Project ID (immutable, globally unique), project name (mutable display label), and project number (auto-assigned, used internally by some Google APIs). Only the Project ID cannot be changed after creation.

A domain-linked organization requires Cloud Identity or Google Workspace tied to a verified DNS domain. A standalone organization is created automatically from a Google account with no Cloud Identity, no domain verification, and it supports federated identities as owners and can be deleted and later restored.

It evaluates the policy against real activity and logs what it would have blocked, without actually blocking anything. It never enforces or restricts access; it's purely observational, used to validate a policy's blast radius before enforcement.

Labels are free-form key-value metadata for billing and inventory. Network tags are unstructured strings used only to target Compute Engine firewall rules and routes. Resource Manager tags are IAM-governed key-value pairs that can gate IAM Conditions and org-policy targeting.

Cloud Identity is the directory layer managing users and groups; IAM is the separate system controlling what those users and groups can do. Cloud Identity answers "who exists," IAM answers "what can they do."

Workforce Identity Federation authenticates users through their own external IdP with no Cloud Identity account created at all, so there's no directory entry to manage or forget to deactivate. Temporary Cloud Identity accounts still require Meridian to own the full lifecycle, including guaranteed offboarding.

The Compute Engine API is likely not enabled on that project. API enablement is a separate gate from IAM permission; check with gcloud services list --enabled.

Don't disable the compliance policy. Instead, create a dedicated DR-testing project outside the EU-locked folder, with its own narrower, time-boxed IAM grants, so the org policy's inheritance never applies to it. Design the exception path in advance, not during an incident.

A one-time audit only catches what exists at that moment. Shadow projects and stray credentials can appear at any time; a recurring query catches new instances of the same risk pattern continuously, the way Meridian caught a personal project's leaked key through a dry-run policy rollout.

Moving a project between folders makes it inherit the new parent's org policies immediately, which is exactly what happened. The move should have gone through a dry-run check of the destination folder's policies against the project's real automation before the move, not been treated as a purely cosmetic reorganization.

No. A budget alert only sends a notification (email, or a Pub/Sub message); it never caps or blocks spending on its own. Actually stopping spend requires custom automation built on the budget's Pub/Sub trigger.

gcloud auth login authenticates the human for interactive CLI and console use. gcloud auth application-default login sets up Application Default Credentials, a separate credential store that client libraries and Terraform pick up automatically; running only the first is a common cause of DefaultCredentialsError in application code.

Terraform applies a change once and stops. Config Connector continuously reconciles GCP resources as Kubernetes Custom Resources, the same drift-correcting reconciliation loop a Deployment controller uses for Pods.

Fabric FAST is a staged, opinionated Terraform framework (part of the open-source cloud-foundation-fabric project) for bootstrapping an entire production-ready GCP organization from scratch, in defined stages with separate state per stage. Hand-written Terraform is more flexible but doesn't provide that staged, whole-organization bootstrap structure out of the box.

Consumer access to Gemini CLI was sunset in June 2026 in favor of Antigravity CLI, which shares the same agent harness as the Antigravity 2.0 platform. Organizations with a Gemini Code Assist Standard or Enterprise license retain Gemini CLI access via paid API keys.

No, it's the GCS backend's locking mechanism working correctly, preventing a concurrent write from corrupting state. The real fix is process: route production applies through a single serialized CI pipeline rather than allowing local applies at all.

Application Design Center, since it's built specifically for developer self-service against platform-authored templates through a visual designer, with no IaC authoring required. Terraform assumes the person applying it understands the underlying resource definitions, which this developer explicitly shouldn't need to.

Route every budget alert's audience check against current Cloud Identity group membership rather than an individual's address, and wire the Pub/Sub notification to automation that both alerts a monitored channel and validates the recipient list's freshness, so a stale distribution list doesn't quietly go unnoticed again.

A predefined role is Google-maintained and updates automatically as a service gains new permissions. A custom role is a static permission list you own and must maintain yourself. Prefer predefined roles first; use a custom role only for a documented least-privilege gap.

A principal's effective permissions at any resource are the union of every role bound to them at that resource and at every ancestor above it. There's no lower-level override for a plain allow policy the way some org-policy constraints allow.

Workforce Identity Federation authenticates humans for console SSO access. Workload Identity Federation authenticates workloads (a CI pipeline, an application, a Kubernetes Pod) for programmatic API calls. One is for people signing in; the other is for code calling APIs.

Because a service account key is a long-lived credential valid indefinitely from anywhere until manually revoked, making it a significant, avoidable security liability compared to short-lived, audit-friendly alternatives like impersonation or Workload Identity Federation.

roles/iam.serviceAccountTokenCreator, granted on the target service account to the calling principal.

roles/editor covers thousands of permissions across nearly every GCP service, far beyond what any single feature needs, and can carry IAM-modification ability in some contexts. The correct response is identifying the specific predefined roles the feature actually needs and granting only those.

Workload Identity Federation, using the impersonation-based access pattern (rather than direct access), so the federated GitHub identity impersonates one well-known target service account regardless of which repository triggered the pipeline.

A recurring Cloud Asset Inventory query that reconstructs the full impersonation graph across every service account, flagging any chain longer than one hop, since individual bindings can each look reasonable in isolation while their transitive composition creates real, invisible risk.

An older project's default Compute Engine service account still carried a broad legacy role that predated Google's current, more restrictive default. The fix is creating a purpose-scoped, user-managed service account for every workload, rather than relying on the default service account, and auditing any project still doing so.

No. Persistent Disk is no longer available on the newest machine series, and Google's current guidance points to Hyperdisk for new deployments; Persistent Disk remains supported on existing machine series and workloads.

Hyperdisk Balanced (general-purpose, most workloads), Hyperdisk Extreme (highest IOPS, performance-critical databases), Hyperdisk Throughput (sequential, bandwidth-heavy workloads), and Hyperdisk ML (fast large-dataset loading for ML training, throughput-provisioned only).

It ties SSH access to a user's Google identity and IAM role, so granting or revoking access across an entire project is one IAM binding change instead of a per-instance metadata edit repeated (and easy to forget) across every VM.

No. Template edits only apply to instances created afterward; an explicit rolling update must be triggered to propagate the change to existing instances.

Fault-tolerant, checkpointed, or easily restartable workloads (batch processing, CI build workers) fit well. A workload that can't tolerate an abrupt, short-notice (roughly 30-second) termination does not fit.

A recurring, scheduled test restore verified against known data, on some regular cadence, rather than relying solely on the snapshot job's own success status, which only confirms something was written, not that it's the data actually needed.

No. Without checkpointing, a mid-run reclaim forces a full restart, risking the deadline. Spot fits workloads that are either short enough for a restart to be cheap or checkpointed so a reclaim only costs time since the last checkpoint; this job satisfies neither.

Not necessarily, and often not. It's frequently a regional/zonal availability problem, the specific GPU model simply isn't offered in that zone, which no quota increase fixes. Check the accelerator regional availability table first.

Choose based on framework support and workload shape, not a default preference: GPUs offer the broadest framework compatibility; TPUs outperform specifically on the matrix-multiplication-heavy patterns (like large transformer training) they're purpose-built for.

Autopilot bills per Pod resource request (vCPU-hour, GiB-hour), only while Pods run. Standard bills per provisioned node VM, continuously, regardless of actual Pod utilization.

No. Every Autopilot Pod must declare resource requests; Autopilot injects defaults or adjusts non-compliant Pods at admission. On Standard, requests are technically optional (though never advisable).

The Agent Runtime is a managed, serverless execution environment specifically for AI agents, providing built-in session state and tool-calling primitives. Cloud Run runs a general-purpose container and provides neither primitive natively; you'd have to build them yourself on top of a database and orchestration code.

Because Cloud Run never deletes a superseded revision on promotion; it scales to zero and stays available. A rollback is a traffic-routing change to a still-running revision, not a rebuild-and-redeploy.

Vertex AI Agent Builder became the Gemini Enterprise Agent Platform (April 2026), and what was Agent Engine is now referred to internally as Deployments; the ACE exam guide itself still uses the term Agent Runtime for the same managed execution layer.

The workload, despite being bursty in request volume, ran at consistently high CPU utilization whenever active, exactly the profile where Standard's flat per-VM pricing beats Autopilot's per-resource-request premium. The mistake was applying a general heuristic without checking this specific workload's actual utilization pattern.

The workstation's container image had drifted from the CI pipeline's base image, an older library version baked in locally that CI never used. The fix is building the workstation configuration's image from the same base image tag CI uses, checked on a recurring schedule for drift.

The Agent Runtime, since multi-turn session state and tool-calling are exactly what it provides as managed primitives, which a plain Cloud Run service would require the team to build themselves.

Without Workload Identity Federation enabled at creation, Pods likely fall back to the node's own (often overly broad) default service account instead of each workload having its own tightly scoped identity, reintroducing exactly the excess-permission risk Workload Identity Federation for GKE is designed to close.

Filestore is general-purpose managed NFS. NetApp Volumes adds SMB and multi-protocol support for enterprises standardized on NetApp's ONTAP. Managed Lustre is purpose-built for extreme-throughput AI training and HPC workloads, a genuinely different performance tier from the other two.

Move to AlloyDB when a PostgreSQL workload's performance genuinely exceeds Cloud SQL's ceiling. Move to Spanner specifically for global distribution with strong consistency, not just general scale growth, since its operational and cost profile only pays off at that particular requirement.

When genuine Kafka API compatibility is required, an existing Kafka-based application, Kafka Connect integrations, or client libraries assuming Kafka semantics. For new systems without that requirement, Pub/Sub's simpler operational model is the default.

The data it encrypts becomes permanently unreadable. This isn't a soft lock or a warning state; it's the mechanism working exactly as designed, which is why every resource referencing a key (including replicas) must be accounted for before disabling any version.

An AI-assisted dashboard giving one aggregated, fleet-wide view across database products (Cloud SQL, Spanner, Bigtable, AlloyDB, and more) across every project in scope. It's most valuable once an organization's databases are spread across enough projects that no single console view shows the whole picture.

Cloud SQL's fixed connection limit being exhausted by the sheer number of autoscaled instances each opening their own connection pool, not a compute resource limit. The fix is a connection pooler between the autoscaling compute layer and the database.

The replica referenced the specific old key version directly rather than a key alias that would have tracked the rotation. The runbook should enumerate every resource referencing a key, including every replica, before disabling any old version.

Managed Lustre, since it's specifically built for the extreme-throughput, sub-millisecond-latency checkpoint access pattern distributed AI training needs. Filestore is general-purpose NFS and doesn't target that throughput ceiling.

BigQuery is a serverless analytical warehouse optimized for ad hoc SQL over large datasets, not for low-latency transactional reads/writes an application backend needs. Cloud SQL, AlloyDB, Spanner, or Firestore fit the transactional role instead.

Classic rules support network tags and service accounts as source filters. NGFW policies support only Secure Tags for source filtering (service accounts can be targets, not source filters); plain network tags aren't supported by policies at all.

Centrally managed, IAM-governed key-value tags usable in firewall targeting. A Secure-Tag-based rule keeps matching correctly as IP ranges change (a resize, a migration, a new subnet), since it matches an identity attribute instead of an address.

No. If VPC A peers with B, and B peers with C, A cannot reach C through B. Each peering relationship is a direct, standalone connection.

The global external Application Load Balancer supports Premium Tier only, while the regional external Application Load Balancer supports both Premium and Standard Tier. Choosing "global" implicitly commits to Premium Tier pricing.

Cloud VPN is an encrypted tunnel over the public internet, quick to set up, suited to modest bandwidth or backup paths. Cloud Interconnect is a private physical or carrier-mediated connection, higher bandwidth and more consistent latency, but with a much longer provisioning lead time.

No. Policies don't support plain network tags at all. Every targeted resource needs an equivalent Secure Tag applied first, and the new policy rules must reference those Secure Tags instead.

The subnet's available IP range was exhausted, so new nodes couldn't be allocated an address. A standing Cloud Monitoring alert on subnet IP utilization (e.g., at 80%) would surface this days or weeks before it becomes a hard ceiling during an actual load event.

No. The global load balancer uses a single global anycast IP, routing each user to the nearest healthy backend across regions over Google's backbone. The regional load balancer, even on Premium Tier, is tied to one region's backends; distant users still incur the latency of reaching that one region.

To validate, using real VPC Flow Log traffic, that the new Secure-Tag-based rules actually matched the same traffic the old rules had been matching, before removing the old mechanism. Verifying the new mechanism's coverage before removing the old one avoided any unplanned denial during the migration.

Admin Activity audit logs are always on and cannot be disabled, capturing configuration changes. Data Access audit logs (capturing reads/writes to data itself) are off by default for most services, since they generate substantially more volume, and must be explicitly enabled.

No, not even by an organization administrator. It's a fixed, guaranteed minimum audit trail, unlike the _Default bucket or custom sinks, which do have configurable retention.

Cloud Trace narrows a slow multi-hop request down to which service is slow; Cloud Profiler narrows a slow service down to which function is the bottleneck; Query Insights (with the index advisor) narrows a slow database call down to which query and what's missing. They're typically used in that sequence, each output deciding the next tool.

A feed filtered specifically to incidents and maintenance relevant to your own projects, with the same alerting channel integration as Cloud Monitoring (email, SMS, PagerDuty, Slack, Pub/Sub, webhook) and a dedicated API, rather than a generic list of every incident across every GCP customer.

Gemini Cloud Assist answers questions you actively ask, using real resource data. Active Assist proactively surfaces recommendations (organized by value pillar: cost, security, performance, reliability, manageability, sustainability) based on usage patterns, without you having to ask.

The root cause is alert fatigue from a threshold never tuned against real historical data, teaching the on-call rotation to reflexively dismiss the alert. The fix is tuning every alerting policy against at least two weeks of historical metric data before it goes live, and retiring or retuning any policy that fires often without corresponding real incidents.

Process, not tooling. The diagnostic data was correct and visible the entire time; nobody had a standing habit of proactively reviewing Query Insights' top-flagged queries, since a slow, gradual regression never crossed any single alerting threshold in one day.

Personalized Service Health should be checked at the very start of any investigation. It can be automated by wiring its alerting into the same incident channel as internal Cloud Monitoring alerts, so a Google-side incident surfaces as just another entry in the existing alert feed.

Only if Data Access audit logging was enabled for Cloud Storage at the time in question. Since it's off by default for most services, the answer may simply be unavailable if it was never turned on, and it can't be enabled retroactively to reconstruct past access.