Read this the night before or on exam morning. It assumes you’ve studied the notes. It’s here to refresh, not to teach.
Exam day
- 50 to 60 multiple choice and multiple select questions in 2 hours. English or Japanese. Fee $200. No prerequisites; 3+ years of industry experience with 1+ year on Google Cloud is recommended.
- Google does not publish a passing score. There is no stated penalty for wrong answers, so never leave one blank. Roughly 2 minutes per question; flag and move on.
- Domain weights from the current guide (live from April 2026): designing scalable, secure and reliable cloud-native applications about 32%, building and testing about 23%, configuring applications for deployment about 24%, integrating with Google Cloud services about 21%.
- The platform formerly called Vertex AI is now the Gemini Enterprise Agent Platform. Read either name as the same thing. The guide expects familiarity with AI coding assistants, context engineering, MCP servers and AI-assisted observability.
How to read a question
Read the last sentence first, then hunt for the constraint words.
| The question says | Lean toward |
|---|---|
| Least operational overhead, serverless, scale to zero | Cloud Run (or Cloud Run functions) |
| Kubernetes, StatefulSet, service mesh, Helm | GKE |
| No keys, most secure auth | Attached service account, impersonation, Workload Identity Federation, ADC |
| Rotate secrets | Secret Manager |
| At-least-once, duplicates | Idempotent handlers; Pub/Sub dead-letter topic |
| Controlled rate to one endpoint, scheduled later | Cloud Tasks |
| Multi-step process with retries and branching | Workflows |
| Cron | Cloud Scheduler |
| Gradual rollout, rollback | Cloud Run revision traffic split; Cloud Deploy canary; kubectl rollout undo |
| Only trusted images may run | Binary Authorization with attestations |
| Temporary access to an object, no Google account | Signed URL |
| Monetise, partners, developer portal | Apigee |
Cloud Run facts
| Item | Value |
|---|---|
| Port | Container listens on $PORT (8080 default) |
| Concurrency | 80 default, up to 1000 |
| Request timeout | 5 min default, up to 60 min |
| CPU allocation | Request-based or always-on (instance-based) |
| Probes | Startup and liveness (no readiness) |
| Deploy from source | gcloud run deploy --source . (Dockerfile or buildpacks, Cloud Build, Artifact Registry) |
| Traffic | --no-traffic, --tag, update-traffic --to-revisions A=10,B=90 |
| Access | roles/run.invoker; ingress internal or load-balancer only |
| Cloud SQL | --add-cloudsql-instances, socket /cloudsql/PROJECT:REGION:INSTANCE |
| VPC | Direct VPC egress |
GKE probes and autoscaling
| Item | Rule |
|---|---|
| Startup probe | Disables others until success; for slow starters |
| Readiness probe | Failing removes the pod from Service endpoints; no restart |
| Liveness probe | Failing restarts the container; keep it cheap, no downstream calls |
| Probe defaults | period 10 s, timeout 1 s, failure threshold 3, success threshold 1 |
| HPA | min and max replicas, target metric; CPU utilization needs requests |
| HPA formula | ceil(current replicas x current metric / target) |
| HPA scale-down | Stabilization window 300 s by default |
| Queue worker scaling | External metric such as Pub/Sub backlog |
| Rolling update | maxSurge, maxUnavailable |
| Rollback | kubectl rollout undo deployment/NAME |
Pub/Sub facts
| Item | Value |
|---|---|
| Delivery | At-least-once by default |
| Ack deadline | 10 s default, 10 to 600 s |
| Retention of unacked messages | 7 days default, up to 31 days |
| Dead-letter | 5 to 100 delivery attempts |
| Ordering | Ordering key plus ordering enabled on subscription |
| Exactly-once | Pull subscriptions, regional |
| Push auth | OIDC token; invoker role on the target |
| Max message size | 10 MB |
Messaging and orchestration chooser
| Need | Service |
|---|---|
| Fan-out, buffering, streaming | Pub/Sub |
| React to Google Cloud events as CloudEvents | Eventarc |
| Rate-limited, scheduled per-task HTTP calls | Cloud Tasks |
| Cron | Cloud Scheduler |
| Orchestrate several services | Workflows |
Security quick table
| Need | Use |
|---|---|
| Identity on Google Cloud | Attached service account and ADC |
| Identity outside Google Cloud | Workload Identity Federation |
| Pods | Workload Identity Federation for GKE |
| Database access | Cloud SQL or AlloyDB Auth Proxy, IAM database authentication |
| Secrets | Secret Manager (versions, rotation notifications) |
| Keys | Cloud KMS (CMEK, rotation) |
| User sign-in for your app | Identity Platform |
| Identity-aware access to internal apps | IAP |
| Scan deployed app | Web Security Scanner |
| Scan images | Artifact Analysis |
| Block unattested images | Binary Authorization |
| WORM storage | Retention policy plus bucket lock |
| Private service communication | Cloud Service Mesh, network policies, Private Service Connect |
Data store chooser and consistency
| Need | Store |
|---|---|
| Standard relational | Cloud SQL |
| High-performance PostgreSQL | AlloyDB |
| Global relational scale | Spanner |
| Document, mobile | Firestore |
| Wide-column, huge throughput | Bigtable |
| Objects | Cloud Storage |
| Analytics | BigQuery |
| Cache | Memorystore |
- Strong: Cloud Storage, Firestore, Spanner (default reads), single-cluster Bigtable, primary databases.
- Eventual: Cloud SQL read replicas, AlloyDB read pool, multi-cluster Bigtable.
- Avoid sequential keys in Spanner and Bigtable. Firestore multi-field queries need composite indexes.
- BigQuery streaming: Storage Write API (exactly-once possible). Batch: load jobs.
- Signed URL V4 maximum expiry: 7 days.
Build and supply chain
- Cloud Build: steps in order,
waitFor: ['-']runs in parallel, non-zero exit fails the build,imagespushed at the end, custom substitutions begin with_, default timeout 60 minutes, private pools for VPC access. - Artifact Registry replaces Container Registry: standard, remote and virtual repositories, cleanup policies, deploy by digest.
- Provenance (SLSA) from Cloud Build, scanned by Artifact Analysis, enforced by Binary Authorization.
- Emulators: Pub/Sub, Firestore, Bigtable, Spanner; set
*_EMULATOR_HOST. - Cloud Workstations for managed developer environments; Cloud Shell has a 5 GB persistent home.
API calls and observability
- Enable the API first (
gcloud services enable). Prefer Cloud Client Libraries with ADC. - Batch, restrict fields, paginate with page tokens, cache, back off exponentially with jitter on transient errors (429, 5xx), not on 4xx like 400 or 403.
- Logs: structured JSON to stdout; set
logging.googleapis.com/traceto link logs to traces. - Propagate
X-Cloud-Trace-Contextortraceparenton outbound calls so spans share a trace ID. - Error Reporting groups exceptions; Profiler finds hot code; Cloud Debugger is retired (Snapshot Debugger is its open-source successor).
- Log retention:
_Default30 days,_Required400 days. - Gemini Cloud Assist: natural-language investigations, explain log entries, query help.
Common traps
- Picking GKE when Cloud Run satisfies the need with less to manage.
- Using a service account key where an attached account or federation works.
- Making a liveness probe depend on the database.
- Forgetting the invoker role on Cloud Run, or the OIDC service account on a Pub/Sub push subscription.
- Assuming Pub/Sub delivers exactly once and in order by default.
- Treating session affinity as a guarantee.
- Retrying 4xx errors, or retrying without backoff.
- Choosing Cloud Tasks when many independent consumers need the same message, or Pub/Sub when you need per-task rate control.