Google PCA Design and plan a cloud solution architecture — 10 Questions

Question 1

A financial services company is designing a multi-tier application on Google Cloud. The application must meet PCI DSS compliance, with data encrypted at rest and in transit. They plan to use Cloud SQL for PostgreSQL for transactional data and Cloud Storage for archival data. Which TWO actions should the architect take to meet compliance requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable customer-managed encryption keys (CMEK) on Cloud SQL and Cloud Storage. Option C is correct because enabling customer-managed encryption keys (CMEK) on Cloud SQL and Cloud Storage gives the organization control over the key lifecycle via Cloud KMS, which PCI DSS auditors typically require for demonstrating ownership and rotation of encryption keys protecting cardholder data at rest. Option D is correct because VPC Service Controls creates a service perimeter around Cloud SQL and Cloud Storage APIs, preventing data exfiltration and unauthorized access from outside the trusted perimeter, which directly supports PCI DSS network and access-control requirements for in-transit protection. Options A, B, and E are not the right choices: client-side encryption (A) adds complexity and does not by itself satisfy the full scope of PCI DSS controls for managed services; relying solely on Google-managed default encryption (B) removes customer control over keys, which auditors often reject; and Cloud HSM with an externally generated key (E) is not required for Cloud SQL/Cloud Storage CMEK and is over-engineered for this scenario.

Answer

Configure client-side encryption in the application code

Answer

Rely on Google-managed default encryption for all data

Answer

Use Cloud HSM with a key generated outside of Google Cloud

Question 2

Refer to the exhibit. An architect created a VM instance using the above command. After the instance starts, the architect tries to access the nginx default page from the internet but gets a timeout. What is the most likely reason?

Accepted Answer

The VM was created without an external IP address. The most likely reason for the timeout is that the VM was created without an external (public) IP address. Without an external IP, the VM is not directly reachable from the internet, even if nginx is running and firewall rules allow HTTP traffic. The timeout occurs because the internet has no route to the VM's private IP address.

Answer

The VM is in a subnet without a Cloud NAT

Answer

The firewall rule allowing HTTP traffic is missing

Answer

The startup script failed to install nginx

Question 3

A media streaming company is deploying a new video transcoding pipeline on Google Cloud. The pipeline receives raw video files uploaded to Cloud Storage, triggers a Cloud Function that submits transcoding jobs to a Compute Engine worker pool, and stores the transcoded output in another Cloud Storage bucket. The workers are managed by a managed instance group (MIG) running a custom container image. Currently, when there is a spike in uploads, the MIG takes 5-7 minutes to scale up new workers, causing processing delays. The architect needs to reduce the time to add new workers to under 2 minutes. The workers are stateless and the container image is about 2 GB. What should the architect do?

Accepted Answer

Create a custom Compute Engine image that includes the container runtime and pre-pulled container. Creating a custom Compute Engine image that includes the container runtime and pre-pulls the 2 GB container image eliminates the need to download the image during scale-up. This reduces the instance startup time from 5-7 minutes to under 2 minutes, as the container is already cached locally on the image, bypassing the network pull delay.

Answer

Use Cloud Run instead of Compute Engine to run the transcoding workers

Answer

Increase the minimum number of instances in the MIG to 10

Answer

Replace the Compute Engine workers with Cloud Functions to handle the transcoding

Question 4

A financial services company is designing a multi-tier application on Google Cloud. The application must meet PCI DSS compliance, with data encrypted at rest and in transit. They plan to use Cloud SQL for PostgreSQL for transactional data and Cloud Storage for archival data. Which TWO actions should the architect take to meet compliance requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy the application in two regions with active-active traffic load balancing and Cloud Spanner multi-region configuration.. It uses Cloud Spanner's multi-region configuration, which provides synchronous replication across regions with automatic failover, meeting an RPO of 15 minutes (typically seconds) and an RTO of 1 hour. Active-active traffic load balancing with Compute Engine ensures that the application can immediately route traffic to the healthy region, minimizing downtime without the need for manual failover or backup/restore operations.

Answer

Deploy in one region with scheduled snapshots to Cloud Storage and use persistent disk snapshots for recovery.

Answer

Deploy in two regions with active-passive using Cloud Load Balancing and Cloud Spanner backup/restore.

Answer

Use a single region with Cloud SQL for PostgreSQL and enable cross-region replication using Cloud SQL replica.

Question 5

Match each Google Cloud service to its primary purpose.

Accepted Answer

Cloud VPC: Isolated virtual network for GCP resources. These are core networking services in GCP. Cloud VPC provides isolated virtual networks, Cloud Load Balancing distributes traffic, Cloud CDN caches content at the edge, and Cloud NAT enables outbound internet for private instances. Common confusion: mixing up VPC and Load Balancing definitions, or CDN and NAT.

Answer

Cloud VPC: Distributes incoming traffic across multiple instances

Answer

Cloud CDN: Network address translation for private instances to access internet

Question 6

A company has a hub-and-spoke VPC topology with multiple on-premises locations connected via Cloud VPN to the hub VPC. They notice IP conflicts because overlapping CIDR ranges are used in different spokes. The network team wants to allow communication between spokes without re-IPing. What should they do?

Accepted Answer

Use Cloud NAT in each spoke and private routing via the hub with network tags to distinguish ranges.. Using Cloud VPN tunnels between spokes through the hub allows the hub to route traffic between spokes based on the tunnel interfaces. By assigning unique IP addresses to each tunnel endpoint (e.g., 10.254.0.1 for Spoke A and 10.254.0.2 for Spoke B), the hub can forward packets without relying on the overlapping spoke CIDRs. The spokes use static routes pointing to their respective tunnel interfaces, ensuring that traffic is encapsulated over IPsec and decapsulated at the destination, bypassing the IP conflict. This approach avoids re-IPing while enabling communication, though it introduces additional overhead and complexity.

Answer

Use Cloud VPN tunnels between spokes through the hub.

Answer

Configure static routes in the hub to summarize ranges with a smaller prefix.

Answer

Create VPC peering between each spoke VPC.

Question 7

An organization has multiple Google Cloud projects that need to access a shared Cloud SQL database. The database should only be accessible from authorized projects. What is the most secure way to grant access?

Accepted Answer

Configure the Cloud SQL instance with a private IP in a shared VPC and grant IAM roles to the authorized projects.. Using a private IP in a shared VPC ensures that Cloud SQL is not exposed to the public internet, and IAM roles (e.g., roles/cloudsql.client) allow fine-grained access control at the project level. This approach leverages VPC peering or shared VPC to restrict network access exclusively to authorized projects, eliminating the need for public IPs or complex VPN configurations while maintaining high security.

Answer

Use Cloud SQL Proxy on each project's Compute Engine instances.

Answer

Expose the Cloud SQL instance on a public IP and authorize the IP ranges of the projects.

Answer

Set up a Cloud VPN between each project's VPC and the VPC hosting Cloud SQL.

Question 8

A company is building a real-time data pipeline that ingests events from IoT devices, processes them with Apache Beam, and stores results in BigQuery for analytics. The pipeline must handle spikes in traffic and guarantee exactly-once processing. Which combination of services should they use?

Accepted Answer

Cloud Pub/Sub, Dataflow, and BigQuery.. Cloud Pub/Sub provides scalable, asynchronous ingestion for IoT event spikes, Dataflow (which runs Apache Beam) offers exactly-once processing semantics via checkpointing and idempotent sinks, and BigQuery serves as the analytics destination. This combination meets all requirements: Pub/Sub decouples producers from consumers, Dataflow handles stateful processing with exactly-once guarantees, and BigQuery supports real-time streaming inserts.

Answer

Cloud Pub/Sub, Dataproc, and BigQuery.

Answer

Cloud IoT Core, Data Fusion, and Cloud Bigtable.

Answer

Cloud Storage, Cloud Functions, and BigQuery.

Question 9

Which TWO statements are true regarding the benefits of using VPC Network Peering over Cloud VPN for connecting two VPC networks?

Accepted Answer

VPC Network Peering provides lower latency because traffic stays within Google's network.. Option A is correct because VPC Network Peering routes traffic directly between the two VPC networks over Google's private backbone, avoiding the public internet and the encryption/decryption overhead of IPsec tunnels, which yields lower latency and higher throughput. Option C is correct because Cloud VPN traffic traverses external IP addresses and is billed for egress, whereas VPC Network Peering traffic stays internal to Google's network and is generally not charged for egress between peered VPCs (though other charges may apply). Option B is wrong because VPC Network Peering is a native Google Cloud feature requiring no VPN gateway appliance or tunnels. Option D is wrong because VPC Network Peering can connect VPC networks across different projects and even different organizations, not only within the same organization. Option E is wrong because Cloud VPN does encrypt traffic via IPsec, but VPC Network Peering traffic is also encrypted in transit within Google's infrastructure, so this is not a differentiating benefit.

Answer

VPC Network Peering requires a separate VPN gateway appliance.

Answer

VPC Network Peering can only be established within the same organization.

Answer

Cloud VPN encrypts traffic, which VPC Network Peering does not.

Question 10

A startup is building a web application that experiences unpredictable traffic spikes. They want a scalable solution that minimizes costs. Which Google Cloud service should they use to run their containerized application?

Accepted Answer

Google Kubernetes Engine (GKE) with autoscaling. Google Kubernetes Engine (GKE) with autoscaling is the correct choice because it combines cluster autoscaling (which adjusts the number of nodes based on pod resource requests) with Horizontal Pod Autoscaling (which scales the number of pod replicas based on CPU/memory utilization or custom metrics). This dual-layer scaling handles unpredictable traffic spikes efficiently while minimizing costs by only provisioning resources when needed, and it is purpose-built for containerized applications.

Answer

App Engine Standard Environment

Answer

Cloud Run for Anthos

Answer

Compute Engine with managed instance groups