GCP ACE Practice / Study guide / Topics / gcloud CLI Commands
gcloud CLI Commands
What actually gets tested on the Google Cloud Associate Cloud Engineer exam,
the traps to know, and 6 free sample questions with full explanations.
The ACE exam expects you to recognize what a gcloud command does when you see it, not memorize every flag. gcloud config list prints the active configuration's properties — account, project, default region/zone — which is different from gcloud projects list (enumerates every project you can at least resourcemanager.projects.get on) and different again from gcloud projects describe (metadata for one specific project). Mixing these three up is one of the exam's most common wrong-answer patterns.
On authentication, gcloud auth login opens a browser flow to authenticate your own Google identity for interactive CLI use; the related but distinct gcloud auth application-default login sets up Application Default Credentials for code and client libraries running on your machine — the exam expects you to know these are two different credential stores serving two different purposes, not the same command twice.
For workloads that shouldn't use a downloaded key, impersonation (gcloud config set auth/impersonate_service_account or the --impersonate-service-account flag, backed by roles/iam.serviceAccountTokenCreator) issues short-lived credentials on demand instead of a long-lived file that can leak. Beyond the CLI itself, know when each tool is the right one: the Console for one-off exploratory changes, Cloud Shell for a preconfigured browser shell with the SDK and common tools already installed, and a local gcloud install (or Terraform on top of it) for anything repeatable.
Exam tips for this topic
- gcloud config list shows CLI settings (account, project, region/zone); gcloud projects list enumerates projects you can access — don't confuse the two.
- gcloud auth login authenticates you for interactive CLI use; gcloud auth application-default login sets up ADC for code/client libraries — two separate credential stores.
- Impersonation via roles/iam.serviceAccountTokenCreator issues short-lived credentials with no key file to leak — recognize it as the safer alternative whenever a scenario mentions automation or a workload.
Sample questions — gcloud CLI Commands
These 6 questions are drawn from our full bank of 658 to show the style and
depth you'll get in the app. Each comes with the full explanation you'd see after answering
in a real practice session.
gcloud
Which command shows the account, project, and other properties of your active gcloud configuration?
- gcloud config listCorrect
- gcloud auth login
- gcloud projects describe
- gcloud config configurations create
Why: gcloud config list prints the active configuration's properties (account, project, region/zone). auth login authenticates, projects describe shows metadata of a project (not your CLI config), and configurations create makes a new profile.
gcloud
You need to run gcloud commands as a service account from your workstation for a script. Which approach is recommended TODAY over downloading a JSON key?
- Use service account impersonation with gcloud --impersonate-service-account after granting yourself Token CreatorCorrect
- Download the service account's JSON key file and activate it with gcloud auth activate-service-account
- Store the service account's password in Secret Manager and have the script log in with it
- Add your user account as a member of the service account's group so you inherit its identity
Why: Impersonation issues short-lived credentials and requires the roles/iam.serviceAccountTokenCreator grant, avoiding long-lived key files that can leak. Downloaded JSON keys are discouraged and often blocked by org policy; service accounts have no passwords, and groups don't confer identity.
gcloud
Which command authenticates your user account in the gcloud CLI on a new machine?
- gcloud auth loginCorrect
- gcloud iam login
- gcloud users authenticate
- gcloud config set auth
Why: gcloud auth login opens a browser flow to authenticate your Google identity (gcloud auth application-default login is the related command for Application Default Credentials used by client libraries). The other commands are not valid.
gcloud
You want to see all projects your account can access. Which command do you run?
- gcloud projects listCorrect
- gcloud config list projects
- gcloud org list
- gcloud iam projects show
Why: gcloud projects list enumerates projects on which you hold at least resourcemanager.projects.get. gcloud config list shows CLI settings, and the others aren't valid commands.
gcloud
Your script must run gcloud non-interactively in CI and answer 'yes' to prompts automatically. Which flag helps?
- --quiet (or -q) to disable prompts and accept defaultsCorrect
- --force, which overrides confirmation prompts on every command
- --assume-yes, which answers yes to all interactive questions
- --batch, which runs the command in non-interactive batch mode
Why: --quiet suppresses interactive prompts, using default answers (aborting when there is no safe default) — standard for automation. The other flags don't exist globally in gcloud.
gcloud
What does gcloud auth application-default login configure?
- Application Default Credentials used by client libraries and tools like Terraform running locallyCorrect
- The account and default project that the gcloud CLI itself uses for every subsequent command
- Service account keys stored on a VM's metadata server for local applications to read
- Two-factor authentication requirements for the developer's Google account
Why: ADC is the credential chain client libraries look up; the application-default login command stores user credentials for local development so code and Terraform can authenticate. gcloud auth login (without application-default) is what authenticates the CLI itself — the two are separate credential stores.
Practice this for real
The app has dozens more questions on this and every other topic, with instant scoring,
spaced repetition of what you get wrong, and progress tracking across sessions.
Start practicing →
This topic shows up in
Other topics