Google Cloud Associate Cloud EngineerStudy guide

Understand the Google Cloud resource hierarchy (organization, folders, projects) and policy inheritance, the project as the basic unit of billing/permissions/resources, managing users and groups with Cloud Identity, and Cloud IAM—who gets which role on which resource—with the principle of least privilege.

Understand the configuration tasks that make a cloud environment operational: linking billing accounts to projects, budgets and alerts and billing exports, enabling APIs in a project, and assessing and requesting increases to quotas.

Understand how to choose among four compute options by workload (Compute Engine VMs, managed Kubernetes GKE, serverless containers on Cloud Run, event-driven Cloud Functions), plus Spot VMs for cost and custom machine types to fit requirements.

Understand how to choose among Google Cloud data services—relational (Cloud SQL, Spanner), NoSQL (Firestore, Bigtable), analytics (BigQuery), and object storage (Cloud Storage)—and how to pick Cloud Storage classes (Standard, Nearline, Coldline, Archive) and Persistent Disk types.

Understand the basics of planning network resources: designing availability with regions and zones, choosing a load balancer by use case, and selecting Network Service Tiers (Premium / Standard) for performance and cost.

Understand launching Compute Engine instances, autoscaling managed instance groups (MIGs) via instance templates, OS Login for access, and configuring GKE clusters (Autopilot, Standard, regional, private), deploying containerized apps, and using kubectl.

Understand deploying apps to Cloud Run and Cloud Functions, receiving events via Pub/Sub, Cloud Storage changes, and Eventarc, deciding where to deploy, and deploying data products (Cloud SQL, BigQuery, Firestore, Spanner, AlloyDB, Pub/Sub, Dataflow) and loading data.

Understand creating VPCs with subnets (custom mode, Shared VPC), ingress/egress firewall rules based on IP, network tags, and service accounts, connecting external networks via Cloud VPN and VPC Network Peering, and Infrastructure as Code with Terraform and Config Connector.

Understand operational tasks: Compute Engine snapshots and images, GKE node pools and horizontal/vertical autoscaling, Cloud Run versions and traffic splitting, Cloud Storage object lifecycle management and database backup/restore, and subnet expansion, static IPs, Cloud DNS, and Cloud NAT.

Understand operational observability: metrics, alerts, and custom metrics with Cloud Monitoring; viewing/filtering logs, log buckets and log routers, and external export with Cloud Logging; deploying the Ops Agent and Managed Service for Prometheus; and audit logs and checking Google Cloud status.

Understand the core of Google Cloud access control: viewing and creating IAM policies, the difference and selection among basic, predefined, and custom roles, and designing access along the principle of least privilege.

Understand service accounts—identities used by apps and workloads: creating them, using them in IAM policies with least privilege, assigning them to resources, service account impersonation, and issuing short-lived credentials to avoid long-lived keys.