Domain 1: Designing Cloud-Native Applications
- In-memory session state on one instance is not shared with other instances an autoscaler adds, so state must be externalized to a shared store like Memorystore for consistent behavior across a scaled-out service.
- Cache-aside (lazy loading) has the app read the cache first and populate it from the database only on a miss, while writes go straight to the database; cache TTL trades data freshness against database refresh load.
- A connection pool reuses a bounded set of persistent connections across requests instead of opening one per request, preventing exhaustion of a backend's client limit such as Redis max connections.
- An API key identifies the calling application or project for usage tracking, billing, and quota without carrying end-user identity; use OAuth 2.0 authorization code grant only when accessing a specific user's private data.
- Enabling Cloud SQL regional high availability provisions an automatic standby that fails over across zones, while a read replica offloads read traffic from the primary without affecting write performance.
- BigQuery is a serverless data warehouse built to scan terabytes efficiently for ad hoc analytical SQL, whereas Bigtable has no native SQL joins and is unsuited to relational reporting; Cloud Spanner uses the TrueTime API for globally ordered timestamps and external consistency across regions.
- A regional managed instance group spreads instances across multiple zones by default, giving resilience to a single-zone outage.
- A circuit breaker opens after repeated failures to stop new calls to a struggling dependency so the caller fails fast, and raising a Cloud Run request timeout beyond a downstream call's duration prevents premature cancellation.
- gRPC uses HTTP/2 multiplexing so many concurrent calls share one persistent connection, and an OpenAPI specification defines REST paths, methods, and schemas that Cloud Endpoints uses for validation and routing.
- Secret Manager versions secret values, supports per-secret IAM, and can notify a team via Pub/Sub when a rotation period is due; disabling a customer-managed key blocks decryption entirely until re-enabled.
Domain 2: Building and Testing Applications
- A software bill of materials (SBOM) records component names, versions, and license metadata, letting legal teams review compliance across the full dependency tree; CVSS scores describe security risk, not licensing.
- Emulators give fast local development feedback and deterministic CI integration tests without a real project, but they do not reproduce production performance and do not enforce IAM, so permission behavior must be tested against a real project.
- A post-deployment smoke test suite is fast, automated, and limited to a few critical checks like health endpoints, giving quick confidence rather than exhaustive coverage.
- Trunk-based development keeps branches short-lived with a lightweight pull-request check for review, and each release should be tagged with an immutable semantic version rather than a reusable mutable tag like latest.
- Pulling a file from a remote URL during a build breaks reproducibility because the resource can change or disappear, so dependencies should be vendored or pinned to checksum-verified artifacts.
- Cloud Build private worker pools support VPC peering for private network access and let teams choose a machine type for dedicated build workers.
- PROJECT_ID, BUILD_ID, and SHORT_SHA are default substitutions Cloud Build populates automatically from the build context.
- Higher SLSA levels require builds to run on a trusted hosted platform that generates verifiable provenance, and vulnerability severity levels like CRITICAL and HIGH derive from the Common Vulnerability Scoring System (CVSS); a multi-stage Docker build copies only the compiled binary into a minimal final stage.
- kind runs each Kubernetes node as a Docker container for fast disposable CI clusters, the Functions Framework runs a Cloud Function locally as an HTTP server, and the Firestore emulator evaluates security rules offline.
- The Cloud SQL Auth Proxy can connect over an instance's private IP alone with no public IP required, Cloud Code validates Kubernetes YAML against known schemas inside the editor, and an Artifact Registry Go format repository resolves internal modules privately through go get.
Domain 3: Deploying Applications
- A Cloud Run job defines a total task count and a parallelism value that caps how many tasks run simultaneously, distinct from a service's per-instance concurrency.
- Cloud Run scales instances by dividing total concurrent demand by the per-instance concurrency limit, and offers three ingress options (all, internal, internal and Cloud Load Balancing) that control which network sources reach a service.
- A rolling update swaps old instances for new ones incrementally within one environment, blue-green stands up a full parallel environment for a single-cutover switch, and canary phases shift a defined traffic percentage at each step.
- Setting maxUnavailable to 0 prevents dropping below desired capacity during a rollout while a positive maxSurge allows extra pods, and kubectl rollout status reports live rollout progress.
- A Cloud Deploy release is an immutable snapshot binding a specific artifact version to rendered config, and promoting an existing release carries forward its fixed artifact rather than triggering a new build.
- GKE Autopilot fully manages nodes with security hardening by default and bills on pod resource requests, removing node-pool and machine-type management required in GKE Standard.
- Control plane authorized networks restrict which CIDR ranges may reach a GKE cluster's control plane endpoint, Cloud NAT provides outbound internet for instances without external IPs such as private GKE nodes, and a Serverless VPC Access connector scales between configured min and max throughput.
- Binary Authorization policies enforce attestation before deploy but support image-path-based exemptions for specific trusted images, and running a service under the broad Editor role violates least privilege.
- A liveness probe restarts a container that has become unresponsive, and taints repel pods from nodes unless a pod carries a matching toleration.
- helm rollback reverts a named release to a previous revision from Helm's release history, and values.yaml holds configurable defaults that templates reference and operators override per install.
Domain 4: Integrating Google Cloud Services
- Eventarc routes Cloud Storage object events (such as finalize when an object is fully written), Cloud Audit Logs events, and direct Pub/Sub messages as trigger sources.
- Cloud Scheduler's Pub/Sub target publishes to a topic on a cron schedule, while Cloud Tasks suits a single one-time delayed action, created as one task with a schedule time in the future.
- Cloud Tasks queues expose configurable dispatch rate, max concurrent dispatches (in-flight concurrency), and retry limits; cap max concurrent dispatches to protect a target that fails above a simultaneous-request threshold.
- Pub/Sub guarantees message ordering only among messages sharing the same ordering key, not across different keys.
- Workflows can define a subworkflow invoked with different parameters from multiple call sites, use http.get connector calls to fetch external data into a variable, and handle failures with a retry policy in a try block paired with an except block.
- A log sink exports matching log entries to a BigQuery dataset for retention and querying far beyond Cloud Logging's default retention, and GKE forwards container stdout and stderr via a Fluent Bit agent on each node.
- Error Reporting scans Cloud Logging directly for error-like entries without needing a log-based metric first, and custom Cloud Monitoring metrics must use the custom.googleapis.com prefix.
- An error budget of 0.1 percent against 1,000,000 requests permits 1,000 failures before the SLO is breached; a daily quota exhaustion is a capacity limit resolved by a project quota increase, not a transient rate limit.
- Local development can impersonate a service account via gcloud auth application-default login with the Service Account Token Creator role, exchanging the developer's credentials for short-lived tokens without downloading a key, while workforce sign-in to the Cloud Console and Workspace is managed through Cloud Identity rather than Firebase Authentication, which serves application end users.
- A one-time Firestore get() is more cost-effective than a persistent real-time listener for rarely-changing data needed only on screen load, Parquet and Avro suit exporting BigQuery data to Cloud Storage, and setting a custom attribute on a Cloud Trace span attaches context like the payment provider in the trace waterfall view.
Google Cloud Professional Cloud Developer exam tips
- Learn the compute selection decision tree cold: Cloud Run for stateless request-driven containers, Cloud Run jobs for finite batch tasks, GKE Autopilot when you need Kubernetes without node management, and GKE Standard when you must control nodes.
- For auth questions, match the mechanism to the caller: API keys for app-level usage and quota, OAuth 2.0 for delegated user data access, service account impersonation for local dev, and Cloud Identity for workforce sign-in.
- Know the messaging and scheduling tools by their trigger shape: Pub/Sub for fan-out, Eventarc for event routing, Cloud Scheduler for recurring cron, and Cloud Tasks for rate-limited or single delayed dispatches.
- Memorize the release strategies and their cost and risk tradeoffs: rolling reuses infrastructure, blue-green needs a full parallel environment, and canary shifts traffic in validated percentage phases.
- Practice the SLO math and observability stack: compute error budgets from request volume, remember custom.googleapis.com for custom metrics, and know that Error Reporting reads Logging directly while log sinks export to BigQuery.
Study guide FAQ
How many questions are on the Professional Cloud Developer exam and how long is it?
The exam runs 120 minutes and contains multiple-choice and multiple-select questions. Google reports results as pass or fail and does not publish a fixed passing score.
What is the difference between a Cloud Run service and a Cloud Run job?
A Cloud Run service serves inbound HTTP requests and autoscales based on concurrency, while a Cloud Run job runs a finite task to completion using a task count and parallelism value, making it suited to batch work rather than serving traffic.
How much coding does the exam require?
It emphasizes applied development judgment more than writing syntactically perfect code: choosing compute platforms, caching and resilience patterns, CI and artifact practices, release strategies, and service integration. Familiarity with reading gcloud, YAML, and API concepts is expected.
How does this exam differ from the Professional Cloud Architect exam?
Cloud Developer focuses on building, testing, deploying, and integrating application code using services like Cloud Run, GKE, Cloud Build, and Pub/Sub, while Cloud Architect focuses on high-level solution design, business requirements, and enterprise-wide infrastructure decisions.
Official exam sources
The domain names and weightings on this page follow the published exam blueprint. Each source below records what it confirmed and when it was read, so the split can be checked rather than taken on trust.
- Google Cloud - Professional Cloud Developer certification pagelink and content verified 8 September 2026Length: Two hours, matching our 120 minutes. Format: 50-60 multiple choice and multiple select questions. Registration 200 USD. Recommended experience: "3+ years of industry experience including 1+ years designing and managing solutions using Google Cloud".