Complete Microsoft Azure (AZ-900 / AZ-104), Google Cloud (GCP) & HashiCorp Terraform Certification Study Guide

Comprehensive Active-Recall Curriculum: Multi-cloud architecture and certification prep covering Microsoft Azure Fundamentals & Administrator (AZ-900, AZ-104), Google Cloud Associate Cloud Engineer & Professional Architect (GCP), HashiCorp Terraform Infrastructure as Code (IaC), and AWS vs Azure vs GCP service comparisons. Practice 6 progressive flashcard decks (192 cards total) spanning foundational principles (basic), intermediate problem-solving (intermediate), and advanced exam mastery (advanced).

👉 Explore All Microsoft Azure (AZ-900 / AZ-104), Google Cloud (GCP ACE) & Terraform IaC Flashcard Decks on Flashcards.World →

---

Why Active Recall & Spaced Repetition Work for This Exam

Mastering Microsoft Azure (AZ-900 / AZ-104), Google Cloud (GCP ACE) & Terraform IaC requires retrieving precise definitions, formulas, diagnostic rules, and edge-case distinctions under timed pressure. Passive re-reading creates an illusion of competence; active recall (testing yourself before viewing the answer) and spaced repetition strengthen long-term synaptic retrieval pathways.

Study Phase	Decks Covered	Target Mastery Level	Daily Active-Recall Protocol
Phase 1: Foundations (Weeks 1–2)	Decks 1 & 2 (Basic)	90%+ Instant Recall	32 new cards/day + full review of missed concepts
Phase 2: Application (Weeks 3–5)	Decks 3 & 4 (Intermediate)	Multi-step synthesis	32 new cards/day + interleaved Phase 1 review
Phase 3: Exam Mastery (Weeks 6–8)	Decks 5 & 6 (Advanced)	Timed exam readiness	Full 192-card spaced-repetition rotation + weak-spot drills

---

Deck 1: Azure Core Identity (Entra ID, RBAC, Conditional Access & Governance) (32 Cards — Basic)

What this deck covers: Foundational Microsoft Azure governance and identity mastery for AZ-900 and AZ-104 covering Microsoft Entra ID tenants, RBAC role definitions and scope hierarchy, Conditional Access, Privileged Identity Management (PIM), Azure Policy, Resource Locks, Blueprints, Tags, and the Shared Responsibility Model.

High-Yield Prompt / Question	Core Concept & Mechanism	Exam Application & Details
What is the four-level scope hierarchy in Azure for resource organization and governance, from broadest to narrowest?	Management Groups (up to 6 levels deep, excluding the Root Management Group) -> Subscriptions -> Resource Groups -> Resources.	RBAC role assignments, Azure Policies, and Locks applied at a higher scope are automatically inherited by all child scopes beneath them.
What is the relationship between an Azure Subscription and a Microsoft Entra ID (formerly Azure AD) tenant?	A many-to-one trust relationship: multiple Azure Subscriptions can trust the same single Microsoft Entra ID tenant for authentication and id	A many-to-one trust relationship: multiple Azure Subscriptions can trust the same single Microsoft Entra ID tenant for authentication and identity management, whereas each Azure Subscription can trust only one Entra ID directory at any given time.
Under the Cloud Shared Responsibility Model, which security responsibilities ALWAYS remain with the customer across IaaS, PaaS, and SaaS?	Information and data security, endpoint device protection (mobile/PCs), and account/identity and access management.	The cloud provider is always responsible for physical datacenter security, physical hosts, and physical networks.
How does responsibility for Operating System patching and Network Controls differ between IaaS, PaaS, and SaaS in Azure?	IaaS (e.g., Azure VMs): Customer manages OS patching, middleware, and network configs. PaaS (e.g., App Service, Azure SQL): Cloud provider patches the OS	responsibility for network controls and application configuration is shared. SaaS (e.g., Microsoft 365): Cloud provider manages the OS, network, and application software.
What are the four fundamental built-in Azure RBAC roles and how do their permissions differ?	Owner: Full access to all resources, including the right to delegate access (assign RBAC roles) to others.	Contributor: Can create and manage all types of Azure resources, but cannot grant access to others. Reader: View-only access to existing resources. User Access Administrator: Can manage user access (role assignments) to Azure resources without modifying the resources themselves.
What are the three components required to create an Azure RBAC role assignment?	1. Security Principal (Who: User, Group, Service Principal, or Managed Identity)	2. Role Definition (What: collection of allowed and denied Actions, NotActions, DataActions, and NotDataActions); 3. Scope (Where: Management Group, Subscription, Resource Group, or individual Resource).
How does Azure RBAC evaluate permissions when a user is subject to both role assignments and Azure Blueprint/Managed Application Deny Assignments?	Azure RBAC is an additive model (effective permissions are the union of all assigned roles), with one exception: Deny Assignments.	Deny Assignments take precedence over all RBAC role assignments (even Owner) and explicitly block specified actions at that scope.
What is the difference between Actions/NotActions and DataActions/NotDataActions in an Azure custom RBAC role definition?	Actions and NotActions govern Control Plane operations sent to the Azure Resource Manager (ARM) endpoint (e.g., creating or deleting a storage account).	DataActions and NotDataActions govern Data Plane operations inside the resource itself (e.g., reading blobs inside a container or querying a Key Vault secret).
How do Microsoft Entra ID Roles differ from Azure RBAC Roles?	Microsoft Entra ID Roles (e.g., Global Administrator, User Administrator, Application Administrator) control access to directory resources such as users, groups, enterprise applications, and domains via Microsoft Graph.	Azure RBAC Roles (e.g., Owner, Contributor) control access to Azure infrastructure and PaaS resources via Azure Resource Manager (ARM).
What can a Global Administrator in Microsoft Entra ID do if they have lost access to all Azure Subscriptions in the tenant?	Enable the 'Access management for Azure resources' toggle in Microsoft Entra ID properties.	This temporarily grants the user the User Access Administrator RBAC role at the Root Scope (/), allowing them to view all subscriptions and assign themselves or others the Owner role.
Compare System-Assigned and User-Assigned Managed Identities in Azure.	System-Assigned: Enabled directly on an Azure resource	its lifecycle is tied 1:1 to that resource (automatically deleted when the resource is deleted) and cannot be shared. User-Assigned: Created as a standalone Azure resource; its lifecycle is independent and the same identity can be assigned to multiple Azure resources.
What is the difference between an Application Registration (Application Object) and a Service Principal (Enterprise Application) in Microsoft Entra ID?	An Application Object is the globally unique definition (template) of the app residing in its home tenant.	A Service Principal is the local instantiation of that app in a specific tenant, holding the actual permissions, role assignments, and sign-in policies within that directory.

👉 Practice Deck 1: Azure Core Identity (Entra ID, RBAC, Conditional Access & Governance) (32 Flashcards) →
🔍 Browse All Basic Microsoft Azure (AZ-900 / AZ-104), Google Cloud (GCP ACE) & Terraform IaC Sets →

---

Deck 2: Azure Compute, Networking (VNet, NSG, Application Gateway) & Storage (32 Cards — Basic)

What this deck covers: Essential Azure infrastructure services for AZ-900, AZ-104, and AZ-305 covering Virtual Machines, Availability Sets vs Availability Zones, VM Scale Sets, App Services, Azure Functions, AKS, Virtual Networks (VNet Peering, NSGs, ASGs, Firewall, Application Gateway, Load Balancer, ExpressRoute/VPN), and Storage Accounts.

High-Yield Prompt / Question	Core Concept & Mechanism	Exam Application & Details
Compare Azure Availability Sets and Availability Zones for Virtual Machine high availability and SLA.	Availability Set: Protects against hardware failures within a SINGLE datacenter using Fault Domains (up to 3, separate power/network racks) and Update Domains (up to 20, rebooted one at a time during maintenance)	provides a 99.95% SLA for 2+ VMs. Availability Zones: Physically separate datacenters within an Azure Region with independent power, cooling, and networking; provides a 99.99% SLA for 2+ VMs across zones.
What is the difference between the 'Stopped' and 'Stopped (Deallocated)' states of an Azure Virtual Machine?	'Stopped': Shut down from inside the Guest OS	the VM still reserves its physical compute hardware and dynamic IPs on the Azure host, so you CONTINUE paying for compute hours. 'Stopped (Deallocated)': Stopped via Azure Portal/CLI/API (az vm deallocate); compute hardware is released and you stop paying for compute (only p...
Compare Uniform and Flexible orchestration modes in Azure Virtual Machine Scale Sets (VMSS).	Uniform orchestration: Uses identical VM instances managed from a single template	optimized for large-scale stateless workloads, does not support Availability Set fault domain guarantees beyond standard scale set placement. Flexible orchestration: Allows mixing different VM SKUs, combining Spot and Pay-As-You-Go instances, adding standard standalone VMs int...
What are the five main Azure Managed Disk performance tiers and their primary use cases?	1. Standard HDD: Backup, non-critical, infrequent access	2. Standard SSD: Web servers, lightly used enterprise apps, dev/test; 3. Premium SSD: Production and performance-sensitive workloads (supports host caching); 4. Premium SSD v2: Sub-millisecond latency with decoupled capacity, IOPS, and throughput adjustment; 5. Ultra Disk: Hig...
Compare Azure Functions Consumption Plan, Flex Consumption / Premium Plan, and Dedicated (App Service) Plan.	Consumption Plan: Serverless pay-per-execution, scales to zero, experiences cold starts, max execution timeout of 10 minutes, limited VNet integration.	Premium Plan: Pre-warmed instances (no cold starts), VNet connectivity, unlimited execution duration (60+ min), higher cost. Dedicated (App Service) Plan: Runs on already-allocated App Service Plan VMs at no extra execution cost, supports Always On.
What are Deployment Slots in Azure App Service and how does a Slot Swap work without downtime?	Deployment Slots (available in Standard, Premium, and Isolated tiers) are live apps with their own hostnames and configurations.	During a swap (e.g., Staging to Production), Azure warms up the source slot, applies destination-specific 'Slot Settings' (connection strings/variables marked sticky to the slot), and seamlessly redirects the internal routing pointer from Staging to Production with zero droppe...
When should you choose Azure Container Instances (ACI) vs. Azure Container Apps (ACA) vs. Azure Kubernetes Service (AKS)?	ACI: Simplest, fastest way to run a single isolated container or pod group on-demand (per-second billing, batch jobs, burst).	ACA: Managed serverless container platform built on Kubernetes/KEDA/Dapr/Envoy for microservices and event-driven scale-to-zero without managing K8s APIs. AKS: Full managed Kubernetes cluster when you need custom CRDs, DaemonSets, CNI control, and deep orchestration.
What are the five IP addresses reserved by Azure in every VNet subnet?	1. .0: Network address	2. .1: Reserved by Azure for the default gateway; 3. .2 and 4. .3: Reserved by Azure to map the Azure DNS IPs (168.63.129.16) to the VNet space; 5. .255 (last address in CIDR): Network broadcast address. Thus, usable IPs per Azure subnet = $2^{(32 - \text{prefix})} -...
Is Azure VNet Peering transitive by default, and how can two indirectly peered Spoke VNets communicate through a Hub VNet?	No, VNet Peering is non-transitive by default (if VNet A peers with Hub VNet B, and Hub VNet B peers with VNet C, A cannot talk directly to C).	To enable Spoke-to-Spoke traffic through the Hub, configure a Network Virtual Appliance (NVA) or Azure Firewall in the Hub VNet, enable 'Allow forwarded traffic' on the peerings, and attach User-Defined Routes (UDRs) on the Spokes pointing to the Hub NVA/Firewall.
What do the VNet Peering flags UseGatewayTransit and UseRemoteGateways do?	In a Hub-and-Spoke topology where the Hub VNet hosts a VPN Gateway or ExpressRoute Gateway: enable AllowGatewayTransit on the Hub VNet's peering link, and enable UseRemoteGateways on the Spoke VNet's peering link.	This allows the Spoke VNet to share the Hub's gateway to reach on-premises networks without deploying its own gateway.
How do Azure Network Security Groups (NSGs) evaluate rules when an NSG is attached to both a Subnet and a VM's Network Interface (NIC)?	NSGs are stateful Layer 4 firewalls evaluated by priority (lowest number 100–4096 wins first).	For Inbound traffic: Subnet NSG is evaluated first, then NIC NSG. For Outbound traffic: NIC NSG is evaluated first, then Subnet NSG. Traffic must be allowed by BOTH NSGs to pass.
What are Application Security Groups (ASGs) and Service Tags in Azure NSG rules?	ASGs allow you to group VM network interfaces logically by workload role (e.g., WebServers, DbServers) within the same VNet and reference the ASG in NSG rules instead of hardcoding IP addresses.	Service Tags represent a Microsoft-managed group of IP address prefixes for a given Azure service (e.g., Storage, Sql, Internet, VirtualNetwork) that automatically updates as Azure IPs change.

👉 Practice Deck 2: Azure Compute, Networking (VNet, NSG, Application Gateway) & Storage (32 Flashcards) →
🔍 Browse All Basic Microsoft Azure (AZ-900 / AZ-104), Google Cloud (GCP ACE) & Terraform IaC Sets →

---

Deck 3: Azure High Availability, Backup, Monitoring & Cost Management (32 Cards — Intermediate)

What this deck covers: Intermediate Azure operations and architecture mastery for AZ-104 and AZ-305 covering composite SLA mathematics, Region Pairs, Azure Site Recovery (RTO/RPO), Azure Backup, Azure Monitor, Log Analytics (KQL), Application Insights, Network Watcher, Reservations/Savings Plans, Cosmos DB consistency, and Azure SQL options.

High-Yield Prompt / Question	Core Concept & Mechanism	Exam Application & Details
How do you calculate the composite SLA for Azure services deployed in series (dependent chain) versus in parallel (redundant active-active/failover)?	In Series (both must be up): Multiply individual SLAs ($SLA_{\text{total}} = SLA_A \times SLA_B$).	For example, Web App (99.95%) + SQL DB (99.99%) = $0.9995 \times 0.9999 = 99.94%$. In Parallel (redundant, only one must be up): $SLA_{\text{total}} = 1 - (1 - SLA_A) \times (1 - SLA_B)$. Two 99.9% systems in parallel yield $1 - (0.001 \times 0.001) = 99.9999%$.
What are the single-instance SLAs for an Azure VM depending on the Managed Disk tier used?	A single Azure VM (not in an Availability Set or Zone) still receives an SLA if all operating system and data disks use Managed Disks: 99.9% with Ultra Disk or Premium SSD	99.5% with Standard SSD; and 95.0% with Standard HDD.
What is an Azure Region Pair and what operational benefits does it provide?	Most Azure Regions are paired with another region in the same geography (typically 300+ miles apart, e.g., East US & West US).	Benefits include: sequential platform updates (only one region in a pair is updated at a time), prioritized recovery of at least one region during widespread outages, data residency compliance within the same legal jurisdiction, and built-in target for GRS/GZRS replication.
Define Recovery Time Objective (RTO) and Recovery Point Objective (RPO) in Disaster Recovery planning.	RTO (Recovery Time Objective) is the maximum acceptable duration of downtime after a disaster before business operations must be restored (e.g., 2 hours to bring services back online).	RPO (Recovery Point Objective) is the maximum acceptable age of data lost due to a disaster (e.g., an RPO of 15 minutes means backups/replication must occur at least every 15 minutes).
How does Azure Site Recovery (ASR) differ from Azure Backup?	Azure Backup creates periodic point-in-time recovery points (typically daily or multi-hour RPO) to protect against accidental deletion, corruption, or ransomware.	Azure Site Recovery (ASR) provides continuous block-level replication (RPO of seconds/minutes) and automated orchestration runbooks to fail over and fail back entire running VMs across Azure regions or from VMware/Hyper-V to Azure.
Compare the two stages of an Azure VM Backup in a Recovery Services Vault: Snapshot Tier vs. Vault Tier.	Stage 1 (Snapshot): Azure Backup takes an instant incremental snapshot stored locally alongside the VM's disks for up to 1–5 days, enabling 'Instant Restore' without waiting for data transfer from the vault.	Stage 2 (Vault): The snapshot is transferred asynchronously into the Recovery Services Vault for long-term retention.
What is Soft Delete in an Azure Recovery Services Vault and how long is deleted backup data retained?	When Soft Delete is enabled on a Recovery Services Vault (and can be locked as 'Always On'), if a malicious actor or admin deletes a VM's ba	When Soft Delete is enabled on a Recovery Services Vault (and can be locked as 'Always On'), if a malicious actor or admin deletes a VM's backup data, the backup items and recovery points are retained in a soft-deleted state for an additional 14 days (configurable up to 180 da...
What is the difference between the Azure Backup MARS Agent, MABS (Azure Backup Server), and Azure VM Backup Extension?	VM Backup Extension (VMSnapshot / VMSnapshotLinux): Backs up entire Azure IaaS VMs directly at the fabric level without an OS agent.	MARS (Microsoft Azure Recovery Services) Agent: Installed inside Windows OS (on-prem or Azure VM) to back up specific files, folders, and System State (up to 3 times/day). MABS: Application-aware backup server for on-prem VMware, Hyper-V, SQL, Exchange, and SharePoint.
Compare the three primary log categories in Azure Monitor: Activity Logs, Resource (Diagnostic) Logs, and Microsoft Entra Logs.	Activity Logs: Subscription-level control-plane events (WHO created, updated, or deleted an ARM resource and WHEN	retained 90 days free). Resource Logs (formerly Diagnostic Logs): Data-plane operations occurring INSIDE a specific resource (e.g., Key Vault secret reads, NSG flows, SQL queries; must be explicitly enabled via Diagnostic Settings). Entra Logs: Sign-in, Audit, and Provisioning...
What destinations can you route Azure Monitor Activity Logs and Resource Logs to using Diagnostic Settings?	1. Log Analytics Workspace (for KQL querying and log alerts)	2. Azure Storage Account (for cheap long-term archival and compliance retention); 3. Azure Event Hubs (for streaming logs in real time to external SIEMs like Splunk, Datadog, or Microsoft Sentinel); 4. Partner solutions.
How has the Azure Monitor Agent (AMA) with Data Collection Rules (DCRs) replaced the legacy Log Analytics (MMA/OMS) Agent?	The legacy MMA agent bound a VM directly to workspaces and collected all defined performance counters globally.	AMA uses centralized Data Collection Rules (DCRs) as ARM resources, allowing you to filter events (via XPath queries for Windows Event Logs or facility/severity for Linux Syslog), transform data at ingestion time using KQL, and send different telemetry streams to multiple Log ...
What language is used to query Azure Monitor Log Analytics, and what is the difference between where, summarize, project, and extend?	Kusto Query Language (KQL). where filters rows based on predicates (like SQL WHERE)	summarize aggregates rows using functions like count(), avg(), dcount(), or percentile() grouped by columns; project selects, renames, or drops specific output columns (like SQL SELECT); extend calculates and appends new computed columns while keeping all exi...

👉 Practice Deck 3: Azure High Availability, Backup, Monitoring & Cost Management (32 Flashcards) →
🔍 Browse All Intermediate Microsoft Azure (AZ-900 / AZ-104), Google Cloud (GCP ACE) & Terraform IaC Sets →

---

Deck 4: GCP Core Infrastructure (IAM, Compute Engine, GKE, Cloud Run & VPC) (32 Cards — Intermediate)

What this deck covers: Google Cloud Associate Cloud Engineer (ACE) and Professional Cloud Architect core infrastructure mastery covering the GCP Resource Hierarchy, IAM Roles, Service Accounts, Workload Identity Federation, Compute Engine, GKE (Standard vs Autopilot), Cloud Run, App Engine, and Global VPC Networking.

High-Yield Prompt / Question	Core Concept & Mechanism	Exam Application & Details
What are the four levels of the Google Cloud Resource Hierarchy from top to bottom, and how do IAM and Organization Policies inherit?	Organization Node (root tied to Google Workspace or Cloud Identity domain) -> Folders (optional, nestable up to 10 levels for departments/teams/environments) -> Projects (trust boundary for billing, APIs, and resource...	IAM policies are strictly additive down the hierarchy (child cannot revoke permissions granted at a parent level unless a Deny Policy is used), and Organization Policy constraints are inherited by all descendants.
What are the three identifiers of a Google Cloud Project, and which ones are mutable vs. immutable?	1. Project Name: Human-readable display label chosen by you	mutable (can be changed anytime) and does NOT need to be unique. 2. Project ID: Globally unique string chosen by you at creation (used in CLI commands and resource URIs); IMMUTABLE after creation. 3. Project Number: Globally unique integer automatically generated by Google Clo...
Compare the three types of IAM Roles in Google Cloud: Basic (Primitive), Predefined, and Custom Roles.	Basic Roles (Owner, Editor, Viewer, Billing Administrator): Coarse-grained legacy roles applied at the Project/Folder/Org level containing thousands of permissions across all services (violates least privilege...	Predefined Roles (e.g., roles/storage.objectViewer, roles/compute.instanceAdmin.v1): Fine-grained, service-specific roles maintained and updated by Google. Custom Roles: User-created collections of specific service.resource.verb permissions maintained by the customer at ...
Why can a Google Cloud Service Account act as both an 'Identity' and a 'Resource' in IAM?	As an Identity (Principal), a Service Account is granted roles on other GCP resources (e.g., roles/storage.objectViewer on a bucket) so a VM or container can call GCP APIs.	As a Resource, an IAM policy can be attached directly TO the Service Account itself, granting specific users or other service accounts the roles/iam.serviceAccountUser or roles/iam.serviceAccountTokenCreator role to attach or impersonate ONLY that Service Account.
Why are User-Managed Service Account Keys (JSON files) considered a high security risk in GCP, and what are the recommended alternatives?	Downloadable JSON private keys do not expire automatically by default, can be leaked in Git repositories, and are hard to audit/rotate. Recommended alternatives: 1. Attached Service Accounts / Workload Identity for wo...	2. Service Account Impersonation (--impersonate-service-account, short-lived OAuth tokens) for local developer testing; 3. Workload Identity Federation for external workloads (AWS, Azure, GitHub Actions, on-prem K8s).
How does Google Cloud Workload Identity Federation allow workloads on AWS, Azure, or GitHub Actions to access GCP without JSON keys?	You create a Workload Identity Pool and Provider configured to trust an external OIDC (e.g., GitHub Actions, Azure Entra ID, Kubernetes) or AWS STS identity provider.	The external workload exchanges its native platform credential with the Google Security Token Service (STS) for a federated token, which then impersonates a GCP Service Account to obtain short-lived GCP access tokens.
What is GKE Workload Identity and how does it bind Kubernetes Pods to GCP IAM?	Workload Identity is the recommended way for Pods in Google Kubernetes Engine (GKE) to authenticate to GCP APIs without node-level over-privileged service accounts or JSON keys.	You annotate a Kubernetes ServiceAccount (iam.gke.io/gcp-service-account) and bind the GCP Service Account with roles/iam.workloadIdentityUser to the K8s identity serviceAccount:<PROJECT_ID>.svc.id.goog[<NAMESPACE>/<KSA_NAME>]. The GKE metadata server intercepts Pod toke...
Compare Google Compute Engine (GCE) machine families: E2/N2/N2D/N4 (General Purpose), C2/C3/C4 (Compute Optimized), M1/M2/M3 (Memory Optimized), and A2/A3/G2 (Accelerator Optimized).	General Purpose: E2 (cost-optimized dynamic underlying CPU, shared-core options), N2/N2D/N4/C3 (balanced price/performance, sustained use or CUDs).	Compute Optimized (C2/C2D/C3/H3): High single-thread clock speeds for HPC, gaming, and CPU-bound tasks. Memory Optimized (M1/M2/M3): Multi-terabyte RAM (up to 32 TB) for SAP HANA and in-memory databases. Accelerator Optimized (A2/A3/G2): Attached NVIDIA A10...
Compare GCP Spot VMs (formerly Preemptible VMs) with Standard VMs on Compute Engine.	Spot VMs offer 60–91% discounts off on-demand prices by utilizing spare Compute Engine capacity.	Unlike legacy Preemptible VMs (which had a hard 24-hour maximum runtime limit), Spot VMs have NO maximum runtime limit, but Compute Engine can preempt (stop or delete) them at any time with a 30-second ACPI shutdown notice (preemption notice) if capacity is needed.
Compare Sustained Use Discounts (SUDs) and Committed Use Discounts (CUDs) in Google Compute Engine.	Sustained Use Discounts (SUDs): Automatic incremental discounts (up to 20–30%) applied when eligible VM families (N1, N2, N2D) run for more than 25% of a billing month—no upfront commitment required (Note: E2 ...	Committed Use Discounts (CUDs): 1-year or 3-year commitments (up to 55–70% discount) available as Resource-based CUDs (specific region/project/vCPU/RAM) or Flexible Spend-based CUDs ($/hr across regions/services).
What are Compute Engine Managed Instance Groups (MIGs), and how do Stateless vs. Stateful MIGs differ?	A Managed Instance Group (MIG) uses an Instance Template to manage a fleet of VMs as a single entity, providing autohealing (via health checks), autoscaling (by CPU, Load Balancer capacity, Cloud Monitoring metric, or...	Stateful MIGs preserve each instance's unique name, attached Persistent Disks, and internal/external IP addresses across recreations and autohealing.
How do Startup Scripts and the Instance Metadata Server (169.254.169.254) work in Google Compute Engine?	Every GCE VM can query http://metadata.google.internal/computeMetadata/v1/ (IP 169.254.169.254) with the required header Metadata-Flavor: Google to retrieve project/instance attributes, SSH keys, and service acc...	windows-startup-script-ps1 for Windows) and runs as root on every boot.

👉 Practice Deck 4: GCP Core Infrastructure (IAM, Compute Engine, GKE, Cloud Run & VPC) (32 Flashcards) →
🔍 Browse All Intermediate Microsoft Azure (AZ-900 / AZ-104), Google Cloud (GCP ACE) & Terraform IaC Sets →

---

Deck 5: GCP Storage, BigQuery, Pub/Sub, Dataflow & Cloud SQL (32 Cards — Advanced)

What this deck covers: Advanced Google Cloud data engineering, storage, and database architecture covering Cloud Storage classes and lifecycle rules, Persistent Disks vs Filestore, Cloud SQL vs Cloud Spanner vs Bigtable vs Firestore, BigQuery internals (partitioning, clustering, slots), Pub/Sub, and Dataflow vs Dataproc.

High-Yield Prompt / Question	Core Concept & Mechanism	Exam Application & Details
Compare the four Google Cloud Storage (GCS) storage classes: Standard, Nearline, Coldline, and Archive.	All four classes offer the same millisecond first-byte latency, high durability (11 nines), and global API! They differ by pricing and minimum storage duration: 1. Standard: Hot data, no minimum duration, no retrieval...	2. Nearline: Accessed <1x/month, 30-day min duration, per-GB retrieval fee; 3. Coldline: Accessed <1x/quarter, 90-day min duration, higher retrieval fee; 4. Archive: Accessed <1x/year, 365-day min duration, lowest storage cost and highest retrieval fee.
Compare Regional, Dual-Region, and Multi-Region location types in Google Cloud Storage.	Regional: Data stored redundantly across zones within a single GCP region (lowest cost, co-located with Compute Engine/GKE for lowest latency and zero inter-region network charges).	Dual-Region: Data replicated across a specific pair of regions (supports Turbo Replication with a 15-minute RPO SLA). Multi-Region: Data replicated across a large geographic area (us, eu, asia) with 99.95% SLA (Standard) and geo-redundancy.
What is Uniform Bucket-Level Access vs. Fine-Grained Access Control in Google Cloud Storage?	Uniform Bucket-Level Access (recommended): Disables legacy object-level Access Control Lists (ACLs) and manages all access uniformly via GCP IAM policies at the bucket level (also required to use IAM Conditions and Wo...	Fine-Grained Access: Combines IAM policies with individual object-level and bucket-level POSIX-style ACLs, which is harder to audit centrally.
How does Object Lifecycle Management work in Google Cloud Storage, and what actions and conditions are supported?	Object Lifecycle Management applies declarative JSON rules to a bucket to automatically transition or delete objects.	Supported Actions: Delete, SetStorageClass (downgrade from Standard -> Nearline -> Coldline -> Archive), and AbortIncompleteMultipartUpload. Supported Conditions: age (days since creation), createdBefore, isLive (versioned objects), numNewerVersions, `matchesPref...
What are Signed URLs and Signed Policy Documents in Google Cloud Storage?	A Signed URL (gcloud storage sign-url or V4 signing with a Service Account) grants time-limited read (GET) or write (PUT) permission to a specific GCS object for anyone possessing the URL, even if they don't hav...	A Signed Policy Document is used with HTML forms (POST) to allow users to upload files directly to GCS while enforcing constraints on file size, content-type, and key prefix.
Compare Customer-Managed Encryption Keys (CMEK), Customer-Supplied Encryption Keys (CSEK), and Google-Managed Default Encryption in GCP.	Google-Managed Default Encryption: Google automatically encrypts all data at rest using AES-256 without customer setup. CMEK: You create and control key rotation/revocation inside Cloud KMS while Google services manag...	Google never stores the key on disk (only in RAM during the operation).
Compare Google Cloud Persistent Disks (Standard, Balanced, Performance/SSD, Extreme), Hyperdisk, Local SSD, and Cloud Filestore.	Persistent Disk (PD) / Hyperdisk: Network-attached durable block storage (pd-standard HDD, pd-balanced, pd-ssd, pd-extreme / Hyperdisk Extreme with configurable IOPS)	survives VM termination, supports snapshots and regional replication (Regional PD across 2 zones). Local SSD: Physically attached NVMe/SCSI disk on the host server; ultra-high IOPS/low latency, but EPHEMERAL (data lost if VM stops). Filestore: Managed NAS (NFSv3/v4.1) shared...
How does High Availability (HA) work in Google Cloud SQL, and how does it differ from Read Replicas?	Cloud SQL HA (Regional configuration) uses a Primary instance in one zone and a Standby instance in a second zone within the same region, kept in sync via synchronous replication to a Regional Persistent Disk.	If the primary zone or instance fails, Cloud SQL automatically fails over to the Standby (typically <60s) on the same IP. Read Replicas use asynchronous replication to offload read queries (within the same or different region) and do not provide automatic HA failover.
Why and how should applications use the Cloud SQL Auth Proxy to connect to Cloud SQL?	The Cloud SQL Auth Proxy is a lightweight sidecar/binary that establishes an encrypted TLS 1.3 tunnel to the Cloud SQL instance using IAM permissions (roles/cloudsql.client), removing the need to manage static SSL c...	It also supports automatic IAM database authentication using short-lived OAuth tokens.
Compare Cloud SQL, AlloyDB for PostgreSQL, and Cloud Spanner for relational database workloads in GCP.	Cloud SQL: Managed MySQL, PostgreSQL, and SQL Server (up to 64 TB, vertical scaling, regional HA).	AlloyDB for PostgreSQL: Google-engineered PostgreSQL-compatible engine with decoupled storage/compute, columnar engine for hybrid OLTP+OLAP, 4x faster transactional throughput than standard Postgres, 99.99% SLA. Cloud Spanner: Globally distributed, horizontally scalable relati...
How does Google Cloud Spanner achieve external consistency (linearizability) across global datacenters without traditional lock contention bottlenecking reads?	Cloud Spanner uses Google's hardware-assisted TrueTime API (combining GPS receivers and atomic rubidium clocks in every datacenter) to bound clock uncertainty $\epsilon$ to a few milliseconds.	By waiting out the uncertainty window ($2\epsilon$) during commit ('commit wait') along with Paxos consensus groups and Multi-Version Concurrency Control (MVCC), Spanner guarantees that transaction timestamps strictly reflect real-world causal ordering, enabling lock-free cons...
What is the #1 cause of hotspots when designing schemas in Cloud Spanner and Cloud Bigtable, and how do you avoid it?	Monotonically increasing primary keys or row keys (such as auto-incrementing integers 1, 2, 3... or leading timestamps 2026-11-02...).	Because Spanner and Bigtable sort rows lexicographically by key across key-range splits/tablets, sequential keys route 100% of new writes to a single tablet server. Mitigations: Use UUIDv4, hash prefixing, bit-reversal of sequential IDs, or put high-cardinality attributes (lik...

👉 Practice Deck 5: GCP Storage, BigQuery, Pub/Sub, Dataflow & Cloud SQL (32 Flashcards) →
🔍 Browse All Advanced Microsoft Azure (AZ-900 / AZ-104), Google Cloud (GCP ACE) & Terraform IaC Sets →

---

Deck 6: Multi-Cloud Architecture Tradeoffs & Well-Architected Framework (32 Cards — Advanced)

What this deck covers: Senior Cloud Architect synthesis across AWS, Microsoft Azure, and Google Cloud covering service equivalences, the 5/6 Pillars of the Well-Architected Framework, Zero Trust multi-cloud networking, cross-cloud OIDC/SAML federation, Disaster Recovery patterns, CAP theorem in cloud databases, FinOps, and the 6 Rs of migration.

High-Yield Prompt / Question	Core Concept & Mechanism	Exam Application & Details
Map the equivalent Identity, Resource Hierarchy, and Policy Governance services across AWS, Microsoft Azure, and Google Cloud.	Identity Provider: AWS IAM Identity Center + IAM / Azure Microsoft Entra ID / GCP Cloud Identity + Cloud IAM.	Resource Hierarchy: AWS Organization -> OUs -> Accounts / Azure Tenant -> Management Groups -> Subscriptions -> Resource Groups / GCP Organization -> Folders -> Projects. Guardrails/Policy: AWS Service Control Policies (SCPs) + AWS Config / Azure Policy / GCP Organization Poli...
Map the equivalent Compute (VMs, Serverless Functions, Serverless Containers, Managed Kubernetes) services across AWS, Azure, and GCP.	IaaS VMs: AWS EC2 / Azure Virtual Machines / GCP Compute Engine.	Autoscaling Groups: AWS ASG / Azure VM Scale Sets (VMSS) / GCP Managed Instance Groups (MIGs). Serverless Functions: AWS Lambda / Azure Functions / GCP Cloud Run Functions. Serverless Containers: AWS App Runner & ECS Fargate / Azure Container Apps & ACI / GCP Cloud Run. Manage...
Map the equivalent Storage (Object, Block, Managed NFS/SMB File) services across AWS, Azure, and GCP.	Object Storage: AWS S3 / Azure Blob Storage (and ADLS Gen2) / GCP Cloud Storage (GCS).	Block Storage: AWS EBS / Azure Managed Disks (Standard/Premium SSD, Ultra Disk) / GCP Persistent Disk & Hyperdisk. Managed File Shares: AWS EFS (NFS) & FSx (Windows/Lustre/NetApp) / Azure Files (SMB/NFS) & Azure NetApp Files / GCP Filestore (NFS) & Google Cloud NetApp Volumes.
Map the equivalent Relational, Global Distributed SQL, Wide-Column/Key-Value NoSQL, and Document Databases across AWS, Azure, and GCP.	Managed RDBMS: AWS RDS & Aurora / Azure SQL Database & SQL MI / GCP Cloud SQL & AlloyDB.	Globally Distributed SQL / Multi-Region DB: AWS Aurora Global Database & DynamoDB Global Tables / Azure Cosmos DB / GCP Cloud Spanner. Wide-Column / High-Throughput NoSQL: AWS Keyspaces & DynamoDB / Azure Cosmos DB (Table/Cassandra API) / GCP Cloud Bigtable. Document DB: AWS D...
Map the equivalent Data Warehouse, Event Streaming, Pub/Sub Messaging, and Batch/Stream Processing services across AWS, Azure, and GCP.	Data Warehouse: AWS Redshift / Azure Synapse Analytics & Microsoft Fabric / GCP BigQuery.	Event Streaming: AWS Kinesis Data Streams & MSK / Azure Event Hubs / GCP Pub/Sub & Managed Service for Apache Kafka. Message Queues/Bus: AWS SQS & SNS & EventBridge / Azure Service Bus & Event Grid / GCP Pub/Sub & Eventarc. Data Processing: AWS EMR & Glue / Azure Databricks & ...
Map the equivalent Networking (VPC, Private PaaS Connectivity, Dedicated Fiber, Global L7 Load Balancer + WAF) services across AWS, Azure, and GCP.	Virtual Network: AWS VPC (regional) / Azure VNet (regional) / GCP VPC (global with regional subnets).	Private PaaS Endpoint: AWS PrivateLink (Interface VPC Endpoints) / Azure Private Link (Private Endpoints) / GCP Private Service Connect. Dedicated Private Fiber: AWS Direct Connect / Azure ExpressRoute / GCP Cloud Interconnect. Global Edge L7 LB + WAF: AWS CloudFront + Global ...
What are the five core pillars of the Cloud Well-Architected Framework (plus AWS's 6th pillar)?	1. Reliability (resiliency, fault isolation, automated recovery, DR testing)	2. Security (least privilege, defense in depth, encryption in transit/at rest, traceability); 3. Cost Optimization (FinOps, right-sizing, consumption pricing, commitments); 4. Operational Excellence (IaC, CI/CD, observability, small reversible changes, blameless postmortems); ...
Compare the four classic Cloud Disaster Recovery (DR) architecture patterns ordered from lowest cost / longest RTO to highest cost / lowest RTO.	1. Backup and Restore: Data backed up to cloud object storage	infrastructure provisioned from scratch via IaC only during disaster (RTO: hours to days, RPO: hours; $). 2. Pilot Light: Core stateful data layer (DB replicas) continuously replicated and running minimal compute; application servers are off/scaled to 0 until disaster (RTO: 10...
What are the '6 Rs' (or 7 Rs) of Cloud Migration Strategies and when should you choose each?	1.	Rehost ('Lift and Shift'): Move VMs as-is to cloud IaaS without code changes for rapid datacenter exit. 2. Replatform ('Lift, Tinker, and Shift'): Keep core architecture but adopt managed PaaS (e.g., move self-hosted Postgres to Cloud SQL/RDS). 3. Refactor / Re-architect: Rede...
Explain the Strangler Fig Pattern when modernizing a legacy monolithic application during a cloud migration.	Named by Martin Fowler, instead of a high-risk 'big bang' rewrite of a monolith, you place an API Gateway or Layer 7 Reverse Proxy (e.g., Application Gateway, Envoy, CloudFront/ALB) in front of the legacy monolith.	You incrementally build new microservices in the cloud and route specific URL paths or domains (/orders, /payments) to the new cloud services while forwarding remaining traffic to the monolith, until the monolith shrinks away and is retired.
How do you architect keyless cross-cloud authentication between AWS, Azure, and GCP workloads?	Never store static long-lived IAM access keys or service account JSON keys across clouds! Use OpenID Connect (OIDC) federation: 1.	From Azure/GCP to AWS: Exchange an Entra ID Managed Identity JWT or GCP Service Account OIDC ID token using AWS STS AssumeRoleWithWebIdentity. 2. From AWS/GCP to Azure: Configure Federated Identity Credentials on an Entra App Registration/User-Assigned Managed Identity trust...
How do you architect high-availability, low-latency private network connectivity between two cloud providers (e.g., Azure and GCP or AWS and Azure)?	Two main patterns: 1.	Encrypted Internet Overlay: Deploy redundant HA VPN Gateways in both clouds using dynamic BGP over 4 IPsec tunnels across separate Availability Zones (up to ~5–10 Gbps, 99.99% SLA). 2. Private Dedicated Cross-Cloud Interconnect: Use a colocation fabric provider (such as Equini...

👉 Practice Deck 6: Multi-Cloud Architecture Tradeoffs & Well-Architected Framework (32 Flashcards) →
🔍 Browse All Advanced Microsoft Azure (AZ-900 / AZ-104), Google Cloud (GCP ACE) & Terraform IaC Sets →

---

Complete 6-Deck Quick-Access Directory

Deck #	Deck Title	Level	Cards	Direct Practice Link
Deck 1	Azure Core Identity (Entra ID, RBAC, Conditional Access & Governance)	basic	32	Open Deck 1 →
Deck 2	Azure Compute, Networking (VNet, NSG, Application Gateway) & Storage	basic	32	Open Deck 2 →
Deck 3	Azure High Availability, Backup, Monitoring & Cost Management	intermediate	32	Open Deck 3 →
Deck 4	GCP Core Infrastructure (IAM, Compute Engine, GKE, Cloud Run & VPC)	intermediate	32	Open Deck 4 →
Deck 5	GCP Storage, BigQuery, Pub/Sub, Dataflow & Cloud SQL	advanced	32	Open Deck 5 →
Deck 6	Multi-Cloud Architecture Tradeoffs & Well-Architected Framework	advanced	32	Open Deck 6 →

👉 Launch Full Microsoft Azure (AZ-900 / AZ-104), Google Cloud (GCP ACE) & Terraform IaC Spaced-Repetition Track →