Memory hook: Observe the user outcome; automate the reviewed intent.
Must remember
Cloud Monitoring handles metrics, dashboards, uptime checks and alerts; Cloud Logging stores/searches log entries and routes them to destinations. Logs-based metrics turn matching entries into measured signals. Custom metrics describe application-specific behavior. Alerts need meaningful thresholds, duration and notification channels.
Log Router sinks select matching entries for destinations such as log buckets, BigQuery, Cloud Storage or Pub/Sub, subject to destination permissions. Retention and exclusions affect cost and future evidence. Creating a sink does not retroactively route all historical logs. Audit-log categories include administration and data access with different defaults/service behavior; verify required visibility.
The Ops Agent collects supported VM telemetry; Managed Service for Prometheus supports Prometheus-style metrics. Traces connect request spans; profiling identifies code resource use. Check provider service status, quota, recent changes and application dependencies while diagnosing.
Infrastructure as code tools include Terraform, Cloud Foundation Toolkit patterns and Config Connector's Kubernetes-style resource management. Helm packages Kubernetes applications. Version configuration, review plans/manifests, protect state and run identities, and verify the resulting service. A controller and Terraform should not compete to manage the same object without a deliberate ownership model.
Use release strategies that match risk: staged/canary traffic, health validation, rollback and backward-compatible schema changes. Define service-level indicators (SLIs), objectives (SLOs) and alerting based on user-visible failure rather than only CPU. Backups need restored-data verification and dependency-aware recovery.
Read-only recall drill: explain what gcloud config list, a filtered Logging query, a Monitoring chart and a Terraform plan each can and cannot prove. No cloud mutation is needed to rehearse the distinctions.
Review details
Remember the four audit categories: Admin Activity, Data Access, System Event and Policy Denied. Admin Activity and System Event logs are always written; most Data Access logs require explicit enablement, while BigQuery Data Access is a notable default-enabled exception. Verify the service, configured exclusions and reader permissions before promising evidence of a past read.
Logging queries filter fields such as resource.type, severity and time; a narrow time/resource scope makes diagnosis easier. Log Analytics supports SQL-based analysis of eligible log buckets. A logs-based metric measures matching entries; an alert still needs an actionable condition, notification destination and owner.
Choose under exam pressure
| Requirement | Choice and reason |
|---|---|
| Find a specific failed request | Logs and trace correlation. |
| Detect an error-rate trend | A meaningful metric and alert/SLO condition. |
| Repeat infrastructure deployment | Reviewed IaC with clear resource ownership. |
Traps
- A sink needs destination access and normally routes new matching entries.
- A successful deployment job is not proof of user-visible availability.
Active recall
1. Logging versus Monitoring?
Logging records/searches events; Monitoring measures and alerts on metrics and service health.
2. Why create logs-based metrics?
To count or measure meaningful patterns in log entries for dashboards/alerts.
3. What does an Ops Agent supply?
Supported telemetry collection from VMs.
4. Why avoid two independent managers for one resource?
They can repeatedly undo each other’s changes and create drift/conflict.
5. What should a good availability alert represent?
A meaningful user/service failure with actionable ownership and timing.