The Professional Cloud Architect exam, as it stands in October 2026

Cloud Storage features

• All classes have the same millisecond latency and 11-nines durability. Colder classes add retrieval fees and minimum durations.
• Autoclass moves objects colder when they aren’t accessed and back to Standard when they are, with no retrieval fees. Use it for unpredictable access.
• Lifecycle rules change class or delete by age, version count or date. They can only move objects to colder classes.
• Retention policy + Bucket Lock makes data immutable until a set age. Locking is irreversible.
• Soft delete is on by default with 7-day retention. Object versioning keeps noncurrent versions.
• Locations: region, dual-region (turbo replication gives a 15-minute RPO), or multi-region.
• Access: uniform bucket-level access, public access prevention, signed URLs for time-limited access, Requester Pays for shared datasets.

Block and file

• Persistent Disk: balanced, SSD or standard. Regional PD replicates synchronously across two zones.
• Hyperdisk: Balanced, Extreme, Throughput and ML. IOPS and throughput are set independently and can change online. Balanced High Availability replicates across two zones. Hyperdisk ML attaches read-only to many VMs to share model weights.
• Local SSD: fastest, but ephemeral. Data is lost when the VM stops or is deleted.
• Filestore: managed NFS (Basic, Zonal, Regional, Enterprise tiers). Regional and Enterprise survive a zone failure.
• NetApp Volumes: NFS and SMB with enterprise storage features.
• Managed Lustre (Parallelstore’s documentation now redirects to it): a high-throughput parallel file system for AI and HPC.
• Cloud Storage FUSE: mounts a bucket as files. Not fully POSIX (no file locking).

Quick picks

• Global ACID writes or a 99.999% requirement → Spanner
• Existing MySQL, PostgreSQL or SQL Server with minimal change → Cloud SQL
• PostgreSQL that needs more performance or analytics → AlloyDB
• Millions of writes per second, time series, millisecond lookups → Bigtable
• Mobile sync or document data, MongoDB drivers → Firestore
• Sub-millisecond reads of hot data → Memorystore
• SQL analytics over petabytes → BigQuery

HA vs DR for databases

• HA = surviving a zone failure (Cloud SQL HA, AlloyDB, regional Spanner).
• DR = surviving a region failure (cross-region replica, AlloyDB secondary cluster, Spanner multi-region, backups in another region).
• Read replicas scale reads. They aren’t HA on their own until promoted.
• Point-in-time recovery protects against bad writes, which replication copies faithfully.

VPC basics

• A VPC is global and its subnets are regional. Use custom mode in production.
• Plan RFC 1918 ranges that don’t overlap with on-premises or other clouds. Include GKE pod and service secondary ranges.
• VPC firewall rules are stateful. Priorities run 0–65535, and the lower number wins. There’s an implied deny for ingress and allow for egress.
• Firewall policies: hierarchical (organization or folder, evaluated first, with goto_next), global network and regional network policies. Target with secure tags or service accounts.
• Cloud NGFW tiers: Essentials, Standard (FQDN, geolocation and threat-intelligence objects) and Enterprise (intrusion prevention). Intrusion prevention (the exam guide’s “intrusion protection”) is an NGFW Enterprise feature.

Connecting VPCs and services

• Shared VPC: one organization, a central network team, a host project plus service projects.
• VPC Network Peering: point to point, non-transitive, no overlapping ranges.
• Network Connectivity Center: hub and spoke. In the default mesh topology every VPC spoke reaches every other (a star topology keeps edge spokes apart). Hybrid spokes bring in Interconnect or VPN, and router appliances handle SD-WAN.
• Private Service Connect: publish or consume a single service privately, across organizations, even with overlapping IPs. Also provides endpoints for Google APIs.
• Private Services Access: peering-based private IPs for Cloud SQL, Memorystore and similar services.
• Private Google Access: a per-subnet setting that lets VMs without external IPs reach Google APIs. Use restricted.googleapis.com with VPC Service Controls.
• Cloud NAT: outbound only. Secure Web Proxy: egress filtering by URL.
• Serverless: Cloud Run reaches a VPC through Direct VPC egress (preferred) or a Serverless VPC Access connector.

Encryption and routing

• Interconnect traffic isn’t encrypted by default. Add MACsec for Cloud Interconnect, or HA VPN over Cloud Interconnect.
• Cloud Router runs BGP. Regional or global dynamic routing mode sets how far learned routes reach.
• Cloud Interconnect usually lowers egress pricing compared with internet egress.

Hybrid DNS

• Cloud DNS forwarding zone: the cloud resolves on-premises names.
• Inbound server policy: on-premises resolves Cloud DNS private zones.
• DNS peering: one VPC uses another VPC’s zones.
• Response policies override answers, for example for restricted.googleapis.com.

Edge services

• Cloud CDN caches behind the external Application Load Balancer. Signed URLs and cookies, cache invalidation.
• Media CDN handles large-scale video streaming and downloads on Google’s media edge.
• Cloud Armor: WAF with preconfigured OWASP rules, rate limiting, IP and geo rules, Adaptive Protection and bot management. Works on external Application and proxy Network LBs, and on passthrough LBs and public-IP VMs through network edge policies.
• Certificate Manager manages TLS certificates at scale.

Common gotchas

• Backends being recreated every minute usually means health checks are blocked by the firewall.
• Cloud Armor doesn’t protect internal-only traffic.
• You need the client IP for UDP → passthrough NLB (or the PROXY protocol with proxy LBs).

Hierarchy and policies

• Organization → folders → projects → resources.
• IAM allow policies are inherited downward and are additive. A child can’t revoke a parent’s grant; use deny policies, which are evaluated first.
• Organization policies (constraints) restrict configuration. A lower level can override them if permitted, and only the Organization Policy Administrator can do so. IAM roles never bypass them.
• Roles: basic (Owner, Editor, Viewer; avoid in production), predefined, and custom (organization or project level only, not folders).
• Grant roles to Google groups, not individuals.
• IAM Conditions add time or resource restrictions. Privileged Access Manager gives just-in-time, approved, expiring elevation.
• Policy Intelligence: IAM recommender, Policy Analyzer, Policy Troubleshooter.

Who is calling?

• Employees: Cloud Identity or Workspace. GCDS syncs AD users and groups, and SAML or OIDC SSO keeps passwords in AD FS, Entra ID or Okta. Workforce Identity Federation uses the external IdP with no sync.
• App end users: Identity Platform (customer identity, social sign-in, MFA).
• Workloads on Google Cloud: attached service accounts, one per workload. No keys.
• GKE pods: Workload Identity Federation for GKE.
• Workloads elsewhere (AWS, Azure, GitHub Actions, on-premises OIDC or SAML): Workload Identity Federation.
• Humans acting as a service account: impersonation with roles/iam.serviceAccountTokenCreator.
• Admin access to VMs: IAP TCP forwarding (allow 35.235.240.0/20) plus OS Login. No bastions with public IPs.
• Internal web apps without VPN: IAP plus Access Context Manager access levels (Chrome Enterprise Premium for device posture).

Protecting data

• Key rotation creates a new primary version. Old versions still decrypt old data until it is re-encrypted.
• Secret Manager stores credentials with versions, rotation notifications, per-secret IAM and optional CMEK.
• Sensitive Data Protection discovers, inspects and de-identifies data. Redaction and masking are irreversible. Deterministic and format-preserving encryption are reversible and keep joins working. Hashing is one-way.
• VPC Service Controls put a perimeter around Google API services to stop exfiltration even with valid credentials. Use access levels, ingress and egress rules for narrow exceptions, bridges inside one organization, and dry-run mode before enforcing.
• BigQuery also offers column-level security, dynamic data masking and row-level security.

Securing AI new since Oct 2025

• Model Armor screens prompts and responses for prompt injection and jailbreaks, harmful content, malicious URLs and sensitive data (through SDP). It works with any model and is configured with templates and floor settings.
• Sensitive Data Protection on training data, prompts and logs.
• VPC Service Controls around Agent Platform. Private endpoints. CMEK for AI resources.
• Least-privilege IAM on endpoints, agents and tools. Use separate service accounts per agent.
• Model provenance (Model Registry), evaluation before deployment, and logging of prompts and responses.
• Google’s Secure AI Framework (SAIF) is the reference model.

Detection, supply chain, audit

• Security Command Center (Standard, Premium, Enterprise): misconfigurations, vulnerabilities, threats (Event, Container and VM Threat Detection), attack paths, compliance reports.
• Google Security Operations: SIEM and SOAR. Mandiant: incident response and threat intelligence.
• Supply chain: Artifact Registry with Artifact Analysis scanning, Cloud Build with SLSA provenance, Binary Authorization to enforce attestations at deploy time on GKE and Cloud Run, and Assured OSS.
• Audit logs: Admin Activity and System Event are always on and free. Data Access logs are off by default (except BigQuery) and need Private Logs Viewer to read. Policy Denied logs are also recorded.
• Access Transparency logs Google staff access. Access Approval requires your approval first.

Adapting a model: cheapest first

1. Prompt design: instructions, examples, structured output (response schema).
2. Grounding / RAG: fresh or private facts and citations. The answer for content that changes.
3. Supervised tuning: consistent style, format or domain behavior. It doesn’t keep facts current.
4. Custom training: unique tasks or data with no suitable foundation model.

Use batch inference for large offline jobs (cheaper, avoids online quotas) and online inference for interactive use.

AI Hypercomputer

• Accelerators: TPUs (v5e for cost efficiency, v5p and Trillium for large training, Ironwood for inference; the eighth generation, TPU 8t for training and TPU 8i for inference, was announced at Next ’26 for later in 2026) and GPUs (G2 with L4 for inference, A3 with H100 or H200, A4 with B200, A4X with GB200).
• Orchestration: GKE (the most common for large training and serving, with GKE Inference Gateway), Cluster Director (Slurm), Batch, and Agent Platform training.
• Serverless inference: Cloud Run with GPUs, scaling to zero.
• Storage: Cloud Storage with FUSE and Anywhere Cache, Managed Lustre, Hyperdisk ML.

Accelerator consumption models

• On-demand: flexible and most expensive. Capacity isn’t guaranteed.
• Spot: cheapest, can be preempted. Checkpoint your work.
• DWS flex-start: queued until all capacity is available, discounted, then runs uninterrupted for up to 7 days.
• DWS calendar mode: reserve capacity for a known future window.
• Reservations and CUDs: steady, long-running training or serving.

Online transfer time, rule of thumb

• 1 TB over 100 Mbps ≈ 1 day
• 10 TB over 1 Gbps ≈ 1 day
• 100 TB over 1 Gbps ≈ 12 days
• 1 PB over 10 Gbps ≈ 12 days

These assume the link is fully yours. If the transfer would take more than about a week, or the link is shared, consider Transfer Appliance.

Licensing and money

• BYOL for Windows Server without License Mobility needs sole-tenant nodes.
• Premium OS images include pay-as-you-go licenses.
• For per-core licenses: custom machine types, or threads per core set to 1.
• Oracle: Bare Metal Solution or Oracle Database@Google Cloud.
• Moving from CapEx to OpEx: model TCO, commit to the steady baseline, and keep peaks elastic.

SRE vocabulary

• SLI: the measurement, e.g. the share of requests that succeed in under 300 ms.
• SLO: the internal target for an SLI.
• SLA: the contract, set looser than the SLO.
• Error budget: 100% minus the SLO. When it’s spent, slow releases and fix reliability.
• Good SLOs measure users’ experience (success rate, latency percentiles), not CPU.

Building blocks

• Compute: regional MIGs with autohealing, regional GKE clusters, Backup for GKE, multi-cluster Gateway.
• Data: Cloud SQL HA plus cross-region replicas, AlloyDB secondary clusters, Spanner multi-region, dual- or multi-region buckets, regional PD or Hyperdisk HA.
• Backup and DR Service: central, policy-based backups with immutable backup vaults.
• Testing: DR drills, chaos experiments, load tests, and penetration tests (no notice to Google needed; follow the AUP).

Logging architecture

• The Log Router sends entries through sinks to log buckets, BigQuery, Cloud Storage, Pub/Sub (for SIEMs) or other projects.
• The _Required bucket keeps Admin Activity and System Event logs for 400 days. You can’t change or exclude it.
• The _Default bucket keeps logs for 30 days by default. Custom buckets keep them for 1–3,650 days.
• Aggregated sinks at the organization or folder centralize logs from every project.
• Exclusion filters cut cost. Ingestion is the main logging charge.

Release strategies

• Rolling: replace gradually. The GKE default.
• Blue/green: two environments, switch traffic. Instant rollback, double cost.
• Canary: a small share of traffic first (Cloud Run traffic splitting, Cloud Deploy canary).
• A/B: route by user attributes to compare behavior.
• Shadow: mirror traffic to the new version without serving its responses.
• Cloud Deploy adds approvals, promotion and one-step rollback.

Support

• Standard: business hours, 4-hour response for P2.
• Enhanced: 24/7, 1-hour P1 response.
• Premium: 15-minute P1 response, Technical Account Manager.

Levers

• Rightsize with Active Assist. Use custom machine types. Delete idle resources.
• Autoscale, and scale to zero on Cloud Run.
• Storage: Autoclass, lifecycle rules, retention limits.
• BigQuery: partition and cluster, require partition filters, cap bytes billed, choose editions with autoscaling for steady load and on-demand for spiky load.
• Network: keep chatty services in the same region or zone, use CDN, prefer Interconnect egress.
• Logging: exclusion filters.

Visibility and control

• Labels plus billing export to BigQuery for showback and chargeback.
• Budgets only alert. To enforce a cap, use Pub/Sub notifications that trigger a function to disable billing or stop resources.
• The FinOps hub and Gemini Cloud Assist cost insights.
• Quotas limit resources, not dollars.

CI/CD

• Cloud Build: triggers, private pools for VPC access, SLSA provenance.
• Artifact Registry: containers and language packages, with scanning. Container Registry is shut down.
• Cloud Deploy: delivery pipelines to GKE and Cloud Run with canary, approvals and rollback.
• GitOps: Config Sync for clusters, Config Connector for Google Cloud resources.
• DORA metrics: deployment frequency, lead time, change failure rate, time to restore.

Infrastructure as code

• Terraform: remote state in a versioned Cloud Storage bucket with locking, modules, policy checks in CI (gcloud terraform vet).
• Infrastructure Manager: Google-managed Terraform runs.
• Config Connector: Google Cloud resources as Kubernetes custom resources.
• The enterprise foundations blueprint and Fabric FAST for landing zones.
• Deployment Manager: end of support 31 Mar 2026.

API management

• Apigee: full lifecycle. Proxies, security, quotas and Spike Arrest, analytics, monetization, developer portal. Apigee hybrid runs the runtime on-premises.
• API Gateway: a lightweight managed gateway for serverless backends.
• Cloud Endpoints: the older ESP-based option.
• Version APIs, use API keys or OAuth per consumer, and protect backends with quotas.

Working programmatically

• CLIs: gcloud, gcloud storage (preferred over gsutil), bq, cbt, kubectl.
• Cloud Shell: a temporary VM with a 5 GB persistent $HOME. Cloud Shell Editor, Cloud Code, Gemini Code Assist.
• Emulators: Pub/Sub, Spanner, Bigtable, Firestore and Datastore (gcloud emulators …).
• Cloud Client Libraries (preferred) with Application Default Credentials.
• Retry with truncated exponential backoff and jitter. Respect quotas, paginate and batch.