Manage implementation Study Guide — Professional Cloud Architect

Manage Implementation

This domain tests your ability to advise development teams on GCP best practices and oversee the end-to-end delivery of cloud solutions. It covers the tools, APIs, migration strategies, and developer workflows that architects must understand to guide teams effectively. At 11% of the exam, expect approximately 8–10 questions spanning API management, SDK usage, migration patterns, data transfer services, Anthos, and developer tooling.

Cloud APIs

Core Concepts

Every GCP service is backed by a Cloud API (also called a Google API). Before any service can be used, its API must be enabled on the project. APIs are enabled per-project and are managed through the API & Services console or via gcloud services enable.

Key enabling commands:

gcloud services enable compute.googleapis.com
gcloud services list --enabled
gcloud services disable compute.googleapis.com

Quotas

Quotas limit the rate or volume of API calls to prevent abuse and ensure fair usage. There are two quota types:

• Quota increases are requested via IAM & Admin > Quotas in the console.
• Some quotas reset daily; others are permanent allocation limits.
• Exceeding a quota returns HTTP 429 (RESOURCE_EXHAUSTED).

Client Libraries vs REST vs gRPC

• Client libraries handle retries, authentication, and serialization automatically — recommended for production application code.
• gRPC offers binary serialization (Protocol Buffers), bidirectional streaming, and lower latency than REST. Used internally by most GCP services.
• REST is human-readable and easier to debug with tools like curl; best for quick prototyping or when a client library isn't available.

Common Traps

• The exam may imply you must manually grant API access to service accounts — enabling the API is separate from granting IAM permissions.
• Disabling an API does not delete underlying data or resources, but will break any application calling it.
• gRPC is not universally available for all GCP APIs; some APIs only expose REST surfaces.
• Client libraries use Application Default Credentials (ADC), not hard-coded API keys (API keys are for server-to-server calls to specific APIs like Maps).

SDK and CLI Tools

Overview

GCP's command-line tooling consists of three primary tools:

Note for exam 2024: gsutil is being superseded by gcloud storage commands. Know both, but prefer gcloud storage for new scenarios.

gcloud Key Patterns

• Configuration: gcloud config set project PROJECT_ID — sets the active project.
• Auth: gcloud auth application-default login — sets ADC for local development.
• Impersonation: gcloud --impersonate-service-account=SA@PROJECT.iam.gserviceaccount.com
• Filtering: gcloud compute instances list --filter="zone:us-central1-a"
• Formats: --format=json, --format=yaml, --format=csv

gsutil vs gcloud storage

bq Key Patterns

bq query --use_legacy_sql=false 'SELECT * FROM dataset.table'
bq load --source_format=CSV dataset.table gs://bucket/file.csv schema.json
bq mk --dataset PROJECT:dataset_name
bq show --format=prettyjson dataset.table

Common Traps

• gsutil uses gs:// URIs; bq uses PROJECT:DATASET.TABLE notation — mixing these up is a classic distractor.
• gcloud requires --project flag or a configured default; forgetting this causes permission errors.
• bq jobs run asynchronously by default; use --sync for synchronous execution.
• gcloud auth login authenticates a user; gcloud auth application-default login sets ADC for code. These are different credentials.