Google Cloud
Professional Cloud Architect
Designing Secure, Scalable & Highly Available Google Cloud Architectures
Exam: GCP PCA
51 Questions & Verified Answers
Google Professional Cloud Architect — 51 Exam
Questions
Covers all exam domains: Business & Technical Design, Infrastructure, Security & Compliance,
Analytics, Networking, Reliability, and Cost Optimization.
Q01. What is the Google Cloud resource hierarchy and why does it matter for governance?
A. Zone > Region > Project > Organization
B. Resource > Folder > Project > Organization
C. Organization > Folders > Projects > Resources — policies and permissions applied at
higher levels are inherited downward
D. Project > Organization > Folder > Resource
Answer: C. Organization > Folders > Projects > Resources — policies applied at higher
levels are inherited downward
Organization: root node — created when a Google Workspace or Cloud Identity domain is linked to
GCP.
Folders: intermediate groupings — use to mirror organizational structure (departments,
environments).
Projects: boundary for resources, billing, API enablement, and IAM.
IAM inheritance: a role granted at the Organization level applies to all resources in all projects.
Q02. What is a VPC in Google Cloud and how does it differ from traditional networks?
A. VPCs are regional and cannot span zones
B. Google Cloud VPCs are global resources — a single VPC spans all regions, with regional
subnets — enabling resources in different regions to communicate privately without VPC
peering
C. VPCs require a physical network appliance
D. Google Cloud VPCs are identical to AWS VPCs
Answer: B. Google Cloud VPCs are global — one VPC spans all regions with regional
subnets and private cross-region communication
, Unlike AWS (regional VPCs): Google VPCs are global — resources in us-central1 and europe-
west1 in the same VPC communicate privately.
Subnets are regional: when you create a subnet in us-central1, VMs in any zone in us-central1 can
use it.
VPC Peering: connect two VPCs privately — but not transitive (A peers B, B peers C ≠ A can reach
C).
Shared VPC: share a host project VPC with multiple service projects — centralized network
management.
Q03. What is Cloud Spanner and when should an architect choose it over Cloud SQL?
A. Cloud Spanner is a NoSQL database — choose for unstructured data
B. Cloud Spanner is a managed key-value store
C. Cloud Spanner is Google's relational key-value hybrid
D. Cloud Spanner is a globally distributed, horizontally scalable SQL database with strong
consistency and 99.999% SLA — choose when you need global relational scale beyond what
regional Cloud SQL can provide
Answer: D. Globally distributed horizontal SQL with strong consistency and 99.999% SLA —
choose when global scale beyond Cloud SQL is needed
Cloud SQL: regional, vertically scaled MySQL/PostgreSQL/SQL Server. Good for regional
transactional workloads.
Cloud Spanner: globally distributed, horizontally scaled. Handles millions of transactions per second
globally.
Choose Spanner when: global users require low-latency reads/writes, or when Cloud SQL
approaches max capacity.
Cost: Spanner is significantly more expensive — use only when the scale and global requirements
justify it.
Q04. A retail company experiences 10x traffic spikes during flash sales. Which architecture best
handles this?
A. Use Committed Use Discounts and fixed instance count
B. Provision for peak capacity permanently
C. Use preemptible VMs as the primary compute
D. Implement a managed instance group with autoscaling, Cloud Load Balancing, and Cloud
CDN for static content — scaling compute automatically while CDN absorbs static asset load
Answer: D. Managed instance group + autoscaling + Cloud Load Balancing + Cloud CDN for
static assets
Managed Instance Group (MIG) autoscaling: scale out during traffic spike, scale in when traffic
subsides — cost-efficient.
Cloud Load Balancing: global anycast load balancer — routes users to nearest healthy backend.
Cloud CDN: cache product images, CSS, JavaScript at edge — reduces origin server load by
80%+.
Cloud Armor: add DDoS protection during flash sale — prevent abuse from bots.
Q05. What is the purpose of Google Cloud's Anthos?
A. A NoSQL database service
, B. An AI/ML training platform
C. A hybrid and multi-cloud application management platform — enabling consistent
deployment, security, and observability of containerized applications across GKE, on-premises,
and other clouds
D. A content delivery network
Answer: C. Hybrid/multi-cloud platform for consistent deployment, security, and
observability across GKE, on-prem, and other clouds
Anthos components: GKE (Google Kubernetes), Anthos Service Mesh (Istio), Anthos Config
Management (GitOps), Cloud Run for Anthos.
Use when: compliance requires on-premises data, or you operate across multiple cloud providers.
Anthos Service Mesh: mutual TLS between services, traffic management, detailed telemetry —
automatically.
Single control plane: manage workloads across all environments from Google Cloud Console.
Q06. What is BigQuery and how should it be used in a data analytics architecture?
A. BigQuery is a relational OLTP database for application backends
B. BigQuery is a managed Redis cache for analytics applications
C. BigQuery is a NoSQL document store
D. BigQuery is a fully managed, serverless data warehouse for running fast SQL analytics on
petabyte-scale data — with built-in ML, geo-analysis, and BI Engine for sub-second dashboard
queries
Answer: D. Serverless data warehouse for petabyte-scale SQL analytics with built-in ML,
geo, and BI Engine
BigQuery separates compute and storage — pay for queries and storage independently.
Partitioned and clustered tables: dramatically reduce query costs by scanning only relevant
partitions.
BigQuery ML: train and run ML models using SQL — no Python or separate ML infrastructure.
Streaming inserts: ingest real-time data into BigQuery tables — available for query within seconds.
Q07. What is Google Cloud Armor and what threats does it protect against?
A. Physical armor for Google data centers
B. A VPC firewall service
C. A DDoS protection and web application firewall integrated with Cloud Load Balancing —
protecting against volumetric DDoS attacks, OWASP Top 10 threats, bot abuse, and
geographic threats using preconfigured WAF rules
D. An identity protection service
Answer: C. DDoS protection and WAF integrated with Cloud Load Balancing — volumetric
attacks, OWASP Top 10, bots, geo threats
Managed protection tiers: Standard (basic), Plus (ML-based adaptive protection, DDoS response
support team).
Preconfigured WAF rules: OWASP Top 10, CVE-based rules — enable with one policy setting.
Adaptive protection: ML detects and suggests rules to mitigate novel DDoS patterns automatically.
Security policies: apply to backend services — evaluate each request against rules in priority order.
Q08. What is the difference between Cloud Run and Cloud Functions?
Professional Cloud Architect
Designing Secure, Scalable & Highly Available Google Cloud Architectures
Exam: GCP PCA
51 Questions & Verified Answers
Google Professional Cloud Architect — 51 Exam
Questions
Covers all exam domains: Business & Technical Design, Infrastructure, Security & Compliance,
Analytics, Networking, Reliability, and Cost Optimization.
Q01. What is the Google Cloud resource hierarchy and why does it matter for governance?
A. Zone > Region > Project > Organization
B. Resource > Folder > Project > Organization
C. Organization > Folders > Projects > Resources — policies and permissions applied at
higher levels are inherited downward
D. Project > Organization > Folder > Resource
Answer: C. Organization > Folders > Projects > Resources — policies applied at higher
levels are inherited downward
Organization: root node — created when a Google Workspace or Cloud Identity domain is linked to
GCP.
Folders: intermediate groupings — use to mirror organizational structure (departments,
environments).
Projects: boundary for resources, billing, API enablement, and IAM.
IAM inheritance: a role granted at the Organization level applies to all resources in all projects.
Q02. What is a VPC in Google Cloud and how does it differ from traditional networks?
A. VPCs are regional and cannot span zones
B. Google Cloud VPCs are global resources — a single VPC spans all regions, with regional
subnets — enabling resources in different regions to communicate privately without VPC
peering
C. VPCs require a physical network appliance
D. Google Cloud VPCs are identical to AWS VPCs
Answer: B. Google Cloud VPCs are global — one VPC spans all regions with regional
subnets and private cross-region communication
, Unlike AWS (regional VPCs): Google VPCs are global — resources in us-central1 and europe-
west1 in the same VPC communicate privately.
Subnets are regional: when you create a subnet in us-central1, VMs in any zone in us-central1 can
use it.
VPC Peering: connect two VPCs privately — but not transitive (A peers B, B peers C ≠ A can reach
C).
Shared VPC: share a host project VPC with multiple service projects — centralized network
management.
Q03. What is Cloud Spanner and when should an architect choose it over Cloud SQL?
A. Cloud Spanner is a NoSQL database — choose for unstructured data
B. Cloud Spanner is a managed key-value store
C. Cloud Spanner is Google's relational key-value hybrid
D. Cloud Spanner is a globally distributed, horizontally scalable SQL database with strong
consistency and 99.999% SLA — choose when you need global relational scale beyond what
regional Cloud SQL can provide
Answer: D. Globally distributed horizontal SQL with strong consistency and 99.999% SLA —
choose when global scale beyond Cloud SQL is needed
Cloud SQL: regional, vertically scaled MySQL/PostgreSQL/SQL Server. Good for regional
transactional workloads.
Cloud Spanner: globally distributed, horizontally scaled. Handles millions of transactions per second
globally.
Choose Spanner when: global users require low-latency reads/writes, or when Cloud SQL
approaches max capacity.
Cost: Spanner is significantly more expensive — use only when the scale and global requirements
justify it.
Q04. A retail company experiences 10x traffic spikes during flash sales. Which architecture best
handles this?
A. Use Committed Use Discounts and fixed instance count
B. Provision for peak capacity permanently
C. Use preemptible VMs as the primary compute
D. Implement a managed instance group with autoscaling, Cloud Load Balancing, and Cloud
CDN for static content — scaling compute automatically while CDN absorbs static asset load
Answer: D. Managed instance group + autoscaling + Cloud Load Balancing + Cloud CDN for
static assets
Managed Instance Group (MIG) autoscaling: scale out during traffic spike, scale in when traffic
subsides — cost-efficient.
Cloud Load Balancing: global anycast load balancer — routes users to nearest healthy backend.
Cloud CDN: cache product images, CSS, JavaScript at edge — reduces origin server load by
80%+.
Cloud Armor: add DDoS protection during flash sale — prevent abuse from bots.
Q05. What is the purpose of Google Cloud's Anthos?
A. A NoSQL database service
, B. An AI/ML training platform
C. A hybrid and multi-cloud application management platform — enabling consistent
deployment, security, and observability of containerized applications across GKE, on-premises,
and other clouds
D. A content delivery network
Answer: C. Hybrid/multi-cloud platform for consistent deployment, security, and
observability across GKE, on-prem, and other clouds
Anthos components: GKE (Google Kubernetes), Anthos Service Mesh (Istio), Anthos Config
Management (GitOps), Cloud Run for Anthos.
Use when: compliance requires on-premises data, or you operate across multiple cloud providers.
Anthos Service Mesh: mutual TLS between services, traffic management, detailed telemetry —
automatically.
Single control plane: manage workloads across all environments from Google Cloud Console.
Q06. What is BigQuery and how should it be used in a data analytics architecture?
A. BigQuery is a relational OLTP database for application backends
B. BigQuery is a managed Redis cache for analytics applications
C. BigQuery is a NoSQL document store
D. BigQuery is a fully managed, serverless data warehouse for running fast SQL analytics on
petabyte-scale data — with built-in ML, geo-analysis, and BI Engine for sub-second dashboard
queries
Answer: D. Serverless data warehouse for petabyte-scale SQL analytics with built-in ML,
geo, and BI Engine
BigQuery separates compute and storage — pay for queries and storage independently.
Partitioned and clustered tables: dramatically reduce query costs by scanning only relevant
partitions.
BigQuery ML: train and run ML models using SQL — no Python or separate ML infrastructure.
Streaming inserts: ingest real-time data into BigQuery tables — available for query within seconds.
Q07. What is Google Cloud Armor and what threats does it protect against?
A. Physical armor for Google data centers
B. A VPC firewall service
C. A DDoS protection and web application firewall integrated with Cloud Load Balancing —
protecting against volumetric DDoS attacks, OWASP Top 10 threats, bot abuse, and
geographic threats using preconfigured WAF rules
D. An identity protection service
Answer: C. DDoS protection and WAF integrated with Cloud Load Balancing — volumetric
attacks, OWASP Top 10, bots, geo threats
Managed protection tiers: Standard (basic), Plus (ML-based adaptive protection, DDoS response
support team).
Preconfigured WAF rules: OWASP Top 10, CVE-based rules — enable with one policy setting.
Adaptive protection: ML detects and suggests rules to mitigate novel DDoS patterns automatically.
Security policies: apply to backend services — evaluate each request against rules in priority order.
Q08. What is the difference between Cloud Run and Cloud Functions?
