Google Certified Professional Cloud Architect 2025

Explore the Google Cloud professional cloud architect certification, covering design and provisioning of secure, compliant cloud solutions, case studies, and exam topics on core services, IAM, monitoring, and reliability.

Explore cloud migration strategies through two case studies, TerramEarth and Dress4win, highlighting IoT data collection, data analysis, predictive maintenance, and cost-aware cloud adoption.

Log in to Google Cloud Platform to access a $300 free credit valid for 12 months, set up a billing account, and explore services in the console.

Explore regions and zones as independent geographic areas hosting data centers worldwide to reduce latency, improve availability, and secure data at rest and in transit with renewable-energy powered facilities.

Explore Google's global network backbone, including fiber optic links, submarine cable investments, and the point of presence that connects data centers and CDN locations, with premium charges for cross-region data.

Explore Google Cloud Platform services, from compute, storage, networking, and databases to identity, security, big data and machine learning; discover no-ops platforms, management tools, and API management with Apigee.

Explore the three interfaces to Google Cloud Platform: the web console, command line tools like gcloud, and API client libraries, plus how to enable APIs and use cloud shell.

Explore identity and access management in Google Cloud Platform, learn to create and assign granular permissions and rules to users, groups, or service accounts across organization, folders, and projects.

Learn how to create and manage a GCP billing account, link projects to a single billing account, set budgets and alerts, change payment methods, and generate billing reports.

Learn how quotas control resource usage in Google Cloud, including global, project, and region quotas, and how to request increases or upgrade accounts, with hard limits like VPC peering.

Explore Google cloud infrastructure services for resource management, access controls, monitoring with Stackdriver, logging, tracing, and deployment management using infrastructure as code to deploy repeatable configurations.

Install the Google Cloud SDK on your laptop to access gcloud, Cloud Shell, and built-in client libraries for storage and APIs.

Explore Google Cloud Platform development tools, including Cloud SDK, Cloud Shell, Cloud Storage, and bq for queries, plus Cloud Source Repositories and plugins for Android and Firebase deployments.

Google Compute Engine offers a flexible virtual machine service on Google Cloud, enabling on-demand sizing, autoscaling, GPUs, and secure, customizable CPU, memory, and storage options.

Explore Compute Engine basics with a live Linux VM demo, covering instance details, networking, disks, SSH access, monitoring, and management tasks like start, stop, delete, and permissions.

Explore Google compute engine machine types, from general purpose to custom configurations, across N1, N2, and C3 generations with per CPU memory. Understand CPU architectures and GPU requirements, including drivers.

Explore compute engine disks, snapshots, and images to optimize storage choices. Compare local ssd, zonal and regional persistent disks, file storage in nfs, ram disk, and custom and public images.

Discover container optimized OS for compute engine. Run containers out of the box with pre-installed docker and automatic weekly updates, while offering a locked-down, small attack surface.

Learn how instance templates define machine type, image, startup script, disks, and metadata for use by managed instance groups, enabling autoscaling, autohealing, rolling updates, and high availability with load balancers.

Learn how sole tenancy reserves dedicated hardware using node groups and node templates, with CPUs, RAM, local ssd, and optional GPUs for gaming, finance, healthcare, and ml workloads.

Explore Google Compute Engine pricing, including per-second disk charges, snapshot costs, geography-based pricing, and up to 80% discounts on preemptible VMs, sustained use, and committed use.

Protect Google Cloud workloads with shielded VM and confidential computing by securing boot with titan-chip TPM and integrity monitoring, while enabling in-memory protection on AMD EPYC processors.

Learn to create and configure Linux virtual machines in Google Compute Engine, selecting regions and zones, choosing machine types, disk images, and SSH access with cost-conscious options.

Understand Google Cloud load balancers: external global and regional HTTP/HTTPS, TCP, and UDP types with proxy or pass-through modes, anycast IPs, and Cloud Armor protection.

Demonstrates configuring a Google Cloud HTTP load balancer with regional instance templates and groups, health checks, and auto scaling to route traffic across Asia, Europe, and US West.

Learn how to clean up a Google Cloud HTTP load balancer by deleting the load balancer, then the instance group and its associated instances.

Explore how Google App Engine organizes apps into services, each with multiple versions and instances, and learn traffic splitting, scaling options, and basic monitoring and pricing.

Explore App Engine traffic splitting to deploy a new version, gradually migrate traffic from old to new using IP, cookie, or random splits, and complete the cutover.

Explore App Engine's flexible environment, running your own containers and bringing your own language. Compare it to the standard environment, noting VM access, weekly patches, and region-based deployment.

Explain the App Engine standard environment as a sandbox with predefined runtimes and App Engine API, enabling scalable, secure isolation and deployment from Cloud SDK. Manage via Google Cloud Console.

Learn how the app.yaml deployment file configures App Engine standard and flexible environments, covering service name, scaling, memory, disk size, and instance limits.

Enable the App Engine security scanner, configure firewall rules to allow or deny traffic, run scans, and use logs, tracing, and reporting to debug and examine the source code.

Discover how Google Cloud Kubernetes Engine manages containerized microservices with master and worker nodes, API server, scheduler, controllers, pods, deployments, services, namespaces, and autoscaling.

Learn how to practice Kubernetes engine locally with Minikube, deploying nginx via kubectl, scaling replicas, and inspecting pods, while noting differences from cloud deployments on GCP.

Launch a standard Kubernetes cluster, choose zone or region and a Kubernetes version, then configure node pools, autoscaler, and blue-green upgrade strategies while deploying and exposing an nginx workload.

Explore pods, deployments, and replica sets in Kubernetes engine, learn how containers define resource requests and limits, and use init containers for prechecks and startup housekeeping.

Learn how Kubernetes uses labels as key-value pairs to identify and group objects, and apply equality and set-based selectors, such as environment=production and accelerator=Nvidia Tesla P100, to filter resources.

Explore the Kubernetes engine lifecycle by performing rolling updates on a deployment, updating container images, and practicing rollback using kubectl rollout history and undo to specific revisions.

Explain how ingress and ingress controller expose http and https routes from outside the cluster, route traffic to multiple services with routing rules, and use NGINX controller in GKE.

Explore Kubernetes networking, including container-to-container, pod-to-pod across nodes using flannel, and pod-to-service with CIDR-based addressing, plus ingress and load balancer for external access.

Explore how Anthos unifies on-prem and cloud environments, enabling multi-cluster management, service mesh, configuration and policy governance, and seamless connectivity via cloud interconnect and APIs.

This cloud function demo guides you through creating a function, uploading or sourcing code from cloud storage, configuring triggers, and testing with input data while adjusting memory and timeout settings.

Describe how Cloud Run uses container instances and a concurrency value to scale traffic, including spin-up behavior, latency, and the associated cost tradeoffs.

Discover cloud run fully managed mode, scaling to zero or up to 1000 containers with no provisioning, plus pricing and free-tier limits.

Cloud Run for Anthos lets you deploy a container as a service on Kubernetes, whether on premises or inside VMs, with configurable machine types and memory constraints.

Explore how Google container engine orchestrates clusters, pods, and deployments. Compare App Engine and Cloud Function use cases for scalable, event-driven workloads.

Navigate Google Cloud data and storage services, from Cloud SQL and Spanner to Bigtable and Datastore, and from BigQuery to Dataflow and Dataproc.

Discover Cloud SQL basics for MySQL, PostgreSQL, and SQL Server on Google Cloud, with managed instances, backups, encryption, and availability. Explore performance factors like storage type, IOPS, and read replicas.

Explore Cloud SQL for MySQL, a managed MySQL instance on Google Cloud Platform with encryption at rest and in transit, SSL, replication across zones, import/export, and backups with point-in-time recovery.

Learn how Cloud SQL backups work with automatic and on-demand backups, create and restore backups using seed backups, adjust backup windows, and explore point-in-time recovery and logging for reliability.

Learn high availability in Cloud SQL through synchronous replication to a primary, create failover and read replicas, and enable automatic switchovers across zones in the same region.

explore read replicas in cloud sql to offload read queries from the primary. create replicas across zones, understand lag in replication, and promote a replica to master when needed.

Learn Cloud SQL pricing by selecting machine types and configurations, understanding generation-based charges and egress fees within or across regions. Labs guide you to delete instances to avoid charges.

Explore a hands-on PostgreSQL demo in Google Cloud, creating and managing a cloud instance with machine type, IOPS, maintenance windows, passwords, and basic network settings.

Create and configure a cloud storage bucket with multi regional or dual region locations, standard storage class, fine grained access control, and enable versioning, retention, encryption, and observability.

Explore cloud storage security concepts such as IAM and IAM conditions, ACLs, signed URLs and policies, uniform bucket level access, and project versus bucket level permissions, with object-level controls.

Explore signed URLs, policy documents, and condition-based access to cloud storage; implement uniform bucket access, disable public access, and enforce IAM conditions for time-limited permissions.

Move data from on-premises or other clouds to Google Cloud using the storage transfer service, cloud-to-cloud transfers, and optional transfer appliances; manage jobs via the Google Cloud Console or API.

Describe server side and client side encryption in Google Cloud storage, with Google managed keys or KMS/CSK. Explain bucket lock, retention policy, and admin and data access logs for monitoring.

Explore Google persistent disk, a network storage for virtual machines that supports dedicated or read-only shared disks, online scaling, snapshots, encryption, and cost-effective performance options.

Explore Cloud Firestore in Datastore mode, a backward-compatible, strongly consistent storage layer that extends Datastore with real-time updates, offline features, and increased scalability for mobile and web apps.

Compare two pricing mechanisms for Cloud Firestore: document storage and data storage, with rates such as 18 cents per 100,000 documents and 18 cents per GB per month.

Learn BigQuery best practices for query performance and cost control, including bytes read, bytes passed to each stage, and partitioning for targeted data.

Understand cloud IAM in BigQuery by managing dataset permissions and job creation with dataset reader, writer, and owner roles, without provisioning any hardware.

Master the basics of Google Cloud Dataproc by launching Spark and Hadoop clusters, configuring master and worker nodes, and integrating with other cloud services for scalable, cost-efficient analytics.

Learn to customize cloud dataproc clusters by enabling or disabling features, selecting a gateway, choosing an image version, and adding optional components like Zookeeper, Presto, Druid, and Jupyter.

Learn cloud dataproc storage options, including persistent disk, local ssd, and cloud storage backups, and how data durability and backups affect node failures and data shuffling.

Explore how to submit a Dataproc job on a chosen cluster, run Spark jobs with a main jar, and understand the difference between Dataproc and Dataflow jobs.

Explore Cloud Dataproc workflows to design and execute directed acyclic graphs with dependencies, using templates, managed or existing clusters, and parameterized, gcloud-driven automation.

Explore Cloud Dataproc pricing and how it maps to compute engine configurations, with standard pricing varying by usage, then learn cluster, operations, workflow templates, and jobs.

Delete the Dataproc cluster on Google Cloud Platform to save your $300, releasing all computing resources. Select the cluster, choose delete, and confirm to complete the cleanup.

Understand cloud bigtable architecture: clients connect to front-end pools; nodes store metadata while data sits in the Colossus file system as SSTables, with automatic node balancing.

Learn the basics of schema design for columnar storage rooted in the Bigtable foundation, with one index per table, single-row entities, and adjacent rows for related data.

Explore soft and hard quotas for Google Cloud Bigtable, including recommended limits on rows, column families, qualifiers, and cell sizes, plus maximum tables per cluster.

Understand how Cloud Bigtable pricing characteristics change with configuration choices, including node count (single vs multi-node development clusters), region, storage such as SSD or HDD, and ingress/egress fees.

Explore Cloud IAM for Bigtable, detailing instance and cluster permissions, admin-related permissions, and roles such as Bigtable administrator, readers, and writers, plus custom rules.

Explore Cloud Dataflow, the Apache Beam implementation on Google Cloud Platform, a managed service to deploy and run pipelines for stream and batch processing to data tables and BigQuery.

Learn the Google Cloud Platform Dataflow quotas and limits, including compute engine instances, data upload, monitoring requests, and shuffle slots, and know when to use Dataflow versus data proc.

Discover how Google Cloud Dataflow pricing works, with per-second billing based on actual usage of batch and streaming jobs, memory, storage, and data processed, and how compute resources drive charges.

Create and publish to a Cloud Pub/Sub topic, then create a subscription to pull messages with acknowledgment and retention settings; explore snapshots and cloud storage notifications.

Explore data with cloud data lab, an interactive notebook-based tool for exploration, analysis, and machine learning that integrates with BigQuery, data flow, and visualizations.

Explore Google Cloud networking products, including global VPC with subnets, load balancing, Cloud DNS, VPN and Cloud Interconnect, and Cloud CDN, with emphasis on logs, security, and low-latency connectivity.

Explore the three VPC types, including default auto mode VPCs with precreated subnets and firewall rules, and custom VPCs with user-defined subnets, IP ranges, and routing.

Explore how projects host VPC networks, with a default VPC and up to five networks per project. Learn to plan for global networks, inter-network traffic, and internet egress charges.

Discover how external IP addresses in Google Cloud expose VMs to the internet. Learn to reserve or release static IPs, and differentiate them from internal IPs while managing cost implications.

Learn how VPC peering connects multiple networks across or within projects, with exclusive IP ranges, non-transitive routing, quotas on peering and VMs, and the shared VPC model for centralized management.

Explore vpc flow logs to understand how traffic flows, enabling network monitoring and real-time security analysis, and optimize expenses by exporting logs to a supported destination or cloud storage.

VPC pricing bills only egress traffic, not network creation, with standard and premium tiers. Premium routes traffic via Google fiber for lower latency, while standard uses public internet.

Recap core GCP VPC concepts: networks and subnets, global networks and region-specific subnets, default and custom networks, firewall rules, routes, and internal and external IP addresses with egress traffic.

Learn hybrid connectivity between your data center and Google Cloud Platform using cloud interconnect, cloud VPN, and peering, with direct, partner, and internet options for secure, low-latency data exchange.

Explore cloud router demos, configure VPN gateways and tunnels, and test dynamic routing with BGP to connect subnets across Europe west and Asia east.

Explore cloud interconnect and vpn options for connecting on-premises to Google Cloud, including dedicated interconnect, partner interconnect, and IPsec VPN with Cloud Router, plus DNS and CDN caching and pricing.

Explore cloud identity and access management on Google Cloud Platform, from primitive access rules to fine-grained service accounts, highlighting advanced concepts and features essential for security engineers.

Explore cloud IAM basics, defining identity and access management, primitive and fine-grained roles, organization policies, and audit trails to control enterprise-scale access across resources from organization to project.

Assign roles to users to grant permissions, using primitive, predefined, and custom roles; combine permissions to create tailored roles, with examples like editor, owner, and compute engine instance admin.

Learn why service account key rotation reduces risk when keys are compromised and compare push and pull rotation methods, including required permissions to create and upload new keys.

Learn to use short lived credentials and service account impersonation to access cloud resources securely, and generate oauth2 id tokens and jwt tokens while rotating keys.

Explore how cloud identity centralizes corporate, customer, and service identities, enabling single identity management and role-based access to Google Cloud services and third-party apps.

Learn how resource hierarchy and organization policies enforce rules across organizations, folders, and projects, with top-down constraint propagation and examples like resource location, allowed APIs, and trusted images.

Explore how to secure Compute Engine instances by configuring IAM access scopes, default vs custom service accounts, and firewall controls, including bastion host, NAT, and SSH key management.

Explore confidential computing with shielded VM in Google Cloud, defending against rootkits and bootkits while protecting secrets with TPM and Titan, through secure boot, measured boot, and integrity policy baselines.

Explore confidential computing in Google Cloud Platform, enabling a trusted execution environment that processes data in memory with keys in the processor on AMD EPYC CPU, offering isolation and attestation.

Explore how VPC service controls create perimeters around resources, enforce ingress and egress rules, and leverage access context manager to define fine-grained, context-aware access levels and service parameters.

Discover how Google Cloud Security Command Center unifies vulnerability and threat reporting, health analytics, and scans in a single dashboard, with standard and premium tiers and broad integrations.

Explore regulatory compliance in cloud environments, including PCI DSS, ISO 9000, and government laws, and learn how cloud providers offer tools to achieve compliance through encryption and framework alignment.

Understand PCI DSS standards for payment card processing and the roles of manufacturers, developers, and merchants, and implement controls like firewalls, data encryption, access restrictions, and regular security testing.

Explore GDPR, CCPA, and other privacy laws, and learn how to ensure transparency, consent, data minimization, accuracy, deletion, encryption, two-factor authentication, and audit trails in Google Cloud.