GCP Professional Cloud Architect Cheat Sheet (2026 Edition)

1. Database Selection

The single most-tested topic. Know the decision rule cold.

Service	Type	Choose when…
Cloud SQL	Relational (OLTP)	MySQL/PostgreSQL/SQL Server, single region, standard OLTP workload
Cloud Spanner	Relational (Global)	Multi-region consistency, 99.999% SLA, >1,000 TPS, horizontal scale
BigQuery	Analytical (OLAP)	Petabyte-scale analytics, data warehouse, serverless SQL, BI reporting
Firestore	NoSQL (Document)	Mobile/web apps, real-time sync, offline support, flexible schema
Bigtable	NoSQL (Wide-column)	IoT ingestion, time-series, high-throughput reads/writes, low latency at scale
Memorystore (Redis)	In-memory cache	Session caching, leaderboards, pub/sub, sub-millisecond latency
Cloud Storage	Object store	Unstructured data — images, videos, backups, ML training files

Exam tip: If the scenario mentions financial transactions and global in the same sentence — that is Spanner. If it mentions sensor data or time-series — that is Bigtable. If it just says relational with no scale requirement — Cloud SQL.

2. Networking & Connectivity

Load Balancer Decision Tree

Scenario	Use
HTTP/HTTPS traffic, global, multiple regions	Global External HTTP(S) Load Balancer
TCP/SSL traffic, global, non-HTTP	SSL Proxy / TCP Proxy Load Balancer
UDP or any port, single region, external	Regional External Network Load Balancer
Internal microservices, private VPC traffic	Internal HTTP(S) or Internal TCP/UDP LB

Hybrid Connectivity Options

• Cloud VPN (HA VPN): Encrypted IPsec tunnel over public internet. 99.99% SLA with two tunnels. Best for lower bandwidth (<3 Gbps) or a quick setup.
• Dedicated Interconnect: Direct physical fibre to Google PoP. 10 Gbps or 100 Gbps circuits. Highest bandwidth, lowest latency, no internet traversal.
• Partner Interconnect: Via an approved third-party provider. 50 Mbps to 50 Gbps. Use when you cannot physically reach a Google PoP.
• Cloud Router: Manages dynamic BGP routing for VPN and Interconnect. Required for dynamic routing.

Exam tip: If the scenario says "the company cannot co-locate at a Google facility" — that is Partner Interconnect. "Highest bandwidth, dedicated physical link" — Dedicated Interconnect.

VPC Design Patterns

• Shared VPC: One host project shares its VPC with multiple service projects. Best for centralised network administration across teams.
• VPC Peering: Connects two separate VPCs (same or different org). Non-transitive — A peers with B and B peers with C, but A cannot reach C.
• Private Google Access: Allows VMs without external IPs to reach Google APIs. Enable per-subnet.
• VPC Service Controls: Creates a security perimeter around GCP services to prevent data exfiltration.

3. Compute Options

Service	Control Level	Choose when…
Compute Engine	Maximum (IaaS)	OS-level access needed, custom kernels, licensed software, lift-and-shift VMs
GKE Standard	High	Kubernetes, control over node types, GPUs, custom node configs
GKE Autopilot	Medium	Kubernetes without node management, pay-per-pod, simplified ops. Compare →
Cloud Run	Low	Stateless containers, pay-per-request, scales to zero, HTTP workloads
Cloud Functions	Minimal	Event-driven code (Pub/Sub triggers, HTTP), short execution, no server management
App Engine Standard	Minimal	Managed web apps, scales to zero, only specific language runtimes

Exam tip: "Operational overhead" = move toward serverless (Cloud Run / Functions). "Fine-grained control" = Compute Engine or GKE Standard. "Event-driven" = Cloud Functions.

4. Cloud Storage Classes

Class	Access Frequency	Min Storage Duration	Use Case
Standard	Frequent	None	Hot data, websites, active ML datasets
Nearline	< once/month	30 days	Backups, infrequently accessed data
Coldline	< once/quarter	90 days	Disaster recovery, quarterly reports
Archive	< once/year	365 days	Long-term archival, regulatory compliance

Exam tip: Use Object Lifecycle Management to automatically transition objects between classes. Always pick the class that matches access frequency — Archive is cheapest to store but most expensive to retrieve.

5. IAM & Security

Role Types

• Basic Roles (Owner, Editor, Viewer): Very broad — never use in production. Only for development/testing.
• Predefined Roles: Granular permissions curated by Google per service (e.g. roles/storage.objectViewer). Always prefer over Basic.
• Custom Roles: You define the exact permissions. Use when no predefined role fits the principle of least privilege.

Service Accounts — Key Rules

• Service Accounts are both an identity and a resource. A VM uses a service account to call GCP APIs.
• Prefer Workload Identity Federation over service account keys to avoid long-lived credentials.
• Grant service accounts only the roles they need — nothing more.
• Service Account impersonation allows one service account to act as another — useful for separation of duties.

Key Security Services

• Cloud Armor: DDoS protection and WAF at the Global Load Balancer. Blocks by IP, geo, or OWASP rules.
• Secret Manager: Stores API keys, passwords, certificates with versioning and audit logging.
• Cloud KMS: Manages encryption keys. Use with CMEK (Customer-Managed Encryption Keys) for compliance.
• Security Command Center: Centralised security monitoring, vulnerability scanning, and threat detection.
• VPC Service Controls: Creates security perimeters around APIs to prevent data exfiltration.
• Binary Authorization: Ensures only trusted container images are deployed to GKE.

6. High Availability & Disaster Recovery

RTO vs RPO — Know the Difference

• RTO (Recovery Time Objective): Maximum acceptable downtime after a failure.
• RPO (Recovery Point Objective): Maximum acceptable data loss (measured in time).

HA Patterns by Service

Service	HA Configuration
Compute Engine	Managed Instance Groups (MIG) across multiple zones, with autoscaling and health checks
Cloud SQL	High Availability configuration with a standby in a second zone. Automatic failover.
Cloud Spanner	Multi-region configuration for 99.999% availability. Built-in synchronous replication.
GKE	Regional cluster spreads nodes across 3 zones automatically
Cloud Storage	Multi-region or dual-region bucket for geo-redundant, 99.95% availability object storage

Exam tip: The scenario phrase "the company cannot tolerate data loss" = synchronous replication = Cloud Spanner multi-region or Cloud SQL HA. "Low cost DR, some data loss acceptable" = async replication or GCS cross-region copy.

7. Data & Analytics Pipeline

• Pub/Sub: Asynchronous messaging, event ingestion at scale. The entry point for streaming data pipelines.
• Dataflow: Apache Beam-based managed service for both batch and streaming data processing (ETL, transformations).
• Dataproc: Managed Spark/Hadoop clusters. Use when migrating existing Spark/Hadoop workloads.
• BigQuery: End destination for analytics. Serverless, petabyte-scale, columnar SQL engine.
• Looker / Looker Studio: BI and data visualisation on top of BigQuery.
• Vertex AI: End-to-end ML platform — training, deployment, and MLOps pipelines.

Common pipeline pattern: IoT devices → Pub/Sub → Dataflow (transform) → Bigtable (low-latency serving) + BigQuery (analytics). This pattern appears in both Mountkirk and TerramEarth case studies.

8. Cost Optimisation

• Committed Use Discounts (CUDs): Commit to 1 or 3 years of a resource type for up to 57% discount. Good for steady-state workloads.
• Preemptible / Spot VMs: Up to 90% cheaper than on-demand. Can be terminated with 30-second notice. Use for batch jobs, fault-tolerant workloads.
• Sustained Use Discounts: Automatic discounts when a VM runs for more than 25% of a month. No action needed.
• Rightsizing Recommendations: Cloud Monitoring and the Recommender API flag underutilised VMs. Review regularly.
• Cloud Storage Lifecycle policies: Auto-transition objects to Nearline/Coldline/Archive to reduce storage costs.
• BigQuery flat-rate pricing vs on-demand: Use on-demand for variable workloads, flat-rate reservations for predictable heavy usage.
• Budget Alerts: Set billing alerts in Cloud Billing to catch unexpected spend before it compounds.

9. Monitoring & Operations

• Cloud Monitoring: Metrics, dashboards, uptime checks, and alerting for all GCP resources.
• Cloud Logging: Centralised log ingestion. Use Log Sinks to export to BigQuery, Cloud Storage, or Pub/Sub for long-term retention.
• Cloud Trace: Distributed request tracing to diagnose latency in microservices.
• Cloud Profiler: Continuous CPU and memory profiling for production applications.
• Error Reporting: Aggregates and surfaces application errors in real time.
• Audit Logs: Admin Activity, Data Access, and System Event logs. Always-on for Admin Activity; enable Data Access logs explicitly (they generate large volume).

Exam tip: "Centralise logs across all projects" = Log Sinks to a central project's Cloud Logging or Cloud Storage bucket. "Detect anomalies in real time" = combine Pub/Sub + Dataflow + Cloud Monitoring alerts.

10. Official Case Study Summaries

Know each company's key requirements and the GCP services that address them.

EHR Healthcare

• Core challenge: Migrate legacy on-premises healthcare systems to GCP while maintaining HIPAA compliance.
• Key services: Cloud Healthcare API, Cloud SQL (HA), Shared VPC, Cloud Armor, Cloud KMS (CMEK), VPC Service Controls.
• Themes: Compliance, security, hybrid connectivity during migration, minimising downtime.

Mountkirk Games

• Core challenge: Global multiplayer gaming platform that must scale rapidly and keep latency low for players worldwide.
• Key services: Cloud Spanner (global player data), Bigtable (game state), GKE (microservices), Global Load Balancer, Pub/Sub + Dataflow (analytics).
• Themes: Global scale, NoSQL decision, real-time analytics, cost-efficient scaling with preemptible VMs.

TerramEarth

• Core challenge: IoT fleet management for heavy machinery — ingest telemetry from 500,000 vehicles for predictive maintenance.
• Key services: Pub/Sub (ingestion), Dataflow (stream processing), Bigtable (time-series storage), BigQuery (analytics), Vertex AI (predictive maintenance models).
• Themes: IoT pipeline, batch vs streaming, ML integration, data lifecycle management.

11. Exam FAQs

How hard is the GCP Professional Cloud Architect exam?

The PCA is considered one of the harder GCP certifications. It has 50–60 questions with a 2-hour time limit, with 40–50% scenario-based questions. Most candidates with 2+ years of cloud experience and 4–8 weeks of preparation pass on the first attempt. Use our free practice tests to benchmark your readiness.

What are the official GCP PCA case studies?

The three active case studies are EHR Healthcare, Mountkirk Games, and TerramEarth. Google publishes them publicly — read them before the exam and practise mapping their requirements to GCP services. See summaries above.

Cloud Spanner vs Cloud SQL — when do I pick each?

Cloud SQL for standard OLTP in a single region (MySQL/PostgreSQL/SQL Server compatible). Cloud Spanner when you need multi-region strong consistency, 99.999% SLA, or horizontal scaling beyond what a single instance can handle (typically >1,000 TPS or global write requirements).

GKE Autopilot vs GKE Standard — quick decision?

Autopilot if the scenario prioritises reduced operational burden — Google manages nodes, scaling, and security patches. Standard if you need specific node machine types, GPUs, or custom node configurations. For the exam, "operational simplicity" almost always points to Autopilot. Full comparison here →

Which storage class for archival/compliance data?

Archive class for data accessed less than once a year (e.g. regulatory records). Coldline for less than once a quarter. Nearline for less than once a month. Use Object Lifecycle Management to automate transitions and avoid paying Standard rates for data you rarely access.