GCP ACE Practice / Study guide / Topics / Cloud Monitoring, Logging & Audit Logs
What actually gets tested on the Google Cloud Associate Cloud Engineer exam, the traps to know, and 6 free sample questions with full explanations.
An alerting policy evaluates a metric condition over a duration and fires to a notification channel — but it only reaches a human if a channel (email, SMS, Pub/Sub) is actually attached. Dashboards visualize metrics but don't page anyone; log sinks archive logs but don't alert; budgets are a completely separate system. A frequent exam trap: an alerting policy exists and looks correctly configured, but there's no notification channel attached, so it fires silently and nobody finds out.
On what's actually visible: the hypervisor can see CPU and network externally without any extra setup, but it can't see inside the guest — memory percentage, disk usage, swap, and application-level metrics all require installing the Ops Agent on the instance. This is a recurring "why don't I see this metric" scenario. For events that aren't a built-in metric at all, a log-based metric turns a pattern in your logs into something you can alert on the same way.
Logs Explorer's query language filters by resource, severity, label, text, and time — a container's own filesystem is ephemeral and not a substitute for centralized logging. Log sinks route logs at ingestion time to GCS/BigQuery/Pub/Sub or another log bucket for long-term retention (Logging's own default buckets keep most logs for roughly 30 days). For audit logs specifically: Admin Activity logs are always on and cannot be disabled; Data Access logs (except for BigQuery, which is always on) are off by default and have to be enabled deliberately — a distinction the exam tests directly.
These 6 questions are drawn from our full bank of 658 to show the style and depth you'll get in the app. Each comes with the full explanation you'd see after answering in a real practice session.
Which audit log type is ALWAYS on and cannot be disabled?
Which query interface finds all ERROR-severity logs from one Cloud Run service in the last hour?
You must be paged when the checkout API's error rate exceeds 2% for 5 minutes. Which Cloud Monitoring construct?
Security asks 'who read objects in this sensitive bucket last week?' What must have been enabled BEFOREHAND for the answer to exist?
Compliance requires keeping ALL audit logs for 7 years cheaply. Default retention won't do. What do you configure?
Default Compute Engine metrics WITHOUT any agent include CPU and network — but which common metrics require installing the Ops Agent?
The app has dozens more questions on this and every other topic, with instant scoring, spaced repetition of what you get wrong, and progress tracking across sessions.
Start practicing →