We use cookies for site analytics. Accept to help us understand how the site is used. See our Privacy Policy for details.
Configurations and the project/ADC model, gcloud vs gsutil vs bq, and the Compute Engine / GKE / Cloud Run / IAM / BigQuery commands that carry the ACE and Professional exams.
Google Cloud's CLI is where the Associate Cloud Engineer exam actually lives - a large share of ACE questions are "which command" or "what does this command do", and the Professional exams assume you can read one. The shape is gcloud <group> <subgroup> <verb> with --project, --region and --zone as the flags that decide where anything lands. Two things confuse newcomers. First, credentials come in two flavours: your gcloud login identity (what CLI commands use) and Application Default Credentials (what client libraries running locally use) - they are set by different commands and forgetting the second is the usual cause of "works in gcloud, fails in code". Second, the older gsutil (storage) and bq (BigQuery) tools are separate binaries with their own syntax, though gcloud storage now covers most of what gsutil did and is meaningfully faster.
| Command | What it does | Common flags | Example |
|---|---|---|---|
| gcloud init | Interactive first-run: authenticate, pick a project, set a default region/zone. | --no-launch-browser, --console-only | gcloud init |
| gcloud auth login | Authenticate the CLI as a human user. | --no-launch-browser, --update-adc | gcloud auth login |
| gcloud auth application-default login | Separate credential for client libraries running locally. If your code says it cannot find default credentials, this is the fix. | --scopes, revoke | gcloud auth application-default login |
| gcloud auth activate-service-account | Authenticate as a service account from a key file (CI). | --key-file=key.json | gcloud auth activate-service-account --key-file=$GOOGLE_APPLICATION_CREDENTIALS |
| gcloud config configurations | Named bundles of account + project + region. Switching configurations is the clean way to move between environments. | create <name>, activate <name>, list, describe | gcloud config configurations activate prod |
| gcloud config set / list | Set or show defaults in the active configuration. | set project <id>, set compute/region europe-west1, set compute/zone europe-west1-b | gcloud config set project my-project-123 |
| gcloud projects list | Projects you can see, with their numbers and ids. | --filter, --format='table(projectId,name)' | gcloud projects list --format='table(projectId,name)' |
| gcloud services enable | Enable an API on the project. Almost every "permission denied" on a brand-new project is actually a disabled API. | <api>.googleapis.com, list --enabled | gcloud services enable run.googleapis.com artifactregistry.googleapis.com |
gcloud does not use JMESPath. It has its own projection syntax, which is more capable than it first looks and shows up directly in exam answers.
| Command | What it does | Common flags | Example |
|---|---|---|---|
| gcloud compute instances create | Create a VM. | --machine-type --zone --image-family --image-project --boot-disk-size --subnet --tags --metadata-from-file startup-script=boot.sh --service-account --scopes | gcloud compute instances create web1 --machine-type=e2-medium --zone=us-central1-a --image-family=debian-12 --image-project=debian-cloud |
| gcloud compute instances list | VM inventory across all zones in the project. | --filter, --format, --zones | gcloud compute instances list --filter='status=RUNNING' --format='table(name,zone.basename(),EXTERNAL_IP)' |
| gcloud compute ssh | SSH in, generating and propagating a key automatically. Add --tunnel-through-iap to reach a VM with no external IP. | --zone, --tunnel-through-iap, --command 'uptime' | gcloud compute ssh web1 --zone=us-central1-a --tunnel-through-iap |
| gcloud compute instances stop / start / delete | Lifecycle. A stopped instance still bills for its persistent disks and any reserved static IP. | --zone, --keep-disks, --quiet | gcloud compute instances stop web1 --zone=us-central1-a |
| gcloud compute firewall-rules create | VPC firewall rule. Targets are network TAGS or service accounts, not instances - that indirection is the model Google wants you to know. | --allow tcp:443 --source-ranges --target-tags --direction INGRESS|EGRESS --priority --network | gcloud compute firewall-rules create allow-https --allow=tcp:443 --source-ranges=0.0.0.0/0 --target-tags=web |
| gcloud compute networks subnets create | Subnet in a custom-mode VPC. Subnets are REGIONAL in GCP, not zonal - a frequent exam discriminator. | --network --range --region --enable-private-ip-google-access | gcloud compute networks subnets create sn-app --network=vpc-main --range=10.10.0.0/20 --region=us-central1 |
| gcloud compute disks snapshot | Snapshot a persistent disk. Snapshots are global resources. | --zone --snapshot-names --storage-location | gcloud compute disks snapshot web1 --zone=us-central1-a --snapshot-names=web1-2026-08-14 |
| Command | What it does | Common flags | Example |
|---|---|---|---|
| gcloud storage ls / cp / rsync | The modern replacement for gsutil - same ideas, notably faster on large transfers. | cp --recursive, rsync --recursive --delete-unmatched-destination-objects, ls --long --readable-sizes | gcloud storage rsync ./dist gs://my-bucket/site --recursive |
| gcloud storage buckets create | Create a bucket. | --location --default-storage-class STANDARD|NEARLINE|COLDLINE|ARCHIVE --uniform-bucket-level-access --public-access-prevention | gcloud storage buckets create gs://my-bucket --location=us-central1 --uniform-bucket-level-access |
| gcloud container clusters create | GKE cluster. Autopilot removes node management entirely. | --num-nodes --machine-type --region|--zone --enable-autoscaling --min-nodes --max-nodes --workload-pool (Workload Identity), create-auto for Autopilot | gcloud container clusters create-auto prod --region=us-central1 |
| gcloud container clusters get-credentials | Write the kubeconfig entry so kubectl can reach the cluster. | --region | --zone, --project | gcloud container clusters get-credentials prod --region=us-central1 |
| gcloud container node-pools create / resize | Node pool lifecycle on a Standard cluster. | --cluster --num-nodes --machine-type --spot --enable-autoscaling | gcloud container node-pools resize pool-1 --cluster=prod --num-nodes=5 --region=us-central1 |
| gcloud run deploy | Deploy a container (or build from source with --source .) to Cloud Run. | --image --source . --region --allow-unauthenticated --set-env-vars --min-instances --max-instances --concurrency --service-account | gcloud run deploy api --source . --region=us-central1 --allow-unauthenticated |
| gcloud functions deploy | Deploy a Cloud Function (2nd gen runs on Cloud Run). | --gen2 --runtime nodejs20 --trigger-http --trigger-topic --entry-point --region --set-env-vars | gcloud functions deploy handler --gen2 --runtime=nodejs20 --trigger-http --region=us-central1 |
| bq query | Run BigQuery SQL from the shell. | --use_legacy_sql=false, --destination_table, --dry_run (returns bytes scanned - the cost check), --format=prettyjson | bq query --use_legacy_sql=false --dry_run 'SELECT COUNT(*) FROM `p.d.events`' |
| Command | What it does | Common flags | Example |
|---|---|---|---|
| gcloud iam service-accounts create | Create a service account. | --display-name, --description | gcloud iam service-accounts create app-sa --display-name='App runtime' |
| gcloud projects add-iam-policy-binding | Grant a role at project scope. Roles bind to members (user:, serviceAccount:, group:) - there is no attach/detach, only policy bindings. | --member --role, --condition | gcloud projects add-iam-policy-binding my-project --member='serviceAccount:app-sa@my-project.iam.gserviceaccount.com' --role='roles/storage.objectViewer' |
| gcloud projects get-iam-policy | Full policy dump - the audit command. | --format=json, --flatten='bindings[].members' | gcloud projects get-iam-policy my-project --flatten='bindings[].members' --format='table(bindings.role,bindings.members)' |
| gcloud secrets create / versions access | Secret Manager write and read. | create --data-file=- (read stdin), versions access latest --secret=<name> | gcloud secrets versions access latest --secret=db-password |
| gcloud logging read | Query Cloud Logging with the same filter language as the console. | --limit --freshness 1h --format, filter string is positional | gcloud logging read 'resource.type=cloud_run_revision AND severity>=ERROR' --limit=50 --freshness=1h |
| gcloud logging tail | Live-tail logs (needs the beta component on some installs). | filter positional, --format | gcloud logging tail 'resource.type=cloud_run_revision' |
Time and space complexity for the data structures, sorting algorithms, and search routines that show up in coding interviews. Skim the row, remember the row, defend the row in an interview.
The recurring shapes - sliding window, two pointers, fast/slow, BFS/DFS, backtracking, DP, divide & conquer, binary search variants, union-find, topological sort. Each entry: when to reach for it, the template, complexity, and which classic problems use it.
The recurring forks in system design interviews. CAP, PACELC, sync vs async, push vs pull, SQL vs NoSQL, sharding shapes, consistency models, cache strategies, idempotency, and rate limiting. For each, the options and when to choose each.
Filesystem layout, the commands you actually use (find / grep / awk / sed / xargs), processes and signals, networking, permissions, basic shell scripting, and a vi survival kit.
Query clause order, every JOIN type and when to use it, aggregates vs window functions, what indexes actually buy you, transaction isolation levels, and the NULL / WHERE-vs-HAVING / EXISTS-vs-IN gotchas interviewers fish for.
The everyday commands, every undo scenario mapped to its fix, rebase vs merge with a side to pick, interactive rebase, bisect, the reflog safety net, stash, and the flags worth aliasing.
The docker and kubectl commands you reach for daily, Dockerfile best practices, how layer caching actually works, the core k8s objects in one screen, requests vs limits, liveness vs readiness, and a step-by-step CrashLoopBackOff debug flow.
Method semantics and idempotency, the ~15 status codes that matter, resource naming rules, offset vs cursor pagination, versioning and auth tradeoffs, error body conventions, rate-limit headers, and the smells reviewers flag.
The STAR structure with timing, what interviewers actually grade, eight question archetypes and how to frame each, the anti-patterns that sink answers (rambling, "we" instead of "I", no metrics), and a 30-second answer skeleton.
TCP vs UDP, the TLS and TCP handshakes, HTTP versions, status codes, DNS resolution, the OSI and TCP/IP layer models, and the ports you are expected to know in an interview.
Anchors, character classes, quantifiers, groups, alternation, lookarounds, backreferences, and flags - plus practical patterns and the gotchas that trip people up in interviews.
The USE method, a first-five-minutes triage runbook, and the CPU, memory, disk, network, and tracing commands you reach for when a Linux box is misbehaving.
A fast reference for concurrency primitives, synchronization tradeoffs, the memory model, and the classic bugs that show up in systems interviews and real code.
A reference for the theorems, consistency models, replication and partitioning strategies, delivery guarantees, and resilience patterns that come up in system design interviews.
Topics, partitions, and consumer groups, the three delivery semantics and how Kafka actually achieves each, ordering guarantees, rebalancing, retention vs compaction, and a straight Kafka vs SQS vs RabbitMQ vs Kinesis comparison.
Schema, types, and resolvers, the three operation kinds, the N+1 problem and DataLoader, cursor vs offset pagination, error handling that actually works, security (depth limiting, query cost), and an honest answer to 'when does REST beat GraphQL'.
State and why it must be remote and locked, the init/plan/apply lifecycle, modules and variables, count vs for_each, workspaces, import and drift, a command table, and the gotchas (prevent_destroy, secrets in state) that mark real production experience.
How LLMs work in one paragraph, the knobs (context window, temperature, top-p), system vs user prompts, few-shot and chain-of-thought, RAG and embeddings, the fine-tune-vs-prompt decision, tool calling, eval basics, and the interview questions teams actually ask now.
How B-tree indexes actually work, composite index column order, covering indexes, reading EXPLAIN ANALYZE, why the planner ignores your index, join algorithms, N+1, keyset pagination, and the 'why is this query slow' scenarios interviews are built on.
Profiles and credential resolution, the --query vs --filters distinction that trips people up, and the EC2 / S3 / IAM / VPC / Lambda / CloudWatch commands you actually reach for under time pressure.
Login and subscription juggling, the resource-group model everything hangs off, JMESPath --query, and the VM / storage / AKS / Key Vault / App Service commands worth knowing cold.
Chart anatomy, the values precedence order that explains every "why did my override not apply", install vs upgrade --install, template vs dry-run vs diff, and rollback.
The gh commands that remove the browser round-trip: PR create/review/merge, issues, run watching and log digging on Actions, releases, and gh api for anything without a command.
The same operation in all three CLIs, side by side - compute, storage, networking, IAM, Kubernetes, serverless and logging - plus the service-name mapping and the model differences the equivalences hide.
Reading is the floor. The signal in interviews comes from working problems out loud and defending your tradeoffs. Spin up an AI mock interview or run a coding challenge to put these to work.