Read this the night before or on exam morning. It assumes you’ve studied the notes. It’s here to refresh, not to teach.
Exam day
- 50 to 60 multiple choice and multiple select questions in 2 hours. English or Japanese. Fee $200. Valid for 2 years. No prerequisites; 3+ years of experience with 1+ year on Google Cloud is recommended.
- Google does not publish a passing score. Treat every question as worth answering; there is no stated penalty for wrong answers, so never leave one blank.
- Two case studies appear in each exam, and case study questions are about 20 to 30% of it. You can see the case study on a split screen. Renewal exam: 1 hour, 25 questions, one generative AI case study, $100.
- Roughly 2 minutes per question. Flag long case questions and return.
- Domain weights from the current guide: designing and planning 25%, managing and provisioning 17.5%, security and compliance 17.5%, analyzing and optimizing 15%, managing implementation 12.5%, operations and reliability (solution and operations excellence) 12.5%.
- The platform formerly called Vertex AI is now the Gemini Enterprise Agent Platform. Read either name as the same thing.
How to read a PCA question
Read the last sentence first, then list every requirement and constraint in the scenario. The correct answer meets all of them.
| The question says | Lean toward |
|---|---|
| Minimise operational overhead, fully managed | Managed or serverless (Cloud Run, BigQuery, Spanner, Cloud SQL, Autopilot) |
| Cost-effective, minimise cost | Spot VMs, committed use, Autoclass, lifecycle, right-sizing, but only if the RTO/SLO still holds |
| Most secure, least privilege | Predefined roles to groups, no service account keys, private access, VPC Service Controls, CMEK only if required |
| Compliance, data residency | Region constraints (gcp.resourceLocations), Assured Workloads, audit logs with locked retention |
| Minimal downtime migration | Continuous replication (Migrate to VMs, DMS), parallel run, DNS cutover |
| Global users, low latency | Global load balancer, CDN, Spanner multi-region, Premium Tier |
| Existing legacy stays on premises | Hybrid connectivity (Interconnect or HA VPN), do not force a move |
| Quickly, least effort to start | HA VPN over Interconnect, prebuilt API over custom model, lift and shift first |
Elimination tricks
- Reject answers that ignore one stated requirement (for instance high availability or EU-only data).
- Reject over-engineering: multi-region active-active for a 99.9% target.
- Reject manual, per-server work when a managed or automated option exists.
- For choose two or three, each pick is a different piece of one solution.
The four case studies
| Case | Situation | Key requirements | What to reach for |
|---|---|---|---|
| EHR Healthcare | SaaS electronic health records, multi-national. Leaving colocation (a lease is ending). Kubernetes, MySQL, SQL Server, Redis, MongoDB. Active Directory. Legacy insurer file and API integrations stay on premises. Alerts by email are ignored | 99.9% availability minimum; onboard insurers quickly; lower latency for all customers; regulatory compliance; centralised visibility and proactive action; insights and predictions from provider data; lower admin cost. Technical: secure high-performance on-premises link, consistent container management across multiple environments, consistent logging, retention, monitoring and alerting, dynamic scaling, ingestion interfaces for new providers | Redundant Interconnect, regional GKE with fleets or GKE Enterprise, Cloud SQL HA or AlloyDB, Memorystore, Cloud Monitoring and central logging, BigQuery and ML for trends, Apigee for insurer APIs, Cloud Healthcare API, VPC Service Controls, Directory Sync or federation |
| Altostrat Media | Media company with audio and video library. GKE, Cloud Storage, BigQuery, Cloud Run functions. Legacy on-premises ingest and archive. Google Identity plus third-party IdPs. Prometheus and Cloud Monitoring with email alerts | Faster, more reliable operations across Google Cloud and on-premises; simpler infrastructure; lower storage cost with high availability; natural-language interaction and 24/7 support; automatic summaries; metadata from NLP and vision; filter inappropriate content; insights from content. Technical: modern container CI/CD with central management, secure high-performance hybrid ingest, Kubernetes on premises and cloud, auditable and explainable AI, chatbots, summarisation | Storage Autoclass and lifecycle, Interconnect, GKE Enterprise, Cloud Build, Artifact Registry and Cloud Deploy, Gemini on the Agent Platform, Agent Builder, Model Armor, Explainable AI and logging, Pub/Sub and Cloud Run functions |
| Cymbal Retail | Growing online retailer with a huge, multi-vertical catalogue. MySQL, SQL Server, Redis, MongoDB, Kubernetes, SFTP and batch ETL, IVR and call centre, Grafana, Nagios, Elastic | Automate catalogue enrichment; better discoverability; more engagement; higher conversion; lower call centre and data centre costs. Technical: generate attributes from supplier data, generate and edit images, natural-language product discovery, scalability, human-in-the-loop review UI, data security and compliance | Gemini for attributes, Imagen for images, Discovery AI and Agent Builder for conversational commerce, review app on Cloud Run with approve/reject flow, Datastream and DMS, Cloud Storage and Workflows or Composer, Sensitive Data Protection, Cloud Monitoring |
| KnightMotives Automotive | Car maker (BEV, hybrid, ICE) wanting a modern in-vehicle experience across all models in five years. Mainframe supply chain, outdated ERP, siloed data, unreliable online ordering, dealers with no hardware budget, poor rural connectivity, past breaches | Personalised, cohesive experience; build-to-order with transparency; monetise data; security paramount; EU data protection; autonomous driving investment; upskilling. Technical: consistent UX with AI across models, plant and HQ network upgrades, hybrid cloud with gradual modernisation, simulation environment, data platform with strict privacy, security framework with incident response, dealer tools and CRM | Hybrid cloud, Interconnect, Pub/Sub and Dataflow for telemetry, BigQuery and data platform with policy tags, EU regions and Assured Workloads, GPU and TPU simulation and training, Apigee for dealers, web-based dealer tools (no new dealer hardware), Cloud Armor, SCC, incident response |
Common threads in all four: hybrid connectivity, replace email-only alerting, managed services to cut admin effort, compliance and data governance, a stated availability or reliability target, and (in three of them) generative AI with human review, grounding and safety filters.
Decision tables
Databases and storage
| Need | Pick |
|---|---|
| Objects, media, backups | Cloud Storage (Standard, Nearline 30 d, Coldline 90 d, Archive 365 d; Autoclass when access is unknown) |
| Relational, regional, lift and shift | Cloud SQL (HA = standby in another zone) |
| High-performance PostgreSQL, HTAP | AlloyDB |
| Relational, global, strongly consistent, 99.999% | Spanner |
| Wide-column, huge throughput, time series | Bigtable (row key design matters) |
| Documents for apps | Firestore |
| Analytics warehouse | BigQuery |
| Cache | Memorystore |
| NFS | Filestore |
| Block | Persistent Disk, Hyperdisk, Local SSD (ephemeral) |
Compute
| Need | Pick |
|---|---|
| Stateless containers, scale to zero | Cloud Run |
| Event handlers | Cloud Run functions |
| Kubernetes | GKE Autopilot (less ops) or Standard (control, special hardware) |
| Full control, licensing, lift and shift | Compute Engine |
| Run VMware unchanged | VMware Engine |
| Fault-tolerant batch | Spot VMs (60 to 91% off, 30 s notice) |
| Steady baseline | Committed use discounts |
Networking
| Need | Pick |
|---|---|
| Global HTTP(S), CDN, WAF | Global external Application Load Balancer + Cloud CDN + Cloud Armor |
| Preserve client IP, any TCP/UDP | Passthrough Network Load Balancer |
| Quick hybrid link, backup | HA VPN (99.99%, about 3 Gbps per tunnel) |
| High volume private link | Dedicated Interconnect (10/100 Gbps), Partner (50 Mbps to 50 Gbps) |
| 99.99% Interconnect | Four connections across two metros |
| Encrypt over Interconnect | MACsec or HA VPN over Interconnect |
| Many VPCs, hub and spoke | Network Connectivity Center |
| Publish a service privately | Private Service Connect |
| One org, central network team | Shared VPC |
| Peering | Not transitive, no overlapping ranges |
| Outbound only for private VMs | Cloud NAT |
| Reach Google APIs without external IP | Private Google Access |
Data and AI
| Need | Pick |
|---|---|
| Stream or batch pipeline, managed | Dataflow |
| Existing Spark or Hadoop | Dataproc |
| Ingest events | Pub/Sub |
| Orchestrate | Cloud Composer or Workflows |
| Change data capture | Datastream |
| Standard AI task (vision, speech, translation, documents) | Prebuilt API |
| Search and conversational agents | Agent Builder (Vertex AI Search, Conversational Agents, Discovery AI) |
| Foundation models | Gemini on the Agent Platform; Model Garden for catalogue |
| Tolerable-interruption ML training | Spot with checkpoints; GPUs versatile, TPUs cost-effective at scale |
| Block prompt injection, harmful content | Model Armor |
Migration
| Object | Tool |
|---|---|
| Discovery and planning | Migration Center |
| VMs | Migrate to Virtual Machines |
| Databases | Database Migration Service |
| Files and objects online | Storage Transfer Service |
| Bulk offline | Transfer Appliance |
| Warehouse | BigQuery Migration Service |
| Containers | Migrate to Containers |
Security
| Need | Pick |
|---|---|
| Guardrails across the org | Organization Policy, hierarchical firewall policy |
| Data residency | gcp.resourceLocations, Assured Workloads |
| Stop service account keys | iam.disableServiceAccountKeyCreation, impersonation, Workload Identity Federation |
| Control keys | CMEK in Cloud KMS; HSM for hardware; EKM for external keys |
| Stop API data exfiltration | VPC Service Controls |
| Admin access without VPN or public IP | IAP + OS Login |
| Find and mask PII | Sensitive Data Protection |
| Secrets | Secret Manager |
| Only signed images | Binary Authorization |
| Central, locked audit logs | Aggregated sink to a dedicated project, retention policy + Bucket Lock |
| Data Access audit logs | Off by default (except BigQuery) |
Reliability numbers
| Target | Allowed downtime per year | Per 30 days |
|---|---|---|
| 99.9% | about 8.8 hours | about 43 minutes |
| 99.95% | about 4.4 hours | about 22 minutes |
| 99.99% | about 53 minutes | about 4.3 minutes |
| 99.999% | about 5 minutes | about 26 seconds |
- Error budget = 100% minus the SLO. Budget left: ship. Budget spent: freeze risky changes.
- SLI is the measure, SLO the target, SLA the contract.
- DR patterns by cost and speed: backup and restore, pilot light, warm standby, hot.
- Alert on symptoms and burn rate, not on every cause. Mitigate first, then find root cause; blameless postmortem.
- Pen tests on your own resources need no Google approval; load test at and above peak; chaos starts with a hypothesis and small blast radius.
Defaults and limits worth remembering
- Admin Activity audit logs: always on. Data Access logs: off by default.
_Requiredbucket 400 days,_Default30 days. - Spot VMs: 30 second notice, no maximum run time.
- IAM is additive and inherited; deny policies override allows.
- Regional Persistent Disk replicates synchronously between two zones. Local SSD loses data when the VM stops.
- Cloud Run concurrency default 80 (max 1000); scales to zero.
- Default encryption at rest is AES-256 and automatic.
- Bucket Lock is irreversible.