How to use ACE flashcards effectively
Flashcards work through active recall — the process of retrieving information from memory rather than passively re-reading it. Research consistently shows that active recall produces stronger, longer-lasting memory than re-reading study guides. For ACE preparation, this means flashcards are one of the highest-return study tools available.
Attempt recall first
Read the ACE question on each card, pause, and attempt to formulate the answer in your own words before revealing. This retrieval attempt — even if wrong — dramatically strengthens memory compared to immediately reading the answer.
Review wrong cards again
When you get a card wrong, note it and add it back to your review pile. Spaced repetition — seeing difficult cards more frequently — is the mechanism that makes flashcard study far more efficient than linear reading.
Study by domain
Group your ACE flashcard sessions by domain for the first 3–4 weeks. Master one domain before moving to the next. In the final week, shuffle all cards together to test cross-domain recall — which is what the real ACE exam requires.
Short sessions beat marathon reviews
20–30 flashcard cards per session, done daily, produces better retention than a single 200-card marathon session. Five short daily sessions per week over 4 weeks gives you over 400 total card reviews — enough to reliably pass ACE.
ACE flashcard preview
Sample cards from the ACE flashcard bank. Read the question, think of the answer, then read the explanation below.
What is the correct order of the Google Cloud resource hierarchy from highest to lowest level?
Organization → Folder → Project → Resources
Google Cloud organizes resources in a strict hierarchy: Organization → Folders → Projects → Resources. Policies set at higher levels are inherited by all resources below them. This design allows centralized governance while delegating control at lower levels.
A compliance archive stores legal documents accessed at most once per quarter. Which Cloud Storage class minimizes storage cost while meeting that access pattern?
Coldline
Coldline storage is designed for data accessed fewer than once every 90 days, with a lower storage price than Standard or Nearline. Archive is cheaper but imposes a 365-day minimum storage duration and high retrieval cost — for quarterly access, Coldline is the better cost fit.
Which gcloud command creates a Compute Engine VM named 'web-01' using the e2-medium machine type in zone us-central1-a?
gcloud compute instances create web-01 --zone=us-central1-a --machine-type=e2-medium
The correct command structure is `gcloud compute instances create [NAME] --zone=[ZONE] --machine-type=[TYPE]`. The `--machine` shorthand and `--size` flag don't exist. `gcloud vm` is not a valid subcommand group.
A team wants to receive an email alert when the average CPU utilization of VMs in a managed instance group exceeds 80% for more than 5 minutes. What should they create in Cloud Monitoring?
An alerting policy with a CPU utilization threshold condition
Alerting policies in Cloud Monitoring define threshold conditions on metrics (e.g., CPU utilization > 80% for 5 minutes) and attach notification channels (email, SMS, PagerDuty). Dashboards only visualize data; uptime checks verify endpoint availability; log-based metrics require log entries, not metric data.
A junior developer needs read-only access to all GCP resources in a project. Which IAM role grants the minimum permissions required?
Viewer
The Viewer role grants read access to all project resources without any ability to create, modify, or delete them. Editor includes write permissions. Owner adds billing and IAM management. Browser only provides access to view the project's folder structure — not resource data.
What is the correct order of the Google Cloud resource hierarchy from highest to lowest level?
Organization → Folder → Project → Resources
Google Cloud organizes resources in a strict hierarchy: Organization → Folders → Projects → Resources. Policies set at higher levels are inherited by all resources below them. This design allows centralized governance while delegating control at lower levels.
A compliance archive stores legal documents accessed at most once per quarter. Which Cloud Storage class minimizes storage cost while meeting that access pattern?
Coldline
Coldline storage is designed for data accessed fewer than once every 90 days, with a lower storage price than Standard or Nearline. Archive is cheaper but imposes a 365-day minimum storage duration and high retrieval cost — for quarterly access, Coldline is the better cost fit.
Which gcloud command creates a Compute Engine VM named 'web-01' using the e2-medium machine type in zone us-central1-a?
gcloud compute instances create web-01 --zone=us-central1-a --machine-type=e2-medium
The correct command structure is `gcloud compute instances create [NAME] --zone=[ZONE] --machine-type=[TYPE]`. The `--machine` shorthand and `--size` flag don't exist. `gcloud vm` is not a valid subcommand group.
A team wants to receive an email alert when the average CPU utilization of VMs in a managed instance group exceeds 80% for more than 5 minutes. What should they create in Cloud Monitoring?
An alerting policy with a CPU utilization threshold condition
Alerting policies in Cloud Monitoring define threshold conditions on metrics (e.g., CPU utilization > 80% for 5 minutes) and attach notification channels (email, SMS, PagerDuty). Dashboards only visualize data; uptime checks verify endpoint availability; log-based metrics require log entries, not metric data.
A junior developer needs read-only access to all GCP resources in a project. Which IAM role grants the minimum permissions required?
Viewer
The Viewer role grants read access to all project resources without any ability to create, modify, or delete them. Editor includes write permissions. Owner adds billing and IAM management. Browser only provides access to view the project's folder structure — not resource data.
A startup creates its first Google Cloud project. Before deploying any paid resources, what must be linked to the project?
A billing account
A billing account must be associated with a project before paid GCP services can be provisioned. Without a linked billing account, resource creation is blocked for paid services. An Organization node and Cloud Identity domain are optional for individual or startup use.
A team needs to run a containerized HTTP API that scales to zero when idle and requires zero cluster or server management. Which GCP compute platform is the best fit?
Cloud Run
Cloud Run is a fully managed serverless platform for containerized HTTP services. It scales to zero when there are no requests, charges only for actual request processing, and requires no infrastructure management. GKE Autopilot manages node provisioning but still requires a cluster with minimum costs. App Engine Standard also scales to zero but is less flexible for arbitrary containers.
A developer has a Kubernetes Deployment manifest in a file named 'api-deployment.yaml'. Which command creates the Deployment if it doesn't exist, or updates it if it does?
kubectl apply -f api-deployment.yaml
`kubectl apply -f` is idempotent — it creates the resource if absent and updates it if present. `kubectl create -f` only creates and errors if the resource already exists. `kubectl deploy` is not a valid kubectl command.
A team wants logs from their Python application running on a Compute Engine VM to appear in Cloud Logging. What must be installed on the VM?
Ops Agent (Google Cloud's combined logging and monitoring agent)
The Ops Agent (which replaced the legacy Cloud Logging and Cloud Monitoring agents) must be installed on Compute Engine VMs to collect application and system logs and forward them to Cloud Logging. Without it, logs remain local and invisible to Cloud Logging.
A security review identifies that service account JSON key files are stored on multiple developer laptops, posing a data exfiltration risk. What is the recommended remediation?
Remove the key files and use service account impersonation or Workload Identity for workloads that need GCP access
Long-lived service account key files are one of the highest-risk authentication methods in GCP. The preferred approach is to eliminate keys entirely — use Workload Identity for GKE/Cloud Run, attach service accounts directly to GCE VMs, or use Workload Identity Federation for external workloads. Rotating keys or moving them to Secret Manager reduces distribution risk but doesn't eliminate the key's existence.
Which gcloud CLI command authenticates a developer's local environment with their Google account?
gcloud auth login
The `gcloud auth login` command opens a browser to prompt for Google account credentials and stores an access token locally. This is distinct from `gcloud init`, which also configures default project/region settings as part of a broader setup workflow.
A batch data processing job runs nightly for 4 hours and can tolerate interruption because it saves progress checkpoints every 15 minutes. Which VM option offers the greatest cost reduction?
Spot VM
Spot VMs (formerly Preemptible VMs) offer discounts of up to 91% compared to standard VMs. They can be preempted with a 30-second notice, making them ideal for fault-tolerant workloads that checkpoint progress. Custom machine types optimize resource fit but don't inherently reduce cost as dramatically.
A team wants to deploy a container image at 'gcr.io/myproject/api:v2' as a Cloud Run service named 'api-service' in us-east1, accessible without authentication. Which command is correct?
gcloud run deploy api-service --image=gcr.io/myproject/api:v2 --region=us-east1 --allow-unauthenticated
The Cloud Run deploy command syntax is `gcloud run deploy [SERVICE] --image=[IMAGE] --region=[REGION]`. `--allow-unauthenticated` enables public (unauthenticated) access. `--zone` is a Compute Engine concept, not Cloud Run. `--no-auth` and `--public` are not valid flags.
A security analyst needs to retrieve all Cloud Logging entries with severity ERROR or higher across all resource types in the current project. Which log query correctly filters these entries?
severity >= "ERROR"
In Cloud Logging's query language, `severity >= "ERROR"` matches all entries at ERROR, CRITICAL, ALERT, and EMERGENCY levels. Quotation marks around the severity value are required. The time range is typically set via the console's time picker or `timestamp` filters.
A team wants to allow inbound HTTPS traffic (TCP port 443) from the internet to instances tagged 'web-server', while blocking all other inbound traffic. What firewall configuration achieves this?
An ingress allow rule for port 443 from 0.0.0.0/0 targeting the 'web-server' tag, relying on the implied deny for other traffic
GCP VPCs have an implied deny-all ingress rule at priority 65535. Adding a single ingress allow rule for port 443 from 0.0.0.0/0 targeting the 'web-server' network tag is sufficient — the existing implied deny handles all other traffic. No explicit deny rule is needed.
A developer attempts to create a Cloud SQL instance but receives the error: 'API [sqladmin.googleapis.com] not enabled.' What is the correct resolution?
Enable the Cloud SQL Admin API via APIs & Services > Library in the Console
Most GCP services require their corresponding API to be explicitly enabled per project. The Cloud SQL Admin API must be enabled before any Cloud SQL resources can be created. API enablement is separate from IAM permissions — having the right role is necessary but not sufficient if the API is disabled.
A mobile app needs a managed database to store user profiles with flexible nested structures that evolve frequently — new fields are added without schema migrations. Which GCP database service is most appropriate?
Cloud Firestore
Cloud Firestore is a NoSQL document database that supports flexible, schemaless documents with nested structures. It's well-suited for mobile and web app backends where data models evolve rapidly. Cloud SQL and Spanner are relational databases requiring predefined schemas. Bigtable is a wide-column store optimized for analytics workloads.
A team needs a GKE cluster named 'prod-cluster' in the us-central1 region with cluster autoscaling enabled, scaling between 3 and 10 nodes. Which command achieves this?
gcloud container clusters create prod-cluster --region=us-central1 --num-nodes=3 --enable-autoscaling --min-nodes=3 --max-nodes=10
The correct command is `gcloud container clusters create` with `--enable-autoscaling`, `--min-nodes`, and `--max-nodes`. `kubectl` creates resources within a cluster — it cannot create the cluster itself. `gcloud kubernetes` is not a valid command group.
ACE flashcards by domain
The ACE flashcard bank covers all 5 official blueprint domains published by Google Cloud. Cards are distributed proportionally, so domains with higher exam weight have more cards.
Domain Coverage
Setting up a cloud solution environment
Planning and configuring a cloud solution
Deploying and implementing a cloud solution
Ensuring successful operation of a cloud solution
Configuring access and security
Flashcards vs practice tests: which is better for ACE?
Both flashcards and practice questions are evidence-based study tools. The difference is in what they train:
Flashcards — concept retention
Best for memorising definitions, acronyms, protocol behaviours, command syntax, and conceptual distinctions. Use flashcards to build the foundational vocabulary that ACE questions assume you know.
Best in: weeks 1–3
Practice tests — application
Best for applying concepts to realistic scenarios, eliminating distractors, and building exam stamina.ACE questions test scenario reasoning — not just recall — so practice tests are essential.
Best in: weeks 3–6
The most effective ACE study plan combines both: use flashcards for the first 2–3 weeks to build conceptual foundations, then shift to practice tests and mock exams in the final 2–3 weeks to apply and benchmark that knowledge. Most candidates who pass on their first attempt use both tools.
ACE flashcards — frequently asked questions
Are the ACE flashcards free?
Yes — all ACE flashcards on Courseiva are completely free, no account required. Every card includes the question, correct answer, and a full explanation. Create a free account to track which cards you have studied and get spaced repetition recommendations.
How many ACE flashcards are on Courseiva?
Courseiva has 300+ original ACE flashcards across all 5 exam blueprint domains. New cards are added regularly as the question bank grows. All cards are written by certified engineers against the official Google Cloud exam objectives.
How are Courseiva flashcards different from Anki or Quizlet?
Courseiva flashcards are purpose-built for IT certification exams. Unlike generic flashcard platforms where content quality varies, every Courseiva card is mapped to the official ACE exam blueprint, written by engineers who hold the certification, and includes a full explanation of the correct answer and why the distractors are wrong. This explanation quality is what separates genuine learning from rote memorisation.
Can I use ACE flashcards offline?
Courseiva is a web platform — an internet connection is required. For offline study, we recommend creating free Courseiva account, using the platform in your browser, and using your device's offline capabilities if your browser supports offline web apps.
Track your ACE flashcard progress
Save your results, see which domains need more work, and get spaced repetition recommendations — all free.
Sign Up FreeFree forever · Every certification included