Google PCA Design and plan a cloud solution architecture Practice Test 3 — 15 Questions

Question 1

A financial-services company must deploy a new payment-processing platform on Google Cloud. Regulatory requirements mandate that cryptographic keys used to sign transactions never leave a FIPS 140-2 Level 3 validated hardware security module, and that the company retains full control over key rotation and destruction. The platform runs on Compute Engine VMs and writes to Cloud Storage. Which key-management approach should the architect design?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud HSM with a keyring in the same region as the Compute Engine VMs. The requirement is a customer-controlled, validated hardware boundary for signing keys with full lifecycle control. Cloud HSM keyrings satisfy FIPS 140-2 Level 3, keep key material inside the HSM, and integrate with Compute Engine and Cloud Storage through CMEK. Software keys, on-premises CSEK, and Cloud EKM either lack the validated hardware boundary or do not cover the signing use case the platform needs.

Answer

Cloud External Key Manager backed by a third-party key store that the company already operates on-premises

Answer

Cloud KMS with software-protection-level keys stored in a multi-region keyring

Answer

Customer-supplied encryption keys generated on-premises and passed to the Google Cloud API on each request

Question 2

A financial services company needs to process sensitive data in Google Cloud. The data must be encrypted at rest with keys that the company controls, and the keys must be stored in a hardware security module (HSM) that is FIPS 140-2 Level 3 validated. The company also requires the ability to automatically rotate keys every 90 days and to audit all key usage. Which Google Cloud service should they use?

Accepted Answer

Cloud KMS with HSM protection level. Cloud KMS with HSM protection level provides hardware-backed keys in FIPS 140-2 Level 3 validated HSMs, supports automatic rotation, and logs all key operations to Cloud Audit Logs. This satisfies the financial company's requirements for customer-controlled keys, HSM storage, rotation, and auditing. Other options either lack HSM backing or do not integrate with Google Cloud services for key management.

Answer

Cloud External Key Manager (Cloud EKM)

Answer

Cloud Key Management Service (KMS) with software protection level

Answer

Cloud HSM

Question 3

A logistics company is planning its Google Cloud resource hierarchy. It has one central platform team and four business units, each of which must control its own projects and IAM policies while still inheriting mandatory security controls from the central team. Billing must be reported per business unit, and the central team must be able to view all resources but not modify business unit workloads. Which structure should the architect recommend?

Accepted Answer

Create one folder per business unit under the organization, grant the central team roles/viewer at the organization level, and grant each business unit owner access at its folder.. Folders are the mechanism for delegating administration while preserving centralized control. Placing a folder per business unit under the organization lets each unit own its projects and policies, while policies applied higher in the hierarchy cascade down as mandatory controls. Granting the central team a viewer role at the organization level satisfies the visibility requirement without conferring modification rights over business unit workloads.

Answer

Create each business unit's projects directly under the organization with no folders and grant the central team roles/iam.securityAdmin at the organization level.

Answer

Create one folder per business unit and grant the central team roles/owner at the organization level so it can enforce security controls everywhere.

Answer

Create a single project for each business unit and use labels to separate cost reporting, granting the central team roles/editor on all of them.

Question 4

A company is deploying a new application on Google Cloud. The application consists of a frontend web service and a backend API. The frontend must be accessible from the internet over HTTPS, and the backend must only be accessible from the frontend. The company wants to minimize operational overhead and ensure the backend is not exposed to the internet. What should they do?

Accepted Answer

Deploy the frontend on Cloud Run with ingress set to 'all' and the backend on Cloud Run with ingress set to 'internal'. Use a Serverless VPC Access connector to allow the frontend to reach the backend.. Cloud Run provides a fully managed serverless environment, reducing operational overhead. By setting the frontend's ingress to 'all', it can receive public HTTPS traffic. The backend's ingress set to 'internal' ensures it only accepts traffic from the VPC. A Serverless VPC Access connector allows the frontend to communicate with the backend privately. This architecture meets the security and accessibility requirements with minimal management.

Answer

Deploy both frontend and backend as Compute Engine VMs. Assign a public IP to the frontend VM and no public IP to the backend VM. Configure a firewall rule to allow traffic from the frontend VM's internal IP to the backend VM on the API port.

Answer

Deploy the frontend on App Engine standard environment and the backend on App Engine flexible environment. Configure the backend to use ingress controls to allow only traffic from the frontend service.

Answer

Deploy the frontend on Cloud Run with serverless VPC access, and the backend on Cloud Run with ingress set to 'internal and cloud load balancing'. Use a private service connect endpoint for the backend.

Question 5

An e-commerce company is designing a new order processing system on Google Cloud. Orders arrive continuously and must be processed exactly once, in order per customer, and the system must scale to handle bursts up to 50,000 messages per second. The architecture team wants minimal operational overhead and no message loss. Which design should the architect recommend?

Accepted Answer

Pub/Sub with ordering keys and a pull subscription processed by Dataflow with exactly-once and deduplication. The combination of Pub/Sub ordering keys and a pull subscription consumed by Dataflow provides per-customer ordering, high throughput, and exactly-once processing when paired with idempotent sinks. Push subscriptions introduce redelivery risk, Cloud Tasks does not scale to the required message rate, and Pub/Sub without ordering keys cannot guarantee per-customer order. The selected design balances scale, ordering, and delivery semantics.

Answer

Cloud Tasks queue with HTTP target and deduplication by task name

Answer

Pub/Sub topic with a pull subscription and Dataflow exactly-once processing

Answer

Pub/Sub with ordering keys enabled and a push subscription to Cloud Run

Question 6

A financial services company is designing a new PCI-DSS-regulated payment processing platform on Google Cloud. The platform must be isolated from the company's existing corporate workloads, and a dedicated security team needs to centrally enforce network controls and view audit logs across all environment projects without being able to modify application resources. Which Google Cloud resource hierarchy design should the architect choose?

Accepted Answer

Create a new folder named 'Payments' under the organization, place all environment projects inside it, and grant the security team the Security Admin and Logging Viewer roles at the folder level.. A dedicated folder under the existing organization gives the payments platform a clear isolation boundary while preserving centralized billing, identity, and policy inheritance. Folder-level IAM bindings automatically apply to all current and future child projects, which satisfies the centralized enforcement requirement without granting the security team the ability to modify application resources.

Answer

Place all projects directly under the organization root and grant the security team Compute Security Admin and Logs Viewer on each project individually.

Answer

Create a new organization for the payments platform, migrate all projects into it, and grant the security team Organization Administrator on the new organization.

Answer

Create a shared VPC host project in the corporate hierarchy and attach the payments projects as service projects, granting the security team Project IAM Admin on the host project.

Question 7

A financial services company is designing a hybrid cloud architecture that connects its on-premises data center to Google Cloud. The company requires a dedicated, private connection with high throughput and low latency for mission-critical workloads. They also need to ensure that the connection is resilient to a single point of failure. Which two actions should they take? (Choose two.)

Accepted Answer

Provision two Dedicated Interconnect connections in different Google Cloud regions.. To achieve a resilient, high-throughput hybrid connection, two Dedicated Interconnect connections in different regions provide primary redundancy, and a Cloud VPN backup adds an extra failover path. This combination ensures that no single failure disrupts connectivity. The other options either lack redundancy or do not meet the performance requirements.

Answer

Set up a Partner Interconnect connection through a service provider in the same metropolitan area.

Answer

Enable Cloud CDN to cache traffic between on-premises and Google Cloud.

Answer

Use a single Dedicated Interconnect connection with a 100 Gbps circuit to reduce complexity.

Question 8

A company is deploying a new internal web application on Google Cloud. The application runs on a managed instance group of Compute Engine VMs in a single region. The security team requires that the VMs have no public IP addresses and that only employees on the corporate network can reach the application. Which approach should you use to expose the application privately?

Accepted Answer

Configure an internal passthrough Network Load Balancer with a regional internal IP address and restrict access using firewall rules.. An internal passthrough Network Load Balancer exposes the application on a regional internal IP that is only routable inside the VPC or connected networks, so the VMs can remain without public IPs. Firewall rules then restrict which source ranges can reach the load balancer. External load balancers, ephemeral external IPs, and Cloud NAT do not provide private-only inbound access for corporate employees.

Answer

Reserve a global static external IP and attach it to an external Application Load Balancer with Cloud Armor rules allowing only corporate IP ranges.

Answer

Use Cloud NAT to give the VMs outbound internet access and rely on Identity-Aware Proxy for inbound employee access.

Answer

Assign each VM an ephemeral external IP and use VPC firewall rules to allow only corporate CIDR ranges to port 443.

Question 9

A company is designing a hybrid cloud architecture where their on-premises data center connects to a Google Cloud VPC using Cloud VPN. They need to ensure that traffic between on-premises and Google Cloud is encrypted and that the connection is highly available. They also want to minimize latency for latency-sensitive applications. Which two actions should they take? (Choose two.)

Accepted Answer

Configure two Cloud VPN tunnels on different Cloud VPN gateways in different regions, and use dynamic routing (Cloud Router) with BGP.. To achieve high availability and encryption, you should configure multiple Cloud VPN tunnels in different regions with dynamic routing via Cloud Router and BGP. This provides redundancy and automatic failover. Additionally, configuring strong encryption parameters (IKEv2, AES-256) on both the on-premises and Google Cloud VPN gateways ensures that all traffic is encrypted. Together, these actions meet the requirements for a secure, highly available hybrid connection.

Answer

Set up a dedicated Interconnect connection in addition to Cloud VPN, and use Cloud VPN as a backup.

Answer

Use a single Cloud VPN tunnel with high availability (HA) VPN gateway, which provides a 99.99% SLA.

Answer

Enable Cloud VPN with global dynamic routing mode on the VPC, and configure the on-premises router to advertise routes with lower MED values for the primary tunnel.

Question 10

A healthcare analytics company stores patient records in Cloud Storage and must guarantee that objects cannot be deleted or overwritten by any user, including project owners, for seven years. The compliance team also wants a verifiable, cryptographically signed proof of the retention policy. Which combination of controls should the architect design?

Accepted Answer

Create a Bucket Lock retention policy of seven years and enable Object Retention Lock in compliance mode on the objects.. Bucket Lock with a seven-year retention policy makes the retention period immutable at the bucket level, and Object Retention Lock in compliance mode extends that immutability to individual objects in a way no principal can override. These controls satisfy the requirement that even project owners cannot delete or overwrite the records, and they produce the auditable commitment the compliance team needs.

Answer

Enable Object Versioning on the bucket and grant users only the Storage Object Viewer role.

Answer

Store the records in a dual-region bucket with Turbo Replication and enable Cloud Audit Logs for data access.

Answer

Apply a Cloud Storage bucket IAM policy that denies storage.objects.delete to all principals except a break-glass service account.

Question 11

A logistics company is designing a hybrid architecture. Their on-premises data center connects to Google Cloud via Cloud Interconnect. They need to run a batch analytics job that reads 200 TB of data from on-premises storage and writes results to BigQuery. The job runs monthly and must complete within a 6-hour window. They want to minimize data transfer time and cost. Which approach should the architect recommend?

Accepted Answer

Use Transfer Appliance to ship data to Google Cloud, then load into BigQuery. For 200 TB of on-premises data with a tight 6-hour processing window, network transfer over Interconnect or VPN is likely too slow and costly. Transfer Appliance physically ships the data, avoiding network bottlenecks, and then the data is loaded into BigQuery for processing. Storage Transfer Service and BigQuery Data Transfer Service do not address the bulk transfer time constraint as effectively.

Answer

Use Cloud Interconnect to transfer data directly to BigQuery via Storage Transfer Service

Answer

Use a VPN over the internet to transfer data directly to BigQuery

Answer

Use BigQuery Data Transfer Service with a Cloud Interconnect connection

Question 12

A financial services firm is designing a new payment-processing platform on Google Cloud. The architecture team must decide how to organize resources so that each of the firm's four business units can independently manage billing, IAM policies, and quotas, while a central platform team retains the ability to enforce organization-wide security controls. The business units must not be able to see or modify each other's resources. Which Google Cloud resource hierarchy design should the architect recommend?

Accepted Answer

Create one folder per business unit under the organization node, grant each business unit's administrators folder-level IAM roles, and apply organization policies at the organization node.. Placing a folder per business unit beneath the organization node creates the delegated administrative boundary the firm needs, because IAM roles and organization policies inherit downward while each unit's projects remain separate. Central controls applied at the organization node continue to govern every folder and project, and billing can be attributed per folder, satisfying all stated requirements.

Answer

Create a single shared project for all business units and use labels plus IAM conditions to separate resources and billing per unit.

Answer

Create a separate Google Cloud organization for each business unit and link all four organizations to a single shared billing account.

Answer

Create one project per business unit directly under the organization node and grant each business unit the Project Owner role on its own project.

Question 13

A healthcare analytics company runs a batch pipeline that reads 40 TB of de-identified patient records from Cloud Storage, joins them against a 2 TB reference dataset, and writes aggregated results nightly. The reference dataset changes only once per month, and the nightly job must complete within a three-hour window. Cost is a secondary concern, but the job currently fails to finish in time on a standard Dataproc cluster. Which design change should the architect recommend FIRST to meet the window?

Accepted Answer

Materialize the joined reference data as a partitioned, columnar table in BigQuery, then have the nightly Spark job read only the partitions it needs.. The nightly job's bottleneck is repeatedly reading and shuffling a large, mostly static reference dataset. Persisting that dataset in a partitioned, columnar store such as BigQuery and pruning to needed partitions and columns removes the dominant cost, which is the change most likely to bring the run inside the three-hour window.

Answer

Cache the 2 TB reference dataset in a persistent Dataproc cluster's local SSDs and run the nightly job on that warm cluster.

Answer

Increase the Dataproc cluster's primary disk size and switch the job to use the Hadoop Distributed File System instead of Cloud Storage.

Answer

Convert the pipeline to run on Dataproc Serverless for Spark and increase the executor count, letting the service autoscale workers per stage.

Question 14

A media company is designing a batch analytics platform on Google Cloud. Data lands continuously in Cloud Storage, and analysts run ad-hoc SQL queries over several petabytes. The company wants a serverless, petabyte-scale query engine and wants to minimize data movement and cost. Which two design choices should the architect recommend? (Choose two.)

Accepted Answer

Use BigQuery with external tables over the Cloud Storage data and rely on the BigQuery Storage API for query acceleration.. BigQuery external tables over Cloud Storage keep the data in place and avoid duplication, while the Storage API accelerates reads. Layering a partitioned and clustered object layout on top lets the query engine prune partitions and blocks, cutting bytes scanned and cost. Together these choices deliver serverless, petabyte-scale analytics with minimal data movement.

Answer

Use Dataproc with a fixed-size cluster and Hive to query the data in place.

Answer

Replicate the Cloud Storage data into a second bucket in another region and query the replica to reduce latency.

Answer

Load all data into a Cloud SQL for PostgreSQL instance and use read replicas to serve analyst queries.

Question 15

A financial services company is designing a new payment processing platform on Google Cloud. The architecture requires that the encryption keys used for Cloud Storage and BigQuery data be generated, rotated, and stored entirely on the company's on-premises hardware security modules (HSMs), which are not directly reachable from Google Cloud over the public internet. They need a solution that supports key rotation without re-encrypting existing data and provides an audit trail of all cryptographic operations. Which approach should the architect recommend?

Accepted Answer

Use Cloud External Key Manager (Cloud EKM) with an external key manager that communicates with the on-premises HSM through a VPC Service Controls perimeter and Cloud Interconnect.. The requirement is that keys be generated, rotated, and stored on customer-controlled on-premises HSMs, while Google Cloud services still use them for encryption. Cloud External Key Manager is designed exactly for this: it lets an external key manager, including on-premises HSMs, hold the key material and serve wrap/unwrap requests to Google Cloud services. Connectivity over Cloud Interconnect or VPN plus VPC Service Controls satisfies the network constraint, and audit logs record every cryptographic operation.

Answer

Use Customer-Managed Encryption Keys (CMEK) with Cloud KMS and configure the key ring to be backed by a Cloud HSM in the same region as the data.

Answer

Use Google-managed encryption keys and enable Confidential VMs for all workloads that process payment data.

Answer

Use Customer-Supplied Encryption Keys (CSEK) for Cloud Storage and client-side encryption for BigQuery, storing the raw keys in a local hardware security module.