GCP PCA · Domain 2 of 6

GCP PCA Domain 2: Managing and provisioning a cloud solution infrastructure

Section 2 moves from diagrams to configuration. You set up hybrid and VPC network topologies, storage with lifecycle and protection, compute with the right volatility and orchestration, and ML workflows on Gemini Enterprise Agent Platform.

Exam weight
~17.5%
Official objectives
5
Estimated questions estimate
9–11
Suggested study time estimate
16–20 hrs

About 13 min read Reviewed October 2026

Overview

Section 2 has five objectives. The first three cover classic infrastructure: network topologies for hybrid, multicloud and project-to-project traffic with firewalls and load balancing; storage allocation, transfer, retention, lifecycle and backup; and compute provisioning across Compute Engine, GKE, serverless and Google Cloud VMware Engine, including Spot versus standard capacity and patch management.

The last two objectives are AI provisioning, written with Google's April 2026 names. Objective 2.4 covers Gemini Enterprise Agent Platform (formerly Vertex AI): Agent Platform Pipelines for automating the ML lifecycle, preparing data integration, and using AI Hypercomputer GPUs and TPUs with suitable consumption models. Objective 2.5 asks you to tell Google's prebuilt AI APIs apart, know Gemini Enterprise features such as agents and NotebookLM, and integrate models from Model Garden.

How it's tested

Section 2 questions are concrete. They name a workload and its constraints, then ask how to configure the network path, storage class, retention setting, compute capacity type or AI service. Correct answers usually combine the right service with the right setting rather than simply naming a product.

  • Connectivity choice

    Pick HA VPN, Dedicated or Partner Interconnect, Cross-Cloud Interconnect, VPC Network Peering or Shared VPC from bandwidth, SLA and ownership clues.

  • Data lifecycle setting

    Select a storage class, Object Lifecycle Management rule, retention policy or backup plan that meets cost and recovery needs.

  • AI build or buy

    Decide between a prebuilt Google AI API, a Gemini Enterprise feature, a Model Garden model or a custom pipeline on Agent Platform.

Reasoning it through

A media company must tag millions of archived video files with spoken topics and detect unsafe frames, and its small team has no ML engineers. Training a custom model through Agent Platform Pipelines would take months. Prebuilt APIs for speech and video analysis, triggered from Cloud Run functions when files land in Cloud Storage, meet the need fastest with the least ML effort.

Objectives 5

Official objectives from the Google Cloud outline, in outline order.

2.1 Configuring network topologiesHybrid and multicloud links, Google Cloud-to-Google Cloud traffic, security protections, VPC design with load balancing.
What it means
This objective covers building the network paths a solution needs. It includes extending to on-premises environments, connecting to other clouds, communication between Google Cloud networks and projects, security protections such as intrusion protection, access control and firewalls, and VPC design that includes load balancing.
What to understand
HA VPN gives an encrypted 99.99% SLA path over the internet when two tunnels and Cloud Router BGP sessions are configured. Dedicated Interconnect suits 10 or 100 Gbps needs at a colocation facility, Partner Interconnect suits smaller needs through a provider, and Cross-Cloud Interconnect links directly to another cloud. Shared VPC centralizes network control across projects, while VPC Network Peering joins separate networks without transitive routing. Cloud Next Generation Firewall policies and Cloud IDS add protection, and the load balancer type depends on protocol and global or regional reach.
How it shows up
Expect stems with bandwidth figures, SLA targets and team boundaries that point to one connectivity or VPC model.
Common confusion
VPC Network Peering is not transitive; a third network cannot route through a peered network.
2.2 Configuring individual storage systemsAllocation, processing and compute provisioning, access, transfer, retention and lifecycle, growth, protection.
What it means
This objective covers setting up storage once a type has been chosen. It includes allocating storage, provisioning related data processing and compute, security and access management, configuring network transfer and latency, data retention and lifecycle management, planning for growth, and data protection through backup and recovery.
What to understand
Cloud Storage classes (Standard, Nearline, Coldline, Archive) differ by minimum storage duration and retrieval cost, and Object Lifecycle Management or Autoclass moves objects between them. Retention policies and Bucket Lock enforce write-once retention for regulated data. Location choice (region, dual-region, multi-region) trades latency against resilience. Access should use uniform bucket-level access with IAM. For databases, configure automated backups, point-in-time recovery and read replicas; the Backup and DR Service centralizes protection for VMs and databases.
How it shows up
Questions often ask for the cheapest storage setting that still meets an access frequency or retention rule.
Common confusion
Archive storage is cheapest to keep but has a 365-day minimum duration and retrieval fees.
2.3 Configuring compute systemsProvisioning, Spot or standard volatility, cloud-native networking, orchestration, patching, containers, serverless.
What it means
This objective covers configuring compute. It includes provisioning compute resources, choosing volatility (Spot versus standard VMs), network configuration for Compute Engine, GKE, serverless and Google Cloud VMware Engine, infrastructure orchestration, resource configuration and patch management, container orchestration and serverless computing.
What to understand
Managed instance groups with instance templates give autohealing, autoscaling and rolling updates. VM Manager handles OS patching and inventory across fleets. GKE Autopilot removes node management, while Standard mode gives node pool control. Serverless services reach VPC resources through Direct VPC egress or Serverless VPC Access connectors. Google Cloud VMware Engine runs existing vSphere workloads without conversion, which helps when a data center exit must happen before applications can change.
How it shows up
Expect questions on capacity type, orchestration mode and how serverless or VMware workloads connect to private resources.
Common confusion
GKE Autopilot still runs Kubernetes; it removes node operations, not the Kubernetes API.
2.4 Leveraging Gemini Enterprise Agent Platform for end-to-end ML workflowsAgent Platform Pipelines, data integration preparation, AI Hypercomputer GPUs and TPUs for training and serving.
What it means
This objective covers running an ML lifecycle on Gemini Enterprise Agent Platform, the April 2026 name for Vertex AI. It includes automating the lifecycle with Agent Platform Pipelines, preparing data integration for Agent Platform, and using AI Hypercomputer GPUs and TPUs for training and serving, including consumption models and large-scale training.
What to understand
A pipeline chains data preparation, training, evaluation, registration and deployment so each run is repeatable and traceable. Data usually arrives from BigQuery or Cloud Storage. For capacity, know the difference between on-demand, Spot, reserved and committed use capacity, and that Dynamic Workload Scheduler can queue GPU or TPU requests for batch training. TPUs suit large tensor workloads written for frameworks such as JAX or PyTorch/XLA, while GPUs offer broader framework support.
How it shows up
Questions test which component automates retraining and which accelerator or consumption model fits a training budget.
Common confusion
Older material calls these Vertex AI Pipelines; the current guide uses the Agent Platform name.
2.5 Configuring prebuilt solutions or APIs with Agent PlatformGoogle AI APIs, Gemini Enterprise features such as agents and NotebookLM, Model Garden integration.
What it means
This objective covers using AI without building models. It includes telling apart Google's AI APIs for search, conversation, vision, image, video and audio, knowing Gemini Enterprise features such as AI agents and NotebookLM, and integrating models from Model Garden.
What to understand
Prebuilt APIs such as Cloud Vision, Video Intelligence, Speech-to-Text, Text-to-Speech and Translation solve common tasks with a call. Search and conversational products ground answers in a company's own data for site search and virtual agents. Gemini Enterprise gives employees agents and NotebookLM for working with documents. Model Garden lists Google, partner and open models that can be deployed to an endpoint or called as a managed API when a specific model is required.
How it shows up
Expect a business task and a choice between an API, a Gemini Enterprise feature and a custom model.
Common confusion
NotebookLM is an end-user research tool, not an API for building a customer-facing chatbot.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • HA VPN

    Encrypted IPsec connectivity with a 99.99% SLA when configured with two tunnels and BGP.

    Remember
    Classic VPN does not carry the 99.99% SLA.
    Tested as
    Low-bandwidth or backup hybrid paths.
    Trap
    Expecting VPN to deliver Interconnect-level bandwidth.

  • Dedicated vs Partner Interconnect

    Private physical links to Google, direct or through a service provider.

    Remember
    Dedicated needs presence in a colocation facility; Partner works where you cannot reach one.
    Tested as
    High-bandwidth hybrid scenarios.
    Trap
    Assuming Interconnect traffic is encrypted by default.

  • Shared VPC

    One host project owns the network; service projects use its subnets.

    Remember
    Central network control with team-level project ownership.
    Tested as
    Multi-team organizations.
    Trap
    Confusing it with VPC Network Peering.

  • Object Lifecycle Management

    Rules that change storage class or delete objects by age or condition.

    Remember
    Automates cost control for aging data.
    Tested as
    Retention and cost questions.
    Trap
    Moving data to Archive that is read weekly.

  • Bucket Lock

    Locks a retention policy so objects cannot be deleted or replaced early.

    Remember
    A locked policy cannot be removed or shortened.
    Tested as
    Regulated record retention.
    Trap
    Using object versioning as a compliance control.

  • Spot VMs

    Preemptible capacity at deep discounts with no maximum runtime.

    Remember
    Workloads must tolerate interruption.
    Tested as
    Batch processing and some training jobs.
    Trap
    Using them for latency-sensitive front ends.

  • Google Cloud VMware Engine

    Managed VMware environment running in Google Cloud.

    Remember
    Moves vSphere workloads without rewriting or reformatting VMs.
    Tested as
    Fast data center exits.
    Trap
    Choosing VM conversion when the stem stresses keeping VMware tooling.

  • Agent Platform Pipelines

    Managed orchestration for ML workflows on Gemini Enterprise Agent Platform.

    Remember
    Makes training and deployment repeatable and auditable.
    Tested as
    Retraining automation questions.
    Trap
    Scheduling notebooks by hand instead.

  • AI Hypercomputer consumption models

    Ways to obtain accelerators: on demand, Spot, reservations, committed use and Dynamic Workload Scheduler.

    Remember
    Match the model to urgency and budget.
    Tested as
    Large training jobs in case studies.
    Trap
    Buying long commitments for a one-off experiment.

  • Model Garden

    Catalog of first-party, partner and open models with deployment options.

    Remember
    Use it when a specific or open model is required.
    Tested as
    Integration questions in 2.5.
    Trap
    Assuming every model must be self-hosted on GKE.

  • Gemini Enterprise

    Google's workplace AI offering with agents and NotebookLM for employees.

    Remember
    Aimed at internal productivity, not public apps.
    Tested as
    Employee knowledge scenarios.
    Trap
    Recommending it for a customer-facing storefront search.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Hybrid connectivity

ConceptMeaningKey differenceCommon trap
HA VPN IPsec tunnels over the internet. Encrypted, quick to set up, limited per-tunnel bandwidth. Picking it for sustained multi-gigabit traffic.
Dedicated Interconnect Direct physical link. Highest bandwidth, needs colocation presence. Forgetting redundancy for the 99.99% SLA.
Partner Interconnect Link through a provider. Smaller increments, no colocation needed. Assuming the partner handles BGP for every option.
Cross-Cloud Interconnect Direct link to another cloud provider. Built for multicloud traffic. Using it for on-premises sites.

Cloud Storage classes

ConceptMeaningKey differenceCommon trap
Standard Frequently accessed data. No minimum duration. Leaving cold archives in Standard.
Nearline Accessed about once a month. 30-day minimum. Using it for daily reads.
Coldline Accessed about once a quarter. 90-day minimum. Ignoring retrieval charges.
Archive Accessed less than once a year. 365-day minimum, lowest storage price. Expecting slow restore; access is still immediate.

AI options

ConceptMeaningKey differenceCommon trap
Prebuilt AI API Ready model for a common task. No training, fastest to adopt. Choosing custom training for a standard task.
Model Garden model Selected model deployed or called through Agent Platform. Choice of first-party, partner or open models. Overlooking license terms of open models.
Custom pipeline Training workflow on Agent Platform. Full control for unique data and objectives. Underestimating data and staffing needs.

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. VPN for heavy traffic

    What candidates pick
    HA VPN for a steady 20 Gbps replication stream.
    Why it looks right
    It is quick and encrypted.
    Why it's wrong
    VPN tunnels have per-tunnel bandwidth limits; sustained high throughput calls for Interconnect, adding encryption on top if required.

    Clue to watch for Large, steady bandwidth figures in the stem.

  2. Peering as a hub

    What candidates pick
    Peer every spoke to one hub VPC and route between spokes.
    Why it looks right
    It looks like a simple star.
    Why it's wrong
    Peering does not pass traffic between spokes; use Network Connectivity Center or Shared VPC.

    Clue to watch for Spokes that must talk to each other.

  3. Versioning for compliance

    What candidates pick
    Turn on object versioning to meet a seven-year retention rule.
    Why it looks right
    Versions keep old copies.
    Why it's wrong
    Versions can still be deleted; a locked retention policy enforces the rule.

    Clue to watch for Words such as regulator, immutable or must not be deleted.

  4. Custom model for a standard task

    What candidates pick
    Build a training pipeline to transcribe calls.
    Why it looks right
    Custom feels more accurate.
    Why it's wrong
    Speech-to-Text already handles transcription, and a pipeline adds cost and delay without a stated need.

    Clue to watch for A small team or a short deadline.

  5. Wrong Gemini product

    What candidates pick
    Use NotebookLM to power a public shopping assistant.
    Why it looks right
    It is a Gemini product that answers from documents.
    Why it's wrong
    NotebookLM serves employees; a customer assistant needs conversational or agent services built on Agent Platform.

    Clue to watch for Customer-facing, web or mobile channel.

  6. Reservations for a one-time job

    What candidates pick
    Commit to a three-year accelerator purchase for a single training run.
    Why it looks right
    Commitments give the biggest discount.
    Why it's wrong
    A one-off job wastes the commitment; Spot capacity or Dynamic Workload Scheduler fits short, flexible work.

    Clue to watch for One-time or experimental training.

Answer framework

Apply these steps when a Section 2 question asks how to configure a resource.

  1. Identify the resource family in the question: network path, storage system, compute platform, ML workflow or prebuilt AI capability.
  2. Pull out the numbers that matter, such as bandwidth, SLA, access frequency, retention period, interruption tolerance or training scale.
  3. Choose the service tier or capacity type those numbers require, for example Interconnect over VPN or Coldline over Standard.
  4. Add the configuration detail the stem expects, such as a lifecycle rule, retention lock, BGP session, autoscaling policy or pipeline step.
  5. Reject answers that work technically but add avoidable operational effort, such as custom training where an existing API already solves the task.

Practice question

A manufacturer needs 40 Gbps of private, low-latency connectivity between its data center, located in a colocation facility that Google also uses, and Google Cloud. The link must have a 99.99% availability SLA. Which configuration should the architect choose?

Want more like this? The GCP PCA practice test has questions for every domain.

Checklist

0 of 13

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Split this section into infrastructure and AI. For infrastructure, use a lab project to build a Shared VPC with two service projects, an HA VPN to a second VPC that simulates on premises, and a regional managed instance group behind a load balancer. Create a bucket, add lifecycle rules and a retention policy, then read the pricing page to see why minimum durations matter. Hands-on work makes configuration questions much easier to reason through.

For AI, first learn the 2026 naming. Make a two-column list of old Vertex AI terms and the Gemini Enterprise Agent Platform names used in the guide. Then run a small pipeline tutorial and note each step from data to endpoint. Spend an hour on the prebuilt API catalog so you can name which API handles speech, video, images, translation or search. Close with mixed scenario practice drawn from the Cymbal Retail and Altostrat Media cases, which lean on these AI services. Budget 16 to 20 hours.

FAQ

How much of the exam is Managing and provisioning a cloud solution infrastructure?

Section 2 is weighted at about 17.5%, which works out to roughly 9 to 11 questions on a 50 to 60 question exam. That estimate is editorial; Google does not publish question counts per section.

What is Gemini Enterprise Agent Platform?

It is the name Google introduced in April 2026 for the platform previously called Vertex AI. The exam guide uses the new name in objectives 2.4 and 2.5, including Agent Platform Pipelines.

Do I need to write ML code for this section?

No. The architect needs to know how pipelines, data preparation and accelerators fit together and when to pick a prebuilt API, not how to write training code.

Which networking topics overlap with the Network Engineer exam?

Hybrid connectivity, Shared VPC, peering, firewalls and load balancing overlap, but the architect exam tests selection and fit more than detailed configuration commands.

Is Google Cloud VMware Engine on the exam?

Yes. Objective 2.3 names it under cloud-native networking for compute. Know that it runs existing VMware workloads in Google Cloud with little change.

Why are Spot VMs listed separately?

The guide lists volatility configuration, Spot versus standard, because the choice drives both cost and reliability. Expect questions that test whether a workload can survive preemption.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 2 knowledge

Test your ability to configure hybrid links, storage lifecycle, compute capacity and Agent Platform workflows under realistic constraints.

Take the GCP PCA practice test Check your GCP PCA readiness

Keep going