PCA · topic practice

Design and plan a cloud solution architecture practice questions

Q: How should I use these Design and plan a cloud solution architecture practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Q: Can I practise just Design and plan a cloud solution architecture questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Design and plan a cloud solution architecture domain.

Practise Google Professional Cloud Architect Design and plan a cloud solution architecture practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Design and plan a cloud solution architecture

Practice 10 questions Browse domain →

What the exam tests

What to know about Design and plan a cloud solution architecture

Cloud concepts questions usually test the service model (IaaS/PaaS/SaaS) and deployment model (public/private/hybrid/community) appropriate for a given scenario.

IaaS, PaaS and SaaS responsibilities and examples.

Public, private, hybrid and community cloud deployment models.

On-premises vs cloud trade-offs: cost, control, scalability.

How cloud connectivity options (VPN, Direct Connect, ExpressRoute) work.

Watch out for

Common Design and plan a cloud solution architecture exam traps

▸IaaS gives you infrastructure control; SaaS gives you only the application.
▸Hybrid cloud combines on-premises and public cloud — not two public clouds.
▸Cloud does not automatically mean cheaper or more secure.
▸Management responsibility shifts with each service model (IaaS → PaaS → SaaS).

Practice set

Design and plan a cloud solution architecture questions

20 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Read the full VPN explanation →

A company has a hub-and-spoke VPC topology with multiple on-premises locations connected via Cloud VPN to the hub VPC. They notice IP conflicts because overlapping CIDR ranges are used in different spokes. The network team wants to allow communication between spokes without re-IPing. What should they do?

Trap 1: Use Cloud VPN tunnels between spokes through the hub.

VPN tunnels can work with overlapping ranges but require careful routing and possibly NAT; however, overlapping ranges will cause routing ambiguity.

Trap 2: Configure static routes in the hub to summarize ranges with a…

Summarizing does not resolve the overlap; traffic will still be confused.

Trap 3: Create VPC peering between each spoke VPC.

VPC peering does not support overlapping IP ranges; it will fail.

Study all Design and plan a cloud solution architecture common traps →

A
Use Cloud NAT in each spoke and private routing via the hub with network tags to distinguish ranges.
Cloud NAT can map overlapping private IPs to a unique internal IP range within the hub, and tags can help route traffic appropriately, though this approach has limitations; alternative is to re-IP. But among options, this allows some communication without re-IPing.
B
Use Cloud VPN tunnels between spokes through the hub.
Why wrong: VPN tunnels can work with overlapping ranges but require careful routing and possibly NAT; however, overlapping ranges will cause routing ambiguity.
C
Configure static routes in the hub to summarize ranges with a smaller prefix.
Why wrong: Summarizing does not resolve the overlap; traffic will still be confused.
D
Create VPC peering between each spoke VPC.
Why wrong: VPC peering does not support overlapping IP ranges; it will fail.

Full breakdown with real-world context →

Question 2easymultiple choice

Read the full Design and plan a cloud solution architecture explanation →

A small startup wants to deploy a containerized web application that scales automatically and only charges for resources used. They have limited operational experience. Which compute solution should they choose?

Trap 1: App Engine Standard Environment with a custom runtime.

App Engine Standard does not support custom containers; it supports specific runtimes.

Trap 2: Google Kubernetes Engine (GKE) with a multi-node pool.

GKE requires management of the cluster and nodes; not as simple as serverless.

Trap 3: Compute Engine with a managed instance group.

Managed instance groups require upfront configuration and are not as simple as serverless.

Study all Design and plan a cloud solution architecture common traps →

A
App Engine Standard Environment with a custom runtime.
Why wrong: App Engine Standard does not support custom containers; it supports specific runtimes.
B
Google Kubernetes Engine (GKE) with a multi-node pool.
Why wrong: GKE requires management of the cluster and nodes; not as simple as serverless.
C
Compute Engine with a managed instance group.
Why wrong: Managed instance groups require upfront configuration and are not as simple as serverless.
D
Cloud Run (fully managed).
Cloud Run manages scaling, and billing is based on request count and duration, ideal for startups with variable traffic.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full Design and plan a cloud solution architecture explanation →

You need to store object data that is accessed infrequently (once a quarter) but must be retained for 10 years for compliance. Which storage class is the most cost-effective?

Trap 1: Archive

Archive has the lowest storage cost but higher retrieval fees and a 365-day minimum storage duration. For quarterly access, Coldline is more cost-effective overall.

Trap 2: Standard

Standard is for hot data.

Trap 3: Nearline

Nearline is for data accessed monthly.

Study all Design and plan a cloud solution architecture common traps →

A
Archive
Why wrong: Archive has the lowest storage cost but higher retrieval fees and a 365-day minimum storage duration. For quarterly access, Coldline is more cost-effective overall.
B
Standard
Why wrong: Standard is for hot data.
C
Nearline
Why wrong: Nearline is for data accessed monthly.
D
Coldline
Coldline offers low storage cost with moderate retrieval fees and a 90-day minimum. It is the most cost-effective for data accessed once a quarter.

Full breakdown with real-world context →

Question 4hardmultiple choice

Read the full Design and plan a cloud solution architecture explanation →

A company is designing a VPC architecture for a multi-tenant SaaS platform. Each tenant has isolated workloads that must not communicate with each other. They also need centralized network security and logging. Which VPC design meets these requirements?

Trap 1: Dedicated Cloud VPN connections per tenant

Dedicated Cloud VPN connections per tenant do not provide isolation within the VPC and are used for hybrid connectivity, not multi-tenant isolation.

Trap 2: Single VPC with network tags and IAP tunnels

A single VPC with network tags and IAP tunnels does not enforce strict isolation between tenants as tags can be misconfigured, and IAP is for access control, not network isolation.

Trap 3: Peered VPCs for each tenant with Cloud NAT

Peered VPCs for each tenant with Cloud NAT would create multiple VPCs, but this approach lacks centralized management and logging compared to a Shared VPC.

Study all Design and plan a cloud solution architecture common traps →

A
Dedicated Cloud VPN connections per tenant
Why wrong: Dedicated Cloud VPN connections per tenant do not provide isolation within the VPC and are used for hybrid connectivity, not multi-tenant isolation.
B
Use a Shared VPC with separate subnets for each tenant and firewall rules to enforce isolation
Shared VPC with separate subnets per tenant and firewall rules allows centralized network security and logging while ensuring tenants are isolated.
C
Single VPC with network tags and IAP tunnels
Why wrong: A single VPC with network tags and IAP tunnels does not enforce strict isolation between tenants as tags can be misconfigured, and IAP is for access control, not network isolation.
D
Peered VPCs for each tenant with Cloud NAT
Why wrong: Peered VPCs for each tenant with Cloud NAT would create multiple VPCs, but this approach lacks centralized management and logging compared to a Shared VPC.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full Design and plan a cloud solution architecture explanation →

The exhibit shows a command to create a Compute Engine instance. The instance is intended to run a web server that needs to access Cloud Storage buckets using its service account. However, the web server fails to read from a storage bucket. What is the most likely cause?

Exhibit

Refer to the exhibit.

gcloud compute instances create my-instance \
    --zone=us-central1-a \
    --machine-type=n1-standard-4 \
    --image-family=ubuntu-2004-lts \
    --image-project=ubuntu-os-cloud \
    --boot-disk-size=50GB \
    --boot-disk-type=pd-ssd \
    --scopes=cloud-platform \
    --service-account=my-sa@project.iam.gserviceaccount.com \
    --tags=http-server,https-server

Trap 1: The service account is not attached to the instance

The service account is attached to the instance (as shown by the --scopes flag), so this is not the cause.

Trap 2: The tags http-server and https-server block outbound traffic

pd-ssd is a valid boot disk type and does not affect Cloud Storage access.

Trap 3: The boot disk type is SSD, which is not compatible with Cloud…

The tags http-server and https-server are used for firewall rules, not for storage access.

Study all Design and plan a cloud solution architecture common traps →

A
The service account is not attached to the instance
Why wrong: The service account is attached to the instance (as shown by the --scopes flag), so this is not the cause.
B
The tags http-server and https-server block outbound traffic
Why wrong: pd-ssd is a valid boot disk type and does not affect Cloud Storage access.
C
The boot disk type is SSD, which is not compatible with Cloud Storage
Why wrong: The tags http-server and https-server are used for firewall rules, not for storage access.
D
The service account lacks IAM permissions to read from Cloud Storage
Even with the service account attached, it must have IAM permissions (e.g., roles/storage.objectViewer) to read from Cloud Storage. Lack of those permissions is the likely cause.

Full breakdown with real-world context →

Question 6mediummultiple choice

Read the full Design and plan a cloud solution architecture explanation →

The exhibit shows a Cloud Storage bucket IAM policy. A developer (admin@example.com) wants to upload a file to the bucket but gets a permission denied error. What is the most likely reason?

Exhibit

Refer to the exhibit.

{
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": [
        "user:admin@example.com"
      ]
    },
    {
      "role": "roles/storage.objectAdmin",
      "members": [
        "serviceAccount:my-sa@project.iam.gserviceaccount.com"
      ]
    }
  ]
}

Trap 1: An organization policy denies all write operations

No evidence of org policy.

Trap 2: The developer is not a member of the project

The user is explicitly listed.

Trap 3: The service account my-sa overrides the developer's permissions

Service accounts are separate.

Study all Design and plan a cloud solution architecture common traps →

A
An organization policy denies all write operations
Why wrong: No evidence of org policy.
B
The developer is not a member of the project
Why wrong: The user is explicitly listed.
C
The service account my-sa overrides the developer's permissions
Why wrong: Service accounts are separate.
D
The developer is assigned only the objectViewer role
objectViewer cannot write.

Full breakdown with real-world context →

Question 7mediummultiple choice

Read the full Design and plan a cloud solution architecture explanation →

A company is designing a microservices architecture on Google Kubernetes Engine (GKE) for a global user base. They require high availability across multiple zones, automatic scaling, and rolling updates without downtime. Which Kubernetes workload resource should they use for each service?

Trap 1: StatefulSet with volumeClaimTemplates for persistent storage

StatefulSets are intended for stateful applications that require stable network identities and persistent storage, not for stateless microservices that need rolling updates and zone spreading.

Trap 2: Job for batch processing

Jobs are for running a finite task to completion, not for long-running services that need to be always available and scaled.

Trap 3: DaemonSet to ensure one pod per node

DaemonSets run a pod on every node, which is not suitable for services that should be scaled and spread across zones; they are used for node-level functions like logging or monitoring.

Study all Design and plan a cloud solution architecture common traps →

A
StatefulSet with volumeClaimTemplates for persistent storage
Why wrong: StatefulSets are intended for stateful applications that require stable network identities and persistent storage, not for stateless microservices that need rolling updates and zone spreading.
B
Deployment with pod anti-affinity rules spread across zones
Deployments provide rolling updates and replica management; combined with pod anti-affinity, they can ensure pods are distributed across zones for high availability.
C
Job for batch processing
Why wrong: Jobs are for running a finite task to completion, not for long-running services that need to be always available and scaled.
D
DaemonSet to ensure one pod per node
Why wrong: DaemonSets run a pod on every node, which is not suitable for services that should be scaled and spread across zones; they are used for node-level functions like logging or monitoring.

Full breakdown with real-world context →

Question 8easymultiple choice

Read the full Design and plan a cloud solution architecture explanation →

Your company has migrated its legacy web application from a single Compute Engine instance to a managed instance group (MIG) behind an HTTP(S) load balancer. The application was updated to a new version as part of the migration. After the migration, users report intermittent 502 Bad Gateway errors. The application logs show no errors, and the load balancer backend health checks are reported as healthy. On investigation, the developers discover that the new version requires a specific environment variable for authentication to a downstream service. This variable was set manually on the original instance but is missing from the MIG's instance template. The health check endpoint does not depend on this variable and always returns a 200 status even when the variable is absent. As a result, instances created from the template are considered healthy by the load balancer, but when they receive requests that require authentication, they fail and return a 502 error to the client. What is the most likely cause of the 502 errors?

Trap 1: The health check is configured to check the old application path,…

If the health check path no longer existed, the health check would fail, but it is reported as healthy, so this is not the cause.

Trap 2: The load balancer's backend timeout is too short for the…

A short timeout typically results in 504 Gateway Timeout errors, not 502 Bad Gateway.

Trap 3: The MIG is not scaling out fast enough to handle peak traffic.

Insufficient scaling would lead to 503 Service Unavailable errors or increased latency, not intermittent 502 errors from healthy instances.

Study all Design and plan a cloud solution architecture common traps →

A
The missing environment variable causes authentication failures on new instances.
The environment variable is essential for authentication; its absence causes requests to fail with 502 errors. Health checks pass because they do not exercise that code path.
B
The health check is configured to check the old application path, which no longer exists.
Why wrong: If the health check path no longer existed, the health check would fail, but it is reported as healthy, so this is not the cause.
C
The load balancer's backend timeout is too short for the application's response time.
Why wrong: A short timeout typically results in 504 Gateway Timeout errors, not 502 Bad Gateway.
D
The MIG is not scaling out fast enough to handle peak traffic.
Why wrong: Insufficient scaling would lead to 503 Service Unavailable errors or increased latency, not intermittent 502 errors from healthy instances.

Full breakdown with real-world context →

Question 9hardmultiple choice

Read the full Design and plan a cloud solution architecture explanation →

Refer to the exhibit. An engineer is investigating why web-01 was removed from the load balancer target pool. What is the most likely root cause?

Network Topology

Trap 1: The database instance db-01 is running out of memory and rejecting…

Timeout suggests network-level issue, not resource exhaustion (which would typically produce a different error).

Trap 2: The load balancer health check is misconfigured to use an incorrect…

The health check failure is a symptom, not the root cause; the underlying issue is the database connectivity.

Trap 3: The instance web-01 is running an outdated version of the web…

There is no evidence of outdated software; the logs point to a connectivity issue.

Study all Design and plan a cloud solution architecture common traps →

A
The firewall rule allowing traffic from web-01 to db-01 on port 3306 has been removed or misconfigured.
The timeout when connecting to the database suggests a firewall or network path issue blocking TCP/3306 traffic.
B
The database instance db-01 is running out of memory and rejecting connections.
Why wrong: Timeout suggests network-level issue, not resource exhaustion (which would typically produce a different error).
C
The load balancer health check is misconfigured to use an incorrect port.
Why wrong: The health check failure is a symptom, not the root cause; the underlying issue is the database connectivity.
D
The instance web-01 is running an outdated version of the web server software.
Why wrong: There is no evidence of outdated software; the logs point to a connectivity issue.

Full breakdown with real-world context →

Question 10mediummultiple choice

Read the full Design and plan a cloud solution architecture explanation →

A company is migrating on-premises workloads to Google Cloud. They have a critical application that requires consistent low-latency access to a database, with read replicas in multiple regions for disaster recovery. The application is expected to grow by 10x over the next year. Which database service and configuration should the architect choose to meet these requirements?

Trap 1: Use Cloud Bigtable with multi-region replication

Bigtable is a NoSQL wide-column database optimized for analytical workloads, not transactional consistency.

Trap 2: Use Cloud SQL for PostgreSQL with cross-region read replicas

Cross-region replicas are asynchronous, not strongly consistent, and may not meet latency requirements.

Trap 3: Use Firestore in native mode with multi-region location

Firestore Native mode is eventually consistent, not strongly consistent across regions.

Study all Design and plan a cloud solution architecture common traps →

A
Use Cloud Bigtable with multi-region replication
Why wrong: Bigtable is a NoSQL wide-column database optimized for analytical workloads, not transactional consistency.
B
Use Cloud SQL for PostgreSQL with cross-region read replicas
Why wrong: Cross-region replicas are asynchronous, not strongly consistent, and may not meet latency requirements.
C
Use Cloud Spanner with multi-region configuration
Cloud Spanner offers global strong consistency, automatic replication, and horizontal scalability.
D
Use Firestore in native mode with multi-region location
Why wrong: Firestore Native mode is eventually consistent, not strongly consistent across regions.

Full breakdown with real-world context →

Question 11hardmulti select

Read the full Design and plan a cloud solution architecture explanation →

A financial services company is designing a multi-tier application on Google Cloud. The application must meet PCI DSS compliance, with data encrypted at rest and in transit. They plan to use Cloud SQL for PostgreSQL for transactional data and Cloud Storage for archival data. Which TWO actions should the architect take to meet compliance requirements?

Trap 1: Configure client-side encryption in the application code

Client-side encryption is not a recommended architecture pattern for Cloud SQL and would add complexity.

Trap 2: Rely on Google-managed default encryption for all data

Default encryption does not meet PCI DSS requirements for key management control.

Trap 3: Use Cloud HSM with a key generated outside of Google Cloud

Cloud HSM is a key management service, but the question asks for actions specifically for encryption at rest and in transit; CMEK already covers this.

Study all Design and plan a cloud solution architecture common traps →

A
Configure client-side encryption in the application code
Why wrong: Client-side encryption is not a recommended architecture pattern for Cloud SQL and would add complexity.
B
Rely on Google-managed default encryption for all data
Why wrong: Default encryption does not meet PCI DSS requirements for key management control.
C
Enable customer-managed encryption keys (CMEK) on Cloud SQL and Cloud Storage
CMEK provides control over key management required for PCI DSS.
D
Use VPC Service Controls to restrict data access
VPC Service Controls prevent data exfiltration and help meet compliance.
E
Use Cloud HSM with a key generated outside of Google Cloud
Why wrong: Cloud HSM is a key management service, but the question asks for actions specifically for encryption at rest and in transit; CMEK already covers this.

Full breakdown with real-world context →

Question 12hardmultiple choice

Read the full Design and plan a cloud solution architecture explanation →

Refer to the exhibit. An architect created a VM instance using the above command. After the instance starts, the architect tries to access the nginx default page from the internet but gets a timeout. What is the most likely reason?

Exhibit

Refer to the exhibit.

gcloud compute instances create my-instance \
  --zone=us-central1-a \
  --machine-type=e2-micro \
  --image-family=debian-11 \
  --image-project=debian-cloud \
  --boot-disk-size=20GB \
  --boot-disk-type=pd-standard \
  --network-interface=subnet=default,no-address \
  --metadata=startup-script='#! /bin/bash
    sudo apt-get update
    sudo apt-get install -y nginx
    sudo systemctl enable nginx
    sudo systemctl start nginx'

Trap 1: The VM is in a subnet without a Cloud NAT

Even with Cloud NAT, the VM has no external IP and cannot be accessed from the internet inbound.

Trap 2: The firewall rule allowing HTTP traffic is missing

The default VPC includes a default-allow-http firewall rule for port 80.

Trap 3: The startup script failed to install nginx

The startup script is correctly formatted and should install nginx successfully.

Study all Design and plan a cloud solution architecture common traps →

A
The VM is in a subnet without a Cloud NAT
Why wrong: Even with Cloud NAT, the VM has no external IP and cannot be accessed from the internet inbound.
B
The firewall rule allowing HTTP traffic is missing
Why wrong: The default VPC includes a default-allow-http firewall rule for port 80.
C
The startup script failed to install nginx
Why wrong: The startup script is correctly formatted and should install nginx successfully.
D
The VM was created without an external IP address
The 'no-address' flag omits the external IP, making the VM unreachable from the internet.

Full breakdown with real-world context →

Question 13easymultiple choice

Read the full Design and plan a cloud solution architecture explanation →

A media streaming company is deploying a new video transcoding pipeline on Google Cloud. The pipeline receives raw video files uploaded to Cloud Storage, triggers a Cloud Function that submits transcoding jobs to a Compute Engine worker pool, and stores the transcoded output in another Cloud Storage bucket. The workers are managed by a managed instance group (MIG) running a custom container image. Currently, when there is a spike in uploads, the MIG takes 5-7 minutes to scale up new workers, causing processing delays. The architect needs to reduce the time to add new workers to under 2 minutes. The workers are stateless and the container image is about 2 GB. What should the architect do?

Trap 1: Use Cloud Run instead of Compute Engine to run the transcoding…

Cloud Run has a request timeout of 60 minutes and is not designed for batch processing.

Trap 2: Increase the minimum number of instances in the MIG to 10

This increases baseline cost and does not reduce the time to add new workers beyond the minimum.

Trap 3: Replace the Compute Engine workers with Cloud Functions to handle…

Cloud Functions have a maximum timeout of 60 minutes and may not be suitable for long transcoding jobs.

Study all Design and plan a cloud solution architecture common traps →

A
Use Cloud Run instead of Compute Engine to run the transcoding workers
Why wrong: Cloud Run has a request timeout of 60 minutes and is not designed for batch processing.
B
Increase the minimum number of instances in the MIG to 10
Why wrong: This increases baseline cost and does not reduce the time to add new workers beyond the minimum.
C
Replace the Compute Engine workers with Cloud Functions to handle the transcoding
Why wrong: Cloud Functions have a maximum timeout of 60 minutes and may not be suitable for long transcoding jobs.
D
Create a custom Compute Engine image that includes the container runtime and pre-pulled container
A custom image with the container already pulled reduces boot time as the image does not need to be downloaded.

Full breakdown with real-world context →

Question 14easymultiple choice

Read the full Design and plan a cloud solution architecture explanation →

A company is migrating a legacy monolithic application to Google Cloud. The application currently runs on a single on-premises server and uses a local MySQL database. The company wants to minimize changes to the application code while improving scalability and reliability. Which migration strategy should the architect recommend?

Trap 1: Refactor the application into microservices and deploy on Google…

Refactoring requires significant code changes, which contradicts the requirement to minimize changes.

Trap 2: Containerize the application with Docker and run it on Cloud Run.

Containerization may require code changes for statelessness and Cloud Run has limitations that may not suit a monolithic app.

Trap 3: Migrate the database to Firestore and rewrite the application to…

Rewriting to use Firestore involves significant code changes and is not a lift-and-shift approach.

Study all Design and plan a cloud solution architecture common traps →

A
Refactor the application into microservices and deploy on Google Kubernetes Engine.
Why wrong: Refactoring requires significant code changes, which contradicts the requirement to minimize changes.
B
Rehost the application on Compute Engine and use Cloud SQL for MySQL as the database.
Rehosting on Compute Engine with Cloud SQL minimizes changes and improves scalability and reliability.
C
Containerize the application with Docker and run it on Cloud Run.
Why wrong: Containerization may require code changes for statelessness and Cloud Run has limitations that may not suit a monolithic app.
D
Migrate the database to Firestore and rewrite the application to use Firestore APIs.
Why wrong: Rewriting to use Firestore involves significant code changes and is not a lift-and-shift approach.

Full breakdown with real-world context →

Question 15hardmultiple choice

Read the full Design and plan a cloud solution architecture explanation →

A global e-commerce platform is experiencing intermittent latency spikes during flash sales. The application is deployed on Google Kubernetes Engine (GKE) with a regional cluster. The architecture includes a frontend service, a product catalog service using Cloud Spanner, and an order processing service using Cloud Pub/Sub. During high load, the catalog service shows increased query latency, and some requests time out. What should the architect prioritize to address the issue?

Trap 1: Use Cloud CDN to cache product catalog responses.

Caching can reduce load but does not address the root cause of Spanner query latency; also product data may be dynamic.

Trap 2: Increase the number of nodes in the GKE node pool.

Scaling nodes may help overall throughput but does not directly fix query performance issues in Cloud Spanner.

Trap 3: Migrate the catalog service from Cloud Spanner to Cloud Bigtable…

Bigtable is optimized for time-series data, not transactional queries with complex filters.

Study all Design and plan a cloud solution architecture common traps →

A
Use Cloud CDN to cache product catalog responses.
Why wrong: Caching can reduce load but does not address the root cause of Spanner query latency; also product data may be dynamic.
B
Increase the number of nodes in the GKE node pool.
Why wrong: Scaling nodes may help overall throughput but does not directly fix query performance issues in Cloud Spanner.
C
Enable Cloud Spanner interleaved tables and add secondary indexes for common query filters.
Secondary indexes and interleaved tables optimize query access patterns, reducing latency.
D
Migrate the catalog service from Cloud Spanner to Cloud Bigtable for better read performance.
Why wrong: Bigtable is optimized for time-series data, not transactional queries with complex filters.

Full breakdown with real-world context →

Question 16mediummultiple choice

Read the full Design and plan a cloud solution architecture explanation →

A startup is developing a real-time analytics dashboard that ingests data from IoT devices. The data volume is unpredictable but can spike to millions of events per second. The dashboard must display near real-time aggregations with sub-second latency. Which Google Cloud architecture should the architect recommend?

Trap 1: Ingest via Cloud IoT Core directly to Cloud Bigtable, then query…

Cloud IoT Core is for device management, not high-volume event ingestion; direct write to Bigtable may lack stream processing.

Trap 2: Ingest via Cloud Pub/Sub, process with Cloud Dataproc, store in…

Cloud Dataproc (Hadoop/Spark) has higher latency for streaming; Cloud Storage is not optimized for sub-second queries.

Trap 3: Ingest via Cloud Pub/Sub, store raw data in Cloud Storage, and use…

Cloud SQL is not designed for high write throughput or sub-second aggregations on large datasets.

Study all Design and plan a cloud solution architecture common traps →

A
Ingest via Cloud IoT Core directly to Cloud Bigtable, then query with BigQuery.
Why wrong: Cloud IoT Core is for device management, not high-volume event ingestion; direct write to Bigtable may lack stream processing.
B
Ingest via Cloud Pub/Sub, process with Cloud Dataproc, store in Cloud Storage, and query with BigQuery.
Why wrong: Cloud Dataproc (Hadoop/Spark) has higher latency for streaming; Cloud Storage is not optimized for sub-second queries.
C
Ingest via Cloud Pub/Sub, store raw data in Cloud Storage, and use Cloud SQL for aggregations.
Why wrong: Cloud SQL is not designed for high write throughput or sub-second aggregations on large datasets.
D
Ingest via Cloud Pub/Sub, process with Cloud Dataflow, store in Cloud Bigtable, and query from the dashboard.
This combination handles high ingest rates, stream processing, and low-latency queries.

Full breakdown with real-world context →

Question 17hardmultiple choice

Read the full Design and plan a cloud solution architecture explanation →

A financial services company is designing a multi-region disaster recovery architecture for a critical application. The application runs on Compute Engine with a stateful backend using Cloud Spanner. The Recovery Time Objective (RTO) is 1 hour, and the Recovery Point Objective (RPO) is 15 minutes. What architecture meets these requirements cost-effectively?

Trap 1: Deploy in one region with scheduled snapshots to Cloud Storage and…

Snapshots have RPO of 1+ hour and recovery time may exceed 1 hour.

Trap 2: Deploy in two regions with active-passive using Cloud Load…

Backup/restore RPO is at least 1 hour, not meeting 15 min RPO.

Trap 3: Use a single region with Cloud SQL for PostgreSQL and enable…

Cloud SQL replicas are asynchronous and RPO may exceed 15 min; failover is manual.

Study all Design and plan a cloud solution architecture common traps →

A
Deploy the application in two regions with active-active traffic load balancing and Cloud Spanner multi-region configuration.
Cloud Spanner multi-region provides synchronous replication with RPO < 15 min and automatic failover meets RTO.
B
Deploy in one region with scheduled snapshots to Cloud Storage and use persistent disk snapshots for recovery.
Why wrong: Snapshots have RPO of 1+ hour and recovery time may exceed 1 hour.
C
Deploy in two regions with active-passive using Cloud Load Balancing and Cloud Spanner backup/restore.
Why wrong: Backup/restore RPO is at least 1 hour, not meeting 15 min RPO.
D
Use a single region with Cloud SQL for PostgreSQL and enable cross-region replication using Cloud SQL replica.
Why wrong: Cloud SQL replicas are asynchronous and RPO may exceed 15 min; failover is manual.

Full breakdown with real-world context →

Question 18easymultiple choice

Read the full Design and plan a cloud solution architecture explanation →

A company wants to restrict access to a Cloud Storage bucket so that only a specific service account can read objects. The bucket contains sensitive data. Which identity and access management (IAM) approach should the architect use?

Trap 1: Grant the service account roles/iam.serviceAccountUser on the…

roles/iam.serviceAccountUser is for using service accounts, not for accessing storage.

Trap 2: Use a signed URL to allow access for the service account.

Signed URLs are for temporary access, not for a service account.

Trap 3: Grant the service account roles/storage.admin on the bucket.

roles/storage.admin grants full control, which is excessive and includes write, delete, etc.

Study all Design and plan a cloud solution architecture common traps →

A
Grant the service account roles/iam.serviceAccountUser on the bucket.
Why wrong: roles/iam.serviceAccountUser is for using service accounts, not for accessing storage.
B
Use a signed URL to allow access for the service account.
Why wrong: Signed URLs are for temporary access, not for a service account.
C
Grant the service account roles/storage.admin on the bucket.
Why wrong: roles/storage.admin grants full control, which is excessive and includes write, delete, etc.
D
Grant the service account roles/storage.objectViewer on the bucket and remove all other bindings.
This restricts read access to only the service account.

Full breakdown with real-world context →

Question 19mediumdrag order

Read the full Design and plan a cloud solution architecture explanation →

Drag and drop the steps to set up a VPC network peering between two projects in Google Cloud into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: 1

This order creates only one side of the peering. VPC peering requires both sides to be set up; otherwise, traffic flows only in one direction or not at all.

Trap 2: 1

Checking IP range overlap is done after peering attempts. If IPs overlap, peering will fail, so this order wastes effort and causes potential errors early.

Trap 3: 1

Similar to C but reverses the order of peering creation. However, the critical flaw is still performing IP range check after creating peering, which can lead to immediate failure.

Study all Design and plan a cloud solution architecture common traps →

A
1. Verify that the VPC networks have non-overlapping IP ranges. 2. Create a VPC peering connection from Project A to Project B. 3. Create a VPC peering connection from Project B to Project A. 4. Verify the peering status and network connectivity.
This order ensures prerequisites are met (non-overlapping IPs), then establishes both directions of peering, which is required for bidirectional communication. Finally, verification confirms success.
B
1. Verify that the VPC networks have non-overlapping IP ranges. 2. Create a VPC peering connection from Project A to Project B. 3. Verify the peering status and network connectivity. (No peering from Project B to Project A)
Why wrong: This order creates only one side of the peering. VPC peering requires both sides to be set up; otherwise, traffic flows only in one direction or not at all.
C
1. Create a VPC peering connection from Project A to Project B. 2. Create a VPC peering connection from Project B to Project A. 3. Verify that the VPC networks have non-overlapping IP ranges. 4. Verify the peering status and network connectivity.
Why wrong: Checking IP range overlap is done after peering attempts. If IPs overlap, peering will fail, so this order wastes effort and causes potential errors early.
D
1. Create a VPC peering connection from Project B to Project A. 2. Create a VPC peering connection from Project A to Project B. 3. Verify that the VPC networks have non-overlapping IP ranges. 4. Verify the peering status and network connectivity.
Why wrong: Similar to C but reverses the order of peering creation. However, the critical flaw is still performing IP range check after creating peering, which can lead to immediate failure.

Full breakdown with real-world context →

Question 20mediumdrag order

Read the full Design and plan a cloud solution architecture explanation →

Drag and drop the steps to recover a Cloud SQL instance from a backup into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: Step 1: Identify the backup, Step 2: Restore the backup to the…

This is incorrect because restoring directly to the existing instance overwrites current data, risking data loss. Best practice is to restore to a new instance first.

Trap 2: Step 1: Create a new Cloud SQL instance, Step 2: Identify the…

This is incorrect because you must identify the backup before creating the instance, as the backup determines the required instance configuration (e.g., region, size). Ordering creation before identification is inefficient.

Trap 3: Step 1: Identify the backup, Step 2: Redirect applications to a new…

This is incorrect because redirecting applications before restoring data causes downtime or errors (applications connect to an empty instance). Restoration must complete before redirecting.

Study all Design and plan a cloud solution architecture common traps →

A
Step 1: Identify the backup, Step 2: Create a new Cloud SQL instance, Step 3: Restore the backup to the new instance, Step 4: Redirect applications to the new instance.
This is correct because restoring to a new instance prevents overwriting production data, and creating the instance before restoring ensures the target exists. Redirecting after restore ensures minimal downtime.
B
Step 1: Identify the backup, Step 2: Restore the backup to the existing instance, Step 3: Verify the data, Step 4: Redirect applications if needed.
Why wrong: This is incorrect because restoring directly to the existing instance overwrites current data, risking data loss. Best practice is to restore to a new instance first.
C
Step 1: Create a new Cloud SQL instance, Step 2: Identify the backup, Step 3: Restore the backup to the new instance, Step 4: Redirect applications.
Why wrong: This is incorrect because you must identify the backup before creating the instance, as the backup determines the required instance configuration (e.g., region, size). Ordering creation before identification is inefficient.
D
Step 1: Identify the backup, Step 2: Redirect applications to a new instance, Step 3: Restore the backup to the new instance, Step 4: Verify the restoration.
Why wrong: This is incorrect because redirecting applications before restoring data causes downtime or errors (applications connect to an empty instance). Restoration must complete before redirecting.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Design and plan a cloud solution architecture sessions

Start a Design and plan a cloud solution architecture only practice session

Every question in these sessions is drawn from the Design and plan a cloud solution architecture domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Design and plan a cloud solution architecture questions →Mixed PCA session

Frequently asked questions

What does the PCA exam test about Design and plan a cloud solution architecture?: Cloud concepts questions usually test the service model (IaaS/PaaS/SaaS) and deployment model (public/private/hybrid/community) appropriate for a given scenario.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Design and plan a cloud solution architecture questions in a focused session?: Yes — the session launcher on this page draws every question from the Design and plan a cloud solution architecture domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other PCA topics?: Use the topic links above to move to related areas, or go back to the PCA question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the PCA exam covers. They are not copied from any real exam or dump site.

Design and plan a cloud solution architecture only

10 questions 20 questions 30 questions 50 questions

Mixed PCA session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All PCA questions Design and plan a cloud solution architecture domain overview PCA exam guide

Exam traps to avoid

▸IaaS gives you infrastructure control; SaaS gives you only the application.
▸Hybrid cloud combines on-premises and public cloud — not two public clouds.
▸Cloud does not automatically mean cheaper or more secure.
▸Management responsibility shifts with each service model (IaaS → PaaS → SaaS).

Design and plan a cloud solution architecture practice questions

What to know about Design and plan a cloud solution architecture

Common Design and plan a cloud solution architecture exam traps

Design and plan a cloud solution architecture questions

A small startup wants to deploy a containerized web application that scales automatically and only charges for resources used. They have limited operational experience. Which compute solution should they choose?

You need to store object data that is accessed infrequently (once a quarter) but must be retained for 10 years for compliance. Which storage class is the most cost-effective?

A company is designing a VPC architecture for a multi-tenant SaaS platform. Each tenant has isolated workloads that must not communicate with each other. They also need centralized network security and logging. Which VPC design meets these requirements?

The exhibit shows a command to create a Compute Engine instance. The instance is intended to run a web server that needs to access Cloud Storage buckets using its service account. However, the web server fails to read from a storage bucket. What is the most likely cause?

Exhibit

The exhibit shows a Cloud Storage bucket IAM policy. A developer (admin@example.com) wants to upload a file to the bucket but gets a permission denied error. What is the most likely reason?

Exhibit

A company is designing a microservices architecture on Google Kubernetes Engine (GKE) for a global user base. They require high availability across multiple zones, automatic scaling, and rolling updates without downtime. Which Kubernetes workload resource should they use for each service?

Refer to the exhibit. An engineer is investigating why web-01 was removed from the load balancer target pool. What is the most likely root cause?

Refer to the exhibit. An architect created a VM instance using the above command. After the instance starts, the architect tries to access the nginx default page from the internet but gets a timeout. What is the most likely reason?

Exhibit

A company wants to restrict access to a Cloud Storage bucket so that only a specific service account can read objects. The bucket contains sensitive data. Which identity and access management (IAM) approach should the architect use?

Drag and drop the steps to set up a VPC network peering between two projects in Google Cloud into the correct order.

Drag and drop the steps to recover a Cloud SQL instance from a backup into the correct order.

Track your progress over time

Start a Design and plan a cloud solution architecture only practice session

Related PCA topic practice pages

Managing Implementation and Ensuring Solution and Operations Reliability practice questions

Managing and Provisioning a Solution Infrastructure practice questions

Designing for Security and Compliance practice questions

Analysing and Optimising Technical and Business Processes practice questions