Google Cloud Associate Cloud Engineer — knowledge map
The 127 core concepts of Google Cloud Associate Cloud Engineer and how they connect. Click a node in the map above to explore related terms and prerequisites; the list below indexes every concept with its definition and links to its prerequisites and related concepts.
Concepts (127)
Managed services (management boundary)
A categorization by how much AWS operates for you. The more fully managed (AWS handles patching/scaling/availability), the lower your operational burden but less control; unmanaged (e.g., EC2) is flexible but self-operated. It frames “where your responsibility ends” in the shared responsibility model.
Performance metrics (IOPS/throughput/bandwidth/latency)
Core vocabulary for performance: IOPS = I/O operations per second (small random access, e.g., EBS io2); throughput = data volume per time (MB/s, large sequential transfer); bandwidth = link capacity; latency = delay per operation. Design and monitor by the metric that fits the workload.
Cloud Storage
Object storage for unstructured data such as images, video, and backups.
Cloud Run
A service that runs containers serverless, scaling to zero when idle and billing only for usage.
Compute Engine
Google Cloud IaaS providing virtual machines (VMs) with selectable CPU/memory and OS-level control; ideal as a lift-and-shift target.
Prerequisites: Migration strategy (lift-and-shift/improve-and-move/refactor)
Eventarc
A service that routes events from diverse sources (Pub/Sub, Cloud Storage changes) uniformly to Cloud Run/Cloud Functions.
Prerequisites: Cloud Functions、Cloud Run、Cloud Storage、Pub/Sub
BigQuery
Google Cloud serverless data warehouse for fast SQL analytics on petabyte-scale data.
Deployment Manager
Google Cloud's native Infrastructure as Code service (YAML/Jinja/Python templates). It is deprecated and reaches end of support on 2026-03-31; migrate to the Terraform-based Infrastructure Manager or another IaC tool.
Prerequisites: IaC tools (Terraform / Helm)、Infrastructure as Code (IaC)、Infrastructure Manager、YAML
VPC firewall rules
Stateful rules that allow/deny traffic in/out of a VPC, evaluated by direction, priority, target (tags/service accounts), and source; hierarchical firewall policies exist at the org level.
Prerequisites: Service account、Cloud NGFW and hierarchical firewall
Service account
A special identity for workloads (VMs/apps) rather than humans; prefer short-lived tokens via metadata or Workload Identity Federation over downloaded keys.
Cloud Interconnect
A dedicated-connection service (Dedicated/Partner) linking on-premises to Google Cloud with high bandwidth, low latency, and an SLA; choose vs the simpler encrypted-tunnel Cloud VPN by requirements.
Prerequisites: Cloud VPN、Performance metrics (IOPS/throughput/bandwidth/latency)
Ops Agent
An agent installed on Compute Engine or on-prem VMs that collects detailed system metrics (CPU/memory/disk, etc.) and logs into Cloud Monitoring / Cloud Logging. It unifies the legacy separate Monitoring agent and Logging agent—use this for new deployments.
Prerequisites: Cloud Logging、Cloud Monitoring、Compute Engine
IaC tools (Terraform / Helm)
Beyond Bicep/ARM, pipelines apply multi-cloud Terraform (declarative, state management) and Kubernetes Helm charts to codify infrastructure and app configuration.
Cloud Build
A serverless CI service that automates fetching source, building, testing, and containerizing images. Build steps are defined in cloudbuild.yaml and can be triggered by pushes to GitHub/Cloud Source Repositories; artifacts are typically stored in Artifact Registry.
Prerequisites: YAML
Related: Cloud Deploy、Artifact Registry
Filestore
A fully managed NFS file storage that mounts as a shared file system from Compute Engine VMs or GKE, providing low-latency shared storage.
Prerequisites: Compute Engine、Managed services (management boundary)、Performance metrics (IOPS/throughput/bandwidth/latency)
Cloud DNS
A Google Cloud service that manages internal/external name resolution (domain → IP).
Cloud NAT
A service that lets VMs without external IPs make outbound calls to the internet.
Cloud VPN
A service connecting on-premises or other networks to Google Cloud over an encrypted tunnel.
Storage Transfer Service
A managed service to transfer large or continuous data into Cloud Storage; for small data, the gcloud/bq CLI is simpler.
Prerequisites: Cloud Storage、Managed services (management boundary)
Encryption keys (GMEK / CMEK / CSEK)
GMEK = Google-managed default keys; CMEK = customer-managed keys via Cloud KMS (control rotation/disabling); CSEK = customer-supplied keys. Data is encrypted at rest and in transit by default.
Prerequisites: Encryption at rest、Encryption in transit
Related: Cloud KMS
App Engine
A fully managed web app platform (PaaS) to publish apps without managing servers, letting you focus on development.
Prerequisites: Managed services (management boundary)
Cloud Logging
A Google Cloud Observability capability for collecting, searching, and retaining logs, used for investigation and audit.
Related: Three observability pillars (metrics, logs, traces)
Cloud Monitoring
A Google Cloud Observability capability for metrics monitoring, dashboards, and alerts.
Related: Three observability pillars (metrics, logs, traces)
Pub/Sub
A messaging service that ingests events in real time and distributes them to multiple services; used for streaming ingestion.
Spanner
A distributed relational database combining global strong consistency and high availability, ideal for global core systems.
Prerequisites: Strong consistency
Cloud Deploy
A managed continuous-delivery (CD) service for GKE, Cloud Run, and Anthos. It templates a delivery pipeline (e.g., dev → staging → prod) and provides deployment strategies like canary or blue-green, approval gates, and rollback as built-in features.
Prerequisites: Cloud Run、GKE Enterprise (Anthos)、Deployment strategies (canary/blue-green/rollback)
Related: Cloud Build
Cloud Trace
A distributed-tracing service that follows request paths (spans) across services to find latency bottlenecks; a different observability axis from metrics (Monitoring) or logs (Logging).
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Three observability pillars (metrics, logs, traces)
Memorystore
A fully managed in-memory cache compatible with Redis/Memcached; caches frequent reads to reduce latency. Not a durable store.
Prerequisites: Managed services (management boundary)、Performance metrics (IOPS/throughput/bandwidth/latency)
Vertex AI AutoML
A Vertex AI capability that auto-builds high-quality custom ML models from tabular, text, image, or video data with minimal code. It runs neural architecture search and hyperparameter tuning under the hood to produce a model balancing accuracy against training cost. For quick SQL-only analysis, BigQuery ML can be the simpler choice.
Prerequisites: BigQuery、BigQuery ML、Vertex AI
Related: Tabular Workflows
YAML
A human-friendly text format that expresses hierarchy through indentation. Favored for CloudFormation and other IaC tools and CI/CD pipeline config files, and interconvertible with JSON representing the same data.
Prerequisites: IaC tools (Terraform / Helm)、JSON
Config Connector
An Infrastructure as Code tool that manages Google Cloud resources declaratively the Kubernetes way.
Prerequisites: Infrastructure as Code (IaC)
VPC Network Peering
Directly connecting two VPC networks so they can communicate with each other.
Prerequisites: Virtual Private Cloud (VPC)
Amazon Managed Service for Prometheus (AMP)
A managed, Prometheus-compatible metrics ingestion/storage service. You query container-environment metrics (EKS/ECS, etc.) with PromQL while AWS handles scale and retention—commonly paired with Managed Grafana for visualization.
Prerequisites: Managed services (management boundary)
Cloud Functions
A serverless functions service for event-driven small tasks, such as running when a file is uploaded.
Cloud SQL
A managed relational database compatible with MySQL/PostgreSQL/SQL Server, for typical business apps.
Firestore
A scalable document NoSQL database for mobile and web app data.
Vertex AI
A unified AI platform to build, train, deploy, and operate ML models end to end, including using foundation models.
Encryption at rest
Encrypting data while it sits on disk or object storage. Most managed cloud storage (block/file/object/DB) offers built-in encryption integrated with the platform's key management (e.g., a KMS). A baseline defense protecting the data itself against theft or unauthorized access.
Prerequisites: Cloud Storage
API Gateway (Google Cloud)
A fully managed API gateway in front of serverless backends (Cloud Run/Functions/App Engine); defined with OpenAPI to handle auth, keys, and monitoring.
Prerequisites: App Engine、Cloud Run、Managed services (management boundary)
Virtual Private Cloud (VPC)
Google Cloud's software-defined network. A global resource that holds regional subnets in one network; routes, firewalls, and peering control traffic.
Infrastructure as Code (IaC)
Defining infrastructure declaratively as code (templates) so it is reproducible and version-controlled—preventing manual drift and enabling review, automation, and consistent multi-environment builds. On AWS, CloudFormation and CDK are the main tools.
CIDR notation
A notation expressing an IP address range by prefix length, like “/24” (256 addresses) or “/16” (65,536 addresses)—the smaller the number, the larger the range. It underlies network design across every cloud: sizing VPCs/VNets and subnets, longest-prefix-match routing, and scoping firewall-rule allows.
Prerequisites: VPC firewall rules
Ephemeral port
A temporary high-numbered port (typically 1024–65535) a client uses for the return leg of a connection. Stateless firewall rules (e.g., network ACLs) must explicitly allow this range for return traffic to work—an easily overlooked source of misconfiguration.
Prerequisites: VPC firewall rules、Port number
Deployment strategies (canary/blue-green/rollback)
Canary = release to a subset first; blue/green = instant switch between old/new environments; rollback = revert quickly on issues. Risk-limiting release techniques.
VPC Service Controls
A mechanism that prevents data exfiltration to managed services (e.g., BigQuery, Cloud Storage) via a service perimeter; a layer of control separate from IAM grants.
Prerequisites: BigQuery、Cloud Storage、Managed services (management boundary)
Artifact Registry
A registry to store and manage container images and language packages; the destination for artifacts built by Cloud Build.
Related: Cloud Build
Cloud CLI emulators
Local mocks (Firestore, Pub/Sub, Spanner, etc.) provided by the Google Cloud CLI to speed local development/unit testing without connecting to the cloud (not a production substitute).
Three observability pillars (metrics, logs, traces)
Metrics (Cloud Monitoring, numeric trends), logs (Cloud Logging, events), and traces (Cloud Trace, request paths); correlate logs and traces by trace ID to pinpoint causes.
Related: Cloud Trace、Cloud Logging、Cloud Monitoring
Cloud NGFW and hierarchical firewall
A next-generation firewall controlling in-VPC traffic; offers hierarchical policies inherited by org/folder, an effective policy evaluated by priority, and Enterprise-tier L7 inspection (IPS). Implement micro-segmentation with tags/service accounts.
Prerequisites: Service account
Cloud Router
A router that exchanges routes dynamically over BGP with on-prem/other networks; configure ASN, route priority/MED, and authentication, and control advertised/learned ranges with custom-advertised/learned routes.
Prerequisites: Route priority
Cross-Cloud Interconnect
A service that links another public cloud to Google Cloud over a dedicated physical link without the internet; use it for multicloud connectivity when you need more bandwidth/lower latency than Cloud VPN.
Prerequisites: Cloud VPN、Cloud Interconnect、Performance metrics (IOPS/throughput/bandwidth/latency)
Port number
A 16-bit number identifying which service is running on a given IP address (e.g., HTTP uses 80, HTTPS uses 443, SSH uses 22). Carried in TCP/UDP headers, and firewall/security-group rules allow or deny traffic based on source/destination port.
Prerequisites: HTTPS
Related: UDP
Strong consistency
A consistency model guaranteeing that a read after a completed write always returns the latest value. It typically costs more latency or throughput than eventual consistency, but is chosen where stale reads are unacceptable, such as inventory counts or balances. Consistency models are picked per use case based on this trade-off.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Eventual consistency
Tabular Workflows
A feature that decomposes the tabular AutoML pipeline into components on Vertex AI Pipelines, letting you customize and reuse individual stages such as feature engineering or architecture search. Where plain AutoML is more black-box, Tabular Workflows targets advanced use cases needing fine control or scale over specific stages.
Prerequisites: Workflows、Vertex AI
Related: Vertex AI AutoML
Billing account and budgets
The unit that pays costs; link projects to it (one account, many projects). Budgets and alerts only notify at thresholds and do not auto-stop spending.
Managed instance group (MIG) and instance template
A Compute Engine group that creates identical VMs from an instance template (a VM blueprint), with autoscaling and self-healing.
Prerequisites: Compute Engine
Organization Policy
A mechanism that inherits and enforces constraints down the resource hierarchy for consistent org-wide rules (e.g., disallow creation outside certain regions); distinct from IAM grants.
Prerequisites: Resource hierarchy
Cloud Storage classes
Classes by access frequency: Standard (frequent)/Nearline (~monthly)/Coldline (~quarterly)/Archive (long-term rare). Less access = cheaper storage but pricier retrieval.
Prerequisites: Cloud Storage
Cloud KMS
A managed key-management service to create and manage encryption keys and control rotation/disabling; the basis of CMEK.
Related: Encryption keys (GMEK / CMEK / CSEK)
Workflows
Serverless orchestration for lightweight cross-service step chaining (simple workflows); heavy dependencies use Cloud Composer.
Anycast
A communication mode that advertises the same IP address from multiple locations at once, automatically routing traffic to the topologically nearest node. CDNs, DNS, and global load-balancing services use it as the foundation for low latency and high availability.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Unicast
BigQuery ML
A capability to create ML models and run predictions with only SQL on data in BigQuery, without moving the data.
Prerequisites: BigQuery
Bigtable
A wide-column NoSQL database for huge-scale, low-latency workloads such as IoT and time series.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Gemini
Google Cloud core generative AI model for text generation, summarization, code assistance, and image understanding, embedded across services and Workspace.
Resource hierarchy
The Google Cloud hierarchy of Organization → Folder → Project → resources; the project is the basic billing/permission unit and policies inherit down the hierarchy.
Spot VM
A Compute Engine VM offered at a deep discount in exchange for possible preemption; used for cost optimization of interruption-tolerant batch work.
Prerequisites: Compute Engine
Encryption in transit
Encrypting data while it moves across the network, typically protected with TLS. Only by pairing it with encryption at rest do you cover a piece of data's whole lifecycle (stored and moving)—satisfying both is a baseline security requirement.
Prerequisites: Encryption at rest
Eventual consistency
A consistency model where a read right after a write may return a stale value, but all replicas eventually converge over time. It's often the default behavior of distributed data stores that prioritize availability and low latency, and using it for reads that don't need strong consistency buys throughput.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Strong consistency
Cloud Billing
Links a billing account to projects to track costs, set budget alerts, and export billing data to BigQuery.
Prerequisites: Billing account and budgets、BigQuery
Gemini Cloud Assist
An AI assistant inside the Google Cloud console that analyzes logs, metrics, traces, and resource configuration to offer natural-language troubleshooting and architecture suggestions. Aimed at cutting the time operators spend investigating root causes across the console.
Prerequisites: Gemini
Related: Gemini Code Assist
Gemini Code Assist
An AI pair-programming feature that assists with code completion, generation, explanation, and review inside an IDE. It has a free individual tier and an Enterprise tier that can ground completions in a private codebase and add enterprise administration. Used as an extension for VS Code and JetBrains-family IDEs.
Prerequisites: Gemini
Related: Gemini Cloud Assist
IP masquerade (GKE)
A mechanism that source-NATs a GKE Pod's outbound (egress) traffic to the node's IP. By default, non-masqueraded (untranslated) destinations are RFC 1918 private ranges and link-local addresses; the ip-masq-agent configuration lets you add or change the target CIDRs. Whether this agent is auto-deployed as a DaemonSet, and its default configuration, depends on the GKE version and cluster setup (e.g., Autopilot vs. Standard, whether Dataplane V2 is in use).
Prerequisites: Dataplane V2、CIDR notation
Horizontal scaling (scale out)
Scaling by adding more instances to spread the load. It assumes a stateless design plus a load balancer and auto scaling, and since one instance failing doesn't take down the whole system, it also improves fault tolerance. Considered the default direction in cloud-native design.
Prerequisites: Fault tolerance
HTTPS
HTTP carried on top of TLS. Unlike plain HTTP, the traffic is encrypted, preventing eavesdropping or tampering along the path. Browsers verify the certificate to confirm the server's legitimacy, and it's now the standard way sites communicate.
Related: TLS
Microservices
An architectural style splitting an application into small, independent services that can each be deployed, scaled, and failed in isolation—at the cost of more inter-service communication and operational complexity. Commonly built on containers or serverless compute plus an API gateway.
Multicast
A communication mode that delivers data only to hosts that joined a specific group. Like broadcast, it's often not natively supported by cloud virtual networks; where it's required, teams use a dedicated feature such as a transit-gateway's multicast capability, or redesign around unicast instead.
Cloud External Key Manager (Cloud EKM)
Encrypts Google Cloud data using keys held in an external (own/third-party) key-management backend, raising key sovereignty beyond CMEK (customer-managed via Cloud KMS).
Prerequisites: Cloud KMS、Encryption keys (GMEK / CMEK / CSEK)
Infrastructure Manager
A Google Cloud service that runs Terraform as managed IaC, making infrastructure reproducible and reviewable/auditable via CI/CD and PRs.
Prerequisites: IaC tools (Terraform / Helm)
Private Google Access
A setting that lets VMs without external IPs reach Google APIs (e.g., Cloud Storage) privately; distinct in purpose from general egress via Cloud NAT.
Prerequisites: Cloud NAT、Cloud Storage
Cloud Run revisions and traffic splitting
Each deploy creates an immutable revision; traffic splitting controls the percentage sent to each revision, enabling canary release and rollback.
Prerequisites: Cloud Run、Deployment strategies (canary/blue-green/rollback)
gRPC
A low-latency, typed (Protocol Buffers) RPC framework over HTTP/2, suited to internal service-to-service calls; choose REST for public web.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Cloud CDN
A CDN enabled on an external Application LB backend that caches content at Google's edge; origins include MIG/Cloud Storage/Cloud Run/internet NEG. Drop stale content via cache invalidation on updates.
Prerequisites: Cloud Run、Cloud Storage
Network endpoint group (NEG)
A load balancer backend unit that groups container-native (GKE), serverless (e.g., Cloud Run), or internet endpoints; chosen vs managed instance groups (MIGs) by need.
Prerequisites: Managed instance group (MIG) and instance template、Cloud Run
VLAN attachment
The logical link between a Cloud Interconnect and a VPC (Cloud Router); after creating the physical Interconnect, a VLAN attachment carries traffic to the actual VPC.
Prerequisites: Cloud Interconnect、Cloud Router
TLS
A protocol that encrypts traffic and authenticates the server (and, when required, the client) via certificates. It performs key exchange and authentication in a handshake, then encrypts data with a symmetric key. Cloud load balancers and CDNs commonly terminate it, with certificates issued and renewed by a managed service.
Prerequisites: Managed services (management boundary)
Related: HTTPS
UDP
A lightweight, connectionless transport-layer protocol with no ordering guarantee or retransmission. Its low overhead makes it fast, so it's used for DNS lookups and video/audio streaming—cases that prefer low latency over occasional loss.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Related: Port number
Unicast
The most common one-to-one communication mode, sending from a single source to a single destination. Ordinary client–server traffic and most API calls are designed around this mode.
Related: Anycast
Vertical scaling (scale up)
Scaling by upgrading a single instance's specs (CPU, memory, etc.). It requires little application change and is simple, but is capped by instance-type limits, tends to be a single point of failure, and often requires downtime to apply. The counterpart choice to horizontal scaling.
Prerequisites: Horizontal scaling (scale out)、Single point of failure (SPOF)
GKE Autopilot
A GKE cluster mode where Google fully manages node provisioning, scaling, upgrades, and hardening. Billing is per-Pod, and you lose node-pool tuning and SSH access in exchange for minimal operational overhead.
Prerequisites: Managed services (management boundary)
Transfer Appliance
An offline transfer service that ships large data on a physical device for ingestion into Cloud Storage; suits volumes where network transfer is impractical.
Prerequisites: Cloud Storage
GKE Enterprise (Anthos)
A platform to operate and manage containers consistently across on-premises and multiple clouds, enabling hybrid and multicloud.
Connection tracking
How a stateful firewall (e.g., a security group) remembers established connections in a state table and automatically allows their return traffic. Unlike stateless rules, it removes the need to separately open the ephemeral-port range for the return leg.
Prerequisites: Ephemeral port
Model Garden
A Vertex AI catalog to browse and choose among diverse foundation models (Google, open, third-party).
Prerequisites: Vertex AI
Classic VPN
A legacy, single-tunnel IPSec VPN gateway with no SLA guarantee. It comes in route-based (dynamic) and policy-based (static traffic-selector) variants, with the latter kept mainly for compatibility with specific peer network devices. Google deprecates it in favor of HA VPN for new builds.
Prerequisites: HA VPN
Cloud Code
An extension built into IDEs like VS Code and IntelliJ. It helps author Kubernetes manifests and Dockerfiles, deploy to GKE/Cloud Run directly from your local machine, and live-debug on a remote cluster—all from within the editor.
Prerequisites: Cloud Run
Cloud Endpoints
An API management service that manages OpenAPI/gRPC APIs via the Extensible Service Proxy, adding auth, monitoring, and quotas.
Prerequisites: gRPC
HA VPN
Google's recommended IPSec VPN, providing a 99.99% availability SLA via two redundant tunnels (each with its own external IP). Used to connect to on-prem, other clouds, or other VPCs, and assumes dynamic routing via BGP. The default choice for new deployments.
Workload Identity Federation (GCP)
A mechanism that trusts an external identity provider outside Google Cloud—AWS, Azure, on-prem, or CI/CD like GitHub Actions—and exchanges its issued tokens for temporary Google Cloud credentials. Used for external system integrations where you want to avoid downloading and distributing service-account keys.
Prerequisites: Service account
Dataplane V2
GKE's eBPF-based networking data plane. It enforces Kubernetes NetworkPolicy (Pod-to-Pod L3/L4 traffic control) efficiently at the kernel level and also provides visibility via flow logs. It has become the default for new clusters on recent GKE versions and runs with less overhead than the older iptables-based implementation.
Immutable infrastructure
An operating model that never modifies running servers—instead it rebuilds and replaces them from a new image (AMI/container). It eliminates configuration drift, and rollback is just reverting to the prior version; pairs well with blue/green and Auto Scaling.
Prerequisites: Deployment strategies (canary/blue-green/rollback)
JSON
A lightweight text format representing structured data as braces and key–value pairs. Widely used wherever machine-readability matters most—API request/response bodies and permission definitions like IAM or bucket policies.
Principle of least privilege
A design principle that grants each identity (person, app, or service) only the minimum permissions needed to do its job. Excess privilege widens the blast radius of a mistake or breach, so it is continuously tightened through IAM roles, policies, and permission boundaries.
Prerequisites: Blast radius
Broadcast
A communication mode that sends data to every host on the same network segment at once. Most public-cloud virtual networks (VPC/VNet equivalents) don't support broadcast by default, so on-prem applications built around it typically need a redesign when migrated.
Bulkhead
A pattern that isolates resources into compartments so overload/failure in one does not spread (named after a ship’s watertight bulkheads). Separating connection pools, threads, queues, or accounts/cells contains impact.
Prerequisites: Connection pool
Cloud Load Balancing
Choose by use: global external Application LB (L7, routes global users to nearest), internal LB (internal microservices), Network LB (L4, TCP/UDP).
Prerequisites: Microservices
Migration strategy (lift-and-shift/improve-and-move/refactor)
Lift-and-shift = move as-is (fastest, least change); improve-and-move = slight optimization; refactor = rebuild cloud-native (most effort, biggest payoff). Choose by requirements.
Application Default Credentials (ADC)
The standard way an app resolves credentials to authenticate to Google Cloud; combine with service accounts or Workload Identity Federation to avoid hardcoded keys.
Prerequisites: Service account
Cloud SQL Auth Proxy
A proxy for secure Cloud SQL connections using IAM auth and encryption without exposing a public IP; the recommended way for apps to connect to the DB.
Prerequisites: Cloud SQL
Connection pool
Reuses database connections to avoid connection setup cost and exhaustion; especially important for serverless/high-concurrency apps.
Secret Manager
A managed service to securely store, retrieve, and rotate secrets (API keys, passwords, certificates); avoid embedding them in code.
Prerequisites: Managed services (management boundary)
Signed URL
A URL granting time-limited, scoped access to a Cloud Storage object without making it public; different from making a whole bucket public.
Prerequisites: Cloud Storage
Artifact Analysis
Scanning that detects known vulnerabilities in container images/packages. Distinct from Binary Authorization (deploy-only-if-signed); combine detection with enforcement.
Prerequisites: Binary Authorization
Private Service Connect
A way to reach specific managed/published services over private IPs without traversing the internet; use it to avoid exposing public IPs.
Prerequisites: Managed services (management boundary)
Synthetic monitors
Actively and periodically probe endpoints/workflows from the user perspective (external monitoring); pair with passive monitoring to catch issues proactively.
Prerequisites: Workflows
Google Cloud Armor
Edge/backend security policies applied in front of an external Application LB; provides WAF (SQLi/XSS/RFI), advanced DDoS protection with ML-based Adaptive Protection, rate limiting, bot management, and Threat Intelligence.
Prerequisites: Rate limiting
Cloud DNS routing policies and split-horizon
Advanced Cloud DNS resolution: geolocation (vary by source region) and failover (switch to backup on primary failure) routing policies, plus split-horizon DNS resolving the same name differently via public/private zones.
Prerequisites: Cloud DNS
Dynamic routing mode (global/regional)
A VPC setting that determines how far BGP routes learned by Cloud Router propagate: regional stays within one region; global propagates to all regions. Use global to span multiple regions.
Prerequisites: Cloud Router
Hybrid DNS (forwarding zones/inbound policy/DNS peering)
Configurations for bidirectional name resolution between on-prem and Cloud DNS: forwarding zones query on-prem from cloud, inbound server policy resolves cloud from on-prem, and DNS peering references a zone in another VPC.
Prerequisites: Cloud DNS
Network Intelligence Center
A suite for network visualization, diagnosis, and optimization: Network Topology (visualize), Connectivity Tests (static route/firewall diagnosis), Performance Dashboard (packet loss/latency), Firewall Insights, Network Analyzer (automatic config diagnosis), and Flow Analyzer.
Prerequisites: Performance metrics (IOPS/throughput/bandwidth/latency)
Route priority
A value that decides which route is chosen when multiple share a destination; a lower value wins. Combine with network tags to scope where it applies.
Secure Web Proxy
A proxy that allowlists egress by URL/SNI; unlike Cloud NAT (general internet egress), it controls "where egress is allowed" at the application layer.
Prerequisites: Cloud NAT
Rate limiting
Capping the number of requests accepted per unit of time to protect downstream systems from overload and abuse (DoS, scraping, etc.). Commonly implemented as API-gateway throttling or a web-application-firewall rate-based rule.
Blast radius
The scope of impact from a failure, mistake, or breach. Kept small via account separation, multiple Regions/AZs, least privilege, and cell-based partitioning. Limiting blast radius is fundamental to resilience and security.
Fault tolerance
Designing so the service keeps running despite component failures—stronger than high availability (fast recovery): it continues without interruption. Achieved via redundant parallel paths (active/active), N+1, and spreading across AZs (auto-recovery, which involves a brief recovery, is more an HA technique).
Single point of failure (SPOF)
A component whose failure brings down the whole system. Eliminated via multi-AZ placement, redundancy, load balancing, and automatic failover. The starting point of availability design is to find and remove SPOFs.
Subnet mask
A value marking the boundary between the network and host portions of an IP address (e.g., 255.255.255.0)—the dotted-decimal counterpart to a CIDR prefix length, still used in on-prem network gear and some cloud configuration screens.
Prerequisites: CIDR notation