GCP ACE · Domain 3 of 5

GCP ACE Domain 3: Deploying and implementing a cloud solution

This is the largest, most hands-on GCP ACE section. It covers actually deploying resources: Compute Engine instances and managed instance groups, GKE clusters and workloads, Cloud Run and Functions, data products, VPC networking, and infrastructure as code.

Exam format
~25%
Official sections
6
Assessment estimate
12–15
Suggested study time estimate
20–25 hrs

About 11 min read Reviewed October 2026

Overview

Deploying and implementing a cloud solution is the largest and most hands-on GCP ACE section, covering the actual provisioning of resources, mostly through the gcloud and related command lines. It has six areas. Deploying Compute Engine covers launching instances with disks, SSH keys and availability policies, and creating autoscaled managed instance groups from templates, plus OS Login and VM Manager. Deploying GKE covers kubectl, deploying clusters in various configurations such as Autopilot, regional and private, and deploying containerized applications. Deploying Cloud Run and Functions covers deploying applications and event-driven handlers. Deploying data solutions covers provisioning data products and loading data. Deploying networking covers creating VPCs with subnets, firewall rules and peering. Implementing infrastructure as code covers Terraform, Config Connector, the Cloud Foundation Toolkit and Helm.

At about 25%, this is the single heaviest section, and it is overwhelmingly practical. The exam rewards knowing the commands and configurations to deploy each resource type correctly.

How it's tested

GCP ACE questions in this section show or ask for the commands and configuration to deploy a resource, and reward the correct deployment approach. GCP ACE questions are practical and scenario-based, often involving a gcloud command, so read the requirement and choose the service or action it points to before answering.

  • Deploy the compute

    A compute deployment is described, and you choose the instance, managed instance group or GKE configuration.

  • Deploy networking

    A networking need is described, and you create the VPC, subnet, firewall rule or peering.

  • Infrastructure as code

    A repeatable-deployment need is described, and you choose Terraform or another IaC tool.

Reasoning it through

A web tier must run multiple identical VMs that scale automatically with load and recover failed instances. Launching individual VMs does not autoscale or self-heal. Creating a managed instance group from an instance template provides autoscaling and automatic recreation of failed instances, which matches the requirement, so a managed instance group with a template is the deployment approach the exam expects.

Sections 6

Official sections from the Google Cloud outline, in outline order.

3.1 Deploying and implementing Compute Engine resourcesLaunching instances, managed instance groups, OS Login and VM Manager.
What it means
This covers launching a compute instance with disks, availability policy and SSH keys, creating an autoscaled managed instance group from an instance template, configuring OS Login for SSH access management, and configuring VM Manager for patch and configuration management.
What to understand
A managed instance group runs identical VMs from a template, with autoscaling and automatic recreation of failed instances. OS Login ties SSH access to IAM identities. VM Manager handles patching and configuration. Instance templates make deployments repeatable.
How it shows up
A compute deployment is described, and you must choose the instance, managed instance group or access configuration.
Common confusion
Confusing a managed instance group with individual instances; the group provides autoscaling and self-healing that standalone VMs do not.
3.2 Deploying and implementing Google Kubernetes Engine resourceskubectl, cluster configurations, and deploying containerized applications.
What it means
This covers installing and configuring kubectl, deploying a GKE cluster in different configurations such as Autopilot, regional, private and GKE Enterprise, and deploying a containerized application to GKE.
What to understand
GKE runs containers on managed Kubernetes. Autopilot manages nodes for you, regional clusters spread across zones, and private clusters have no public node IPs. kubectl is the command line for Kubernetes. Deploying an application uses manifests or commands. The cluster configuration matches the operational and availability needs.
How it shows up
A GKE deployment is described, and you must choose the cluster configuration or the deployment command.
Common confusion
Confusing Autopilot with Standard GKE; Autopilot manages nodes automatically, while Standard gives node-level control.
3.3 Deploying and implementing Cloud Run and Cloud Functions resourcesDeploying applications and event-driven handlers.
What it means
This covers deploying an application to Cloud Run or Cloud Functions, deploying an application that receives Google Cloud events such as Pub/Sub messages, Cloud Storage change notifications or Eventarc events, and determining where to deploy using Cloud Run or Cloud Functions.
What to understand
Cloud Run deploys containers and Cloud Functions deploys functions, both serverless. They can be triggered by events from Pub/Sub, Cloud Storage or Eventarc. The choice depends on whether the unit is a container or a function and the trigger model.
How it shows up
A serverless deployment or event-handling need is described, and you must choose Cloud Run or Cloud Functions and the trigger.
Common confusion
Confusing where to deploy; Cloud Run suits containers, while Cloud Functions suits discrete event-driven functions.
3.4 Deploying and implementing data solutionsDeploying data products and loading data.
What it means
This covers deploying data products such as Cloud SQL, Firestore, BigQuery, Spanner, Pub/Sub, Dataflow, Cloud Storage and AlloyDB, and loading data via command line upload, from Cloud Storage, or with the Storage Transfer Service.
What to understand
Deploying a data product provisions the managed service, and data is loaded through uploads, from Cloud Storage, or with transfer services. The choice of product follows the planning decisions, and loading uses the appropriate tool for the source and volume.
How it shows up
A data deployment or loading need is described, and you must choose the product and loading method.
Common confusion
Confusing data loading methods; command-line upload suits small data, while Storage Transfer Service suits large or scheduled transfers.
3.5 Deploying and implementing networking resourcesVPCs with subnets, firewall rules, and peering.
What it means
This covers creating a VPC with subnets such as custom mode VPC and Shared VPC, creating ingress and egress firewall rules and policies using IP subnets, network tags and service accounts, and peering external networks with Cloud VPN and VPC Network Peering.
What to understand
A VPC is a global virtual network with regional subnets. Firewall rules allow or deny traffic and can target by IP range, network tag or service account. Shared VPC shares a network across projects. Cloud VPN and VPC Network Peering connect networks. The configuration matches the connectivity and isolation needs.
How it shows up
A networking deployment is described, and you must create the VPC, subnet, firewall rule or peering.
Common confusion
Confusing VPC Network Peering with Cloud VPN; peering connects VPCs privately, while Cloud VPN connects over an encrypted tunnel, often to on-premises.
3.6 Implementing resources through infrastructure as codeTerraform, Config Connector, the Cloud Foundation Toolkit and Helm.
What it means
This covers infrastructure as code tooling, including Terraform, Config Connector, the Cloud Foundation Toolkit and Helm, to deploy resources repeatably and consistently.
What to understand
Terraform is the main infrastructure-as-code tool for Google Cloud, declaring resources in configuration files. Config Connector manages Google Cloud resources through Kubernetes, the Cloud Foundation Toolkit provides reference templates, and Helm packages Kubernetes applications. These make deployments repeatable and version-controlled.
How it shows up
A repeatable-deployment need is described, and you must choose the infrastructure-as-code tool.
Common confusion
Confusing Terraform with Helm; Terraform provisions cloud infrastructure, while Helm packages and deploys Kubernetes applications.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Managed instance group

    Identical VMs from a template with autoscaling and self-healing.

    Remember
    It autoscales and recreates failed VMs.
    Tested as
    Compute questions.
    Trap
    Using standalone VMs instead.

  • Instance template

    A reusable VM definition.

    Remember
    It makes deployments repeatable.
    Tested as
    Compute questions.
    Trap
    Hand-configuring each VM.

  • OS Login

    Ties SSH access to IAM identities.

    Remember
    It centralizes SSH access.
    Tested as
    Access questions.
    Trap
    Managing SSH keys manually.

  • GKE Autopilot vs. Standard

    Node-managed versus node-controlled Kubernetes.

    Remember
    Autopilot manages nodes automatically.
    Tested as
    GKE questions.
    Trap
    Confusing the two modes.

  • kubectl

    The Kubernetes command line.

    Remember
    It manages GKE workloads.
    Tested as
    GKE questions.
    Trap
    Managing GKE without kubectl.

  • Private and regional clusters

    No public node IPs, and multi-zone spread.

    Remember
    For isolation and availability.
    Tested as
    GKE questions.
    Trap
    Confusing the configurations.

  • Cloud Run and event triggers

    Serverless containers triggered by events.

    Remember
    Pub/Sub, Storage and Eventarc can trigger it.
    Tested as
    Serverless questions.
    Trap
    Expecting only HTTP triggers.

  • VPC and subnets

    A global network with regional subnets.

    Remember
    Subnets are regional.
    Tested as
    Networking questions.
    Trap
    Treating a VPC as regional.

  • Firewall rules

    Allow or deny traffic by IP, tag or service account.

    Remember
    Target rules precisely.
    Tested as
    Networking questions.
    Trap
    Using overly broad rules.

  • VPC Peering vs. Cloud VPN

    Private VPC-to-VPC versus encrypted tunnel.

    Remember
    Peering is private; VPN is encrypted over a tunnel.
    Tested as
    Networking questions.
    Trap
    Confusing the two.

  • Terraform

    Infrastructure as code for Google Cloud.

    Remember
    Declarative, repeatable deployment.
    Tested as
    IaC questions.
    Trap
    Confusing it with Helm.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Managed instance group vs. individual instances

ConceptMeaningKey differenceCommon trap
Managed instance group Identical VMs from a template Autoscaling and self-healing Using standalone VMs
Individual instances Single VMs No autoscaling or self-healing Expecting group features

GKE Autopilot vs. Standard

ConceptMeaningKey differenceCommon trap
Autopilot Google manages nodes Less operational overhead Expecting node control
Standard You manage nodes Full node control Managing nodes unnecessarily

VPC Peering vs. Cloud VPN vs. Terraform/Helm

ConceptMeaningKey differenceCommon trap
VPC Network Peering Private VPC-to-VPC No tunnel, private Confusing with VPN
Cloud VPN Encrypted tunnel Often to on-premises Confusing with peering
Terraform vs. Helm IaC for cloud vs. Kubernetes apps Provision vs. package Confusing the two tools

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Standalone VMs for scaling

    What candidates pick
    Launch individual VMs for a tier that must autoscale and self-heal.
    Why it looks right
    VMs are quick to launch.
    Why it's wrong
    A managed instance group from a template autoscales and recreates failed instances.

    Clue to watch for The tier must scale automatically and recover from failures.

  2. Autopilot needs node control

    What candidates pick
    Choose GKE Autopilot when the team needs to configure nodes directly.
    Why it looks right
    Autopilot is simpler.
    Why it's wrong
    Autopilot manages nodes for you; Standard mode is needed for node-level control.

    Clue to watch for The team must control node configuration.

  3. VPN for VPC-to-VPC

    What candidates pick
    Use Cloud VPN to connect two VPCs privately within Google Cloud.
    Why it looks right
    VPN connects networks.
    Why it's wrong
    VPC Network Peering connects VPCs privately without a tunnel; Cloud VPN is an encrypted tunnel, often to on-premises.

    Clue to watch for Two Google Cloud VPCs must connect privately.

  4. Helm provisions cloud

    What candidates pick
    Use Helm to provision Google Cloud infrastructure such as VPCs and VMs.
    Why it looks right
    Both are deployment tools.
    Why it's wrong
    Terraform provisions cloud infrastructure; Helm packages and deploys Kubernetes applications.

    Clue to watch for The task is provisioning cloud resources versus deploying a Kubernetes app.

  5. Broad firewall rule

    What candidates pick
    Allow all traffic to simplify a firewall configuration.
    Why it looks right
    It avoids connectivity issues.
    Why it's wrong
    Firewall rules should target precisely by IP range, network tag or service account for least exposure.

    Clue to watch for Access should be limited to specific sources or targets.

Answer framework

For any Section 3 scenario, use these steps to find the answer the exam expects.

  1. Identify what is being deployed: compute, GKE, serverless, data, networking or infrastructure as code.
  2. For compute, use a managed instance group from a template for autoscaling and self-healing, and configure OS Login and VM Manager as needed.
  3. For GKE, choose the cluster mode and configuration, and deploy applications with kubectl or manifests.
  4. For networking, create the VPC and subnets, target firewall rules precisely by IP, tag or service account, and choose peering or Cloud VPN for connectivity.
  5. For repeatable deployment, use Terraform or the right infrastructure-as-code tool, and verify each deployment with the appropriate command line. Where several options could fit, choose the one the requirements make defensible, often confirmable with the matching gcloud command.

Practice question

A web tier must run several identical virtual machines that automatically scale with demand and have failed instances recreated without manual intervention. Which deployment approach should be used?

Want more like this? The GCP ACE practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

This is the largest and most hands-on section, so spend the most time in a free-tier account and Cloud Shell actually deploying resources, since the exam heavily tests the command line. Start with Compute Engine: launch instances and, importantly, create managed instance groups from templates for autoscaling and self-healing.

Then practice GKE: create clusters in Autopilot and Standard modes and deploy applications with kubectl. Learn Cloud Run and Functions deployment and event triggers. For networking, practice creating VPCs, subnets and precisely targeted firewall rules, and connecting networks with peering versus Cloud VPN. Finally, use Terraform to deploy resources repeatably.

Because the exam shows and asks for commands, memorizing the common gcloud and kubectl commands and practicing them is essential. Because GCP ACE is hands-on and heavily tests the gcloud command line, practice every task in a free-tier account and the Cloud Shell rather than only reading, and review missed practice questions by section to find weak spots. Afterwards, move to Section 4, ensuring successful operation, which manages what you deploy here.

FAQ

How much of the GCP ACE exam is Section 3?

Deploying and implementing a cloud solution is about 25% of the exam, the single largest and most hands-on section.

What is a managed instance group?

A group of identical VMs created from an instance template that provides autoscaling and automatically recreates failed instances, unlike standalone VMs.

What is the difference between GKE Autopilot and Standard?

Autopilot manages the cluster's nodes for you with less operational overhead. Standard mode gives you control over node configuration and node pools.

What is the difference between VPC Network Peering and Cloud VPN?

VPC Network Peering connects two VPCs privately within Google Cloud without a tunnel. Cloud VPN connects networks over an encrypted tunnel, often to on-premises.

How do firewall rules target traffic?

By IP range, network tag or service account, allowing or denying ingress and egress precisely rather than broadly.

What is Terraform used for on the exam?

Infrastructure as code: declaring Google Cloud resources in configuration files to deploy them repeatably and consistently, distinct from Helm, which packages Kubernetes applications.

How does Section 3 connect to the rest of the exam?

It deploys the products planned in Section 2, within the environment of Section 1, and the resources it creates are operated in Section 4 and secured in Section 5.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 3 knowledge

You have covered deploying compute, GKE, serverless, data, networking and infrastructure as code. Test whether you can choose the right deployment approach under exam conditions.

Take the GCP ACE practice test Check your GCP ACE readiness

Keep going