GCP Cloud Architect flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Resource hierarchy inheritance

IAM allow policies set at the organization, folder, or project level are inherited by every descendant resource, and a lower-level policy cannot remove a permission granted higher up.

Multi-region bucket

A Cloud Storage location type that replicates objects across a large geographic area, providing geo-redundancy and a 99.95% availability SLA for designs with strict RPO needs.

Cloud Spanner

A globally distributed relational database that offers external consistency, horizontal scaling through nodes and processing units, and up to 99.999% availability in multi-region configurations.

Shared VPC

A model where a host project shares its subnets with service projects, letting a central network team control IP ranges and firewalls while application teams own their own resources.

Serial availability multiplication

When components must all succeed in sequence, total availability is the product of their individual availabilities, so 0.999 multiplied by 0.999 yields roughly 0.998.

Cloud Run

A serverless container platform for stateless HTTP and gRPC services that scales to zero, bills per request and resource use, and requires no cluster management.

Terraform remote state

Storing the terraform.tfstate file in a Cloud Storage backend with object versioning and state locking so multiple engineers share one consistent view and can recover earlier versions.

Cloud Build trigger

An automated build that runs cloudbuild.yaml when a change lands in a connected repository such as GitHub or Cloud Source Repositories, and can deploy to GKE, Cloud Run, or App Engine.

Private Google Access

A subnet-level setting that lets VM instances without external IP addresses reach Google APIs and services over internal routes instead of the public internet.

Labels versus network tags

Labels are key-value pairs used for billing reports and resource filtering, while network tags are plain strings attached to instances and matched by firewall rules and routes.

Config Connector

A Kubernetes add-on that creates and manages Google Cloud resources from Kubernetes manifests, allowing infrastructure to follow the same GitOps flow as containerized workloads.

IAM deny policy

A policy that blocks specified principals from using given permissions and takes precedence over allow policies, so granted roles cannot override the denial.

Workload Identity Federation

A mechanism that exchanges external credentials such as OIDC or SAML tokens for short-lived Google Cloud credentials, removing the need to download and store service account keys.

VPC Service Controls perimeter

A security boundary around Google Cloud services that denies access from outside the perimeter, preventing data exfiltration even when a caller holds valid credentials.

CMEK

Customer-managed encryption keys held in Cloud KMS give an organization control over rotation, disabling, and destruction of the keys protecting data at rest in supported services.

Assured Workloads

A folder-level control package that enforces data residency, personnel access limits, and encryption requirements for regulated regimes such as FedRAMP, IL4, CJIS, or HIPAA.

Error budget

One minus the SLO, expressed as the amount of unreliability allowed in a window; a 99.9% SLO permits 0.1% failed requests, and exhausting it should pause risky releases.

Sustained use discount

An automatic Compute Engine discount applied when an instance runs for a significant portion of the billing month, requiring no upfront commitment from the customer.

Committed use discount

A pricing model where a one-year or three-year commitment to a baseline of vCPU, memory, or licenses in a region yields a substantially lower rate than on-demand pricing.

Spot VM

A deeply discounted Compute Engine instance that can be reclaimed with about 30 seconds notice, making it suitable for batch, rendering, and other fault-tolerant workloads.

Object lifecycle policy

A Cloud Storage rule set that transitions or deletes objects by age or condition; Nearline requires 30 days, Coldline 90 days, and Archive 365 days of minimum storage.

BigQuery partition and cluster

Partitioning restricts a query to a date or range of data, while clustering sorts rows within partitions so filters scan fewer blocks, together lowering bytes billed.

Canary deployment

A release pattern that sends a small percentage of traffic to the new version, compares its metrics to the baseline, then increases traffic, keeping rollback impact small.

Blue/green deployment

Running two identical environments and switching all traffic from blue to green at once; rollback is an immediate switch back, but infrastructure cost roughly doubles.

Cloud Deploy

A managed delivery service that promotes releases through ordered targets such as development, staging, and production, supporting approvals and rendering to GKE or Cloud Run.

Artifact Registry

A regional or multi-regional repository for container images and language packages that integrates with IAM, supports vulnerability scanning, and keeps immutable versioned artifacts for rollback.

Anthos Config Management

A GitOps tool that continuously syncs Kubernetes configuration and policy from a Git repository to clusters across clouds, keeping fleets consistent and auditable.

Warm standby DR

A disaster recovery pattern keeping a scaled-down but running copy of production in a second region that scales up on failover, giving minutes-level RTO at moderate cost.

MIG autohealing

A managed instance group feature that uses an application health check to detect unhealthy VMs and automatically recreate them, maintaining the configured target capacity.

Log sink

A routing rule that exports matching log entries to Cloud Storage, BigQuery, or Pub/Sub; exclusion filters drop entries before storage to control volume and cost.

GKE cluster autoscaler

A controller that adds or removes nodes in a node pool when pods are unschedulable or nodes sit underutilized, complementing the Horizontal Pod Autoscaler which scales replicas.

Cloud Monitoring uptime check

A periodic probe issued from multiple global locations that verifies an endpoint responds correctly; failures can fire alerting policies and notify on-call responders.