GCP DevOps Engineer study plan

Diagram the resource hierarchy for a three-team, three-environment org and decide the folder/project layout before touching any console

Author Terraform (or gcloud scripts) that creates projects, links billing accounts, and enforces at least five org policy constraints such as disabling service account key creation and restricting external IPs

Create Cloud Identity groups and bind least-privilege predefined roles to groups rather than individuals or primitive roles

Configure an aggregated folder-level log sink into a user-managed log bucket and state the retention and exclusion rules you chose

Build a VPC topology (Shared VPC host plus service projects) and add firewall rules and Private Google Access to reach Google APIs without external IPs

Configure Workload Identity Federation so an external CI provider can impersonate a deploy service account without long-lived keys

Wrap a project in a VPC Service Controls perimeter and prove that a call from outside the perimeter is denied

Draft the org-wide bootstrap runbook covering identity, guardrails, network, and logging order of operations

Write a Cloud Build pipeline that runs unit tests, builds the container, and pushes it to Artifact Registry with vulnerability scanning enabled

Add automated gates so the build fails on test failure or on a HIGH/CRITICAL container vulnerability

Create PR and branch triggers with substitutions so the same config serves dev and prod

Compare Cloud Build against a GitOps approach using Config Sync or a Terraform-driven pipeline, and record when each fits

Implement a progressive rollout with Cloud Deploy (canary to GKE or Cloud Run) including an automated verification step before promotion

Add an infrastructure pipeline that runs terraform plan on PR and requires manual approval before apply

Build a Vertex AI Pipeline that trains, evaluates, and registers a model, and gate promotion on an evaluation threshold

Configure Binary Authorization or an equivalent admission check so only attested images deploy

Define SLIs and SLOs for one service and calculate the resulting error budget over a 28-day window

Instrument multiwindow, multi-burn-rate alerting policies instead of static threshold alerts

Write an incident response and blameless postmortem template and run a tabletop exercise against a simulated outage

Identify one recurring manual task and automate it to reduce toil, measuring the time saved

Query Cloud Logging with the logging query language to isolate failures by severity, resource label, and time window

Create log-based metrics and route them into alert policies and a dashboard

Instrument a sample service with OpenTelemetry or the Cloud Trace client and trace one request across two services

Diagnose three injected faults - an IAM permission denial, a quota exhaustion, and a firewall block - and explain how you found each

Right-size at least two workloads using Cloud Advisor recommendations and record the before/after machine types

Export billing data to BigQuery and author a query that ranks the top cost drivers by service and label

Set budgets with programmatic alerts and configure autoscaling (HPA/Node Auto Provisioning or Cloud Run concurrency) validated by a load test

Evaluate committed use versus sustained use discounts and storage class or BigQuery edition changes for the sample workload

Complete two full-length timed practice sets and tabulate scores by domain

Remediate the two weakest domains with targeted labs and re-test those areas

Consolidate one-page cheat sheets for resource hierarchy and org policy, CI/CD component selection, SLO math, log query syntax, and cost levers

Re-run every earlier deliverable that felt shaky and fix any configuration you cannot explain from memory