How should I use these Designing for Security and Compliance practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

PCA · topic practice

Designing for Security and Compliance practice questions

Q: Can I practise just Designing for Security and Compliance questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Designing for Security and Compliance domain.

Practise Google Professional Cloud Architect Designing for Security and Compliance practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Designing for Security and Compliance

Practice 10 questions Browse domain →

What the exam tests

What to know about Designing for Security and Compliance

Designing for Security and Compliance questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Designing for Security and Compliance exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Designing for Security and Compliance questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full Designing for Security and Compliance explanation →

A company wants to control which resources can be accessed by a service account in a specific project. Which IAM policy binding approach should be used?

Trap 1: Use VPC Service Controls to restrict the service account

VPC Service Controls control data exfiltration, not IAM permissions.

Trap 2: Add the service account to a Cloud Identity group and grant the…

While possible, this is not the most direct approach and still requires role binding at the appropriate scope.

Trap 3: Grant the service account a role at the organization level

This would grant access to all resources in the organization, not just the specific project.

Study all Designing for Security and Compliance common traps →

A
Use VPC Service Controls to restrict the service account
Why wrong: VPC Service Controls control data exfiltration, not IAM permissions.
B
Grant the service account a role at the project or resource level
IAM roles at the project or resource level restrict access to that scope.
C
Add the service account to a Cloud Identity group and grant the group a role
Why wrong: While possible, this is not the most direct approach and still requires role binding at the appropriate scope.
D
Grant the service account a role at the organization level
Why wrong: This would grant access to all resources in the organization, not just the specific project.

Designing for Security and Compliance practice questions

What to know about Designing for Security and Compliance

Common Designing for Security and Compliance exam traps

Designing for Security and Compliance questions

A company wants to control which resources can be accessed by a service account in a specific project. Which IAM policy binding approach should be used?

An organization requires that all container images deployed to GKE be signed and verified before deployment. Which GCP service should be used?

A security team wants to prevent data exfiltration from a GKE cluster to external storage. They need to restrict access to Cloud Storage buckets from the cluster without using private IPs. Which solution should they implement?

A company uses Cloud KMS with CMEK to encrypt data stored in BigQuery. They need to audit who has used the encryption key and when. Which type of audit log should they enable?

An engineer needs to grant a user the ability to create and manage service accounts in a project. Which predefined IAM role provides these permissions?

A company wants to enforce that all API calls to GCP services from outside their corporate network come through a specific Cloud VPN tunnel. Which GCP service can enforce this policy?

An organization needs to store secrets used by multiple GCP services. They require automatic rotation of secrets every 30 days and integration with Cloud Functions. Which service should they use?

A company wants to use its existing Active Directory credentials to authenticate users to the GCP Console. Which service should they integrate with?

Which GCP service can be used to detect and redact sensitive data such as credit card numbers in text files stored in Cloud Storage?

A company needs to ensure that only approved container images can be deployed to a GKE cluster. They already use Binary Authorization. What additional step is required to enforce this policy?

An organization needs to encrypt data at rest in BigQuery using keys that are rotated every 90 days. They want to manage the keys themselves but cannot store keys on-premises. Which encryption approach should they use?

A developer wants to allow a Compute Engine VM to authenticate to Google Cloud APIs without embedding service account keys in the VM image. What is the recommended approach?

A company wants to restrict network access to Cloud SQL instances such that only applications running in a specific VPC can connect. Which GCP feature should they use?

A company uses Cloud Armor to protect an HTTP(S) Load Balancer. They want to block traffic from a specific IP address range during off-peak hours but allow it during peak hours. How can they achieve this?

A company needs to ensure that only applications running in a specific GKE namespace can access a Cloud Storage bucket. Which approach should they use?

A company wants to enforce that only approved container images can be deployed to GKE. They also want to ensure images are scanned for vulnerabilities before deployment. Which two GCP services should they use? (Choose TWO).

A company needs to store secrets used by multiple GCP services. They require automatic rotation of secrets every 30 days and integration with Cloud Functions. Which two GCP services should they use? (Choose TWO).

Which two GCP audit log types are available by default? (Choose TWO).

A company wants to protect a web application from SQL injection and cross-site scripting (XSS) attacks. They also need to block traffic from specific geographic regions. Which three features of Cloud Armor should they use? (Choose THREE).

A company needs to ensure that data stored in Cloud Storage is encrypted with customer-managed keys that are rotated every 90 days. Which two steps must be taken to achieve this? (Choose TWO).

Track your progress over time

Start a Designing for Security and Compliance only practice session

Related PCA topic practice pages

Managing Implementation and Ensuring Solution and Operations Reliability practice questions

Designing and Planning a Cloud Solution Architecture practice questions

Managing and Provisioning a Solution Infrastructure practice questions

Designing for Security and Compliance practice questions

Analysing and Optimising Technical and Business Processes practice questions

Design and plan a cloud solution architecture practice questions

Manage and provision cloud infrastructure practice questions

Design for security and compliance practice questions

Analyze and optimize technical and business processes practice questions

Manage implementation of cloud architecture practice questions

Ensure solution and operations reliability practice questions

PCA fundamentals practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid