GCP Professional Cloud Architect Foundations

The Google Professional Cloud Architect exam validates skills for designing secure, scalable, and reliable solutions on Google Cloud. The resource hierarchy is organization, folders, projects, and resources. A project is the base container for services, billing, and permissions. Folders group projects so policies can be applied at scale, and the organization node is the root of the hierarchy. Regions are geographic areas, zones are isolated locations within regions, and multi-region deployments improve durability and availability. An SLA defines expected service availability. High availability requires redundancy, health checks, and failover rather than a single point of failure. Architects must also consider cost, performance, security, and operational requirements when choosing a design. This course connects each domain to original practice questions.

Google Cloud offers compute and data services for different workloads. Compute Engine provides IaaS virtual machines with machine types and managed instance groups. Google Kubernetes Engine runs containers with Kubernetes, and Cloud Run scales stateless containers automatically. Cloud Functions is serverless event-driven compute, and App Engine is a managed PaaS for web applications. Spot VMs are cheaper but interruptible. For data, Cloud SQL provides managed MySQL and PostgreSQL, Cloud Spanner provides global relational scale, Firestore is a NoSQL document database, and Bigtable is a low-latency wide-column database. BigQuery is a serverless data warehouse, Cloud Storage is object storage, Filestore provides NFS shares, and Dataproc runs Hadoop and Spark. Choose services based on latency, scale, schema, and operational ownership.

Networking connects Google Cloud resources securely and efficiently. A VPC is a global virtual network, and subnets are IP ranges within it. Firewall rules control traffic to and from resources. Cloud Load Balancing distributes traffic across instances and regions, including global HTTP(S) load balancers. Cloud VPN creates encrypted tunnels from on-premises networks, while Cloud Interconnect provides dedicated private physical connections. Cloud NAT lets private instances reach the internet for outbound requests without public IPs. VPC peering connects two VPCs, and Shared VPC lets a host project share subnets with service projects. Architects choose connectivity based on latency, bandwidth, cost, and security. Design networks with least-privilege firewalls and clear traffic paths.

Security in Google Cloud combines identity, data protection, and network defense. Cloud IAM controls permissions with roles and policies. A role is a set of permissions, and a service account is an identity used by applications. Secret Manager stores API keys and passwords, and Cloud KMS manages encryption keys. Cloud Armor protects web applications with WAF rules and DDoS defense, and Cloud Security Scanner finds web vulnerabilities. Organization policies enforce constraints across the resource hierarchy. Cloud Audit Logs record who did what for forensics and compliance. Best practices include least privilege, separating environments with projects, using service accounts instead of user keys, enabling audit logs, and protecting data at rest and in transit.

Reliable systems must be monitored, automated, and recoverable. Autoscalers adjust instance counts based on load, and health checks determine whether instances can receive traffic. Cloud Monitoring collects metrics, dashboards, and alerts, while Cloud Logging stores and queries logs. Uptime checks verify endpoints from multiple locations, and alerting policies notify teams when conditions are violated. Backups create recoverable copies, and disaster recovery plans define recovery time and point objectives. Rolling deployments update instances gradually to reduce downtime, and canary releases test new versions with a small traffic percentage. Operations teams use infrastructure as code, continuous delivery, and runbooks to respond quickly. Choose reliability patterns based on the criticality of the workload.