CertifyDeck
Start for free
All cheat sheets
Professional Cloud Architect · CHEAT SHEET

Google Cloud Certified Professional Cloud Architect

Key concepts grouped by official exam weight.

Download as PDF (free, no sign-up)

1. Designing and planning a cloud solution architecture

25–25%

Designing a cloud solution infrastructure that meets business requirements

  • Product strategy starts from business value: total cost of ownership includes management, so prefer managed and serverless services such as Cloud Run. Ready-made products cover common use cases (Document AI to extract data from documents, Agent Search for semantic search with generative answers), and proofs of concept demonstrate value before investing.
  • Non-functional requirements (availability, data residency, scalability) determine the deployment archetype: zonal, regional, multi-regional or global. Reliability is defined with user-experience metrics such as request success ratio and latency rather than CPU, and scalability comes from stateless designs that scale horizontally.
  • Disaster recovery is part of business continuity and starts with a business impact analysis that sets the RTO (maximum offline time) and RPO (maximum data-loss period). Cold, warm and hot patterns balance cost against recovery speed, and the recovered environment must carry the same security controls as production and be tested regularly.
  • Cost optimization aligns spending with business value and relies on visibility (labels, billing export to BigQuery), matching resources to actual usage and choosing the right discounts: committed use for steady workloads, Spot VMs for preemption-tolerant jobs, and Autoclass or lifecycle rules in Cloud Storage.
  • To support application design, decouple services with asynchronous messaging (Pub/Sub), use managed caches such as Memorystore for fast reads, design for graceful degradation (throttle and drop excess requests at the frontend) and follow request journeys with Cloud Trace to find bottlenecks.

Designing a cloud solution infrastructure that meets technical requirements

  • The Well-Architected Framework groups its recommendations into six pillars (operational excellence, security, reliability, cost, performance and sustainability) and cross-pillar perspectives such as AI and ML. Its principles include realistic reliability targets below 100%, graceful degradation under overload, managed services, decoupled and stateless design, and customer responsibility for workload efficiency.
  • High availability is designed by replicating every critical component across failure domains with automatic failover: Cloud SQL in the HA configuration with synchronous replication across two zones, Bigtable with multi-cluster routing, Hyperdisk Balanced High Availability for stateful volumes, and Cloud DNS failover routing policies with health checks across regions.
  • Google Cloud lets resources adapt to the workload: Cloud Run scales to zero without traffic, custom machine types match vCPUs and memory (useful with per-CPU licenses), Hyperdisk changes IOPS and throughput while in use without changing size, and Spot VMs cut the cost of fault-tolerant workloads when combined with managed instance groups and checkpoints.
  • Growth is best handled by scaling out with stateless components: managed instance groups with autoscaling (predictive when load is cyclical and startup is slow), the GKE cluster autoscaler driven by Pod resource requests, shared state in services such as Memorystore, and Spanner when a relational database must scale writes with strong consistency.
  • Latency is reduced by bringing content and compute closer to users: Cloud CDN on the global external Application Load Balancer, backends in several regions behind one anycast IP, and Premium Tier so traffic enters Google's network at the nearest point of presence. Within a zone, compact placement cuts latency between VMs and Local SSD gives the lowest latency for temporary data.

Designing network, storage, and compute resources

  • To connect on-premises or other clouds you choose between Cloud VPN (lower cost and bandwidth) and Cloud Interconnect: Dedicated when you can reach a colocation facility, Partner through a service provider, and Cross-Cloud to another cloud; HA VPN over Interconnect adds IPsec without using the internet. Inbound DNS server policies and Private Google Access for on-premises hosts complete the integration.
  • Gemini Enterprise Agent Platform brings together Gemini models, Model Garden (Google, partner and open models, with an organization policy to limit which are allowed), RAG grounding to reduce hallucinations, and Agent Runtime with Sessions and Memory Bank for production agents. AI Hypercomputer provides accelerators, open software and consumption options such as Dynamic Workload Scheduler for large training runs.
  • Shared VPC centralizes subnets, routes and firewalls in a host project and delegates use of specific subnets with compute.networkUser. VPC Network Peering is not transitive and does not allow overlapping ranges; Private Service Connect publishes services to other consumers through their own internal IPs. Hierarchical firewall policies enforce rules projects cannot override, and Cloud NAT provides internet egress without external IPs.
  • Dataflow runs Apache Beam batch and streaming pipelines as a fully managed, autoscaling service, typically with Pub/Sub for ingestion and BigQuery as the sink. Managed Service for Apache Spark (formerly Dataproc) keeps existing Spark code, on clusters or serverless, and Datastream replicates changes from operational databases into BigQuery with low latency.
  • Google Cloud offers block storage (Persistent Disk, Hyperdisk, Local SSD), file storage (Filestore, NetApp Volumes, Managed Lustre) and object storage (Cloud Storage). For databases, Bigtable serves single-keyed data at scale with low latency, and Spanner provides relational SQL with horizontal scaling and global consistency. Cloud Storage adds lockable retention and lifecycle rules.

Creating a migration plan (i.e., documents and architectural diagrams)

  • To integrate with existing systems, the tiered hybrid pattern moves frontends first and keeps backends on-premises behind an API gateway; Apigee provides that proxy layer with security, quotas and analytics without changing the backend. Cloud bursting uses Cloud Load Balancing with hybrid connectivity NEGs, and Cloud Interconnect links networks without crossing the internet.
  • Migration Center discovers servers and databases, produces total cost of ownership reports, identifies dependencies and helps plan the migration. To execute it, Migrate to Virtual Machines replicates running VMs with test-clones before cut-over, Database Migration Service runs continuous migrations into Cloud SQL or AlloyDB, and Storage Transfer Service or Transfer Appliance move large datasets.
  • Google's migration guide distinguishes rehost, replatform, refactor, re-architect, rebuild and repurchase, and organizes the journey into assess, plan, deploy and optimize. It recommends stateless, non-critical first movers with few dependencies, validating the plan with proofs of concept, planning DNS TTLs, and preparing a tested rollback for every step.
  • Microsoft licenses can be on-demand, billed with compute, or brought through License Mobility. Physical-core licenses with dedicated hardware terms go on sole-tenant nodes. For the financial impact, total cost of ownership must include data center operating and networking costs, and committed use discounts can be resource-based or flexible.

Envisioning future solution improvements

  • After migrating, Google recommends optimizing in a continuous loop of iterations with measurable goals such as SLOs, and assessing team skills before adopting new services. Tools such as Active Assist recommendations, VM rightsizing and the Cloud Billing export to BigQuery help find improvements. The Well-Architected Framework also calls for retrospectives and keeping up with technology.
  • Business needs change, so designs must anticipate them: scale out before known events and autoscale for unexpected surges, move from vertical scaling to stateless horizontal architectures, and account for the regulations of future markets. The Well-Architected Framework also asks you to keep cloud spending aligned with business value.
  • A cloud-first design prioritizes managed and serverless services, because total cost of ownership includes patching, monitoring and scaling. It uses loosely coupled microservices that communicate through events, for example with Pub/Sub, idempotent operations that tolerate retries, and stateless, disposable instances that keep data in services such as Cloud Storage.

2. Managing and provisioning a cloud solution infrastructure

17–18%

Configuring network topologies

  • Cloud VPN encrypts traffic over the internet; Dedicated Interconnect needs equipment in a colocation facility and Partner Interconnect connects through a provider. Cloud Interconnect isn't encrypted by default: HA VPN over Cloud Interconnect adds IPsec. For hybrid DNS, forwarding zones query on-premises servers and a server policy with inbound forwarding lets on-premises hosts query private zones.
  • Cross-Cloud Interconnect provisions a dedicated physical connection between Google and another cloud provider, with one pair of connections per provider. Between Google Cloud networks, VPC Network Peering is not transitive; Google recommends Network Connectivity Center VPC spokes, even across organizations, and Private Service Connect to consume a single service from another organization over internal IPs.
  • Hierarchical firewall policies attach to the organization or folders, can't be overridden at lower levels and delegate with goto_next. Cloud NGFW Enterprise inspects VM and GKE traffic with firewall endpoints and threat-prevention profiles. Cloud Armor applies WAF rules at the edge of external load balancers, and IAP allows identity-based SSH to VMs without external IPs.
  • Shared VPC centralizes subnets and firewalls in a host project; grant the Network User role per subnet. Regional load balancers terminate TLS only in their region, global ones in locations worldwide. Cloud NAT provides internet egress with fixed IPs without accepting inbound connections, and Private Google Access or Private Service Connect reach Google APIs without external IPs.

Configuring individual storage systems

  • Google Cloud offers block storage (Persistent Disk, Hyperdisk, ephemeral Local SSD), file storage (Filestore for shared NFS) and object storage (Cloud Storage). Hyperdisk lets you set and change IOPS or throughput while in use; Hyperdisk ML attaches read-only to many instances, and Storage Pools share capacity and performance to avoid overprovisioning.
  • Dataflow runs Apache Beam batch and streaming pipelines without managing VMs, with autoscaling and exactly-once processing. Managed Service for Apache Spark (formerly Dataproc) offers clusters or serverless runs billed only while the workload runs. With data in Cloud Storage, secondary workers (including spot) scale compute only, and idle clusters are deleted and recreated.
  • Uniform bucket-level access disables ACLs and leaves only IAM; public access prevention, enforceable with the storage.publicAccessPrevention constraint, stops data from being made public. Signed URLs give time-limited access to one object without a Google account. In BigQuery, policy tags restrict columns and row-level access policies filter rows.
  • Transfer Appliance suits large volumes with little bandwidth; Storage Transfer Service moves data from other clouds or on-premises NFS at scale with a bandwidth limit, and gcloud storage fits ad hoc transfers. Cloud CDN serves content from Google's edge, and dual-region buckets with turbo replication quickly replicate new objects across two regions.
  • Object Lifecycle Management changes storage class or deletes objects based on conditions such as age. A retention policy prevents early deletion and Bucket Lock makes it permanent; event-based holds restart the retention period when released. In BigQuery, partition expiration removes each old partition without deleting the table.

Configuring compute systems

  • Instance templates define VM configuration and are required for MIGs; regional templates isolate errors and help with data residency. Reservations assure capacity: automatically consumed ones are used by any matching VM, specifically targeted ones only by VMs that target them. Bulk creation picks zones with capacity and validates quota, but does not create a managed group.
  • Spot VMs use excess capacity at deep discounts, but Compute Engine can preempt them at any time; it stops them on preemption or, with the DELETE action, deletes them. A 120-second preemption notice gives room to workloads that need over 30 seconds to wind down. In GKE, taint Spot nodes, use nodeSelector plus tolerations, and keep a standard node pool for system components.
  • Cloud Run reaches a VPC through Direct VPC egress (recommended, no VM charges, per-service network tags) or connectors; a static outbound IP requires routing all traffic through Cloud NAT. VPC-native GKE clusters use secondary ranges for Pods and Services, extendable with discontiguous multi-Pod CIDR. VMware Engine connects to a VPC by peering with its VMware Engine network.
  • Infrastructure Manager runs Terraform as a managed service from Git or Cloud Storage, stores each revision's state and supports previews, but doesn't deploy applications. VM Manager applies scheduled patches with compliance reporting and, through OS policies, keeps the desired software on VM groups filtered by labels. MIGs roll out new templates through rolling updates controlled by maxSurge and maxUnavailable.
  • Regional GKE clusters replicate the control plane across zones and keep the API available during upgrades; Autopilot is always regional. Maintenance windows and exclusions control when and which upgrades happen, such as No minor upgrades. The cluster autoscaler decides based on Pod resource requests and won't remove nodes running Pods without a controller.

Leveraging Gemini Enterprise Agent Platform for end-to-end ML workflows

  • Agent Platform Pipelines serverlessly orchestrates ML workflows defined as DAGs with Kubeflow Pipelines or TFX, compiled to YAML and run once or through the scheduler API. Agent Platform ML Metadata stores each run's artifact lineage. Execution caching skips steps with the same cache key and can be turned off per task or per job, and Google Cloud Pipeline Components provide prebuilt components with billing labels.
  • Agent Platform Feature Store uses BigQuery tables or views as the offline store and serves the latest values online through feature views; registering feature groups with a timestamp serves only the latest value. AutoML needs a managed dataset, which Agent Platform reads through a Service Agent. Before training, avoid data leakage and training-serving skew.
  • AI Hypercomputer brings together GPUs and TPUs, open software and consumption models: flex-start with Dynamic Workload Scheduler for jobs that can wait, Spot for fault-tolerant work, and reservations for the highest capacity assurance. TPUs suit large matrix-heavy models and scale in slices. Cloud Run offers managed GPUs that scale to zero for inference, and Agent Platform training can use reservations, Spot or DWS.

Configuring prebuilt solutions or APIs with Agent Platform

  • Each Google AI API covers a content type: Vision analyzes images (labels, logos, OCR), Video Intelligence analyzes video (shots, logos, objects), Speech-to-Text transcribes audio synchronously, asynchronously or by streaming, and Text-to-Speech synthesizes speech. Document AI extracts fields and tables from documents, Natural Language analyzes text, Cloud Translation translates and Agent Search provides search with generative answers.
  • Gemini Enterprise combines intranet search, an assistant and agents over data connected through data stores and prebuilt connectors (Jira, Confluence, SharePoint), with permissions-aware answers and actions that create or update records. Gemini Notebook Enterprise, formerly NotebookLM Enterprise, summarizes and researches uploaded sources kept as static copies, with data in the project and sharing only within it.
  • Model Garden brings Google, partner and open models together with a common deployment pattern: managed models (MaaS) are serverless, while self-deployed models run in your project and VPC and can use Compute Engine reservations. The vertexai.allowedModels policy limits which models and actions are allowed, and regional or multi-region endpoints help respect data residency.

3. Designing for security and compliance

17–18%

Designing for security

  • IAM combines allow policies inherited through the hierarchy, deny policies evaluated before them, and Principal Access Boundary policies that limit which resources principals can access. Good practice is to avoid basic roles in production, grant predefined roles at the smallest scope, use one service account per component, and use conditions so that access expires on its own.
  • The resource hierarchy goes from the organization (the root, tied to Cloud Identity or Google Workspace) to optional folders and projects. Allow, deny and organization policies are inherited downwards; lower-level allow grants are additive and only a deny policy restricts them. Google recommends a single root node and choosing the structure by environment, subsidiary or accountability, not by org chart.
  • Google Cloud encrypts data at rest and in transit by default; for more control, Cloud KMS manages keys whose material cannot be exported, Cloud HSM hosts them in Google-managed HSMs and Cloud EKM keeps them in an external key manager. Secret Manager stores passwords and API keys with versions, per-secret IAM and scheduled rotation through Pub/Sub notifications.
  • Separation of duties keeps any single principal from holding all the permissions needed for a malicious action. In Cloud KMS it separates key managers from key users (ideally only the service agent), using dedicated key projects or deny policies; Privileged Access Manager adds temporary access approved by another person, and the Workspace super admin delegates Google Cloud to Organization Administrator.
  • Security controls work in layers: VPC Service Controls creates perimeters that stop exfiltration from Google APIs, hierarchical firewall policies impose rules on the whole organization or folders that projects cannot override, organization policies restrict configurations such as locations or external IPs, and Data Access audit logs, disabled by default except for BigQuery, must be enabled.

Designing for compliance

  • Regulatory compliance is a shared responsibility: you own your data and many privacy controls. For HIPAA, Google signs a Business Associate Agreement covering its entire infrastructure; Assured Workloads applies residency and personnel access control packages to folders; and sovereignty is strengthened with external keys (Cloud EKM), Key Access Justifications and Access Transparency.
  • For card data, PCI DSS scope covers every system that stores, processes or transmits cardholder data plus connected systems; reduce it with a folder for designated users, a dedicated custom mode VPC with VPC Service Controls, and tokenization. For PII, Sensitive Data Protection discovers data with organization-level profiles and de-identifies it with masking, hashing or reversible tokenization.
  • Google Cloud only issues SOC 2 Type II reports, produced by an independent auditor about its own controls, and you download them on demand from Compliance Reports Manager; bridge letters cover the gap to the customer's period end. Under shared responsibility you evidence your own controls: check each service's scope and monitor your configuration with the Compliance Manager SOC 2 framework.
  • Cloud Audit Logs always records Admin Activity and System Event entries; Data Access logs are off except for BigQuery and must be enabled. For centralized audits, use an organization aggregated sink with --include-children into a locked log bucket with retention. Access Transparency records access by Google personnel.

4. Analyzing and optimizing technical and business processes

15–15%

Analyzing and defining technical processes

  • Google Cloud secures the whole software lifecycle: Cloud Workstations gives managed, consistent development environments; Artifact Registry centralizes dependencies, with virtual repositories that prioritize private packages; Assured OSS offers verified packages; Artifact Analysis generates SBOMs and finds vulnerabilities; Cloud Build produces non-falsifiable, SLSA-aligned provenance.
  • Cloud Build is the managed CI service: its triggers build and test on pushes or pull requests. Cloud Deploy handles continuous delivery to Cloud Run and GKE with a promotion sequence, approvals, automated canary strategies and rollback to the last good release. Binary Authorization blocks images without the required attestations at deploy time.
  • For root cause analysis, choose the tool by symptom: Cloud Trace for latency across services, Cloud Profiler for CPU and memory use per function in production, and Connectivity Tests for network failures after configuration changes. Then run a blameless post-incident review with a timeline, the immediate cause and systemic factors, and share it.
  • Test cheaply first: local Pub/Sub or Spanner emulators for functional tests, knowing the Spanner emulator lacks IAM and does not reflect real performance. For Terraform, static analysis with terraform validate, isolated module tests in fresh projects and cleanup with terraform destroy. Validate recovery by simulating failures under load in a staging environment and measuring against the RTO.
  • Service Catalog lets admins publish curated solutions (Terraform, templates or links) in catalogs shared with organizations, folders or projects; users with Catalog Consumer launch them, organization policies are respected, and updating a solution leaves existing deployments unchanged. Infrastructure Manager runs managed Terraform with revisions and previews.

Analyzing and defining business processes

  • Involve all stakeholders from the start to agree on scope and decisions, and keep them informed with goals, checkpoints and milestones. To influence finance, argue with total cost of ownership and business value, not list prices. Pick motivated first-mover teams sponsored by leadership, and gather feedback through surveys and interviews.
  • Change management combines governance (approvals and communication), risk assessment, testing and controlled deployment with rollback. On Google Cloud it relies on version-controlled Terraform and CI/CD, Cloud Deploy approvals wired to ITSM tools through Pub/Sub, organization policies tested outside production and rolled out gradually, and small, frequent changes measured with DORA.
  • Team readiness is assessed with the Google Cloud Adoption Framework: four themes (Learn, Lead, Scale and Secure) in tactical, strategic or transformational phases. The assessment includes role-based training, sandbox environments for experimentation and motivated first-mover teams with DevOps and SRE practices and sponsorship. Rehosting keeps current skills; refactoring or rebuilding requires new ones.
  • For sound decisions, Google recommends architecture decision records (ADRs) that capture options, requirements and the decision, stored near the code and keeping the history of changes. The migration plan includes a technical design document, a RACI matrix and a timeline. Proofs of concept with a defined scope and measurable business impact give leadership evidence.
  • Working with Cloud Customer Care means choosing the right priority: P1 when production is unusable with no quick workaround, P2 when it is degraded but one exists. Escalation flags process breaks rather than speeding up cases. A good case includes ISO 8601 times, project ID and zone. Personalized Service Health alerts you to incidents affecting your projects.

5. Managing implementation

12–13%

Advising development and operation teams to ensure the successful deployment of the solution

  • In managed instance groups, maxSurge and maxUnavailable control the pace of a proactive update; with maxUnavailable at 0 and maxSurge above 0 no capacity is lost, and --canary-version tests a template on a subset. Cloud Deploy promotes releases through targets, supports approvals with requireApproval, canary deployments on GKE and Cloud Run, and rollbacks to the last good release.
  • Apigee is Google Cloud's API management platform: a proxy between clients and backends that applies security, traffic and caching policies. Quota limits calls per app or developer over long periods with accurate counts; SpikeArrest protects the backend from spikes. API products bundle operations and quotas, and keys are provisioned for them. Complex logic belongs outside the gateway.
  • Emulators (Pub/Sub, Spanner) enable local unit and integration tests, but they do not support IAM and their performance does not compare to production. Cloud Build runs tests on each commit in a consistent, on-demand platform, and Locust or JMeter cover performance. For load tests on GKE, first measure one Pod's capacity with autoscaling off and generate load from the same region.
  • Migration Center discovers assets, calculates TCO and finds dependencies. Migrate to Virtual Machines replicates VMs in the background, supports test-clones in an isolated environment and cuts over with a short downtime. Database Migration Service migrates to Cloud SQL and AlloyDB with continuous replication and schema conversion. Storage Transfer Service moves data online; Transfer Appliance helps when bandwidth is short.
  • Gemini Cloud Assist is Google Cloud's AI collaborator for designing, deploying, troubleshooting and optimizing. It generates gcloud commands, manifests and Terraform, runs investigations over logs and metrics, can be triggered by alerts, hands cases to support and explains cost anomalies. In the background it acts through an audited dedicated service account, and its output should be validated before use.

Interacting with Google Cloud programmatically

  • Cloud Shell provides a temporary Google-managed VM with the gcloud CLI and other tools; only the $HOME directory persists, and it cannot be expanded (use Cloud Workstations for more space). Ephemeral mode starts faster without persistence. The Cloud Shell Editor, based on Code OSS, integrates Cloud Code, which supports Kubernetes and Cloud Run development in VS Code, IntelliJ and Cloud Shell.
  • Google recommends gcloud storage commands over the legacy gsutil tool, which lacks newer Cloud Storage features. For automation, gcloud scripts should rely on exit status plus --format and --filter rather than default output or stderr, and named configurations separate accounts and projects. The bq tool offers --dry_run to estimate bytes and --maximum_bytes_billed to cap query cost.
  • The gcloud CLI provides local, in-memory emulators for Bigtable, Spanner, Pub/Sub and Firestore; client libraries reach them through variables such as PUBSUB_EMULATOR_HOST or SPANNER_EMULATOR_HOST. Emulators are for development and testing only: they skip IAM and authentication, do not match production performance, and have gaps such as no gcloud pubsub support or Bigtable admin APIs.
  • Google recommends keeping Terraform state remotely in a versioned Cloud Storage bucket, structuring each service as modules plus one root configuration per environment with its own backend, and running Terraform from an automated pipeline that saves a plan for approval before applying it. Infrastructure Manager runs Terraform as a managed service with revisions and previews.
  • Applications should authenticate through Application Default Credentials: an attached service account in Google Cloud, gcloud ADC (optionally impersonating a service account) on workstations, and Workload Identity Federation outside Google Cloud, avoiding service account keys. API keys need API and application restrictions, and retries should target transient errors with exponential backoff and idempotent requests.

6. Ensuring solution and operations excellence

12–13%

Understanding the principles and recommendations of the operational excellence pillar of the Google Cloud Well-Architected Framework

  • The operational excellence pillar asks teams to define SMART SLOs tracked with SLIs in Cloud Monitoring, to manage incidents with runbooks, centralized tracking, automated remediation and blameless post-incident reviews, and to right-size and autoscale resources using Cloud Monitoring and Recommender. Automation, IaC and CI/CD reduce toil, and retrospectives drive continuous improvement.

Familiarity with Google Cloud Observability solutions

  • Cloud Logging routes entries through sinks to log buckets, Cloud Storage, BigQuery or Pub/Sub; aggregated sinks at organization or folder level centralize logs, and Pub/Sub sinks feed third-party tools. The Ops Agent collects logs, metrics and traces from Compute Engine, and a multi-project metrics scope lets one scoping project hold dashboards and alerts for many projects.
  • Cloud Profiler is a statistical, low-overhead profiler that continuously collects CPU and heap data from production and attributes it to source code, while Cloud Trace measures end-to-end latency across services and pinpoints slow dependencies. The Well-Architected Framework recommends load tests with realistic traffic and stress tests beyond peak to find bottlenecks before launches.
  • Cloud Monitoring alerting policies evaluate metrics, log entries or SQL query results and notify through channels. Conditions include metric-threshold, metric-absence for silent time series, forecasted metric-value for predicted breaches, and PromQL. For SLOs, Google recommends a fast-burn alert with a short lookback and a slow-burn alert with a longer one; integrations provide recommended policies.

Deployment and release management

  • Cloud Deploy promotes releases through targets in a defined sequence, with optional approvals (requireApproval, announced through Pub/Sub), rollbacks that redeploy the last successful release, and canary strategies in which it can apportion traffic automatically. Cloud Run itself supports deploying revisions with no traffic, testing them through tag URLs, and migrating traffic gradually by percentage.

Assisting with the support of deployed solutions

  • Effective support cases give Customer Care an ISO 8601 timestamp, the product and request mechanism, the zone, project IDs and artifacts, use one case per issue, and raise an existing case to P1 when production is impacted. Personalized Service Health shows and alerts on Google Cloud incidents relevant to your projects, and Error Reporting groups application errors from logs or its API.

Evaluating quality control measures

  • Quality control on Google Cloud is automated in the pipeline: Cloud Deploy runs verification containers after each deployment and a failure stops the rollout, and Binary Authorization admits only images carrying attestations from earlier stages. For infrastructure code, test from cheapest to costliest: static analysis, isolated modules and, last, end-to-end in a fresh environment.

Ensuring the reliability of solutions in production (e.g., chaos engineering, penetration testing, and load testing)

  • Production reliability is proven by testing: simulate failures gradually and under realistic load, confirm alerts fire, and compare recovery with the RTO and RPO, periodically. Cloud Service Mesh injects delays and errors into a percentage of requests; Web Security Scanner complements, but does not replace, manual security review; on Apigee, load tests are announced to support first.
Practice this certification