Google Cloud Certified - Professional Cloud Architect Cheat Sheet 2026

The 30 highest-yield Google Cloud Certified - Professional Cloud Architect facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. Your application on GKE experiences intermittent OOM kills on pods during traffic spikes. What is the most effective long-term fix? → Set appropriate resource requests and limits on pods and enable Vertical Pod Autoscaler
2. Which firewall rule direction handles traffic coming INTO a VM instance from outside? → Ingress
3. Business organizations can accomplish all of the following, with the exception of: → Minimize the amount of projects needed to leverage GCP effectively
4. Which GCP service provides a managed Redis or Memcached in-memory cache to reduce database load? → Memorystore
5. A Professional Cloud Architect must ensure traffic between microservices in GKE is encrypted in transit. Which solution is best? → Use Anthos Service Mesh or Istio mTLS
6. What is the purpose of Log-Based Metrics in Cloud Logging? → Create Cloud Monitoring metrics from log entry data
7. Which GCP service collects application performance data such as latency and request traces across distributed services? → Cloud Trace
8. A professional cloud architect needs to audit who made changes to production IAM policies over the past 30 days. Where should they look? → Cloud Audit Logs (Admin Activity logs)
9. A company wants to connect its on-premises data center to Google Cloud with a dedicated, private connection. Which service should they use? → Cloud Interconnect
10. A company wants to ensure its GCE VMs are never preempted during a critical batch window. Which VM type should they use? → Standard on-demand VMs
11. Which type of service account is automatically created when you enable certain GCP APIs and is managed by Google? → Google-managed service account
12. Which IAM role should be assigned to a CI/CD pipeline service account that needs to deploy Kubernetes workloads to GKE but should not have cluster admin access? → roles/container.developer
13. A financial company needs an RTO of less than 15 minutes for their GCP-hosted trading platform. Which architecture best achieves this? → Hot standby in a second region with automated health-check-driven failover
14. Your organization requires that only users from specific geographic regions can access a public-facing GCP application. Which service enforces this? → Cloud Armor geo-restriction policies
15. Which GCP compute service is best suited for running stateful, long-running background workers that don't need HTTP endpoints? → Cloud Run Jobs
16. An architect is designing for 99.99% availability for a critical web application. Which architecture best achieves this SLO? → Multi-region active-active deployment with a global load balancer and regional failover
17. A Cloud Architect needs to audit all IAM policy changes in a GCP organization over the past 30 days. Which service provides this data? → Cloud Audit Logs (Admin Activity logs)
18. Which Google Cloud feature allows you to share a VPC network across multiple projects within the same organization? → Shared VPC
19. A company needs to export all GCP logs to a centralized BigQuery dataset for long-term analysis. What is the best approach? → Configure a Log Sink to route logs to BigQuery
20. What is the maximum number of IAM policy bindings that can be set on a single Cloud Storage bucket? → 1,500
21. A team wants to receive alerts when their GKE cluster CPU utilization exceeds 80% for 5 minutes. Which tool should they configure? → Cloud Monitoring alerting policies
22. What Cloud Storage class is most cost-effective for data accessed less than once per year? → Archive
23. An organization wants to test their GCP disaster recovery plan without causing a production outage. Which approach is best? → Conduct a chaos engineering or DR simulation in a non-production environment
24. Which load balancer type in Google Cloud operates at Layer 7 and supports content-based routing across global backends? → External Application Load Balancer (global)
25. Which GCP monitoring concept defines a target level of service that is measured against an error budget? → SLO (Service Level Objective)
26. Which Cloud Spanner configuration provides the highest level of availability and global disaster recovery? → Multi-region instance
27. A GKE workload requires access to a Cloud Storage bucket. What is the recommended way to grant this permission without using service account keys? → Use Workload Identity to bind a Kubernetes service account to a GCP service account
28. A company must ensure Cloud Storage objects in a specific bucket cannot be deleted or modified for 7 years for compliance. What should they configure? → Bucket Lock with a Retention Policy
29. Which GCP service automatically groups and analyzes application error events and notifies developers of new errors? → Error Reporting
30. What is the purpose of a Cloud Monitoring workspace? → Provide a unified monitoring view across multiple GCP projects