Google Cloud Services and Architecture

102 flashcards by MentisLibrary

The Google Cloud service catalog and how it fits together: the resource hierarchy, Compute Engine, GKE and Cloud Run, Cloud Storage and the database family, the global VPC, IAM and service accounts, BigQuery and the data stack, and cost controls.

Name the four levels of the Google Cloud resource hierarchy, from the top down.
Organization at the top, then Folders (which may nest), then Projects, then the resources themselves. IAM policies set at any level are inherited by everything below, and the effective permission is the union of all inherited policies.
What is a Google Cloud project, and which of its identifiers matter?
The basic container for resources, APIs, billing and quota. It has a project ID, a globally unique immutable string used in nearly every command and API call, a mutable display name, and an auto-assigned numeric project number.
How do regions and zones relate in Google Cloud?
A region is an independent geographic area containing at least three zones. A zone is an isolated deployment area within a region. Zonal resources exist in one zone, regional resources are replicated across the zones of a region, and a few resources are global.
Which Google Cloud resources are global rather than regional?
VPC networks, routes, firewall rules, global external load balancers with their anycast addresses, images, snapshots, and IAM itself. Cloud Storage buckets are regional, dual-region or multi-region depending on the location chosen at creation.
How are APIs enabled in a Google Cloud project?
Each service API must be explicitly enabled per project before it can be used, either in the console or with gcloud services enable. Enabling is itself an audited administrative action.
What are labels used for in Google Cloud?
Key-value pairs attached to resources for organisation, filtering and, most importantly, cost attribution. Labels flow through to the billing export so spend can be broken down by team, environment or cost centre.
What is an organization policy constraint, and how does it differ from IAM?
IAM answers who may do something. An organization policy constraint answers what may be done at all, applied to the organization, a folder or a project, regardless of who is asking, including project owners.
Compute Engine and its machine type families
The infrastructure-as-a-service virtual machine offering. A machine type sets the virtual CPU count and memory, chosen from families aimed at different profiles: general purpose, compute optimised, memory optimised and accelerator optimised, plus custom machine types with an arbitrary CPU and memory combination.
Live migration
Google moves a running VM to another host during planned host maintenance without rebooting the guest, so most maintenance events cause no downtime. It is configured through the instance's availability policy.
What is a Spot VM, and how does it differ from the older preemptible VM?
A deeply discounted instance that Google may reclaim at any time with a short shutdown notice. Preemptible VMs, the earlier form, additionally terminate after at most 24 hours; Spot VMs have no maximum runtime.
What does a managed instance group provide?
A group of identical VMs created from an instance template, with autohealing based on a health check, autoscaling on a metric, rolling updates with surge and max-unavailable settings, and optional distribution across the zones of a region.
Compare App Engine standard and flexible environments.
Standard runs your code in a language-specific sandbox, starts in seconds and scales to zero. Flexible runs your container on managed Compute Engine VMs, allows any runtime and native code, but has slower scaling and does not scale to zero.
How does Cloud Run differ from running containers on a cluster you operate?
A managed service that runs stateless containers, autoscaling on concurrent requests, scaling to zero when idle, and billing only for the time a container instance is handling work. It also runs finite tasks as Cloud Run jobs.
How do Cloud Functions relate to Cloud Run?
Cloud Functions run a single event-driven function without a container build. The second generation is built on Cloud Run and Eventarc, so it inherits Cloud Run's concurrency, longer timeouts and larger instance sizes.
What is the difference between GKE Standard and GKE Autopilot?
Standard gives you node pools you size, patch and pay for whether or not Pods use them. Autopilot manages nodes entirely and bills for the CPU, memory and storage your Pods request, while restricting privileged and node-level operations.
What Persistent Disk options does Compute Engine offer?
Network-attached block storage in types trading cost against performance, including standard hard-disk backed, balanced and SSD tiers. A regional persistent disk replicates synchronously across two zones. Local SSD is physically attached, very fast and entirely ephemeral.
What are Cloud Storage location types?
A bucket is created in one of three location types: a single region, a dual-region pair, or a multi-region covering a continent. The choice is permanent for the life of the bucket and affects availability, latency and cost.
Name the Cloud Storage classes and their minimum storage durations.
Standard has no minimum. Nearline has a 30-day minimum, Coldline 90 days and Archive 365 days. Colder classes cost less to store and more to retrieve, but all four have the same millisecond first-byte latency.
What does Cloud Storage object lifecycle management do?
Applies rules to a bucket that automatically change an object's storage class or delete it based on age, version state, class or a creation-date condition.
Uniform bucket-level access
A setting that disables per-object ACLs so that access is controlled only by IAM at the bucket level, giving one consistent, auditable permission model.
How do you grant one-off access to a single private Cloud Storage object?
A time-limited URL that grants a specific operation on a specific object to whoever holds it, without them needing a Google identity. It is signed by a service account key or by the IAM credentials API.
What does a Cloud Storage retention policy plus bucket lock provide?
A retention period that prevents any object from being deleted or overwritten before it reaches that age. Locking the policy makes it permanent and irreversible for the life of the bucket.
What is Cloud SQL, and how is high availability provided?
A managed relational database for MySQL, PostgreSQL and SQL Server, handling patching, backups and replication. In its high availability configuration it maintains a standby instance in a second zone with synchronous replication, and fails over automatically.
AlloyDB for PostgreSQL
A PostgreSQL-compatible managed database that separates compute from a distributed storage layer and adds a columnar engine for analytical queries, targeting higher performance than standard managed PostgreSQL while keeping compatibility.
What makes Cloud Spanner unusual among relational databases?
It combines horizontal scale-out with relational schemas, SQL and external strong consistency across regions, using synchronised clocks (TrueTime) and Paxos replication rather than a single primary.
What is Firestore, and what are its two modes?
A serverless document database with automatic scaling, real-time listeners and offline client SDKs. Native mode offers the real-time and mobile features; Datastore mode provides the older Datastore API semantics for server workloads.
When should Bigtable be used instead of Firestore or Spanner?
When you need very high throughput and low-latency single-key reads and writes over a huge, sparse wide-column dataset: time series, telemetry, financial ticks and personalisation profiles. It offers no SQL joins and no cross-row transactions.
Memorystore
Managed in-memory caching, offering Redis and Memcached, with provisioning, patching, monitoring and, for Redis, replication and failover handled by Google.
What architecture makes BigQuery serverless?
Storage and compute are fully separated: data sits in a columnar format on Google's distributed storage while queries execute on a shared, dynamically allocated pool of compute measured in slots. You provision neither servers nor clusters.
How do partitioning and clustering reduce BigQuery cost?
Partitioning splits a table by date, timestamp, integer range or ingestion time, so a filtered query prunes whole partitions. Clustering sorts data within each partition by chosen columns, letting the engine skip blocks that cannot match.