Google Cloud PCA Study Guide
Section 1: Compute, Containers, and Serverless
Service selection guide focused on why an organization would choose each option
PCA study frame For PCA-style questions, do not only memorize what the service is. Focus on the organizational reason for choosing it: operational control, cost reduction, portability, managed operations, compliance, migration speed, or performance. Most exam questions are decision questions disguised as business scenarios. |
Services and Concepts Covered
Core compute | Containers and Kubernetes | Serverless / Specialized |
|---|---|---|
Compute Engine / GCE | Google Kubernetes Engine / GKE | Cloud Run |
Managed Instance Groups / MIGs | GKE Standard | Cloud Run functions / Cloud Functions |
Spot VMs / Preemptible VMs | GKE Autopilot | App Engine Standard |
Custom machine types | Node auto-provisioning | App Engine Flexible |
Sole-tenant nodes | VPC-native GKE / alias IPs | Serverless VPC Access |
GPUs / TPUs / accelerators | Workload Identity for GKE | Google Cloud VMware Engine / GCVE |
GKE fleets / multi-cluster management | Bare Metal Solution | |
Config Management / Config Sync | AI Hypercomputer | |
Policy Controller |
Fast PCA Decision Matrix
Use this table when a practice question gives you a business requirement and asks what the architect should recommend.
If the organization needs... | Likely PCA answer |
|---|---|
Need full VM/OS control or legacy app hosting | Compute Engine |
Need VM autoscaling, autohealing, and rolling updates | Managed Instance Groups |
Need cheapest fault-tolerant compute | Spot VMs / Preemptible VMs |
Need right-sized VM CPU/memory ratios | Custom machine types |
Need dedicated host hardware for licensing/compliance | Sole-tenant nodes |
Need Kubernetes APIs, operators, sidecars, daemonsets, portability | GKE |
Need Kubernetes but minimal node operations | GKE Autopilot |
Need advanced node, network, or privileged workload control | GKE Standard |
Need stateless serverless containers or APIs | Cloud Run |
Need small event-driven code snippets | Cloud Run functions |
Need managed PaaS for supported app runtime | App Engine Standard |
Need App Engine model with custom Docker/runtime support | App Engine Flexible |
Need serverless workload to reach private VPC resources | Serverless VPC Access |
Need VMware lift-and-shift without refactoring | Google Cloud VMware Engine |
Need specialized legacy/dedicated physical hardware near Google Cloud | Bare Metal Solution |
Need large-scale AI/ML accelerator infrastructure | AI Hypercomputer |
Service Deep Dives
Each card is written in PCA language: what the service is, why an organization would use it, the exam trigger, and the common wrong turn.
Core compute
Compute Engine / GCE What it is: Google Cloud's infrastructure-as-a-service VM platform. Why an organization would use it: Use it when the organization needs maximum control over the operating system, VM shape, networking, boot disks, attached disks, startup scripts, agents, or legacy application dependencies. It is the default answer for lift-and-shift workloads, custom runtime requirements, long-running services, specialized OS images, and workloads that do not fit cleanly into containers or serverless platforms. PCA exam trigger: VMs, custom OS, existing server workload, agent-based software, legacy app, tight VM/network control, or infrastructure similar to a traditional data center. Watch out: Do not default to GCE for stateless web services when Cloud Run or App Engine would reduce operations overhead. |
Managed Instance Groups / MIGs What it is: A managed group of identical Compute Engine VMs created from an instance template. Why an organization would use it: Use MIGs to run VM-based applications with autohealing, autoscaling, rolling updates, regional distribution, and repeatable configuration. They are common when an app still needs VMs but must behave like a resilient, horizontally scaled service. PCA exam trigger: Autoscaling and autohealing VM fleets behind a load balancer, especially when the workload cannot be moved to Cloud Run or GKE yet. Watch out: Do not choose unmanaged instance groups when the question needs self-healing, autoscaling, or controlled rollouts. |
Spot VMs / Preemptible VMs What it is: Lower-cost Compute Engine capacity that can be reclaimed by Google. Why an organization would use it: Use them to reduce compute cost for fault-tolerant work such as batch jobs, rendering, CI workers, data processing workers, stateless queue consumers, and non-urgent compute that can restart safely. PCA exam trigger: Cost optimization plus a workload that can tolerate interruption, checkpoint progress, or retry from a queue. Watch out: Do not use them for stateful databases or critical production workloads that cannot tolerate termination. |
Custom machine types What it is: VM machine types with customized vCPU and memory ratios. Why an organization would use it: Use them when predefined shapes overprovision CPU or memory. This is a cost/performance tuning lever for workloads with unusual resource ratios, like memory-heavy but CPU-light applications. PCA exam trigger: The workload is overpaying for unused CPU or memory and needs a better right-sized VM shape. Watch out: Do not overcomplicate simple workloads. A predefined machine family may be cleaner when it matches the workload. |
Sole-tenant nodes What it is: Dedicated Compute Engine host hardware for one customer. Why an organization would use it: Use them for compliance isolation, hardware placement control, and bring-your-own-license scenarios where licensing terms require dedicated hosts or socket/core visibility. PCA exam trigger: Dedicated hardware, license compliance, host affinity, or strict isolation at the physical host level. Watch out: Do not confuse this with project, VPC, or IAM isolation. Sole tenancy is physical host isolation. |
GPUs / TPUs / accelerators What it is: Specialized compute accelerators for ML, AI, HPC, graphics, and parallel workloads. Why an organization would use it: Use accelerators when CPUs alone are too slow or expensive for the workload. GPUs are common for AI inference, training, rendering, video processing, and some HPC workloads. TPUs are Google-designed accelerators associated with large-scale ML workloads. PCA exam trigger: ML training, model inference, scientific computing, large matrix math, video processing, or performance bottlenecks that benefit from parallel compute. Watch out: Do not add accelerators to normal web apps or databases unless the question explicitly gives an accelerator-friendly requirement. |
Containers and Kubernetes
Google Kubernetes Engine / GKE What it is: Google Cloud's managed Kubernetes service. Why an organization would use it: Use GKE when the organization needs Kubernetes APIs, container portability, advanced orchestration, service discovery, sidecars, operators, daemonsets, custom controllers, multi-container workloads, or a platform that can support complex microservices and platform engineering patterns. PCA exam trigger: Already Kubernetes-based, requires Kubernetes-native controls, needs portability, uses sidecars/daemonsets/operators, or must run complex containerized microservices at scale. Watch out: Do not choose GKE for a simple stateless container if Cloud Run satisfies the requirements with less operational overhead. |
GKE Standard What it is: GKE mode where the organization has more control over node pools and cluster configuration. Why an organization would use it: Use Standard when platform teams need advanced Kubernetes control, custom node pools, privileged workloads, specialized networking, daemonsets, custom security controls, or operational flexibility that Autopilot may restrict. PCA exam trigger: Custom node management, privileged containers, daemonsets, specialized networking, custom machine types, or advanced Kubernetes configuration. Watch out: Do not choose Standard just because it is more flexible. If the requirement emphasizes reduced operations, Autopilot may be better. |
GKE Autopilot What it is: GKE mode where Google manages more of the cluster infrastructure, nodes, scaling, and security defaults. Why an organization would use it: Use Autopilot to run Kubernetes workloads while reducing node management, capacity planning, and operational burden. It is good for teams that want Kubernetes APIs without managing the underlying node fleet. PCA exam trigger: Kubernetes plus minimize ops, avoid node management, improve default security posture, or pay closer to requested workload resources. Watch out: Do not choose Autopilot when the workload requires privileged host access, unusual node customization, or unsupported controls. |
Node auto-provisioning What it is: GKE capability that creates and sizes node pools based on pending pod requirements. Why an organization would use it: Use it to reduce manual capacity planning and let GKE create appropriate node pools for workloads that need different CPU, memory, GPU, or machine characteristics. PCA exam trigger: Workloads cannot schedule because node pools are the wrong size/type, or the platform needs automatic capacity creation for diverse workloads. Watch out: Do not confuse it with horizontal pod autoscaling. HPA scales pods. Node auto-provisioning creates node capacity. |
VPC-native GKE / alias IPs What it is: GKE networking model where pods and services use secondary VPC IP ranges. Why an organization would use it: Use VPC-native clusters for scalable, integrated Google Cloud networking. It makes pod IPs routable within the VPC model, supports better integration with load balancing and network policy patterns, and is the modern default architecture for GKE networking. PCA exam trigger: GKE IP planning, private clusters, pod/service ranges, routing, or integration with VPC-native networking. Watch out: Do not ignore IP range planning. Poor pod/service CIDR design can block future scaling or hybrid routing plans. |
Workload Identity for GKE What it is: The recommended way for GKE workloads to access Google Cloud APIs using IAM identities instead of static service account keys. Why an organization would use it: Use Workload Identity to reduce key leakage risk and map Kubernetes service accounts to Google Cloud IAM service accounts. It is a major security pattern for production GKE. PCA exam trigger: Pods need access to Google APIs securely, especially when the wrong answer suggests downloading or mounting long-lived service account keys. Watch out: Do not store service account JSON keys in Kubernetes Secrets unless there is no modern alternative. |
GKE fleets / multi-cluster management What it is: A way to logically group and manage multiple Kubernetes clusters together. Why an organization would use it: Use fleets when operating many clusters across projects, regions, teams, or environments and needing consistent identity, policy, observability, or management boundaries. PCA exam trigger: Multiple GKE clusters and the requirement asks for consistent management or policy across them. Watch out: Do not introduce fleets for a single simple cluster unless the question is about future multi-cluster governance. |
Config Management / Config Sync What it is: GitOps-style configuration synchronization for Kubernetes clusters. Why an organization would use it: Use Config Sync to enforce consistent Kubernetes configuration across clusters and prevent manual drift. It helps platform teams manage namespaces, RBAC, policies, and baseline resources from source control. PCA exam trigger: Consistent configuration across many clusters, GitOps, drift prevention, or centrally managed Kubernetes configuration. Watch out: Do not use it as a general CI/CD deployment tool for application releases if the question is really about build/deploy pipelines. |
Policy Controller What it is: Policy enforcement for Kubernetes resources, commonly used with GKE Enterprise and fleets. Why an organization would use it: Use Policy Controller to enforce guardrails such as allowed image registries, required labels, restricted privileges, namespace standards, or other Kubernetes admission controls. PCA exam trigger: Enforce Kubernetes policy consistently across clusters before resources are admitted. Watch out: Do not confuse it with Organization Policy Service. Org Policy governs Google Cloud resources; Policy Controller governs Kubernetes resources. |
Serverless and PaaS
Cloud Run What it is: Fully managed serverless platform for containers, services, jobs, and request-driven apps. Why an organization would use it: Use Cloud Run to deploy containers without managing servers or Kubernetes. It is strong for stateless APIs, web apps, microservices, event consumers, background workers, and jobs that benefit from automatic scaling and pay-for-use economics. PCA exam trigger: Stateless container, scale to zero, sudden traffic, minimal operations, HTTP service/API, event-driven container, or serverless container platform. Watch out: Do not choose Cloud Run when the workload needs full Kubernetes APIs, custom daemonsets, persistent local state, or deep node-level control. |
Cloud Run functions / Cloud Functions What it is: Event-driven functions for small units of code triggered by HTTP, Pub/Sub, Cloud Storage, Audit Logs, or other events. Why an organization would use it: Use functions for glue code and event handlers where running a full service would be unnecessary. They are good for lightweight automation, image processing triggers, webhook handlers, simple API endpoints, and event-driven workflows. PCA exam trigger: Small single-purpose code, event trigger, minimal configuration, or quick automation around a cloud event. Watch out: Do not choose functions for complex long-running applications or workloads better packaged as a containerized service in Cloud Run. |
App Engine Standard What it is: Managed PaaS runtime for supported languages with fast scaling and opinionated environment constraints. Why an organization would use it: Use App Engine Standard for mature web applications that fit supported runtimes and benefit from rapid scaling without infrastructure management. PCA exam trigger: Supported language runtime, scale-to-zero, minimal infrastructure management, and simple app deployment without custom OS/container requirements. Watch out: Do not choose Standard when the app needs custom system packages, background processes outside supported patterns, or full container flexibility. |
App Engine Flexible What it is: App Engine environment that runs applications in Docker containers with more runtime flexibility than Standard. Why an organization would use it: Use Flexible when you want App Engine-style management but need custom runtimes, Docker containers, native libraries, or background processes that Standard does not support. PCA exam trigger: Custom runtime/container flexibility plus a PaaS-style deployment model. Watch out: Do not choose Flexible for the fastest scale-to-zero pattern. Cloud Run is often better for modern stateless containers. |
Serverless VPC Access What it is: Connectivity that lets serverless workloads reach resources in a VPC using private IPs. Why an organization would use it: Use it when Cloud Run, App Engine, or functions must call private services like internal databases, Memorystore, private APIs, or internal-only endpoints. PCA exam trigger: A serverless service must privately reach VPC resources and public internet exposure is not acceptable. Watch out: Do not use it as a general ingress security control. It is primarily about serverless egress to VPC resources. |
Specialized, hybrid, and AI compute
Google Cloud VMware Engine / GCVE What it is: Managed VMware private cloud running VMware stack on Google Cloud infrastructure. Why an organization would use it: Use GCVE to migrate or extend VMware workloads without refactoring applications, retraining teams, or immediately changing operational tooling. It is common for data center exit, VMware disaster recovery, and phased modernization. PCA exam trigger: VMware, vSphere, vCenter, NSX, HCX, data center evacuation, lift-and-shift without refactoring, or keeping the VMware operations model. Watch out: Do not choose GCVE if the workload can be modernized directly to GKE, Cloud Run, Compute Engine, or managed databases with lower cost and less VMware dependency. |
Bare Metal Solution What it is: Dedicated bare-metal machines located close to Google Cloud regions. Why an organization would use it: Use Bare Metal Solution for specialized workloads that cannot run well or legally in normal VMs, such as certain Oracle/database platforms, licensing-constrained workloads, or systems requiring direct hardware access and low-latency adjacency to Google Cloud services. PCA exam trigger: Cannot virtualize, strict legacy licensing, specialized hardware, Oracle RAC-style requirement, or dedicated physical servers adjacent to Google Cloud. Watch out: Do not confuse it with Compute Engine bare metal machine types or sole-tenant nodes. The trigger is usually legacy/specialized workloads needing a managed bare-metal environment. |
AI Hypercomputer What it is: Google Cloud's integrated AI supercomputing architecture for large-scale AI/ML workloads. Why an organization would use it: Use AI Hypercomputer when the organization needs optimized infrastructure for large model training, tuning, serving, or high-performance AI workloads using accelerators, high-performance networking, ML frameworks, and specialized consumption models. PCA exam trigger: Large AI/ML training or serving at scale, accelerator clusters, performance-optimized AI infrastructure, or modern GenAI platform architecture. Watch out: Do not use it for normal application hosting. For small inference workloads, Cloud Run with GPUs or Vertex AI may be more appropriate. |
Common PCA Confusion Points
Confusion point | How to think about it |
|---|---|
Cloud Run vs GKE | Cloud Run is the easier answer for stateless containers when Kubernetes features are not required. GKE is the answer when the organization needs Kubernetes APIs, operators, daemonsets, sidecars, custom networking, or platform control. |
GKE Autopilot vs GKE Standard | Autopilot reduces node operations and applies stronger managed defaults. Standard gives more control over node pools, machine types, networking, and privileged workloads. |
Cloud Run functions vs Cloud Run services | Functions are best for small event handlers and glue code. Cloud Run services are better when the workload is a containerized service/API with more explicit service configuration. |
App Engine Standard vs Flexible | Standard is more opinionated and fast-scaling for supported runtimes. Flexible gives more runtime/container flexibility but behaves more like managed VMs and is less of a pure scale-to-zero answer. |
MIGs vs GKE | MIGs scale identical VMs. GKE orchestrates containers with Kubernetes. If the app needs Kubernetes-native behavior, choose GKE. If it is still VM-based, choose MIGs. |
GCVE vs Migrate to VMs vs modernization | GCVE keeps the VMware operating model. Compute Engine VM migration changes the infrastructure target. GKE/Cloud Run modernization changes the application platform. |
Sole-tenant nodes vs Bare Metal Solution | Sole-tenant nodes are dedicated Compute Engine hosts. Bare Metal Solution is for specialized bare-metal environments near Google Cloud, often tied to legacy or licensing-constrained workloads. |
Spot VMs vs regular VMs | Spot VMs are cheaper but interruptible. Regular VMs are for workloads that need stable capacity and cannot tolerate preemption. |
Cram Summary
- Choose the most managed service that still satisfies the requirement.
- Compute Engine is for control. Cloud Run is for simple stateless containers. GKE is for Kubernetes control and portability.
- MIGs make VM fleets resilient; they do not replace Kubernetes orchestration.
- Autopilot minimizes GKE operations; Standard maximizes GKE flexibility.
- Workload Identity is the secure GKE answer when pods need Google Cloud API access.
- GCVE is a migration-speed and VMware-continuity answer, not a modernization answer.
- Bare Metal Solution is for specialized legacy/licensing/hardware constraints.
- Spot VMs are only safe when interruption is acceptable.
- AI Hypercomputer is for large-scale AI/ML infrastructure, not normal app hosting.
Sources used: Google Cloud Professional Cloud Architect certification page, Google Cloud application hosting docs, Compute Engine docs, Cloud Run docs, GKE docs, VMware Engine docs, Bare Metal Solution docs, and AI Hypercomputer docs.