Google Cloud Services for PCA Exam (2026)
The Professional Cloud Architect exam doesn’t ask you to list service features. It tests your ability to select, combine, and justify the right Google Cloud services to meet complex business requirements. This page provides an architect‑focused view of the services you must master—not as isolated products, but as components of larger, well‑architected solutions. For detailed implementation tutorials, visit CloudComputingDevPro.
Google Cloud Services Overview
The table below organizes the most exam‑relevant services into architectural categories. Use it as a strategic reference throughout your preparation.
| Service | Category | Primary Purpose | Architectural Importance |
|---|---|---|---|
| Compute Engine | Compute | Virtual machines (IaaS) | Foundation for lift‑and‑shift, custom compute environments; requires decisions about scaling, availability, and cost control. |
| Google Kubernetes Engine (GKE) | Compute | Managed Kubernetes | Container orchestration; key for microservices, portability, and hybrid/multi‑cloud architectures. |
| Cloud Run | Compute | Serverless containers | Simplifies deployment and scaling of containerized workloads; critical trade‑off between control and operational overhead. |
| App Engine | Compute | Platform as a Service | Fully managed web application hosting; often compared to Cloud Run for standard web apps. |
| Cloud Functions | Compute | Event‑driven serverless functions | Enables lightweight, reactive architectures; architectural choice for decoupling and automation. |
| Cloud Storage | Storage | Object storage | Central to data lakes, static content, backups, and archival; decisions around storage classes, lifecycle, and access control. |
| Filestore | Storage | Managed NFS file shares | High‑performance file storage for enterprise applications requiring shared file systems. |
| Persistent Disk | Storage | Block storage for Compute Engine and GKE | Durable, high‑performance disks; architectural decisions about performance tiers and snapshot policies. |
| Cloud SQL | Database | Managed MySQL, PostgreSQL, SQL Server | Relational database for OLTP; trade‑offs in high availability, read replicas, and backups. |
| AlloyDB for PostgreSQL | Database | Enterprise‑grade PostgreSQL | High performance, scalability; alternative to self‑managed databases for demanding relational workloads. |
| Cloud Spanner | Database | Globally distributed, strongly consistent relational database | Unique capability for horizontal scaling with ACID transactions; critical for global applications. |
| Firestore | Database | Serverless NoSQL document database | Real‑time synchronization, mobile/web backends; architectural fit for specific use cases. |
| Bigtable | Database | Wide‑column NoSQL for analytics and time‑series | Low‑latency, high‑throughput; key for IoT, financial data, and personalization. |
| Virtual Private Cloud (VPC) | Networking | Software‑defined network | Foundation of all network architecture; global, shared VPCs, peering, and firewall rules. |
| Cloud Load Balancing | Networking | Global, regional traffic distribution | Enables high availability, multi‑region failover, and SSL offloading; architectural decision on layer‑4 vs layer‑7. |
| Cloud DNS | Networking | Managed DNS service | Internal and external name resolution; integrates with hybrid and multi‑cloud DNS designs. |
| Cloud CDN | Networking | Content delivery network | Accelerates global content delivery, reduces origin load; architectural fit for web and media workloads. |
| Cloud NAT | Networking | Network address translation | Provides internet access for private VMs without public IPs; security best practice. |
| Cloud VPN | Networking | Encrypted tunnels to on‑premises | Hybrid connectivity; often used as backup to Cloud Interconnect or for smaller sites. |
| Cloud Interconnect | Networking | Dedicated, high‑bandwidth connectivity | Enterprise hybrid and multi‑cloud connectivity; critical for large migrations and consistent performance. |
| IAM | Security | Identity and access management | Central to security posture; designs must enforce least privilege, roles, and service accounts. |
| Service Accounts | Security | Workload identity | Authentication for automated processes; replace user credentials in production. |
| Secret Manager | Security | Secrets storage and rotation | Securely stores API keys, passwords, certificates; integrates with applications to avoid hard‑coding. |
| Cloud KMS | Security | Key management | Centralized encryption key management; supports customer‑managed encryption keys (CMEK). |
| Security Command Center | Security | Security posture management | Centralized visibility into vulnerabilities, misconfigurations, and compliance. |
| Cloud Monitoring | Operations | Metrics, dashboards, alerting | Core observability tool; SLO monitoring, uptime checks, and incident notification. |
| Cloud Logging | Operations | Centralized log management | Audit logs, application logs, and log‑based metrics; required for security and troubleshooting. |
| Cloud Trace | Operations | Distributed tracing | Performance analysis of microservices; identifies latency bottlenecks. |
| Cloud Profiler | Operations | CPU and memory profiling | Continuous profiling for performance optimization in production. |
| BigQuery | Analytics | Serverless data warehouse | Petabyte‑scale analytics; architectural decisions around data modeling, partitioning, and access. |
| Pub/Sub | Analytics | Global messaging and event ingestion | Asynchronous decoupling; backbone for event‑driven architectures and streaming pipelines. |
| Dataflow | Analytics | Stream and batch data processing | Apache Beam‑based; architecture choice for complex ETL and real‑time analytics. |
| Vertex AI | AI | Unified ML platform | End‑to‑end ML workflows; architectural integration for training, deployment, and MLOps. |
Compute Services
Compute selection drives scalability, cost, and operational model. The table below summarizes the key decision points.
| Service | When to Choose | Key Architectural Trade‑offs |
|---|---|---|
| Compute Engine | Full OS control, legacy apps, custom networking, or strict compliance requirements. | Maximum control but highest management overhead. Use Managed Instance Groups for scaling and auto‑healing. |
| Google Kubernetes Engine (GKE) | Containerized microservices, hybrid/multi‑cloud portability, large‑scale orchestration. | Balances control and automation; operational overhead for cluster management. GKE Autopilot reduces node management. |
| Cloud Run | Stateless, HTTP‑driven container workloads; fast development and deployment. | Minimal management, scales to zero. Less control over compute infrastructure. Ideal for modern APIs and web apps. |
| App Engine | Traditional web applications with auto‑scaling and minimal operations. | Fully managed, limited to specific runtimes and sandbox. Standard vs. Flexible environments dictate customization. |
| Cloud Functions | Event‑driven, short‑lived tasks; glue code between services. | No server management; execution limited by timeout and concurrency. Best for lightweight automation. |
As an architect, you must consider not only the technical fit but also the team’s skills, operational maturity, and cost profile. A serverless‑first approach (Cloud Run, Cloud Functions) reduces overhead and often lowers cost for variable workloads, while Compute Engine or GKE may be needed for specific performance or compliance requirements.
Storage and Database Services
Data architecture directly influences application performance, scalability, and resilience. Understand the following trade‑offs.
Storage options:
- Cloud Storage – Object storage with lifecycle management. Use for unstructured data, content serving, and data lakes. Storage classes (Standard, Nearline, Coldline, Archive) align cost with access frequency.
- Persistent Disk – Block storage attached to Compute Engine and GKE. Choose between standard (HDD) and SSD types; snapshots provide backup.
- Filestore – Managed NFS for shared file systems. High performance but higher cost than Cloud Storage. Suitable for enterprise applications requiring file‑based access.
Database engines:
- Cloud SQL – Managed relational for OLTP workloads. Automatic high availability, read replicas, and backups. Not globally scalable; limited to regional deployments.
- AlloyDB – High‑performance, scalable PostgreSQL. Designed for demanding transactional workloads; offers better performance than standard Cloud SQL.
- Cloud Spanner – Horizontally scalable, strongly consistent relational database. Ideal for global, high‑throughput applications. Higher cost; evaluate whether the consistency and scale are truly needed.
- Firestore – NoSQL document database with real‑time sync. Great for mobile and web apps; limited analytical query capability.
- Bigtable – Wide‑column NoSQL for high‑throughput analytics, time‑series, and personalization. Low latency but limited to key‑value lookups; not suitable for complex queries.
Architectural decision framework: For a global e‑commerce platform, you might use Cloud Spanner for inventory (strong consistency across regions) and Firestore for user profiles (real‑time sync). For a data warehouse, BigQuery is the primary choice. Always align the database with the access patterns and consistency requirements.
Networking Services
Network design impacts security, performance, and reliability. The PCA exam expects you to design scalable, secure, and hybrid‑ready networks.
- VPC – Global, shared, and peering configurations. Use Shared VPC for multi‑project environments to centralize network administration. Plan CIDR ranges to avoid overlap in hybrid scenarios.
- Cloud Load Balancing – Global HTTP(S) load balancing enables multi‑region active‑active architectures with automatic failover. Regional TCP/UDP load balancers handle non‑HTTP traffic. Understand the use of health checks and backend services.
- Cloud DNS – Private zones for internal resolution, forwarding to on‑premises DNS. Integrate with Cloud VPN or Interconnect for hybrid DNS.
- Cloud CDN – Edge caching for static and dynamic content. Reduces latency and origin load. Architect for cache invalidation strategies.
- Cloud NAT – Provides outbound internet access for private instances. Essential for patching and API access without exposing VMs to the internet.
- Hybrid connectivity – Cloud VPN for encrypted tunnels, Cloud Interconnect for dedicated, high‑bandwidth links. Often used together for redundancy. Network Connectivity Center simplifies multi‑site topologies.
- Private connectivity – VPC Service Controls create perimeters around multi‑tenant services to prevent data exfiltration. Private Service Connect allows secure, private access to Google APIs and third‑party services.
A common enterprise pattern: Shared VPC with a hub and spoke design, Cloud Interconnect for on‑premises connectivity, Cloud NAT for outbound internet, and VPC Service Controls for data protection.
Security Services
Security is a cross‑cutting concern. Every architecture must incorporate defense in depth, least privilege, and centralized governance.
- IAM – Roles (predefined, custom, primitive) and conditions. Design with principle of least privilege. Use groups and service accounts, not individual users, for production access.
- Organization Policies – Enforce guardrails at the organization or folder level (e.g., restrict domain‑restricted sharing, limit VM external IPs). Essential for compliance.
- Service Accounts – Workload identity. Attach to Compute Engine, Cloud Run, GKE workloads. Avoid downloading keys; use automatic credential rotation.
- Secret Manager – Store database passwords, API keys, and certificates. Integrate with Cloud Run, GKE, and Cloud Functions for secure access.
- Cloud KMS – Centralize key management. Customer‑managed encryption keys (CMEK) give you control over data at rest. Cloud HSM for hardware‑backed keys.
- Security Command Center – Central dashboard for vulnerabilities, misconfigurations, and threats. Enable Security Health Analytics and integrate with Eventarc for automated remediation.
The architect must design IAM hierarchies that reflect the organization’s structure, apply organization policies for proactive control, and ensure that encryption keys are managed according to data sensitivity.
Operations and Reliability
Building a reliable system requires observability, automated recovery, and proactive maintenance.
- Cloud Monitoring – Create dashboards, define SLOs, and set up alerting policies. Use uptime checks to monitor external availability. Integrate with notification channels (email, PagerDuty).
- Cloud Logging – Centralize all logs. Enable audit logs for compliance and security investigations. Use log‑based metrics to create custom alerts.
- Cloud Trace – Distributed tracing for latency analysis in microservices. Identify bottlenecks in request flows.
- Cloud Profiler – Continuously profiles CPU and memory usage in production without significant overhead. Helps optimize resource utilization and reduce cost.
- Backup and disaster recovery – For Compute Engine, use snapshots and managed instance groups. For databases, configure automated backups, high availability, and cross‑region replication. Design for RTO/RPO based on business requirements.
Adopt the Google Cloud Architecture Framework’s reliability pillar: design for failure, implement redundancy across zones and regions, and test recovery procedures regularly.
Analytics and AI Services
Data and AI are increasingly integrated into modern solutions. The PCA exam expects familiarity with the following services.
- BigQuery – Serverless data warehouse. Architect for cost optimization (partitioning, clustering, reservation model). Understand access controls (IAM, authorized views) and data ingestion patterns.
- Pub/Sub – Asynchronous messaging backbone. Use for decoupling microservices, ingesting streaming data, and fan‑out patterns. Design for at‑least‑once delivery and idempotent processing.
- Dataflow – Apache Beam‑based stream and batch processing. Useful for complex ETL, data enrichment, and aggregation. Consider as an alternative to Dataproc for serverless, autoscaling pipelines.
- Vertex AI – Unified platform for ML model development and deployment. Architects need to know how to integrate Vertex AI endpoints with applications, secure them with IAM, and design for MLOps (continuous training, model monitoring).
Integration example: An e‑commerce site might use Pub/Sub to capture user clicks, Dataflow to transform and aggregate data into BigQuery, and Vertex AI to serve product recommendations via a microservice on Cloud Run.
Mapping Services to Exam Objectives
The table below shows how core services align with the six PCA objectives, reinforcing where each service is most relevant.
| Service | Related Objectives | Architecture Role |
|---|---|---|
| Compute Engine | 1, 2, 4, 5 | Primary compute; decisions on scalability and cost |
| GKE | 1, 2, 4, 5, 6 | Container orchestration for microservices |
| Cloud Run | 1, 2, 4, 5 | Serverless compute for modern applications |
| Cloud Storage | 1, 2, 3, 4, 6 | Object storage for data lakes, backups, and static content |
| Cloud SQL | 1, 2, 4, 6 | Managed relational databases with HA/DR |
| Cloud Spanner | 1, 2, 4, 6 | Global, scalable relational database |
| VPC | 1, 2, 3, 6 | Network foundation; connectivity and security |
| Cloud Load Balancing | 1, 2, 6 | High availability and multi‑region traffic management |
| IAM | 1, 2, 3 | Access control and identity management |
| Cloud Monitoring | 4, 6 | Observability and SLO management |
| BigQuery | 1, 4 | Analytics and data warehousing |
| Pub/Sub | 1, 4 | Event‑driven messaging and decoupling |
Service Learning Priority
Prioritize your study based on exam importance and architectural frequency.
| Priority | Services | Reason |
|---|---|---|
| High | Compute Engine, VPC, IAM, Cloud Storage, Cloud SQL, GKE, Cloud Run, Cloud Monitoring, BigQuery, Pub/Sub | They appear in the majority of design scenarios and underpin almost every solution. |
| Medium | Cloud Spanner, Cloud Load Balancing, Cloud DNS, Cloud CDN, Cloud NAT, Cloud VPN, Cloud Interconnect, Secret Manager, Cloud KMS, Dataflow, Vertex AI | Frequently used in specialized scenarios (global applications, hybrid networking, advanced analytics). |
| Advanced | AlloyDB, Firestore, Bigtable, Cloud Trace, Cloud Profiler, Security Command Center | Important for depth, but less frequently the primary focus of exam questions. Study once the high‑priority services are mastered. |
Service Relationships
Enterprise solutions are not a single service but a integration of many. The diagram below illustrates a typical modern architecture.
A global load balancer routes to a Cloud Run service. The application uses Cloud SQL for transactions and Cloud Storage for static assets. Events are published to Pub/Sub, processed by Dataflow, and stored in BigQuery for analytics and Vertex AI for model serving. IAM, VPC, and KMS provide security and isolation; Monitoring and Logging ensure observability.
Recommended Study Roadmap
Master services in this sequence to build architectural thinking layer by layer.
- Compute – Understand the core execution environments; every solution has a compute element.
- Networking – Learn how resources communicate and are secured. VPC is foundational.
- Storage – Choose the right data storage for each workload.
- Databases – Deepen your knowledge of managed database options and their trade‑offs.
- IAM & Security – Apply access control and encryption across all layers.
- Monitoring – Design for observability and operational excellence.
- Analytics – Incorporate data processing and analysis into architectures.
- AI – Leverage machine learning where it adds business value.
- Architecture Patterns – Combine all services into proven enterprise designs.
This order matches the dependency chain: compute runs on networks, stores data, and is secured before you optimize and extend with analytics.
Common Mistakes
- Memorizing service names without understanding trade‑offs – PCA questions ask “Which service best meets these requirements?” You must know the why.
- Ignoring architectural trade‑offs – Every service choice involves cost, complexity, and control. Acknowledge these in your design.
- Weak networking knowledge – Many candidates fail to design proper VPCs, firewalls, and hybrid connectivity. This is a major exam area.
- Forgetting cost optimization – The cheapest service is not always the right one, but the exam will ask you to balance cost with other pillars.
- Treating services in isolation – Design scenarios require you to integrate services. Practice with the Scenarios to build this skill.
Continue Learning
- PCA Certification Overview – Full exam guide and learning framework.
- PCA Exam Objectives – The official blueprint with architecture context.
- PCA Architecture Patterns – Reusable patterns for enterprise solutions.
- PCA Scenarios – Practice making architecture decisions in realistic case studies.
- PCA Resources – Study checklists, official references, and practice materials.
For detailed implementation tutorials, API references, and deep technical guides on every Google Cloud service, continue your learning on CloudComputingDevPro.
Frequently Asked Questions
Which Google Cloud services are most important for the PCA exam?
Focus on Compute Engine, VPC, IAM, Cloud Storage, Cloud SQL, GKE, Cloud Run, Cloud Monitoring, BigQuery, and Pub/Sub. These are the backbone of most architectures.
Should I study every Google Cloud service?
No. The exam evaluates your ability to choose appropriate services, not encyclopedic knowledge. Master the high‑priority list and understand their trade‑offs.
How deeply should I understand Kubernetes?
You should know GKE architecture: cluster types (autopilot vs. standard), node pools, networking, and basic workload management. Deep Kubernetes internals are not required.
Is Vertex AI covered in the PCA exam?
Yes, but at a high level. Understand its role in ML workflows, how to serve models securely, and its integration with other services like BigQuery and Cloud Storage.
How much networking knowledge is required?
Extensive. You must design VPCs, subnets, firewalls, load balancers, and hybrid connectivity. Networking is one of the most heavily tested domains.
Key Takeaways
- PCA is an architecture exam. Focus on service selection and the trade‑offs between cost, performance, security, and reliability.
- Prioritize the high‑importance services, but understand how they integrate. The exam tests combined solutions, not isolated facts.
- Use the service relationship diagram as a mental model to connect services in your designs.
- Complement this guide with CloudCertPro’s architecture patterns and scenarios to build real‑world decision‑making skills.
- For deep technical details, always refer to official Google Cloud documentation and CloudComputingDevPro.