GCP ACE · Domain 1 of 5

GCP ACE Domain 1: Setting up a cloud solution environment

This section covers setting up the Google Cloud foundation: creating the resource hierarchy, applying organization policies, granting IAM roles, managing Cloud Identity, enabling APIs and quotas, and configuring billing accounts, budgets and exports.

Exam format
~20%
Official sections
2
Assessment estimate
10–12
Suggested study time estimate
15–20 hrs

About 10 min read Reviewed October 2026

Overview

Setting up a cloud solution environment establishes the foundation every other Google Cloud task depends on. It has two areas. Setting up projects and accounts covers creating the resource hierarchy of organization, folders and projects, applying organization policies to that hierarchy, granting IAM roles within a project, managing users and groups in Cloud Identity, enabling APIs, provisioning Google Cloud Observability, and assessing and requesting quota increases. Managing billing covers creating billing accounts, linking projects to them, establishing billing budgets and alerts, and setting up billing exports.

At about 20%, this section tests practical environment setup, often through the gcloud command line that the exam emphasizes throughout. The exam rewards understanding the resource hierarchy and how policies and IAM inherit down it, how projects attach to billing accounts, and how to control cost with budgets and alerts. These foundations recur across every later section.

How it's tested

GCP ACE questions are scenario-based and practical, often showing or asking for a gcloud command or the correct console action. In this section they describe a setup, access, quota or billing need and reward the right hierarchy, IAM, Cloud Identity or billing action. Read the scenario for the specific setup task.

  • Hierarchy and policy

    A governance or scope need is described, and you choose where in the organization, folder or project hierarchy to apply a policy or role.

  • Grant access correctly

    An access need is described, and you choose the IAM role and the level at which to grant it, or manage Cloud Identity.

  • Control billing

    A cost or billing need is described, and you choose billing accounts, budgets, alerts or exports.

Reasoning it through

An administrator must apply a constraint, such as restricting resource locations, to every current and future project in the organization without configuring each project. Applying the policy to each project individually does not cover future ones. Applying an organization policy at the organization node means it inherits down to all folders and projects, including those created later, which is the hierarchy-based approach the exam expects.

Sections 2

Official sections from the Google Cloud outline, in outline order.

1.1 Setting up cloud projects and accountsResource hierarchy, organization policies, IAM roles, Cloud Identity, APIs and quotas.
What it means
This covers creating the resource hierarchy of organization, folders and projects, applying organization policies to the hierarchy, granting IAM roles within a project, managing users and groups in Cloud Identity manually and automatically, enabling APIs within projects, provisioning Google Cloud Observability, and assessing quotas and requesting increases.
What to understand
The resource hierarchy nests from the organization through folders to projects to resources, and organization policies and IAM roles applied higher up inherit downward. Projects are the basic unit for enabling APIs and grouping resources. Cloud Identity manages users and groups. Quotas limit resource usage and can be raised by request.
How it shows up
A setup, governance or access need is described, and you must choose the hierarchy level, policy, IAM role or Cloud Identity action.
Common confusion
Confusing organization policies with IAM; organization policies constrain configuration across the hierarchy, while IAM grants permissions to members.
1.2 Managing billing configurationBilling accounts, linking projects, budgets, alerts and exports.
What it means
This covers creating one or more billing accounts, linking projects to a billing account, establishing billing budgets and alerts, and setting up billing exports to BigQuery or other destinations for analysis.
What to understand
A billing account pays for the resources used by the projects linked to it, and a project must be linked to a billing account to use paid resources. Budgets with alerts warn when spend approaches a threshold, and billing exports send detailed billing data to BigQuery for analysis. One billing account can fund many projects.
How it shows up
A billing or cost-control need is described, and you must choose billing account linking, budgets, alerts or exports.
Common confusion
Confusing a billing account with a project; a billing account pays for resources, while a project groups and runs them.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Resource hierarchy

    Organization, folders, projects and resources, nested top to bottom.

    Remember
    Policies and IAM inherit downward.
    Tested as
    Governance questions.
    Trap
    Applying a control at the wrong level.

  • Organization policies

    Constraints applied across the hierarchy.

    Remember
    They govern configuration, not permissions.
    Tested as
    Governance questions.
    Trap
    Confusing them with IAM.

  • Projects

    The basic unit for grouping resources and enabling APIs.

    Remember
    Resources belong to a project.
    Tested as
    Setup questions.
    Trap
    Confusing a project with a billing account.

  • IAM roles

    Basic, predefined and custom roles granting permissions to members.

    Remember
    Grant least privilege at the right level.
    Tested as
    Access questions.
    Trap
    Using broad basic roles.

  • IAM inheritance

    Roles granted higher in the hierarchy apply below.

    Remember
    A role at the folder applies to its projects.
    Tested as
    Access questions.
    Trap
    Granting at too high a level.

  • Cloud Identity

    Manages users and groups for Google Cloud.

    Remember
    Groups simplify access management.
    Tested as
    Identity questions.
    Trap
    Managing users individually at scale.

  • Enabling APIs

    APIs must be enabled per project before use.

    Remember
    A service needs its API enabled.
    Tested as
    Setup questions.
    Trap
    Expecting a service to work without its API.

  • Quotas

    Limits on resource usage that can be increased by request.

    Remember
    Check and request quota before hitting limits.
    Tested as
    Capacity questions.
    Trap
    Not requesting a needed increase.

  • Billing account

    Pays for the resources of linked projects.

    Remember
    Projects must be linked to use paid resources.
    Tested as
    Billing questions.
    Trap
    Confusing it with a project.

  • Budgets and alerts

    Thresholds that warn when spend approaches a limit.

    Remember
    They alert rather than cap spend.
    Tested as
    Cost questions.
    Trap
    Expecting a budget to stop spending.

  • Billing exports

    Detailed billing data sent to BigQuery for analysis.

    Remember
    Use exports for granular cost analysis.
    Tested as
    Cost questions.
    Trap
    Analyzing cost without exports.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Organization policy vs. IAM

ConceptMeaningKey differenceCommon trap
Organization policy Constrains configuration across the hierarchy Governs what is allowed Confusing it with IAM
IAM Grants permissions to members Governs who can act Confusing it with policies

Organization vs. folder vs. project

ConceptMeaningKey differenceCommon trap
Organization The top of the hierarchy Org-wide policy and IAM Applying everything here
Folder Groups projects and other folders Departmental grouping Confusing with a project
Project Groups resources and enables APIs The unit resources belong to Confusing with a billing account

Billing account vs. project vs. budget

ConceptMeaningKey differenceCommon trap
Billing account Pays for linked projects Funds resources Confusing with a project
Project Groups and runs resources Where resources live Confusing with billing
Budget Threshold with alerts Warns, does not cap Expecting it to stop spend

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Per-project policy

    What candidates pick
    Apply a constraint to each project individually to cover the whole organization.
    Why it looks right
    It directly configures each project.
    Why it's wrong
    Applying an organization policy at the organization node inherits down to all current and future projects without per-project work.

    Clue to watch for The constraint must apply to all current and future projects.

  2. Policy grants access

    What candidates pick
    Use an organization policy to grant a user permissions.
    Why it looks right
    Policies govern resources.
    Why it's wrong
    Organization policies constrain configuration; IAM grants permissions to members.

    Clue to watch for The need is to grant access, not restrict configuration.

  3. Budget caps spend

    What candidates pick
    Expect a billing budget to stop resources when the limit is reached.
    Why it looks right
    A budget sounds like a cap.
    Why it's wrong
    Budgets alert when spend approaches a threshold; they do not automatically stop spending.

    Clue to watch for The requirement is to be warned about or control cost.

  4. API not enabled

    What candidates pick
    Expect a service to work in a project without enabling its API.
    Why it looks right
    The service exists in Google Cloud.
    Why it's wrong
    Each API must be enabled in the project before the service can be used.

    Clue to watch for A service call fails in a new project.

  5. Project pays for itself

    What candidates pick
    Use paid resources in a project not linked to a billing account.
    Why it looks right
    The project is created.
    Why it's wrong
    A project must be linked to a billing account to use paid resources.

    Clue to watch for Paid resources cannot be created in a project.

  6. Individual users at scale

    What candidates pick
    Grant roles to each user individually across many projects.
    Why it looks right
    It is direct.
    Why it's wrong
    Managing users in Cloud Identity groups and granting roles to groups scales far better.

    Clue to watch for Access must be managed for many users consistently.

Answer framework

For any Section 1 setup scenario, use these steps to find the answer the exam expects.

  1. Identify whether the need is hierarchy and policy, access, APIs and quotas, or billing.
  2. For governance, apply organization policies and IAM roles at the right hierarchy level so they inherit to the intended scope, including future resources.
  3. For access, grant least-privilege IAM roles, prefer predefined over broad basic roles, and manage users through Cloud Identity groups.
  4. Enable the required APIs per project and check or request quotas before hitting limits.
  5. For billing, link projects to a billing account, set budgets and alerts to monitor spend, and use billing exports to BigQuery for detailed analysis. Where several options could fit, choose the one the requirements make defensible, often confirmable with the matching gcloud command.

Practice question

An organization must ensure that a resource-location restriction applies to every existing project and any project created in the future, without configuring each project individually. What should the administrator do?

Want more like this? The GCP ACE practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

This is a hands-on setup section, so practice in a free-tier Google Cloud account and the gcloud command line rather than only reading, since the exam tests CLI fluency throughout. Start with the resource hierarchy: create projects, understand organization and folders, and watch how organization policies and IAM roles inherit from higher levels down to projects and resources.

Next, learn access setup: least-privilege IAM roles, the difference between basic, predefined and custom roles, and managing users through Cloud Identity groups. Then practice enabling APIs and checking quotas. Finally, master billing: linking projects to a billing account, setting budgets and alerts, and exporting billing data to BigQuery.

Keep the organization-policy-versus-IAM distinction clear, since it is a common trap. Afterwards, move to Section 2, planning and configuring a cloud solution, which chooses the compute, storage and network services this foundation will run. Because GCP ACE is hands-on and command-line heavy, practice every task in a free-tier account and Cloud Shell, and review missed practice questions by section to find weak spots.

FAQ

How much of the GCP ACE exam is Section 1?

Setting up a cloud solution environment is about 20% of the exam, establishing the hierarchy, access and billing foundation for everything else.

What is the Google Cloud resource hierarchy?

From top to bottom: the organization, folders, projects and resources. Organization policies and IAM roles applied higher up inherit downward to everything below.

What is the difference between an organization policy and IAM?

An organization policy constrains what configuration is allowed across the hierarchy, such as restricting resource locations. IAM grants permissions to members, controlling who can do what.

What is the difference between a billing account and a project?

A billing account pays for resources, and one can fund many projects. A project groups and runs resources, and must be linked to a billing account to use paid services.

Does a billing budget stop spending?

No. A budget with alerts warns you when spend approaches a threshold. It does not automatically cap or stop spending.

Why must I enable APIs?

Each Google Cloud service's API must be enabled within a project before the service can be used, so a new project often needs the relevant APIs turned on first.

How does Section 1 connect to the rest of the exam?

The hierarchy, IAM and billing set up here govern the compute, storage, networking, operations and security covered in the later sections.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 1 knowledge

You have covered the resource hierarchy, IAM, Cloud Identity, APIs, quotas and billing. Test whether you can set up the environment correctly under exam conditions.

Take the GCP ACE practice test Check your GCP ACE readiness

Keep going