Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!
Prepare and test your skills
Prepare and test your skills
To connect on-premises data centers or other cloud environments to Google Cloud, architects must select the right connectivity option based on bandwidth, security, and reliability needs. For high-bandwidth, direct physical connections, Dedicated Interconnect links an on-premises network directly to a Google facility, whereas Partner Interconnect provides this physical connection through a trusted third-party provider. When a physical link is not needed or is too costly, Cloud VPN establishes secure, encrypted tunnels over the public internet. A Cloud Router dynamically manages these connections by exchanging routing information using Border Gateway Protocol to ensure traffic flows along the most resilient path.
An on-premises data center connects to a Google Cloud VPC using three options: Dedicated Interconnect, Partner Interconnect, and Cloud VPN. A Cloud Router uses BGP to exchange routes dynamically across these connections.
Google Cloud offers a comprehensive suite of tools designed to build, customize, and run artificial intelligence and machine learning models. Developers can explore pre-trained models, open-source models, and proprietary foundation models like Gemini LLMs in the Model Garden to find the right fit for their application. To quickly build conversational AI assistants without writing complex code, creators use Agent Builder to connect these language models to their own business data and systems. When organizations need to train large-scale models or run massive workloads, they deploy these tasks on an AI Hypercomputer, which integrates supercomputing architecture, specialized accelerators, and performance-tuned software to maximize processing speeds.
A Virtual Private Cloud (VPC) provides an isolated, global network boundary where virtual resources can securely communicate. To share resources across different projects, a Shared VPC allows an organization to designate a host project with shared subnets, while VPC Network Peering connects two distinct VPC networks directly without traversing the public internet. Network security is enforced by Cloud Firewalls, which inspect inbound and outbound traffic based on rules to allow or block data at the virtual machine level. For container-based applications, container networking manages IP address allocation and communication paths between individual pods and external services.
To manage incoming user traffic, Cloud Load Balancing acts as a traffic controller, distributing requests to backend services based on capacity, proximity, and health checks. For secure internal connections, Private Service Connect allows private consumption of services across different VPC networks or Google APIs without exposing traffic to the public internet. Choosing between these networking components depends on the required isolation level and the communication path. Traffic typically flows from a public user to a load balancer, through firewall checks, and down to the specific private subnet housing the workload.
Selecting the right data processing service depends on whether the data is processed in real-time streams or historical batches. For ingesting and decoupling real-time data streams, Pub/Sub acts as an asynchronous messaging service that buffers incoming messages before they reach processing systems. Organizations then use Dataflow to execute unified stream and batch processing pipelines, transforming the incoming data before saving it. If a company needs to run open-source Apache Spark or Hadoop workloads instead, they choose Dataproc to quickly spin up and scale managed clusters. Finally, processed data often flows into BigQuery, a serverless data warehouse designed for fast SQL analysis over petabytes of structured data.
Architects choose storage options based on data structure, access patterns, and performance requirements. For unstructured data such as videos, backups, and static website assets, Cloud Storage provides scalable object storage categorized into distinct storage classes based on access frequency. If multiple virtual machines require concurrent access to a shared file system using standard protocols, Filestore delivers fully managed network-attached file storage. Both options isolate data within specific regional boundaries to meet compliance and latency needs.
When choosing a database, the decision depends on the structure of the data and the scale of the transactional workload:
Deploying an application requires matching its architecture and scaling needs to the correct Google Cloud compute platform. For microservices packaged in containers that need advanced orchestration and complete control over Kubernetes APIs, Google Kubernetes Engine (GKE) is the preferred choice. For containerized applications where the team wants to avoid infrastructure management, Cloud Run offers a serverless environment that automatically scales containers down to zero when there is no traffic. If the application is event-driven and consists of small, single-purpose pieces of code, Cloud Run functions run code directly in response to cloud events without requiring a container image or an active server.
When provisioning virtual machines on Compute Engine, matching the hardware configuration to the workload optimizes costs and performance. For stateless, batch, or fault-tolerant workloads that can tolerate unexpected interruptions, Spot VMs offer deep discounts compared to standard instances but can be reclaimed by Google Cloud at any time. If standard machine shapes do not match the workload's memory or CPU needs, custom machine types allow architects to configure precise amounts of resources to avoid paying for excess capacity. For specialized workloads requiring extreme computational power, teams can attach hardware accelerators like GPUs for graphics rendering or TPUs for machine learning training.
Dedicated Interconnect links an on-premises network directly to a Google facility for high-bandwidth, direct physical connections. Partner Interconnect provides this same physical connection through a trusted third-party provider.
Use Cloud VPN when a physical link is not needed or is too costly, as it establishes secure, encrypted tunnels over the public internet rather than requiring dedicated physical infrastructure.
Google Kubernetes Engine is preferred for microservices packaged in containers that need advanced orchestration and complete control over Kubernetes APIs. Cloud Run offers a serverless environment for containerized applications where the team wants to avoid infrastructure management and automatically scales containers down to zero when there is no traffic.
Cloud Router dynamically manages connections by exchanging routing information using Border Gateway Protocol to ensure traffic flows along the most resilient path between on-premises networks and Google Cloud.
StudyCerts
StudyCerts