GCP ACE Practice / Study guide / Domain 1
GCP ACE Domain 1: Setting Up a Cloud Solution Environment
Roughly ~20% of the Google Cloud Associate Cloud Engineer exam. What it
actually covers, the traps to know, and 8 free sample questions with full explanations.
This is the exam's "GCP fundamentals" domain, and it's usually the easiest to pick up fast because it's about structure rather than services. Before you can deploy anything, you need somewhere to put it — and Google Cloud's answer is a strict hierarchy: an organization at the root, optional folders under it (folders can nest inside folders), projects inside folders or directly under the organization, and individual resources — VMs, buckets, databases — inside projects. IAM policies set higher in the tree are inherited downward, which is the single most-tested idea in this domain: put a policy on a folder and every project under it inherits it automatically.
Expect questions on project lifecycle (project IDs are chosen once and are immutable forever; a deleted project sits in a ~30-day recoverable state before it's gone for good and its ID can never be reused), on billing (a billing account can fund many projects; budgets and budget alerts don't cap spend by themselves — they only notify), and on Cloud Identity versus a Google Workspace account for managing users who don't need Gmail or Docs.
The other recurring theme is tooling: knowing what the Cloud SDK (gcloud, gsutil, bq) does versus the Console versus Cloud Shell, how to enable APIs a project needs before using a service, and the difference between a user account and a service account from day one — you'll see service accounts again in much more depth in Domain 5.
Exam tips for this domain
- Memorize the hierarchy direction: Organization → Folder → Project → Resource — and that IAM inherits downward, never upward.
- Project ID is permanent; project name is not. A lot of wrong answers hinge on this exact distinction.
- A billing budget alert is a notification, not a spending cap — nothing stops the bill just because a budget was configured.
Sample questions — Domain 1
These 8 questions are drawn from our full bank of 658 to show the style and
depth you'll get in the app. Each comes with the full explanation you'd see after answering
in a real practice session.
APIs
Your new project throws an error that the Compute Engine API has not been used or is disabled. What should you do?
- Enable the API with gcloud services enable compute.googleapis.comCorrect
- Grant your account the roles/compute.admin role on the project
- Upgrade the project's billing account to a paid support tier
- Create a new service account for Compute Engine to run as
Why: Each project must explicitly enable the APIs it uses; gcloud services enable (or the console API Library) fixes this. IAM roles and service accounts don't matter if the API itself is disabled, and billing being enabled is a prerequisite but the error specifically indicates a disabled API.
Billing
A project's resources keep running but you want a different department to pay for them. What should you do?
- Link the project to the other department's billing accountCorrect
- Export the project's resources to a new project owned by the other department
- Create a new billing budget in the other department's name
- Transfer the organization node to the other department
Why: A project is linked to exactly one billing account at a time, and changing that link (requires Project Billing Manager on the project plus Billing Account User on the target account, or Billing Account Administrator) redirects all future charges without touching any resources. Migrating resources or reorganizing the hierarchy is unnecessary, and budgets only monitor spend — they don't change who pays.
Billing IAM
A new hire must be able to link and unlink projects to the company billing account but must NOT see or change billing account settings like payment methods. Which role should you grant on the billing account?
- Billing Account UserCorrect
- Billing Account Administrator
- Billing Account Viewer
- Project Owner
Why: Billing Account User allows associating projects with the billing account and nothing more, which matches least privilege here (paired with Project Billing Manager or Owner on the projects). Administrator could change payment settings, Viewer can only read cost information, and Project Owner is a project-level role that grants nothing on the billing account.
Cloud Identity
Your company wants employees to use corporate credentials for Google Cloud instead of personal Gmail accounts, and it does not use Google Workspace. What should it set up?
- Cloud Identity, then create the organization and manage users thereCorrect
- Have every employee create a personal Google account with the company domain in the name
- Use only service accounts for humans
- Create a shared admin Google account for the whole company
Why: Cloud Identity provides managed corporate identities (and creates the Organization node) without requiring Google Workspace, and it can federate with an existing IdP such as Active Directory. Personal accounts are unmanaged, shared accounts destroy auditability, and service accounts are for workloads, not people.
Cloud Shell
You need a machine with gcloud, kubectl, and terraform pre-installed to run a few admin commands, without installing anything locally. What is the fastest option?
- Use Cloud Shell from the Google Cloud consoleCorrect
- Create a Compute Engine VM and install the tools
- Use the Cloud Mobile App
- Install Docker locally and pull the SDK image
Why: Cloud Shell is a free, browser-based shell with the Cloud SDK, kubectl, terraform, and many tools preinstalled, plus 5 GB of persistent home storage — ideal for quick admin work. A VM or local Docker adds setup time, and the mobile app is for monitoring and basic management, not full CLI work.
Console
You're on a train with only your phone and need to restart a misbehaving VM. What's the quickest supported option?
- Use the Google Cloud mobile app to stop/start the instanceCorrect
- SSH from the phone's browser into Cloud Shell and script it
- Wait until you have a laptop
- Email Google support to restart it
Why: The Cloud mobile app supports monitoring and key management actions like starting/stopping VMs, viewing alerts, and checking billing. It's the tool designed for exactly this scenario; Cloud Shell in a phone browser technically works but is far clumsier.
Free tier
You want to experiment with Google Cloud personally with minimal risk of charges. Which combination helps most?
- Use the free trial credits and set a budget with alert thresholdsCorrect
- Rely on Google to stop billing automatically at $0
- Create resources only in expensive regions to get discounts
- Disable all APIs after creating resources
Why: The free trial gives credits for new accounts, the always-free tier covers small amounts of some services, and a budget with alerts warns you as spend approaches limits. Google never silently stops billing for paid accounts, and disabling APIs can break running resources without necessarily stopping charges (e.g., storage).
IAM basics
Which best describes how IAM policy inheritance works?
- Policies are inherited downward, and the effective policy is the union of the resource's policy and its ancestors' policiesCorrect
- A policy set on a project overrides and removes any permissions that were granted at the organization level above it
- Policies apply only at the level where they are defined and are never inherited by child resources
- Child policies must be explicitly synchronized with their parent policies before they take effect
Why: IAM is additive: a resource's effective policy is the union of policies set on it and everything above it, so you cannot remove an inherited grant at a lower level (deny policies are a separate, newer mechanism). Grants at higher levels therefore deserve extra care.
Practice this domain for real
The app has dozens more Domain 1 questions with instant scoring, spaced
repetition of what you get wrong, and progress tracking across sessions.
Start Domain 1 practice →
Other exam domains