Unit 3 roadmap — Deploying and implementing a cloud solution

Every objective below is quoted from Google's Associate Cloud Engineer exam guide, retrieved 2026-09-22. Under each topic is that topic's own summary of what the exam actually tests, taken from its lecture.

Topic 1 — Deploying and implementing Compute Engine resources

ACE-U3.T1 · 4 objectives · lecture deck of 15 slides

1. Launching a compute instance (e.g., assign disks, availability policy, SSH keys)
2. Creating an autoscaled managed instance group by using an instance template
3. Configuring OS Login
4. Configuring VM Manager

What this topic actually tests. Disks: attach, then format and mount. Availability: the host maintenance policy — live migrate by default. MIGs: templates can't be edited; disks are recreated with their VM. OS Login: metadata keys stop working; sudo needs osAdminLogin. VM Manager: API, agent and metadata — the org policy only reaches new VMs.

Topic 2 — Deploying and implementing Google Kubernetes Engine resources

ACE-U3.T2 · 3 objectives · lecture deck of 12 slides

1. Installing and configuring the command line interface (CLI) for Kubernetes (kubectl)
2. Deploying a Google Kubernetes Engine cluster with different configurations (e.g., Autopilot, regional clusters, private clusters, GKE Enterprise)
3. Deploying a containerized application to Google Kubernetes Engine

What this topic actually tests. Does this machine's kubeconfig know the cluster? if not, get-credentials. Can the setting change later? zonal and regional cannot. Who can reach the app? ClusterIP by default — --type LoadBalancer for the internet.

Topic 3 — Deploying and implementing Cloud Run and Cloud Functions resources

ACE-U3.T3 · 3 objectives · lecture deck of 12 slides

1. Deploying an application
2. Deploying an application for receiving Google Cloud events (e.g., Pub/Sub events, Cloud Storage object change notification events, Eventarc)
3. Determining where to deploy an application by using Cloud Run (fully managed), Cloud Run for Anthos, or Cloud Functions

What this topic actually tests. Image or source? --image if you built it, --source if you want Cloud Build to. Deploy or serve? Revisions are created on every change; traffic moves only when you say so. Which identity? The deployer, the service, the trigger — each a separate service account. Which name? Cloud Run for Anthos is Knative serving; Cloud Functions is Cloud Run functions.

Topic 4 — Deploying and implementing data solutions

ACE-U3.T4 · 2 objectives · lecture deck of 10 slides

1. Deploying data products (e.g., Cloud SQL, Firestore, BigQuery, Spanner, Pub/Sub, Dataflow, Cloud Storage, AlloyDB)
2. Loading data (e.g., command line upload, load data from Cloud Storage, Storage Transfer Service)

What this topic actually tests. What is fixed at creation? a dataset's location, a Spanner configuration's edition requirement, a bucket's hierarchical namespace. What must exist first? a subscription before a Dataflow job reads it; an AlloyDB cluster before its primary. Whose permission, and which location? you upload; the Cloud SQL instance's service account imports; the bucket and dataset share a location.

Topic 5 — Deploying and implementing networking resources

ACE-U3.T5 · 3 objectives · lecture deck of 14 slides

1. Creating a VPC with subnets (e.g., custom mode VPC, Shared VPC)
2. Creating ingress and egress firewall rules and policies (e.g., IP subnets, network tags, service accounts)
3. Peering external networks (e.g., Cloud VPN, VPC Network Peering)

What this topic actually tests. Is there a subnet in that region? The network is global; subnets are regional, and custom mode creates none for you. Which rule wins? Lowest priority number; with no rule, ingress is denied and egress allowed. What kind of network is on the other side? A VPC network is peered — both sides, no overlap, not transitive; anything else connects over Cloud VPN.

Topic 6 — Implementing resources through infrastructure as code

ACE-U3.T6 · 1 objective · lecture deck of 8 slides

1. Infrastructure as code tooling (e.g., Cloud Foundation Toolkit, Config Connector, Terraform, Helm)

What this topic actually tests. Which tool? Terraform by default; blueprints for a ready-made start; Config Connector if you live in Kubernetes; Helm to package apps, not cloud resources. Which command? init prepares, plan shows, apply changes, destroy removes. Where is the state? In a shared Cloud Storage backend — never one file per laptop.