How should I use these Designing for Security and Compliance practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

PCA · topic practice

Designing for Security and Compliance practice questions

Q: Can I practise just Designing for Security and Compliance questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Designing for Security and Compliance domain.

Practise Google Professional Cloud Architect Designing for Security and Compliance practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Designing for Security and Compliance

Practice 10 questions Browse domain →

What the exam tests

What to know about Designing for Security and Compliance

Designing for Security and Compliance questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Designing for Security and Compliance exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Designing for Security and Compliance questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Designing for Security and Compliance explanation →

A company wants to restrict network access to Cloud SQL instances such that only applications running in a specific VPC can connect. Which GCP feature should they use?

Trap 1: Private Service Connect

Private Service Connect is used for exposing services to consumers via Network Endpoint Groups, not for connecting to Cloud SQL. The correct feature for consuming Cloud SQL privately is Private Service Access.

Trap 2: VPC peering

VPC peering connects two VPCs, but Cloud SQL is not a VPC; it's a managed service. Private Service Access uses VPC peering with the Cloud SQL's tenant VPC, but the feature itself is named Private Service Access.

Trap 3: Private Services Access

Private Services Access is not a real GCP feature. The correct term is Private Service Access.

Study all Designing for Security and Compliance common traps →

A
Private Service Connect
Why wrong: Private Service Connect is used for exposing services to consumers via Network Endpoint Groups, not for connecting to Cloud SQL. The correct feature for consuming Cloud SQL privately is Private Service Access.
B
Private Service Access
Private Service Access enables private connectivity to Google-managed services such as Cloud SQL from a VPC using private IP addresses. This is the recommended approach.
C
VPC peering
Why wrong: VPC peering connects two VPCs, but Cloud SQL is not a VPC; it's a managed service. Private Service Access uses VPC peering with the Cloud SQL's tenant VPC, but the feature itself is named Private Service Access.
D
Private Services Access
Why wrong: Private Services Access is not a real GCP feature. The correct term is Private Service Access.

Designing for Security and Compliance practice questions

What to know about Designing for Security and Compliance

Common Designing for Security and Compliance exam traps

Designing for Security and Compliance questions

A company wants to restrict network access to Cloud SQL instances such that only applications running in a specific VPC can connect. Which GCP feature should they use?

A company is using Cloud SQL for MySQL and wants to encrypt data at rest with a key that they manage and rotate. They also want to avoid any additional cost for the encryption feature. What should they do?

An organization needs to comply with FedRAMP High requirements and wants to run workloads in a GCP region that supports these controls. They also need to restrict data movement to only approved services. Which GCP feature should they use?

A company wants to control which resources can be accessed by a service account in a specific project. Which IAM policy binding approach should be used?

An organization requires that all container images deployed to GKE be signed and verified before deployment. Which GCP service should be used?

A security team wants to prevent data exfiltration from a GKE cluster to external storage. They need to restrict access to Cloud Storage buckets from the cluster without using private IPs. Which solution should they implement?

A company uses Cloud KMS with CMEK to encrypt data stored in BigQuery. They need to audit who has used the encryption key and when. Which type of audit log should they enable?

An engineer needs to grant a user the ability to create and manage service accounts in a project. Which predefined IAM role provides these permissions?

A company wants to enforce that all API calls to GCP services from outside their corporate network come through a specific Cloud VPN tunnel. Which GCP service can enforce this policy?

An organization needs to store secrets used by multiple GCP services. They require automatic rotation of secrets every 30 days and integration with Cloud Functions. Which service should they use?

A company wants to use its existing Active Directory credentials to authenticate users to the GCP Console. Which service should they integrate with?

Which GCP service can be used to detect and redact sensitive data such as credit card numbers in text files stored in Cloud Storage?

A company needs to ensure that only approved container images can be deployed to a GKE cluster. They already use Binary Authorization. What additional step is required to enforce this policy?

An organization needs to encrypt data at rest in BigQuery using keys that are rotated every 90 days. They want to manage the keys themselves but cannot store keys on-premises. Which encryption approach should they use?

A developer wants to allow a Compute Engine VM to authenticate to Google Cloud APIs without embedding service account keys in the VM image. What is the recommended approach?

A company uses Cloud Armor to protect an HTTP(S) Load Balancer. They want to block traffic from a specific IP address range during off-peak hours but allow it during peak hours. How can they achieve this?

A company needs to ensure that only applications running in a specific GKE namespace can access a Cloud Storage bucket. Which approach should they use?

A company wants to enforce that only approved container images can be deployed to GKE. They also want to ensure images are scanned for vulnerabilities before deployment. Which two GCP services should they use? (Choose TWO).

A company needs to store secrets used by multiple GCP services. They require automatic rotation of secrets every 30 days and integration with Cloud Functions. Which two GCP services should they use? (Choose TWO).

Which two GCP audit log types are available by default? (Choose TWO).

Track your progress over time

Start a Designing for Security and Compliance only practice session

Related PCA topic practice pages

Managing Implementation and Ensuring Solution and Operations Reliability practice questions

Managing and Provisioning a Solution Infrastructure practice questions

Designing for Security and Compliance practice questions

Analysing and Optimising Technical and Business Processes practice questions

Design and plan a cloud solution architecture practice questions

Manage and provision cloud infrastructure practice questions

Design for security and compliance practice questions

Analyze and optimize technical and business processes practice questions

Manage implementation of cloud architecture practice questions

Ensure solution and operations reliability practice questions

PCA fundamentals practice questions

PCA scenario practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid