About the Professional Cloud DevOps Engineer exam

The Google Cloud Professional Cloud DevOps Engineer certification validates that you can implement processes across the development lifecycle using Google-recommended practices, balancing service reliability with delivery speed. The exam covers five Domains: bootstrapping and maintaining a Google Cloud organization; building CI/CD pipelines with continuous testing for application, infrastructure, and machine learning workloads; applying site reliability engineering (SRE) practices such as SLOs and error budgets; implementing observability and troubleshooting issues; and optimizing performance and cost.

Professional Cloud DevOps Engineer exam domains

Exam Study Guide

Designing a CI/CD architecture stack in Google Cloud, hybrid, and multi-cloud environments

Continuous integration (CI) with Cloud Build is the automated practice of testing every commit, building a container image, and pushing a versioned artifact to Artifact Registry. A cloudbuild.yaml file declares an ordered list of steps that share source code and a workspace, and a build trigger starts that file when a repository event occurs. Data flows from the source repository to the trigger, from the trigger through the build steps in order, and from the final steps to deployment targets.

Continue with this study guide: Designing a CI/CD architecture stack in Google Cloud, hybrid, and multi-cloud environments

Managing multiple environments (e.g., staging, production)

Managing ephemeral environments is the practice of defining short-lived, isolated Google Cloud environments in code and creating them on demand through automated pipelines. Infrastructure as Code (IaC) declares virtual machines, networks, databases, storage, and identity in versioned files, and continuous integration and continuous deployment (CI/CD) executes those files to build, test, and tear down the same environment repeatedly. Each environment is created by a trigger or schedule and destroyed when work completes, so development, testing, and preview work cannot leak into staging or production.

Continue with this study guide: Managing multiple environments (e.g., staging, production)

Enabling secure cloud development environments

Identity, network, and encryption controls for cloud development environments keep developer desktops productive while preventing data from leaving trusted boundaries. Cloud Workstations centralizes developer machines inside Google Cloud, Identity and Access Management (IAM) controls who can use them, private networking controls how traffic moves, and perimeter encryption controls where data can go.

Continue with this study guide: Enabling secure cloud development environments

Designing the overall resource hierarchy for an organization

Organizing resources in Google Cloud means arranging the Organization resource, folders, and projects into a hierarchy that controls security, governance, and cost. The Resource Manager provides this tree, while Identity and Access Management (IAM) and the Organization Policy Service provide the access grants and guardrails that flow through it. A well-designed hierarchy limits blast radius so a compromise or misconfiguration in one project does not spread to sibling projects.

Continue with this study guide: Designing the overall resource hierarchy for an organization

Managing infrastructure

Infrastructure-as-code tooling and managed services on Google Cloud define infrastructure in versioned files and reconcile Google Cloud to that desired state through automated execution. Infrastructure Manager provides managed Terraform orchestration without a separate toolchain, Config Connector provides Kubernetes-native reconciliation, and Terraform Cloud provides remote SaaS execution. Security Command Center enforces policy before resources are created, while Cloud Build executes the GitOps pipeline that moves changes from commit to deployment.

Continue with this study guide: Managing infrastructure

Exam Study Guide

Securing the deployment pipeline

Artifact Analysis is the Google Cloud family of services that scans container images for vulnerabilities, stores security metadata, and feeds deployment decisions. Artifact Registry provides built-in detection points where images are scanned on push and continuously monitored afterward. Together they connect detection in the registry to enforcement in the pipeline and visibility in operations.

Continue with this study guide: Securing the deployment pipeline

Designing pipelines

CI/CD of applications and infrastructure is the automated path that moves code and environment definitions from commit to production with testing and security checks at every stage. Cloud Build builds and tests artifacts, Artifact Analysis scans images in Artifact Registry, Binary Authorization blocks untrusted images at deploy time, and Cloud Deploy promotes releases through staging to production. Terraform and Cloud Build extend the same model to infrastructure, where Git is the source of truth for desired state.

Continue with this study guide: Designing pipelines

Implementing and managing pipelines

Auditing and tracking deployments is the system that proves where an artifact came from, how it was built, where it was released, and who approved the change. Artifact Registry stores container images and records their lineage, Cloud Build creates verifiable build history, Cloud Deploy creates ordered release history across environments, and Cloud Audit Logs records who invoked each action. Together they provide operational visibility, security enforcement, and compliance evidence for software supply chain security.

Continue with this study guide: Implementing and managing pipelines

Managing pipeline configuration and secrets

Envelope encryption for CI/CD pipelines is a layered design where a per-object data encryption key (DEK) encrypts the payload and a customer-managed key encryption key (KEK) wraps that DEK. Cloud Key Management Service (Cloud KMS) holds the KEK and never exposes raw KEK material, while the wrapped DEK travels and is stored alongside the encrypted payload in Secret Manager, Cloud Storage, or another CMEK-integrated service. Reading the payload therefore requires both permission on the resource and permission to unwrap the DEK with the KEK.

Continue with this study guide: Managing pipeline configuration and secrets

Exam Study Guide

Balancing change, velocity, and reliability of the service

Defining service level indicators (SLIs), service level objectives (SLOs), and service level agreements (SLAs) creates a hierarchy from measurement to internal target to external promise. The SLI is the technical measurement, the SLO is the internal operational target for that measurement, and the SLA is the legal commitment to users. SLI data flows into SLO monitoring, and SLO compliance provides the buffer that protects SLA commitments.

Continue with this study guide: Balancing change, velocity, and reliability of the service

Managing service lifecycle

Service management is the end-to-end control of a cloud service from planning and deployment through maintenance and retirement. A managed service is the logical resource integrated with Service Infrastructure, with only two immutable properties — service name and producer project — plus service consumers, a history of immutable service configurations, and a history of immutable service rollouts. The configurations referenced by the latest rollout represent the current state, from display name to metrics definitions to rate limits, so every lifecycle change is made by pushing a new configuration and rollout.

Continue with this study guide: Managing service lifecycle

Mitigating incident impact on users

Draining and redirecting traffic is the controlled removal of backends from serving and the shifting of user requests to healthy backends during deployments and incidents. Cloud Load Balancing provides the control plane for this work through URL maps, backend services, and health checks. Traffic flows from pipeline automation to URL maps, from URL maps to backend services, and from backend services to specific backends, so each stage can be advanced, paused, or reversed without dropping in-flight work.

Continue with this study guide: Mitigating incident impact on users

Exam Study Guide

Troubleshooting issues

Persistent storage, capacity, and network failures in Google Cloud share one troubleshooting rule: trace from the failed resource to the dependency that blocks it before assuming data is lost. Traffic flows from virtual machine (VM) instances, containers, or on-premises hosts through Virtual Private Cloud (VPC) routes and firewall enforcement to Persistent Disk volumes, buckets, or databases, while identity, Domain Name System (DNS), and replication services must stay healthy on both sides of every trust boundary. When reads, writes, or scale-out stall, the cause is usually a failed key, route, quota, or replica path rather than destroyed bytes.

Continue with this study guide: Troubleshooting issues

Managing metrics, dashboards, and alerts

Correlating metrics in Cloud Monitoring is the practice of querying related time series together to trace visible degradation back to its origin. No single chart explains an outage, so analysis compares frontend signals such as latency and errors against backend signals such as CPU utilization, memory pressure, and storage errors over the same time window. Confidence comes from aligning timing, scope, and distribution across those signals rather than from any single spike.

Continue with this study guide: Managing metrics, dashboards, and alerts

Managing and analyzing logs

Analyzing logs using the Logs Explorer and the Logging query language means filtering stored log entries with precise Boolean expressions and then diagnosing them with visual tools. Cloud Logging uses the same Logging query language in Logs Explorer, the Logging API entries.list method, the gcloud logging read command, and in filters for sinks and log-based metrics. Every query tests indexed LogEntry fields such as resource.type, severity, logName, timestamp, textPayload, jsonPayload, and protoPayload.

Continue with this study guide: Managing and analyzing logs

Instrumenting and collecting telemetry

Collecting and importing logs is the end-to-end pipeline that moves host, application, audit, and network telemetry from where it is generated into Cloud Logging for storage and analysis. Host data flows automatically from virtual machines (VMs), application data flows from instrumented code through receivers and collectors, and platform data flows from Google Cloud control planes and networks through audit and flow logs. Aggregated sinks then centralize those entries for security, troubleshooting, and compliance.

Continue with this study guide: Instrumenting and collecting telemetry

Capturing and analyzing distributed traces

Utilizing tracing frameworks means adding instrumentation code to applications so each request generates spans and traces that flow to a Google Cloud project for storage in Cloud Trace. OpenTelemetry is the recommended vendor-neutral framework for this work, and telemetry flows from the application process to the project either through an intermediate collector or directly through the Telemetry (OTLP) API. Before any flow starts, the Cloud Logging, Cloud Monitoring, and Cloud Trace APIs must be enabled in the project, which requires the serviceusage.services.enable permission through the Owner role or the Service Usage Admin role.

Continue with this study guide: Capturing and analyzing distributed traces

Exam Study Guide

Implementing FinOps practices for optimizing resource utilization and costs

Observability costs are the charges for ingesting, storing, and querying telemetry from traces, metrics, and logs while keeping enough visibility to troubleshoot. In Google Cloud, Cloud Trace spans, Google Cloud Managed Service for Prometheus samples, and Cloud Logging bucket storage drive most of the spend. Cloud Billing dashboards, exports, and alerts connect that technical usage to teams, budgets, and chargeback. Cost control therefore happens first in the telemetry pipeline, and cost accountability happens second in billing data.

Continue with this study guide: Implementing FinOps practices for optimizing resource utilization and costs

Collecting performance information in Google Cloud

Application performance monitoring in Google Cloud is the practice of collecting metrics, logs, and traces into Cloud Monitoring to understand health, performance, and cost. Cloud Monitoring automatically ingests system metrics, events, and metadata from most Google Cloud services and can serve as a backend for open-source tools. Numeric metric data stored in a project is visualized in charts and dashboards and evaluated by alerting policies. The metrics scope of a project controls which time-series data can be charted, and by default the scope is limited to time-series data stored by that project alone, while a project whose scope includes other projects can chart their data without moving it.

Continue with this study guide: Collecting performance information in Google Cloud

About the Professional Cloud DevOps Engineer exam

Professional Cloud DevOps Engineer exam domains

Exam Study Guide

Google Cloud Professional Cloud DevOps Engineer

About the Professional Cloud DevOps Engineer exam

Professional Cloud DevOps Engineer at a glance

Professional Cloud DevOps Engineer exam domains

1Bootstrapping and maintaining a Google Cloud organization~20%

1.1Designing a CI/CD architecture stack in Google Cloud, hybrid, and multi-cloud environments

1.2Managing multiple environments (e.g., staging, production)

1.3Enabling secure cloud development environments

1.4Designing the overall resource hierarchy for an organization

1.5Managing infrastructure

2Building and implementing CI/CD pipelines, including continuous testing, for application, infrastructure, and machine learning workloads~25%

2.1Securing the deployment pipeline

2.2Designing pipelines

2.3Implementing and managing pipelines

2.4Managing pipeline configuration and secrets

3Applying site reliability engineering practices~18%

3.1Balancing change, velocity, and reliability of the service

3.2Managing service lifecycle

3.3Mitigating incident impact on users

4Implementing observability practices and troubleshooting issues~25%

4.1Troubleshooting issues

4.2Managing metrics, dashboards, and alerts

4.3Managing and analyzing logs

4.4Instrumenting and collecting telemetry

4.5Capturing and analyzing distributed traces

5Optimizing performance and cost~12%

5.1Implementing FinOps practices for optimizing resource utilization and costs

5.2Collecting performance information in Google Cloud

Equivalent exams at other providers

Google Cloud Professional Cloud DevOps Engineer

About the Professional Cloud DevOps Engineer exam

Professional Cloud DevOps Engineer at a glance

Professional Cloud DevOps Engineer exam domains

1Bootstrapping and maintaining a Google Cloud organization~20%

1.1Designing a CI/CD architecture stack in Google Cloud, hybrid, and multi-cloud environments

1.2Managing multiple environments (e.g., staging, production)

1.3Enabling secure cloud development environments

1.4Designing the overall resource hierarchy for an organization

1.5Managing infrastructure

2Building and implementing CI/CD pipelines, including continuous testing, for application, infrastructure, and machine learning workloads~25%

2.1Securing the deployment pipeline

2.2Designing pipelines

2.3Implementing and managing pipelines

2.4Managing pipeline configuration and secrets

3Applying site reliability engineering practices~18%

3.1Balancing change, velocity, and reliability of the service

3.2Managing service lifecycle

3.3Mitigating incident impact on users

4Implementing observability practices and troubleshooting issues~25%

4.1Troubleshooting issues

4.2Managing metrics, dashboards, and alerts

4.3Managing and analyzing logs

4.4Instrumenting and collecting telemetry

4.5Capturing and analyzing distributed traces

5Optimizing performance and cost~12%

5.1Implementing FinOps practices for optimizing resource utilization and costs

5.2Collecting performance information in Google Cloud

Equivalent exams at other providers

Designing a CI/CD architecture stack in Google Cloud, hybrid, and multi-cloud environments

Managing multiple environments (e.g., staging, production)

Enabling secure cloud development environments

Designing the overall resource hierarchy for an organization

Managing infrastructure

Securing the deployment pipeline

Designing pipelines

Implementing and managing pipelines

Managing pipeline configuration and secrets

Balancing change, velocity, and reliability of the service

Managing service lifecycle

Mitigating incident impact on users

Troubleshooting issues

Managing metrics, dashboards, and alerts

Managing and analyzing logs

Instrumenting and collecting telemetry

Capturing and analyzing distributed traces

Implementing FinOps practices for optimizing resource utilization and costs

Collecting performance information in Google Cloud

Designing a CI/CD architecture stack in Google Cloud, hybrid, and multi-cloud environments

Managing multiple environments (e.g., staging, production)

Enabling secure cloud development environments

Designing the overall resource hierarchy for an organization

Managing infrastructure

Securing the deployment pipeline

Designing pipelines

Implementing and managing pipelines

Managing pipeline configuration and secrets

Balancing change, velocity, and reliability of the service

Managing service lifecycle

Mitigating incident impact on users

Troubleshooting issues

Managing metrics, dashboards, and alerts

Managing and analyzing logs

Instrumenting and collecting telemetry

Capturing and analyzing distributed traces

Implementing FinOps practices for optimizing resource utilization and costs

Collecting performance information in Google Cloud