GCP PCD · Domain 1 of 4

GCP PCD Domain 1: Designing highly scalable, secure, and reliable cloud-native applications

The largest section of the Professional Cloud Developer exam covers how you design an application before writing it: compute platform, APIs and events, security controls for code and identities, and the right database for each access pattern.

Exam weight
~32%
Official objectives
3
Estimated questions estimate
16–19
Suggested study time estimate
20–26 hrs

About 15 min read Reviewed October 2026

Overview

Section 1 asks you to think like the developer who owns an application's design. Subsection 1.1 covers platform choice between Compute Engine, GKE and Cloud Run, regional and zonal placement, load balancing, session affinity, Memorystore caching, REST and gRPC APIs fronted by Apigee or Cloud API Gateway, event-driven integration with Eventarc and Pub/Sub, traffic splitting, and orchestration with Workflows, Cloud Tasks and Cloud Scheduler.

Subsection 1.2 moves to security: retention policies on Cloud Storage, Identity-Aware Proxy, Web Security Scanner, Artifact Analysis findings, Secret Manager and Cloud KMS, Workload Identity Federation, service account roles, Cloud Service Mesh and Binary Authorization. Subsection 1.3 covers storage selection, schema design for AlloyDB, Spanner, Bigtable and Firestore, consistency trade-offs, signed URLs and writing to BigQuery for analytics and AI/ML work. The current guide was published in April 2026, and Google has announced no retirement of this exam.

How it's tested

Expect short business scenarios with one or two hard constraints, such as global users, unpredictable traffic, regulated data or a strict latency target. Several answers will work in principle; the correct one meets the constraint with the most managed option and the least custom code or standing credentials.

  • Platform and data fit

    A workload description (stateless HTTP, long-running batch, global transactions, time series) points to one compute platform and one database family.

  • Secure by default

    You replace keys in code, broad roles or exported service account keys with Secret Manager, narrow IAM roles and Workload Identity Federation.

  • Sync versus async

    You decide whether services should call each other directly, publish events through Pub/Sub or Eventarc, or be coordinated by Workflows or Cloud Tasks.

Reasoning it through

An order service must accept requests in bursts, call a slow payment partner and never lose an order. Calling the partner inline would tie up request threads and fail under spikes. Writing the order, then enqueuing a Cloud Tasks job with retry and rate limits toward the partner endpoint, absorbs bursts, controls the call rate and keeps each order recoverable if the partner times out.

Objectives 3

Official objectives from the Google Cloud outline, in outline order.

1.1 Designing high-performing applications and APIsPlatform choice, geography, load balancing, caching, APIs, events, traffic splitting and orchestration.
What it means
This objective covers matching a workload to Compute Engine, GKE or Cloud Run; building and refactoring containers; understanding regional and zonal services; using load balancers and session affinity; caching with Memorystore; creating REST and gRPC APIs; applying rate limits and authentication through Apigee or Cloud API Gateway; and integrating services asynchronously with Eventarc and Pub/Sub. It also covers resource sizing, cost, failover replication, gradual rollouts and A/B tests, and orchestration with Workflows, Cloud Tasks and Cloud Scheduler.
What to understand
Cloud Run suits stateless containers that scale on requests or events, including to zero. GKE fits workloads that need Kubernetes APIs, sidecars, custom networking or many cooperating services. Compute Engine remains the answer for licensed software, special kernels or lift-and-shift. Know that Pub/Sub decouples publishers from many subscribers, Cloud Tasks targets one handler with explicit rate control, Cloud Scheduler fires cron jobs, and Workflows chains steps with retries and conditions. Apigee is the full API management platform; Cloud API Gateway is a lighter managed gateway for serverless backends.
How it shows up
Questions give a traffic pattern or latency target and ask which platform, cache or messaging service fits with the least operational effort.
Common confusion
Pub/Sub and Cloud Tasks both queue work, but only Cloud Tasks gives explicit per-queue dispatch rate control toward a single target.
1.2 Designing secure applicationsRetention, vulnerability scanning, secrets and keys, authentication, service accounts, service-to-service security and Binary Authorization.
What it means
This objective covers Cloud Storage Object Lifecycle Management and retention policy locks; protecting apps with Identity-Aware Proxy and testing them with Web Security Scanner; fixing findings from Artifact Analysis and Security Command Center; storing and rotating secrets in Secret Manager and keys in Cloud Key Management Service; authenticating with Application Default Credentials, OAuth 2.0, JWTs, the Cloud SQL and AlloyDB Auth Proxies, Identity Platform and Workload Identity Federation; and running services with narrowly scoped service accounts.
What to understand
Application Default Credentials let the same code pick up a local user login, an attached service account or a federated identity without changes. Workload Identity Federation removes the need for downloaded service account keys for workloads running outside Google Cloud, and Workload Identity on GKE maps Kubernetes service accounts to IAM. Secret Manager stores versioned secrets with IAM per secret; Cloud KMS manages encryption keys and does not store application passwords. Identity Platform authenticates end users of your app, while IAP guards access to an app using Google identities. Cloud Service Mesh adds mutual TLS and policy between services; Binary Authorization blocks unsigned or unattested images at deploy time.
How it shows up
Look for the option that removes long-lived keys and broad roles, such as Workload Identity Federation instead of an exported JSON key.
Common confusion
Identity Platform signs in your application's customers; Identity-Aware Proxy controls which workforce identities may reach an internal app.
1.3 Storing and accessing dataStorage selection, schemas, replication consistency, signed URLs and writing data to BigQuery.
What it means
This objective covers picking a storage system by data volume and performance, designing schemas for relational stores such as AlloyDB and Spanner and for NoSQL stores such as Bigtable and Firestore, understanding eventual versus strong consistency across AlloyDB, Bigtable, Cloud SQL, Spanner and Cloud Storage, generating signed URLs for temporary object access, and writing data to BigQuery for analytics and AI/ML workloads.
What to understand
Spanner offers horizontally scaled relational storage with strong consistency, even across regions, and needs keys that avoid hotspots such as monotonically increasing IDs. Bigtable is a wide-column store for very high write throughput and time series, where row key design decides performance and replication between clusters is eventually consistent. Firestore is a document database with real-time listeners and offline mobile sync. AlloyDB and Cloud SQL serve PostgreSQL-style workloads, with AlloyDB aimed at higher performance and mixed analytical queries. Signed URLs grant time-limited access to one object without granting IAM. BigQuery takes streaming or batch writes for analysis.
How it shows up
Scenarios describe access patterns, scale and consistency needs, then ask for the database or row key design that satisfies them.
Common confusion
Bigtable is not a relational database and does not support SQL joins or multi-row transactions like Spanner does.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Cloud Run vs GKE vs Compute Engine

    Three compute choices with falling levels of management.

    Remember
    Default to Cloud Run for stateless containers unless Kubernetes features or VM control are required.
    Tested as
    Platform selection opens subsection 1.1 and drives later deployment questions.
    Trap
    Choosing GKE because it is more flexible when nothing in the scenario needs that flexibility.

  • Session affinity

    Routing a client's repeat requests to the same instance or backend.

    Remember
    Helps cache locality, but state that must survive instance loss belongs in Memorystore or a database.
    Tested as
    Named directly in the guide for performant content delivery.
    Trap
    Treating affinity as a replacement for shared session storage.

  • Memorystore

    Managed Redis-compatible and Memcached in-memory caching.

    Remember
    Use it to cut read latency and database load for hot keys.
    Tested as
    The guide's example for caching solutions.
    Trap
    Using a cache as the system of record for data that cannot be lost.

  • Apigee vs Cloud API Gateway

    Full API management versus a lightweight managed gateway.

    Remember
    Apigee brings monetization, analytics, versioning and advanced policies; Cloud API Gateway fronts serverless backends simply.
    Tested as
    Rate limiting, authentication and API observability questions name both.
    Trap
    Picking Apigee for a single internal API with no management needs.

  • Pub/Sub, Cloud Tasks, Cloud Scheduler, Workflows

    Four tools for async and coordinated work.

    Remember
    Fan-out events: Pub/Sub. One target with rate limits: Cloud Tasks. Timed jobs: Cloud Scheduler. Multi-step with branching: Workflows.
    Tested as
    Orchestration is an explicit 1.1 bullet.
    Trap
    Using Pub/Sub when the scenario needs a controlled dispatch rate to one endpoint.

  • Traffic splitting

    Sending a percentage of requests to a new revision or version.

    Remember
    Supports gradual rollouts, quick rollback and A/B tests on Cloud Run or GKE.
    Tested as
    Release-safety scenarios often hinge on it.
    Trap
    Redeploying over the old version instead of shifting traffic back.

  • Workload Identity Federation

    Lets external workloads exchange their own tokens for short-lived Google credentials.

    Remember
    Removes the need to export service account keys.
    Tested as
    Appears in both secrets and authentication bullets.
    Trap
    Downloading a JSON key and storing it in Secret Manager as the fix.

  • Secret Manager vs Cloud KMS

    Versioned secret storage versus key management for encryption.

    Remember
    Passwords and API tokens go in Secret Manager; KMS keys encrypt data or protect secrets with CMEK.
    Tested as
    Secret storage and rotation questions.
    Trap
    Putting a database password in a KMS key ring.

  • Binary Authorization

    Deploy-time policy that admits only attested container images.

    Remember
    Pairs with build provenance from Cloud Build.
    Tested as
    Named for securing application artifacts.
    Trap
    Assuming vulnerability scanning alone blocks unsafe images from deploying.

  • Signed URLs

    Time-limited URLs granting access to a specific Cloud Storage object.

    Remember
    The holder needs no Google account or IAM role.
    Tested as
    Direct guide bullet in 1.3.
    Trap
    Making a bucket public to let anonymous users download one file.

  • Spanner key design

    Primary keys determine data distribution across splits.

    Remember
    Avoid sequential keys; use UUIDv4 or bit-reversed sequences to prevent hotspots.
    Tested as
    Schema design for structured databases.
    Trap
    Using an auto-incrementing integer as the leading key.

  • Bigtable row keys

    The single indexed key in each table.

    Remember
    Design keys around the main read pattern and avoid timestamp-first keys.
    Tested as
    Schema design for unstructured stores.
    Trap
    Expecting secondary indexes to rescue a poor row key.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Choosing a compute platform

ConceptMeaningKey differenceCommon trap
Cloud Run Serverless containers driven by HTTP requests, events or jobs. Scales to zero and bills per use; no cluster to manage. Assuming it cannot run gRPC or WebSockets, which it supports.
GKE Managed Kubernetes in Autopilot or Standard mode. Gives Kubernetes APIs, sidecars, DaemonSets and fine networking control. Picking it for a single stateless API with no Kubernetes needs.
Compute Engine Virtual machines with full OS control. Fits legacy, licensed or kernel-dependent software. Choosing VMs for a new container app because the team knows Linux.

Matching data stores to access patterns

ConceptMeaningKey differenceCommon trap
Spanner Relational, horizontally scalable, strongly consistent. Global transactions with SQL at large scale. Using it for small regional apps where Cloud SQL is enough.
AlloyDB / Cloud SQL Managed relational engines (AlloyDB is PostgreSQL-compatible). Regional relational workloads; AlloyDB adds speed for mixed analytics. Expecting unlimited horizontal write scaling.
Bigtable Wide-column NoSQL for huge throughput. Time series, IoT and key lookups at low latency. Expecting joins or ad hoc SQL analysis.
Firestore Serverless document database. Mobile and web apps with real-time sync and flexible documents. Using it for heavy analytical scans better suited to BigQuery.

Async and orchestration services

ConceptMeaningKey differenceCommon trap
Pub/Sub Global messaging with topics and subscriptions. Many independent subscribers; publishers do not know consumers. Expecting it to throttle delivery to a fragile endpoint.
Cloud Tasks Queues of tasks dispatched to one HTTP target. Explicit rate limits, retries and scheduled delivery per task. Using it for broadcast fan-out.
Workflows Serverless orchestration of steps and API calls. Branching, waits, retries and callbacks in a defined sequence. Coding orchestration inside a service when Workflows fits.

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Exported service account keys

    What candidates pick
    Create a JSON key, store it securely and rotate it monthly.
    Why it looks right
    It sounds like good key hygiene.
    Why it's wrong
    Google recommends avoiding long-lived keys entirely; Workload Identity Federation or attached service accounts issue short-lived credentials automatically.

    Clue to watch for The workload runs on another cloud, on premises or in a CI system.

  2. Pub/Sub for rate-limited calls

    What candidates pick
    Publish each job to a Pub/Sub topic with a push subscription.
    Why it looks right
    Pub/Sub is the best-known async service.
    Why it's wrong
    Push subscriptions do not give per-queue dispatch rate control toward one fragile endpoint; Cloud Tasks does.

    Clue to watch for A partner API allows only a fixed number of calls per second.

  3. Sequential primary keys in Spanner

    What candidates pick
    Use an auto-incrementing order number as the primary key.
    Why it looks right
    It mirrors traditional relational design.
    Why it's wrong
    Monotonic keys concentrate writes on one split and create a hotspot that limits throughput.

    Clue to watch for Very high insert rates on a Spanner table.

  4. Public bucket for one-off sharing

    What candidates pick
    Grant allUsers read access to the bucket.
    Why it looks right
    It is the fastest way to share a file.
    Why it's wrong
    It exposes every object indefinitely; a signed URL grants access to one object until a set expiry.

    Clue to watch for An external user without a Google account needs a single download.

  5. Scanning instead of enforcing

    What candidates pick
    Enable Artifact Analysis and consider deployments secured.
    Why it looks right
    Scanning finds vulnerabilities.
    Why it's wrong
    Scanning reports problems but does not stop a non-compliant image from running; Binary Authorization enforces policy at deploy time.

    Clue to watch for Only verified images may be deployed to production.

  6. Sticky sessions as state storage

    What candidates pick
    Turn on session affinity so user carts survive scaling.
    Why it looks right
    Affinity keeps a user on one instance.
    Why it's wrong
    Instances can be replaced or scaled in at any time, losing in-memory state; shared state belongs in Memorystore or a database.

    Clue to watch for The app must keep carts when instances restart.

Answer framework

Use this sequence when a design question lists several plausible Google Cloud services.

  1. Underline the hard constraint first, such as global consistency, burst traffic, scale to zero, regulated data or a latency limit, before reading the answer options.
  2. Choose the most managed compute platform that satisfies it, checking Cloud Run before GKE and GKE before Compute Engine unless a stated need rules it out.
  3. Pick the data store from the access pattern: relational transactions, wide-column throughput, documents with sync, or analytics in BigQuery.
  4. Decide how services talk: direct REST or gRPC calls, Pub/Sub events, Cloud Tasks queues, or a Workflows definition with retries.
  5. Apply security last but always: short-lived credentials, Secret Manager, least-privilege service accounts, and Binary Authorization for images.

Practice question

A retailer's mobile app needs a database for user shopping lists. Lists change offline on phones and must sync to other devices in near real time when connectivity returns. Traffic is unpredictable and the team wants no servers to manage. Which database should the developer choose?

Want more like this? The GCP PCD practice test has questions for every domain.

Checklist

0 of 13

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Give this section the largest share of your time, since it carries about a third of the marks. Start with a one-page decision table: rows for workload types (stateless API, event handler, batch job, legacy app, mobile backend) and columns for compute, data store and integration service. Fill it from Google's product documentation and architecture center, then test yourself by covering the columns.

Next, build a small lab: deploy a container to Cloud Run, connect it to Firestore, read a secret from Secret Manager through an attached service account, publish an event to Pub/Sub and handle it with an Eventarc trigger. Add a Cloud Tasks queue with a low dispatch rate and watch how it throttles calls. Create a signed URL from code.

Finish with security and data design drills. Write out why a Spanner key with a timestamp prefix hotspots and how to fix it, and explain which identity each authentication option represents. Then take timed question sets on this section only and review every wrong answer against the constraint you missed.

FAQ

How much of the Professional Cloud Developer exam is Domain 1?

Designing highly scalable, secure, and reliable cloud-native applications is about 32% of the exam, the largest of the four sections. On a 50 to 60 question form that is roughly 16 to 19 items, though Google does not publish per-section counts.

Do I need deep Kubernetes knowledge for this section?

You need enough to know when GKE is justified over Cloud Run. Detailed manifests, probes and autoscaling settings are tested more heavily in Section 3, subsection 3.2.

Are generative AI APIs tested in Section 1?

Google's April 2026 guide mentions generative AI APIs in the role description but lists no subsection for them. Section 1 does include writing data to BigQuery for AI/ML workloads, so expect AI mostly as scenario context.

Which databases should I know best?

Spanner, AlloyDB, Cloud SQL, Bigtable, Firestore, Cloud Storage and BigQuery all appear in subsection 1.3. Focus on schema and key design plus consistency behavior rather than administration.

Is Apigee in scope even though it is an API management product?

Yes. The guide names Apigee and Cloud API Gateway for rate limiting, authentication and API observability, and Apigee again for API versioning in Section 3.

What security topics carry the most weight?

Secrets handling, short-lived credentials through Workload Identity Federation, least-privilege service accounts and Binary Authorization show up repeatedly. Know which product authenticates users versus workloads.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 1 knowledge

Check whether you can pick the right compute platform, database and security control under exam conditions with timed Section 1 questions.

Take the GCP PCD practice test Check your GCP PCD readiness

Keep going