Decision Tables

Every "which X do I pick?" in one place. These matrices ARE the exam.

Compute & containers

?DECISIONWhich compute?

Full OS control, custom kernels, lift-and-shift→Compute Engine

Kubernetes API, multi-service orchestration→GKE (Autopilot unless you need node control)

Stateless containers, scale-to-zero→Cloud Run

Event-driven single function→Cloud Run functions

Batch, fault-tolerant, cheap→Spot VMs on GCE / GKE

Pick this when: containers without cluster ops → Cloud Run; full k8s control → GKE; OS-level control / lift-and-shift → Compute Engine; single-purpose event handler → Cloud Run functions

?DECISIONWhich disk?

Sensible default (boot, general)→Balanced Persistent Disk

High sustained IOPS, tunable→Hyperdisk / SSD PD

Survive single-zone failure→Regional PD (2-zone, ~2x cost)

Ultra-fast ephemeral scratch→Local SSD (375 GB units, data lost on stop)

Cheap, throughput-oriented→Standard PD

Pick this when: default → balanced PD; high IOPS/DB → SSD PD or Hyperdisk; survive a zone outage → regional PD; scratch/cache only → local SSD; archival → standard PD

?DECISIONGKE Autopilot or Standard?

Hands-off, per-pod billing, less ops→Autopilot

Custom node config, privileged pods, node SSH→Standard

Most new workloads→Autopilot (default recommendation)

Pick this when: want Google to run nodes and pay per-pod → Autopilot; need node-level control (custom machine types, DaemonSets, GPUs, SSH) → Standard

?DECISIONSnapshot or image?

Incremental disk backup, scheduled→Snapshot

Golden boot disk for new instances / MIG template→Image (custom image)

Pick this when: back up / restore a disk's data → snapshot; template a boot disk to launch many VMs → image

Storage & data

?DECISIONWhich storage class?

Hot / frequent→Standardno min duration

< 1× / month→Nearline30-day min

< 1× / quarter→Coldline90-day min

< 1× / year→Archive365-day min

All classes: same ms-latency access; you pay retrieval + early-deletion fees on the cold tiers.

Pick this when: access < once/year → Archive; < once/quarter → Coldline; < once/month → Nearline; otherwise Standard

?DECISIONWhich database?

Existing app's RDBMS→Cloud SQLRelational (MySQL/PG/SQLSvr) · vertical, read replicas

Global consistent transactions→SpannerRelational · horizontal, global, 99.999%

Demanding PostgreSQL→AlloyDBRelational (PG) · vertical+, HTAP

Mobile/web app data→FirestoreDocument · auto scale

Time-series, IoT, >1 TB, high write→BigtableWide-column · horizontal (nodes)

Analytics, billing export→BigQueryColumnar SQL warehouse · serverless

Pick this when: relational + regional → Cloud SQL; relational + global/horizontal → Spanner; Postgres-compatible + demanding → AlloyDB; mobile/web docs → Firestore; huge key-wide-column throughput → Bigtable; analytics/SQL-on-everything → BigQuery

?DECISIONWhich encryption keys?

Google handles everything (default)→Google-managed

You manage keys in Cloud KMS (rotation, disable, audit)→CMEK

You supply raw keys, Google never stores them→CSEK

Pick this when: do nothing → Google-managed; need control/rotation/audit in Cloud KMS → CMEK; must hold keys yourself off-platform → CSEK

?DECISIONMessaging / in-memory?

Async fan-out, event ingestion→Pub/Sub

Streaming + batch data pipelines→Dataflow

Sub-ms cache, sessions (Redis/Memcached)→Memorystore

Kafka compatibility, managed→Managed Service for Apache Kafka

Pick this when: decouple services async → Pub/Sub; stream/ETL processing → Dataflow; cache or session store → Memorystore

?DECISIONWhich data-movement tool?

Ad-hoc files from a machine→gcloud storage cp / rsync

Big or scheduled from S3/other cloud/on-prem→Storage Transfer Service

Petabyte-scale, poor bandwidth→Transfer Appliance (ship it)

Pick this when: a few files → gcloud storage cp; large/recurring cloud-to-GCS → Storage Transfer Service; petabytes offline → Transfer Appliance

Networking

?DECISIONWhich load balancer?

HTTP(S), global external→Global external Application LBGlobal · external

HTTP(S), regional internal→Internal Application LBRegional · internal

TCP/SSL proxy, global external→External proxy Network LBGlobal · external

TCP/UDP passthrough, regional external→External passthrough Network LBRegional · external

TCP/UDP, regional internal→Internal passthrough Network LBRegional · internal

Pick this when: HTTP(S) + global → Global external Application LB; TCP/SSL non-HTTP + global → external proxy Network LB; regional pass-through (preserve client IP / UDP) → passthrough Network LB; internal traffic → the internal variants of the same

?DECISIONWhich hybrid connectivity?

Option	Bandwidth	Path
Cloud VPN (HA)	~1.5-3 Gbps/tunnel	Encrypted over internet
Partner Interconnect	50 Mbps - 50 Gbps	Provider's network
Dedicated Interconnect	10 / 100 Gbps	Private fiber
Direct / Carrier Peering	n/a	Google edge (not for VPC)

Pick this when: cheap/fast to set up, over internet → Cloud VPN (HA); dedicated SLA bandwidth ≥ 10 Gbps → Dedicated Interconnect; lower bandwidth via provider → Partner Interconnect; only need Google APIs → Private Google Access

?DECISIONShared VPC or VPC Peering?

Central net team, service projects attach→Shared VPC

Connect 2 VPCs, each self-managed (non-transitive)→VPC Peering

Auto subnets everywhere, quick start→Auto-mode VPC (not for prod)

Controlled CIDRs per region→Custom-mode VPC

Pick this when: one team owns central network for many projects → Shared VPC; two independently-owned VPCs need private connectivity → Peering

?DECISIONFirewall target: tag or service account?

Rule should follow a workload identity→Target service account

Ad-hoc grouping, anyone can set the tag→Network tag

Pick this when: stable identity, least privilege → service account; quick/flexible grouping → network tag

?DECISIONPremium or Standard network tier?

Performance, global reach (default)→Premium

Lowest egress cost, regional traffic→Standard

Pick this when: global users, lowest latency, Google backbone → Premium; regional, cost-sensitive → Standard

Operations & cost

?DECISIONWhich diagnostic tool?

"Where is the request spending time?"→Cloud Trace

"What's burning CPU/memory?"→Cloud Profiler

"What's throwing exceptions?"→Error Reporting

"Which query is slow?"→Query Insights / index advisor

Pick this when: latency across services → Trace; CPU/memory hot spots → Profiler; exceptions → Error Reporting; slow SQL → Query Insights

?DECISIONWhich IaC tool?

General GCP + multi-cloud provisioning→Terraform

Manage GCP resources from within Kubernetes→Config Connector

Template/package Kubernetes apps→Helm

Pick this when: multi-cloud / standard → Terraform; manage GCP via k8s CRDs → Config Connector; package k8s apps → Helm

?DECISIONWhich cost lever?

Committed steady load, 1 or 3 yr→Committed Use Discounts

Running >25% of month, automatic→Sustained Use Discounts

Fault-tolerant batch, 60-91% off→Spot VMs

Right-size / idle recommendations→Active Assist / Recommender

Pick this when: predictable steady usage → CUD; already-on always-running → SUD (automatic); interruptible batch → Spot; find waste → Active Assist

?DECISIONWhere should logs go?

Cloud Logging bucket→Default store, retention control

BigQuery→Query logs with SQL

Cloud Storage→Cheap long-term archive

Pub/Sub→Stream to external/SIEM

Pick this when: long retention/compliance → log bucket; SQL analytics → BigQuery; cheap archive → GCS; stream to other systems → Pub/Sub