[NEW] GCP Associate Cloud Engineer Certification Training

Build a secure, cost-controlled Google Cloud workspace by configuring resource hierarchy, policy inheritance, organization policies, Cloud Identity, and billing alerts.

Explore the GCP resource hierarchy—from organization to folders, projects, and resources—and learn how policy inheritance governs permissions and billing, enabling least-privilege access.

Create your first Google Cloud project in the console, pick a location, and learn the difference between project name, permanent project ID, and the 30-day recovery.

Set centralized guardrails with organization policies to limit resource configurations across your Google Cloud environment, and enforce constraints with policy inheritance.

Apply the resource location restriction policy to a project, grant the Organization Policy Administrator role, and test by creating a VM to see location-based filtering in action.

Enable Google Cloud APIs for your project using the API library, then activate services like Cloud Build to unlock compute and storage capabilities and monitor enabled APIs.

Discover Cloud Identity to manage who can access your Google Cloud resources, then create users and groups and assign permissions via IAM in the Google Cloud Console.

Master day-to-day user and group management in the Google admin console by resetting passwords, suspending and deleting accounts with data transfer, and adding members while promoting managers.

Use Cloud Asset Inventory as the single source of truth for all Google Cloud resources. Explore the resources tab with filters and leverage Gemini for plain-English, step-by-step guidance.

Understand how a cloud billing account, separate from projects, defines payments, tracks costs per project and per service with labels, enabling detailed cost attribution.

Verify your new project is linked to the correct billing account in the Google Cloud billing console, using Account Management to confirm or change the linkage.

Set up budgets and alerts to proactively manage cloud costs, noting budgets do not stop services; use scope, amount, and thresholds, and trigger programmatic actions via pub/sub and Cloud Run.

Create your first Google Cloud budget in the console by defining scope, setting a monthly amount, and configuring 50%, 90%, and 100% alert thresholds with email notifications.

Set up a BigQuery billing export to capture detailed usage cost data, enabling SQL-based, resource-level analysis of cloud spending with forward-looking data that arrives after setup.

Learn how Google Cloud quotas protect you and the platform, focusing on allocation and rate quotas, how to view them, and how to request increases.

Organize projects into development and production folders and apply the organization policy compute.vm external IP access denying in the production folders, leveraging policy inheritance for scalable guardrails.

Explore the GCP resource hierarchy—organization, folders, projects, and resources—and policy inheritance and organization policies that govern access with IAM, plus budgeting and billing exports to BigQuery.

Master IAM fundamentals to secure your cloud by applying least privilege, mastering principles, policies, and the golden rule, configuring basic, predefined, and custom roles, and managing service accounts and impersonation.

Identify who can do what on which resource in Google Cloud by binding principals users, groups, or service accounts to roles through allow policies and role bindings, with inheritance.

Explore the three IAM role types—basic, predefined, and custom—demonstrating how predefined roles support least privilege and how custom roles offer granular control over permissions.

Demonstrates a hands-on IAM workflow in the Google Cloud console, granting the compute viewer role to enforce least privilege and illustrating risks of basic roles like editor.

Create a custom IAM role to grant only the permissions to start and stop existing compute engine instances, assign it to a junior developer, and verify least privilege access.

Define least privilege as granting only the minimum permissions for users and services. Limit blast radius in Google Cloud via predefined and custom roles and service accounts.

Explore how service accounts act as non-human identities in Google Cloud, granting least-privilege access to resources inside or outside the cloud, and differentiate user-managed versus Google-managed accounts.

Learn to create a custom service account, grant least-privilege storage object creator rights, attach it to a Compute Engine virtual machine, and verify permissions with ssh, gcloud, and gsutil.

Secure service accounts by managing keys and permissions, applying least privilege, rotating keys, using secret manager, and monitoring with audit logs to detect compromised access.

Master service account impersonation to replace long-lived keys with short-lived credentials, using the IAM service account token creator role for auditable, secure access.

Learn to securely impersonate a service account to access a bucket by granting the service account token creator role. Test access and download a file with gsutil.

Manage service accounts at scale by creating with purpose, clear naming, and least-privilege through impersonation. Monitor with IAM recommender and audit logs, and retire accounts using a disable-then-delete lifecycle.

Apply Google Cloud security concepts with IAM, roles, and policies under the principle of least privilege, and create a custom role granting only compute instances start, stop, and get permissions.

Learn identity and access management in Google Cloud, focusing on principals, roles, and policy, least privilege, and predefined or custom roles, with secure service accounts and impersonation.

Explore Google Cloud Compute Engine by provisioning Linux and Windows VMs, securing access with SSH and RDP, and mastering storage, snapshots, and disaster recovery via VM Manager.

Explore Google Compute Engine, Google Cloud's infrastructure-as-a-service for creating virtual machines with custom machine types and persistent disks. Learn use cases and the concept of Spot VMs.

Launch a Linux Compute Engine instance in the Google Cloud Console. Use preset E2 medium or custom options, configure the boot disk and http/https firewall, and note snapshots or backups.

Launch a Windows Server 2022 data center with Desktop Experience on Google Cloud, note licensing costs and a 50 gigabyte boot disk, plus RDP access on port 3389.

Demonstrate secure connections to Linux and Windows VMs in Google Cloud Compute Engine using in-browser SSH and RDP, generate temporary SSH keys, set Windows passwords, and manage IAM permissions.

Explore how spot VMs leverage Google's spare capacity to deliver the same performance at discounts up to 91%, with a 30-second preemption warning for fault-tolerant, stateless workloads.

Launch a spot VM in Google Cloud Compute Engine, set provisioning model to spot with stop termination, and test preemption by stopping and restarting to confirm persistence on persistent disk.

Explore Google Cloud virtual machine storage through persistent disks and Hyperdisk, comparing standard, balanced, solid state drive, and extreme options, and learn zonal versus regional availability for durable, scalable performance.

Attach a new persistent disk to a running Linux virtual machine in US Central 1C, format and mount it, then resize the file system to use the added space.

Use snapshots for backup and disaster recovery of persistent disks, and use images to rapidly create new VM instances from public or custom blueprints.

Protect cloud virtual machines by creating a boot disk snapshot, performing a point-in-time backup, simulating a disaster, and restoring the VM to recover data.

Automate backups with snapshot schedules that define frequency and start time, enforce retention, and automatically delete old snapshots, while attaching schedules to regional persistent disks.

Automate patch management and enforce consistent software configurations across large fleets of Compute Engine VMs with VM Manager, OS policies, and the OS config agent for security and compliance.

Centralizes Linux VM access by using OS login with IAM roles, replacing manual SSH keys and enabling two-step verification for secure, auditable, scalable access.

Apply right-sizing to cloud compute by matching stateless, fault-tolerant rendering workloads with spot VMs and keeping the stateful licensing database on standard VMs to minimize costs with zero reliability risk.

Explore Compute Engine fundamentals for virtual machines in Google Cloud, covering VM types, disks, snapshots, firewall, Windows vs Linux, GPUs, TPUs, spot VMs, and automation features.

Learn to scale and automate Compute Engine with instance templates and managed instance groups, enabling auto-scaling, auto-healing, high availability through regional MIGs, and zero-downtime rolling updates.

Create identical virtual machines with instance templates, immutable blueprints available as global or regional resources, and use deterministic configurations for managed instance groups while considering security by using IDs.

Managed instance groups automate auto-scaling, auto-healing, and automatic updates across regional deployments, enabling scalable, highly available workloads with zonal or regional configurations and canary or rolling updates.

Create a web server instance template with a startup script and regional managed instance group, then enable auto-scaling to grow from two to five virtual machines at 60 percent cpu.

Configure a regional autoscaled managed instance group with auto-healing, health checks, startup scripts, distributing two VMs across zones for high availability and scalable capacity.

Explore autoscaling policies beyond CPU, using load balancer utilization, request volume, and Cloud monitoring metrics, including standard metrics via the Ops agent and custom metrics like PubSub queue length.

Design auto-scaling using scheduled, predictive, and reactive policies to fit predictable workloads and peak traffic, prioritizing availability while combining signals like CPU, load balancer, and custom metrics.

Explore how managed instance groups achieve high availability through auto-healing with application-based health checks, critical initial delay settings, and regional MIGs that distribute VMs across zones for fault tolerance.

Perform a rolling update on a MIG to upgrade from version 1 to version 2 by swapping instance templates one VM at a time, ensuring zero downtime.

Build a scalable web application with a global external application load balancer, a single static IP, and a regional auto-scaling, auto-healing MIG behind a backend service.

Deliver a resilient infrastructure as a service by using a regional managed instance group with http health checks and a 200-second initial delay to survive zone outages.

Leverage instance templates to create immutable vm configurations and drive scalable deployments with regional managed instance groups. Implement autoscaling, autohealing, and zero-downtime updates to ensure high availability across zones.

Master GKE fundamentals and container-based deployment, including pods, deployments, and services. Build end-to-end workflows—from Docker files and Artifact Registry to kubectl—deploying private clusters and live services.

Compare virtual machines and containers using a simple analogy to explain architecture, performance, and resource usage. Identify when to choose a VM versus a containerized service like GKE for workloads.

Compare containers and virtual machines to show speed, efficiency, and isolation. Explain when to use GKE or Compute Engine for cloud-native apps and legacy workloads.

Explore the core concepts of Kubernetes, including pods, deployments, and services, and learn how deployments manage replicas, self-healing, and rolling updates to keep apps running with zero downtime.

Explain how pods are ephemeral and how deployments manage replica pods, while a service provides a stable IP, DNS name, and internal load balancing, enabling self-healing and rolling updates.

GKE streamlines Kubernetes operations by providing a fully managed control plane and automated worker provisioning on Google Cloud, automating upgrades, scaling, and self-healing for pods and deployments.

Compare GKE standard and autopilot modes, detailing control plane management, worker nodes, node pools, autoscaling, and cost implications of over provisioning.

Explore GKE Autopilot's zero node management and pod-based billing versus standard's full control over node pools, machine types, GPUs, and scaling.

Deploy a GKE autopilot cluster in the cloud console, enabling the API, configuring DNS-based access, and connecting with kubectl to manage a serverless, highly available, managed cluster.

Deploy a regional GKE standard cluster with configurable node pools for high availability. Learn to set node counts per zone and choose upgrade strategies and provisioning options.

Deploy a regional google kubernetes engine standard cluster by configuring node images, machine types, and networking, then manage six nodes across three zones.

Discover how private GKE clusters isolate from the public internet with private nodes and a private control plane, using Cloud NAT and Private Google Access for Google services.

Explore how to configure private and public control plane endpoints for private GKE clusters, secure with authorized networks, and understand Cloud NAT and private Google access for safe networking.

Learn to use kubectl as the universal command line for Kubernetes, configure access with kubeconfig via gcloud get-credentials, and troubleshoot with kubectl describe to manage GKE clusters.

Master containerization with Docker to package an application and dependencies into portable containers that run identically on any host, then build your first Docker container with a Dockerfile.

Create a Flask web app with app.py and requirements.txt, build a Dockerfile using Python 3.11, build a container image with docker build, run the container, and prepare for Artifact Registry.

Learn how Artifact Registry replaces the older deprecated container registry, the gcr.io service, and stores Docker images and other artifacts in regional, multi-format repositories with IAM-based push and pull permissions.

Enable Artifact Registry, create a Docker repository, configure Docker authentication, tag the my-app image, and push it to Artifact Registry, then verify the image and digest.

Deploy your first container to a GKE cluster with kubectl create deployment using the full artifact registry image path, and learn how deployments manage pods.

Expose your hello-app with a load balancer service to reach users outside the cluster. Run kubectl expose deployment to assign ports 80 and 8080, then check the external ip.

Explore secure GKE networking by deploying private nodes with a Cloud NAT gateway to enable outbound internet access for updates, while keeping worker nodes invisible to the public internet.

Explore Google Kubernetes Engine to manage containers with pods, deployments, and services, compare containers to virtual machines, and learn autopilot versus standard modes for scalable deployment.

Learn to monitor and scale production-grade GKE workloads by diagnosing health with kubectl describe, resizing node pools, and configuring autoscaling, with secure access via Workload Identity Federation.

Learn to observe and troubleshoot your GKE cluster by inspecting nodes, pods, and services with kubectl, using get and describe commands, and reviewing events and allocatable resources.

Explore the pod as the smallest Kubernetes deployable unit and its health checks. Use kubectl get pods and kubectl describe pod to debug readiness, crashes, image issues, and events.

Explore how Kubernetes services provide a stable front end and expose apps via load balancer, cluster IP, and external IP, then inspect endpoints and selector with kubectl describe service.

Explore how GKE node pools organize a cluster into departments with identical configurations, enabling cost control, hardware distinctions, and auto-scaling for diverse workloads.

Learn how GKE node pools create GPU, batch, and memory-optimized pools alongside a default pool, and how node selectors and taints route workloads for heterogeneous clusters.

Learn to manage GKE standard clusters by adding a node pool, resizing it, and removing it, using different machine types for heterogeneous workloads.

Explore how the horizontal pod autoscaler scales out by adding pods to meet cpu utilization targets, and preview the vertical pod autoscaler to balance resources across deployments.

Understand horizontal and vertical pod autoscaling, right-sizing CPU and memory, and when to use HPA versus VPA—plus how recommendation-only VPA pairs with HPA for efficient deployments.

Explore how the horizontal pod autoscaler and the cluster autoscaler cooperate to handle traffic spikes in GKE, provisioning new nodes when pods become pending and scheduling them to run.

Explore how horizontal pod autoscaling and the cluster autoscaler resize pods and nodes to save costs, enable autoscaling through node pool settings, and compare standard versus autopilot GKE models.

Configure the hello app deployment with a horizontal pod autoscaler. Set min 1 and max 5 replicas and target CPU at 60%, and define resource requests so HPA can scale.

Configure the horizontal pod autoscaler using CPU metrics, set resource requests, verify with kubectl top pods, and enable the cluster autoscaler for elastic node scaling in GKE.

Learn how stateful sets provide stable network identity, stable persistent storage, and ordered deployment for stateful apps, with dynamic PVC provisioning on GKE to preserve data.

Enable secure access for specific GKE pods to Google Cloud APIs using workload identity federation for GKE, avoiding service account keys and broad node permissions.

Learn to securely access GCP services from GKE pods using workload identity federation, binding a Kubernetes service account to a Google service account for seamless token exchange.

Discover how pods and nodes interact in a GKE standard cluster. Learn that the cluster autoscaler scales on pending pods, not on node CPU utilization.

Learn to manage and scale GKE clusters with node pools, HPA, VPA, and cluster autoscaler, and deploy stateless deployments and stateful sets with workload identity.

Learn serverless computing with Cloud Run, turning containers into global, scalable web services in seconds, with zero-to-scale, traffic management, canary releases, event-driven computing via event arc, and side-by-side compute comparisons.

Discover how Cloud Run turns stateless containers into scalable, secure HTTPS services in seconds, with fully managed serverless infrastructure, auto scaling to zero, and pay-per-use pricing.

Deploy a container to Cloud Run from Artifact Registry, configure region and public access, enable scale to zero, and expose an HTTPS endpoint on port 8080 in a serverless workflow.

Explore how Cloud Run uses immutable revisions to snapshot a service and enable zero-downtime updates. Use traffic splitting for canary rollouts, and perform quick rollbacks if issues arise.

Learn to deploy a new cloud run revision, test with zero traffic, perform a canary release with a 90-10 split, monitor health, and rollback instantly if issues arise.

Cloud Run auto-scaling creates container instances automatically and scales to zero when idle, with configurable minimum and maximum instances to balance latency and cost.

Learn how Cloud Run autoscaling adjusts container instances based on traffic, using minimum and maximum instances and concurrency to balance I/O bound and CPU bound workloads.

Discover how Cloud Run functions enable event-driven compute by reacting to Cloud Storage, Pub/Sub, and Cloud Logging events. Learn to deploy small, single-purpose code that runs on events via Eventarc.

Deploy Cloud Run functions with a single code file and buildpacks that auto-wrap your code into a container. They glue storage, Pub/Sub, and other services to automate workflows.

Explore real-world Cloud Run functions use cases, including cloud storage triggered thumbnails, pub slash sub welcome emails, and real-time security alerts via cloud logging, all in an event-driven, decoupled pattern.

Build a Cloud Run function triggered by a Cloud Storage upload to power a thumbnail generator, using uploads and thumbnails buckets, a dedicated service account, and least-privilege permissions.

Configure a cloud run function named process-image that triggers on cloud storage uploads via event arc, using a custom service account and python 3.12, with inline code and dependencies.

Verify a Cloud Run function triggered by a Cloud Storage upload using event arc and a two-bucket pipeline. Troubleshoot with logs, permissions, and missing trigger checks.

Explore how Event Arc, a fully managed event routing service, connects providers to receivers using direct events and audit log triggers for Cloud Run, Cloud Storage, and more.

Compare VMs, GKE, and Cloud Run services and functions along a spectrum of management to decide the right compute option for each workload.

Compare compute options across VMs, GKE, and Cloud Run, highlighting when to choose Cloud Run services for stateless http apps scalable to zero, and Cloud Run functions for event-driven code.

Use Cloud Run service for the front-end API and Cloud Run function with Event Arc for the image processor; this serverless, scalable-to-zero setup bills only for execution.

Discover Cloud Run, a fully managed serverless platform for stateless containers. Scale to zero, deploy container images, set ingress and authentication, and use canary revisions.

Explore object storage with a shelf analogy, defining buckets, objects, and metadata in Google Cloud Storage, and explain flat and hierarchical namespaces, durability, availability, and unstructured data uses.

Create a Google Cloud bucket in a chosen region with standard storage, uniform bucket level access, and public access prevention; upload files and folders with soft delete seven days.

Master modern gcloud storage commands to create buckets, upload files, and sync data from the command line, including delete unmatched destination objects for exact mirrors.

Choose from standard, near-line, cold-line, and archive storage in Google Cloud to balance access needs and costs. Learn how location, auto-class, and minimum storage durations drive transitions and fees.

Secure cloud storage with IAM policies as the permanent guard and uniform bucket level access, then grant external users time-limited access via signed links for uploads or downloads.

Automate data lifecycle with object lifecycle management to move files across storage classes—from standard to nearline, coldline, and archive—or delete them based on age and other conditions.

Automate storage class transitions and old-version cleanup with lifecycle rules. Move nearline to coldline with setStorageClass to avoid early deletion fees, and delete non-live versions older than seven days.

Build and verify a lifecycle policy that moves data to Nearline after 30 days and deletes after 365 days, using Google Cloud Console, a lifecycle.json, and Cloud Shell commands.

Enable object versioning on a bucket to preserve previous files as non-current versions. This bucket-wide setting protects against overwrites and deletions by preserving and restoring specific generation numbers.

Learn how object versioning protects against accidental deletions and how retention policies enforce immutability for compliance. Use lifecycle management to auto-delete old versions and control storage costs with non-current versions.

Plan and execute large-scale migrations to Google Cloud Storage with Storage Transfer Service, a fully managed pipeline for cloud-to-cloud and on-premises transfers, offering incremental transfers and end-to-end checksum validation.

Learn to estimate cloud storage costs with the Google Cloud Pricing Calculator by analyzing data storage, processing, network usage, and replication for ace exam readiness.

Explore the waterfall cost-optimization strategy for cloud storage by applying a lifecycle policy that moves data from Standard to Nearline, Coldline, and Archive based on age.

Discover how Google Cloud Storage stores data as objects in buckets with 11 nines of durability, while you manage access, lifecycle, versioning, and cost for unstructured data.

Navigate the GCP database landscape by comparing relational and NoSQL options and mastering Cloud SQL, Spanner, Firestore, Bigtable, AlloyDB, and Memorystore, plus creating, securing, and backing up managed databases.

Cloud SQL provides a fully managed relational database service for MySQL, PostgreSQL, and SQL Server, with automatic backups, patches, vertical scaling, and storage auto-scaling.

Provision a fully managed Cloud SQL for MySQL instance, configuring storage, machine type, and automated backups and maintenance windows in the console.

Configure a Cloud SQL instance by selecting region and multiple zones for high availability, enabling automatic storage increases, and tuning machine, storage, connections, security, and data protection settings, including backups.

Explore configuring Cloud SQL with point-in-time recovery for high availability, using binary logs to restore to any moment within the retention period, and managing maintenance windows and storage settings.

Learn to safely delete a Cloud SQL MySQL instance by disabling deletion protection, adjusting data protection options, and confirming deletion with the instance ID in Cloud SQL.

Compare high availability and read replicas in Cloud SQL to balance reliability with performance, explaining standby failover, asynchronous replication, cross-region reads, and manual promotion.

Learn how Cloud SQL backups, point-in-time recovery, and cross-region read replicas deliver disaster recovery, with restoration always creating a new instance and promoting a replica as new primary.

Explore Cloud Spanner, a fully managed, globally distributed relational database that delivers strong consistency and ACID transactions with SQL support, scaling horizontally with nodes.

Explore Firestore, a managed serverless NoSQL document database with collections and documents, a flexible schema, real-time updates, and offline support. Compare native and data store modes and pricing by operation.

Bigtable is Google's fully managed, wide-column NoSQL database built for petabyte-scale analytics and ultra-fast throughput. It separates compute from storage for instant scaling and avoids hotspotting with smart row-key design.

Discover AlloyDB, a fully managed PostgreSQL-compatible database for demanding workloads. It uses disaggregated compute and storage with a built-in columnar engine to speed analytics on live data.

Explore Memorystore, Google's fully managed in-memory datastore service. Learn how Redis, memcached-d, and Valkey deliver sub-millisecond caching to speed sessions, leaderboards, and real-time data access while fronting your database.

learn to create a database, build a table, and insert records using Cloud SQL Studio, including authenticating with a dedicated user and running DDL and DML queries in the cloud.

Create a logistics_DB database and shipments table, insert sample rows, and run queries to practice DDL and DML, using Cloud SQL Studio and gcloud commands.

Compare automated backups, point-in-time recovery (pitr), storage locations, cross-region backups, and restore times across Cloud SQL, Spanner, Firestore, Bigtable, and AlloyDB for exam readiness.

Centralize monitoring for all Cloud SQL, Spanner, Firestore, Bigtable, AlloyDB, and Memorystore databases with Database Center's unified dashboard. Get health status, performance metrics, and cost insights across your portfolio.

Identify key cost drivers across Cloud SQL, AlloyDB, Spanner, Firestore, Bigtable, and MemoryStore, and apply right-sizing, single-zone deployments, read replicas, and caching to optimize costs.

For a global, relational ledger with strong external consistency and high write throughput, choose Cloud Spanner for SQL compatibility, global multi-region replication, and horizontal scaling.

Explore the GCP database landscape featuring Cloud SQL, AlloyDB, Spanner, Firestore, Bigtable, and Memorystore, and learn about backups, PITR, read replicas, HA, storage scaling, and regional versus global deployments.