Google PCA Design and plan a cloud solution architecture Practice Test 10 — 15 Questions

Question 1

A healthcare company is designing a new patient portal on Google Cloud. Regulatory requirements mandate that all data at rest be encrypted with keys the company controls and can rotate on its own schedule, and that the keys never leave a hardware security module (HSM). The security team also wants to retain the ability to revoke Google's access to the data if the external key becomes unavailable. Which key management design should you recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Cloud External Key Manager (Cloud EKM) with a supported external key management partner and an HSM-backed external key.. Cloud External Key Manager is the only option that keeps key material outside Google Cloud in a partner HSM while still integrating with Google Cloud services for encryption at rest. It supports customer-controlled rotation and, critically, allows the customer to revoke Google's access by disabling the external key. CMEK and GMEK keep key custody inside Google, which does not meet the external control and revocation mandate.

Answer

Create a Cloud KMS key ring with HSM protection level and use customer-managed encryption keys (CMEK) for the services.

Answer

Encrypt data with application-level keys stored in Secret Manager and decrypt in the application before writing to Cloud Storage.

Answer

Use Google-managed encryption keys (GMEK) with default Cloud KMS encryption for all services.

Question 2

A logistics company runs a latency-sensitive inventory service on Compute Engine in us-central1. The service writes to a Cloud SQL for MySQL instance and reads from a Memorystore for Redis cache. The architect must design for a zone failure in us-central1 with minimal data loss and automatic failover, without changing the application's connection strings. Which design should the architect choose?

Accepted Answer

Deploy the service in a managed instance group across three zones, use a Cloud SQL for MySQL regional instance with a primary and standby, and configure Memorystore for Redis in Standard Tier with automatic failover.. Spreading the service across zones with a regional managed instance group, pairing it with a Cloud SQL regional instance that has a standby in another zone, and using Memorystore Standard Tier with automatic failover together address zone failure at every tier. Each component exposes stable endpoints, so the application keeps its existing connection strings.

Answer

Deploy the service in a multi-region managed instance group, use Cloud Spanner instead of Cloud SQL, and use Memorystore for Redis in Basic Tier.

Answer

Deploy the service across two zones, use a Cloud SQL for MySQL regional instance, and run a self-managed Redis cluster on Compute Engine with Sentinel.

Answer

Deploy the service in a zonal managed instance group, use a Cloud SQL for MySQL zonal instance, and enable Memorystore for Redis Basic Tier with read replicas.

Question 3

A retail company is designing a new microservices architecture on Google Cloud. They want to minimize operational overhead, enable independent deployment of services, and ensure that a failure in one service does not cascade to others. They also want to use managed services where possible. Which two design choices should the architect recommend? (Choose two.)

Accepted Answer

Implement asynchronous communication between services using Pub/Sub topics. Cloud Run per microservice with distinct service accounts provides managed scaling, independent deployment, and least-privilege isolation. Pub/Sub enables asynchronous, durable communication that prevents cascading failures and decouples services. Together they meet the goals of minimal operational overhead, independent deployability, and fault isolation. Shared databases, single VMs, and shared GKE namespaces introduce coupling and operational burden.

Answer

Deploy all microservices into a single Google Kubernetes Engine cluster with a shared namespace

Answer

Use a single Compute Engine instance running all microservices in Docker containers

Answer

Use a shared Cloud SQL instance with a single database for all microservices

Question 4

A retail company is planning a Google Cloud organization structure for a new e-commerce platform. They want to isolate production from non-production, allow central network and security teams to apply guardrails across all projects, and give application teams self-service within their own boundaries. Which two design choices support these goals? (Choose two.)

Accepted Answer

Use a Shared VPC host project owned by the central network team, with application projects attached as service projects.. A folder hierarchy with production and non-production branches lets central teams apply organization policies and IAM that inherit downward, while application teams create projects inside their assigned folder. Pairing that with a Shared VPC host project centralizes network control and lets service projects consume the network, so application teams get self-service deployment without owning network topology.

Answer

Place every project directly under the organization node and manage IAM individually per project.

Answer

Assign each application team the Project Creator role at the organization node so they can create projects anywhere.

Answer

Grant the central network team the Organization Administrator role so they can manage all projects directly.

Question 5

Your organization runs a batch analytics platform that ingests data from a Pub/Sub topic into Cloud Storage, then loads it into BigQuery using a Dataflow streaming pipeline. The pipeline must handle sudden bursty traffic during month-end reporting, and you want to minimize operational overhead while ensuring the pipeline scales automatically. Which architectural approach should you choose?

Accepted Answer

Use a Dataflow streaming pipeline with autoscaling enabled, reading from Pub/Sub and writing to Cloud Storage and BigQuery.. A Dataflow streaming pipeline with autoscaling is the most suitable choice because it automatically adjusts worker count to handle bursty Pub/Sub traffic, integrates natively with Cloud Storage and BigQuery, and minimizes operational overhead. It provides exactly-once processing and handles backpressure, ensuring reliable and scalable analytics during month-end peaks.

Answer

Deploy a Compute Engine managed instance group running a custom ingestion script, and configure an autoscaler based on Pub/Sub queue depth.

Answer

Use a Dataproc cluster with autoscaling to run a Spark Streaming job that reads from Pub/Sub and writes to BigQuery.

Answer

Create a Cloud Function that triggers on each Pub/Sub message and writes directly to BigQuery and Cloud Storage.

Question 6

A media company is designing a new content delivery architecture on Google Cloud. Users worldwide download large video files, and the company wants to serve them from a global edge cache while keeping the origin bucket private. They also want to reduce egress cost by caching at the edge. Which Google Cloud service should you recommend as the front end for this architecture?

Accepted Answer

Cloud CDN with a global external Application Load Balancer and a Cloud Storage backend bucket.. Cloud CDN integrated with a global external Application Load Balancer and a Cloud Storage backend bucket delivers content from Google's global edge, cutting latency for worldwide users and reducing origin egress by serving cached responses. The bucket stays private because only the load balancer's service account is granted read access, so the architecture meets both the caching and privacy requirements.

Answer

A regional external Application Load Balancer in front of a Managed Instance Group that serves the video files from local SSD.

Answer

Cloud Storage with a multi-region bucket and signed URLs generated per user request.

Answer

Cloud Interconnect between the company's data center and a Google Cloud region, with the bucket served from that region.

Question 7

Your company is deploying a multi-tier application on Google Cloud. The application consists of a web frontend running on Compute Engine instances, a backend API running on Google Kubernetes Engine (GKE), and a Cloud SQL for MySQL database. You need to design the network architecture to ensure that the web frontend can communicate with the backend API, and the backend API can access the Cloud SQL database, while minimizing exposure to the public internet. Which two design choices should you implement? (Choose two.)

Accepted Answer

Place the web frontend and backend API in the same VPC network but different subnets, and configure firewall rules to allow traffic only from the frontend subnet to the backend API on the required port.. The correct choices are to place both tiers in the same VPC with firewall rules restricting traffic, and to enable Private Service Access for Cloud SQL. This ensures internal communication without public internet exposure. Using a single VPC simplifies security, and Private Service Access provides private connectivity to Cloud SQL, meeting the requirement to minimize public exposure.

Answer

Use Cloud VPN to connect the web frontend and backend API over an encrypted tunnel, even though they are in the same Google Cloud region.

Answer

Assign external IP addresses to all Compute Engine instances and GKE nodes, and use firewall rules to restrict access to specific source IP ranges.

Answer

Create a separate VPC network for each tier and use VPC peering to connect them, then configure firewall rules to allow traffic between the peered networks.

Question 8

A retail company runs its order-processing platform on Compute Engine instances in a single managed instance group (MIG) spread across three zones in us-central1. During seasonal peaks, the application must handle up to 10x normal traffic while keeping median request latency under 200 ms. The architecture team wants to add a caching layer that can absorb repeated catalogue reads and survive the loss of an entire zone without manual intervention. Which design should they choose?

Accepted Answer

Deploy Memorystore for Redis in Standard Tier with a replica in a second zone and configure the application to read from the Redis endpoint.. The requirement combines zone-level resilience, low-latency repeated reads, and no manual failover. A managed in-memory cache with automatic cross-zone replication satisfies all three simultaneously: replication handles the zone loss, in-memory storage handles the latency, and the managed endpoint removes manual steps. Options that lack a replica or that push orchestration onto the team fail at least one stated constraint, and edge HTTP caching does not fit dynamic internal reads.

Answer

Deploy Memorystore for Redis in Basic Tier and place the instance in the same zone as the majority of the MIG instances to reduce network latency.

Answer

Deploy a self-managed Redis cluster on Compute Engine instances distributed across three zones and manage replication and failover with your own scripts.

Answer

Enable Cloud CDN with a backend service pointed at the MIG, and rely on edge caching to serve repeated catalogue reads.

Question 9

A retail company runs its e-commerce checkout service on a single Compute Engine instance in us-central1. The service must survive a zonal outage with minimal data loss and automatic failover, but the operations team is small and does not want to manage replication or failover scripts themselves. Which design should the architect recommend?

Accepted Answer

Deploy the checkout service as a regional managed instance group across three zones in us-central1 behind a global external Application Load Balancer, and store session state in a regional Cloud SQL for PostgreSQL instance with automatic failover.. Surviving a zonal outage with minimal data loss and no custom failover logic requires managed, zone-redundant building blocks at every tier. A regional managed instance group combined with a global external Application Load Balancer keeps serving traffic when a zone disappears, and a regional Cloud SQL instance promotes its standby automatically. Together these services remove the need for the small operations team to write or run replication and failover scripts.

Answer

Create a snapshot schedule for the instance boot disk and a Cloud Scheduler job that recreates the VM in a different zone when a Cloud Monitoring uptime check fails.

Answer

Keep the single instance but attach a regional persistent disk, and add a second instance in another zone that mounts the same disk read-only for reporting.

Answer

Move the service to two standalone Compute Engine instances in different zones and use a network load balancer with a health check, keeping the database on the original instance's local SSD.

Question 10

A financial services firm is designing a new payment-processing platform on Google Cloud. Regulatory requirements mandate that data never leaves the European Union, that encryption keys are generated and stored on hardware the firm controls inside its own data center, and that the firm can revoke key access instantly. The security team wants to use Cloud KMS but is unsure it meets all three requirements. Which combination of services should the architect recommend?

Accepted Answer

Cloud External Key Manager (Cloud EKM) with a supported external key manager in the firm's data center, plus organization policy constraints to restrict resource locations.. The three requirements are EU data residency, self-controlled key hardware, and instant revocation. Only an external key manager integration satisfies all three because the keys physically live in the firm's data center and Google must reach out to them for every unwrap operation. Location constraints in organization policy handle the residency requirement, and severing the external key path provides the immediate revocation the security team wants.

Answer

Customer-managed encryption keys (CMEK) stored in a Cloud KMS key ring in europe-west1, with Cloud HSM backing.

Answer

Cloud KMS with CMEK and a key ring in europe-west4, combined with VPC Service Controls perimeters around all data services.

Answer

Cloud KMS with a multi-region key ring in europe, plus organization policy constraints to restrict resource locations.

Question 11

A retail company is planning to move its on-premises data warehouse to Google Cloud. They need a fully managed, petabyte-scale analytics database that supports standard SQL and can ingest data in real time from Pub/Sub. They also want to minimize administration and cost. Which Google Cloud service should they choose?

Accepted Answer

BigQuery. BigQuery is the correct choice because it is a fully managed, petabyte-scale analytics database that supports standard SQL and integrates with Pub/Sub for real-time data ingestion. It minimizes administration and offers cost-effective pricing, making it ideal for moving an on-premises data warehouse to Google Cloud.

Answer

Bigtable

Answer

Cloud SQL for PostgreSQL

Answer

Cloud Spanner

Question 12

A retail company is deploying a customer-facing API on Google Cloud. The API must survive the loss of an entire region with minimal data loss and must serve users in North America, Europe, and Asia with low latency. The database layer must support strongly consistent reads and writes. Which design should the architect choose for the data tier?

Accepted Answer

Cloud Spanner with a multi-region instance configuration, with application instances reading and writing through regional endpoints.. Cloud Spanner is the Google Cloud database that provides synchronous multi-region replication with external consistency, so losing a region does not lose committed writes and reads stay strongly consistent. Regional endpoints let each continent's application instances talk to nearby replicas while the multi-region quorum maintains durability and correctness.

Answer

Firestore in Datastore mode with a multi-region location and client-side caching of query results.

Answer

Bigtable with a multi-cluster routing policy and application-level retries for failed writes.

Answer

A single Cloud SQL for PostgreSQL instance in us-central1 with cross-region read replicas in europe-west1 and asia-east1.

Question 13

A logistics company is planning its first Google Cloud landing zone. It has three business units that must be billed separately, a central network team that manages shared VPCs, and a security team that needs to apply guardrails across everything. Which resource hierarchy design should the architect recommend?

Accepted Answer

Create folders per business unit and per environment under the organization, place application projects inside those folders, and create a separate shared networking project owned by the central network team.. The scenario calls for delegated administration, separate billing, central networking, and organization-wide guardrails. A hierarchy of folders by business unit and environment lets policy and IAM inherit cleanly, projects give billing and isolation boundaries, and a dedicated shared networking project is the canonical host for shared VPC. Flattening everything, collapsing into one project, or splitting into multiple organizations each breaks at least one of these requirements.

Answer

Create one project per business unit, place all projects directly under the organization node, and use labels to separate billing and security policies.

Answer

Create a single project for the whole company and use IAM roles and labels to separate business units, environments, and network administration.

Answer

Create one organization per business unit, each with its own projects, and link them with VPC peering for shared network services.

Question 14

Your organization is deploying a global e-commerce platform on Google Cloud. The platform uses a microservices architecture running on GKE, and you need to route external HTTP(S) traffic to different services based on URL paths and also provide global load balancing with low latency. You also want to offload SSL/TLS termination and protect against DDoS attacks. Which Google Cloud service should you use?

Accepted Answer

Global external HTTP(S) Load Balancer with a URL map and Google-managed SSL certificates, integrated with Cloud Armor.. The global external HTTP(S) Load Balancer is the only option that provides global anycast load balancing, URL path-based routing, Google-managed SSL certificates for TLS termination, and integration with Cloud Armor for DDoS protection. It is designed for external HTTP(S) traffic and meets all the stated requirements for a global e-commerce platform.

Answer

Internal HTTP(S) Load Balancer with a URL map and Google-managed SSL certificates, integrated with Cloud Armor.

Answer

TCP Proxy Load Balancer with a backend service and Google-managed SSL certificates, integrated with Cloud Armor.

Answer

Regional external HTTP(S) Load Balancer with a URL map and self-managed SSL certificates, integrated with Cloud CDN.

Question 15

A multinational manufacturer is planning its first Google Cloud landing zone. The security team requires that no data be stored outside approved European regions, that all workloads authenticate using short-lived credentials tied to their Google identities, and that network egress to the public internet be centrally inspected and logged. The platform team wants to minimize per-project configuration. Which two design elements should the architect include in the landing zone? (Choose two.)

Accepted Answer

Deploy a centralized Shared VPC host project with a firewall policy and Cloud NAT in a spoke architecture, routing egress through a central inspection project.. The landing zone needs organization-level enforcement that propagates automatically. A resource location organization policy at the root keeps data in approved European regions, and a Shared VPC host project with hierarchical firewall policies and a central inspection project centralizes and logs egress. Together these meet the security requirements while minimizing per-project work.

Answer

Enable Cloud Armor on each project's load balancers and rely on its logging for internet egress visibility.

Answer

Configure Cloud Identity-Aware Proxy on every project and require users to authenticate with long-lived service account keys.

Answer

Grant the Editor role to all developers at the organization node so they can create resources without per-project IAM changes.