GCP Professional Cloud Developer study plan

Decompose a monolithic app spec into stateless services and pick managed compute (Cloud Run, GKE Autopilot, App Engine) with written justification

Design a multi-zone, autoscaling architecture on paper that survives loss of one zone and one instance group

Diagram an IAM model using least privilege: service accounts per workload, custom roles, no primitive roles

Compare Cloud SQL, Spanner, Firestore, and Bigtable for three sample workloads and defend each choice

Implement retries with exponential backoff and idempotency keys for a flaky downstream API call

Configure health checks, readiness probes, and graceful shutdown in a containerized service

Write unit tests that mock Google Cloud client libraries and hit 80%+ line coverage on the service layer

Build a Cloud Build pipeline that runs tests and blocks merges on failure

Containerize an application with a multi-stage Dockerfile and a non-root runtime user

Push images to Artifact Registry with immutable tags and vulnerability scanning enabled

Write integration tests that run against an emulator (Pub/Sub or Datastore) in CI

Debug a failing deployment using Cloud Logging queries and Cloud Trace spans

Instrument a service with OpenTelemetry and export traces and metrics to Cloud Trace and Cloud Monitoring

Define an SLO with an error budget and create an alerting policy that fires on burn rate

Refactor a synchronous call chain into an asynchronous Pub/Sub flow with a dead-letter topic

Write a postmortem for an injected failure (simulated quota exhaustion) with remediation actions

Write Terraform (or Deployment Manager) that provisions a Cloud Run service, a service account, and required IAM bindings

Store and reference secrets through Secret Manager with versioned access instead of env vars in code

Configure environment-specific deployments (dev/prod) using separate projects and Cloud Build triggers

Implement a canary rollout with traffic splitting and automatic rollback on error-rate threshold

Attach a custom domain with managed TLS and configure Cloud Armor rules blocking a named attack pattern

Set up VPC Service Controls or private connectivity so a service reaches Cloud SQL without a public IP

Grant a workload identity to a GKE pod and verify access to a Cloud Storage bucket without key files

Compare deployment strategies (blue/green vs rolling vs canary) and document when each applies

Publish and consume Pub/Sub messages with ordering keys, at-least-once handling, and idempotent consumers

Invoke a Cloud Functions or Cloud Run service from an Eventarc trigger on a Cloud Storage object event

Integrate a Cloud SQL instance from a Cloud Run service using the connector and connection pooling

Cache hot reads in Memorystore and measure the latency delta against a direct database path

Complete a timed 50-question practice set and score above 80%

Re-teach the five weakest topics from scratch on a whiteboard without notes

Review IAM, networking, and deployment-strategy edge cases one final pass

Re-run the week 4 failure injection and confirm the alert still fires correctly