PCA · topic practice

Design and plan a cloud solution architecture practice questions

Q: How should I use these Design and plan a cloud solution architecture practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Q: Can I practise just Design and plan a cloud solution architecture questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Design and plan a cloud solution architecture domain.

Practise Google Professional Cloud Architect Design and plan a cloud solution architecture practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Design and plan a cloud solution architecture

Practice 10 questions Browse domain →

What the exam tests

What to know about Design and plan a cloud solution architecture

Cloud concepts questions usually test the service model (IaaS/PaaS/SaaS) and deployment model (public/private/hybrid/community) appropriate for a given scenario.

IaaS, PaaS and SaaS responsibilities and examples.

Public, private, hybrid and community cloud deployment models.

On-premises vs cloud trade-offs: cost, control, scalability.

How cloud connectivity options (VPN, Direct Connect, ExpressRoute) work.

Watch out for

Common Design and plan a cloud solution architecture exam traps

▸IaaS gives you infrastructure control; SaaS gives you only the application.
▸Hybrid cloud combines on-premises and public cloud — not two public clouds.
▸Cloud does not automatically mean cheaper or more secure.
▸Management responsibility shifts with each service model (IaaS → PaaS → SaaS).

Practice set

Design and plan a cloud solution architecture questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Design and plan a cloud solution architecture explanation →

A company is migrating on-premises workloads to Google Cloud. They have a critical application that requires consistent low-latency access to a database, with read replicas in multiple regions for disaster recovery. The application is expected to grow by 10x over the next year. Which database service and configuration should the architect choose to meet these requirements?

Trap 1: Use Cloud Bigtable with multi-region replication

Bigtable is a NoSQL wide-column database optimized for analytical workloads, not transactional consistency.

Trap 2: Use Cloud SQL for PostgreSQL with cross-region read replicas

Cross-region replicas are asynchronous, not strongly consistent, and may not meet latency requirements.

Trap 3: Use Firestore in native mode with multi-region location

Firestore Native mode is eventually consistent, not strongly consistent across regions.

Study all Design and plan a cloud solution architecture common traps →

A
Use Cloud Bigtable with multi-region replication
Why wrong: Bigtable is a NoSQL wide-column database optimized for analytical workloads, not transactional consistency.
B
Use Cloud SQL for PostgreSQL with cross-region read replicas
Why wrong: Cross-region replicas are asynchronous, not strongly consistent, and may not meet latency requirements.
C
Use Cloud Spanner with multi-region configuration
Cloud Spanner offers global strong consistency, automatic replication, and horizontal scalability.
D
Use Firestore in native mode with multi-region location
Why wrong: Firestore Native mode is eventually consistent, not strongly consistent across regions.

Full breakdown with real-world context →

Question 2hardmulti select

Read the full Design and plan a cloud solution architecture explanation →

A financial services company is designing a multi-tier application on Google Cloud. The application must meet PCI DSS compliance, with data encrypted at rest and in transit. They plan to use Cloud SQL for PostgreSQL for transactional data and Cloud Storage for archival data. Which TWO actions should the architect take to meet compliance requirements?

Trap 1: Configure client-side encryption in the application code

Client-side encryption is not a recommended architecture pattern for Cloud SQL and would add complexity.

Trap 2: Rely on Google-managed default encryption for all data

Default encryption does not meet PCI DSS requirements for key management control.

Trap 3: Use Cloud HSM with a key generated outside of Google Cloud

Cloud HSM is a key management service, but the question asks for actions specifically for encryption at rest and in transit; CMEK already covers this.

Study all Design and plan a cloud solution architecture common traps →

A
Configure client-side encryption in the application code
Why wrong: Client-side encryption is not a recommended architecture pattern for Cloud SQL and would add complexity.
B
Rely on Google-managed default encryption for all data
Why wrong: Default encryption does not meet PCI DSS requirements for key management control.
C
Enable customer-managed encryption keys (CMEK) on Cloud SQL and Cloud Storage
CMEK provides control over key management required for PCI DSS.
D
Use VPC Service Controls to restrict data access
VPC Service Controls prevent data exfiltration and help meet compliance.
E
Use Cloud HSM with a key generated outside of Google Cloud
Why wrong: Cloud HSM is a key management service, but the question asks for actions specifically for encryption at rest and in transit; CMEK already covers this.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full Design and plan a cloud solution architecture explanation →

Refer to the exhibit. An architect created a VM instance using the above command. After the instance starts, the architect tries to access the nginx default page from the internet but gets a timeout. What is the most likely reason?

Exhibit

Refer to the exhibit.

gcloud compute instances create my-instance \
  --zone=us-central1-a \
  --machine-type=e2-micro \
  --image-family=debian-11 \
  --image-project=debian-cloud \
  --boot-disk-size=20GB \
  --boot-disk-type=pd-standard \
  --network-interface=subnet=default,no-address \
  --metadata=startup-script='#! /bin/bash
    sudo apt-get update
    sudo apt-get install -y nginx
    sudo systemctl enable nginx
    sudo systemctl start nginx'

Trap 1: The VM is in a subnet without a Cloud NAT

Even with Cloud NAT, the VM has no external IP and cannot be accessed from the internet inbound.

Trap 2: The firewall rule allowing HTTP traffic is missing

The default VPC includes a default-allow-http firewall rule for port 80.

Trap 3: The startup script failed to install nginx

The startup script is correctly formatted and should install nginx successfully.

Study all Design and plan a cloud solution architecture common traps →

A
The VM is in a subnet without a Cloud NAT
Why wrong: Even with Cloud NAT, the VM has no external IP and cannot be accessed from the internet inbound.
B
The firewall rule allowing HTTP traffic is missing
Why wrong: The default VPC includes a default-allow-http firewall rule for port 80.
C
The startup script failed to install nginx
Why wrong: The startup script is correctly formatted and should install nginx successfully.
D
The VM was created without an external IP address
The 'no-address' flag omits the external IP, making the VM unreachable from the internet.

Full breakdown with real-world context →

Question 4easymultiple choice

Read the full Design and plan a cloud solution architecture explanation →

A media streaming company is deploying a new video transcoding pipeline on Google Cloud. The pipeline receives raw video files uploaded to Cloud Storage, triggers a Cloud Function that submits transcoding jobs to a Compute Engine worker pool, and stores the transcoded output in another Cloud Storage bucket. The workers are managed by a managed instance group (MIG) running a custom container image. Currently, when there is a spike in uploads, the MIG takes 5-7 minutes to scale up new workers, causing processing delays. The architect needs to reduce the time to add new workers to under 2 minutes. The workers are stateless and the container image is about 2 GB. What should the architect do?

Trap 1: Use Cloud Run instead of Compute Engine to run the transcoding…

Cloud Run has a request timeout of 60 minutes and is not designed for batch processing.

Trap 2: Increase the minimum number of instances in the MIG to 10

This increases baseline cost and does not reduce the time to add new workers beyond the minimum.

Trap 3: Replace the Compute Engine workers with Cloud Functions to handle…

Cloud Functions have a maximum timeout of 60 minutes and may not be suitable for long transcoding jobs.

Study all Design and plan a cloud solution architecture common traps →

A
Use Cloud Run instead of Compute Engine to run the transcoding workers
Why wrong: Cloud Run has a request timeout of 60 minutes and is not designed for batch processing.
B
Increase the minimum number of instances in the MIG to 10
Why wrong: This increases baseline cost and does not reduce the time to add new workers beyond the minimum.
C
Replace the Compute Engine workers with Cloud Functions to handle the transcoding
Why wrong: Cloud Functions have a maximum timeout of 60 minutes and may not be suitable for long transcoding jobs.
D
Create a custom Compute Engine image that includes the container runtime and pre-pulled container
A custom image with the container already pulled reduces boot time as the image does not need to be downloaded.

Full breakdown with real-world context →

Question 5easymultiple choice

Read the full Design and plan a cloud solution architecture explanation →

A company is migrating a legacy monolithic application to Google Cloud. The application currently runs on a single on-premises server and uses a local MySQL database. The company wants to minimize changes to the application code while improving scalability and reliability. Which migration strategy should the architect recommend?

Trap 1: Refactor the application into microservices and deploy on Google…

Refactoring requires significant code changes, which contradicts the requirement to minimize changes.

Trap 2: Containerize the application with Docker and run it on Cloud Run.

Containerization may require code changes for statelessness and Cloud Run has limitations that may not suit a monolithic app.

Trap 3: Migrate the database to Firestore and rewrite the application to…

Rewriting to use Firestore involves significant code changes and is not a lift-and-shift approach.

Study all Design and plan a cloud solution architecture common traps →

A
Refactor the application into microservices and deploy on Google Kubernetes Engine.
Why wrong: Refactoring requires significant code changes, which contradicts the requirement to minimize changes.
B
Rehost the application on Compute Engine and use Cloud SQL for MySQL as the database.
Rehosting on Compute Engine with Cloud SQL minimizes changes and improves scalability and reliability.
C
Containerize the application with Docker and run it on Cloud Run.
Why wrong: Containerization may require code changes for statelessness and Cloud Run has limitations that may not suit a monolithic app.
D
Migrate the database to Firestore and rewrite the application to use Firestore APIs.
Why wrong: Rewriting to use Firestore involves significant code changes and is not a lift-and-shift approach.

Full breakdown with real-world context →

Question 6hardmultiple choice

Read the full Design and plan a cloud solution architecture explanation →

A global e-commerce platform is experiencing intermittent latency spikes during flash sales. The application is deployed on Google Kubernetes Engine (GKE) with a regional cluster. The architecture includes a frontend service, a product catalog service using Cloud Spanner, and an order processing service using Cloud Pub/Sub. During high load, the catalog service shows increased query latency, and some requests time out. What should the architect prioritize to address the issue?

Trap 1: Use Cloud CDN to cache product catalog responses.

Caching can reduce load but does not address the root cause of Spanner query latency; also product data may be dynamic.

Trap 2: Increase the number of nodes in the GKE node pool.

Scaling nodes may help overall throughput but does not directly fix query performance issues in Cloud Spanner.

Trap 3: Migrate the catalog service from Cloud Spanner to Cloud Bigtable…

Bigtable is optimized for time-series data, not transactional queries with complex filters.

Study all Design and plan a cloud solution architecture common traps →

A
Use Cloud CDN to cache product catalog responses.
Why wrong: Caching can reduce load but does not address the root cause of Spanner query latency; also product data may be dynamic.
B
Increase the number of nodes in the GKE node pool.
Why wrong: Scaling nodes may help overall throughput but does not directly fix query performance issues in Cloud Spanner.
C
Enable Cloud Spanner interleaved tables and add secondary indexes for common query filters.
Secondary indexes and interleaved tables optimize query access patterns, reducing latency.
D
Migrate the catalog service from Cloud Spanner to Cloud Bigtable for better read performance.
Why wrong: Bigtable is optimized for time-series data, not transactional queries with complex filters.

Full breakdown with real-world context →

Question 7mediummultiple choice

Read the full Design and plan a cloud solution architecture explanation →

A startup is developing a real-time analytics dashboard that ingests data from IoT devices. The data volume is unpredictable but can spike to millions of events per second. The dashboard must display near real-time aggregations with sub-second latency. Which Google Cloud architecture should the architect recommend?

Trap 1: Ingest via Cloud IoT Core directly to Cloud Bigtable, then query…

Cloud IoT Core is for device management, not high-volume event ingestion; direct write to Bigtable may lack stream processing.

Trap 2: Ingest via Cloud Pub/Sub, process with Cloud Dataproc, store in…

Cloud Dataproc (Hadoop/Spark) has higher latency for streaming; Cloud Storage is not optimized for sub-second queries.

Trap 3: Ingest via Cloud Pub/Sub, store raw data in Cloud Storage, and use…

Cloud SQL is not designed for high write throughput or sub-second aggregations on large datasets.

Study all Design and plan a cloud solution architecture common traps →

A
Ingest via Cloud IoT Core directly to Cloud Bigtable, then query with BigQuery.
Why wrong: Cloud IoT Core is for device management, not high-volume event ingestion; direct write to Bigtable may lack stream processing.
B
Ingest via Cloud Pub/Sub, process with Cloud Dataproc, store in Cloud Storage, and query with BigQuery.
Why wrong: Cloud Dataproc (Hadoop/Spark) has higher latency for streaming; Cloud Storage is not optimized for sub-second queries.
C
Ingest via Cloud Pub/Sub, store raw data in Cloud Storage, and use Cloud SQL for aggregations.
Why wrong: Cloud SQL is not designed for high write throughput or sub-second aggregations on large datasets.
D
Ingest via Cloud Pub/Sub, process with Cloud Dataflow, store in Cloud Bigtable, and query from the dashboard.
This combination handles high ingest rates, stream processing, and low-latency queries.

Full breakdown with real-world context →

Question 8hardmultiple choice

Read the full Design and plan a cloud solution architecture explanation →

A financial services company is designing a multi-region disaster recovery architecture for a critical application. The application runs on Compute Engine with a stateful backend using Cloud Spanner. The Recovery Time Objective (RTO) is 1 hour, and the Recovery Point Objective (RPO) is 15 minutes. What architecture meets these requirements cost-effectively?

Trap 1: Deploy in one region with scheduled snapshots to Cloud Storage and…

Snapshots have RPO of 1+ hour and recovery time may exceed 1 hour.

Trap 2: Deploy in two regions with active-passive using Cloud Load…

Backup/restore RPO is at least 1 hour, not meeting 15 min RPO.

Trap 3: Use a single region with Cloud SQL for PostgreSQL and enable…

Cloud SQL replicas are asynchronous and RPO may exceed 15 min; failover is manual.

Study all Design and plan a cloud solution architecture common traps →

A
Deploy the application in two regions with active-active traffic load balancing and Cloud Spanner multi-region configuration.
Cloud Spanner multi-region provides synchronous replication with RPO < 15 min and automatic failover meets RTO.
B
Deploy in one region with scheduled snapshots to Cloud Storage and use persistent disk snapshots for recovery.
Why wrong: Snapshots have RPO of 1+ hour and recovery time may exceed 1 hour.
C
Deploy in two regions with active-passive using Cloud Load Balancing and Cloud Spanner backup/restore.
Why wrong: Backup/restore RPO is at least 1 hour, not meeting 15 min RPO.
D
Use a single region with Cloud SQL for PostgreSQL and enable cross-region replication using Cloud SQL replica.
Why wrong: Cloud SQL replicas are asynchronous and RPO may exceed 15 min; failover is manual.

Full breakdown with real-world context →

Question 9easymultiple choice

Read the full Design and plan a cloud solution architecture explanation →

A company wants to restrict access to a Cloud Storage bucket so that only a specific service account can read objects. The bucket contains sensitive data. Which identity and access management (IAM) approach should the architect use?

Trap 1: Grant the service account roles/iam.serviceAccountUser on the…

roles/iam.serviceAccountUser is for using service accounts, not for accessing storage.

Trap 2: Use a signed URL to allow access for the service account.

Signed URLs are for temporary access, not for a service account.

Trap 3: Grant the service account roles/storage.admin on the bucket.

roles/storage.admin grants full control, which is excessive and includes write, delete, etc.

Study all Design and plan a cloud solution architecture common traps →

A
Grant the service account roles/iam.serviceAccountUser on the bucket.
Why wrong: roles/iam.serviceAccountUser is for using service accounts, not for accessing storage.
B
Use a signed URL to allow access for the service account.
Why wrong: Signed URLs are for temporary access, not for a service account.
C
Grant the service account roles/storage.admin on the bucket.
Why wrong: roles/storage.admin grants full control, which is excessive and includes write, delete, etc.
D
Grant the service account roles/storage.objectViewer on the bucket and remove all other bindings.
This restricts read access to only the service account.

Full breakdown with real-world context →

Question 10mediumdrag order

Read the full Design and plan a cloud solution architecture explanation →

Drag and drop the steps to set up a VPC network peering between two projects in Google Cloud into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 11mediumdrag order

Read the full Design and plan a cloud solution architecture explanation →

Drag and drop the steps to recover a Cloud SQL instance from a backup into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 12mediummatching

Read the full Design and plan a cloud solution architecture explanation →

Match each Google Cloud service to its primary purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Distribute traffic across instances

Cache content at edge locations

Protect against DDoS and web attacks

Enable outbound internet for private instances

Dedicated connection between on-prem and GCP

Question 13mediummatching

Read the full Design and plan a cloud solution architecture explanation →

Match each GCP security service to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Manage encryption keys

Hardware security module for key protection

Store API keys, passwords, certificates

Manage access control

Centralized security and risk management

Question 14easymultiple choice

Read the full NAT/PAT explanation →

A multinational e-commerce company needs a globally distributed database that provides strong consistency and transactional support for order processing. Which Google Cloud database service should they use?

Trap 1: Cloud SQL

Cloud SQL is a regional database service and cannot be globally distributed.

Trap 2: Cloud Bigtable

Cloud Bigtable is a NoSQL wide-column database with eventual consistency, not suitable for strong transactional consistency.

Trap 3: Cloud Firestore

Cloud Firestore is a NoSQL document database with limited transactional support and not designed for global distribution with strong consistency.

Study all Design and plan a cloud solution architecture common traps →

A
Cloud SQL
Why wrong: Cloud SQL is a regional database service and cannot be globally distributed.
B
Cloud Spanner
Cloud Spanner provides global distribution, strong consistency, and full transactional support, making it ideal for order processing.
C
Cloud Bigtable
Why wrong: Cloud Bigtable is a NoSQL wide-column database with eventual consistency, not suitable for strong transactional consistency.
D
Cloud Firestore
Why wrong: Cloud Firestore is a NoSQL document database with limited transactional support and not designed for global distribution with strong consistency.

Full breakdown with real-world context →

Question 15mediummultiple choice

Read the full Design and plan a cloud solution architecture explanation →

A data analytics company runs nightly batch jobs using Compute Engine instances. The jobs can tolerate interruptions, and the company wants to minimize costs. What should they do?

Trap 1: Use C2 high-CPU machine types for faster processing.

C2 machine types are premium and more expensive per hour.

Trap 2: Use standard (on-demand) VMs and commit to a 1-year resource-based…

On-demand VMs are more expensive than preemptible; committed use discounts help but are not as cost-effective as preemptible for interruptible workloads.

Trap 3: Deploy VMs on Sole-tenant nodes for cost isolation.

Sole-tenant nodes are more expensive as they provide dedicated hardware.

Study all Design and plan a cloud solution architecture common traps →

A
Use preemptible VMs for the batch jobs.
Preemptible VMs cost much less than standard VMs and can be interrupted, acceptable for batch jobs that are checkpointed.
B
Use C2 high-CPU machine types for faster processing.
Why wrong: C2 machine types are premium and more expensive per hour.
C
Use standard (on-demand) VMs and commit to a 1-year resource-based commitment.
Why wrong: On-demand VMs are more expensive than preemptible; committed use discounts help but are not as cost-effective as preemptible for interruptible workloads.
D
Deploy VMs on Sole-tenant nodes for cost isolation.
Why wrong: Sole-tenant nodes are more expensive as they provide dedicated hardware.

Full breakdown with real-world context →

Question 16hardmultiple choice

Read the full Design and plan a cloud solution architecture explanation →

A financial services company is designing a multi-region application on Google Kubernetes Engine (GKE) for high availability. They need to serve user requests from the closest region and automatically failover if a region becomes unavailable. Which architecture should they use?

Trap 1: Use a global external HTTP(S) load balancer with a single backend…

A single backend service does not provide multi-region failover; traffic is sent to one region.

Trap 2: Use Cloud CDN in front of a single regional GKE cluster to cache…

Cloud CDN does not provide load balancing failover across regions.

Trap 3: Use a single regional GKE cluster with auto-scaling across zones.

A single regional cluster provides zone-level HA but cannot survive a regional failure.

Study all Design and plan a cloud solution architecture common traps →

A
Use a global external HTTP(S) load balancer with a single backend service pointing to one regional cluster.
Why wrong: A single backend service does not provide multi-region failover; traffic is sent to one region.
B
Use Cloud CDN in front of a single regional GKE cluster to cache content.
Why wrong: Cloud CDN does not provide load balancing failover across regions.
C
Use a single regional GKE cluster with auto-scaling across zones.
Why wrong: A single regional cluster provides zone-level HA but cannot survive a regional failure.
D
Deploy GKE clusters in multiple regions and use a multicluster ingress with an external HTTP(S) load balancer set up with the global external backend.
This architecture uses the Global External HTTP(S) Load Balancer with multicluster ingress to direct traffic to the nearest healthy cluster, providing geographic load balancing and failover.

Full breakdown with real-world context →

Question 17easymultiple choice

Read the full Design and plan a cloud solution architecture explanation →

A media company wants to serve publicly available images and videos to a global audience with low latency. Which Google Cloud service should they primarily use?

Trap 1: Cloud Storage with public bucket serving the files.

Cloud Storage directly serves content but without edge caching, resulting in higher latency; CDN is needed for global scale.

Trap 2: Cloud Run with a container that serves the files.

Cloud Run is serverless compute and not optimized for serving static files globally; it would still benefit from a CDN.

Trap 3: Compute Engine with an HTTP server.

Compute Engine instances in a region would have higher latency for global users compared to CDN.

Study all Design and plan a cloud solution architecture common traps →

A
Cloud Storage with public bucket serving the files.
Why wrong: Cloud Storage directly serves content but without edge caching, resulting in higher latency; CDN is needed for global scale.
B
Cloud CDN with Cloud Storage as the origin.
Cloud CDN caches content from Cloud Storage at edge locations, reducing latency for global users.
C
Cloud Run with a container that serves the files.
Why wrong: Cloud Run is serverless compute and not optimized for serving static files globally; it would still benefit from a CDN.
D
Compute Engine with an HTTP server.
Why wrong: Compute Engine instances in a region would have higher latency for global users compared to CDN.

Full breakdown with real-world context →

Question 18mediummultiple choice

Read the full Design and plan a cloud solution architecture explanation →

A company is migrating an on-premises PostgreSQL database to Cloud SQL with minimal downtime. The database is 1 TB and the network link has 500 Mbps bandwidth. Which migration approach is most appropriate?

Trap 1: Set up a Compute Engine instance with PostgreSQL replication and…

While possible, it is more complex and less managed than using DMS.

Trap 2: Use BigQuery Data Transfer Service to replicate data.

BigQuery Data Transfer Service is for loading data into BigQuery, not for migrating databases to Cloud SQL.

Trap 3: Export the database as a SQL dump, transfer it to Cloud Storage,…

This approach requires significant downtime for the export and import process.

Study all Design and plan a cloud solution architecture common traps →

A
Set up a Compute Engine instance with PostgreSQL replication and switch over.
Why wrong: While possible, it is more complex and less managed than using DMS.
B
Use BigQuery Data Transfer Service to replicate data.
Why wrong: BigQuery Data Transfer Service is for loading data into BigQuery, not for migrating databases to Cloud SQL.
C
Export the database as a SQL dump, transfer it to Cloud Storage, and import into Cloud SQL.
Why wrong: This approach requires significant downtime for the export and import process.
D
Use Database Migration Service to perform continuous replication and then promote Cloud SQL.
Database Migration Service supports continuous replication from on-premises to Cloud SQL with minimal downtime.

Full breakdown with real-world context →

Question 19hardmultiple choice

Read the full VPN explanation →

A company has a hub-and-spoke VPC topology with multiple on-premises locations connected via Cloud VPN to the hub VPC. They notice IP conflicts because overlapping CIDR ranges are used in different spokes. The network team wants to allow communication between spokes without re-IPing. What should they do?

Trap 1: Use Cloud VPN tunnels between spokes through the hub.

VPN tunnels can work with overlapping ranges but require careful routing and possibly NAT; however, overlapping ranges will cause routing ambiguity.

Trap 2: Configure static routes in the hub to summarize ranges with a…

Summarizing does not resolve the overlap; traffic will still be confused.

Trap 3: Create VPC peering between each spoke VPC.

VPC peering does not support overlapping IP ranges; it will fail.

Study all Design and plan a cloud solution architecture common traps →

A
Use Cloud NAT in each spoke and private routing via the hub with network tags to distinguish ranges.
Cloud NAT can map overlapping private IPs to a unique internal IP range within the hub, and tags can help route traffic appropriately, though this approach has limitations; alternative is to re-IP. But among options, this allows some communication without re-IPing.
B
Use Cloud VPN tunnels between spokes through the hub.
Why wrong: VPN tunnels can work with overlapping ranges but require careful routing and possibly NAT; however, overlapping ranges will cause routing ambiguity.
C
Configure static routes in the hub to summarize ranges with a smaller prefix.
Why wrong: Summarizing does not resolve the overlap; traffic will still be confused.
D
Create VPC peering between each spoke VPC.
Why wrong: VPC peering does not support overlapping IP ranges; it will fail.

Full breakdown with real-world context →

Question 20easymultiple choice

Read the full Design and plan a cloud solution architecture explanation →

A small startup wants to deploy a containerized web application that scales automatically and only charges for resources used. They have limited operational experience. Which compute solution should they choose?

Trap 1: App Engine Standard Environment with a custom runtime.

App Engine Standard does not support custom containers; it supports specific runtimes.

Trap 2: Google Kubernetes Engine (GKE) with a multi-node pool.

GKE requires management of the cluster and nodes; not as simple as serverless.

Trap 3: Compute Engine with a managed instance group.

Managed instance groups require upfront configuration and are not as simple as serverless.

Study all Design and plan a cloud solution architecture common traps →

A
App Engine Standard Environment with a custom runtime.
Why wrong: App Engine Standard does not support custom containers; it supports specific runtimes.
B
Google Kubernetes Engine (GKE) with a multi-node pool.
Why wrong: GKE requires management of the cluster and nodes; not as simple as serverless.
C
Compute Engine with a managed instance group.
Why wrong: Managed instance groups require upfront configuration and are not as simple as serverless.
D
Cloud Run (fully managed).
Cloud Run manages scaling, and billing is based on request count and duration, ideal for startups with variable traffic.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Design and plan a cloud solution architecture sessions

Start a Design and plan a cloud solution architecture only practice session

Every question in these sessions is drawn from the Design and plan a cloud solution architecture domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Design and plan a cloud solution architecture questions →Mixed PCA session

Frequently asked questions

What does the PCA exam test about Design and plan a cloud solution architecture?: Cloud concepts questions usually test the service model (IaaS/PaaS/SaaS) and deployment model (public/private/hybrid/community) appropriate for a given scenario.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Design and plan a cloud solution architecture questions in a focused session?: Yes — the session launcher on this page draws every question from the Design and plan a cloud solution architecture domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other PCA topics?: Use the topic links above to move to related areas, or go back to the PCA question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the PCA exam covers. They are not copied from any real exam or dump site.

Design and plan a cloud solution architecture only

10 questions 20 questions 30 questions 50 questions

Mixed PCA session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All PCA questions Design and plan a cloud solution architecture domain overview PCA exam guide

Exam traps to avoid

▸IaaS gives you infrastructure control; SaaS gives you only the application.
▸Hybrid cloud combines on-premises and public cloud — not two public clouds.
▸Cloud does not automatically mean cheaper or more secure.
▸Management responsibility shifts with each service model (IaaS → PaaS → SaaS).

Design and plan a cloud solution architecture practice questions

What to know about Design and plan a cloud solution architecture

Common Design and plan a cloud solution architecture exam traps

Design and plan a cloud solution architecture questions

Refer to the exhibit. An architect created a VM instance using the above command. After the instance starts, the architect tries to access the nginx default page from the internet but gets a timeout. What is the most likely reason?

Exhibit

A company wants to restrict access to a Cloud Storage bucket so that only a specific service account can read objects. The bucket contains sensitive data. Which identity and access management (IAM) approach should the architect use?

Drag and drop the steps to set up a VPC network peering between two projects in Google Cloud into the correct order.

Drag and drop the steps to recover a Cloud SQL instance from a backup into the correct order.

Match each Google Cloud service to its primary purpose.

Match each GCP security service to its function.

A multinational e-commerce company needs a globally distributed database that provides strong consistency and transactional support for order processing. Which Google Cloud database service should they use?

A data analytics company runs nightly batch jobs using Compute Engine instances. The jobs can tolerate interruptions, and the company wants to minimize costs. What should they do?

A financial services company is designing a multi-region application on Google Kubernetes Engine (GKE) for high availability. They need to serve user requests from the closest region and automatically failover if a region becomes unavailable. Which architecture should they use?

A media company wants to serve publicly available images and videos to a global audience with low latency. Which Google Cloud service should they primarily use?

A company is migrating an on-premises PostgreSQL database to Cloud SQL with minimal downtime. The database is 1 TB and the network link has 500 Mbps bandwidth. Which migration approach is most appropriate?

A small startup wants to deploy a containerized web application that scales automatically and only charges for resources used. They have limited operational experience. Which compute solution should they choose?

Track your progress over time

Start a Design and plan a cloud solution architecture only practice session

Related PCA topic practice pages