Google PCA Design and plan a cloud solution architecture Practice Question
A financial services company is designing a multi-tier application on Google Cloud. The application must meet PCI DSS compliance, with data encrypted at rest and in transit. They plan to use Cloud SQL for PostgreSQL for transactional data and Cloud Storage for archival data. Which TWO actions should the architect take to meet compliance requirements?
⚠ Common exam trap
Test-takers frequently assume Google-managed default encryption is sufficient for PCI DSS, but the exam tests the nuance that many compliance frameworks require customer-managed keys (CMEK) to demonstrate control over the encryption process, not just encryption itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable customer-managed encryption keys (CMEK) on Cloud SQL and Cloud Storage
Enabling CMEK on Cloud SQL and Cloud Storage allows the company to use their own encryption keys, which is often required by PCI DSS to demonstrate control over key management. CMEK ensures data at rest is encrypted with keys managed via Cloud KMS, providing auditability and separation of duties beyond Google-managed default encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure client-side encryption in the application code
Why it's wrong here
Client-side encryption is not a recommended architecture pattern for Cloud SQL and would add complexity.
- ✗
Rely on Google-managed default encryption for all data
Why it's wrong here
Default encryption does not meet PCI DSS requirements for key management control.
- ✓
Enable customer-managed encryption keys (CMEK) on Cloud SQL and Cloud Storage
Why this is correct
CMEK provides control over key management required for PCI DSS.
- ✓
Use VPC Service Controls to restrict data access
Why this is correct
VPC Service Controls prevent data exfiltration and help meet compliance.
- ✗
Use Cloud HSM with a key generated outside of Google Cloud
Why it's wrong here
Cloud HSM is a key management service, but the question asks for actions specifically for encryption at rest and in transit; CMEK already covers this.
Go deeper
Related to this question
Learn chapter
Introduction to Google Cloud Platform
Key term
Cloud KMS
Cloud KMS (Key Management Service) is a cloud-based service that lets you create, manage, and use encryption keys to protect your data at rest and in transit.
Key term
KMS
KMS (Key Management Service) is a Microsoft technology that automates volume licensing activation for Windows and Office products within an organization's network.
About these practice questions
Courseiva writes every PCA question from scratch — 955 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.