How should I use these Design for security and compliance practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Design for security and compliance questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Design for security and compliance domain.

PCA · topic practice

Design for security and compliance practice questions

Practise Google Professional Cloud Architect Design for security and compliance practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Design for security and compliance

Practice 10 questions Browse domain →

What the exam tests

What to know about Design for security and compliance

Design for security and compliance questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Design for security and compliance exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Design for security and compliance questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full Design for security and compliance explanation →

A company is migrating sensitive customer data to Google Cloud. They need to ensure data is encrypted at rest and in transit. Which Google Cloud service provides a centralized way to manage encryption keys used by Google Cloud services?

Trap 1: Cloud HSM

Cloud HSM is a hardware security module service for managing encryption keys, but Cloud KMS is the more general key management service.

Trap 2: Cloud External Key Manager (Cloud EKM)

Cloud EKM allows you to use keys managed outside Google Cloud, but it's not the centralized service for GCP-managed keys.

Trap 3: Secret Manager

Secret Manager is for storing API keys, passwords, and certificates, not encryption keys for GCP services.

Study all Design for security and compliance common traps →

A
Cloud HSM
Why wrong: Cloud HSM is a hardware security module service for managing encryption keys, but Cloud KMS is the more general key management service.
B
Cloud External Key Manager (Cloud EKM)
Why wrong: Cloud EKM allows you to use keys managed outside Google Cloud, but it's not the centralized service for GCP-managed keys.
C
Cloud Key Management Service (Cloud KMS)
Cloud KMS provides centralized management of encryption keys used by Google Cloud services.
D
Secret Manager
Why wrong: Secret Manager is for storing API keys, passwords, and certificates, not encryption keys for GCP services.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full Design for security and compliance explanation →

A financial services company runs a multi-tier application on Compute Engine. They need to restrict network access so that only the web tier can communicate with the application tier, and only the application tier can access the database tier. All VMs are in the same VPC network. What is the most secure way to implement this?

Trap 1: Use Identity-Aware Proxy (IAP) to manage network access between…

IAP is for user access to instances, not for inter-tier traffic control.

Trap 2: Create separate VPC networks for each tier and use VPC peering.

This adds complexity and is unnecessary; VPC firewall rules within a single network can achieve the goal.

Trap 3: Assign a unique service account to each tier and use IAM conditions…

Service accounts are used for authentication, not network-level traffic control.

Study all Design for security and compliance common traps →

A
Use Identity-Aware Proxy (IAP) to manage network access between tiers.
Why wrong: IAP is for user access to instances, not for inter-tier traffic control.
B
Use VPC firewall rules with target tags to allow traffic between specific tiers.
VPC firewall rules with tags are the simplest and most secure way to enforce network segmentation within a VPC.
C
Create separate VPC networks for each tier and use VPC peering.
Why wrong: This adds complexity and is unnecessary; VPC firewall rules within a single network can achieve the goal.
D
Assign a unique service account to each tier and use IAM conditions to restrict traffic.
Why wrong: Service accounts are used for authentication, not network-level traffic control.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full NAT/PAT explanation →

A healthcare organization uses Cloud Storage to store protected health information (PHI). They have a compliance requirement to ensure that all objects in the bucket are encrypted with a customer-managed key (CMK) that is rotated every 90 days. They also need to log all access to the bucket and detect anomalous access patterns. Which combination of Google Cloud services should they use?

Trap 1: Cloud Storage with default encryption, Cloud Audit Logs, and…

Default encryption uses Google-managed keys, not customer-managed, so rotation is not under customer control.

Trap 2: Cloud Storage with CMEK via Cloud HSM, Cloud Audit Logs, and Cloud…

Cloud DLP is for data loss prevention, not anomaly detection.

Trap 3: Cloud Storage with CSEK, Cloud Audit Logs, and Security Command…

CSEK keys are not managed via Cloud KMS and cannot be rotated automatically; they are supplied per request.

Study all Design for security and compliance common traps →

A
Cloud Storage with default encryption, Cloud Audit Logs, and Security Command Center
Why wrong: Default encryption uses Google-managed keys, not customer-managed, so rotation is not under customer control.
B
Cloud Storage with CMEK via Cloud HSM, Cloud Audit Logs, and Cloud DLP
Why wrong: Cloud DLP is for data loss prevention, not anomaly detection.
C
Cloud Storage with CSEK, Cloud Audit Logs, and Security Command Center
Why wrong: CSEK keys are not managed via Cloud KMS and cannot be rotated automatically; they are supplied per request.
D
Cloud Storage with CMEK via Cloud KMS, Cloud Audit Logs, and Chronicle
CMEK uses Cloud KMS for key management, Cloud Audit Logs for logging, and Chronicle for anomaly detection.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Design for security and compliance explanation →

An e-commerce platform uses Cloud SQL for MySQL to store user profiles and order history. The security team wants to ensure that database administrators (DBAs) cannot view plaintext credit card numbers stored in the database. They also want to minimize application changes. What should they do?

Trap 1: Implement column-level encryption using Cloud KMS in the…

This requires significant application changes and does not leverage built-in DLP capabilities.

Trap 2: Grant DBAs the Cloud SQL Viewer role to restrict access to data.

The Viewer role allows viewing data; it does not mask sensitive columns.

Trap 3: Use Cloud SQL Proxy to encrypt connections and limit DBA access.

Cloud SQL Proxy provides encrypted connections but does not mask data from DBAs.

Study all Design for security and compliance common traps →

A
Implement column-level encryption using Cloud KMS in the application layer.
Why wrong: This requires significant application changes and does not leverage built-in DLP capabilities.
B
Grant DBAs the Cloud SQL Viewer role to restrict access to data.
Why wrong: The Viewer role allows viewing data; it does not mask sensitive columns.
C
Use Cloud SQL Proxy to encrypt connections and limit DBA access.
Why wrong: Cloud SQL Proxy provides encrypted connections but does not mask data from DBAs.
D
Use Cloud DLP with de-identification and re-identification transforms on the Cloud SQL database.
Cloud DLP can automatically detect and tokenize sensitive data, with re-identification for authorized apps.

Full breakdown with real-world context →

Question 5easymultiple choice

Read the full Design for security and compliance explanation →

A company wants to ensure that only Compute Engine instances with a specific service account can access a Cloud Storage bucket. Which IAM condition should they use?

Trap 1: Condition: 'request.auth ==…

This is not a valid IAM condition syntax.

Trap 2: Condition: 'origin.serviceAccount ==…

'origin' is used for VPC network origins, not service accounts.

Trap 3: Condition: 'resource.serviceAccount ==…

The correct attribute is 'iam.serviceAccount', not 'resource.serviceAccount'.

Study all Design for security and compliance common traps →

A
Condition: 'request.auth == "serviceAccount:sa@project.iam.gserviceaccount.com"'
Why wrong: This is not a valid IAM condition syntax.
B
Condition: 'origin.serviceAccount == "sa@project.iam.gserviceaccount.com"'
Why wrong: 'origin' is used for VPC network origins, not service accounts.
C
Condition: 'resource.serviceAccount == "sa@project.iam.gserviceaccount.com"'
Why wrong: The correct attribute is 'iam.serviceAccount', not 'resource.serviceAccount'.
D
Condition: 'iam.serviceAccount == "sa@project.iam.gserviceaccount.com"'
The condition 'iam.serviceAccount' matches the service account used by the caller.

Full breakdown with real-world context →

Question 6hardmultiple choice

Read the full NAT/PAT explanation →

A multinational corporation operates in multiple regions and must comply with GDPR. They use Cloud Load Balancing to distribute traffic across regional backends. Their security team wants to block traffic from specific countries (e.g., non-EU countries) at the edge. What should they use?

Trap 1: Configure Cloud CDN to serve content only to EU-based users.

Cloud CDN does not have geo-blocking capabilities.

Trap 2: Set VPC firewall rules to allow traffic only from EU IP ranges.

VPC firewall rules are regional and not designed for global geo-blocking.

Trap 3: Configure Identity-Aware Proxy (IAP) to require user authentication…

IAP is for application access control, not filtering at the edge.

Study all Design for security and compliance common traps →

A
Configure Cloud CDN to serve content only to EU-based users.
Why wrong: Cloud CDN does not have geo-blocking capabilities.
B
Use Cloud Armor security policies with geographic-based denylist rules.
Cloud Armor can block traffic from specific countries at the Google Cloud edge.
C
Set VPC firewall rules to allow traffic only from EU IP ranges.
Why wrong: VPC firewall rules are regional and not designed for global geo-blocking.
D
Configure Identity-Aware Proxy (IAP) to require user authentication from allowed countries.
Why wrong: IAP is for application access control, not filtering at the edge.

Full breakdown with real-world context →

Question 7mediummulti select

Read the full Design for security and compliance explanation →

Which TWO are recommended practices for securing a Kubernetes Engine (GKE) cluster?

Trap 1: Disable HTTP load balancing to reduce attack surface.

HTTP load balancing is often needed and not a security issue.

Trap 2: Use the default Compute Engine service account for all GKE nodes.

Default service accounts have broad permissions; use least-privilege custom service accounts.

Trap 3: Enable basic authentication for easier access management.

Basic authentication is insecure; use OAuth2 or OIDC.

Study all Design for security and compliance common traps →

A
Disable HTTP load balancing to reduce attack surface.
Why wrong: HTTP load balancing is often needed and not a security issue.
B
Enable Binary Authorization to ensure only signed container images are deployed.
Binary Authorization enforces deployment of trusted images.
C
Use the default Compute Engine service account for all GKE nodes.
Why wrong: Default service accounts have broad permissions; use least-privilege custom service accounts.
D
Use Workload Identity to bind Kubernetes service accounts to IAM service accounts.
Workload Identity allows fine-grained access control for pods.
E
Enable basic authentication for easier access management.
Why wrong: Basic authentication is insecure; use OAuth2 or OIDC.

Full breakdown with real-world context →

Question 8hardmulti select

Read the full Design for security and compliance explanation →

Which THREE are valid methods to protect sensitive data in BigQuery?

Trap 1: Enable customer-managed encryption keys (CMEK) to encrypt sensitive…

CMEK encrypts the entire table, not individual columns.

Trap 2: Use IAM roles to grant access at the dataset level, which…

IAM roles do not provide data masking; they control access to datasets.

Study all Design for security and compliance common traps →

A
Enable customer-managed encryption keys (CMEK) to encrypt sensitive columns.
Why wrong: CMEK encrypts the entire table, not individual columns.
B
Apply Cloud DLP de-identification transforms during data ingestion.
Cloud DLP can automatically de-identify data before loading into BigQuery.
C
Create authorized views that query only non-sensitive columns.
Authorized views can share query results without exposing underlying tables.
D
Use BigQuery column-level security to restrict access to sensitive columns.
Column-level security allows you to restrict access to specific columns.
E
Use IAM roles to grant access at the dataset level, which automatically masks sensitive data.
Why wrong: IAM roles do not provide data masking; they control access to datasets.

Full breakdown with real-world context →

Question 9hardmultiple choice

Read the full Design for security and compliance explanation →

Your company runs a multi-region web application on Google Kubernetes Engine (GKE) with pods that process sensitive user data. The application uses Cloud SQL for PostgreSQL as the backend database. Your security team has implemented the following controls: 1) All traffic to the database is encrypted using SSL/TLS. 2) The GKE cluster uses Workload Identity to bind Kubernetes service accounts to IAM service accounts. 3) The Cloud SQL instance is configured with a public IP address and authorized networks to allow only the GKE cluster's node IP ranges. 4) The database credentials are stored in Secret Manager and mounted as volumes in the pods. Recently, a security audit revealed that a pod was compromised due to a container vulnerability. The attacker was able to exfiltrate sensitive data directly from the Cloud SQL database using the credentials from Secret Manager. The security team wants to prevent such exfiltration in the future while minimizing changes to the application code. Which course of action should you recommend?

Trap 1: Migrate the database to Cloud Spanner, which has built-in IAM…

Migrating to a different database is a major change and not necessary to solve the credential exfiltration problem.

Trap 2: Rotate the database password and store the new password in Secret…

While rotating passwords improves security, the credentials are still static and could be exfiltrated again.

Trap 3: Change the Cloud SQL instance to use a private IP address and…

This reduces network exposure but does not prevent a compromised pod from using stored credentials to access the database.

Study all Design for security and compliance common traps →

A
Deploy Cloud SQL Auth Proxy as a sidecar container in each pod, and configure IAM database authentication to replace static credentials.
Cloud SQL Auth Proxy with IAM authentication removes static credentials and uses IAM roles to control access, preventing credential exfiltration.
B
Migrate the database to Cloud Spanner, which has built-in IAM integration and automatic encryption.
Why wrong: Migrating to a different database is a major change and not necessary to solve the credential exfiltration problem.
C
Rotate the database password and store the new password in Secret Manager, then update the application to fetch the password from Secret Manager at startup.
Why wrong: While rotating passwords improves security, the credentials are still static and could be exfiltrated again.
D
Change the Cloud SQL instance to use a private IP address and disable public access, ensuring only the GKE cluster can reach it via VPC peering.
Why wrong: This reduces network exposure but does not prevent a compromised pod from using stored credentials to access the database.

Full breakdown with real-world context →

Question 10mediummultiple choice

Read the full Design for security and compliance explanation →

A company is migrating its on-premises workloads to Google Cloud. They have strict compliance requirements that all data at rest must be encrypted with customer-managed encryption keys (CMEK). Which Google Cloud service should they use to manage the lifecycle of these keys?

Trap 1: Secret Manager

Secret Manager stores secrets, not key lifecycle management.

Trap 2: Cloud External Key Manager (Cloud EKM)

Cloud EKM is for managing keys outside Google Cloud.

Trap 3: Cloud Hardware Security Module (Cloud HSM)

Cloud HSM provides hardware-backed keys but management is still done via Cloud KMS.

Study all Design for security and compliance common traps →

A
Secret Manager
Why wrong: Secret Manager stores secrets, not key lifecycle management.
B
Cloud External Key Manager (Cloud EKM)
Why wrong: Cloud EKM is for managing keys outside Google Cloud.
C
Cloud Key Management Service (Cloud KMS)
Cloud KMS is the correct service for managing CMEK.
D
Cloud Hardware Security Module (Cloud HSM)
Why wrong: Cloud HSM provides hardware-backed keys but management is still done via Cloud KMS.

Full breakdown with real-world context →

Question 11hardmulti select

Read the full Design for security and compliance explanation →

Which TWO of the following are valid methods to control access to Google Cloud resources using Identity and Access Management (IAM)?

Trap 1: Attach an IAM policy to a user

Users are identities; policies are attached to resources.

Trap 2: Assign an IAM role directly to a user

Roles are assigned via policies, not directly.

Trap 3: Attach an IAM policy to a service account

Service accounts are identities; policies are attached to resources.

Study all Design for security and compliance common traps →

A
Attach an IAM policy to an organization
IAM policies can be attached at the organization level.
B
Attach an IAM policy to a project
IAM policies can be attached at the project level.
C
Attach an IAM policy to a user
Why wrong: Users are identities; policies are attached to resources.
D
Assign an IAM role directly to a user
Why wrong: Roles are assigned via policies, not directly.
E
Attach an IAM policy to a service account
Why wrong: Service accounts are identities; policies are attached to resources.

Full breakdown with real-world context →

Question 12hardmultiple choice

Read the full Design for security and compliance explanation →

An organization has set the IAM policy constraint 'constraints/iam.allowedPolicyMemberDomains' with the values shown. Which of the following users can be granted an IAM role on a project in this organization?

Exhibit

Refer to the exhibit.

```yaml
# organization_policy.yaml
constraint: constraints/iam.allowedPolicyMemberDomains
listPolicy:
  allowedValues:
    - C0xxxxxxx  # Google Cloud organization ID
    - A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6  # Cloud Identity domain: example.com
```

Trap 1: external@otherdomain.com

External domain not allowed.

Trap 2: admin@another-customer-domain.com

Domain not in allowed list.

Study all Design for security and compliance common traps →

A
service-account@project-id.iam.gserviceaccount.com
Service accounts within the organization are allowed.
B
external@otherdomain.com
Why wrong: External domain not allowed.
C
admin@another-customer-domain.com
Why wrong: Domain not in allowed list.
D
user@example.com
The constraint allows members from the example.com domain.

Full breakdown with real-world context →

Question 13mediummultiple choice

Read the full Design for security and compliance explanation →

Your company has a production environment on Google Cloud that includes Compute Engine instances, Cloud Storage buckets, and BigQuery datasets. Security policies require that all data at rest is encrypted with CMEK, and audit logs must be retained for 7 years. The current configuration uses Google-managed encryption keys. You have been asked to transition to CMEK for all resources. After enabling CMEK for new resources, you discover that the existing resources are not re-encrypted. To comply with the policy, you need to re-encrypt the existing data. What should you do?

Trap 1: Enable CMEK on the existing resources by modifying the resource's…

CMEK does not automatically re-encrypt existing data for most services.

Trap 2: Delete the existing resources and recreate them with CMEK enabled

Deleting production resources risks data loss and downtime.

Trap 3: Enable Data Loss Prevention (DLP) API to scan and re-encrypt data…

DLP is for data classification, not re-encryption.

Study all Design for security and compliance common traps →

A
Enable CMEK on the existing resources by modifying the resource's encryption settings. This will automatically re-encrypt the data.
Why wrong: CMEK does not automatically re-encrypt existing data for most services.
B
Delete the existing resources and recreate them with CMEK enabled. Then restore data from backups.
Why wrong: Deleting production resources risks data loss and downtime.
C
Enable Data Loss Prevention (DLP) API to scan and re-encrypt data automatically.
Why wrong: DLP is for data classification, not re-encryption.
D
For Compute Engine: create new disks with CMEK, attach them, and copy data. For Cloud Storage: rewrite objects with CMEK. For BigQuery: copy datasets to new datasets with CMEK.
This correctly re-encrypts existing data for each service.

Full breakdown with real-world context →

Question 14mediummultiple choice

Read the full NAT/PAT explanation →

A company is deploying a multi-tier web application on Google Cloud. The application must comply with PCI DSS. Which combination of Google Cloud services should be used to restrict access to the database tier to only the application tier, while also encrypting data at rest and in transit?

Trap 1: Use Cloud Spanner with private IP and SSL/TLS, and enable…

Cloud Spanner is not optimized for typical relational web app workloads and may not meet all PCI DSS requirements easily.

Trap 2: Use Cloud SQL with public IP and SSL/TLS, and enable Google-managed…

Public IP does not restrict network access to only the app tier.

Trap 3: Use Cloud Datastore with secure WebSocket connections and enable…

Cloud Datastore is NoSQL and not appropriate for relational data; WebSocket is not standard for database connections.

Study all Design for security and compliance common traps →

A
Use Cloud Spanner with private IP and SSL/TLS, and enable Google-managed encryption keys
Why wrong: Cloud Spanner is not optimized for typical relational web app workloads and may not meet all PCI DSS requirements easily.
B
Use Cloud SQL with public IP and SSL/TLS, and enable Google-managed encryption keys
Why wrong: Public IP does not restrict network access to only the app tier.
C
Use Cloud Datastore with secure WebSocket connections and enable customer-managed encryption keys
Why wrong: Cloud Datastore is NoSQL and not appropriate for relational data; WebSocket is not standard for database connections.
D
Use Cloud SQL with private IP and SSL/TLS, and enable Cloud Key Management Service (KMS) to create a key ring and customer-managed encryption key (CMEK)
Private IP isolates the database, SSL/TLS encrypts in transit, CMEK encrypts at rest with customer-managed keys.

Full breakdown with real-world context →

Question 15hardmulti select

Read the full Design for security and compliance explanation →

An organization is implementing a data loss prevention (DLP) strategy for sensitive data stored in Cloud Storage. They want to automatically detect and redact credit card numbers in CSV files uploaded to a specific bucket. Which TWO Google Cloud services should they combine to achieve this?

Trap 1: Cloud Dataflow

Dataflow is for batch/stream data processing, not event-triggered file redaction.

Trap 2: Cloud Run

Cloud Run is for containerized applications; it's not the best fit for simple event-triggered DLP.

Trap 3: BigQuery

BigQuery is for data warehousing, not file-level DLP.

Study all Design for security and compliance common traps →

A
Cloud Dataflow
Why wrong: Dataflow is for batch/stream data processing, not event-triggered file redaction.
B
Cloud Run
Why wrong: Cloud Run is for containerized applications; it's not the best fit for simple event-triggered DLP.
C
Cloud DLP
Cloud DLP provides inspection and redaction of sensitive data types like credit card numbers.
D
Cloud Functions
Cloud Functions can be triggered by Cloud Storage events (e.g., finalize) to call DLP API.
E
BigQuery
Why wrong: BigQuery is for data warehousing, not file-level DLP.

Full breakdown with real-world context →

Question 16easymultiple choice

Review the full subnetting walkthrough →

An engineer runs the above command and sees two firewall rules that allow SSH access. A security review requires that SSH access be allowed only from the bastion subnet 10.0.1.0/24. What should the engineer do to meet the requirement?

Network Topology

Trap 1: Add a firewall rule with priority 500 that denies SSH from all IPs

A deny rule with higher priority (lower number) would override the allow rules, blocking SSH from bastion as well.

Trap 2: Change the priority of allow-ssh-ingress to 2000

Priority does not change the source range; the rule still allows all IPs.

Trap 3: Remove the target tag 'ssh-allowed' from allow-ssh-from-bastion

This would prevent the bastion rule from applying to instances, blocking SSH from bastion.

Study all Design for security and compliance common traps →

A
Add a firewall rule with priority 500 that denies SSH from all IPs
Why wrong: A deny rule with higher priority (lower number) would override the allow rules, blocking SSH from bastion as well.
B
Change the priority of allow-ssh-ingress to 2000
Why wrong: Priority does not change the source range; the rule still allows all IPs.
C
Delete the allow-ssh-ingress rule
Deleting the overly permissive rule leaves only the bastion-specific rule, meeting the requirement.
D
Remove the target tag 'ssh-allowed' from allow-ssh-from-bastion
Why wrong: This would prevent the bastion rule from applying to instances, blocking SSH from bastion.

Full breakdown with real-world context →

Question 17mediumdrag order

Read the full Design for security and compliance explanation →

Drag and drop the steps to configure a Cloud Load Balancer with a backend service consisting of Compute Engine instances into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 18mediumdrag order

Read the full Design for security and compliance explanation →

Drag and drop the steps to set up a shared VPC in Google Cloud for a multi-project environment into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 19mediummatching

Read the full Design for security and compliance explanation →

Match each GCP compute service to its characteristic.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Virtual machines with full control

Managed Kubernetes clusters

Serverless containers

Platform as a Service (PaaS)

Event-driven serverless functions

Question 20mediummatching

Read the full Design for security and compliance explanation →

Match each GCP data processing service to its use case.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Stream and batch data processing (Apache Beam)

Managed Hadoop and Spark clusters

Asynchronous messaging for event ingestion

Visual data integration pipelines

Workflow orchestration (Apache Airflow)

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Design for security and compliance sessions

Start a Design for security and compliance only practice session

Every question in these sessions is drawn from the Design for security and compliance domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Design for security and compliance questions →Mixed PCA session

Frequently asked questions

What does the PCA exam test about Design for security and compliance?: Design for security and compliance questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Design for security and compliance questions in a focused session?: Yes — the session launcher on this page draws every question from the Design for security and compliance domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other PCA topics?: Use the topic links above to move to related areas, or go back to the PCA question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the PCA exam covers. They are not copied from any real exam or dump site.

Design for security and compliance only

10 questions 20 questions 30 questions 50 questions

Mixed PCA session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All PCA questions Design for security and compliance domain overview PCA exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Design for security and compliance practice questions

What to know about Design for security and compliance

Common Design for security and compliance exam traps

Design for security and compliance questions

A company is migrating sensitive customer data to Google Cloud. They need to ensure data is encrypted at rest and in transit. Which Google Cloud service provides a centralized way to manage encryption keys used by Google Cloud services?

An e-commerce platform uses Cloud SQL for MySQL to store user profiles and order history. The security team wants to ensure that database administrators (DBAs) cannot view plaintext credit card numbers stored in the database. They also want to minimize application changes. What should they do?

A company wants to ensure that only Compute Engine instances with a specific service account can access a Cloud Storage bucket. Which IAM condition should they use?

A multinational corporation operates in multiple regions and must comply with GDPR. They use Cloud Load Balancing to distribute traffic across regional backends. Their security team wants to block traffic from specific countries (e.g., non-EU countries) at the edge. What should they use?

Which TWO are recommended practices for securing a Kubernetes Engine (GKE) cluster?

Which THREE are valid methods to protect sensitive data in BigQuery?

A company is migrating its on-premises workloads to Google Cloud. They have strict compliance requirements that all data at rest must be encrypted with customer-managed encryption keys (CMEK). Which Google Cloud service should they use to manage the lifecycle of these keys?

Which TWO of the following are valid methods to control access to Google Cloud resources using Identity and Access Management (IAM)?

An organization has set the IAM policy constraint 'constraints/iam.allowedPolicyMemberDomains' with the values shown. Which of the following users can be granted an IAM role on a project in this organization?

Exhibit

A company is deploying a multi-tier web application on Google Cloud. The application must comply with PCI DSS. Which combination of Google Cloud services should be used to restrict access to the database tier to only the application tier, while also encrypting data at rest and in transit?

An organization is implementing a data loss prevention (DLP) strategy for sensitive data stored in Cloud Storage. They want to automatically detect and redact credit card numbers in CSV files uploaded to a specific bucket. Which TWO Google Cloud services should they combine to achieve this?

An engineer runs the above command and sees two firewall rules that allow SSH access. A security review requires that SSH access be allowed only from the bastion subnet 10.0.1.0/24. What should the engineer do to meet the requirement?

Drag and drop the steps to configure a Cloud Load Balancer with a backend service consisting of Compute Engine instances into the correct order.

Drag and drop the steps to set up a shared VPC in Google Cloud for a multi-project environment into the correct order.

Match each GCP compute service to its characteristic.

Match each GCP data processing service to its use case.

Track your progress over time

Start a Design for security and compliance only practice session

Related PCA topic practice pages

Design and plan a cloud solution architecture practice questions

Manage and provision cloud infrastructure practice questions