (or run.invoker) only to authorized identities and require OIDC tokens. Hardcoded secrets and secret URLs are not authentication.
Practice this domain for real
The app has dozens more Domain 3 questions with instant scoring, spaced
repetition of what you get wrong, and progress tracking across sessions.
Start Domain 3 practice →
Other exam domains