Choosing a data store
- Cloud SQL: managed MySQL/PostgreSQL/SQL Server, regional, vertical scale + read replicas — standard OLTP.
- Cloud Spanner: horizontally scalable, strongly consistent relational with SQL, multi-region — global-scale relational.
- Bigtable: wide-column NoSQL, very high throughput, low latency, key-based access — time series, IoT, analytics serving.
- Firestore: document NoSQL with real-time sync — mobile/web app data. BigQuery: serverless analytical data warehouse for petabyte-scale SQL. Memorystore: managed Redis/Memcached cache.
Choosing compute
- Compute Engine: full VM control; managed instance groups add autoscaling and rolling/blue-green updates.
- GKE: full Kubernetes — orchestration, DaemonSets, pod autoscaling, portability. Autopilot removes node management.
- Cloud Run: fully managed, stateless, request-driven containers; scales to zero; per-revision traffic splitting for canaries.
- App Engine: managed app platform (standard sandbox or flexible containers). Cloud Functions: small event-driven snippets.
Networking and hybrid connectivity
- Shared VPC: a host project owns the network; service projects deploy into its subnets — centralised network control.
- VPC Peering connects two VPCs but is non-transitive. Cloud NAT gives private instances outbound internet.
- Global external Application Load Balancer: one anycast IP, managed TLS, path-based routing to multi-region backends.
- Hybrid: Dedicated/Partner Interconnect for private, high-bandwidth, SLA-backed links; HA VPN for encrypted tunnels over the internet.
Security and governance
- Resource hierarchy: Organization → Folders → Projects → resources; IAM and org policy set at a node are inherited below it.
- IAM: prefer predefined roles over basic (Owner/Editor/Viewer), bind to groups, scope to the lowest resource level. Attach least-privilege service accounts to workloads; avoid exported key files.
- VPC Service Controls: a service perimeter that blocks data exfiltration to services/projects outside it, even for authorised identities.
- Encryption: Google-managed by default; CMEK (Cloud KMS) for customer control of key rotation/disable/destroy; CSEK for customer-supplied raw keys. Cloud Audit Logs (Admin Activity always on) exported via an org-level aggregated sink.
Cost, reliability, and operations
- Cost: committed use discounts for steady 1–3 year usage; sustained use discounts automatically; Spot VMs for fault-tolerant batch; scale to zero when idle; Storage classes + lifecycle rules; Recommender for idle/rightsizing.
- Reliability: define SLOs with an error budget to gate risky releases; multi-zone then multi-region; decouple with Pub/Sub to stop failure cascades.
- Deployments: canary via traffic splitting; blue/green with a second MIG behind the backend service; Database Migration Service (CDC) for low-downtime DB moves.
- Operations: Cloud Monitoring (cross-project metrics scope, alerting), Cloud Logging (sinks to BigQuery, log-based metrics), Cloud Trace (distributed latency), Error Reporting.
Test yourself on Professional Cloud Architect
Reading a summary is the easy part. Take the free 10-question diagnostic to see which of these domains you actually have, then drill the rest.
Also free: 15 Professional Cloud Architect sample questions with answers and the Professional Cloud Architect study guide.