Google PCA Practice Test 17 — 15 Questions

Question 1

A financial services firm is designing a new analytics platform on Google Cloud. Regulatory requirements mandate that data must never be replicated or processed outside the European Union, and the company wants to prevent accidental resource creation in non-EU regions regardless of which engineer is deploying. Which mechanism should the architect use to enforce this constraint?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Organization Policy constraints that restrict resource locations to approved EU regions.. Organization Policy constraints enforce location restrictions centrally and deny non-compliant resource creation before it happens, independent of user permissions. IAM governs identity, VPC Service Controls govern API access and exfiltration, and Asset Inventory provides detection after the fact. Only the organization policy provides the preventive, organization-wide geographic guarantee the regulation demands.

Answer

IAM roles that grant project creators permissions only in EU projects.

Answer

VPC Service Controls perimeters around each project to block data exfiltration.

Answer

Cloud Asset Inventory alerts that notify security teams when non-EU resources appear.

Question 2

A multinational enterprise is designing its Google Cloud resource hierarchy. They want to enforce centrally managed policies, delegate administration to regional business units, and isolate billing. Which two design choices should the architects make? (Choose two.)

Accepted Answer

Create folders per business unit under the organization node and apply organization policies at the appropriate folder level.. Folders under the organization node enable policy inheritance and delegated administration, letting central teams set guardrails while business units own their projects. Separate Cloud Billing accounts per business unit isolate costs and budgets. Labels, over-broad organization roles, and networking alone do not deliver the required policy control and billing separation.

Answer

Create a single project for all business units and use labels to separate their resources.

Answer

Use a single Shared VPC in the organization host project for all business units without folders.

Answer

Grant every business unit administrator the Organization Administrator role so they can manage their own projects.

Question 3

A company stores sensitive data in Cloud Storage and wants to enforce encryption at rest using customer-managed keys. Which Google Cloud service should they use to manage the keys?

Accepted Answer

Cloud KMS. Cloud KMS (Key Management Service) is the correct choice because it is the native Google Cloud service for managing cryptographic keys, including customer-managed encryption keys (CMEK). It allows you to create, rotate, and control access to keys used to encrypt data at rest in Cloud Storage, and it integrates directly with Cloud Storage's CMEK feature. Cloud HSM is a hardware-backed key management option but is built on top of Cloud KMS, not a separate service for key management.

Answer

Cloud HSM

Answer

Secret Manager

Answer

IAM

Question 4

A healthcare company is planning a Google Cloud landing zone for a new regulated workload. They must enforce organization-wide guardrails, centralize billing visibility, and give each business unit autonomy over its own projects. The security team needs to apply policies that cannot be overridden by project owners. Which two design choices should you recommend? (Choose two.)

Accepted Answer

Enable Cloud Billing export to BigQuery and create a shared log sink to a central project for audit and cost analysis.. A folder hierarchy lets the company apply organization policies that inherit to all descendant projects and cannot be overridden by project owners, satisfying the guardrail requirement. Exporting billing data to BigQuery and centralizing logs provide the centralized billing and audit visibility. Granting broad roles like Billing Account Administrator or Organization Administrator, or flattening the hierarchy, undermines centralized control and least privilege.

Answer

Place all projects directly under the organization root and rely on project-level IAM to enforce security policies.

Answer

Give each business unit the Organization Administrator role so they can manage their own projects independently.

Answer

Grant each business unit the Billing Account Administrator role on the shared billing account to give them billing autonomy.

Question 5

An enterprise is migrating a latency-sensitive trading application from an on-premises data centre to Google Cloud. The application's components exchange hundreds of thousands of small messages per second and require sub-millisecond inter-process communication. The architect must choose a compute and networking design. What should the architect recommend?

Accepted Answer

Deploy the components on Compute Engine VMs in the same zone with compact placement, and enable high-priority network traffic using the `--network-performance-configs` total-egress-bandwidth-tier setting.. Ultra-low latency between tightly coupled components depends on physical proximity and adequate network throughput. Compact placement policies schedule instances close together on the same rack, reducing switch hops and jitter, while the higher total egress bandwidth tier removes the default throughput cap that would otherwise throttle a heavy small-message workload. Keeping all components in a single zone avoids inter-zone round trips entirely, which is essential for the stated sub-millisecond requirement.

Answer

Deploy the components on GKE Autopilot pods spread across three zones with a PodDisruptionBudget and topology spread constraints.

Answer

Deploy the components on Cloud Run services in the same region and connect them through a Serverless VPC Access connector to a shared VPC.

Answer

Deploy the components on Compute Engine VMs in different zones of the same region and connect them with a global VPC using external IP addresses for direct communication.

Question 6

A financial services firm is planning its Google Cloud resource hierarchy before migrating production workloads. The architecture team wants to enforce separation between business units, centralize network administration, and apply consistent IAM and policy controls across many projects. Which two design choices should the architect recommend? (Choose two.)

Accepted Answer

Use a Shared VPC host project to centralize network administration while service projects host the workloads. A folder-based hierarchy with inherited IAM and Organization Policy constraints gives centralized, consistent governance while separating business units. A Shared VPC host project centralizes network administration so service projects can consume subnets without owning network topology. Together these choices provide the separation, centralization, and consistent controls the firm requires while avoiding the risks of flat hierarchies or excessive organization-level permissions.

Answer

Grant the roles/owner role to each business unit's administrators at the organization level to simplify management

Answer

Place all projects directly under the organization node and manage permissions only at the project level

Answer

Create a separate organization node for each business unit to isolate billing and IAM

Question 7

A company runs a web application on Google Kubernetes Engine (GKE) with Cluster Autoscaler enabled. During a traffic spike, the application becomes slow and some requests timeout. The cluster has sufficient CPU and memory headroom. What is the most likely cause and solution?

Accepted Answer

Configure Horizontal Pod Autoscaler (HPA) based on CPU utilization or custom metrics.. The cluster has sufficient CPU and memory headroom, indicating that the issue is not about cluster capacity but about pod-level scaling. The Horizontal Pod Autoscaler (HPA) automatically scales the number of pod replicas based on observed CPU utilization or custom metrics, which directly addresses the application slowdown and timeouts during traffic spikes by distributing the load across more pods.

Answer

Increase the node pool's machine type to a larger size.

Answer

Enable Cluster Autoscaler to add more nodes.

Answer

Deploy the application in a regional cluster for higher availability.

Question 8

A retail company is designing a new microservices architecture on Google Cloud. They want to minimize operational overhead, enable independent deployment of services, and ensure that a failure in one service does not cascade to others. They also want to use managed services where possible. Which two design choices should the architect recommend? (Choose two.)

Accepted Answer

Implement asynchronous communication between services using Pub/Sub topics. Cloud Run per microservice with distinct service accounts provides managed scaling, independent deployment, and least-privilege isolation. Pub/Sub enables asynchronous, durable communication that prevents cascading failures and decouples services. Together they meet the goals of minimal operational overhead, independent deployability, and fault isolation. Shared databases, single VMs, and shared GKE namespaces introduce coupling and operational burden.

Answer

Deploy all microservices into a single Google Kubernetes Engine cluster with a shared namespace

Answer

Use a single Compute Engine instance running all microservices in Docker containers

Answer

Use a shared Cloud SQL instance with a single database for all microservices

Question 9

A healthcare company is designing a new patient portal on Google Cloud. Regulatory requirements mandate that all data at rest be encrypted with keys the company controls and can rotate on its own schedule, and that the keys never leave a hardware security module (HSM). The security team also wants to retain the ability to revoke Google's access to the data if the external key becomes unavailable. Which key management design should you recommend?

Accepted Answer

Use Cloud External Key Manager (Cloud EKM) with a supported external key management partner and an HSM-backed external key.. Cloud External Key Manager is the only option that keeps key material outside Google Cloud in a partner HSM while still integrating with Google Cloud services for encryption at rest. It supports customer-controlled rotation and, critically, allows the customer to revoke Google's access by disabling the external key. CMEK and GMEK keep key custody inside Google, which does not meet the external control and revocation mandate.

Answer

Create a Cloud KMS key ring with HSM protection level and use customer-managed encryption keys (CMEK) for the services.

Answer

Encrypt data with application-level keys stored in Secret Manager and decrypt in the application before writing to Cloud Storage.

Answer

Use Google-managed encryption keys (GMEK) with default Cloud KMS encryption for all services.

Question 10

Your organization runs a batch analytics platform that ingests data from a Pub/Sub topic into Cloud Storage, then loads it into BigQuery using a Dataflow streaming pipeline. The pipeline must handle sudden bursty traffic during month-end reporting, and you want to minimize operational overhead while ensuring the pipeline scales automatically. Which architectural approach should you choose?

Accepted Answer

Use a Dataflow streaming pipeline with autoscaling enabled, reading from Pub/Sub and writing to Cloud Storage and BigQuery.. A Dataflow streaming pipeline with autoscaling is the most suitable choice because it automatically adjusts worker count to handle bursty Pub/Sub traffic, integrates natively with Cloud Storage and BigQuery, and minimizes operational overhead. It provides exactly-once processing and handles backpressure, ensuring reliable and scalable analytics during month-end peaks.

Answer

Deploy a Compute Engine managed instance group running a custom ingestion script, and configure an autoscaler based on Pub/Sub queue depth.

Answer

Use a Dataproc cluster with autoscaling to run a Spark Streaming job that reads from Pub/Sub and writes to BigQuery.

Answer

Create a Cloud Function that triggers on each Pub/Sub message and writes directly to BigQuery and Cloud Storage.

Question 11

A retail company runs its e-commerce checkout service on a single Compute Engine instance in us-central1. The service must survive a zonal outage with minimal data loss and automatic failover, but the operations team is small and does not want to manage replication or failover scripts themselves. Which design should the architect recommend?

Accepted Answer

Deploy the checkout service as a regional managed instance group across three zones in us-central1 behind a global external Application Load Balancer, and store session state in a regional Cloud SQL for PostgreSQL instance with automatic failover.. Surviving a zonal outage with minimal data loss and no custom failover logic requires managed, zone-redundant building blocks at every tier. A regional managed instance group combined with a global external Application Load Balancer keeps serving traffic when a zone disappears, and a regional Cloud SQL instance promotes its standby automatically. Together these services remove the need for the small operations team to write or run replication and failover scripts.

Answer

Create a snapshot schedule for the instance boot disk and a Cloud Scheduler job that recreates the VM in a different zone when a Cloud Monitoring uptime check fails.

Answer

Keep the single instance but attach a regional persistent disk, and add a second instance in another zone that mounts the same disk read-only for reporting.

Answer

Move the service to two standalone Compute Engine instances in different zones and use a network load balancer with a health check, keeping the database on the original instance's local SSD.

Question 12

A multinational manufacturer is planning its first Google Cloud landing zone. The security team requires that no data be stored outside approved European regions, that all workloads authenticate using short-lived credentials tied to their Google identities, and that network egress to the public internet be centrally inspected and logged. The platform team wants to minimize per-project configuration. Which two design elements should the architect include in the landing zone? (Choose two.)

Accepted Answer

Deploy a centralized Shared VPC host project with a firewall policy and Cloud NAT in a spoke architecture, routing egress through a central inspection project.. The landing zone needs organization-level enforcement that propagates automatically. A resource location organization policy at the root keeps data in approved European regions, and a Shared VPC host project with hierarchical firewall policies and a central inspection project centralizes and logs egress. Together these meet the security requirements while minimizing per-project work.

Answer

Enable Cloud Armor on each project's load balancers and rely on its logging for internet egress visibility.

Answer

Configure Cloud Identity-Aware Proxy on every project and require users to authenticate with long-lived service account keys.

Answer

Grant the Editor role to all developers at the organization node so they can create resources without per-project IAM changes.

Question 13

An e-commerce platform uses Cloud Spanner for order processing. Recently, latency spikes have occurred during flash sales. The team suspects hot spots due to monotonically increasing order IDs. Which table design change would best solve this?

Accepted Answer

Add a random prefix to the order ID primary key.. Monotonically increasing primary keys (like sequential order IDs) cause hot spots in Cloud Spanner because all writes are directed to a single split (tablet), overwhelming that node. Adding a random prefix (e.g., a hash of the customer ID) distributes writes across multiple splits, eliminating the hot spot and reducing latency spikes during high-throughput flash sales.

Answer

Remove the primary key and let Spanner auto-generate it.

Answer

Use interleaved tables to store orders under customers.

Answer

Create a secondary index on the timestamp column.

Question 14

A media company stores 400 TB of video assets in a Cloud Storage bucket in the europe-west1 region. Editors in Tokyo and São Paulo complain about slow first-byte times when previewing assets. The architect must improve read latency for these global users while keeping a single canonical copy of each object and avoiding application changes that rewrite object paths. Which approach best meets these requirements?

Accepted Answer

Enable Cloud CDN on a global external Application Load Balancer with a backend bucket pointing at the existing Cloud Storage bucket.. Cloud CDN attached to a global external Application Load Balancer with a backend bucket serves Cloud Storage content from Google's globally distributed edge caches. Readers in Tokyo and São Paulo are answered by a nearby point of presence, improving first-byte latency, while the europe-west1 bucket remains the sole origin and canonical copy. Because requests still use the same object paths through the load balancer, no application rewrite is required.

Answer

Use Storage Transfer Service to copy objects into regional buckets in asia-northeast1 and southamerica-east1, and update the application to select the closest bucket.

Answer

Change the bucket's default storage class to Standard and enable Autoclass so objects are served from the nearest edge cache.

Answer

Create a multi-region bucket and migrate the objects, then serve reads from the same object names in the new bucket.

Question 15

A healthcare analytics company is designing a BigQuery-based data warehouse that ingests patient records from multiple hospitals. Regulatory requirements mandate that queries never move data across regional boundaries and that only authorized analysts can access patient-identifiable columns. The architects want to enforce these controls at the platform level rather than relying on application code. Which combination of Google Cloud features should they design into the solution?

Accepted Answer

BigQuery dataset location set to a single region, VPC Service Controls perimeter around the project, and column-level security using policy tags in Data Catalog.. Data residency is enforced by pinning the BigQuery dataset to a single region. Preventing exfiltration and restricting access to authorized identities and networks is the role of VPC Service Controls. Column-level least privilege for patient-identifiable fields is achieved with policy tags in Data Catalog, which BigQuery enforces natively. This trio addresses residency, perimeter, and column-level authorization at the platform layer.

Answer

BigQuery dataset location set to a single region, authorized views that exclude patient-identifiable columns, and Cloud Armor security policies on the BigQuery API endpoint.

Answer

BigQuery multi-region dataset, Cloud IAM basic roles for analysts, and Cloud DLP inspection jobs scheduled daily.

Answer

BigQuery dataset location set to a single region, IAM conditions based on resource names, and customer-managed encryption keys in Cloud KMS.