Google PCA Design for security and compliance Practice Question
A healthcare organization stores Protected Health Information (PHI) in Cloud SQL. They have implemented encryption at rest using CMEK and enforce TLS for all connections. To meet HIPAA compliance, they need to ensure that PHI cannot be exfiltrated from the Cloud SQL instance even if an application is compromised. The Cloud SQL instance is accessed by Compute Engine instances in the same VPC using private IPs. The security team wants to add an additional layer of defense against data exfiltration. What should they do?
⚠ Common exam trap
In Google PCA exams, the trap is that candidates confuse encryption (CMEK) or secure connectivity (Auth proxy) with exfiltration prevention, not realizing that VPC Service Controls is the only option that creates a data boundary to block unauthorized data movement even from compromised applications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure VPC Service Controls with a service perimeter that includes the Cloud SQL instance and uses Private Service Connect.
VPC Service Controls with a service perimeter that includes the Cloud SQL instance and uses Private Service Connect prevents data exfiltration by creating a security boundary around the Cloud SQL instance. Even if an application is compromised, the service perimeter blocks unauthorized copying or movement of PHI outside the perimeter, and Private Service Connect ensures traffic stays within Google's network without traversing the public internet. This directly addresses the requirement for an additional layer of defense against exfiltration beyond encryption and TLS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy Cloud Armor and apply a WAF rule to block suspicious traffic to the Cloud SQL instance.
Why it's wrong here
Cloud Armor protects HTTP(S) load-balanced traffic, and Cloud SQL private IP connections are not HTTP, so WAF rules never inspect them. It is tempting because Cloud Armor is the standard edge defence, but it would be correct only for web applications exposed through an external Application Load Balancer.
- ✗
Use the Cloud SQL Auth proxy from all applications to enforce IAM-based authentication.
Why it's wrong here
The Cloud SQL Auth proxy provides IAM-based authentication and TLS, but a compromised application using it still holds valid credentials and can read and exfiltrate PHI. It is tempting because it removes static passwords, yet the requirement is blocking outbound exfiltration, which needs egress controls such as VPC Service Controls.
- ✓
Configure VPC Service Controls with a service perimeter that includes the Cloud SQL instance and uses Private Service Connect.
Why this is correct
VPC Service Controls perimeters restrict data movement across project boundaries, and Private Service Connect keeps Cloud SQL traffic on private endpoints, blocking exfiltration even if the application is compromised. This adds the required defence layer beyond CMEK and TLS.
- ✗
Enable customer-managed encryption keys (CMEK) on the Cloud SQL instance.
Why it's wrong here
CMEK encrypts data at rest and is already implemented, so adding it changes nothing about egress paths. It is tempting because CMEK strengthens key control and auditability, but it cannot stop a compromised application that already holds valid credentials from reading and sending PHI outward.
Go deeper
Related to this question
Learn chapter
Google Kubernetes Engine (GKE)
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Data
Data is raw, unprocessed information, like numbers, words, or measurements, that can be stored, processed, and analyzed by computers.
About these practice questions
This PCA question is part of Courseiva's 807-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.