Page tree
Skip to end of metadata
Go to start of metadata


Google Cloud Training

20220215: Google Certified Associate Cloud Engineer


Review ACE exam guide 2 days before

https://cloud.google.com/certification/guides/cloud-engineer/

The following content is directly from the above official Google Certified Associate Cloud Engineer certification exam guide page as of 20220213.  The details interleaved in each section is an example of practical hands on review/study for increase cloud effectiveness.

Writing helps me study.  I come into this with several years AWS and a bit of Azure experience with GCP (appspot) experience from 2011 as the original cloud backend.

Section 1. Setting up a cloud solution environment

20220214:1330

1.1 Setting up cloud projects and accounts. Activities include:

Creating a resource hierarchy

https://cloud.google.com/sdk/gcloud/reference/projects/create


gcloud auth list



Applying organizational policies to the resource hierarchy

https://cloud.google.com/sdk/gcloud/reference/config/set


switch project
michael@cloudshell:~ (oldev1-seed-project)$ gcloud config set project certification-sbx
Updated property [core/project].
michael@cloudshell:~ (certification-sbx)$

# example iam-admin org policy constraints/gcp.resourceLocations to specific region for PBMM



Granting members IAM roles within a project

create a serviice account first to test with https://cloud.google.com/iam/docs/creating-managing-service-accounts

michael@cloudshell:~ (certification-sbx)$ gcloud iam service-accounts create cert-sa --description=cert-sa --display-name=cert-sa
Created service account [cert-sa].
michael@cloudshell:~ (certification-sbx)$ gcloud projects add-iam-policy-binding certification-sbx --member="serviceAccount:cert-sa@certification-sbx.iam.gserviceaccount.com" --role=roles/storage.admin
Updated IAM policy for project [certification-sbx].
bindings:
- members:
  - user:michael@obrienlabs.dev
  role: roles/owner
- members:
  - serviceAccount:cert-sa@certification-sbx.iam.gserviceaccount.com
  role: roles/storage.admin



Managing users and groups in Cloud Identity (manually and automated)


gcloud auth list



Enabling APIs within projects

https://cloud.google.com/endpoints/docs/openapi/enable-api

TODO: script to enable all 670 services

TODO: script to get diff of service additions (671 1 day later)

# get list of apis
michael@cloudshell:~ (certification-sbx)$ gcloud services list --available | grep NAME | wc -l
670

# list of services enabled by default = 14 and does not include gce
michael@cloudshell:~ (certification-sbx)$ gcloud services list --enabled | grep NAME
NAME: bigquery.googleapis.com
NAME: bigquerystorage.googleapis.com
NAME: cloudapis.googleapis.com
NAME: clouddebugger.googleapis.com
NAME: cloudtrace.googleapis.com
NAME: datastore.googleapis.com
NAME: logging.googleapis.com
NAME: monitoring.googleapis.com
NAME: servicemanagement.googleapis.com
NAME: serviceusage.googleapis.com
NAME: sql-component.googleapis.com
NAME: storage-api.googleapis.com
NAME: storage-component.googleapis.com
NAME: storage.googleapis.com

# enable google compute engine - 30 sec
michael@cloudshell:~ (certification-sbx)$ gcloud services list --available | grep compute
NAME: compute.googleapis.com
NAME: prisma-cloud-compute-paloaltonetworks-public.cloudpartnerservices.goog
michael@cloudshell:~ (certification-sbx)$ gcloud services enable compute.googleapis.com
Operation "operations/acf.p2-754295511751-38d43f80-5a60-4568-b4f1-20ea9137f91e" finished successfully.



Provisioning and setting up products in Google Cloud’s operations suite

Write exam here - pass it (was tough)

1.2 Managing billing configuration. Activities include:

Creating one or more billing accounts


Linking projects to a billing account


Establishing billing budgets and alerts


Setting up billing exports


1.3 Installing and configuring the command line interface (CLI), specifically the Cloud SDK

(e.g., setting the default project).

Section 2. Planning and configuring a cloud solution

2.1 Planning and estimating Google Cloud product use using the Pricing Calculator

website only

2.2 Planning and configuring compute resources. Considerations include:


Selecting appropriate compute choices for a given workload

(e.g., Compute Engine, Google Kubernetes Engine, Cloud Run, Cloud Functions)


Using preemptible VMs and custom machine types as appropriate

2.3 Planning and configuring data storage options. Considerations include:


Product choice

(e.g., Cloud SQL, BigQuery, Firestore, Cloud Spanner, Cloud Bigtable)


Choosing storage options

(e.g., Zonal persistent disk, Regional balanced persistent disk, Standard, Nearline, Coldline, Archive)


2.4 Planning and configuring network resources. Tasks include:


Differentiating load balancing options


Identifying resource locations in a network for availability

Configuring Cloud DNS


Section 3. Deploying and implementing a cloud solution

3.1 Deploying and implementing Compute Engine resources. Tasks include:

Launching a compute instance using Cloud Console and Cloud SDK (gcloud)

(e.g., assign disks, availability policy, SSH keys)


Creating an autoscaled managed instance group using an instance template


Generating/uploading a custom SSH key for instances


Installing and configuring the Cloud Monitoring and Logging Agent


Assessing compute quotas and requesting increases


3.2 Deploying and implementing Google Kubernetes Engine resources. Tasks include:


Installing and configuring the command line interface (CLI) for Kubernetes (kubectl)


Deploying a Google Kubernetes Engine cluster with different configurations including AutoPilot, regional clusters, private clusters.


Deploying a containerized application to Google Kubernetes Engine


Configuring Google Kubernetes Engine monitoring and logging


3.3 Deploying and implementing Cloud Run and Cloud Functions resources. Tasks include, where applicable:


Deploying an application and updating scaling configuration, versions, and traffic splitting


Deploying an application that receives Google Cloud events

(e.g., Pub/Sub events, Cloud Storage object change notification events)

3.4 Deploying and implementing data solutions. Tasks include:


Initializing data systems with products

(e.g., Cloud SQL, Firestore, BigQuery, Cloud Spanner, Pub/Sub, Cloud Bigtable, Dataproc, Dataflow, Cloud Storage)

Loading data

(e.g., command line upload, API transfer, import/export, load data from Cloud Storage, streaming data to Pub/Sub)

3.5 Deploying and implementing networking resources. Tasks include:


Creating a VPC with subnets (e.g., custom-mode VPC, shared VPC)


Launching a Compute Engine instance with custom network configuration

(e.g., internal-only IP address, Google private access, static external and private IP address, network tags)

Creating ingress and egress firewall rules for a VPC (e.g., IP subnets, network tags, service accounts)


Creating a VPN between a Google VPC and an external network using Cloud VPN


Creating a load balancer to distribute application network traffic to an application

(e.g., Global HTTP(S) load balancer, Global SSL Proxy load balancer, Global TCP Proxy load balancer, regional network load

balancer, regional internal load balancer)

3.6 Deploying a solution using Cloud Marketplace. Tasks include:


Browsing the Cloud Marketplace catalog and viewing solution details


Deploying a Cloud Marketplace solution


3.7 Implementing resources via infrastructure as code. Tasks include:


Building infrastructure via Cloud Foundation Toolkit templates and implementing best practices


Installing and configuring Config Connector in Google Kubernetes Engine to create, update, delete, and secure resources


Section 4. Ensuring successful operation of a cloud solution

4.1 Managing Compute Engine resources. Tasks include:


Managing a single VM instance

(e.g., start, stop, edit configuration, or delete an instance)

Remotely connecting to the instance


Attaching a GPU to a new instance and installing necessary dependencies


Viewing current running VM inventory (instance IDs, details)


Working with snapshots

(e.g., create a snapshot from a VM, view snapshots, delete a snapshot)

Working with images

(e.g., create an image from a VM or a snapshot, view images, delete an image)

Working with instance groups

(e.g., set autoscaling parameters, assign instance template, create an instance template, remove instance group)

Working with management interfaces

(e.g., Cloud Console, Cloud Shell, Cloud SDK)


4.2 Managing Google Kubernetes Engine resources. Tasks include:


Viewing current running cluster inventory (nodes, pods, services)


Browsing Docker images and viewing their details in the Artifact Registry

Working with node pools

(e.g., add, edit, or remove a node pool)

Working with pods

(e.g., add, edit, or remove pods)

Working with services

(e.g., add, edit, or remove a service)

Working with stateful applications

(e.g. persistent volumes, stateful sets)

Managing Horizontal and Vertical autoscaling configurations


Working with management interfaces

(e.g., Cloud Console, Cloud Shell, Cloud SDK, kubectl)


4.3 Managing Cloud Run resources. Tasks include:


Adjusting application traffic-splitting parameters


Setting scaling parameters for autoscaling instances


Determining whether to run Cloud Run (fully managed) or Cloud Run for Anthos


4.4 Managing storage and database solutions. Tasks include:


Managing and securing objects in and between Cloud Storage buckets


Setting object life cycle management policies for Cloud Storage buckets


Executing queries to retrieve data from data instances


(e.g., Cloud SQL, BigQuery, Cloud Spanner, Datastore, Cloud Bigtable)

Estimating costs of data storage resources


Backing up and restoring database instances


(e.g., Cloud SQL, Datastore)

Reviewing job status in Dataproc, Dataflow, or BigQuery


4.5 Managing networking resources. Tasks include:


Adding a subnet to an existing VPC


Expanding a subnet to have more IP addresses


Reserving static external or internal IP addresses


Working with CloudDNS, CloudNAT, Load Balancers and firewall rules


4.6 Monitoring and logging. Tasks include:


Creating Cloud Monitoring alerts based on resource metrics


Creating and ingesting Cloud Monitoring custom metrics


(e.g., from applications or logs)

Configuring log sinks to export logs to external systems


(e.g., on-premises or BigQuery)

Configuring log routers


Viewing and filtering logs in Cloud Logging


Viewing specific log message details in Cloud Logging


Using cloud diagnostics to research an application issue


(e.g., viewing Cloud Trace data, using Cloud Debug to view an application point-in-time)

Viewing Google Cloud status


Section 5. Configuring access and security

5.1 Managing Identity and Access Management (IAM). Tasks include:

Viewing IAM policies


Creating IAM policies


Managing the various role types and defining custom IAM roles

(e.g., primitive, predefined and custom)


5.2 Managing service accounts. Tasks include:


Creating service accounts


Using service accounts in IAM policies with minimum permissions


Assigning service accounts to resources


Managing IAM of a service account 


Managing service account impersonation


Creating and managing short-lived service account credentials


5.3 Viewing audit logs




Links

https://digitalmaturitybenchmark.withgoogle.com/cloud/

  • No labels