Google Cloud Professional Cloud Architect Study Guide

Issuing body: Google Cloud Jurisdiction: Global (vendor certification — not a legal license to practice) Level: Professional Prerequisites: None formal. Google recommends 3+ years of industry experience including 1+ year designing and managing solutions on Google Cloud. (Source: catalogue record software-cert-006.) Renewal: Valid 2 years. Renew via a shorter 1-hour renewal exam ($100), the standard exam, or designated Google Skills courses/badges.

1. What this exam is

The Professional Cloud Architect exam tests whether you can design, secure, and operate solutions on Google Cloud the way Google does: with a bias toward managed services, global networking, declarative infrastructure, and SRE-flavored operations. The exam's signature feature is case studies — long fictional-company briefs (Mountkirk Games, Dress4Win, TerramEarth) with business and technical requirements that 6–10 questions reference. You must hold the case facts across questions, and several questions per case are only answerable from the case brief, not from GCP knowledge.

2. Pathway and exam format

Typical path: Cloud Digital Leader (foundational) → Associate Cloud Engineer (hands-on console/gcloud) → Professional Cloud Architect. The Associate exam teaches the how; this exam teaches the why.
Format: 50–60 multiple-choice / multiple-response questions, 2 hours, $200 USD. Includes case-study questions. Passing score is not published by Google (scaled scoring; treat ~70% as the target).
Time pressure is real: 2 hours for 60 questions with case studies = ~2 min/question. Read the case studies FIRST (before starting the exam timer mentally) — actually, read them during the exam's first pass and take notes on each company's constraints; you'll amortize that reading across many questions.
Google's design philosophy is the hidden syllabus: prefer serverless/managed, global over regional, declarative (Terraform/Config Connector) over imperative, and SRE practices over heroics. When torn, pick the answer that a Google SRE would pick.

3. Knowledge domains (with theory)

Google publishes sections (approximate public weightings): Designing and planning a cloud solution architecture (~24%), Managing and provisioning a solution infrastructure (~15%), Designing for security and compliance (~18%), Analyzing and optimizing technical and business processes (~18%), Managing implementation (~11%), Ensuring solution and operations reliability (~14%).

Designing solutions: compute, data, and the global network

Compute selection on GCP:

Cloud Run (serverless containers, scale-to-zero, request-driven) vs GKE (full Kubernetes control, Autopilot for managed nodes) vs Compute Engine (VMs, sole-tenant, custom machine types) vs App Engine (PaaS, standard = sandboxed/scale-to-zero, flexible = Docker on VMs) vs Cloud Functions (event-driven functions, 2nd gen on Cloud Run infra).
The exam's decision axis: how much control do you need over the runtime? None → Cloud Run/Functions; Kubernetes ecosystem → GKE; kernel/licensing/GPU topology → Compute Engine. Preemptible VMs and Spot VMs (up to ~60–91% discount, 24h max, preemptible with 30s warning) for fault-tolerant batch — same economics as AWS Spot.
Sole-tenant nodes for license compliance (Windows/SQL Server BYOL); confidential computing (encrypted memory via AMD SEV) for sensitive workloads.

Data selection on GCP:

Cloud SQL (managed MySQL/Postgres/SQL Server, regional HA with automatic failover) vs AlloyDB (PostgreSQL-compatible, 4× faster analytics, columnar engine) vs Spanner (globally distributed, externally consistent, horizontal scale — the only choice for global OLTP with strong consistency) vs Bigtable (wide-column NoSQL, single-digit ms at massive scale, time-series/IoT) vs Firestore (document DB, mobile/web sync) vs BigQuery (serverless data warehouse, the analytics default).
Spanner's TrueTime is worth understanding: globally synchronized clocks (atomic clocks + GPS) give external consistency without the latency penalty of traditional consensus — this is why Spanner can offer global strong consistency. The exam tests the implication (use Spanner when you need global transactions), not the physics.
BigQuery architecture: decoupled storage (Colossus) and compute (Dremel); slots as the compute currency (on-demand per-TB vs flat-rate/reservations); BigQuery Omni (cross-cloud queries), partitioning + clustering to cut scanned bytes (the #1 cost lever — same lesson as Athena).

GCP networking — the global advantage:

VPCs are global (unlike AWS's regional VPCs): one VPC spans all regions with global dynamic routing via Cloud Router. Subnets are regional. Shared VPC (host/service projects) is the enterprise pattern; VPC peering is non-transitive.
Private Google Access + Private Service Connect: consume Google APIs and third-party services privately. Cloud Interconnect (Dedicated 10/100 Gbps, Partner via providers) for hybrid; Cloud VPN (HA VPN, 99.99% SLA with two tunnels).
Global load balancing is GCP's crown jewel: a single anycast IP fronts Cloud CDN + global external LB, routing users to the nearest healthy backend. Know the LB taxonomy: global external HTTP(S), regional external, internal (L4/L7 via Envoy), network LB. Cloud Armor (WAF/DDoS, edge policies) sits in front.

Resource hierarchy and governance

Organization → Folders → Projects → Resources. IAM is additive (allow policies; deny policies exist but are newer — know they exist). Best practice: grant at the folder level, use groups (Google Groups) not individuals, custom roles for least privilege, IAM Recommender for right-sizing. Organization policies (constraints like constraints/compute.requireOsLogin, constraints/iam.disableServiceAccountKeyCreation) are the GCP analogue of AWS SCPs — preventive guardrails. Know the difference: org policy = constraint on resource configuration; IAM = constraint on who can act.

Security and compliance

BeyondCorp / zero trust: Identity-Aware Proxy (IAP) for TCP/HTTPS forwarding without VPN; context-aware access (device + identity). The exam loves "replace the corporate VPN" → IAP + BeyondCorp.
Data protection: CMEK (customer-managed encryption keys via Cloud KMS) vs CSEK vs Google-managed; VPC Service Controls (service perimeters preventing data exfiltration — the answer to "keep data in the perimeter even if credentials leak"); Access Transparency + Access Approval for Google-admin access; Confidential VMs/GKE.
Key management: Cloud KMS (regional/global, key rotation), HSM-backed keys; separation of duties via IAM on key rings.

Reliability: SRE on the exam

Google invented SRE, and the exam is steeped in it: SLIs/SLOs/error budgets (same math as DOP-C02: budget = (1−SLO) × window), blameless postmortems, toil elimination, canary analysis (Cloud Deploy canary with Cloud Monitoring metrics), chaos testing. Deployment Manager vs Terraform (Google's documented preference for IaC is Terraform; Config Connector for K8s-native GCP management).

Operations suite: Cloud Monitoring (metrics, uptime checks, alerting policies with multi-condition), Cloud Logging (log buckets, sinks to BigQuery/Cloud Storage/PubSub, log-based metrics), Cloud Trace, Cloud Profiler. Log sinks + BigQuery for long-term analysis (same cold-log economics as AWS).

Migration and optimization

Migration: Migrate to Virtual Machines (lift-and-shift from VMware/AWS/Azure), Database Migration Service (homogeneous/heterogeneous to Cloud SQL/AlloyDB), Transfer Service / Storage Transfer for data, StratoZone-style assessment (now part of Migration Center). Anthos/GKE Enterprise for hybrid Kubernetes; Bare Metal Solution for Oracle workloads that can't leave bare metal (licensing).

Cost optimization: committed use discounts (1–3 yr, ~37–57% off), sustained use discounts (automatic), resource-based committed use for Cloud SQL, BigQuery flat-rate slots vs on-demand, recommenders ( rightsizing, idle resources), budgets + programmatic enforcement (pub/sub budget alerts → Cloud Function to disable billing).

4. Key formulas and decision rules

Error budget: (1 − SLO) × time window. 99.9% monthly ≈ 43.2 min. Same as AWS; the exam expects you to use it (freeze releases when exhausted).
Availability math: series multiply, parallel: 1 − Π(1−Ai). Memorize 99.9/99.95/99.99 monthly downtimes (43.8/21.9/4.38 min).
BigQuery cost control: bytes scanned = cost driver. Partition + cluster + SELECT only needed columns; estimate with dry-run before running.
Interconnect vs VPN break-even: sustained >~2–3 Gbps or needing private SLA → Dedicated Interconnect; bursty/lower → HA VPN.
GKE cost: Autopilot charges per-pod resources (no node management); Standard charges per node — Autopilot wins for variable workloads, Standard for dense steady-state.
Data transfer: ingress free; egress charged; cross-region replication multiplies egress — keep hot data near users via Cloud CDN / multi-region buckets.

5. Worked examples

Example 1 — Mountkirk Games-style (mobile gaming backend). Scenario (case-study pattern): global player base, spiky traffic at game launches, leaderboards, 100 ms latency target, minimize ops. Solution: Global external HTTPS LB (anycast) → Cloud Run (scale-to-zero between launches, concurrency per instance) → Memorystore (Redis) for leaderboards/sessions → Spanner for player profiles/inventory (global strong consistency for purchases — no double-spend) → Pub/Sub → Dataflow → BigQuery for analytics. Cloud CDN for game assets from multi-region Cloud Storage. This is the canonical "Google-stack" answer: serverless + global LB + Spanner.

Example 2 — TerramEarth-style (IoT telemetry). Scenario: 2M vehicles sending telemetry every 30 s, predictive maintenance ML, 10-year retention. Solution: Pub/Sub (ingest, handles burst) → Dataflow (windowed streaming ETL) → Bigtable (time-series vehicle state, single-digit ms lookups by key) + BigQuery (long-term analytics, partitioned by date); Vertex AI for the maintenance model; Looker dashboards. Retention: Bigtable with GC policies for hot window, BigQuery for the 10-year archive (cheap long-term storage pricing after 90 days).

Example 3 — Dress4Win-style (lift-and-shift then modernize). Scenario: monolithic e-commerce on VMs, must migrate with minimal downtime, then modernize to microservices. Solution: Migrate to Virtual Machines for rehost (or direct to GCE with DMS for the database to Cloud SQL); put Cloud Load Balancing + Cloud Armor in front immediately (DDoS + WAF win on day one); then strangler-fig: extract services to Cloud Run behind the LB's URL maps/host rules; database strangler via DMS CDC to AlloyDB. Org policies from day one (no public IPs on new VMs, require OS Login).

Example 4 — HIPAA-style compliance on GCP. Scenario: healthcare app with PHI, must demonstrate access controls, audit trails, and data residency in-region. Solution: Dedicated folder with org policies (resource locations constraint pinning to the region, CMEK required); VPC Service Controls perimeter around the PHI projects; Cloud KMS CMEK with rotation; Cloud Audit Logs (Admin Activity always on; Data Access logs enabled for PHI services) sunk to a locked log bucket in a security project with 7-year retention; IAP for admin access (no VPN, no public SSH); DLP API scanning storage for PHI drift. BAA signed with Google (process answer the exam sometimes wants named).

Example 5 — Cost crisis. Scenario: BigQuery bill tripled; GCE bill has 40% idle. Solution: BigQuery: audit with INFORMATION_SCHEMA jobs views, find full-table scans; enforce partitioning/clustering, convert to BI Engine or materialized views for dashboards, move to flat-rate slots if sustained >~$X. GCE: Recommender rightsizing, committed use discounts for the steady baseline, Spot VMs for batch, auto-delete idle disks/IPs, budgets with pub/sub → function enforcement. The exam wants the systematic answer (audit → rightsize → commit → automate), not one trick.

6. Standards and regulations cross-reference

GDPR — resource-locations org policy for data residency; VPC Service Controls against exfiltration; DLP API for discovery/classification; Cloud KMS crypto-shredding for erasure; Access Approval/Transparency for processor accountability.
ISO/IEC 27001:2022 — GCP's compliance reports (via Compliance Reports Manager) cover it; architecturally: org policies + IAM (A.5/A.8 access control), Cloud Audit Logs (A.8.15 logging), CMEK (A.8.24 cryptography), VPC-SC (A.8.20 network security).
SOC 2 — change control via IaC + approvals; audit evidence from Cloud Audit Logs + Forseti/Policy Intelligence drift detection.
PCI DSS v4.0.1 — scope reduction via tokenization (or Google Pay tokens), dedicated projects/VPCs for CDE, no long-lived keys (workload identity federation), centralized logging.
EU AI Act / ISO/IEC 42001 — for ML workloads: Vertex AI Model Registry + evaluation + monitoring as governance artifacts; data lineage via Dataplex.
Section 508 / European Accessibility Act — application-layer concern for public services; Cloud CDN + LB don't exempt the app.

7. Pitfalls, traps, and exam strategy

Trap patterns:

The AWS-brain trap: answering with AWS concepts (AZs, security groups as stateful instance firewalls). GCP VPCs are global; firewall rules are VPC-level with tags/service accounts. Reset your mental model.
The case-study trap: questions answerable only from the case brief (e.g., "which region must data stay in"). Re-read the case facts before each question block.
The over-control trap: choosing GCE when Cloud Run/GKE Autopilot satisfies the constraints — Google's philosophy penalizes undifferentiated ops toil.
The consistency trap: Firestore/Bigtable for global transactions — wrong; Spanner is the global strong-consistency answer.
The org-policy vs IAM trap: org policy constrains resources; IAM constrains identities. "Prevent anyone from creating public buckets" could be either, but "prevent buckets from being public" is org policy (constraints/storage.publicAccessPrevention).
The unpublished-score trap: Google doesn't publish the passing score — don't fixate on question counts; focus on case-study accuracy.

Strategy: read all case studies first and note each company's hard constraints (regions, compliance, latency, budget). 2 min/question is tight — don't re-read long stems twice; extract constraints on the first pass. Memorize: the compute decision tree, the database decision tree (especially Spanner vs Bigtable vs BigQuery), the LB taxonomy, and the SRE vocabulary (SLI/SLO/error budget/toil). For "migrate with minimal downtime" always reach for the managed migration services before hand-rolled replication.

8. Practice problems

P1. A SaaS app runs on GKE Standard with 50 nodes at 35% average utilization, spiky. Two options: (a) move to Autopilot, (b) stay on Standard with committed use discounts. When does each win? Answer: Autopilot wins when utilization is low/spiky — you pay per-pod-requested resources, no idle node cost, no node management. Standard + CUDs wins when utilization is high and steady (>~60–70%) — committed per-node pricing beats per-pod. At 35% spiky, Autopilot usually wins; recompute if they consolidate workloads to raise density.

P2. Design a global leaderboard for 10M players with <100 ms reads worldwide and exactly-once score updates. Which GCP database(s) and why? Answer: Memorystore (Redis) with read replicas per region for the hot leaderboard (<100 ms); Spanner as the system of record for score transactions (global strong consistency prevents lost/double-counted updates); async pipeline (Pub/Sub → Dataflow) syncing Spanner → Redis. Bigtable is a plausible alternative for score history (time-series), but not for transactional exactly-once.

P3. A bank needs all data to stay in europe-west2, with proof for auditors, and no exfiltration even if a service account is compromised. Name the three controls. Answer: (1) Org policy resource-locations constraint (allowlist europe-west2) — preventive. (2) VPC Service Controls perimeter around the projects — contains exfiltration at the API layer even with valid credentials. (3) Cloud Audit Logs (Data Access) sunk to a locked bucket + CMEK — detective/proof. IAP for admin access completes the picture.

P4. BigQuery monthly cost is $18k on-demand. Jobs analysis shows a dashboard scanning 2 TB/day and ad-hoc analysts scanning 500 GB/day. Propose the cost plan. Answer: Dashboard: materialized view or BI Engine in-memory (sub-second, ~$X vs 2 TB/day × 30 = 60 TB/mo on-demand ≈ $300+/mo just for the dashboard — actually compute: 60 TB × $5/TB = $300/mo; the real lever is BI Engine + scheduled refresh). Analysts: enforce partitioned tables + clustering, require dry-runs, consider flat-rate 100-slot commitment (~$2k/mo) if sustained scan >~400 TB/mo. Also: 90-day long-term storage discount is automatic. Estimated savings 40–70%.

P5. Migrate 200 VMware VMs to GCP with <30 min cutover each and minimal rework. Which service and what are the two biggest risks? Answer: Migrate to Virtual Machines (HCX-like replication, agentless). Risks: (1) driver/OS compatibility (Windows/Linux versions, custom kernels) — test waves; (2) network cutover (IP renumbering vs stretched networking) — plan DNS/LB abstraction up front. Post-migration: rightsizing (Recommender) since lifted VMs are usually oversized.

P6. An incident: Cloud Run service latency p99 spiked 5× after a deploy; error budget is 80% consumed. What do you do, in SRE order? Answer: (1) Mitigate first: roll back via Cloud Deploy/traffic split (fastest path to restore SLO). (2) Freeze further releases (budget exhausted → feature freeze per SRE policy). (3) Diagnose with Cloud Trace + Logs (find the regression). (4) Blameless postmortem; add canary analysis with automatic rollback so the next bad deploy never reaches 100%. Never "tune the code" before mitigating.

Original ETS reference writing, verified against public sources on 2026-09-30. Thin sourcing is flagged inline. Not legal advice — confirm current editions with the issuing body.

Google Cloud Professional Cloud Architect Study Guide