Google Cloud learning path: everything to study, topic by topic

Why organizations adopt the cloud, IaaS/PaaS/SaaS and shared responsibility, Google Cloud's regions, zones and network, CapEx versus OpEx, sustainability, and how digital transformation, data and AI create business value

Organization, folders and projects, project ID versus number, enabling APIs, labels and tags, inheritance of IAM and Organization Policy constraints, Assured Workloads, data residency, and regulatory compliance programs

Cloud Billing accounts and project linkage, budgets and alerts, billing export to BigQuery, committed use discounts, sustained use discounts, Spot VMs, rightsizing recommendations, labels for cost allocation and FinOps

Cloud Console, Cloud Shell, the gcloud CLI and configurations, client libraries and REST APIs, API enablement, Terraform, Infrastructure Manager, Config Connector and repeatable deployments

Machine families and custom machine types, images and startup scripts, Persistent Disk and Hyperdisk, snapshots, managed instance groups with autoscaling and autohealing, Spot VMs, sole-tenant nodes, live migration and OS patching

GKE Autopilot versus Standard, zonal versus regional clusters, node pools, release channels and upgrades, Workload Identity, horizontal and vertical pod autoscaling, cluster autoscaler, and operating workloads

Serverless compute choices: Cloud Run services and jobs, revisions, traffic splitting, concurrency and scaling to zero, Cloud Functions triggers through Eventarc, App Engine standard and flexible, Cloud Tasks and Scheduler

Apigee and API Gateway for API management, Artifact Registry, Cloud Build, Cloud Deploy, blue/green and canary releases, rollback, and the business value of APIs and modern application delivery

Cloud Run ingress settings (all, internal, internal and Cloud Load Balancing) and forcing traffic through a load balancer, Direct VPC egress versus a Serverless VPC Access connector, Cloud Run functions and services calling each other with ID tokens and the Cloud Run Invoker role

Backup for GKE (backup and restore plans), readiness probes and PodDisruptionBudgets for safe upgrades, ResourceQuota and LimitRange per namespace, Config Sync fleet GitOps, internal load balancer subsetting, Multi-cluster Services (ServiceExport and ServiceImport), GKE Sandbox, Container-Optimized OS node hardening and GKE security posture

Client retry with exponential backoff and jitter, load testing before launch, emulator-based integration tests in CI, expand-and-contract database schema migrations, Cloud Tasks queues with rate limits and retries, Cloud Workstations managed development environments, and resumable and parallel uploads with gcloud storage

Global VPC networks, auto versus custom mode, subnets and IP ranges, alias IPs, Shared VPC, VPC Network Peering, Private Google Access, Private Service Connect and multi-project network designs

System-generated and custom routes, dynamic routing with Cloud Router and BGP, HA VPN, Dedicated and Partner Interconnect, Cross-Cloud Interconnect, Network Connectivity Center and resilient hybrid designs with SLAs

Application versus network load balancers, external versus internal, global versus regional, backend services and health checks, URL maps, Cloud CDN caching, Cloud DNS zones, DNSSEC and routing policies

VPC firewall rules, hierarchical and network firewall policies, Cloud NGFW, Cloud Armor WAF and DDoS protection, Cloud NAT, Secure Web Proxy, Packet Mirroring and network virtual appliances

VPC-native clusters and Pod/Service IP ranges, private clusters and control-plane access, Gateway and Ingress, network policies, Cloud NAT for nodes, multi-cluster services and IP address exhaustion planning

VPC Flow Logs, firewall rules logging, Connectivity Tests, Network Topology, Performance Dashboard, Firewall Insights, Cloud Monitoring for network metrics, and diagnosing hybrid and load balancer issues

Network Connectivity Center (NCC) hubs with VPC, hybrid (HA VPN and VLAN attachment), router appliance and producer VPC spokes: mesh versus star topology with center and edge groups, spoke acceptance across projects, export and exclude-export ranges, site-to-site data transfer over Google's backbone, redundant Cloud Router interfaces for appliances, and Private NAT with NCC for overlapping ranges

Private Service Connect (PSC) for consuming Google APIs and published services: endpoints with an internal IP, PSC network endpoint groups as load balancer backends, PSC for Google APIs (all-apis and vpc-sc bundles, endpoint DNS names), publishing a service behind an internal load balancer with a service attachment and NAT subnet, and consumer approval modes with connection limits

Network virtual appliances on Compute Engine: IP forwarding (can-ip-forward set at VM creation), internal passthrough load balancer as static-route next hop, multi-NIC guest OS source routing, policy-based routes that override normal routing, and Packet Mirroring policies that clone full packets from instances, subnets or tags to a collector load balancer for IDS inspection

Dual-stack subnets with external IPv6 and internal ULA IPv6 ranges, IPv6 over HA VPN and VLAN attachments, bring your own IP (BYOIP) public advertised prefixes, reserving static internal IPs, Premium versus Standard Network Service Tiers (global versus regional external load balancing), and egress bandwidth caps by machine type

Cloud Interconnect MACsec for Dedicated connections and when HA VPN over Interconnect is needed instead, IKE proposal and shared-secret troubleshooting for HA VPN tunnels, VPN MTU and path MTU discovery with MSS clamping, and Interconnect diagnostics (light levels, LACP, VLAN attachment and BGP status)

Certificate Manager (Google-managed and self-managed certificates, DNS authorization, load balancer authorization, certificate maps), mutual TLS on the external application load balancer with TrustConfig and ServerTlsPolicy, SSL policies (minimum TLS version and cipher profile), CA Service hierarchies for workload mTLS, load balancer request logging, and Cloud DNS query logging, DNS peering and inbound server policies

Cloud Storage buckets, storage classes and Autoclass, locations, lifecycle rules, versioning, retention and object holds, signed URLs, uniform bucket-level access, plus block (Persistent Disk, Hyperdisk) and file (Filestore) storage

Managed MySQL, PostgreSQL and SQL Server on Cloud SQL, high availability, read replicas, backups and point-in-time recovery, connectivity options, AlloyDB for PostgreSQL, and Database Migration Service

Globally distributed relational database: instances, configurations and regional versus multi-region, schema and primary key design to avoid hotspots, interleaving, TrueTime consistency, scaling and backups

Bigtable wide-column design, row key and schema design, clusters and replication; Firestore document data model, indexes and consistency; Memorystore for Redis and Memcached caching patterns

Selecting storage and database services by data model, scale, latency and consistency; Storage Transfer Service, Transfer Appliance, Datastream change data capture, and Database Migration Service

Topics and subscriptions, push versus pull, acknowledgment and ordering, dead-letter topics, retries, exactly-once delivery, BigQuery and Cloud Storage subscriptions, and Managed Service for Apache Kafka

Batch and streaming pipelines with Apache Beam, PCollections and transforms, windowing, triggers and watermarks, late data, templates, autoscaling, Streaming Engine and pipeline testing

Dataproc clusters, ephemeral and autoscaling clusters, Dataproc Serverless for Spark, initialization actions, separation of storage and compute with Cloud Storage, and migrating on-premises Hadoop and Spark

Orchestrating data pipelines with Cloud Composer (Airflow), Workflows and Cloud Scheduler, scheduled queries, CI/CD for pipelines, retries and idempotency, monitoring and troubleshooting failed pipelines

Designing a lake on Cloud Storage, open table formats, BigLake, Dataplex Universal Catalog for discovery, lineage, quality and governance, Analytics Hub, authorized sharing and data mesh principles

Preparing data for visualization and BI, Looker and Looker Studio, semantic models, materialized views and BI Engine, data quality and cleaning, and smart analytics and streaming analytics business value

Designing data processing systems: fidelity and reliability, validation and cleansing, schema evolution, encryption, IAM and column-level security for data, portability across environments, and cost-aware architecture

BigQuery on-demand versus capacity pricing with editions, reservations, baseline and autoscaling slots, partitioning and clustering to cut bytes scanned, partition expiration, time travel and fail-safe windows, logical versus physical storage billing, BATCH job priority, search indexes and continuous queries

BigQuery Data Transfer Service scheduled transfers, federated queries to Cloud SQL with EXTERNAL_QUERY connections, Dataform SQL workflows and assertions, Cloud Data Fusion visual pipelines, Teradata SQL translation with the BigQuery Migration Service and the DTS migration agent, and reconciliation with the Data Validation Tool

Beam stateful processing and timers, TestStream unit tests, hot-key fanout, dead-letter tagged outputs, RunInference for in-pipeline models, draining versus cancelling a streaming job, in-place pipeline update with transform name mapping, regional zone placement and Compute Engine quota troubleshooting

Pub/Sub topic schemas (Avro and Protocol Buffers) and subscription expiration, Google Cloud Managed Service for Apache Kafka versus Pub/Sub, Bigtable autoscaling, garbage-collection policies and change streams, Cloud Composer snapshots for disaster recovery and Cloud SQL Query Insights

AI and ML concepts and business value, pre-trained APIs (Vision, Speech, Natural Language, Translation, Document AI), BigQuery ML, AutoML on Vertex AI, and choosing build versus buy

Foundation models on Vertex AI, Model Garden, prompt design, grounding and retrieval-augmented generation, Vector Search, tuning versus prompting, agent building and evaluation, and safety filters

Exploring and preprocessing data for ML, Vertex AI Workbench and Colab Enterprise, Feature Store, dataset splits and leakage, experiment tracking, TensorBoard and Vertex ML Metadata

Custom training on Vertex AI, prebuilt versus custom containers, distributed training, hyperparameter tuning, choosing CPUs, GPUs and TPUs, loss and metric selection, and cost-complexity-latency tradeoffs

Vertex AI endpoints for online prediction, batch prediction, Model Registry, autoscaling, traffic splitting, GPU serving, latency optimization, and choosing online versus batch versus edge inference

Vertex AI Pipelines (Kubeflow, TFX), orchestration of data, training and deployment steps, CI/CD for ML, triggers for retraining, model versioning and reproducibility

Vertex AI Model Monitoring for skew and drift, performance monitoring, Explainable AI, fairness and bias, responsible AI practices, AI risks, testing and troubleshooting ML systems

Gemini on Vertex AI in production: context caching, controlled generation with a response schema, streaming for time to first token, quota errors (429) and Provisioned Throughput, model cascades with Flash and Pro, pairwise evaluation with the Gen AI evaluation service and monitoring answer quality with autoraters

Deciding whether ML is justified against a rules baseline, translating a business goal into a well-posed supervised problem with a prediction window and label definition, proxy-objective misalignment, label quality and annotator agreement, and uncertainty-sampling active learning loops

Learning to rank with pairwise and listwise objectives and NDCG, two-stage recommender architecture (retrieval then ranking), outlier-robust loss functions such as Huber, differential privacy with DP-SGD against membership inference, and incremental or online model updates with fallback to the last good version

Diagnosing low GPU utilization from an input-bound tf.data pipeline (parallel map, prefetch, caching, vectorized batching), Vertex AI TensorBoard profiling, Dynamic Workload Scheduler Flex Start for scarce GPUs and TPUs, Spot VMs, and Vertex AI Workbench idle shutdown

Private Vertex AI endpoints with Private Service Connect or private services access, endpoint request-response logging to BigQuery, troubleshooting serving containers (out-of-memory kills, health routes, logs), and Custom Prediction Routines with local testing

Principals, roles (basic, predefined, custom), allow policies and inheritance, IAM Conditions, deny policies, principal access boundaries, least privilege, IAM Recommender and Policy Troubleshooter, audit

Service account types and roles, attaching versus impersonating, avoiding long-lived keys, short-lived credentials, Workload Identity Federation for external workloads, Workload Identity for GKE and key rotation

Cloud Identity and Google Workspace, directory sync, SSO with SAML/OIDC, workforce identity federation, multi-factor authentication, session controls, Identity-Aware Proxy, context-aware access and BeyondCorp

Default encryption at rest and in transit, Cloud KMS keys and rotation, CMEK, CSEK, Cloud HSM and External Key Manager, Secret Manager, Confidential Computing and key access justification

Service perimeters, access levels, ingress and egress rules, dry-run mode, protecting against data exfiltration, restricted VIPs, Private Service Connect and private connectivity to Google APIs

Sensitive Data Protection (DLP) inspection, de-identification and tokenization, data classification, BigQuery column-level security and masking, and securing AI workloads: prompt injection, data leakage, Model Armor

Security Command Center findings and posture, Event Threat Detection, Cloud Audit Logs (admin, data access), log sinks and aggregation, Cloud IDS, Google SecOps, and responding to incidents

Binary Authorization, Artifact Analysis vulnerability scanning, Shielded VMs and Secure Boot, OS Config patching, hardened images, Policy Controller, infrastructure scanning in CI and security automation

Access Transparency logs and Access Approval for Google personnel access, Audit Manager assessments, Compliance Reports Manager, Assured Workloads sovereign controls and data residency (bucket locations and the resource locations organization policy), Google's Cloud Data Processing Addendum, and Confidential VMs for data in use

Cloud Asset Inventory search, snapshot exports and point-in-time IAM evidence, real-time asset feeds, Policy Analyzer for who-can-access-what, Policy Simulator for change impact, Policy Troubleshooter for access denials, and Privileged Access Manager for just-in-time, approved and time-bound elevation

OS Login for IAM-governed SSH, API key application and API restrictions, project liens, Essential Contacts, Cloud Logging log views for scoped access, Web Security Scanner managed scans and Cloud Build private pools

Cloud Monitoring metrics, dashboards and alerting policies, uptime checks, the Ops Agent, Cloud Logging, log sinks and log-based metrics, Error Reporting, Cloud Trace, Profiler and managed Prometheus

SLIs, SLOs and error budgets, high availability across zones and regions, backup and disaster recovery patterns (cold, warm, hot), RTO and RPO, chaos engineering, incident management and operational readiness

Google Cloud Architecture Framework pillars (operational excellence, security, reliability, cost, performance), translating business and technical requirements into designs, compute, storage and network tradeoffs, and evaluating future improvements

Migration strategies (rehost, replatform, refactor), assessment with Migration Center, Migrate to Virtual Machines, containerization, phasing, cutover and rollback plans, and architectural diagrams and documentation

Google Cloud Customer Care support tiers (Standard, Enhanced, Premium) and their response targets, Service Health personalized incidents with Cloud Monitoring alerting, the penetration-testing policy for customer resources, carbon-aware region choice with low-CO2 and carbon-free-energy data, and compact placement policies for tightly coupled MPI workloads

Analyzing Google Cloud spend end to end: Cloud Billing export to BigQuery (standard, detailed and pricing exports), SQL and Looker Studio cost reports, label and project based showback and chargeback, resource-based versus spend-based committed use discounts and coverage analysis, budgets with Pub/Sub programmatic notifications, anomaly detection, and egress and idle-resource cost drivers

Analyzing and improving the software development lifecycle on Google Cloud: DORA four key metrics, trunk-based development with automated tests (shift left), Cloud Build pipelines with caching and private pools, Artifact Registry and Artifact Analysis scanning, Binary Authorization attestations, Cloud Deploy delivery pipelines with approvals and canary or blue/green promotion, and automated rollback

Analyzing business processes for a cloud initiative: stakeholder identification and RACI, separating business, functional and non-functional requirements, KPIs, ROI and TCO, the Google Cloud Adoption Framework and a cloud center of excellence, phased rollout with pilots, risk registers, training and communication plans, and measuring adoption

Planning business continuity and disaster recovery: business impact analysis, deriving RTO and RPO per workload, cold, warm and hot standby patterns, Backup and DR Service with immutable backups, Cloud SQL high availability and cross-region replicas, Spanner and Cloud Storage multi-region options, snapshots and regional persistent disks, DNS and load balancer failover, and DR testing

A structured troubleshooting and root-cause process on Google Cloud: mitigate first then diagnose, form and test hypotheses, use Cloud Logging, Cloud Audit Logs, Error Reporting, Cloud Trace, Connectivity Tests and Gemini Cloud Assist investigations, incident roles, five whys and contributing factors, blameless postmortems with tracked action items, and error budget policy

Planning capacity on Google Cloud: allocation versus rate quotas, monitoring quota usage with Cloud Monitoring alerts, requesting quota increases ahead of launches, the fact that quota is not a capacity guarantee, Compute Engine reservations, multi-zone and flexible machine type strategies against stockouts, managed instance group autoscaling, load testing, and forecasting demand from monitoring data