Google PCA Practice Question: Managing and Provisioning a Solution Infrastructure
A security team wants to monitor and audit all changes to IAM policies in a Google Cloud organization. They need to set up real-time alerts when a new binding is added. Which THREE services should they combine to achieve this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Pub/Sub
Cloud Audit Logs record IAM changes. Cloud Pub/Sub can receive logs in near real-time. Cloud Functions can process Pub/Sub messages and trigger alerts (e.g., via email). Cloud Storage is for storage, not real-time alerting. Cloud Scheduler is for cron jobs. Cloud Armor is for security policies at the network edge.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud Scheduler
Why it's wrong here
Scheduler triggers jobs on a schedule, not real-time events.
- ✓
Cloud Pub/Sub
Why this is correct
Pub/Sub delivers log entries in real-time for processing.
- ✓
Cloud Functions
Why this is correct
Cloud Functions can subscribe to Pub/Sub and trigger alerts based on log content.
- ✓
Cloud Audit Logs
Why this is correct
Audit Logs capture IAM policy changes.
- ✗
Cloud Storage
Why it's wrong here
Storage is not real-time; logs can be exported to Storage but not for immediate alerting.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
Learn chapter
Introduction to Google Cloud Platform
Key term
Cloud Functions
Cloud Functions are serverless compute services that let you run single-purpose code in response to events without managing servers.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
One of 955 original PCA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.