Google PCA Design for security and compliance Practice Question
A multinational corporation operates in multiple regions and must comply with GDPR. They use Cloud Load Balancing to distribute traffic across regional backends. Their security team wants to block traffic from specific countries (e.g., non-EU countries) at the edge. What should they use?
⚠ Common exam trap
A common mix-up: candidates confuse VPC firewall rules (which filter by IP ranges) with Cloud Armor's geolocation-based policies, or they assume Cloud CDN or IAP can enforce geographic access control, when in fact only Cloud Armor provides native country-level blocking at the edge.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Cloud Armor security policies with geographic-based denylist rules.
Cloud Armor security policies support geographic-based access control using denylist or allowlist rules that match client IP addresses against country-level geolocation data. This allows the security team to block traffic from specific countries at the edge, before it reaches the backend, which is the most efficient and compliant approach for GDPR enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure Cloud CDN to serve content only to EU-based users.
Why it's wrong here
Cloud CDN does not have geo-blocking capabilities.
- ✓
Use Cloud Armor security policies with geographic-based denylist rules.
Why this is correct
Cloud Armor can block traffic from specific countries at the Google Cloud edge.
- ✗
Set VPC firewall rules to allow traffic only from EU IP ranges.
Why it's wrong here
VPC firewall rules are regional and not designed for global geo-blocking.
- ✗
Configure Identity-Aware Proxy (IAP) to require user authentication from allowed countries.
Why it's wrong here
IAP is for application access control, not filtering at the edge.
Go deeper
Related to this question
Learn chapter
Introduction to Google Cloud Platform
Key term
Cloud Armor
Cloud Armor is a Google Cloud web application firewall (WAF) service that protects applications and websites from attacks like DDoS and SQL injection using customizable security rules.
Key term
Cloud Load Balancing
Cloud Load Balancing is the process of distributing incoming network traffic across multiple servers or resources in the cloud to ensure no single resource is overwhelmed, improving availability and reliability.
About these practice questions
Courseiva writes every PCA question from scratch — 955 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.