Domain 5: Managing Implementation (~12.5%)

Domain 5 accounts for approximately 12.5% of the Professional Cloud Architect exam, translating to roughly 6-7 questions. This domain tests your ability to advise development and operations teams on deploying applications, migrating workloads, and interacting with Google Cloud programmatically. Expect scenario-based questions that ask you to choose the correct deployment strategy, migration tool, API management platform, or IaC approach for a given business requirement.

5.1 Advising DevOps Teams for Successful Deployment

Application Deployment Pathways

Google Cloud offers multiple compute platforms, each with distinct deployment models. The exam tests your ability to match the right platform and deployment method to a scenario.

Cloud Build serves as the CI/CD backbone, building containers from source, running tests, and pushing to Artifact Registry. It integrates with Cloud Deploy for managed continuous delivery pipelines that promote releases through dev, staging, and production targets.

Deployment Strategies by Platform

The exam frequently tests which deployment strategies are available on which platforms and when to use each.

Exam trap: Cloud Deploy supports standard and canary deployment strategies natively. For the first deployment to a target using canary, Cloud Deploy skips the canary phase and deploys directly to stable -- subsequent deployments use canary as configured. Blue-green is achieved through custom target configurations, not a built-in Cloud Deploy strategy type.

Exam trap: App Engine traffic splitting supports three methods: IP address, cookie, and random. IP-based splitting is the default but can cause uneven distribution behind NATs. Cookie-based splitting (GOOGAPPUID) provides more precise user-level routing.

Migration Tools

Choosing the correct migration tool for a scenario is a high-frequency exam topic. Each tool addresses a specific migration use case.

Exam trap: Transfer Appliance is for ingestion into Google Cloud only -- it does not support exporting data out of GCP. For large-scale egress, use gsutil or Storage Transfer Service.

Exam trap: DMS supports Cloud SQL (MySQL, PostgreSQL, SQL Server) and AlloyDB for PostgreSQL as destinations. It does not migrate to Spanner or Firestore -- those require custom ETL pipelines or Dataflow.

API Management

The exam tests your ability to choose among three API management products based on requirements.

Decision framework for the exam:

• Need monetization, developer portal, or advanced analytics? Apigee.
• Running microservices on GKE/Compute Engine and need lightweight API management? Cloud Endpoints.
• Serverless backend (Cloud Functions, Cloud Run) and need simple gateway routing? API Gateway.

Exam trap: Apigee Hybrid runs the runtime plane on customer-managed Kubernetes while the management plane stays in Google Cloud. This is the correct answer when the scenario requires data residency control or on-premises API processing.

Testing Strategies

5.2 Interacting with Google Cloud Programmatically

Cloud Shell

Cloud Shell provides a browser-based terminal pre-authenticated to your Google Cloud account.

Exam trap: Cloud Shell is ephemeral -- the VM is recycled after inactivity. Only $HOME persists. Tools installed outside $HOME (e.g., via apt install) are lost on VM reset. If a scenario asks about persistent custom tooling, Cloud Shell is not the answer.

gcloud CLI

The gcloud CLI is the primary command-line tool for managing Google Cloud resources.

Key commands to know:

# Configuration management
gcloud config set project PROJECT_ID
gcloud config set compute/region us-central1
gcloud config set compute/zone us-central1-a
gcloud config configurations create my-config    # Named configurations
gcloud config configurations activate my-config

# Authentication
gcloud auth login                        # User account (interactive)
gcloud auth activate-service-account     # Service account (key file)
gcloud auth application-default login    # ADC for client libraries
gcloud auth print-access-token           # Get current access token

# Common resource management
gcloud compute instances create/list/delete/describe
gcloud container clusters create/get-credentials
gcloud run deploy/services list
gcloud app deploy/browse
gcloud builds submit --tag gcr.io/PROJECT/IMAGE

Exam trap: gcloud auth login authenticates the gcloud CLI itself. gcloud auth application-default login sets up Application Default Credentials (ADC) used by client libraries and Terraform. These are different credential stores. A scenario that says "Terraform can't authenticate" likely needs gcloud auth application-default login, not gcloud auth login.

gsutil

gsutil handles Cloud Storage operations. Key commands:

Exam trap: gsutil rsync with -d (delete) flag removes destination objects not in source. Without -d, it only adds/updates. The exam may test whether a sync operation deletes extra files.

bq Command-Line Tool

bq is the BigQuery CLI:

Cloud Code

Cloud Code is an IDE extension for developing cloud-native applications.

• Supported IDEs: VS Code, IntelliJ/JetBrains, Cloud Shell Editor
• Target platforms: GKE, Cloud Run, Cloud Functions, App Engine
• Key features: Starter templates, continuous build/deploy with Skaffold, Kubernetes YAML authoring with validation, live debugging on GKE clusters, log streaming, Secret Manager integration
• Local development: Runs applications locally in containers using Skaffold; supports file watching and hot reload

Emulators for Local Development

Google Cloud provides local emulators to develop and test without incurring cloud costs or network latency.

After starting an emulator, set the EMULATOR_HOST environment variable so client libraries route requests locally: $(gcloud beta emulators pubsub env-init).

Exam trap: Not all services have emulators. Cloud SQL, BigQuery, Cloud Storage, and Cloud Functions do not have official emulators. If a scenario asks about local testing for these, the answer involves test instances, sandbox projects, or third-party mocks -- not emulators.

Infrastructure as Code: Terraform

Terraform is Google Cloud's recommended IaC tool. The exam tests conceptual understanding, not HCL syntax.

Core Terraform concepts:

State management best practices:

• Store state remotely in a GCS bucket with versioning enabled
• Use state locking (GCS backend supports this natively)
• Never edit state files manually; use terraform state commands
• Separate state per environment using workspaces or directory structure

Infrastructure Manager (Infra Manager): A Google-managed service that automates Terraform deployments on Google Cloud. It handles execution, state management, and drift detection without requiring you to maintain Terraform CLI infrastructure. Use Infra Manager when the scenario calls for managed Terraform execution without maintaining a separate CI/CD pipeline for IaC.

Exam trap: Terraform state contains sensitive data (passwords, keys, connection strings) in plaintext. The exam may test whether state should be stored in a public bucket (answer: never) or whether CMEK encryption is appropriate for state buckets (answer: yes, for sensitive workloads).

Google API Client Libraries

Google provides idiomatic client libraries for programmatic access to all Google Cloud services.

Authentication pattern: Client libraries use Application Default Credentials (ADC) by default. ADC checks in order: (1) GOOGLE_APPLICATION_CREDENTIALS environment variable, (2) user credentials from gcloud auth application-default login, (3) attached service account (on GCE, GKE, Cloud Run, etc.), (4) Workload Identity Federation for external environments.

Exam trap: On GKE, the recommended authentication method is Workload Identity, which maps Kubernetes service accounts to Google Cloud service accounts. Using node-level service accounts or exported JSON keys are legacy patterns the exam considers incorrect for GKE scenarios.

Exam Strategy for Domain 5

1. Migration tool selection is the highest-value topic. Memorize which tool handles which source/destination and whether it supports continuous replication or one-time transfer.
2. API management questions hinge on whether the scenario needs monetization/developer portal (Apigee), lightweight proxy for microservices (Endpoints), or serverless gateway (API Gateway).
3. Deployment strategy questions test whether you understand canary vs. blue-green vs. rolling and which platforms support which.
4. IaC questions focus on Terraform concepts (state, modules, providers) and when to use Infrastructure Manager vs. self-managed Terraform.
5. CLI questions test whether you know gcloud auth login vs. gcloud auth application-default login and the purpose of named configurations.

References

• Google Cloud SDK Documentation
• Apigee Overview
• Cloud Endpoints with OpenAPI
• Cloud Deploy Deployment Strategies
• Database Migration Service Overview
• Cloud Code Documentation
• Terraform on Google Cloud
• Infrastructure Manager Overview
• Managing Infrastructure as Code with Terraform
• Migrate to Virtual Machines
• Storage Transfer Service
• Transfer Appliance
• Application Default Credentials