Read this the night before or on exam morning. It assumes you’ve studied the notes. It’s here to refresh, not to teach.
Exam day
- 50 to 60 multiple choice and multiple select questions in 2 hours. English or Japanese. Fee $200. No prerequisites; 3+ years of experience including 1+ year on Google Cloud is recommended. Google doesn’t publish a passing score, and there’s no stated penalty for wrong answers, so never leave one blank.
- Roughly 2 minutes per question. Flag long scenarios and return.
- Two guide versions exist. Before 23 November 2026: foundations (bootstrapping the organization) about 20%, CI/CD 25%, SRE 18%, observability 25%, performance and cost 12%. On or after 23 November 2026: foundations 18%, CI/CD 30%, SRE 18%, observability 22%, performance and cost 12%. The new guide adds agent and AI topics (MCP servers, GKE Agent Sandbox, Provisioned Throughput, token costs, agent telemetry) and drops the separate trace section.
- Vertex AI is now the Gemini Enterprise Agent Platform. Read either name as the same thing.
How to read a question
Read the last sentence first, then the constraint words.
| The question says | Pick |
|---|---|
| Least operational overhead, managed | The Google-managed service (Cloud Deploy, Cloud Run, Managed Service for Prometheus) over self-run tools |
| Most secure, no keys | Service account attached to the resource, impersonation, Workload Identity Federation; never downloaded keys |
| Minimise impact now | Rollback or traffic shift first, diagnose later |
| Without changing application code | Cloud Service Mesh telemetry, Ops Agent, log-based metrics, buildpacks |
| Most cost-effective that meets the SLO | Right-size, autoscale, Spot for fault-tolerant parts, commitments for the baseline |
| Across all projects | Metrics scope, aggregated sink at the folder or organization, organization policy |
| Prove the image is trusted | Attestations and Binary Authorization |
Eliminate answers that need SSH into production, manual steps, a service account key, a 100% SLO, or blaming a person.
SRE numbers
| SLO | Downtime per 30 days |
|---|---|
| 99% | 7 h 12 min |
| 99.9% | 43 min |
| 99.95% | 21.6 min |
| 99.99% | 4.3 min |
| 99.999% | 26 s |
- Error budget = 1 − SLO. Burn rate 1 spends it exactly over the window.
- Page: burn 14.4 over 1 h (and 5 min) or burn 6 over 6 h (and 30 min). Ticket: burn 1 over 3 days (and 6 h).
- SLA is looser than SLO. Toil under 50% of SRE time.
- Exhausted budget means feature freeze per the pre-agreed policy.
- DORA: deployment frequency, lead time, change failure rate, failed deployment recovery time.
Pipeline facts
| Topic | Fact |
|---|---|
| Cloud Build | Steps are containers sharing /workspace; waitFor for parallel; substitutions $SHORT_SHA, custom ones start with _; default timeout 60 min (max 24 h); private pools for private networks; availableSecrets for secrets |
| Triggers | Push, PR, tag, manual, Pub/Sub, webhook, schedule; file filters; approval required on trigger |
| Artifact Registry | Standard, remote, virtual repos; cleanup policies; Container Registry is replaced; Artifact Analysis scans and rescans |
| Cloud Deploy | Pipeline, target, release, rollout; Skaffold renders; canary phases; requireApproval; automations promote, advance, repair; rollback |
| Cloud Run | Revisions, traffic split, --no-traffic plus tag, rollback by shifting traffic |
| GKE rollout | maxSurge, maxUnavailable, readiness probe, kubectl rollout undo |
| MIG | Rolling and canary updates, proactive vs opportunistic, autohealing |
| Supply chain | SLSA provenance (Cloud Build L3), Binary Authorization policy, attestors with KMS keys, dry-run mode, continuous validation |
| Secrets | Secret Manager versions, secretAccessor, mounted volumes see new versions, Parameter Manager for config, Certificate Manager for TLS |
| External CI | Workload Identity Federation pool and provider with an attribute condition |
Observability facts
| Topic | Fact |
|---|---|
| Agents | Ops Agent on VMs (Fluent Bit + OTel); needs logging.logWriter and monitoring.metricWriter |
| Prometheus | Managed collection with PodMonitoring; PromQL; billed per sample; cardinality drives cost |
| Audit logs | Admin Activity always on; Data Access off by default except BigQuery |
| Buckets | _Required 400 days fixed; _Default 30 days adjustable |
| Sinks | Writer identity needs a role on the destination; aggregated sinks use --include-children; no backfill |
| Destinations | Bucket (search), BigQuery (SQL), Cloud Storage (archive), Pub/Sub (external tools) |
| Log cost | Exclusions, sampling, source filtering, retention, Cloud Storage routing |
| Log metrics | Counter or distribution; count from creation |
| Probes | Uptime checks (HTTP, HTTPS, TCP, private) and synthetic monitors for workflows |
| Alerts | Symptoms and SLO burn, duration, ratio, documentation with runbook, snooze for maintenance, absence condition for silence |
| Traces | W3C traceparent, sampling, waterfall, logging.googleapis.com/trace for log correlation |
Incident facts
- Incident commander coordinates; operations lead is the only one changing the system; communications lead updates stakeholders; planning lead tracks long-term items. Declare early, hand over explicitly.
- Postmortem: blameless, impact, timeline, root causes, owned and dated action items.
- Drain with capacity scaler 0 or backend removal; redirect with global load balancer or DNS failover; add capacity mindful of quota and downstream limits; shed load with Cloud Armor, cache, degrade.
- Pod states: Pending (resources, taints, quota), CrashLoopBackOff (logs), OOMKilled (memory limit), ImagePullBackOff (image or Artifact Registry reader).
- Cloud Run: listen on
$PORT; check max instances and timeouts. - Tools: Connectivity Tests, Flow Logs, Query Insights, Error Reporting, Profiler, Personalized Service Health.
Cost facts
| Lever | Fact |
|---|---|
| Spot VMs | 60 to 91% off, 30 s warning, no max runtime, no SLA, fault-tolerant work |
| SUD | Automatic on eligible families; no commitment |
| CUD | Resource-based or spend-based, 1 or 3 years, for the steady baseline |
| Reservation | Capacity, not discount |
| Network tiers | Premium (global backbone, global LB) vs Standard (cheaper, regional) |
| Budgets | Alert only; Pub/Sub for automation |
| Recommenders | Cost, security, performance, manageability, reliability |
| Provisioned Throughput | Dedicated model capacity for steady production AI traffic; reduce tokens with shorter prompts, caching, smaller models, output caps |