[NEW] GCP Professional Cloud Architect | Exam Prep

This lecture covers the fundamental mindset shift from cloud operator to cloud architect. You'll learn how PCA exam questions differ from ACE, why architects focus on trade-offs and business context rather than procedures, and how to start thinking in terms of design decisions rather than implementation steps.

This lecture introduces the six pillars of the Google Cloud Well-Architected Framework: Operational Excellence, Security, Reliability, Performance Optimization, Cost Optimization, and Sustainability. You'll learn how the framework is woven throughout every PCA exam objective and how to use it as a decision-making lens for every architectural choice.

Understand the Operational Excellence pillar of the Google Cloud Well-Architected Framework and learn how architects design systems that are easy to change, observe, and recover.

Understand the Security, Privacy, and Compliance pillar of the Google Cloud Well-Architected Framework and learn how architects design layered defenses that protect data at every level.

Understand the Reliability pillar of the Google Cloud Well-Architected Framework and learn how architects design systems that recover fast, eliminate single points of failure, and scale without breaking.

Understand the Performance Optimization pillar of the Google Cloud Well-Architected Framework and learn how architects design systems that deliver the right performance — consistently, at scale, and without waste.

This lecture covers the Cost Optimization pillar of the Well-Architected Framework. You'll learn how to right-size resources, use committed use discounts and Spot VMs strategically, apply storage lifecycle policies, and shift from a CapEx to OpEx mindset — treating cost as an architectural constraint from the start, not an afterthought.

Understand the Sustainability pillar of the Google Cloud Well-Architected Framework and learn why efficient architecture and sustainable architecture are the same thing — and how architects make carbon-aware decisions from day one.

Learn how to identify the business use case driving any cloud scenario — revenue growth, cost reduction, compliance, or speed to market — and use it to filter every architectural decision that follows.

Learn how to define measurable success criteria before making any architectural decision — and how KPIs and ROI connect business goals directly to Google Cloud service choices.

Learn the distinction that drives most architectural decisions — and why identifying non-functional requirements and constraints early is the difference between a system that works and one that works well.

Learn to define and apply the five reliability metrics every architect must know — SLI, SLO, SLA, RTO, and RPO — and understand how each one drives a concrete design decision.

Learn the trade-off triangle every architect must reason through — and how to apply it to real Google Cloud decisions involving databases, compute, and storage.

Learn the four workload disposition strategies every architect applies before a migration — and how to anchor each decision in business value rather than technical habit.

Learn the four integration patterns every architect applies when connecting Google Cloud to external systems — and the decision rule that determines which one to use.

Learn the three architectural decisions that determine whether your observability tools will actually be useful — before a single alert fires.

Learn how to layer multiple security controls across identity, network, data, and visibility so that no single failure exposes your entire system.

Understand the three states of data, how Google Cloud protects each by default, and when architectural decisions around key control and Confidential Computing come into play.

Learn the difference between Google-managed, customer-managed, and customer-supplied encryption keys — and when compliance or data revocation requirements should drive your choice.

Create a Cloud KMS key ring and encryption key, attach it to a Cloud Storage bucket, and experience crypto-shredding firsthand by disabling the key and observing the result.

Learn why hardcoded credentials are an architectural anti-pattern and how to design secure, auditable, rotatable secret management into your applications using Secret Manager.

Learn how service perimeters add a boundary-based security layer on top of IAM to prevent data exfiltration from managed services like BigQuery and Cloud Storage — even when credentials are valid.

See VPC Service Controls in action — create a service perimeter, watch it block unauthorized access, and configure an ingress rule to restore legitimate traffic.

Learn how to enforce consistent network security across your entire organization with hierarchical firewall policies, and how to grant access based on user context — not just identity — using Access Context Manager.

Learn how Identity-Aware Proxy replaces VPNs with identity-based access control for web applications and VMs, and why it is the architectural foundation of zero-trust remote access on Google Cloud.

Deploy a Cloud Run service, enable Identity-Aware Proxy in one command, and watch unauthorized users get blocked — no VPN, no load balancer required.

Learn how Chrome Enterprise Premium extends zero-trust security beyond identity verification to device posture, data loss prevention, and threat protection — and when it is the right architectural choice over IAP alone.

Learn how Workload Identity Federation eliminates service account keys by allowing workloads on AWS, Azure, GitHub Actions, or on-premises to authenticate to Google Cloud using short-lived tokens.

Learn how architects use Binary Authorization, Artifact Registry, SLSA, and Artifact Analysis to build a verifiable chain of trust from source code to production — and why this is a growing focus on the PCA exam.

Learn how architects use Model Armor and Sensitive Data Protection to secure generative AI applications — blocking prompt injection, preventing PII leakage in both directions, and enforcing consistent safety policies across any AI model.

Learn how architects translate GDPR, HIPAA, PCI-DSS, and data sovereignty laws into concrete Google Cloud design decisions using Assured Workloads, resource location policies, and key management controls.

Learn how Google Cloud's industry certifications — SOC 2, ISO 27001, and others — work under the shared responsibility model, and how Cloud Audit Logs give architects the evidence trail that auditors and regulators require.

Walk through a real exam-style security scenario connecting IAM, VPC Service Controls, encryption, Workload Identity Federation, Binary Authorization, audit logging, and compliance controls into one cohesive architecture decision.

Master the architect's decision framework for choosing Compute Engine VMs — when VMs are the right answer, which machine family fits your workload, and what trade-offs come with that choice.

Learn when physical hardware isolation is required — covering compliance, BYOL licensing, performance isolation, and the architectural trade-offs of Sole-Tenant Nodes on Google Cloud.

Understand what Google Cloud VMware Engine is, when it makes architectural sense over a native cloud migration, and how it fits into a broader modernization strategy.

Learn how VM Manager gives architects centralized control over OS patching, inventory, and configuration compliance across large Compute Engine fleets — and why this is an architectural decision, not just an operational one.

Understand when and why architects design multi-cluster GKE environments, how fleets simplify managing them at scale, and what trade-offs come with adding cluster complexity.

Understand how StatefulSets manage stateful workloads in Kubernetes, how GKE's storage primitives support them, and the architectural decisions that determine whether a stateful workload belongs in GKE at all.

Learn when and why architects choose Cloud Run over GKE — covering the serverless model, scale-to-zero economics, and the key trade-offs for production workloads.

Deploy a container to Cloud Run from Artifact Registry — and understand the architectural decisions behind every configuration choice you make along the way.

Build a custom VPC with subnets in two regions — and learn the architectural decisions that guide every design choice an architect makes before writing a single command.

Connect your on-premises network to Google Cloud with high-bandwidth, private connections — and learn when to choose Interconnect over VPN.

Step-by-step lab walkthrough for setting up an HA VPN connection between two VPC networks in the same Google Cloud project. Covers gateway creation, peer gateway configuration, tunnel setup, BGP routing, and connection verification — following the exact current Google Cloud console UI.

Hands-on verification of the HA VPN connection built in the previous lecture. We deploy a lightweight VM in each VPC, create firewall rules to allow traffic across the tunnel, and ping between the two networks using internal IP addresses to prove the encrypted connection is working end-to-end.

Keep your VMs off the public internet while still reaching Google APIs and services — and learn when Private Google Access is not enough.

GKE networking is not just Kubernetes networking. Learn how GKE integrates deeply with your VPC — and why the decisions you make at cluster creation time are very hard to undo.

Most enterprise workloads don't live entirely in one place. Learn the patterns architects use to connect on-premises data centers and multiple clouds into a coherent, secure network.

Your VPC firewall controls who gets in. But what happens when a threat slips through? Learn how Cloud Armor and Cloud IDS form your network's last line of defense.

Put everything together. Walk through a real architect-level decision: designing a multi-region network that is resilient, globally performant, compliant, and cost-aware.

Learn how Google Cloud Storage works as a foundational data layer - buckets, objects, metadata, flat namespace, and why object storage scales where file systems fail.

Choose the right storage class — Standard, Nearline, Coldline, or Archive — based on access frequency, minimum duration rules, and cost trade-offs. Includes Autoclass.

Create a Cloud Storage bucket in the Google Cloud Console, configure access and soft delete settings, and practice uploading files and folders.

Learn how to secure Cloud Storage using IAM roles and Signed URLs — and why Uniform Bucket-Level Access is the architectural standard over legacy ACLs.

Automate storage class transitions and object deletion using Lifecycle Management rules — and learn why automation avoids early deletion fees that manual moves trigger.

Protect against accidental deletions and overwrites with Object Versioning, and enforce compliance requirements with Retention Policies (Bucket Lock).

Move large datasets into Google Cloud Storage using Storage Transfer Service for network-based migrations and Transfer Appliance for offline petabyte-scale transfers.

Learn how Filestore provides a fully managed NFS file system for Linux VMs and GKE clusters — and when to choose Zonal versus Regional tiers for your workload.

Explore Google Cloud NetApp Volumes — the enterprise-grade storage solution supporting SMB for Windows workloads, Active Directory integration, and SAP HANA deployments.

Build a decision framework for selecting Cloud Storage, Filestore, NetApp Volumes, or Persistent Disk — and learn how real architectures combine all storage types together.

Learn how to choose the right Google Cloud database by applying four architectural decision criteria — covering relational vs. NoSQL families, and when to use Cloud SQL, Spanner, AlloyDB, Firestore, Bigtable, and Memorystore.

Learn when to choose Cloud SQL for MySQL, PostgreSQL, or SQL Server workloads - covering managed service benefits, editions, vertical scaling, and the storage limits that signal when to graduate to Spanner.

Understand the architectural difference between High Availability and Read Replicas in Cloud SQL — and how to choose the right pattern for zone fault tolerance, read scaling, and cross-region latency reduction.

Understand when and why to choose Cloud Spanner over Cloud SQL — covering horizontal scaling with nodes and processing units, TrueTime-based external consistency, multi-region availability, and SQL dialect selection.

Learn when to choose Firestore as your document database — covering collections and documents, Native vs. Datastore mode selection, real-time sync, offline support, and the pricing model architects need to understand.

Learn when to choose Cloud Bigtable for high-throughput, petabyte-scale workloads — covering its compute-storage separation architecture, linear scalability, row key design principles, and HBase and Cassandra API compatibility.

Learn when and how to use Cloud Memorystore in your architecture — covering Redis, Memcached, and Valkey engine selection, caching patterns, tier and scaling decisions, and VPC networking constraints.

Design a complete data protection strategy with Cloud SQL — covering automated backups, Point-in-Time Recovery, restore behavior, and cross-region replica promotion for regional disaster recovery.

Compare backup and recovery capabilities across Cloud SQL, Spanner, AlloyDB, Firestore, and Bigtable — and learn how to design a DR strategy that maps RPO and RTO requirements to the right database backup model.

Learn how to architect a database migration to Google Cloud — covering homogeneous vs. heterogeneous migration patterns, Database Migration Service, Change Data Capture, and how to choose the right approach based on downtime tolerance and target database.

Learn how architects design for data growth — covering TTL policies, garbage collection, tiered storage strategies, database scaling signals, and compliance-driven retention across GCP database services.

A consolidated recap of every lecture in this section — covering database selection decisions, Cloud SQL HA and DR patterns, Spanner, Firestore, Bigtable, AlloyDB, Memorystore, backup strategies, migration patterns, and data lifecycle management. Ideal for quick review before your exam or when you need a refresher without rewatching full lectures.