Google Cloud Certified - Associate Cloud Engineer Flashcards

Setting up a cloud solution environment, Planning and implementing a cloud solution, Ensuring successful operation of a cloud solution, and Configuring access and security.

A project is the base container for resources and billing; folders group projects (and other folders) for policy inheritance; the organization is the root node tied to a Google Workspace or Cloud Identity domain that owns everything beneath it.

Identity and Access Management, the system that binds members (users, groups, service accounts) to roles that grant permissions on resources, enforced via policies attached at the org, folder, project, or resource level.

Basic roles (Owner, Editor, Viewer — broad, legacy), predefined roles (granular, service-specific, curated by Google), and custom roles (user-defined sets of permissions).

A special account used by an application or VM (not a person) to authenticate and make authorized API calls to Google Cloud services, identified by an email-like address.

Policies set at a higher level (organization or folder) are inherited by all descendant resources, and the effective policy on a resource is the union of policies set at that resource and all its ancestors — permissions can only be added, never revoked, by inheritance.

Compute Engine gives you IaaS VMs; GKE runs managed Kubernetes containers; App Engine is a fully managed PaaS for deploying code without managing infrastructure; Cloud Run runs stateless containers serverlessly, scaling to zero.

A reusable, immutable configuration (machine type, image, disk, network settings) used to create new VM instances consistently, commonly referenced by managed instance groups.

A collection of identical VM instances created from an instance template that supports autoscaling, autohealing, load balancing, and rolling updates.

Persistent disks are durable, network-attached storage that survive instance termination and can be resized/snapshotted; local SSDs are physically attached to the host, offer very low latency, but lose data when the instance stops.

A short-lived, heavily discounted Compute Engine instance that Google can reclaim at any time with short notice, suited for fault-tolerant, batch, or interruptible workloads.

A VPC is a global, project-level virtual network; subnets are regional IP address ranges within that VPC where resources like VM instances actually reside.

Auto mode VPCs automatically create one subnet per region with predefined IP ranges; custom mode VPCs require you to manually create subnets with ranges you define, giving more control.

A configuration that allows or denies traffic to/from VM instances based on direction, protocol, port, source/destination, priority, and target tags or service accounts.

It lets VM instances or GKE pods without external IP addresses initiate outbound connections to the internet, without exposing them to inbound connections.

Cloud SQL is a managed relational database (MySQL, PostgreSQL, SQL Server) for regional workloads; Cloud Spanner is a globally distributed, horizontally scalable relational database; Firestore is a managed NoSQL document database for flexible, hierarchical data.

A serverless, highly scalable data warehouse for running fast SQL analytics over large datasets, separating storage and compute and billing by data scanned or reserved slots.

Standard is for frequently accessed data; Nearline for data accessed less than once a month; Coldline for data accessed less than once a quarter; Archive for data accessed less than once a year — each with progressively lower storage cost and higher retrieval cost/latency.

A set of rules on a bucket that automatically transitions objects to cheaper storage classes or deletes them based on conditions like age, storage class, or number of newer versions.

IAM applies permissions at the bucket (or project) level uniformly to all objects, while ACLs can grant fine-grained access to individual objects; Google recommends using IAM with uniform bucket-level access when possible.

It allows adding attribute-based conditional logic (such as time, resource type, or resource name) to IAM role bindings, granting access only when conditions are met.

Granting only the minimum permissions needed to perform a task; GCP supports it through granular predefined roles, custom roles, and conditional IAM bindings instead of broad basic roles.

A service that collects metrics, uptime checks, and dashboards to observe the health and performance of Google Cloud resources and applications, and supports alerting policies.

A centralized service for storing, searching, analyzing, and exporting log data (audit, platform, and application logs) from Google Cloud resources.

Logs that record who did what, where, and when across Google Cloud services, including Admin Activity, Data Access, System Event, and Policy Denied logs.

The primary CLI for creating, managing, and interacting with Google Cloud resources and configurations, often used alongside gsutil (Cloud Storage) and bq (BigQuery).

Infrastructure-as-code tooling that lets engineers define Google Cloud resources declaratively in configuration files so environments can be created and updated repeatably and consistently.

A managed service that distributes traffic across backend resources; types include global HTTP(S), SSL proxy, and TCP proxy load balancers, plus regional network and internal load balancers, chosen based on traffic type and scope.

Horizontal scaling adds or removes instances (e.g., via a managed instance group or GKE autoscaler); vertical scaling increases or decreases the resources (CPU/memory) of an existing instance, typically requiring a restart.

Google secures and manages the underlying infrastructure (physical security, hypervisor, network), while the customer is responsible for securing their data, IAM configuration, OS patching (on IaaS), and application-level access controls.