ACE common mistakes
ACE · Understand the traps and how to avoid them.
Creating projects and linking billing accounts with personal credentials instead of using the organization node and a shared automation identity, so resources land outside the org hierarchy.
Candidates practice in a personal Gmail account where folders and the organization node do not exist, then repeat that habit in scenarios that explicitly describe an organization.
What to do instead
Before creating any project, state where it sits: organization, folder, then project. Create the project inside the named folder, attach the billing account, and verify with a describe command that the parent is the expected folder or organization.
Answering identity and access questions with primitive roles (Owner, Editor, Viewer) at project level when the scenario calls for least privilege.
Primitive roles are the fastest way to make a task work, so candidates use them as a shortcut and stop there without refining scope.
What to do instead
Replace primitive grants with predefined or custom roles granted at the narrowest resource (bucket, dataset, topic, folder). Reserve basic roles for cases where no predefined role covers the needed permissions, and say so explicitly.
Designing a network that relies only on firewall rules and forgets that a VPC is global while subnets are regional, placing resources in the wrong region or assuming subnets span regions.
On-premises networking intuition suggests a network is per-datacenter, so candidates misplace subnets and expect cross-region reachability without configuration.
What to do instead
For each workload, name the region, the subnet in that region, and the routes needed. Confirm that instances in different regions communicate over internal IPs only when routing and firewall rules permit it.
Choosing between standard, nearline, coldline, and archive storage classes by guessing rather than by access frequency and minimum storage duration.
The classes look interchangeable in a console dropdown, and candidates overlook retrieval costs and minimum-duration charges.
What to do instead
Tie the choice to access pattern and retention: frequent access uses standard, infrequent but monthly access uses nearline, quarterly uses coldline, and long-term archival uses archive. State the minimum storage duration and retrieval cost implication in the answer.
Granting service accounts broad project roles and downloading long-lived JSON keys instead of using attached service accounts and workload identity.
Key files feel familiar and portable, and attached identities require understanding which resource runs the code.
What to do instead
Attach a dedicated service account to the compute resource with a minimal role, or use workload identity federation for external workloads. If a key is unavoidable, describe rotation and storage in a secret manager.
Ignoring quotas and regional capacity limits when planning a deployment, then proposing a design that cannot be provisioned in the stated region.
Quota checks are a separate console page, and candidates focus on architecture rather than the operational preconditions.
What to do instead
Identify the relevant quota (CPUs, IP addresses, persistent disks, API rate limits) and include a verification or increase-request step in the plan before rollout.
Setting up logging and monitoring only after a failure, with no log sinks, no uptime checks, and no alerting policies defined in the design.
Observability is treated as an afterthought because the scenario emphasizes the workload, not its operations.
What to do instead
In every design, name the logs (audit, VPC flow, application), where they are routed, which metrics drive alerts, and who receives them. Include a budget or uptime check where availability is a stated requirement.
Treating IAM policy inheritance as additive without checking for deny policies, organization policy constraints, and inherited grants that override the intended access.
Candidates reason about a single binding and forget that effective permission is the union of grants along the resource hierarchy.
What to do instead
When troubleshooting access, walk the hierarchy from organization to the resource, list all bindings for the principal, and check organization policy constraints that could block the action regardless of IAM.
Deploying stateful resources without planning for backup, snapshot schedules, and restore testing, and assuming managed services remove the need for recovery design.
Managed databases and disks feel durable, so candidates skip recovery objectives and restore validation.
What to do instead
State recovery point and recovery time objectives, configure scheduled snapshots or backups with retention, and include a restore test as part of the operational plan.
Estimating cost from instance price alone, omitting egress, persistent disk, snapshot, and idle-resource charges, and proposing committed use without matching usage.
Pricing pages list many line items, and candidates anchor on the compute SKU they recognize.
What to do instead
Break the estimate into compute, storage, and network egress, apply sustained or committed use discounts only where usage is steady, and include a budget alert and labeling strategy for cost attribution.