Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!
Gauge your current knowledge
Gauge your current knowledge
Google Cloud provides machine type recommendations that analyze how your virtual machines actually use resources like CPU and memory. These recommendations suggest the best configuration for your workload, helping you avoid paying for more power than you need. You can also create custom machine types that independently scale CPU and memory based on specific needs, ensuring you only pay for what you use. This process of matching resources to actual needs is called rightsizing, and it keeps infrastructure costs low throughout the life of your resources.
The way you provision virtual machines affects both cost and reliability. The standard provisioning model offers full control and immediate access for stable, production workloads that must run continuously. Spot VMs draw from excess Google Cloud capacity and offer 60-91% discounts compared to standard prices, but Google can reclaim these instances at any time through preemption, so they carry no Service Level Agreement. For specialized needs, Flex-start uses the Dynamic Workload Scheduler to provision resources when capacity becomes available, making it ideal for short-term projects lasting up to seven days. Architects use reservations to guarantee capacity in a specific zone for business-critical systems where downtime is not acceptable.
Managed Instance Groups (MIGs) automate the management of multiple VMs as a single entity. These groups use autoscaling to automatically adjust the number of instances based on real-time demand or scheduled events, ensuring high availability during traffic spikes and reducing costs during quiet periods. If one zone fails, instances in other zones continue serving traffic when you use Regional MIGs. Administrators configure autohealing policies that use health checks to monitor application status; if an instance becomes unresponsive, the MIG automatically repairs or recreates it.
Effective cloud management uses Infrastructure as Code (IaC) tools like Terraform to automate provisioning, eliminating manual configuration errors and ensuring consistency across development, testing, and production environments. Implementing Site Reliability Engineering (SRE) principles encourages automation to reduce manual labor and improve system resilience. This automation ensures every environment is built exactly the same way, reduces deployment time, and enables rapid service restoration during failures.
Google Cloud offers two provisioning models for virtual machines that affect both cost and reliability. Standard VMs provide a fixed, always-available instance that you control; they are the default choice for critical services. Spot VMs draw from excess capacity and offer a 60-91% discount compared to standard prices, but they can be reclaimed by Google at any time, so they carry no SLA. Choosing between them means balancing your budget against the performance needs of your application.
Spot VMs are ideal for fault-tolerant tasks such as batch processing, data analysis, scientific simulations, and CI/CD pipelines—jobs that can pause and resume without loss. To protect progress, use shutdown scripts that save checkpoints to Cloud Storage before the instance stops. For production environments you can combine both models inside a Managed Instance Group (MIG). The MIG automatically recreates spot instances after preemption and maintains a baseline of standard instances, ensuring minimum service while scaling cheaply when possible.
Standard VMs give you full control over lifecycle: they run until you stop them and support live migration and automatic restart during maintenance. Spot VMs, by contrast, are non-guaranteed resources that can be preempted when Google needs capacity back. The discount comes at the cost of no SLA, no live migration, and no automatic restart. When a spot VM is preempted, Google follows a termination action that you define during creation.
Choosing the right model depends on how well the workload handles interruptions. Standard VMs suit mission-critical applications that need constant uptime, such as web servers, primary databases, or real-time systems. Spot VMs fit fault-tolerant, stateless, or batch-oriented tasks. Common examples include large-scale data analytics, scientific simulations, rendering jobs, and continuous integration pipelines.
When a Spot VM is marked for preemption, Google sends a termination signal that gives the instance 30 seconds to complete clean-up tasks. During this window, a shutdown script can save checkpoints to Cloud Storage, close network connections, and log the current state so the job can resume later. Managed Instance Groups automate resilience by trying to recreate preempted spot instances as soon as capacity becomes available. A stronger pattern combines standard VMs with spot VMs in the same MIG: the standard instances provide a stable core, while the spot instances handle bursts at a lower cost.
By default, resources in a Virtual Private Cloud (VPC) network cannot reach Google APIs or external services without a public IP address. Private Google Access allows private resources to connect securely to Google APIs over internal IP addresses. Alternatively, Private Service Connect creates a service abstraction that allows a consumer to access Google APIs or services hosted in another VPC using internal endpoints. This keeps sensitive traffic off the public internet, reducing exposure to external threats.
To connect serverless environments like Cloud Run or Cloud Functions to private VPC resources, you must configure a Serverless VPC Access connector. The serverless service routes its outbound traffic through this connector, which assigns it an internal IP address capable of reaching databases or virtual machines within the private network.
A VPC network serves as the basic private boundary for all cloud resources. Using a custom-mode VPC gives network admins complete control over subnet IP ranges and regional setups. In larger setups, a Shared VPC allows a central team to manage these subnets, while developers deploy Compute Engine virtual machines and GKE clusters in their own projects.
For modern container networking, VPC-native clusters are the recommended standard because they assign each Pod a unique, routable address from alias IP ranges. This structure allows GKE Pod traffic to be managed directly by VPC firewall rules, eliminating the need for complex routing tables. VPC-native clusters provide scalability for large numbers of Pods, security through native VPC firewall rules, and efficiency through direct, low-latency communication between Pods and other Google Cloud services.
To secure VM and container workloads, administrators should limit external IP addresses and use Private Google Access for internal service calls. When private Compute Engine VMs or GKE nodes need to retrieve software updates from the internet, Cloud NAT provides secure network address translation. Securing containerized workloads requires VPC firewall rules at the VM level and Kubernetes network policies at the Pod level to restrict lateral movement between containers.
Cloud Load Balancing acts as the front door for user traffic, distributing workloads across regions to ensure high availability. For GKE clusters, container-native load balancing uses Network Endpoint Groups (NEGs) to route traffic directly to individual Pod IPs, reducing latency by avoiding extra network hops through GKE nodes.
Google Cloud VMware Engine (GCVE) is a fully managed service that lets organizations run VMware environments directly on Google Cloud bare metal infrastructure. To establish hybrid connectivity between an on-premises data center and GCVE, administrators can deploy Cloud VPN for encrypted internet tunnels or Cloud Interconnect for high-speed, physical links. Connecting GCVE to a native VPC requires VPC Network Peering to enable private routing between the VMware environment and Google Cloud resources. Within the GCVE private cloud, NSX-T operates as the software-defined networking layer that manages virtual machine segments and micro-segmentation.
To automate the creation of virtual machines, you use an Instance Template. This template acts as a blueprint, defining the VM's machine type, boot disk image, and network settings. To install software or run updates automatically when a VM boots, you use metadata and startup scripts. These tools allow you to standardize resource configuration across all your systems without manual intervention.
Managed Instance Groups (MIGs) use your instance template to create and manage a collection of identical VMs. The group treats these VMs as a single entity, which facilitates automated deployment at scale. Key benefits include high availability, where failed instances are automatically recreated, and scalability, where the number of VMs adjusts based on demand or a schedule.
Effective lifecycle management involves automated monitoring and repair. A MIG uses Health Checks to detect if an application on a VM has crashed. If a failure is detected, the system uses autohealing to automatically replace the unhealthy VM. For planned maintenance, Live Migration moves running VMs to new hardware without causing downtime.
Infrastructure as Code (IaC) means you manage cloud resources using configuration files instead of manual clicks in a console. Tools like Terraform and Google Cloud Deployment Manager use these files to automate the provisioning of resources. Terraform uses a declarative syntax where you describe your desired infrastructure state, and it relies on a state file to track which real-world resources correspond to your code.
Infrastructure orchestration coordinates multiple automated tasks. Google Cloud recommends using deployment pipelines, often automated with services like Cloud Build, to manage changes. These pipelines separate duties between teams, making every change auditable, traceable, and repeatable. For compute resource configuration, image baking creates a pre-configured VM image using a tool like Packer. When a Managed Instance Group scales up, every new VM starts from this identical image and is ready to work immediately.
VM Manager is a suite of tools for managing operating systems on large fleets of Google Cloud VMs. It automates tasks like infrastructure orchestration and resource configuration, specifically for OS updates, which reduces the manual work needed to keep an environment secure.
The OS inventory management service collects detailed software information from your VMs and stores it in instance metadata. You can query this data to check if your systems meet compliance standards. A Patch dashboard uses this inventory to show VM status, categorizing them as Critical, Security, or Up-to-date.
The Patch service lets you schedule operating system updates or apply them on-demand. An OS Config agent runs on each VM and uses the system's standard tools to install these updates. OS policies are declarative files that define the exact state a VM should be in, including specific software packages. When set to enforcement mode, the system automatically corrects any VM that does not match the policy.
When deploying updates, a disruption budget defines the maximum number of VMs that can be updating or offline at the same time. These settings help maintain high availability by preventing updates from taking down too many resources at once.
Container orchestration manages the deployment, scaling, and operation of containerized applications. In Google Cloud, Google Kubernetes Engine (GKE) provides a managed Kubernetes service that handles the underlying infrastructure, allowing teams to focus on their applications. Kubernetes organizes containers into Pods, which are the smallest deployable units, and these Pods run on nodes that can be scaled based on demand. GKE supports both zonal and regional clusters, with regional clusters providing higher availability by running across multiple zones. The orchestration system automatically handles load balancing, rolling updates, and healing failed containers, making it easier to maintain complex applications at scale.
Serverless computing allows developers to run applications without managing the underlying servers. Cloud Run is Google Cloud's serverless container platform that automatically scales based on incoming requests and can scale down to zero when there is no traffic. Cloud Functions provides a serverless execution environment for event-driven code, running functions in response to triggers like HTTP requests, file uploads, or database changes. These services eliminate the need to provision or manage infrastructure, as Google Cloud handles all server maintenance, scaling, and capacity planning. Serverless options are ideal for applications with variable or unpredictable traffic patterns, as you only pay for the compute time you actually use.
By default, resources in a Virtual Private Cloud (VPC) network cannot reach Google APIs or external services without a public IP address. To solve this, Private Google Access allows private re…
By default, resources in a Virtual Private Cloud (VPC) network cannot reach Google APIs or external services without a public IP address. To solve this, Private Google Access allows private re…
Google Kubernetes Engine (GKE) uses automated tools to manage how applications grow or shrink based on demand. The primary goal of workload scaling is to balance high performance with cost-effic…
Google Kubernetes Engine (GKE) uses automated tools to manage how applications grow or shrink based on demand. The primary goal of workload scaling is to balance high performance with cost-effic…
To optimize costs, Google Cloud provides machine type recommendations that analyze actual resource utilization and suggest the best configuration for your workload. Users can also create **custom …
To optimize costs, Google Cloud provides machine type recommendations that analyze actual resource utilization and suggest the best configuration for your workload. Users can also create **custom …
To automate the creation of virtual machines (VMs), you use an Instance Template. This template acts as a blueprint, defining the VM's machine type, boot disk image, and network settings. This ens…
To automate the creation of virtual machines (VMs), you use an Instance Template. This template acts as a blueprint, defining the VM's machine type, boot disk image, and network settings. This ens…
Serverless computing on Google Cloud lets developers build applications without managing servers. Services like Cloud Run and Cloud Run functions provide automatic resource provisioning an…
Serverless computing on Google Cloud lets developers build applications without managing servers. Services like Cloud Run and Cloud Run functions provide automatic resource provisioning an…
Google Cloud offers two provisioning models for virtual machines that affect both cost and reliability. Standard VMs provide a fixed, always-available instance that you control; they are the defau…
Google Cloud offers two provisioning models for virtual machines that affect both cost and reliability. Standard VMs provide a fixed, always-available instance that you control; they are the defau…
StudyCerts
StudyCerts