PCCP - Professional Cloud Certified Professional flashcards

34 cards. Read the term and the definition here. The deck at the top of this page is optional.

Resource hierarchy inheritance

IAM policies set at organization, folder, or project level are inherited by all descendants and are additive; a child policy cannot remove a permission granted by an ancestor.

Shared VPC

A host project owns the VPC network and subnets, and service projects attach their resources to those subnets; centralizes network administration while delegating workload ownership.

VPC Network Peering

Connects two VPC networks so instances communicate using internal IP addresses; it is decentralized, non-transitive, and both sides must configure matching peering rules.

Private Service Connect

A private endpoint mechanism that lets consumers reach Google APIs or producer services through an internal IP inside their VPC, without public exposure or peering.

Committed use discount

A 1-year or 3-year commitment to a minimum level of vCPU, memory, or other resources in exchange for a discounted rate; best for predictable baseline workloads.

Spot VM

Compute Engine instances that use spare capacity at a large discount and can be preempted with short notice; suited to fault-tolerant batch and stateless work.

Terraform remote state

Storing Terraform state in a shared backend such as Cloud Storage with versioning and locking so teams avoid conflicting writes and can recover prior state.

Managed instance group

A group of identical VMs created from an instance template that supports autoscaling, autohealing, and rolling updates across zones in a region.

GKE Autopilot

A GKE mode where Google manages nodes, scaling, and cluster hardening; you define pods and pay for pod resource requests rather than raw nodes.

VPC-native cluster

A GKE cluster that uses alias IP ranges on subnets so pods and services get native VPC IPs; requires correctly sized secondary ranges to avoid exhaustion.

Cloud Build trigger

A configuration that starts a build automatically on events such as a push to a repository branch or a tag, enabling continuous integration pipelines.

Artifact Registry

A managed repository for container images and language packages that supports IAM, vulnerability scanning, and regional or multi-regional storage.

Uniform bucket-level access

A Cloud Storage setting that disables object ACLs so all access is controlled solely through IAM; simplifies permissions and should be chosen at bucket creation.

Workload Identity Federation

Allows external workloads such as AWS or GitHub Actions to obtain short-lived Google Cloud credentials by exchanging their native identity token, avoiding service account keys.

CMEK

Customer-managed encryption keys stored in Cloud KMS that a service uses to encrypt data; gives control over key rotation, disablement, and destruction.

VPC Service Controls

A security perimeter around Google Cloud APIs that restricts data movement across the boundary and helps mitigate data exfiltration risks.

Cloud Armor

A security policy attached to a load balancer that provides WAF rules, IP allow/deny lists, and DDoS protection for HTTP(S) traffic.

Assured Workloads

A folder-level control package that enforces regulatory requirements such as data residency and personnel access restrictions for a defined compliance regime.

Data Access audit logs

Logs that record reads and writes of user data; disabled by default and must be enabled per service, and they can incur logging costs.

Secret Manager

A service for storing versioned secrets with IAM access control and audit logging, replacing hard-coded credentials in code or images.

Billing export to BigQuery

A configuration that writes detailed cost and usage data to BigQuery tables so teams can query, label, and analyze spend with SQL.

Sustained use discount

An automatic discount applied to Compute Engine usage that runs for a significant portion of the month, requiring no upfront commitment.

Object Lifecycle Management

Cloud Storage rules that automatically transition objects to colder storage classes or delete them based on age, version count, or other conditions.

BigQuery partitioning

Splitting a table by date or ingestion time so queries scan only relevant partitions; reduces bytes billed and improves performance.

Error budget

The allowed amount of unreliability derived from an SLO, for example 0.1% errors for a 99.9% target; it guides when to prioritize reliability over features.

Cloud Scheduler

A fully managed cron service that triggers HTTP endpoints, Pub/Sub messages, or App Engine handlers on a defined schedule for batch and automation jobs.

Cloud Run traffic splitting

Routing a percentage of requests to different revisions of a service, enabling gradual canary rollout and instant rollback to a prior revision.

Uptime check

A Cloud Monitoring probe that requests a URL or TCP endpoint from multiple global locations and alerts when availability or latency thresholds are breached.

Log-based metric

A Cloud Monitoring metric derived from a log filter, used to count or extract values from log entries and to drive alerts on business events.

VM Manager patch job

A managed operation that applies OS patches to Compute Engine instances according to a patch schedule and reports compliance status.

Global external Application Load Balancer

A Layer 7 load balancer with a single global anycast IP that routes users to the closest healthy backend region and supports Cloud Armor and SSL.

Autohealing

A managed instance group feature that uses a health check to detect unhealthy instances and recreates them automatically, maintaining desired capacity.

Exponential backoff with jitter

A retry strategy that increases wait time between attempts and randomizes it to avoid synchronized retry storms against a recovering service.

Spanner multi-region

A Spanner configuration that replicates data across regions with strong consistency and a 99.999% availability SLA for regional failure tolerance.