Home / cloud-computing / Google Cloud Professional Cloud Architect / Cheat Sheet
Google Cloud Professional Cloud Architect

GCP PCA Cheat Sheet

PCA Tests Meeting Every Stated Requirement at Least Operational Cost — Not the Most Powerful Service

For architects who translate business goals into Google Cloud designs, migrations and operating models. The shift: tally every business and technical constraint, including people and process, then pick the simplest managed design that satisfies all of them.

Check Your Readiness →
Among the harder certs
Avg: Not published by Google
Pass: 750 / 1000
Most candidates understand Google Cloud Professional Cloud Architect concepts — and still fail. This exam tests how you apply knowledge under pressure.

Professional Cloud Architect Section Map

Each exam draws two of four current case studies (Altostrat Media, Cymbal Retail, EHR Healthcare, KnightMotives Automotive) for 20–30% of questions. Several options usually work; the winner meets every constraint with the least administration. The guide uses Gemini Enterprise Agent Platform names, formerly Vertex AI.

  1. 01
    Designing and planning a solution architecture (~25%) — requirements, RTO/RPO, workload disposition, compute and database fit, Migration Center
  2. 02
    Managing and provisioning infrastructure (~17.5%) — HA VPN vs. Interconnect, Bucket Lock, lifecycle rules, VMware Engine, Agent Platform and Model Garden
  3. 03
    Designing for security and compliance (~17.5%) — hierarchy, org policy, VPC Service Controls, CMEK vs. EKM, IAP, Assured Workloads, Model Armor
  4. 04
    Analyzing technical and business processes (~15%) — DR pattern tiers and testing, postmortems, stakeholders, change management, cost levers
  5. 05
    Managing implementation (~12.5%) — Apigee vs. API Gateway, Terraform, emulators, gcloud/bq/gsutil, Application Default Credentials
  6. 06
    Solution and operations excellence (~12.5%) — Well-Architected operational excellence, SLO burn alerts, Trace vs. Profiler, Cloud Deploy, DORA

Wrong instinct vs correct approach

A MySQL catalogue must move within three months, under ten minutes downtime, with no code changes
✕ Wrong instinct

Refactor into microservices on Spanner before migrating

✓ Correct approach

Use Database Migration Service into Cloud SQL for MySQL: continuous replication keeps cutover short, the engine stays the same, and administration drops. A rewrite cannot meet the deadline; modernise after the move.

A manufacturer in a Google colocation facility needs 40 Gbps private connectivity with a 99.99% SLA
✕ Wrong instinct

Several HA VPN tunnels over the internet

✓ Correct approach

Dedicated Interconnect in the 99.99% topology: redundant connections in two metros and regions with Cloud Router and global routing. VPN tunnels have per-tunnel bandwidth limits; Partner Interconnect suits sites without colocation presence.

A build system in another cloud deploys to GKE; no long-lived credentials and signed images only
✕ Wrong instinct

Store a service account key in the CI tool and scan images

✓ Correct approach

Workload Identity Federation issues short-lived tokens to the external pipeline, and Binary Authorization admits only images attested by the build system. Scanning detects issues but enforces nothing.

Dozens of insurance partners need per-partner keys, rate limits, usage reports and self-service registration
✕ Wrong instinct

Expose the claims APIs behind an external load balancer

✓ Correct approach

Apigee provides API keys, quotas, analytics and a developer portal for partner onboarding. A load balancer offers none of these, and API Gateway is simpler and cheaper but lacks portals and advanced policies.

Three outages in two months came from manual configuration changes applied directly to production
✕ Wrong instinct

Restrict console access and ask staff to be careful

✓ Correct approach

Move changes into infrastructure as code with Terraform through a reviewed CI/CD chain (Cloud Build, Artifact Registry, Cloud Deploy) with canary releases, and run blameless postmortems with tracked preventive actions.

Know these cold

  • ▸ Eliminate options breaking a hard constraint first; cost is judged only among compliant designs
  • ▸ Regional MIGs and regional GKE survive zone loss; zonal autoscaling only adds capacity
  • ▸ Discovery and dependency mapping in Migration Center come before migration waves
  • ▸ Keep vSphere tooling with Google Cloud VMware Engine rather than converting VMs
  • ▸ Gemini Enterprise and NotebookLM serve employees; customer-facing assistants are built on Agent Platform
  • ▸ Prebuilt API before Model Garden model before custom pipeline on AI Hypercomputer
  • ▸ Use IAP TCP forwarding instead of public bastion hosts for administrative SSH
  • ▸ Org policy is preventive regardless of IAM; Assured Workloads applies regulated controls per folder
  • ▸ Pen-testing your own projects needs no Google approval, provided you follow its policies
  • ▸ Load tests prove capacity, chaos tests prove resilience, DR exercises prove RTO and RPO

Can you answer these without checking your notes?

In this scenario: "A MySQL catalogue must move within three months, under ten minutes downtime, with no code changes" — what should you do first?
Use Database Migration Service into Cloud SQL for MySQL: continuous replication keeps cutover short, the engine stays the same, and administration drops. A rewrite cannot meet the deadline; modernise after the move.
In this scenario: "A manufacturer in a Google colocation facility needs 40 Gbps private connectivity with a 99.99% SLA" — what should you do first?
Dedicated Interconnect in the 99.99% topology: redundant connections in two metros and regions with Cloud Router and global routing. VPN tunnels have per-tunnel bandwidth limits; Partner Interconnect suits sites without colocation presence.
In this scenario: "A build system in another cloud deploys to GKE; no long-lived credentials and signed images only" — what should you do first?
Workload Identity Federation issues short-lived tokens to the external pipeline, and Binary Authorization admits only images attested by the build system. Scanning detects issues but enforces nothing.

Common Exam Mistakes — What candidates get wrong

Studying retired case studies such as Mountkirk Games or TerramEarth

The current set is Altostrat Media, Cymbal Retail, EHR Healthcare and KnightMotives Automotive. Read each for business constraints such as cost reduction, limited staff skills or missed email alerts, because those decide answers that look purely technical.

Picking nightly backups when the stem states an RPO of minutes

Low RPO needs replication; low RTO needs warm or hot standby. Tier workloads instead of making everything active-active, and schedule DR exercises, because a documented but untested plan proves neither target.

Choosing Spanner for every relational workload

Spanner earns its cost for global, horizontally scaled, strongly consistent transactions. A regional catalogue or app with modest load fits Cloud SQL, or AlloyDB for faster PostgreSQL. Look for worldwide writes before selecting it.

Meeting a seven-year immutability rule with object versioning

Versions can still be deleted. A retention policy locked with Bucket Lock cannot be removed or shortened. Pair it with lifecycle rules for class changes, checking minimum durations: Nearline 30, Coldline 90, Archive 365 days.

Tightening BigQuery IAM to stop insiders copying data out

Users who may legitimately read data can still copy it to another project. A VPC Service Controls perimeter blocks that path, organization policy location constraints enforce residency, and Data Access audit logs must be enabled explicitly.

Resources to help you pass Google Cloud Professional Cloud Architect on your first attempt

See whether your architecture choices satisfy every constraint the way Professional Cloud Architect scenarios demand.