Google Cloud Professional Cloud DevOps Engineer tests whether you can run software delivery and production systems on Google Cloud the way Google's SRE teams do: resource hierarchy and infrastructure as code, CI/CD with Cloud Build and Cloud Deploy, SLOs and error budgets, observability, and cost control. A new exam guide goes live on 23 November 2026. It gives CI/CD more weight and adds AI agents throughout: isolating agent execution, MCP servers, Provisioned Throughput, agent telemetry and token cost.
This guide follows Google's official exam guides: what changes on 23 November, all five sections with the new weights, a 7-week plan and 15 original scenario questions.
Quick facts (Google Cloud, November 2026)
| Item | Detail |
|---|---|
| Length | 2 hours |
| Questions | 50–60, multiple choice and multiple select |
| Fee | USD 200 (plus tax where applicable) |
| Languages | English, Japanese |
| Delivery | Online-proctored or at a test centre |
| Prerequisites | None; 3+ years of industry experience including 1+ year designing and managing production systems on Google Cloud recommended |
| Exam guide | New version applies to exams taken on or after 23 November 2026 |
Read the official Professional Cloud DevOps Engineer page and check which exam guide applies to your exam date. Google also publishes free sample questions and links the SRE books and DORA research as reading.
What changes on 23 November 2026
| Section | Before 23 Nov | From 23 Nov |
|---|---|---|
| 1. Foundational infrastructure and organisational governance | ~20% | ~18% |
| 2. CI/CD pipelines, including continuous testing | ~25% | ~30% |
| 3. Site reliability engineering practices | ~18% | ~18% |
| 4. Observability and troubleshooting | ~25% | ~22% |
| 5. Performance and cost | ~12% | ~12% |
New or renamed topics in the new guide:
- Agents: isolating agent execution environments (for example GKE Agent Sandbox); Provisioned Throughput for agent reliability and cost; emitting metrics and logs from agents (Gemini Enterprise Agent Platform, Agent Development Kit, Antigravity); agent performance monitoring; optimising token consumption.
- Developer environments: configuring and using Model Context Protocol (MCP) servers; Antigravity and Gemini Cloud Assist for development and operations.
- Infrastructure: Application Design Center and Terraform modules and blueprints; Network Connectivity Center; managing serverless environments.
- Pipelines and SRE: managing short-lived credentials; error budgets with Cloud Run and Cloud Monitoring; feedback loops for continuous improvement.
- Tooling list: third-party CI/CD examples are now Git, Argo CD, Flux and kpt (Jenkins and Packer are no longer named). Tracing is merged into logs, and alerting integrations now name Slack and Discord.
Who should take it?
- DevOps and SRE engineers running production workloads on GKE, Cloud Run or Compute Engine.
- Engineers who passed Associate Cloud Engineer and want a professional DevOps credential.
- AWS or Azure DevOps engineers adding Google Cloud. Compare with AWS DOP-C02 and Azure AZ-400.
Section 1: Foundational infrastructure and governance (~18%)
- Resource hierarchy: organisation, folders and projects; Shared VPC, VPC Network Peering, Network Connectivity Center and Private Service Connect; multi-project monitoring and logging; IAM roles and organisation policies; service accounts; data residency.
- Infrastructure as code: Application Design Center, Infrastructure Manager, Config Connector, GitOps, Terraform and Helm; Terraform modules and blueprints; scripting in Python or Go; Provisioned Throughput for agent reliability.
- CI/CD architecture: CI with Cloud Build; CD with Cloud Deploy, Kustomize and Skaffold; Artifact Registry; Git, Argo CD, Flux and kpt; securing CI/CD tooling.
- Runtime environments: ephemeral environments; configuration and policy; GKE fleets; serverless environments; safe patching and upgrades; GKE Agent Sandbox.
- Developer environments: Cloud Workstations and Cloud Shell; custom images and the Google Cloud SDK; Antigravity and Gemini Cloud Assist; MCP servers.
Section 2: CI/CD pipelines (~30%)
- Building pipelines: application and infrastructure CI/CD; Artifact Registry; deploying to hybrid and multicloud (GKE); triggers; approval flows.
- Running pipelines: auditing deployments (Artifact Registry, Cloud Build, Cloud Deploy, Cloud Audit Logs); canary, blue/green, rolling, traffic splitting and feature flags, with success metrics from app or ML pipeline telemetry.
- Secrets: Cloud KMS; Secret Manager, Certificate Manager, Parameter Manager; Workload Identity Federation; build-time vs runtime secret injection; short-lived credentials.
- Supply chain: Artifact Analysis and vulnerability scanning; Binary Authorization and SLSA; IAM per environment.
# clouddeploy.yaml: promote one release through staging to prod with an approval
apiVersion: deploy.cloud.google.com/v1
kind: DeliveryPipeline
metadata:
name: orders
serialPipeline:
stages:
- targetId: staging
- targetId: prod
strategy:
canary:
runtimeConfig:
cloudRun:
automaticTrafficControl: true
canaryDeployment:
percentages: [10, 50]
---
apiVersion: deploy.cloud.google.com/v1
kind: Target
metadata:
name: prod
requireApproval: true
run:
location: projects/my-project/locations/asia-south1Section 3: SRE practices (~18%)
- SLIs (availability, latency), SLOs and SLAs; error budgets (Cloud Service Mesh, Cloud Run, Cloud Monitoring); the cost of each extra "nine".
- Service lifecycle: planning to retirement; capacity planning with quotas, limits, reservations and Dynamic Workload Scheduler; autoscaling with MIGs, Cloud Run and GKE; feedback loops.
- Incident mitigation: draining or redirecting traffic, adding capacity, rolling back.
| SLO | Allowed downtime per 30 days |
|---|---|
| 99% | About 7.2 hours |
| 99.9% | About 43 minutes |
| 99.95% | About 22 minutes |
| 99.99% | About 4.3 minutes |
Section 4: Observability and troubleshooting (~22%)
- Telemetry: Ops Agent, OpenTelemetry, Cloud Audit Logs, VPC Flow Logs, Cloud Service Mesh; log filtering, sampling and exclusions for cost; Managed Service for Prometheus; synthetic monitors; log-based and custom metrics; metrics and logs from GKE, Cloud Run and agents.
- Logs and traces: Logs Explorer with AI-assisted analysis; log sinks to BigQuery, Pub/Sub and Cloud Storage; redacting PII and PHI; distributed traces, span analysis and correlating trace IDs with structured logs.
- Metrics and alerts: Metrics Explorer; dashboards and PromQL; SLO and cost alerts; PagerDuty, Slack, Discord and webhooks.
- Troubleshooting: infrastructure, pipeline, application, observability and latency issues.
Section 5: Performance and cost (~12%)
- Application and agent performance monitoring; Active Assist recommendations.
- FinOps: observability costs; Spot VMs; committed-use and sustained-use discounts; network tiers; recommenders; GKE, Cloud Run and Compute Engine cost tuning; Provisioned Throughput; token consumption.
7-week study plan
| Week | Focus | Lab |
|---|---|---|
| 1 | Org, folders, projects, IAM, org policies, Shared VPC | Build a dev/prod folder layout with Terraform |
| 2 | Cloud Build, Artifact Registry, Cloud Deploy, Skaffold, Kustomize | Pipeline: build, scan, deploy to staging, approve to prod |
| 3 | Canary, blue/green, traffic splitting; Binary Authorization; Secret Manager; Workload Identity Federation | Keyless GitHub Actions deploy; canary on Cloud Run |
| 4 | SLIs, SLOs, error budgets, capacity planning, autoscaling | Define a latency SLO and a burn-rate alert |
| 5 | Ops Agent, OpenTelemetry, Logs Explorer, log sinks, log-based metrics, Prometheus, tracing | Trace one request across two services; redact PII in logs |
| 6 | Agents and AI: GKE Agent Sandbox, MCP servers, Provisioned Throughput, token cost | Monitor an ADK agent's latency, errors and tokens |
| 7 | FinOps, recommenders, Spot VMs, CUDs; troubleshooting drills; sample questions | Cut a test project's bill using recommenders; book the exam |
15 scenario questions with answers
These are original scenarios written for this guide, not exam questions.
1. Several teams' projects need one central network managed by the platform team. What do you use?
Shared VPC with a host project and service projects.
2. You want Kubernetes-style YAML to manage Google Cloud resources from a GitOps repo. Which tool?
Config Connector.
3. A release must go to staging automatically and to production only after a manager approves. What do you use?
Cloud Deploy with a delivery pipeline and requireApproval on the production target.
4. GitHub Actions must deploy without storing a service account key. How?
Workload Identity Federation with short-lived credentials.
5. Only images built and signed by your pipeline may run in production. What enforces this?
Binary Authorization with attestations from the trusted build.
6. A new version should take 10% of traffic and roll back automatically if errors rise. Which strategy?
A canary deployment with success metrics from telemetry.
7. The SLO is 99.9% and this month's error budget is already used up. What should the team do?
Pause risky feature releases and focus on reliability work until the budget recovers.
8. Product wants 99.999% availability for an internal report tool. What is the SRE answer?
Explain the opportunity cost: each extra nine costs far more, and the tool's users don't need it.
9. A regional outage hits one backend. What is the fastest way to protect users?
Drain or redirect traffic to healthy regions, then investigate.
10. Debug logs are filling Cloud Logging and the bill. What do you do?
Add exclusion filters or sampling for low-value logs, and keep only what you need.
11. Logs must be kept for 7 years for audit at low cost. Where do you route them?
A log sink to Cloud Storage (or BigQuery if you must query them).
12. Customer phone numbers appear in application logs. What do you do?
Redact them with a log processor before storage, and fix the logging code.
13. One request is slow across three microservices. How do you find the slow hop?
OpenTelemetry tracing: read the trace waterfall and correlate the trace ID with structured logs.
14. An AI agent runs generated code and must not reach other workloads. What do you use?
An isolated agent execution environment such as GKE Agent Sandbox.
15. A chatbot's model bill doubled. What do you check first?
Token consumption per request, prompt and context size, and whether Provisioned Throughput or a smaller model suits the load.
After Professional Cloud DevOps Engineer
- Practise GKE and Cloud DevOps interview questions and SRE interview questions.
- Read DevOps vs SRE, AI for SRE engineers and the Professional Cloud Developer guide.
- See live DevOps and SRE jobs.
Cloud Soft Solutions in Ameerpet, Hyderabad teaches multi-cloud DevOps, SRE, Kubernetes and Google Cloud with real-time projects. See the APEX program and all courses.
📞 Call +91 96660 19191 · WhatsApp · Flat No. 513, 5th Floor, Nilagiri Block, Aditya Enclave, Ameerpet, Hyderabad
Frequently Asked Questions
How long is the Professional Cloud DevOps Engineer exam?
2 hours, with 50 to 60 multiple-choice and multiple-select questions.
How much does the exam cost?
USD 200, plus tax where applicable.
What changes on 23 November 2026?
A new exam guide applies. CI/CD pipelines rise to about 30%, observability drops to about 22%, governance to about 18%, and new topics include agent sandboxes, MCP servers, Provisioned Throughput and token cost.
Which exam guide should I study?
Use the guide that matches your exam date: the current guide before 23 November 2026 and the new guide on or after that date.
Is there a prerequisite?
No. Google recommends 3+ years of industry experience, including 1+ year designing and managing production systems on Google Cloud.
Which languages is the exam offered in?
English and Japanese.
