20+ practice questions focused on Design for security and compliance — one of the most tested topics on the Google Professional Cloud Architect exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Design for security and compliance PracticeWhich THREE are valid methods to protect sensitive data in BigQuery?
Explanation: Customer-managed encryption keys (CMEK) provide encryption at rest for BigQuery data, including sensitive columns, by using keys managed by the customer. Cloud DLP de-identification transforms can be applied during data ingestion to automatically mask or tokenize sensitive data. BigQuery column-level security allows restricting access to sensitive columns at the table level. These three methods directly protect sensitive data in BigQuery.
A company wants to automatically rotate cryptographic keys on a schedule without manual intervention. Which service should they use?
Explanation: Cloud KMS provides built-in key rotation capabilities that allow you to automatically rotate cryptographic keys on a schedule (e.g., every 90 days) without manual intervention. You define a rotation period, and KMS automatically generates a new primary key version while retaining older versions for decryption of existing data. This is the correct service because it is specifically designed for managing encryption keys with automated lifecycle policies.
A company hosts a web application on Google Kubernetes Engine (GKE) and wants to protect against SQL injection attacks. Which service should they configure?
Explanation: Cloud Armor is the correct choice because it provides web application firewall (WAF) capabilities that can inspect HTTP/HTTPS traffic and block SQL injection attempts using preconfigured rules (e.g., the OWASP Top 10 rule set). It integrates directly with GKE via HTTP(S) Load Balancing, allowing you to enforce security policies at the edge before requests reach your application.
A company wants to restrict access to a Cloud Storage bucket so that only objects encrypted with a specific Cloud KMS key can be read. Which approach should they use?
Explanation: Using a bucket policy with a condition on the encryption type (`request.object.encryption.type`) denies access to objects not encrypted with CMEK. This ensures that only objects encrypted with a customer-managed key (Cloud KMS) can be read. While the requirement mentions a specific key, the bucket policy can be further refined with a condition on the key resource name, but Option B is the only option that correctly uses encryption type checking. Option C is incorrect because `resource.hasTag` is not a valid IAM condition attribute for Cloud Storage objects; the correct attribute is `request.object.encryption.key_name`.
A company wants to use Cloud Armor to protect their HTTP load balancer from SQL injection attacks. Which rule action should they configure to block malicious requests?
Explanation: Cloud Armor's pre-configured WAF rules include 'evaluatePreconfiguredExpr('sqli-stable')', which specifically detects SQL injection patterns in HTTP requests. Applying the 'deny(403)' action blocks malicious requests by returning a 403 Forbidden status, preventing the attack from reaching the backend. This is the correct approach because Cloud Armor WAF rules are purpose-built for application-layer threats like SQL injection.
+15 more Design for security and compliance questions available
Practice all Design for security and compliance questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Design for security and compliance. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Design for security and compliance questions on the PCA frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Design for security and compliance is tested as part of the Google Professional Cloud Architect blueprint. Practicing with targeted Design for security and compliance questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free PCA practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Design for security and compliance is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Design for security and compliance practice session with instant scoring and detailed explanations.
Start Design for security and compliance Practice →