Google Cloud Certified - Professional Cloud Architect Cheat Sheet 2026

The 30 highest-yield Google Cloud Certified - Professional Cloud Architect facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. Which firewall rule direction handles traffic coming INTO a VM instance from outside? → Ingress
2. Business organizations can accomplish all of the following, with the exception of: → Minimize the amount of projects needed to leverage GCP effectively
3. Which GCP service provides a managed Redis or Memcached in-memory cache to reduce database load? → Memorystore
4. A Professional Cloud Architect must ensure traffic between microservices in GKE is encrypted in transit. Which solution is best? → Use Anthos Service Mesh or Istio mTLS
5. What is the purpose of Log-Based Metrics in Cloud Logging? → Create Cloud Monitoring metrics from log entry data
6. Which GCP service collects application performance data such as latency and request traces across distributed services? → Cloud Trace
7. A professional cloud architect needs to audit who made changes to production IAM policies over the past 30 days. Where should they look? → Cloud Audit Logs (Admin Activity logs)
8. A company wants to connect its on-premises data center to Google Cloud with a dedicated, private connection. Which service should they use? → Cloud Interconnect
9. A company wants to ensure its GCE VMs are never preempted during a critical batch window. Which VM type should they use? → Standard on-demand VMs
10. Which type of service account is automatically created when you enable certain GCP APIs and is managed by Google? → Google-managed service account
11. Which IAM role should be assigned to a CI/CD pipeline service account that needs to deploy Kubernetes workloads to GKE but should not have cluster admin access? → roles/container.developer
12. A financial company needs an RTO of less than 15 minutes for their GCP-hosted trading platform. Which architecture best achieves this? → Hot standby in a second region with automated health-check-driven failover
13. Your organization requires that only users from specific geographic regions can access a public-facing GCP application. Which service enforces this? → Cloud Armor geo-restriction policies
14. Which GCP compute service is best suited for running stateful, long-running background workers that don't need HTTP endpoints? → Cloud Run Jobs
15. A Cloud Architect needs to audit all IAM policy changes in a GCP organization over the past 30 days. Which service provides this data? → Cloud Audit Logs (Admin Activity logs)
16. Which Google Cloud feature allows you to share a VPC network across multiple projects within the same organization? → Shared VPC
17. A company needs to export all GCP logs to a centralized BigQuery dataset for long-term analysis. What is the best approach? → Configure a Log Sink to route logs to BigQuery
18. What is the maximum number of IAM policy bindings that can be set on a single Cloud Storage bucket? → 1,500
19. A team wants to receive alerts when their GKE cluster CPU utilization exceeds 80% for 5 minutes. Which tool should they configure? → Cloud Monitoring alerting policies
20. What Cloud Storage class is most cost-effective for data accessed less than once per year? → Archive
21. An organization wants to test their GCP disaster recovery plan without causing a production outage. Which approach is best? → Conduct a chaos engineering or DR simulation in a non-production environment
22. Which GCP monitoring concept defines a target level of service that is measured against an error budget? → SLO (Service Level Objective)
23. Which Cloud Spanner configuration provides the highest level of availability and global disaster recovery? → Multi-region instance
24. A GKE workload requires access to a Cloud Storage bucket. What is the recommended way to grant this permission without using service account keys? → Use Workload Identity to bind a Kubernetes service account to a GCP service account
25. A company must ensure Cloud Storage objects in a specific bucket cannot be deleted or modified for 7 years for compliance. What should they configure? → Bucket Lock with a Retention Policy
26. Which GCP service automatically groups and analyzes application error events and notifies developers of new errors? → Error Reporting
27. What is the purpose of a Cloud Monitoring workspace? → Provide a unified monitoring view across multiple GCP projects
28. Which Compute Engine feature allows you to automatically add or remove VM instances based on load? → Managed Instance Groups with Autoscaling
29. A team needs to migrate an existing MySQL database to GCP with minimal changes. Which managed service should they use? → Cloud SQL for MySQL
30. Which type of Cloud VPN is recommended for high-availability production workloads? → HA VPN