Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!
Gauge your current knowledge
Gauge your current knowledge
Event streams from various sources flow directly into Pub/Sub, which acts as a highly scalable messaging bridge. This service buffers incoming messages and guarantees data residency by storing messages in specified geographic regions. From Pub/Sub, the data flows to Dataflow, which processes and transforms both batch and streaming data in real time. Dataflow uses its integrated streaming engine to automatically scale worker machines up or down to handle changes in data volume without interrupting the pipeline.
To secure sensitive data within the stream, Sensitive Data Protection scans the payload to classify and mask private details before they reach final storage. The entire pipeline runs inside a perimeter secured by VPC Service Controls to prevent data from being exfiltrated to unauthorized networks. Additionally, Identity and Access Management (IAM) controls which service accounts can publish or subscribe to topics, while Customer-Managed Encryption Keys (CMEK) protect data at rest using keys controlled by the organization.
Dataflow ensures reliable delivery by using checkpoints and task retries to prevent data loss when temporary system failures occur. To achieve high availability, you should deploy pipelines using regional endpoints that distribute processing across multiple zones within a region. Cloud Monitoring continuously tracks pipeline health and alerts administrators if delays occur, ensuring that late-arriving data is handled correctly without failing the pipeline.
Choosing how to connect environments depends on bandwidth requirements, physical location, and cost. For smaller workloads, Cloud VPN offers a cost-effective option by routing encrypted traffic over the public internet. For large-scale transfers, Cloud Interconnect provides a high-performance, private connection. Organizations can choose Dedicated Interconnect for direct physical links to Google at 10 Gbps or 100 Gbps, Partner Interconnect to connect through a third-party provider, or Cross-Cloud Interconnect to link directly with other cloud environments.
Protecting data as it travels across these networks requires selecting the right level of encryption. You can use MACsec to provide hardware-level encryption directly on physical Interconnect links. Alternatively, setting up HA VPN over Cloud Interconnect combines high-speed physical connections with IPsec tunnels to establish highly available, encrypted tunnels with a 99.99% uptime agreement. Within the cloud network, VPC Service Controls acts as a security perimeter to block unauthorized attempts to move data outside the boundaries.
Network designs can bypass the public internet entirely by routing cloud traffic through private endpoints. Private Service Connect lets cloud resources connect to Google APIs using internal IP addresses, while Private Google Access allows on-premises systems to reach these APIs securely. To manage this network traffic dynamically, Cloud Router uses the Border Gateway Protocol (BGP) to automatically update routing tables and redirect traffic if a connection path goes down.
When planning a large-scale migration, architects must evaluate whether to transfer data online or offline. The Storage Transfer Service is a fully managed online tool that automates transfers over the internet or private networks, making it ideal for datasets larger than a terabyte. When network speeds are too slow to meet the project timeline, the Transfer Appliance provides an offline solution. This physical storage hardware is shipped to the on-premises facility, loaded with data, and then sent directly to a Google data center for local upload.
Selecting the right tool requires analyzing network limits, timelines, and financial costs. While moving data into Google Cloud does not incur ingress charges, organizations must budget for potential egress fees charged by their current storage provider. Architects must also measure how much network bandwidth can be used without disrupting daily business operations. Additionally, they must ensure the chosen tool supports metadata preservation so that critical file permissions and timestamps are not lost during the move.
A successful migration depends on setting up a secure resource hierarchy and granting proper IAM permissions to the transfer team. To minimize business downtime during the move, teams often implement a seed and sync strategy. Under this approach, the bulk of the data is transferred first using an offline appliance or online service, and then a final online sync updates only the files that changed during the migration.
StudyCerts
StudyCerts