20+ practice questions focused on Design for security and compliance — one of the most tested topics on the Google Professional Cloud Architect exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Design for security and compliance PracticeAn e-commerce platform uses Cloud SQL for MySQL to store user profiles and order history. The security team wants to ensure that database administrators (DBAs) cannot view plaintext credit card numbers stored in the database. They also want to minimize application changes. What should they do?
Explanation: Cloud DLP can be used to de-identify sensitive data like credit card numbers at rest in Cloud SQL, using deterministic or reversible transformations (e.g., format-preserving encryption or tokenization) that allow re-identification only by authorized applications. This approach minimizes application changes because DLP can scan and transform the data directly in the database, and the application can use re-identification transforms via the DLP API when needed, without modifying existing queries or schema.
A company wants to ensure that only Compute Engine instances with a specific service account can access a Cloud Storage bucket. Which IAM condition should they use?
Explanation: The `iam.serviceAccount` condition attribute in IAM conditions allows you to restrict access based on the service account identity of the caller. When a Compute Engine instance uses a service account, the condition `iam.serviceAccount == "sa@project.iam.gserviceaccount.com"` ensures that only requests authenticated with that specific service account are allowed to access the Cloud Storage bucket. This is the standard IAM condition attribute for matching the service account of the requesting principal.
Which THREE are valid methods to protect sensitive data in BigQuery?
Explanation: Customer-managed encryption keys (CMEK) provide encryption at rest for BigQuery data, including sensitive columns, by using keys managed by the customer. Cloud DLP de-identification transforms can be applied during data ingestion to automatically mask or tokenize sensitive data. BigQuery column-level security allows restricting access to sensitive columns at the table level. These three methods directly protect sensitive data in BigQuery.
Your company runs a multi-region web application on Google Kubernetes Engine (GKE) with pods that process sensitive user data. The application uses Cloud SQL for PostgreSQL as the backend database. Your security team has implemented the following controls: 1) All traffic to the database is encrypted using SSL/TLS. 2) The GKE cluster uses Workload Identity to bind Kubernetes service accounts to IAM service accounts. 3) The Cloud SQL instance is configured with a public IP address and authorized networks to allow only the GKE cluster's node IP ranges. 4) The database credentials are stored in Secret Manager and mounted as volumes in the pods. Recently, a security audit revealed that a pod was compromised due to a container vulnerability. The attacker was able to exfiltrate sensitive data directly from the Cloud SQL database using the credentials from Secret Manager. The security team wants to prevent such exfiltration in the future while minimizing changes to the application code. Which course of action should you recommend?
Explanation: Deploying Cloud SQL Auth Proxy as a sidecar container enforces IAM-based authentication, eliminating static credentials that can be exfiltrated. The proxy also handles SSL/TLS encryption automatically and allows fine-grained access control via IAM permissions, so even if a pod is compromised, the attacker cannot reuse stolen credentials because they are tied to the pod's identity via Workload Identity. This approach requires minimal code changes since the application connects to localhost instead of the Cloud SQL public IP.
An organization has set the IAM policy constraint 'constraints/iam.allowedPolicyMemberDomains' with the values shown. Which of the following users can be granted an IAM role on a project in this organization? (Choose all that apply.)
Explanation: The constraint 'constraints/iam.allowedPolicyMemberDomains' restricts IAM role grants to members from specified domains. The correct answer includes both A and D. Option A: service-account@project-id.iam.gserviceaccount.com is allowed because service accounts ending in 'gserviceaccount.com' are Google-managed and implicitly exempt from the constraint. Option D: user@example.com is allowed because 'example.com' is one of the domains specified in the constraint (as implied by the correct marking). The constraint explicitly lists allowed domains, and 'example.com' is included. Options B and C are from domains not in the allowed list, so they cannot be granted roles.
+15 more Design for security and compliance questions available
Practice all Design for security and compliance questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Design for security and compliance. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Design for security and compliance questions on the PCA frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Design for security and compliance is tested as part of the Google Professional Cloud Architect blueprint. Practicing with targeted Design for security and compliance questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free PCA practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Design for security and compliance is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Design for security and compliance practice session with instant scoring and detailed explanations.
Start Design for security and compliance Practice →