GCP ACE · Domain 4 of 5

GCP ACE Domain 4: Ensuring successful operation of a cloud solution

This section covers operating deployed resources: managing Compute Engine, GKE and Cloud Run, managing storage and databases, managing networking, and monitoring and logging with Cloud Monitoring and Cloud Logging.

Exam format
~20%
Official sections
6
Assessment estimate
10–12
Suggested study time estimate
15–20 hrs

About 12 min read Reviewed October 2026

Overview

Ensuring successful operation of a cloud solution covers the day-to-day management of deployed resources. It has six areas. Managing Compute Engine covers connecting to instances, viewing inventory, and working with snapshots and images. Managing GKE covers viewing cluster inventory, accessing Artifact Registry, working with node pools and Kubernetes resources, and autoscaling. Managing Cloud Run covers deploying new versions, traffic splitting and scaling parameters. Managing storage and databases covers securing objects, lifecycle policies, running queries, estimating costs, backing up and restoring, and reviewing job status. Managing networking covers subnets, IP addresses, Cloud DNS and Cloud NAT. Monitoring and logging covers Cloud Monitoring alerts and custom metrics, Cloud Logging, log exports and routers, cloud diagnostics, the Ops Agent, Managed Service for Prometheus, and audit logs.

At about 20%, this section is heavily hands-on and operations-focused. The exam rewards knowing how to manage, scale, back up and observe running resources.

How it's tested

GCP ACE questions in this section describe a management, scaling, backup or monitoring need and ask how to perform it, often via a command. GCP ACE questions are practical and scenario-based, often involving a gcloud command, so read the requirement and choose the service or action it points to before answering.

  • Manage the resource

    A management task is described, and you choose the snapshot, image, node pool or traffic-splitting action.

  • Protect the data

    A backup or lifecycle need is described, and you choose snapshots, backups or Cloud Storage lifecycle policies.

  • Monitor and log

    An observability need is described, and you choose Cloud Monitoring alerts, custom metrics or log routing.

Reasoning it through

A team must release a new version of a Cloud Run service to a small percentage of users first and shift the rest gradually. Deploying straight to all traffic is risky. Cloud Run supports deploying a new revision and splitting traffic between revisions by percentage, so the team routes a small share to the new revision, monitors it, then increases it, which is the gradual-release operation the exam expects.

Sections 6

Official sections from the Google Cloud outline, in outline order.

4.1 Managing Compute Engine resourcesConnecting to instances, viewing inventory, and snapshots and images.
What it means
This covers remotely connecting to an instance, viewing running VM inventory such as instance IDs and details, and working with snapshots (create, view, delete and schedule) and images (create from a VM or snapshot, view and delete).
What to understand
Snapshots are point-in-time backups of disks, used for backup and creating new disks, and can be scheduled. Images are used to create new VMs with a preconfigured state. Connecting uses SSH, often via OS Login. Viewing inventory is a routine operational task.
How it shows up
A Compute Engine management task is described, and you must choose the snapshot, image or connection action.
Common confusion
Confusing snapshots with images; snapshots back up disks for recovery, while images are templates for creating new VMs.
4.2 Managing Google Kubernetes Engine resourcesViewing inventory, Artifact Registry access, node pools, Kubernetes resources and autoscaling.
What it means
This covers viewing cluster inventory such as nodes, Pods and Services, configuring GKE to access Artifact Registry, working with node pools (add, edit, remove), working with Kubernetes resources such as Pods, Services and StatefulSets, and managing horizontal and vertical autoscaling.
What to understand
Node pools group nodes with the same configuration and can be scaled or added. Horizontal autoscaling adds Pods or nodes, while vertical autoscaling adjusts resource requests. Artifact Registry stores container images that GKE pulls. kubectl views and manages Kubernetes resources.
How it shows up
A GKE management or scaling task is described, and you must choose the node pool, Kubernetes resource or autoscaling action.
Common confusion
Confusing horizontal with vertical autoscaling; horizontal adds instances, while vertical adjusts the resources of existing ones.
4.3 Managing Cloud Run resourcesDeploying new versions, traffic splitting and scaling parameters.
What it means
This covers deploying new versions of an application as revisions, adjusting application traffic splitting between revisions, and setting scaling parameters for autoscaling instances such as minimum and maximum instances and concurrency.
What to understand
Cloud Run uses revisions, and traffic can be split between them by percentage for gradual rollout and rollback. Scaling parameters control how instances scale, including minimum instances to reduce cold starts and maximum to cap cost. These enable safe releases and controlled scaling.
How it shows up
A Cloud Run release or scaling need is described, and you must choose the revision, traffic-splitting or scaling action.
Common confusion
Expecting a new Cloud Run deployment to receive all traffic automatically; traffic splitting controls how much each revision receives.
4.4 Managing storage and database solutionsSecuring objects, lifecycle policies, queries, cost estimation, backups and job status.
What it means
This covers managing and securing objects in Cloud Storage buckets, setting object lifecycle management policies, executing queries against data instances such as Cloud SQL, BigQuery, Spanner, Firestore and AlloyDB, estimating storage costs, backing up and restoring database instances, and reviewing job status such as Dataflow and BigQuery jobs.
What to understand
Lifecycle policies automatically transition or delete objects by age or conditions. Backups protect databases and can be restored. Queries retrieve data from the managed databases. Securing objects uses IAM and access controls. Reviewing job status tracks data processing. These are routine data operations.
How it shows up
A storage or database management task is described, and you must choose the lifecycle policy, backup, query or security action.
Common confusion
Confusing lifecycle policies with manual deletion; lifecycle policies automate transitions and deletion by rules.
4.5 Managing networking resourcesSubnets, IP addresses, Cloud DNS and Cloud NAT.
What it means
This covers adding a subnet to an existing VPC, expanding a subnet to have more IP addresses, reserving static external or internal IP addresses, and working with Cloud DNS and Cloud NAT.
What to understand
Subnets can be added to a VPC and expanded for more addresses. Static IPs are reserved so they do not change. Cloud DNS provides managed name resolution, and Cloud NAT gives private instances outbound internet access without external IPs. These are routine network operations.
How it shows up
A networking management task is described, and you must choose the subnet, IP, Cloud DNS or Cloud NAT action.
Common confusion
Confusing Cloud NAT with a load balancer; Cloud NAT provides outbound internet access for private instances, not inbound traffic distribution.
4.6 Monitoring and loggingCloud Monitoring alerts and metrics, Cloud Logging, log routing, the Ops Agent and audit logs.
What it means
This covers creating Cloud Monitoring alerts on resource metrics, creating and ingesting custom metrics, exporting logs to external systems, configuring log buckets, log analytics and log routers, viewing and filtering logs in Cloud Logging, using cloud diagnostics, viewing Google Cloud status, configuring and deploying the Ops Agent, deploying Managed Service for Prometheus, and configuring audit logs.
What to understand
Cloud Monitoring collects metrics and fires alerts, Cloud Logging stores and queries logs, and log routers export or route logs to destinations such as BigQuery. The Ops Agent collects metrics and logs from VMs. Audit logs record admin and data activity. These provide observability of the solution.
How it shows up
An observability need is described, and you must choose the Cloud Monitoring, Cloud Logging, Ops Agent or audit-log action.
Common confusion
Confusing metrics with logs; Cloud Monitoring handles metrics and alerts, while Cloud Logging stores and queries log data.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Snapshots vs. images

    Disk backups versus VM templates.

    Remember
    Snapshots recover disks; images create VMs.
    Tested as
    Compute questions.
    Trap
    Confusing the two.

  • Scheduled snapshots

    Automatic periodic disk backups.

    Remember
    They automate backup.
    Tested as
    Backup questions.
    Trap
    Taking snapshots manually only.

  • Node pools

    Groups of GKE nodes with the same config.

    Remember
    Scale or add node pools.
    Tested as
    GKE questions.
    Trap
    Confusing with Pods.

  • Horizontal vs. vertical autoscaling

    Adding instances versus adjusting resources.

    Remember
    Horizontal adds; vertical resizes.
    Tested as
    GKE questions.
    Trap
    Confusing the two.

  • Cloud Run revisions and traffic splitting

    Versioned deployments with percentage traffic.

    Remember
    Split traffic for gradual rollout.
    Tested as
    Cloud Run questions.
    Trap
    Expecting all traffic automatically.

  • Cloud Storage lifecycle policies

    Automatic transition or deletion by rules.

    Remember
    Automate tiering and cleanup.
    Tested as
    Storage questions.
    Trap
    Managing objects manually.

  • Database backup and restore

    Protecting and recovering databases.

    Remember
    Back up and restore managed databases.
    Tested as
    Database questions.
    Trap
    Not backing up.

  • Static IP addresses

    Reserved IPs that do not change.

    Remember
    For stable addressing.
    Tested as
    Networking questions.
    Trap
    Relying on ephemeral IPs.

  • Cloud NAT

    Outbound internet for private instances.

    Remember
    No external IPs needed.
    Tested as
    Networking questions.
    Trap
    Confusing it with a load balancer.

  • Cloud Monitoring alerts

    Fire on resource metric thresholds.

    Remember
    They warn of issues.
    Tested as
    Monitoring questions.
    Trap
    Not alerting on key metrics.

  • Cloud Logging and log routers

    Store, query and route logs.

    Remember
    Export logs to BigQuery or elsewhere.
    Tested as
    Logging questions.
    Trap
    Confusing logs with metrics.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Snapshots vs. images

ConceptMeaningKey differenceCommon trap
Snapshots Point-in-time disk backups Recover or clone disks Confusing with images
Images Templates for new VMs Create preconfigured VMs Confusing with snapshots

Horizontal vs. vertical autoscaling

ConceptMeaningKey differenceCommon trap
Horizontal Add Pods or nodes Scale out Confusing with vertical
Vertical Adjust resource requests Resize existing Confusing with horizontal

Cloud Monitoring vs. Cloud Logging

ConceptMeaningKey differenceCommon trap
Cloud Monitoring Metrics and alerts Numeric signals Confusing with logging
Cloud Logging Log storage and queries Detailed records Confusing with metrics

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Image for backup

    What candidates pick
    Use a machine image to back up a disk for recovery.
    Why it looks right
    Both capture a VM state.
    Why it's wrong
    Snapshots are point-in-time disk backups for recovery; images are templates for creating new VMs.

    Clue to watch for The need is to back up and restore a disk.

  2. All traffic to new revision

    What candidates pick
    Expect a new Cloud Run deployment to immediately receive all traffic.
    Why it looks right
    It is the newest revision.
    Why it's wrong
    Cloud Run can split traffic between revisions by percentage, so a gradual rollout controls how much the new revision gets.

    Clue to watch for The release should go to a small share of users first.

  3. Vertical for more instances

    What candidates pick
    Use vertical autoscaling to add more Pods under load.
    Why it looks right
    Both are autoscaling.
    Why it's wrong
    Horizontal autoscaling adds Pods or nodes; vertical adjusts the resources of existing ones.

    Clue to watch for The need is more instances to handle load.

  4. Manual object cleanup

    What candidates pick
    Delete old Cloud Storage objects manually on a schedule.
    Why it looks right
    It is direct.
    Why it's wrong
    Object lifecycle management policies automate transition and deletion by age or rules.

    Clue to watch for Objects should be transitioned or deleted automatically over time.

  5. NAT for inbound

    What candidates pick
    Use Cloud NAT to distribute inbound traffic to private instances.
    Why it looks right
    NAT handles traffic.
    Why it's wrong
    Cloud NAT provides outbound internet access for private instances; inbound distribution uses a load balancer.

    Clue to watch for The need is outbound access versus inbound distribution.

Answer framework

For any Section 4 scenario, use these steps to find the answer the exam expects.

  1. Identify whether the task is managing compute, GKE, Cloud Run, storage and databases, networking, or monitoring.
  2. For compute and GKE, use snapshots and images correctly, manage node pools, and choose horizontal or vertical autoscaling to match the scaling need.
  3. For Cloud Run, deploy revisions and split traffic for gradual rollout, and set scaling parameters.
  4. For data, automate with Cloud Storage lifecycle policies, back up and restore databases, and run queries and review job status.
  5. For observability, create Cloud Monitoring alerts and custom metrics, and use Cloud Logging with log routers, the Ops Agent and audit logs. Where several options could fit, choose the one the requirements make defensible, often confirmable with the matching gcloud command.

Practice question

A team wants to release a new revision of a Cloud Run service to 10 percent of users first, monitor it, and then gradually shift the remaining traffic to it. How should they do this?

Want more like this? The GCP ACE practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

This section is hands-on and broad, so practice the management tasks across each resource type in a free-tier account. Start with Compute Engine, keeping snapshots (disk backups) and images (VM templates) distinct, and practice scheduling snapshots. Then practice GKE operations: node pools and the horizontal-versus-vertical autoscaling distinction.

Learn Cloud Run revision deployment and traffic splitting for gradual rollout, and the data operations of Cloud Storage lifecycle policies, database backup and restore, and querying. For networking, practice adding subnets, reserving static IPs, and Cloud DNS and Cloud NAT. Finally, master observability: Cloud Monitoring alerts and custom metrics, Cloud Logging and log routers, the Ops Agent and audit logs, keeping metrics and logs distinct.

Because the exam tests doing, use the command line for these tasks. Because GCP ACE is hands-on and heavily tests the gcloud command line, practice every task in a free-tier account and the Cloud Shell rather than only reading, and review missed practice questions by section to find weak spots. Afterwards, move to Section 5, configuring access and security.

FAQ

How much of the GCP ACE exam is Section 4?

Ensuring successful operation of a cloud solution is about 20% of the exam, covering the management and observability of deployed resources.

What is the difference between a snapshot and an image?

A snapshot is a point-in-time backup of a disk, used for recovery or cloning. An image is a template used to create new VMs with a preconfigured state.

What is the difference between horizontal and vertical autoscaling?

Horizontal autoscaling adds more Pods or nodes to handle load. Vertical autoscaling adjusts the CPU and memory requests of existing workloads.

How does Cloud Run traffic splitting work?

Cloud Run keeps revisions and lets you assign a percentage of traffic to each, so you can roll out a new revision gradually and roll back by shifting traffic back.

What do Cloud Storage lifecycle policies do?

They automatically transition objects to cheaper classes or delete them based on rules such as object age, removing the need for manual cleanup.

What is the difference between Cloud Monitoring and Cloud Logging?

Cloud Monitoring collects metrics and fires alerts on thresholds. Cloud Logging stores and queries detailed log records, and can route or export them.

How does Section 4 connect to the rest of the exam?

It operates and observes the resources deployed in Section 3, which were planned in Section 2 and set up in Section 1, and it works within the access controls of Section 5.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 4 knowledge

You have covered managing compute, GKE, Cloud Run, storage, networking and observability. Test whether you can perform the right operation under exam conditions.

Take the GCP ACE practice test Check your GCP ACE readiness

Keep going