Google PCA Practice Question: Analyze and optimize technical and business processes
A healthcare company stores patient records in Cloud Storage buckets across multiple projects. An audit reveals that several buckets containing protected health information are publicly accessible. The security team wants a centralized, automated way to detect and remediate public access across all current and future projects, with minimal operational effort. Which solution should the architect recommend?
⚠ Common exam trap
Many candidates confuse prevention controls like organization policy constraints with detection and remediation capabilities, when the scenario explicitly requires both detection and automated remediation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Security Command Center with the built-in Cloud Storage public access finding and configure automated remediation via Cloud Functions.
Security Command Center provides centralized, organization-wide detection of publicly accessible Cloud Storage buckets through built-in findings. By routing findings to Pub/Sub and triggering Cloud Functions, the team can automatically remediate public access across all current and future projects. Organization policy constraints prevent new exposures but do not detect or fix existing ones, and legacy tools like Forseti are deprecated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a Forseti Security instance to scan all projects and automatically remove public IAM bindings.
Why it's wrong here
Forseti Security was deprecated and is no longer the recommended tool for this purpose. Even when available, it required significant operational effort to deploy and maintain. The scenario asks for minimal operational effort, and Forseti is not a current Google Cloud service. This option is outdated and does not meet the requirement.
- ✓
Use Security Command Center with the built-in Cloud Storage public access finding and configure automated remediation via Cloud Functions.
Why this is correct
Security Command Center detects publicly accessible Cloud Storage buckets as a built-in finding and can aggregate findings across all projects in an organization. Automated remediation can be triggered from the finding using Pub/Sub and Cloud Functions to remove public IAM bindings or apply public access prevention. This provides centralized detection and remediation with minimal operational effort.
- ✗
Create an organization policy constraint that disables public access on all Cloud Storage buckets.
Why it's wrong here
An organization policy constraint such as constraints/storage.publicAccessPrevention can prevent new public access, but it does not detect or remediate existing publicly accessible buckets. It also does not provide a detection mechanism for audit reporting. This option addresses prevention, not the required detection and remediation of existing exposures.
- ✗
Enable uniform bucket-level access on all buckets and rely on Cloud Audit Logs to detect public access.
Why it's wrong here
Uniform bucket-level access simplifies permissions but does not prevent public access by itself; a bucket can still be made public through IAM or legacy ACLs if not combined with public access prevention. Audit Logs record access but do not automatically detect or remediate public exposure. This approach does not provide automated remediation across all projects.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
Learn chapter
Security Best Practices and Compliance
Key term
Pub/Sub
Pub/Sub is a messaging pattern where publishers send messages without knowing who receives them, and subscribers receive only the messages they care about.
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
About these practice questions
This PCA question is part of Courseiva's 807-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.