DevOps Google Cloud Platform Syllabus

What is a Virtual Private Cloud (VPC) in GCP?

A global, software-defined private network that provides connectivity for resources (VMs, GKE, etc.), spanning all regions with regional subnets, and managing routing, firewall rules, and IP addressing.

In GCP, what is the scope of a VPC network versus a subnet?

A VPC network is global (spans all regions); a subnet is regional and defines an IP range within a single region.

What is Cloud Load Balancing in GCP and what major types exist?

A managed service distributing traffic across backends. Types include global external HTTP(S), SSL Proxy, TCP Proxy load balancers, and regional internal/external network (L4) load balancers.

What is Cloud CDN?

Google Cloud's content delivery network that caches content at Google's globally distributed edge points of presence to reduce latency and offload origin servers, integrated with HTTP(S) load balancing.

What is Cloud Interconnect versus Cloud VPN?

Cloud Interconnect provides a dedicated/partner physical connection between on-premises and GCP with high bandwidth; Cloud VPN provides an encrypted IPsec tunnel over the public internet, lower bandwidth and cost.

What is BigQuery?

GCP's fully managed, serverless, petabyte-scale data warehouse for fast SQL analytics, separating storage from compute and billing by data scanned or by reserved slots.

What pricing models does BigQuery offer for queries?

On-demand pricing (billed by bytes scanned/processed per query) and capacity-based pricing (flat-rate/reservations of compute slots).

What is Cloud Pub/Sub?

A fully managed, asynchronous messaging service for event ingestion and delivery using a publish/subscribe model, decoupling producers and consumers and enabling real-time streaming pipelines.

What is Cloud Dataflow?

A managed service for executing Apache Beam pipelines that process both batch and streaming data with automatic scaling and resource management.

What is Cloud Dataproc?

A managed service for running Apache Hadoop and Apache Spark clusters quickly and cost-effectively on GCP, with fast cluster provisioning and autoscaling.

What is Vertex AI?

GCP's unified machine learning platform for building, training, tuning, and deploying ML models, including AutoML, custom training, pipelines, feature store, and access to foundation/generative models.

Name three pre-trained AI APIs offered by GCP.

Cloud Vision API (image analysis), Cloud Natural Language API (text/sentiment/entity analysis), and Speech-to-Text / Text-to-Speech APIs (and Translation API).

What is a TPU in the context of GCP ML?

A Tensor Processing Unit, Google's custom-designed ASIC accelerator optimized for large-scale machine learning workloads, especially neural network training and inference with TensorFlow/JAX.

What is Google Cloud IAM?

Identity and Access Management, the service that controls who (identity) can do what (role/permissions) on which resource, enforcing the principle of least privilege through policies.

What are the three components of an IAM policy binding in GCP?

A member (identity, e.g., user, service account, group), a role (a collection of permissions), and the resource the policy is attached to. A binding grants the role to the member on the resource.

Compare the three IAM role types in GCP.

Basic (primitive) roles: Owner, Editor, Viewer—broad project-wide. Predefined roles: granular, service-specific roles managed by Google. Custom roles: user-defined sets of permissions tailored to needs.

What is a service account in GCP?

A special non-human identity used by applications, VMs, or services to authenticate and access GCP resources, identified by an email and authenticated via keys or attached identity rather than a password.

How does IAM policy inheritance work across the GCP resource hierarchy?

Policies are inherited downward: a policy set at the organization is inherited by folders, projects, and resources beneath it. The effective policy on a resource is the union of its own and all inherited allow policies.

What is Google Cloud Operations Suite (formerly Stackdriver)?

GCP's integrated observability suite including Cloud Monitoring, Cloud Logging, Error Reporting, Cloud Trace, and Cloud Profiler for monitoring, logging, and diagnosing applications and infrastructure.

What is Cloud Monitoring and what is a key metric/alerting concept it uses?

Cloud Monitoring collects metrics, events, and metadata from GCP, AWS, and apps. It uses metrics, dashboards, uptime checks, and alerting policies (conditions on metrics that trigger notifications) to track health.

What is the difference between Cloud Monitoring and Cloud Logging?

Cloud Monitoring deals with metrics/time-series data and alerting on resource performance; Cloud Logging collects, stores, searches, and analyzes log entries (text/structured events) from services and applications.

What is an SLI, SLO, and SLA in SRE/monitoring terms?

SLI (Service Level Indicator) is a measured metric (e.g., latency, availability); SLO (Service Level Objective) is the target value for an SLI; SLA (Service Level Agreement) is the contractual promise to customers, often with penalties if breached.

What is Google Cloud Deployment Manager?

GCP's native infrastructure-as-code service that lets you define, deploy, and manage GCP resources declaratively using configuration templates written in YAML, with Jinja2 or Python templates.

What template/config languages does Deployment Manager support?

YAML for configuration files, plus Jinja2 and Python for parameterized, reusable templates.

Why use infrastructure-as-code (IaC) tools like Deployment Manager or Terraform?

To define infrastructure declaratively in version-controlled files, enabling repeatable, consistent, automated, and auditable provisioning of resources rather than manual configuration.

What is Cloud KMS in GCP?

Cloud Key Management Service, a managed service to create, use, rotate, and destroy cryptographic keys for encrypting data, supporting customer-managed encryption keys (CMEK).

How does GCP handle encryption of data at rest by default?

GCP automatically encrypts all customer data at rest by default using AES-256 (Google-managed keys), with options for customer-managed (CMEK via Cloud KMS) or customer-supplied (CSEK) keys.

What is VPC Service Controls?

A GCP security feature that creates a service perimeter around resources to mitigate data exfiltration risks by restricting access to managed services from outside the perimeter.

What is the difference between authentication and authorization?

Authentication verifies who you are (identity); authorization determines what you are allowed to do (permissions/access). In GCP, IAM handles authorization after an identity is authenticated.

What does compliance and governance mean in a GCP context, and name two compliance standards GCP supports.

Governance is the framework of policies, controls, and accountability for cloud usage; compliance is meeting regulatory/industry standards. GCP supports certifications such as ISO 27001, SOC 1/2/3, PCI DSS, HIPAA, and GDPR alignment.

What GCP tools support governance through policy enforcement and auditing?

Organization Policy Service (constraints on resources), Cloud Audit Logs (Admin Activity, Data Access, System Event logs), and Security Command Center for posture and threat visibility.

What is a hybrid cloud strategy?

An architecture combining on-premises/private infrastructure with public cloud, allowing workloads and data to move between them, often connected via VPN or Interconnect.

What is Anthos (Google Distributed Cloud) and what problem does it solve?

Google's hybrid and multi-cloud platform built on Kubernetes/GKE that lets you run, manage, and govern containerized applications consistently across GCP, on-premises, and other clouds.

What is a multi-cloud strategy and one key benefit?

Using services from multiple cloud providers (e.g., GCP plus AWS/Azure) simultaneously. Benefits include avoiding vendor lock-in, increased resilience, and using best-of-breed services per provider.

What is serverless computing?

A model where the cloud provider fully manages servers and infrastructure, automatically scaling resources and billing only for actual usage, so developers focus on code without managing servers.

Name the main serverless compute products on GCP.

Cloud Functions (event-driven functions), Cloud Run (stateless containers), and App Engine Standard (managed app platform), plus serverless data services like BigQuery and Firestore.

What is Cloud Functions?

GCP's event-driven, function-as-a-service (FaaS) offering that runs single-purpose functions in response to events (HTTP requests, Pub/Sub messages, storage changes) and scales automatically including to zero.

What are the four key DevOps metrics (DORA metrics)?

Deployment frequency, lead time for changes, change failure rate, and mean time to recovery (MTTR).

What is Cloud Build?

GCP's fully managed continuous integration/continuous delivery (CI/CD) service that executes builds, tests, and deployments based on build steps defined in a configuration file (cloudbuild.yaml).

What is Artifact Registry in GCP?

A managed service for storing, managing, and securing build artifacts such as container images and language packages (the successor to Container Registry), integrated with CI/CD and IAM.

What is Cloud Source Repositories?

GCP's fully managed, private Git repositories for hosting, tracking, and managing source code, integratable with Cloud Build and other GCP developer tools.

List the main Google Cloud certification tracks.

Foundational: Cloud Digital Leader. Associate: Cloud Engineer. Professional: Cloud Architect, Cloud Developer, Data Engineer, Cloud DevOps Engineer, Cloud Security Engineer, Cloud Network Engineer, Cloud Database Engineer, and Machine Learning Engineer.

How long are Google Cloud certifications valid before recertification?

Most Google Cloud certifications are valid for two years (the Cloud Digital Leader and others), after which you must recertify by retaking the exam.

Which Google Cloud certification is the entry-level, non-technical foundational exam?

The Cloud Digital Leader certification, which validates broad knowledge of cloud concepts and Google Cloud products without requiring hands-on engineering skills.

Name key official learning resources for studying GCP.

Google Cloud Skills Boost (Qwiklabs hands-on labs), official Google Cloud documentation, Coursera Google Cloud specializations, Google Cloud free tier, and Cloud certification exam guides.

What does the GCP Free Tier include?

A 90-day free trial with $300 (USD) in credits for new customers, plus an Always Free tier offering limited monthly usage of select products (e.g., small Compute Engine instance, Cloud Storage, Cloud Functions invocations) at no cost.

What is autoscaling in Compute Engine managed instance groups (MIGs)?

A feature that automatically adds or removes VM instances in a managed instance group based on load signals such as CPU utilization, load-balancing capacity, or custom metrics, to match demand.

What is the difference between horizontal and vertical scaling?

Horizontal scaling (scale out/in) adds or removes instances; vertical scaling (scale up/down) increases or decreases the resources (CPU/RAM) of a single instance.

What pricing discount mechanisms does Compute Engine offer for steady-state usage?

Sustained use discounts (automatic discounts for running VMs a large portion of the month) and committed use discounts (CUDs, lower rates for 1- or 3-year resource commitments).

What is Cloud Identity in GCP?

An Identity-as-a-Service (IDaaS) offering for managing users, groups, and devices, providing single sign-on and centralized identity management that integrates with IAM.

In a GCP load balancer, what is a backend service and a health check?

A backend service defines how the load balancer distributes traffic to a group of backends (instance groups or NEGs); a health check periodically probes backends to route traffic only to healthy instances.