Case Study: Cymbal Retail. Cymbal wants to modernize its operations by generating product attributes and images from supplier-provided information using Generative AI. They must incorporate a Human-in-the-Loop (HITL) review process before the live catalog (stored in Cloud SQL for MySQL) is updated. Which architecture provides the most scalable, cost-effective, and serverless approach while meeting these exact requirements?

Use Vertex AI Gemini for text and Imagen for image generation. Store intermediate results in Firestore. Deploy a Cloud Run web app for the HITL UI, which upon approval, triggers an Eventarc event to a Cloud Run function to update Cloud SQL.

Case Study: KnightMotives Automotive. KnightMotives plans to monetize the vast amounts of telemetry data generated by its autonomous vehicle fleet to finance new technology investments. They need to securely ingest this data from global locations (including rural areas with intermittent connectivity), process it in real-time, and expose specific aggregated datasets to external automotive partners without moving the data. Which combination of services should they implement? (Select 2)

Publish the aggregated datasets to BigQuery and securely share them with external partners using Analytics Hub, granting subscribe access to authorized external identities. | Use Pub/Sub to ingest the telemetry data stream and Dataflow to process and clean the data in real-time before writing the aggregated results to BigQuery.

Guided by the Performance Optimization pillar of the Google Cloud Well-Architected Framework, your enterprise is migrating an intensive high-performance computing (HPC) application. The workload consists of tightly coupled MPI (Message Passing Interface) nodes that require single-digit microsecond latency between instances. The job runs predictably at the end of each month for exactly 48 hours. Which compute deployment strategy guarantees the necessary network performance while optimizing costs?

Deploy Compute Engine C2 (Compute-optimized) instances within a single zone using a Compact Placement Policy, and provision them on-demand without CUDs.

Your organization is provisioning a multi-cloud network architecture linking Google Cloud with AWS. You need to establish highly available, secure connectivity with a guaranteed throughput of 2 Gbps. You want to minimize hardware procurement lead times and physical cross-connect management overhead. Which provisioning approach best satisfies these requirements?

Configure an HA VPN over the public internet between Google Cloud Router and AWS Transit Gateway, utilizing multiple aggregated tunnels to achieve the 2 Gbps throughput.

A retail client is managing their expanding global inventory database on Cloud Spanner. The database has grown to 50 TB, but they are observing severe read latency hotspots during flash sales when millions of users repeatedly query the exact same top 10 trending items simultaneously. Which two architectural provisioning strategies should you apply to alleviate these hotspots while maintaining horizontal scalability? (Select 2)

Implement a Memorystore for Redis cache cluster in front of Cloud Spanner to absorb high-frequency read requests for the trending items. | Utilize Cloud Spanner's built-in query statistics and Key Visualizer to continuously monitor and pinpoint the exact row keys causing the read hotspots.

Case Study: EHR Healthcare. EHR Healthcare hosts highly sensitive Electronic Health Records (EHR) on GKE. To maintain stringent regulatory compliance (HIPAA), they must ensure that pods processing patient records cannot make unauthorized outbound connections to the public internet, while still allowing egress to specific managed Google APIs (e.g., Cloud Storage) without routing over the public internet. How should you design this security control?

Configure Private Google Access on the VPC subnet housing the GKE cluster, and implement Kubernetes Network Policies to block all pod egress traffic except to the private.googleapis.com IP range.

Based on the 'Implement Zero Trust' and 'Least Privilege' principles of the Google Cloud Well-Architected Framework, your security team needs to audit and restrict elevated access in your production environment. Developers currently have persistent `roles/editor` access to troubleshoot live issues, leading to compliance violations. Which combination of actions should you take to design a secure, compliant access model? (Select 2)

Revoke the persistent `roles/editor` access and implement Privileged Access Manager (PAM) to grant just-in-time, time-bound elevated access based on manual approvals. | Utilize IAM Recommender (Policy Intelligence) to analyze access patterns over the last 90 days and apply the auto-generated least-privilege custom roles.

A government agency mandates that all highly sensitive data processed in Google Cloud must be encrypted at rest using keys that the agency retains ultimate physical control over within their own on-premises Hardware Security Modules (HSMs). They need to use these keys seamlessly with BigQuery for analytics. Which cryptographic architecture meets this regulatory need?

Cloud External Key Manager (Cloud EKM) configured to communicate over a secure connection to the agency's on-premises HSM.

Case Study: Altostrat Media. Altostrat’s operations team complains of alert fatigue. Their current open-source monitoring systems generate hundreds of email notifications daily for minor CPU spikes during scheduled video transcoding jobs, causing critical database failures to go unnoticed. To optimize this technical process and align with SRE best practices, what should they do?

Define Service Level Objectives (SLOs) tied to user journeys, configure alerts to trigger only when the Error Budget burn rate exceeds a critical threshold, and route them to an incident management platform.

Following the Cost Optimization pillar of the Google Cloud Well-Architected Framework, your enterprise is analyzing their monthly BigQuery spend. They notice costs have skyrocketed due to a mix of automated dashboard queries and unpredictable ad-hoc queries from data scientists analyzing petabytes of raw data. Which combination of optimizations should you apply to analyze and reduce these business costs? (Select 2)

Transition the predictable automated dashboard workloads to BigQuery Editions (capacity-based pricing) to establish a baseline cost structure. | Enforce a BigQuery custom quota setting a maximum bytes billed per query specifically for the data scientists' projects.

Free Practice · No Signup Required

30 Free GCP GCP-PCA Practice Questions

Real practice questions for the GCP Professional Cloud Architect (GCP-PCA) exam, with answers and detailed explanations. Updated 2026.

Start Timed Exam Mode Unlock all 450 Questions

Free questions

Passing score

Not publicly disclosed (scaled scoring)

Exam time

120 minutes

Question pool

450 Questions

Below are 30 real practice questions for the GCP Professional Cloud Architect (GCP-PCA) exam. Each question shows the correct answer and a detailed explanation when you reveal it. Use these to benchmark your readiness — if you score below 70% on these 30 questions, plan for at least 4 more weeks of study before booking.

GCP-PCA Practice Questions

FreePracticeQuiz.questionLabelDesigning and planning a cloud solution architecture
Case Study: Cymbal Retail. Cymbal wants to modernize its operations by generating product attributes and images from supplier-provided information using Generative AI. They must incorporate a Human-in-the-Loop (HITL) review process before the live catalog (stored in Cloud SQL for MySQL) is updated. Which architecture provides the most scalable, cost-effective, and serverless approach while meeting these exact requirements?
A
Use Vertex AI Gemini for text and Imagen for image generation. Store intermediate results in Firestore. Deploy a Cloud Run web app for the HITL UI, which upon approval, triggers an Eventarc event to a Cloud Run function to update Cloud SQL.
B
Use the Cloud Vision API and Cloud Natural Language API. Store the generated content in Cloud Storage. Deploy an App Engine standard app for associates to review content, writing approved changes via Datastream to Cloud SQL.
C
Run open-source LLMs on a GKE Standard cluster with attached GPUs. Store intermediate generated assets locally on Persistent Disks. Expose a Kubernetes service for associates to review and directly update Cloud SQL via JDBC.
D
Ingest supplier data into BigQuery. Use BigQuery ML to generate text attributes and call Vertex AI Imagen remotely. Use Looker as the HITL UI to review data, and scheduled queries to push approved data to Cloud SQL.
FreePracticeQuiz.questionLabelDesigning and planning a cloud solution architecture
Case Study: KnightMotives Automotive. KnightMotives plans to monetize the vast amounts of telemetry data generated by its autonomous vehicle fleet to finance new technology investments. They need to securely ingest this data from global locations (including rural areas with intermittent connectivity), process it in real-time, and expose specific aggregated datasets to external automotive partners without moving the data. Which combination of services should they implement? (Select 2)
A
Use Cloud IoT Core with MQTT protocol to buffer data locally on the vehicles during rural disconnects, securely transmitting to Cloud Pub/Sub upon reconnection.
B
Deploy a global external Application Load Balancer in front of Cloud Run services to act as an ingestion gateway, writing validated payloads directly to Cloud Storage.
C
Publish the aggregated datasets to BigQuery and securely share them with external partners using Analytics Hub, granting subscribe access to authorized external identities.
D
Use Pub/Sub to ingest the telemetry data stream and Dataflow to process and clean the data in real-time before writing the aggregated results to BigQuery.
E
Configure VPC Service Controls perimeters around BigQuery and export the aggregated data via Cloud Storage signed URLs to external partners.
FreePracticeQuiz.questionLabelDesigning and planning a cloud solution architecture
Guided by the Performance Optimization pillar of the Google Cloud Well-Architected Framework, your enterprise is migrating an intensive high-performance computing (HPC) application. The workload consists of tightly coupled MPI (Message Passing Interface) nodes that require single-digit microsecond latency between instances. The job runs predictably at the end of each month for exactly 48 hours. Which compute deployment strategy guarantees the necessary network performance while optimizing costs?
A
Deploy the nodes on GKE Autopilot in a single region to ensure dynamic scaling, utilizing Spot Pods to minimize the 48-hour compute costs.
B
Deploy Compute Engine C2 (Compute-optimized) instances within a single zone using a Compact Placement Policy, and leverage 1-year Committed Use Discounts (CUDs).
C
Deploy Compute Engine instances using a Spread Placement Policy across multiple zones within the same region to balance high availability and low latency.
D
Deploy Compute Engine C2 (Compute-optimized) instances within a single zone using a Compact Placement Policy, and provision them on-demand without CUDs.
FreePracticeQuiz.questionLabelManaging and provisioning a cloud solution infrastructure
Your organization is provisioning a multi-cloud network architecture linking Google Cloud with AWS. You need to establish highly available, secure connectivity with a guaranteed throughput of 2 Gbps. You want to minimize hardware procurement lead times and physical cross-connect management overhead. Which provisioning approach best satisfies these requirements?
A
Provision a Dedicated Interconnect circuit using a colocation facility, configuring BGP over two 10 Gbps physical links.
B
Deploy a Partner Interconnect connection through a supported service provider, provisioning two 1 Gbps VLAN attachments for high availability.
C
Configure an HA VPN over the public internet between Google Cloud Router and AWS Transit Gateway, utilizing multiple aggregated tunnels to achieve the 2 Gbps throughput.
D
Use Cross-Cloud Network with Network Connectivity Center to automatically provision private fiber lines between the cloud providers without third-party ISPs.
FreePracticeQuiz.questionLabelManaging and provisioning a cloud solution infrastructure
A retail client is managing their expanding global inventory database on Cloud Spanner. The database has grown to 50 TB, but they are observing severe read latency hotspots during flash sales when millions of users repeatedly query the exact same top 10 trending items simultaneously. Which two architectural provisioning strategies should you apply to alleviate these hotspots while maintaining horizontal scalability? (Select 2)
A
Implement a Memorystore for Redis cache cluster in front of Cloud Spanner to absorb high-frequency read requests for the trending items.
B
Redesign the Spanner schema to monotonically increase the primary keys of the products table to ensure sequential data distribution.
C
Use a Spanner bit-reverse sequence or UUID (Universally Unique Identifier) for the primary key of the products table to prevent write hotspots.
D
Provision a Cloud SQL for PostgreSQL read replica in each region to offload the analytical read queries from the primary Spanner instances.
E
Utilize Cloud Spanner's built-in query statistics and Key Visualizer to continuously monitor and pinpoint the exact row keys causing the read hotspots.
FreePracticeQuiz.questionLabelDesigning for security and compliance
Case Study: EHR Healthcare. EHR Healthcare hosts highly sensitive Electronic Health Records (EHR) on GKE. To maintain stringent regulatory compliance (HIPAA), they must ensure that pods processing patient records cannot make unauthorized outbound connections to the public internet, while still allowing egress to specific managed Google APIs (e.g., Cloud Storage) without routing over the public internet. How should you design this security control?
A
Deploy a NAT Gateway on the VPC and configure Kubernetes egress Network Policies to deny all internet-bound traffic except to the NAT IP.
B
Configure Private Google Access on the VPC subnet housing the GKE cluster, and implement Kubernetes Network Policies to block all pod egress traffic except to the private.googleapis.com IP range.
C
Enable VPC Service Controls to create a service perimeter around the GKE cluster, and configure Cloud Armor egress rules to filter malicious outbound requests.
D
Assign public IP addresses to the GKE nodes but use Google Cloud Next Generation Firewall (NGFW) policies to drop all packets with an external destination.
FreePracticeQuiz.questionLabelDesigning for security and compliance
Based on the 'Implement Zero Trust' and 'Least Privilege' principles of the Google Cloud Well-Architected Framework, your security team needs to audit and restrict elevated access in your production environment. Developers currently have persistent roles/editor access to troubleshoot live issues, leading to compliance violations. Which combination of actions should you take to design a secure, compliant access model? (Select 2)
A
Revoke the persistent roles/editor access and implement Privileged Access Manager (PAM) to grant just-in-time, time-bound elevated access based on manual approvals.
B
Create a custom IAM role that duplicates the exact permissions of roles/editor but restrict its usage geographically using VPC Service Controls.
C
Utilize IAM Recommender (Policy Intelligence) to analyze access patterns over the last 90 days and apply the auto-generated least-privilege custom roles.
D
Grant developers the roles/viewer role globally and require them to SSH into production Compute Engine VMs to execute write operations via local service accounts.
E
Implement Identity-Aware Proxy (IAP) on the Google Cloud Console to restrict access strictly to users within the corporate office network.
FreePracticeQuiz.questionLabelDesigning for security and compliance
A government agency mandates that all highly sensitive data processed in Google Cloud must be encrypted at rest using keys that the agency retains ultimate physical control over within their own on-premises Hardware Security Modules (HSMs). They need to use these keys seamlessly with BigQuery for analytics. Which cryptographic architecture meets this regulatory need?
A
Customer-Managed Encryption Keys (CMEK) via Cloud KMS backed by a Google Cloud HSM.
B
Customer-Supplied Encryption Keys (CSEK) dynamically provided in API requests to BigQuery.
C
Cloud External Key Manager (Cloud EKM) configured to communicate over a secure connection to the agency's on-premises HSM.
D
Default Google-managed encryption keys, supplemented with client-side application encryption before loading data into BigQuery.
FreePracticeQuiz.questionLabelAnalyzing and optimizing technical and business processes
Case Study: Altostrat Media. Altostrat’s operations team complains of alert fatigue. Their current open-source monitoring systems generate hundreds of email notifications daily for minor CPU spikes during scheduled video transcoding jobs, causing critical database failures to go unnoticed. To optimize this technical process and align with SRE best practices, what should they do?
A
Write a script to automatically delete all alerts that originate from the video transcoding instances to reduce inbox clutter.
B
Define Service Level Objectives (SLOs) tied to user journeys, configure alerts to trigger only when the Error Budget burn rate exceeds a critical threshold, and route them to an incident management platform.
C
Migrate from Prometheus to Cloud Monitoring, and lower the CPU utilization alert thresholds so they only trigger when an instance hits 100% capacity for 1 hour.
D
Hire a dedicated Tier 1 support team to manually review all emails and escalate only the critical database alerts to the core SRE team.
FreePracticeQuiz.questionLabelAnalyzing and optimizing technical and business processes
Following the Cost Optimization pillar of the Google Cloud Well-Architected Framework, your enterprise is analyzing their monthly BigQuery spend. They notice costs have skyrocketed due to a mix of automated dashboard queries and unpredictable ad-hoc queries from data scientists analyzing petabytes of raw data. Which combination of optimizations should you apply to analyze and reduce these business costs? (Select 2)
A
Transition the predictable automated dashboard workloads to BigQuery Editions (capacity-based pricing) to establish a baseline cost structure.
B
Enforce a BigQuery custom quota setting a maximum bytes billed per query specifically for the data scientists' projects.
C
Convert all raw data tables to JSON format to compress storage sizes, drastically reducing the cost of full table scans.
D
Disable BigQuery result caching, as storing cached results incurs high regional persistent disk storage fees.
E
Move all data scientists' workloads to Cloud SQL, as relational databases inherently prevent large analytical table scans.
FreePracticeQuiz.questionLabelManaging implementation
Your team is managing the deployment of a microservices application using Terraform. To comply with auditing policies, the security team needs an automated way to verify that no infrastructure drift has occurred (i.e., manual changes made via the Cloud Console overriding the Terraform configuration) and automatically notify the security Slack channel if drift is detected. How should you manage this implementation process?
A
Configure VPC Flow Logs to monitor all API calls made to the cloudresourcemanager.googleapis.com endpoint and filter for manual edits.
B
Implement a scheduled CI/CD pipeline using Cloud Build that runs terraform plan -detailed-exitcode. Use a Cloud Run function to send the results to Slack if the exit code is non-zero.
C
Use the Cloud Asset Inventory API to export the state to BigQuery every hour and compare the hash with the Terraform terraform.tfstate file stored in Cloud Storage.
D
Set up an Organization Policy constraint that strictly denies any user access to the Google Cloud Console UI, forcing all interactions through the CLI.
FreePracticeQuiz.questionLabelManaging implementation
Case Study: KnightMotives Automotive. KnightMotives is heavily fragmented with multiple codebases across its vehicle lines. To modernize their IT infrastructure, they are migrating to Google Cloud and want to establish a robust API management platform to safely expose their legacy ERP backend systems to modern mobile applications and third-party dealer portals. Which implementation steps are necessary using Apigee? (Select 2)
A
Deploy an Apigee API proxy to decouple the modern mobile applications from the backend legacy ERP systems.
B
Configure Apigee to route all API calls over the public internet directly to the on-premises mainframe to avoid VPN tunneling costs.
C
Implement OAuth 2.0 and API key verification policies within Apigee to secure access for third-party dealer portals.
D
Use API Gateway instead of Apigee, as Apigee is not designed for hybrid architectures involving on-premises mainframes.
E
Refactor the entire legacy ERP system into microservices before attempting to configure Apigee routing policies.
FreePracticeQuiz.questionLabelEnsuring solution and operations reliability
You have deployed a critical, globally distributed web application on Compute Engine Managed Instance Groups (MIGs) behind a Global External Application Load Balancer. To ensure operations reliability, you want the load balancer to automatically route traffic to a custom static 'Maintenance' page hosted on Cloud Storage if all backend MIGs fail their health checks simultaneously. How should you ensure this solution reliability?
A
Set up a Cloud DNS routing policy with a health check that redirects to the Cloud Storage bucket URL on failure.
B
Configure custom error handling within the backend MIG template to serve a local HTML file if the application crashes.
C
Add a backend bucket containing the maintenance page to the existing URL map, and configure a custom error response policy on the load balancer to route 5xx errors to this backend bucket.
D
Use Cloud Armor to detect backend timeouts and inject a custom HTML response payload using an edge security policy.
FreePracticeQuiz.questionLabelEnsuring solution and operations reliability
Guided by the Reliability pillar of the Google Cloud Well-Architected Framework, your organization is designing a disaster recovery strategy for a mission-critical transactional workload on Cloud SQL. The business demands an RPO (Recovery Point Objective) of zero and an RTO (Recovery Time Objective) of under 2 minutes for a zonal failure within the primary region. What architecture pattern must you deploy?
A
A Cloud SQL instance configured with automated daily backups and point-in-time recovery (PITR) enabled.
B
A Cloud SQL instance with Regional High Availability (HA) enabled, providing synchronous replication to a standby instance in a different zone.
C
A single Cloud SQL instance paired with Datastream to replicate data asynchronously to a separate disaster recovery region.
D
A Cloud SQL instance configured with an external read replica in a different region, triggering a manual promotion via Cloud Run functions upon failure.
FreePracticeQuiz.questionLabelManaging and provisioning a cloud solution infrastructure
Case Study: Cymbal Retail. Cymbal Retail relies on a hybrid environment with massive volumes of daily product inventory updates originating from an on-premises Microsoft SQL Server. They want to modernize their stack by streaming these updates continuously into BigQuery to power real-time dashboards for their Conversational Commerce agents, without writing custom extract/load code. Which combination of services provisions this pipeline? (Select 2)
A
Provision a Datastream connection to capture Change Data Capture (CDC) events directly from the on-premises Microsoft SQL Server.
B
Deploy Cloud Data Fusion to execute hourly batch scripts via a JDBC driver to poll the on-premises database for changes.
C
Configure Datastream with a native BigQuery destination to seamlessly replicate the CDC events into BigQuery tables.
D
Deploy a custom Dataflow pipeline utilizing the Apache Beam JDBC IO connector to continuously query the database and stream into BigQuery.
E
Use Dataflow with a Google-provided template to read the Datastream CDC stream from Cloud Storage and write it to BigQuery.
FreePracticeQuiz.questionLabelDesigning and planning a cloud solution architecture
Your company operates a multicloud environment spanning Google Cloud and AWS. You need to deploy a highly available, high-bandwidth (10 Gbps) private connection between the two cloud providers without routing traffic over the public internet or utilizing a third-party colocation facility. Which Google Cloud networking solution directly fulfills this architecture requirement?
A
Cross-Cloud Interconnect.
B
Dedicated Interconnect.
C
HA VPN over Cloud Router.
D
Partner Interconnect via a supported ISP.
FreePracticeQuiz.questionLabelManaging and provisioning a cloud solution infrastructure
You are setting up a secure continuous integration (CI) pipeline using Cloud Build. The build process must access internal source code repositories hosted on-premises via Cloud VPN, and the build workers must not have external public IP addresses. Which configurations are required? (Select 2)
A
Configure Cloud Build to use private pools assigned to a VPC network peered with the on-premises network.
B
Enable the Google Kubernetes Engine (GKE) integration and run the Cloud Build workers as custom pods within a private cluster.
C
Disable the default global public pool execution by setting an Organization Policy constraint.
D
Assign external IP addresses temporarily during the build phase via a Cloud Nat gateway, then immediately destroy them.
E
Route all Cloud Build traffic through a Cloud Armor security policy designed to drop external ingress.
FreePracticeQuiz.questionLabelDesigning for security and compliance
Case Study: EHR Healthcare. EHR is migrating massive volumes of legacy relational databases to Cloud SQL and BigQuery. Before the migration begins, the compliance team requires an automated way to discover, classify, and report on the presence of unencrypted Patient Health Information (PHI) across their entire organizational footprint in Google Cloud. What is the most efficient technical approach?
A
Enable Sensitive Data Protection (DLP) discovery at the organization or folder level to automatically profile data across BigQuery, Cloud SQL, and Cloud Storage.
B
Export all data to Cloud Storage and configure a Cloud Run function to scan every object using the Cloud Natural Language API.
C
Provision a Dataproc cluster running Apache Spark to crawl all database tables nightly and execute regex pattern matching for PHI formats.
D
Use Security Command Center Premium to run Container Threat Detection on the databases to flag plaintext PHI.
FreePracticeQuiz.questionLabelAnalyzing and optimizing technical and business processes
Following the Reliability pillar of the Google Cloud Well-Architected Framework, your e-commerce application is facing unprecedented traffic during a major holiday sale. The product recommendation microservice is severely overloaded and crashing, threatening to bring down the entire checkout pipeline. What architectural pattern should you implement to analyze and mitigate this process bottleneck?
A
Implement graceful degradation by catching timeouts from the recommendation service and returning a default, static list of popular products to the user instead of failing the request.
B
Configure the recommendation service to retry failing database queries indefinitely until a successful response is received.
C
Use Cloud Load Balancing to immediately terminate the user sessions of clients originating from high-latency geographical regions.
D
Provision a massive Redis cache and load the entire product database into memory, disabling the primary recommendation engine completely.
FreePracticeQuiz.questionLabelManaging implementation
An enterprise operates dozens of Kubernetes clusters across Google Cloud, on-premises data centers, and AWS. They need to manage configuration consistently across all environments, enforcing RBAC and security policies dynamically without manually applying manifests to individual clusters. Which components of GKE Enterprise manage this implementation? (Select 2)
A
Connect all clusters to a unified GKE Fleet.
B
Use Config Sync to apply and continuously reconcile configurations from a central Git repository to all fleet clusters.
C
Deploy Cloud Service Mesh gateways explicitly on the on-premises hardware load balancers.
D
Utilize Google Cloud Deploy to push bash scripts executing kubectl apply iteratively across the multicloud nodes.
E
Install the Binary Authorization admission controller directly onto the AWS EKS nodes using a custom Helm chart.
FreePracticeQuiz.questionLabelDesigning and planning a cloud solution architecture
Case Study: EHR Healthcare. EHR Healthcare needs to securely share anonymized, aggregated patient trend data with third-party medical researchers globally. The researchers use various analytical tools natively within Google Cloud. EHR wants to manage access centrally, revoke access instantly if needed, and strictly avoid the costs and risks of duplicating data across projects. How should this architecture be designed?
A
Export the data to Cloud Storage in Parquet format and generate cryptographically signed URLs with strict expiration times.
B
Use BigQuery Analytics Hub to create an exchange and publish a shared dataset, granting the researchers subscriber access.
C
Create a VPC Service Controls perimeter around the EHR data warehouse and configure an ingress bridge to the researchers' projects.
D
Provision a Datastream pipeline to replicate the required rows directly into the researchers' individual Cloud SQL databases.
FreePracticeQuiz.questionLabelEnsuring solution and operations reliability
Following the Reliability pillar of the Google Cloud Well-Architected Framework, your e-commerce application requires mechanisms to survive severe traffic spikes during flash sales without suffering cascading failures. The backend relies on a Compute Engine Managed Instance Group (MIG) that occasionally hits its absolute scaling limits. Which two architectural patterns should you implement to protect the backend? (Select 2)
A
Deploy Cloud Tasks to decouple and buffer asynchronous requests, smoothing out traffic spikes before they reach the backend.
B
Implement synchronous retries on the frontend with no exponential backoff to ensure requests eventually succeed.
C
Utilize Cloud Service Mesh to implement a Circuit Breaker pattern that fast-fails requests when the backend is overwhelmed.
D
Decrease the health check interval on the load balancer to 1 second to detect and remove overwhelmed nodes faster.
E
Replace the autoscaling MIG with a single, statically provisioned Compute-optimized (C2) virtual machine.
FreePracticeQuiz.questionLabelManaging and provisioning a cloud solution infrastructure
You are tasked with provisioning a new Google Kubernetes Engine (GKE) environment for a data science team. The team runs thousands of ad-hoc batch jobs daily, each with vastly different CPU and memory requirements. You need to eliminate cluster management overhead, strictly pay only for the resources the pods use, and avoid manual node pool configuration entirely. Which compute provisioning strategy should you choose?
A
Provision a GKE Standard cluster and enable the Kubernetes Cluster Autoscaler with a wide range of node sizes.
B
Provision a GKE Autopilot cluster, allowing Google to manage node provisioning and scaling based dynamically on pod specifications.
C
Deploy a fleet of Compute Engine Spot VMs managed by a Managed Instance Group (MIG) running custom Docker containers.
D
Utilize Cloud Run functions configured with maximum memory allocation to execute the batch jobs asynchronously.
FreePracticeQuiz.questionLabelDesigning for security and compliance
A financial enterprise requires that developers must be able to query sensitive financial data in BigQuery from their designated Compute Engine workstations to build ML models. However, strict data exfiltration policies dictate that developers must be entirely blocked from downloading or copying this data to their local laptops or external internet services. What is the most effective security configuration?
A
Remove the BigQuery Data Viewer role from the developers' IAM accounts, granting them only BigQuery Job User.
B
Create a VPC Service Controls perimeter encompassing the BigQuery API and the VPC hosting the developer workstations, disabling internet egress.
C
Enable Cloud Sensitive Data Protection (DLP) to automatically mask all numeric data within the BigQuery tables.
D
Configure Identity-Aware Proxy (IAP) to enforce multi-factor authentication before developers can access the Google Cloud Console.
FreePracticeQuiz.questionLabelAnalyzing and optimizing technical and business processes
Case Study: Altostrat Media. Altostrat Media is trying to optimize their massive Cloud Storage costs. They currently store 50 PB of raw video footage in the Standard storage class. Analysis shows that videos are actively accessed daily during the first 30 days of editing, occasionally accessed between 30 and 90 days, and virtually never accessed after 90 days, though they must be retained indefinitely for compliance. Which two configurations optimize this technical process? (Select 2)
A
Configure an Object Lifecycle Management rule to transition objects to Nearline storage after 30 days.
B
Configure an Object Lifecycle Management rule to transition objects to Archive storage after 90 days.
C
Export all data older than 90 days to a local SAN using Storage Transfer Service to avoid cloud costs.
D
Enable Cloud Storage Autoclass on the bucket to automatically compress the video files.
E
Set an Object Lifecycle Management rule to delete the objects after 90 days and rely on local backups.
FreePracticeQuiz.questionLabelDesigning for security and compliance
Following the 'Implement shift-left security' principle from the Google Cloud Well-Architected Framework, your organization mandates that no container image containing critical OS vulnerabilities can be deployed to your production GKE clusters. You use Cloud Build and Artifact Registry. What is the most robust, automated architecture to enforce this?
A
Use Artifact Analysis to scan images, and configure Binary Authorization with an attestor that requires a 'no critical vulnerabilities' cryptographic signature before scheduling.
B
Run a cron job that checks Artifact Registry every hour using a Python script, automatically deleting images flagged with critical CVEs.
C
Write a Cloud Run function that intercepts Kubernetes deployment manifests and checks the image tag against a hardcoded whitelist in Cloud Storage.
D
Rely on GKE's default ValidatingAdmissionWebhook to automatically block the deployment of images that are larger than 500 MB.
FreePracticeQuiz.questionLabelManaging implementation
You are managing the implementation of a new inventory application deployed on Compute Engine. The application must interact securely with Cloud Storage and Pub/Sub APIs. Historically, developers have generated long-lived JSON service account keys and committed them to the application's source code repository. How should you secure this implementation to meet Google Cloud best practices?
A
Encrypt the JSON keys in the Git repository using Cloud Key Management Service (KMS) symmetric keys.
B
Delete the JSON keys entirely and assign a dedicated Service Account directly to the Compute Engine instances.
C
Move the JSON keys into Secret Manager and hardcode the Secret Manager resource paths in the application's configuration files.
D
Restrict the Git repository's IAM access to only Senior Developers and Security Administrators.
FreePracticeQuiz.questionLabelManaging and provisioning a cloud solution infrastructure
Case Study: Cymbal Retail. Cymbal Retail is provisioning a new multi-region architecture to handle its expanding global catalog. They require a fully managed database providing strong global consistency, ACID transactions, and a relational SQL interface. Furthermore, they need to stream all catalog modifications in real-time to an external analytics pipeline without placing heavy read locks on the primary database. Which two Google Cloud services must they provision? (Select 2)
A
Cloud Spanner.
B
Cloud SQL for PostgreSQL.
C
Cloud Spanner Change Streams processed via Cloud Dataflow.
D
BigQuery Data Transfer Service configured for hourly batched loads.
E
A Cloud SQL Read Replica deployed in the secondary region.
FreePracticeQuiz.questionLabelAnalyzing and optimizing technical and business processes
Following the Cost Optimization pillar of the Google Cloud Well-Architected Framework, you are auditing a legacy project. You discover hundreds of orphaned Persistent Disks (PDs) that were left behind when developers deleted their test VMs. You want to automate the identification and deletion of these unattached disks to halt ongoing storage charges. What is the recommended technical process?
A
Use the Active Assist Idle Resource Recommender API to identify unattached disks, and trigger a Cloud Run function to apply the deletion recommendation.
B
Set a Cloud Storage lifecycle policy on the Persistent Disks to auto-delete after 7 days of remaining unattached.
C
Export Cloud Asset Inventory data to BigQuery daily, and write a SQL query to drop the rows representing the orphaned disks.
D
Create an Organization Policy that prevents developers from deleting a VM if it still has a Persistent Disk attached.
FreePracticeQuiz.questionLabelDesigning and planning a cloud solution architecture
A financial institution is designing a data lakehouse. They possess petabytes of historical trading data residing in Cloud Storage in Parquet format. Business analysts need to query this data via BigQuery using standard SQL. However, a strict organizational policy forbids duplicating or moving the data into BigQuery's native storage layer, while concurrently mandating strict row-level and column-level security. How should you design the data access layer?
A
Create BigLake external tables over the Cloud Storage data, enabling BigQuery querying combined with fine-grained access control.
B
Create standard BigQuery external tables over the Cloud Storage data and use IAM conditions on the bucket.
C
Provision a Dataproc cluster to read the data on-demand and write temporary tables into BigQuery.
D
Load the data into a highly available Cloud SQL instance and utilize BigQuery federated queries.

Progress: 0 of 30 questions completed

Ready for the full GCP-PCA exam?

Get all 450 Questions, timed simulation, and weak-area analytics. Plans from $2.99 — credits never expire.

See pricing

Frequently Asked Questions

Are these real GCP-PCA practice questions?+

Yes. These 30 questions are taken directly from our 450 Questions pool, written and reviewed by certified practitioners. They mirror the style, difficulty, and scope of the official GCP GCP-PCA exam.

Is the GCP-PCA exam hard?+

The GCP Professional Cloud Architect (GCP-PCA) is considered a pass-mark exam (passing score: Not publicly disclosed (scaled scoring)). Most candidates need 4–8 weeks of focused preparation. Use these free questions to gauge where you stand before committing to a full study plan.

How many questions are on the real GCP-PCA exam?+

The official GCP-PCA exam has 50-60 questions.

Do I need to sign up to use these questions?+

No. These 30 questions are free and require no signup. If you want timed simulation, performance analytics, and access to all 450 Questions, our paid plans start at $2.99 per exam with credits that never expire.

Keep studying

Full exam

GCP Professional Cloud Architect (GCP-PCA) details

Free practice

GCP Associate Cloud Engineer

Free practice

AWS SAA-C03

Free practice

Microsoft AZ-305

Pass GCP-PCA on your first try

Join candidates using DummyExams to practice with realistic timed exams, detailed explanations, and weak-area analytics.

Start full GCP-PCA practice exam

30 Free GCP GCP-PCA Practice Questions

GCP-PCA Practice Questions

You are setting up a secure continuous integration (CI) pipeline using Cloud Build. The build process must access internal source code repositories hosted on-premises via Cloud VPN, and the build workers must not have external public IP addresses. Which configurations are required? (Select 2)

Ready for the full GCP-PCA exam?

Frequently Asked Questions

Keep studying

Pass GCP-PCA on your first try