Google PCA Design and plan a cloud solution architecture Practice Test 8 — 15 Questions

Question 1

A financial services company runs a payment processing platform on Compute Engine. Compliance requires that all data at rest be encrypted with keys the company controls and that key material never leave their on-premises HSM appliances. They must also minimize operational overhead for key rotation. Which Google Cloud solution should the architect recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud External Key Manager (Cloud EKM) with an external key manager. The strict requirement is that key material must remain in the company's on-premises HSMs while still protecting Google Cloud resources. Cloud EKM is designed exactly for this: it lets Cloud services use CMEK backed by an external key manager, so Google never holds the key material. CSEK requires manual key handling, Cloud KMS stores keys in Google Cloud, and default encryption gives no customer control.

Answer

Default Google-managed encryption at rest with CMEK disabled

Answer

Customer-supplied encryption keys (CSEK) stored in a local vault

Answer

Cloud KMS with CMEK and automatic rotation

Question 2

A retail company runs a batch analytics workload on Compute Engine. Jobs run nightly, are fault-tolerant, and can be preempted. Finance wants to minimize compute cost while ensuring the jobs still complete each night. The jobs are managed by a Managed Instance Group (MIG) template that must stay within a single zone for data locality compliance. Which configuration should you recommend?

Accepted Answer

Create a zonal MIG with a spot VM instance template and set the autoscaler to scale based on CPU utilization.. Spot VMs offer the largest discount for fault-tolerant, preemptible workloads, and a zonal MIG preserves the single-zone data locality requirement. The autoscaler ensures the nightly job has enough instances to finish on time. Committed use and sustained use discounts target steady-state or long-running workloads, so they do not fit a short nightly batch window. The combination of spot VMs, zonal placement, and CPU-based autoscaling meets both the cost and compliance constraints.

Answer

Create a zonal MIG with E2 standard VMs and configure a sustained use discount to lower the price.

Answer

Create a regional MIG with committed use discounts applied to the template and scale across three zones.

Answer

Create a zonal MIG with custom machine types and use the committed use discount for one-year terms.

Question 3

A multinational retailer is planning its Google Cloud landing zone. Each of the company's business units must be able to create projects and manage billing independently, but the central platform team must retain the ability to enforce network and security guardrails across everything. The company also wants to minimize the number of distinct IAM policy bindings it maintains at the top of the hierarchy. Which two design choices should the architect make? (Choose two.)

Accepted Answer

Apply organization policies such as constraints on allowed resource locations and external IP addresses at the organization node so they are inherited by all folders and projects. Delegating project creation and billing to folder-level roles gives each business unit autonomy while keeping the grant in one place per unit. Applying organization policies at the organization node enforces network and security guardrails through inheritance, so the central team controls every descendant without per-project work. Together these choices satisfy autonomy, central control, and a small number of top-level IAM bindings.

Answer

Grant each business unit's administrators the Organization Administrator role so they can create projects anywhere in the hierarchy

Answer

Create every project directly under the organization node and attach a distinct billing account to each project for isolation

Answer

Use a shared VPC host project per business unit and grant the central team Compute Network Admin on each host project only

Question 4

A media company is designing a hybrid architecture that connects its on-premises data center to a Google Cloud VPC. The company needs high-bandwidth, low-latency, private connectivity that does not traverse the public internet, and it wants redundancy so that a single link failure does not interrupt traffic. The architect is evaluating interconnect options. Which two characteristics apply to Dedicated Interconnect in this scenario? (Choose two.)

Accepted Answer

It requires the customer to establish a minimum of two Interconnect attachments in different edge availability domains to achieve 99.99% availability.. Dedicated Interconnect provides a private physical connection at a supported colocation facility and offers a 99.99% SLA only when at least two attachments are placed in different edge availability domains. Partner Interconnect, HA VPN, and automatic MACsec encryption describe different products or optional features, so they do not accurately characterize Dedicated Interconnect for this hybrid design.

Answer

It can be created entirely over the public internet using IPsec tunnels between the customer gateway and a Cloud VPN gateway.

Answer

It automatically encrypts all traffic with MACsec at the link layer without any customer configuration.

Answer

It is provisioned through a third-party service provider that already has connectivity to Google, without the customer needing colocation space.

Question 5

A financial services firm runs a global trading platform on Google Cloud. The architecture must survive the loss of an entire region with a recovery point objective of zero and a recovery time objective of under one minute, and it must keep strong consistency for order records. Which design should the architect recommend?

Accepted Answer

Deploy the application in two regions behind a global external Application Load Balancer, and store order records in Cloud Spanner with a multi-region instance configuration.. Zero RPO with sub-minute RTO for transactional records requires synchronous replication plus automated failover. Cloud Spanner multi-region configurations replicate synchronously and expose externally consistent reads and writes, so a committed order survives a full region outage. The global external Application Load Balancer provides anycast front ends and health-check-based failover to the surviving region. Together they deliver the availability and consistency guarantees the trading platform needs without manual intervention.

Answer

Deploy the application in two regions behind a global external Application Load Balancer, and store order records in a Cloud SQL for PostgreSQL instance with a cross-region read replica promoted on failover.

Answer

Deploy the application in two regions behind a global external Application Load Balancer, and store order records in a Bigtable instance with a multi-cluster routing policy.

Answer

Deploy the application in two regions behind a global external Application Load Balancer, and store order records in a multi-region Cloud Storage bucket mounted as a file system on the application VMs.

Question 6

A financial services firm is designing a new payment processing system on Google Cloud. The system must expose a single global anycast IP address, terminate TLS at the edge, and route requests to the nearest healthy backend across three regions. The backend services run on Compute Engine and must be protected from volumetric DDoS attacks. Which product should you place in front of the backends?

Accepted Answer

Global external Application Load Balancer with Cloud Armor security policies attached to the backend service.. A global external Application Load Balancer delivers a single global anycast IP, terminates TLS at Google's edge, and uses health-checked backends to route to the nearest region. Cloud Armor security policies attach to the backend service and provide DDoS and web application firewall protection. Regional load balancers cannot offer one global IP, and Layer 4 proxy or passthrough load balancers do not terminate HTTP(S) at the edge or support Cloud Armor in the required way.

Answer

Global external Proxy Network Load Balancer with Google Cloud Armor attached to the target proxy.

Answer

Regional external Application Load Balancer in each region with Cloud CDN enabled for caching.

Answer

External passthrough Network Load Balancer with a global forwarding rule and Cloud Armor on the backend.

Question 7

An IoT company ingests telemetry from 40,000 devices spread across three continents. The architecture team wants a single logical endpoint that automatically routes each device's writes to the nearest healthy Google Cloud region, and they want to avoid managing per-region DNS records or load-balancer IPs. Which design should the architect choose?

Accepted Answer

A global external proxy Network Load Balancer with a single anycast IP and a TCP proxy target proxy. The requirement is one logical anycast endpoint that terminates arbitrary TCP and picks the nearest healthy region. A global external proxy Network Load Balancer does exactly that, with SSL or TCP proxy target proxies and health-checked regional backends. Application Load Balancers are HTTP(S)-only, DNS geolocation needs per-region records, and Interconnect plus an internal passthrough load balancer cannot accept public device traffic.

Answer

A global external Application Load Balancer with a single anycast IP fronting regional backends

Answer

Cloud Interconnect attachments from each continent into a single regional VPC with a regional internal passthrough Network Load Balancer

Answer

Cloud DNS with a geolocation routing policy pointing to regional external passthrough Network Load Balancer IPs

Question 8

A media company stores millions of video master files in a Cloud Storage bucket in the us-central1 region. Files are written once, accessed frequently for the first 30 days during editing and publishing, and then almost never accessed again, though they must remain retrievable for seven years. The company wants to minimize storage cost without changing the objects' names or the way applications read them. Which approach should the architect recommend?

Accepted Answer

Configure an Object Lifecycle Management rule on the bucket that transitions objects to Nearline Storage after 30 days and to Coldline Storage after 365 days. The access pattern is predictable: hot for 30 days, then cold for years. Object Lifecycle Management transitions objects between storage classes in place, so applications keep reading the same object names while the per-gigabyte cost drops as access frequency falls. Approaches that move objects to another bucket or change the default class either break read paths or fail to reclassify existing data.

Answer

Create a second bucket with the Coldline storage class and rewrite each object into it after 30 days using a scheduled job

Answer

Set the bucket's default storage class to Archive and enable Autoclass so objects are promoted on access

Answer

Keep objects in Standard storage and enable Turbo Replication to improve read performance across regions

Question 9

A small e-commerce team wants to deploy a containerized storefront to Google Cloud with minimal operational overhead. Traffic is steady, the team has no Kubernetes expertise, and they want to pay only for what they use while the service scales automatically. Which compute option should the architect recommend?

Accepted Answer

Cloud Run services with request-based autoscaling and scale-to-zero enabled.. The deciding factors are the containerized workload, the lack of Kubernetes skills, and the desire for consumption-based pricing with automatic scaling. Cloud Run accepts a container image, manages all infrastructure, and scales instances up and down with request load, including down to zero when idle. That removes cluster operations entirely while still billing per use, which is exactly the profile the team described.

Answer

Compute Engine managed instance groups with an autoscaling policy based on CPU utilization.

Answer

Google Kubernetes Engine Autopilot cluster with a Horizontal Pod Autoscaler.

Answer

App Engine standard environment with automatic scaling and an instance class sized for peak traffic.

Question 10

A retail company runs a monolithic Java application on Compute Engine instances in a single managed instance group behind an external Application Load Balancer. During a flash sale, the application becomes unresponsive, and the operations team observes that the CPU utilization of all instances reaches 100%. The team wants to ensure that the application remains available during similar events. They need a solution that automatically adjusts capacity based on demand and minimizes manual intervention. Which approach should they take?

Accepted Answer

Configure an autoscaler on the managed instance group to scale based on CPU utilization with a target of 60%.. The managed instance group autoscaler with a CPU utilization target automatically adjusts the number of instances to maintain performance. It is the native, direct solution for scaling Compute Engine workloads based on demand, requiring no application changes. The other options either do not provide automatic scaling, require significant re-architecture, or rely on manual actions that cannot respond quickly enough.

Answer

Increase the size of each Compute Engine instance to a larger machine type to handle the peak load.

Answer

Set up a Cloud Monitoring alert that notifies the operations team when CPU utilization exceeds 80%, so they can manually add instances.

Answer

Deploy the application to a Google Kubernetes Engine cluster with a Horizontal Pod Autoscaler based on CPU utilization.

Question 11

A healthcare company is planning a Google Cloud landing zone for a new regulated workload. They must enforce organization-wide guardrails, centralize billing visibility, and give each business unit autonomy over its own projects. The security team needs to apply policies that cannot be overridden by project owners. Which two design choices should you recommend? (Choose two.)

Accepted Answer

Enable Cloud Billing export to BigQuery and create a shared log sink to a central project for audit and cost analysis.. A folder hierarchy lets the company apply organization policies that inherit to all descendant projects and cannot be overridden by project owners, satisfying the guardrail requirement. Exporting billing data to BigQuery and centralizing logs provide the centralized billing and audit visibility. Granting broad roles like Billing Account Administrator or Organization Administrator, or flattening the hierarchy, undermines centralized control and least privilege.

Answer

Place all projects directly under the organization root and rely on project-level IAM to enforce security policies.

Answer

Give each business unit the Organization Administrator role so they can manage their own projects independently.

Answer

Grant each business unit the Billing Account Administrator role on the shared billing account to give them billing autonomy.

Question 12

An enterprise is migrating a latency-sensitive trading application from an on-premises data centre to Google Cloud. The application's components exchange hundreds of thousands of small messages per second and require sub-millisecond inter-process communication. The architect must choose a compute and networking design. What should the architect recommend?

Accepted Answer

Deploy the components on Compute Engine VMs in the same zone with compact placement, and enable high-priority network traffic using the `--network-performance-configs` total-egress-bandwidth-tier setting.. Ultra-low latency between tightly coupled components depends on physical proximity and adequate network throughput. Compact placement policies schedule instances close together on the same rack, reducing switch hops and jitter, while the higher total egress bandwidth tier removes the default throughput cap that would otherwise throttle a heavy small-message workload. Keeping all components in a single zone avoids inter-zone round trips entirely, which is essential for the stated sub-millisecond requirement.

Answer

Deploy the components on GKE Autopilot pods spread across three zones with a PodDisruptionBudget and topology spread constraints.

Answer

Deploy the components on Cloud Run services in the same region and connect them through a Serverless VPC Access connector to a shared VPC.

Answer

Deploy the components on Compute Engine VMs in different zones of the same region and connect them with a global VPC using external IP addresses for direct communication.

Question 13

A healthcare analytics company is designing the Google Cloud landing zone for a new HIPAA-regulated workload. The security team requires that no project in the organization can enable a public Cloud Storage bucket by accident, and that all data-at-rest in BigQuery is encrypted with keys the company rotates on its own schedule. Which two design decisions should the architect include? (Choose two.)

Accepted Answer

Create a Cloud KMS keyring in each region where BigQuery datasets reside, and set a default CMEK on each dataset. Two controls map directly to the stated requirements. The storage.publicAccessPrevention organization policy is a preventive, inherited guardrail that blocks public bucket grants anywhere in the organization. A default CMEK on each BigQuery dataset, with regional keyrings, gives the company control over the rotation schedule and key lifecycle. Uniform bucket-level access, Google-managed keys, and narrow role grants do not enforce either requirement.

Answer

Enable uniform bucket-level access on every bucket through an organization policy constraint

Answer

Grant the Storage Admin role only to a small group of platform engineers at the organization level

Answer

Use Google-managed encryption keys for BigQuery and rely on the default rotation performed by Google

Question 14

A retail company is designing a new order-processing system on Google Cloud. The system must expose a REST API that is reachable from the public internet over a custom hostname, must terminate TLS at the edge, and must route requests to different backend services based on URL path prefixes such as /orders and /inventory. The platform team wants a fully managed, globally distributed solution that scales automatically and does not require managing reverse-proxy VMs. Which Google Cloud component should they place in front of the backends?

Accepted Answer

Global external Application Load Balancer with a URL map and a Google-managed SSL certificate. The global external Application Load Balancer is the only listed option that combines managed edge TLS termination, custom hostname support through Google-managed certificates, and URL-map-based path routing to multiple backends. Because it is a fully managed global proxy, it scales automatically and removes the operational burden of running reverse-proxy VMs, satisfying both the functional and operational requirements.

Answer

Traffic Director with Envoy sidecars deployed on each backend instance

Answer

Regional external passthrough Network Load Balancer with backend services in two zones

Answer

Cloud CDN with a signed URL key attached directly to the backend instance groups

Question 15

A healthcare analytics company ingests HL7 messages into Pub/Sub and processes them with a Dataflow streaming pipeline that writes results to BigQuery. During a regional outage, the pipeline stopped and the team discovered that unacknowledged messages were lost after the retention window expired. The company needs a design where a single-region failure does not cause message loss and the pipeline can resume with minimal manual intervention. What should the architect recommend?

Accepted Answer

Deploy the Dataflow pipeline as a regional job in two regions with a Pub/Sub subscription in each, and configure the topic to store messages in a second region using message storage policy or a global endpoint.. The failure mode is losing messages when a single region is unavailable and the retention window closes. Keeping Pub/Sub message data in more than one region through a message storage policy or global endpoint, plus running the Dataflow job regionally in two locations each with its own subscription, gives both durability of the messages and a surviving processing path. Retention tuning, object storage substitution, and autoscaling do not remove the single-region dependency.

Answer

Increase the Pub/Sub message retention duration to the maximum and add a dead-letter topic so failed messages are preserved for later reprocessing.

Answer

Replace Pub/Sub with a Cloud Storage bucket in dual-region mode and have Dataflow read new objects with a streaming pipeline triggered by Eventarc notifications.

Answer

Run the Dataflow pipeline in a single region but enable autoscaling and set the maximum number of workers higher so it drains the backlog faster after an outage.