Unit 4 roadmap — Ensuring successful operation of a cloud solution

Every objective below is quoted from Google's Associate Cloud Engineer exam guide, retrieved 2026-09-22. Under each topic is that topic's own summary of what the exam actually tests, taken from its lecture.

Topic 1 — Managing Compute Engine resources

ACE-U4.T1 · 4 objectives · lecture deck of 14 slides

1. Remotely connecting to the instance
2. Viewing current running VM inventory (e.g., instance IDs, details)
3. Working with snapshots (e.g., create a snapshot from a VM, view snapshots, delete a snapshot, schedule a snapshot)
4. Working with images (e.g., create an image from a VM or a snapshot, view images, delete an image)

What this topic actually tests. Which key, and how long? console keys expire; gcloud keys persist; no external IP means IAP. Name or ID? the ID is immutable. Which snapshot survives? standard and archive outlive the disk; instant does not; a deleted schedule's snapshots stay. Snapshot or image? snapshots back up; images build VMs, and a deprecated image drops out of its family.

Topic 2 — Managing Google Kubernetes Engine resources

ACE-U4.T2 · 5 objectives · lecture deck of 15 slides

1. Viewing current running cluster inventory (e.g., nodes, Pods, Services)
2. Configuring Google Kubernetes Engine to access Artifact Registry
3. Working with node pools (e.g., add, edit, or remove a node pool)
4. Working with Kubernetes resources (e.g., Pods, Services, Statefulsets)
5. Managing Horizontal and Vertical autoscaling configurations

What this topic actually tests. gcloud or kubectl? the level of the question decides. Which identity pulls the image? the node's service account. Resize or new pool? count is clusters resize --node-pool; a new configuration is a new pool. Deployment or StatefulSet? interchangeable or not. How many, how big, or how many nodes? HPA, VPA, cluster autoscaler — and never HPA with VPA on CPU or memory.

Topic 3 — Managing Cloud Run resources

ACE-U4.T3 · 3 objectives · lecture deck of 11 slides

1. Deploying new versions of an application
2. Adjusting application traffic splitting parameters
3. Setting scaling parameters for autoscaling instances

What this topic actually tests. A pushed tag is not a deploy — revisions pin a digest. A split outlives the next deploy — --to-latest ends it. --min is warm and billed; --max caps cost and connections. CPU after the response needs instance-based billing — --no-cpu-throttling.

Topic 4 — Managing storage and database solutions

ACE-U4.T4 · 6 objectives · lecture deck of 15 slides

1. Managing and securing objects in Cloud Storage buckets
2. Setting object lifecycle management policies for Cloud Storage buckets
3. Executing queries to retrieve data from data instances (e.g., Cloud SQL, BigQuery, Spanner, Firestore, AlloyDB)
4. Estimating costs of data storage resources
5. Backing up and restoring database instances (e.g., Cloud SQL, Firestore)
6. Reviewing job status (e.g., Dataflow, BigQuery)

What this topic actually tests. A move can be a delete — and early deletion is charged. A lifecycle change is not instant — up to 24 hours. A restore may overwrite — Cloud SQL to itself does; Firestore and point-in-time recovery never do. Stopping a stream — drain keeps buffered data, cancel drops it.

Topic 5 — Managing networking resources

ACE-U4.T5 · 4 objectives · lecture deck of 14 slides

1. Adding a subnet to an existing VPC
2. Expanding a subnet to have more IP addresses
3. Reserving static external or internal IP addresses
4. Working with Cloud DNS and Cloud NAT

What this topic actually tests. Adding a subnet? Name the region; keep the range clear of other subnets, peered networks and — in auto mode — 10.128.0.0/9. Expanding? A smaller prefix length; never shrunk, never undone — expand conservatively. Reserving? Regional unless it fronts a global load balancer; deleting the resource doesn't release it. DNS and NAT? Private zones list their networks; public zones need the registrar's name servers; Cloud NAT lets out outbound connections and their replies, and nothing else in.

Topic 6 — Monitoring and logging

ACE-U4.T6 · 11 objectives · lecture deck of 25 slides

1. Creating Cloud Monitoring alerts based on resource metrics
2. Creating and ingesting Cloud Monitoring custom metrics (e.g., from applications or logs)
3. Exporting logs to external systems (e.g., on-premises, BigQuery)
4. Configuring log buckets, log analytics, and log routers
5. Viewing and filtering logs in Cloud Logging
6. Viewing specific log message details in Cloud Logging
7. Using cloud diagnostics to research an application issue
8. Viewing Google Cloud status
9. Configuring and deploying Ops Agent
10. Deploying Managed Service for Prometheus
11. Configuring audit logs

What this topic actually tests. New metrics and sinks never backfill — only entries from their creation on. Two things are permanent — a bucket's region and its analytics upgrade. OR binds before AND — and lowercase operators are search terms. The Ops Agent reads its file on restart. Data Access audit logs are off — except BigQuery's.