Google Cloud Professional Cloud Architect Managing and Provisioning a Solution Infrastructure Syllabus

Managing and Provisioning a Solution Infrastructure syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Managing and Provisioning a Solution Infrastructure in Google Cloud Professional Cloud Architect, not a summary of it.

1. 1

   Network Architecture and Configuration

   4 topics

   • VPC design and subnetting
     • Shared VPC and VPC Peering
     • Custom vs. auto mode networks
   • Firewall rules and hierarchical policies
   • Cloud DNS and private DNS zones
   • Network Service Tiers and routing
2. 2

   Hybrid and Multi-Cloud Connectivity

   4 topics

   • Cloud VPN configurations
     • HA VPN vs. Classic VPN
   • Cloud Interconnect options
     • Dedicated vs. Partner Interconnect
   • Cloud Router and dynamic routing with BGP
   • Network Connectivity Center
3. 3

   Storage Systems Provisioning

   4 topics

   • Cloud Storage classes and lifecycle management
     • Standard, Nearline, Coldline, Archive
     • Object versioning and retention policies
   • Persistent Disk and Hyperdisk configuration
   • Filestore deployment
   • Data retention and lifecycle policies
4. 4

   Compute and Database Systems Provisioning

   4 topics

   • Provisioning Compute Engine and instance templates
   • Managed instance groups and autoscaling
   • Configuring Cloud SQL and AlloyDB
     • High availability and read replicas
   • Provisioning Spanner, Bigtable, and Firestore
5. 5

   Infrastructure as Code and Deployment

   4 topics

   • Terraform on Google Cloud
     • State management and modules
   • Infrastructure Manager and Config Connector
   • Cloud Marketplace deployments
   • Resource hierarchy and organization policies

Managing and Provisioning a Solution Infrastructure flashcards for Google Cloud Professional Cloud Architect

19 of 68 cards from the Managing and Provisioning a Solution Infrastructure deck — real questions with worked answers.

1. In Google Cloud, what is the network scope of a VPC, and how do subnets relate to regions?

   A VPC is a global resource (it spans all regions), while each subnet is a regional resource confined to a single region but spanning all zones within that region.

2. What are the two subnet creation modes for a Google Cloud VPC, and which is recommended for production?

   Auto mode (one subnet per region with predefined /20 ranges) and Custom mode (you define each subnet and its range manually). Custom mode is recommended for production for full IP control.

3. In a GCP VPC, which four IP addresses in every subnet primary range are reserved and unusable?

   The network (first) address, the default gateway (second) address, and the second-to-last and last (broadcast) addresses are reserved in each subnet primary range.

4. What is the purpose of a secondary IP range on a GCP subnet?

   A secondary range provides alias IP ranges, commonly used for GKE Pods and Services so they get their own routable IPs separate from the node primary range.

5. What is the implied (default) behavior of GCP VPC firewall rules before any user rules are added?

   There are two implied rules: allow all egress (priority 65535) and deny all ingress (priority 65535). Implied rules cannot be deleted, only overridden by higher-priority rules.

6. In GCP firewall rules, what does a lower priority number mean, and what is the valid range?

   Lower numbers mean higher precedence (evaluated first). The range is 0 to 65535, with 1000 as the default.

7. What are the two pre-populated rules created with a GCP auto/default network, and what do they permit?

   default-allow-internal (allows traffic within the VPC) plus rules allowing SSH (22), RDP (3389), and ICMP from anywhere; these come with the default network template.

8. What is a hierarchical firewall policy in Google Cloud and where can it be applied?

   Hierarchical firewall policies are firewall rule sets applied at the organization or folder level (not just on the VPC), so they are inherited by all resources below and enforced before VPC-level rules.

9. In hierarchical firewall policies, what do the 'goto_next' and 'allow/deny' actions do?

   goto_next delegates the decision to the next level down in the hierarchy (lower-level policy or VPC rules), while allow/deny make a final decision at that level.

10. What is Cloud DNS, and what SLA does it offer?

    Cloud DNS is Google's scalable, managed authoritative DNS service. It offers a 100% uptime SLA for its anycast name servers.

11. What is the difference between a public and a private managed zone in Cloud DNS?

    A public zone is visible to the internet and answers queries from anywhere; a private zone is only resolvable from authorized VPC networks within Google Cloud.

12. In Cloud DNS, what is DNS peering used for?

    DNS peering lets one VPC (consumer) forward DNS queries for a namespace to another VPC (producer), so the consumer can resolve records hosted in the producer's private zones.

13. What is a Cloud DNS forwarding zone used for?

    A forwarding zone forwards queries for a specific namespace to external/on-premises DNS servers (target IPs), enabling hybrid name resolution from a VPC.

14. What are the three Network Service Tiers in Google Cloud and the key difference between them?

    Premium Tier routes traffic over Google's global backbone (cold-potato routing, best performance, global LB); Standard Tier routes over the public internet (hot-potato, lower cost, regional only).

15. In Premium vs Standard Network Service Tier, which load balancers are available in each?

    Premium Tier supports global external load balancers; Standard Tier only supports regional external load balancers.

16. What are the route priorities/types in a GCP VPC routing table?

    System-generated subnet routes and default route, plus custom static routes and dynamic routes (learned via Cloud Router/BGP). More specific prefix wins; ties broken by lowest priority value.

17. What are the two routing modes for a GCP VPC's dynamic routing, and how do they differ?

    Regional dynamic routing applies Cloud Router learned routes only within the Cloud Router's region; Global dynamic routing propagates them to all regions in the VPC.

18. What are the two types of Cloud VPN, and how do they differ in availability/SLA?

    Classic VPN (single interface, 99.9% SLA, being deprecated for some features) and HA VPN (two interfaces with two external IPs, 99.99% SLA when configured correctly).

19. What BGP requirement does HA VPN have that Classic VPN does not strictly require?

    HA VPN requires dynamic routing with BGP (Cloud Router) and uses two tunnels for redundancy; Classic VPN can use either static or dynamic routing.

See more Managing and Provisioning a Solution Infrastructure flashcards →

Planning Managing and Provisioning a Solution Infrastructure for Google Cloud Professional Cloud Architect

Managing and Provisioning a Solution Infrastructure (Google Cloud Professional Cloud Architect) FAQ