← PCA·Google Cloud

Question 391 of 1,000

Design for security and compliance →mediumMultiple SelectObjective-mapped

Google PCA Design for security and compliance Practice Question

This PCA practice question tests your understanding of design for security and compliance. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

Which TWO security best practices should be applied when configuring Cloud Functions that process sensitive data? (Choose two.)

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.

A
Enable VPC connector and set ingress to internal to avoid public internet exposure.
VPC connector allows the function to send traffic only via internal IPs, reducing exposure.
B
Disable all inbound network traffic to the function.
Why wrong: Cloud Functions must accept HTTP triggers; you cannot disable ingress completely.
C
Enable Cloud KMS customer-managed encryption for the function's environment variables.
Why wrong: Cloud Functions do not directly encrypt environment variables with CMEK; use Secret Manager instead.
D
Use the default Compute Engine default service account for simplicity.
Why wrong: The default service account has excessive permissions and should be replaced with a custom least-privilege service account.
E
Store secrets in Secret Manager and reference them from the function without hardcoding.
Secret Manager encrypts secrets at rest and minimizes exposure.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable VPC connector and set ingress to internal to avoid public internet exposure.

Option A is correct because enabling a VPC connector and setting ingress to 'internal' ensures that the Cloud Function can only be invoked from resources within the same VPC network, eliminating exposure to the public internet. This is a critical security best practice for functions processing sensitive data, as it enforces network isolation and reduces the attack surface.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Enable VPC connector and set ingress to internal to avoid public internet exposure.
Why this is correct
VPC connector allows the function to send traffic only via internal IPs, reducing exposure.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Disable all inbound network traffic to the function.
Why it's wrong here
Cloud Functions must accept HTTP triggers; you cannot disable ingress completely.
✗
Enable Cloud KMS customer-managed encryption for the function's environment variables.
Why it's wrong here
Cloud Functions do not directly encrypt environment variables with CMEK; use Secret Manager instead.
✗
Use the default Compute Engine default service account for simplicity.
Why it's wrong here
The default service account has excessive permissions and should be replaced with a custom least-privilege service account.
✓
Store secrets in Secret Manager and reference them from the function without hardcoding.
Why this is correct
Secret Manager encrypts secrets at rest and minimizes exposure.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.

Common exam traps

Common exam trap: answer the scenario, not the keyword

A common misconception tested in Google PCA is that environment variables can be encrypted with CMEK, but in reality, Cloud Functions environment variables are encrypted at rest by default with Google-managed keys, and CMEK is not a supported option for them; candidates confuse this with Cloud KMS for other resources.

Detailed technical explanation

How to think about this question

Under the hood, a VPC connector creates a Serverless VPC Access connector that bridges the Cloud Function's isolated environment to your VPC network via an internal IP address, enabling private communication with resources like Cloud SQL or Compute Engine instances without traversing the public internet. The 'ingress' setting in Cloud Functions (ALLOW_ALL vs. ALLOW_INTERNAL_ONLY) controls the source of HTTP requests at the Cloud Functions infrastructure level, not at the function code level, and is enforced by Google's frontend load balancers. In a real-world scenario, a healthcare application processing PHI (Protected Health Information) would use both a VPC connector and Secret Manager to meet HIPAA compliance requirements for network isolation and credential management.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

An e-commerce site experiences heavy traffic on Black Friday and near-zero traffic during off-peak weeks. Rather than provisioning permanent large VMs, the team uses auto-scaling groups that add capacity automatically under load and reduce it overnight. Questions like this test whether you understand elasticity, availability zones, and cloud compute scaling patterns.

Quick reference

Cloud Service Model Comparison

Model	You Manage	Provider Manages	Examples
IaaS	OS, runtime, apps, data	Hardware, hypervisor, networking	EC2, Azure VMs, GCP Compute Engine
PaaS	Apps and data	OS, runtime, middleware, hardware	Elastic Beanstalk, Azure App Service
SaaS	Data and settings only	Everything else	Microsoft 365, Salesforce, Workday
FaaS / Serverless	Function code only	Infra, scaling, runtime	Lambda, Azure Functions, Cloud Run
CaaS	Containers and apps	Kubernetes, OS, hardware	EKS, AKS, GKE

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related PCA practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Managing Implementation and Ensuring Solution and Operations Reliability practice questions

Practise PCA questions linked to Managing Implementation and Ensuring Solution and Operations Reliability.

Designing and Planning a Cloud Solution Architecture practice questions

Practise PCA questions linked to Designing and Planning a Cloud Solution Architecture.

Managing and Provisioning a Solution Infrastructure practice questions

Practise PCA questions linked to Managing and Provisioning a Solution Infrastructure.

Designing for Security and Compliance practice questions

Practise PCA questions linked to Designing for Security and Compliance.

Analysing and Optimising Technical and Business Processes practice questions

Practise PCA questions linked to Analysing and Optimising Technical and Business Processes.

Design and plan a cloud solution architecture practice questions

Practise PCA questions linked to Design and plan a cloud solution architecture.

Manage and provision cloud infrastructure practice questions

Practise PCA questions linked to Manage and provision cloud infrastructure.

Design for security and compliance practice questions

Practise PCA questions linked to Design for security and compliance.

Analyze and optimize technical and business processes practice questions

Practise PCA questions linked to Analyze and optimize technical and business processes.

Manage implementation of cloud architecture practice questions

Practise PCA questions linked to Manage implementation of cloud architecture.

Ensure solution and operations reliability practice questions

Practise PCA questions linked to Ensure solution and operations reliability.

PCA fundamentals practice questions

Practise PCA questions linked to PCA fundamentals.

Practice this exam

Start a free PCA practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

PCA practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this PCA question test?

Design for security and compliance — This question tests Design for security and compliance — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Enable VPC connector and set ingress to internal to avoid public internet exposure. — Option A is correct because enabling a VPC connector and setting ingress to 'internal' ensures that the Cloud Function can only be invoked from resources within the same VPC network, eliminating exposure to the public internet. This is a critical security best practice for functions processing sensitive data, as it enforces network isolation and reduces the attack surface.

What should I do if I get this PCA question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Are there clue words in this question I should notice?

Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.