Question 1

PCA: Minimise operational overhead or fully managed

Accepted Answer

Managed and serverless services: Cloud Run, GKE Autopilot, Cloud SQL, Spanner, BigQuery, Dataflow. Self-managed VMs and clusters add patching, scaling and failure handling the team must run.

Question 2

PCA: Most secure with least privilege

Accepted Answer

Predefined roles granted to groups, service accounts without keys, private connectivity, and organization policy guardrails. Basic roles, shared keys and public endpoints widen the blast radius.

Question 3

PCA: Meet RTO and RPO at the lowest cost

Accepted Answer

The cheapest DR pattern that meets the targets: backup and restore, pilot light, warm standby, or hot.

Active-active everywhere is correct for near-zero targets only; it is waste for hours-level targets.

Question 4

PCA: Existing legacy systems must stay on premises

Accepted Answer

Hybrid connectivity (Interconnect or HA VPN) and integrate; do not force migration. The scenario fixes the constraint; answers that move the system break it (EHR insurer interfaces).

Question 5

PCA: Relational data, global users, strong consistency, horizontal write scaling

Accepted Answer

Spanner (multi-region for 99.999%). Cloud SQL and AlloyDB scale writes vertically within a region.

Question 6

PCA: Lift and shift of MySQL, PostgreSQL or SQL Server

Accepted Answer

Cloud SQL, with HA for zone failure and Database Migration Service for the move. Compatible engines, least change.

Question 7

PCA: Very high write throughput, time series or IoT, low latency, no joins

Accepted Answer

Bigtable with a row key that avoids hotspots. Wide-column store built for scale; not relational.

Question 8

PCA: SQL analytics over petabytes, serverless

Accepted Answer

BigQuery, with partitioning and clustering to cut scanned bytes. Warehouse, not a transactional database.

Question 9

PCA: Mobile or web app needing documents and real-time sync

Accepted Answer

Firestore. Document model with client SDKs and offline sync.

Question 10

PCA: Media library with unpredictable access and growing cost

Accepted Answer

Cloud Storage with Autoclass, plus lifecycle rules for deletion. Autoclass moves objects between classes by actual access; no minimum-duration guesswork.

Question 11

PCA: Records must not be deleted or altered for seven years

Accepted Answer

Retention policy with Bucket Lock (and object holds if needed). Locking makes the retention period irreversible, meeting WORM rules.

Question 12

PCA: Shared POSIX file system for many VMs

Accepted Answer

Filestore. Managed NFS; Cloud Storage is object storage.

Question 13

PCA: Stateless HTTP container, spiky traffic, scale to zero

Accepted Answer

Cloud Run. Per-request billing, no cluster operations.

Question 14

PCA: Many microservices needing Kubernetes features, with low node management

Accepted Answer

GKE Autopilot (Standard if special hardware or node customisation is needed). Autopilot manages nodes and bills per pod.

Question 15

PCA: Fault-tolerant batch, rendering or CI at lowest cost

Accepted Answer

Spot VMs, with checkpointing and a shutdown script. 60 to 91% cheaper but reclaimable with 30 seconds notice.

Question 16

PCA: Steady 24x7 baseline for one to three years

Accepted Answer

Committed use discounts, flexible if shapes will change. Discount for commitment; Spot is wrong for steady critical load.

Question 17

PCA: Run existing VMware vSphere workloads without conversion

Accepted Answer

Google Cloud VMware Engine. Fastest data centre exit with unchanged VMs and tools.

Question 18

PCA: Need consistent Kubernetes management on premises and in the cloud

Accepted Answer

GKE Enterprise fleets with Config Sync and Cloud Service Mesh. One control plane for policy, config and mesh across clusters.

Question 19

PCA: Patch and update many VMs consistently

Accepted Answer

Managed instance groups with new templates (rolling update) and VM Manager patch deployments. Replace instances from a golden image; automate patches for the rest.

Question 20

PCA: Global web app with CDN, WAF and path-based routing

Accepted Answer

Global external Application Load Balancer with Cloud CDN and Cloud Armor. One anycast IP, edge caching and protection.

Question 21

PCA: Fast, low-cost private link to on-premises, or backup for Interconnect

Accepted Answer

HA VPN with two tunnels and Cloud Router (BGP). Deployable in hours; 99.99% SLA with the redundant setup.

Question 22

PCA: High-volume, low-latency, consistent private connection

Accepted Answer

Dedicated Interconnect (or Partner Interconnect if you cannot reach a Google facility); redundant circuits in two metros for 99.99%. VPN over the internet cannot guarantee throughput or latency.

Question 23

PCA: Encrypt traffic over Interconnect

Accepted Answer

MACsec, or HA VPN over Cloud Interconnect. Interconnect is private but not encrypted by default.

Question 24

PCA: Many VPCs and sites needing connectivity, or overlapping IP ranges

Accepted Answer

Network Connectivity Center for hub and spoke; Private Service Connect for service publishing across overlapping ranges. VPC peering is not transitive and cannot have overlapping ranges.

Question 25

PCA: One organisation, central network team, many project teams

Accepted Answer

Shared VPC with a host project and service projects. Central control of subnets and firewalls with delegated app teams.

Question 26

PCA: Private VMs need updates from the internet; no inbound allowed

Accepted Answer

Cloud NAT, plus Private Google Access for Google APIs. NAT is outbound only.

Question 27

PCA: Prevent data being copied out of BigQuery or Cloud Storage even by an authorised but compromised identity

Accepted Answer

VPC Service Controls perimeter with access levels, tested in dry run. IAM alone allows the copy; the perimeter blocks cross-boundary API calls.

Question 28

PCA: Admins need SSH or RDP to VMs with no public IPs and no VPN

Accepted Answer

IAP TCP forwarding with OS Login. IAM-based access, audited, no exposed ports.

Question 29

PCA: Workload in AWS, Azure or GitHub Actions needs Google Cloud access without keys

Accepted Answer

Workload Identity Federation. Exchange the external token for short-lived Google credentials.

Question 30

PCA: A person needs temporary rights of a service account

Accepted Answer

Service account impersonation (Token Creator), or Privileged Access Manager for just-in-time roles. No shared keys, short-lived tokens, full audit trail.

Question 31

PCA: Regulation demands customer control of encryption keys, including revoking Google's access

Accepted Answer

CMEK in Cloud KMS; HSM if hardware-backed; EKM if keys must stay outside Google. Default encryption is Google-managed and cannot be revoked by the customer.

Question 32

PCA: Find and mask credit card numbers or PHI in data before analysts see it

Accepted Answer

Sensitive Data Protection: inspect, then de-identify (mask, tokenise). Built-in infotypes and transformations, works on Cloud Storage, BigQuery and streams.

Question 33

PCA: Resources must only be created in EU regions across all projects

Accepted Answer

Organization policy constraint gcp.resourceLocations at the organization or folder. Inherited guardrail; includes new projects.

Question 34

PCA: Only verified, signed container images may run on GKE

Accepted Answer

Binary Authorization with attestations from Cloud Build, plus Artifact Registry scanning. Deploy-time enforcement of the supply chain.

Question 35

PCA: Central, tamper-resistant audit logs from all current and future projects, kept for years

Accepted Answer

Aggregated log sink at the organization to a dedicated project's bucket or Cloud Storage with a locked retention policy; enable Data Access logs where needed.

Per-project sinks miss new projects; Data Access logs are off by default.

Question 36

PCA: Filter prompt injection and harmful model output

Accepted Answer

Model Armor in front of the model, with Sensitive Data Protection for leakage. Purpose-built screening for prompts and responses on any model.

Question 37

PCA: Health records or children's data

Accepted Answer

Sign the BAA for HIPAA, use covered services, restrict locations, VPC Service Controls, audit logs, minimise data and consent flows for COPPA.

Law dictates the controls; a Google certificate does not make your app compliant.

Question 38

PCA: Hundreds of TB, slow link, one-off

Accepted Answer

Transfer Appliance. Shipping beats months of transfer time.

Question 39

PCA: Recurring online copy from S3, Azure or on-premises files

Accepted Answer

Storage Transfer Service (with agents on premises). Managed, scheduled, checksummed.

Question 40

PCA: Move a production MySQL or SQL Server database with minimal downtime

Accepted Answer

Database Migration Service with continuous replication, then cut over. Replication keeps source live until cutover.

Question 41

PCA: Stream database changes into BigQuery

Accepted Answer

Datastream. Serverless change data capture.

Question 42

PCA: Inventory servers, map dependencies, estimate cost before migrating

Accepted Answer

Migration Center. Assessment and TCO before waves are planned.

Question 43

PCA: Move VMs from on-premises to Compute Engine with testing before cutover

Accepted Answer

Migrate to Virtual Machines (test clones, then cut over). Replicates while the source runs.

Question 44

PCA: Standard task such as OCR, translation or speech

Accepted Answer

A prebuilt API (Vision, Speech, Translation, Document AI) before a custom model. Fastest and cheapest; custom training last.

Question 45

PCA: Chatbot or search grounded in company data

Accepted Answer

Agent Builder with grounding on your data (RAG), with Gemini. Reduces hallucinations and needs no model training.

Question 46

PCA: Generated content must be approved before publishing (catalogue enrichment)

Accepted Answer

Human-in-the-loop review step with approve, reject, edit before the catalogue update. Risk control for generative output; named in the Cymbal case.

Question 47

PCA: Streaming events processed in real time with autoscaling

Accepted Answer

Pub/Sub into Dataflow, output to BigQuery. Managed, exactly-once streaming; Dataproc is for existing Spark.

Question 48

PCA: Large model training needing the best cost and performance at scale

Accepted Answer

TPUs or GPUs on AI Hypercomputer; Spot with checkpoints or flex-start for scarce capacity. Matches accelerator and consumption model to the job.

Question 49

PCA: Release with low risk and automatic rollback

Accepted Answer

Canary rollout (Cloud Run traffic split or Cloud Deploy) watched by SLO metrics. Small exposure first, rollback on signal.

Question 50

PCA: Partner or external developers consuming APIs, with quotas and analytics

Accepted Answer

Apigee. API products, developer portal, quotas, monetisation; API Gateway is simpler and lacks this.

Question 51

PCA: Alerts are being ignored

Accepted Answer

Alert on user-facing symptoms and SLO burn rate, route by severity, add runbooks. Cause-based, noisy alerts breed alert fatigue.

Question 52

PCA: Reliability is slipping while many features ship

Accepted Answer

Use the error budget: when spent, freeze risky releases and fix reliability. SRE trade-off mechanism agreed with product owners.

Question 53

PCA: Major incident in progress

Accepted Answer

Mitigate first (roll back, fail over), communicate, then root cause; blameless postmortem with owned action items. Restore service before investigating.

Question 54

PCA: Teams need safe self-service environments

Accepted Answer

Terraform blueprints in a service catalog, project factory, guardrails by organization policy. Consistent and fast without manual review of each request.

Question 55

PCA: Prove the system survives failure

Accepted Answer

Chaos experiments with a hypothesis and small blast radius, DR drills, and load tests above peak. Reliability is demonstrated, not assumed.

Question 56

PCA: Reduce cloud spend without hurting service

Accepted Answer

Labels and billing export, Recommender right-sizing, delete idle resources, autoscale, lifecycle rules, Spot and committed use. Remove waste before negotiating price.

Question 57

PCA: Large organisational change to a new platform

Accepted Answer

Executive sponsor, pilot group, training before go-live, communication plan, phased rollout. People causes most migration failures; big-bang cutovers are wrong.

PCA question patterns

Find a pattern

In this list

Wording that decides the answer

Databases and storage

Compute and containers

Networking

Security and compliance

Migration and data movement

AI and data platform

Process, delivery and operations