How should I use these Design for security and compliance practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Design for security and compliance questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Design for security and compliance domain.

PCA · topic practice

Design for security and compliance practice questions

Practise Google Professional Cloud Architect Design for security and compliance practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Design for security and compliance

Practice 10 questions Browse domain →

What the exam tests

What to know about Design for security and compliance

Design for security and compliance questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Design for security and compliance exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Design for security and compliance questions

20 questions · select your answer, then reveal the explanation

Question 1hardmulti select

Read the full Design for security and compliance explanation →

Which THREE are valid methods to protect sensitive data in BigQuery?

Trap 1: Create authorized views that query only non-sensitive columns.

Incorrect. Authorized views restrict access to rows or columns but do not encrypt or de-identify data; they are an access control mechanism, not a direct data protection method.

Trap 2: Use IAM roles to grant access at the dataset level, which…

Incorrect. IAM roles grant access at the dataset level but do not automatically mask sensitive data; they control overall access, not data masking.

Study all Design for security and compliance common traps →

A
Enable customer-managed encryption keys (CMEK) to encrypt sensitive columns.
Correct. CMEK encrypts data at rest, protecting sensitive columns from unauthorized access to storage layers.
B
Apply Cloud DLP de-identification transforms during data ingestion.
Correct. Cloud DLP de-identification transforms can mask, tokenize, or redact sensitive data before it is stored in BigQuery.
C
Create authorized views that query only non-sensitive columns.
Why wrong: Incorrect. Authorized views restrict access to rows or columns but do not encrypt or de-identify data; they are an access control mechanism, not a direct data protection method.
D
Use BigQuery column-level security to restrict access to sensitive columns.
Correct. Column-level security (Policy Tags) restricts access to sensitive columns by authorized users only.
E
Use IAM roles to grant access at the dataset level, which automatically masks sensitive data.
Why wrong: Incorrect. IAM roles grant access at the dataset level but do not automatically mask sensitive data; they control overall access, not data masking.

Design for security and compliance practice questions

What to know about Design for security and compliance

Common Design for security and compliance exam traps

Design for security and compliance questions

Which THREE are valid methods to protect sensitive data in BigQuery?

A company wants to automatically rotate cryptographic keys on a schedule without manual intervention. Which service should they use?

A company hosts a web application on Google Kubernetes Engine (GKE) and wants to protect against SQL injection attacks. Which service should they configure?

A company wants to restrict access to a Cloud Storage bucket so that only objects encrypted with a specific Cloud KMS key can be read. Which approach should they use?

A company wants to use Cloud Armor to protect their HTTP load balancer from SQL injection attacks. Which rule action should they configure to block malicious requests?

A company is using Cloud SQL with automatic backups enabled. They want to ensure that backups are encrypted with a customer-managed key (CMEK) and that the key used for backups is different from the one used for the database itself. How can they achieve this?

Which TWO security best practices should be applied when configuring Cloud Functions that process sensitive data? (Choose two.)

A company is migrating sensitive customer data to Google Cloud. They need to ensure data is encrypted at rest and in transit. Which Google Cloud service provides a centralized way to manage encryption keys used by Google Cloud services?

An e-commerce platform uses Cloud SQL for MySQL to store user profiles and order history. The security team wants to ensure that database administrators (DBAs) cannot view plaintext credit card numbers stored in the database. They also want to minimize application changes. What should they do?

A company wants to ensure that only Compute Engine instances with a specific service account can access a Cloud Storage bucket. Which IAM condition should they use?

A multinational corporation operates in multiple regions and must comply with GDPR. They use Cloud Load Balancing to distribute traffic across regional backends. Their security team wants to block traffic from specific countries (e.g., non-EU countries) at the edge. What should they use?

Which TWO are recommended practices for securing a Kubernetes Engine (GKE) cluster?

A company is migrating its on-premises workloads to Google Cloud. They have strict compliance requirements that all data at rest must be encrypted with customer-managed encryption keys (CMEK). Which Google Cloud service should they use to manage the lifecycle of these keys?

Which TWO of the following are valid methods to control access to Google Cloud resources using Identity and Access Management (IAM)?

An organization has set the IAM policy constraint 'constraints/iam.allowedPolicyMemberDomains' with the values shown. Which of the following users can be granted an IAM role on a project in this organization? (Choose all that apply.)

Exhibit

A company is deploying a multi-tier web application on Google Cloud. The application must comply with PCI DSS. Which combination of Google Cloud services should be used to restrict access to the database tier to only the application tier, while also encrypting data at rest and in transit?

Track your progress over time

Start a Design for security and compliance only practice session

Related PCA topic practice pages

Managing Implementation and Ensuring Solution and Operations Reliability practice questions

Managing and Provisioning a Solution Infrastructure practice questions

Designing for Security and Compliance practice questions

Analysing and Optimising Technical and Business Processes practice questions

Design and plan a cloud solution architecture practice questions

Manage and provision cloud infrastructure practice questions

Design for security and compliance practice questions

Analyze and optimize technical and business processes practice questions

Manage implementation of cloud architecture practice questions

Ensure solution and operations reliability practice questions

PCA fundamentals practice questions

PCA scenario practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid