GCP ACE flashcards
GCP ACE · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Resource hierarchy order
- The resource hierarchy is Organization > folders > projects > resources. IAM allow policies are inherited downward, and a child policy cannot remove a parent grant.
- Billing account link
- A project can be linked to at most one billing account, while one billing account can pay for multiple projects; closing the billing account disables linked projects' billable services.
- gcloud default project
- Running gcloud config set project PROJECT_ID changes the default project used by subsequent gcloud commands; it does not grant any IAM permissions.
- Quota versus limit
- Quotas are project- or region-scoped allocations enforced by APIs. Allocation quotas cap resource counts, rate quotas cap request rates, and increases are requested through the console.
- Cloud Identity
- Cloud Identity provides identity, group, and endpoint management without Google Workspace collaboration apps; Google Groups from Cloud Identity can be granted IAM roles.
- Labels versus tags
- Labels are key-value metadata used for cost allocation, filtering, and automation. Tags are key-value metadata used in IAM conditions and firewall targeting; neither grants access by itself.
- VPC scope
- A VPC network is global, while its subnets are regional. Resources in different regions of the same VPC can communicate using internal IP addresses.
- Firewall rule priority
- VPC firewall rules are stateful and evaluated by priority; a lower number means higher priority. There are implied deny ingress and allow egress rules.
- Storage class minimums
- Cloud Storage classes are Standard, Nearline with a 30-day minimum, Coldline with 90 days, and Archive with 365 days. Deleting objects early incurs early deletion charges.
- Cloud SQL HA
- Cloud SQL regional high availability uses a standby instance in a second zone with synchronous replication. Failover is automatic; read replicas are separate and serve read scaling.
- CUD versus SUD
- Committed use discounts require a 1- or 3-year commitment for steady usage. Sustained use discounts apply automatically to qualifying Compute Engine usage within a month.
- BigQuery partitioning
- Partitioning divides a BigQuery table by date, timestamp, or integer range. Clustering sorts data within partitions, reducing bytes scanned by filtered queries.
- App Engine deploy
- gcloud app deploy app.yaml creates a new App Engine version and routes traffic according to promotion settings such as --promote or --no-promote.
- Cloud Run deploy
- gcloud run deploy SERVICE --image IMAGE creates or updates a Cloud Run revision; --allow-unauthenticated permits public invocation of the service.
- GKE Autopilot
- GKE Autopilot is a mode where Google manages nodes, scaling, and infrastructure; users deploy pods and are billed for requested CPU and memory.
- Artifact Registry
- Artifact Registry stores container images and language packages, integrates with IAM, and supports vulnerability scanning; it is the successor to Container Registry.
- Cloud Build steps
- Cloud Build runs each step in cloudbuild.yaml as a container. Substitutions provide variables, and triggers start builds from repository events.
- Terraform plan
- terraform plan previews changes by comparing configuration with state and real resources; terraform apply then creates, updates, or deletes resources to match.
- Pub/Sub subscriptions
- Publishers send messages to a Pub/Sub topic, and each subscription receives a copy. Default delivery is at-least-once, governed by the acknowledgment deadline.
- Uptime check
- A Cloud Monitoring uptime check probes an endpoint from multiple locations. An alerting policy can fire when the check fails for a configured duration.
- Log sink
- A Cloud Logging sink routes log entries to Cloud Storage, BigQuery, Pub/Sub, or another project. Inclusion and exclusion filters determine which entries are routed.
- Audit log defaults
- Admin Activity and System Event audit logs are always enabled. Data Access audit logs are disabled by default and must be explicitly enabled for most services.
- SLO error budget
- An SLO specifies a target and a time window. The error budget equals 1 minus the SLO target, representing allowed unreliability.
- Error Reporting
- Error Reporting aggregates and groups application exceptions found in logs. It can alert on new error groups but is not a general metrics store.
- Billing export
- Billing export to BigQuery writes detailed cost and usage data into datasets. Queries over these tables support cost analysis and chargeback reporting.
- Basic IAM roles
- Owner, Editor, and Viewer are broad legacy roles. Owner includes billing and IAM control; predefined and custom roles provide narrower permissions.
- Service account keys
- Service account keys are long-lived credentials. Attached service accounts, Workload Identity Federation, or short-lived tokens are preferred over downloaded key files.
- Workload Identity Federation
- Workload Identity Federation lets external workloads exchange identity-provider credentials for short-lived Google Cloud credentials, avoiding service account key files.
- IAM conditions
- IAM conditions are CEL expressions attached to role bindings. The grant applies only when the expression evaluates true for attributes such as resource name or time.
- VPC Service Controls
- VPC Service Controls define a service perimeter that restricts access to supported Google Cloud services and helps reduce data exfiltration; they are not network firewalls.
- Cloud KMS
- Cloud KMS manages key rings and cryptographic keys. Customer-managed encryption keys let supported services encrypt data with keys the customer controls.
- Organization Policy
- Organization Policy constraints are set at organization, folder, or project level and restrict resource configurations, such as allowed locations or public IP addresses.