Google CloudOctober 14, 202621 min read

GCP PCA Case Study Questions: How to Read and Answer Them (2026)

Most of the GCP PCA is a reading test. Here is how to find the constraint, the qualifier and the noise in a stem, with three examples taken apart option by option.

  • 50-60Questions
  • 2 hoursTime
  • Not publishedPass mark
  • ~2 minPer question
  • LEAST overheadKey qualifier
GCP PCA case study questions decoded - keywords, qualifiers and traps

Table of Contents

The Professional Cloud Architect exam gives you 50 to 60 multiple-choice and multiple-select questions in two hours, and very few of them ask what a product does. They describe a company, list what it needs, and offer four designs that would all run. Your job is to find the one that satisfies every stated requirement and then wins on the ranking phrase at the end: lowest operational overhead, lowest cost, or Google-recommended practice.

Each exam also includes two of Google's published case studies, and questions about them make up 20 to 30 percent of the exam. You can see the case study on a split screen, but reading a two-page brief for the first time under the clock is how candidates run short of time. This page shows how to read PCA stems the way they are built: separate hard constraints from noise, translate requirement phrases into products, and recognise the handful of ways the wrong options are constructed.

The one rule for reading GCP PCA stems

Treat every stem as a requirements document and pick the design Google would sign off on: it meets every stated constraint with the most managed, least custom architecture.

Almost every option on this exam is technically possible, so asking whether it would work eliminates little. What separates the answers is whether each one honours every explicit requirement, such as RPO, data location, an existing contract or a compliance rule, and then which survivor the qualifier favours. Google's Well-Architected Framework, which the exam guide names as a key requirement, consistently prefers managed services, least privilege and automation over hand-built equivalents.

Read it like this

  • Read the ask before the stem
  • Translate requirement phrases into products
  • Kill on constraints, rank on the qualifier

Not like this

  • Pick the product the company already runs by reflex
  • Reward options for features nobody asked for
  • Reread the whole case study for every question

The 5-step decode routine

Run the same five steps on every case study. The time on each step is a target for a practised reader, not a rule; the order is the part that matters.

  1. ~10s

    Locate the source

    Check whether the question names a case study. If it does, note which company and which of its requirements the question is testing, and open only that part of the split-screen brief.

  2. ~10s

    Read the ask

    Read the final sentence first. Note what you are choosing (a database, a network link, a first action) and the qualifier: BEST, FIRST, LEAST overhead, MOST cost-effective or Choose two.

  3. ~30s

    Mark constraints and noise

    Underline hard limits such as RPO, latency, data location, existing contracts and 'without code changes'. Strike details that change nothing, such as reporting tools, team trivia or past audits.

  4. ~20s

    Map phrases to products

    Before reading the options, turn each cue into a candidate: globally consistent relational to Spanner, exfiltration to VPC Service Controls, scale to zero to Cloud Run.

  5. ~40s

    Eliminate, then rank

    Strike every option that breaks a constraint. Rank what is left by the qualifier: managed over self-built, cheapest that still complies, mitigation before diagnosis.

Anatomy of a GCP PCA case study

Every highlighted phrase below is pinned to a note. Four kinds of phrase matter:

  • Constrainta hard requirement that eliminates options
  • Qualifierthe word that ranks the survivors
  • Keywordpoints at a specific service, control or concept
  • Noiselooks important, changes nothing
Scenario 1 · Section 1: Designing and planning a cloud solution architectureSingle answer

Seat inventory that must never double-sell

Case study (fictional): Northgate Events sells concert and sports tickets in North America and opens in Europe and Asia next year. Solution concept: move seat inventory out of the monolith into a cloud-native booking service before the European launch. Existing environment: a monolith on Compute Engine in one US region with a self-managed PostgreSQL database; card payments go through a third-party processor; the marketing team builds weekly dashboards in Looker Studio1. Business requirements: a seat can never be sold twice2, even when fans on three continents click Buy on the same seat at once; sales continue through the loss of an entire region with no confirmed order lost3; minimize operational overhead4 for a four-person platform team. Technical requirements: one globally consistent relational database5 for seat inventory; PostgreSQL-compatible SQL is preferred6 so existing queries carry over. Executive statement: last season's on-sale outage cost the company a stadium contract, so reliability comes first and cost second.

Which database design BEST meets Northgate's requirements?

  1. 1Noise. Noise. Reporting tools sit downstream of the inventory database and do not change which database can meet the consistency and failover requirements.
  2. 2Constraint. Hard constraint: concurrent purchases of one seat from different continents must be serialized. That rules out eventually consistent and multi-primary designs.
  3. 3Constraint. Hard constraint: a regional failure may not lose a committed write. Any design that replicates across regions asynchronously can drop recent orders on failover.
  4. 4Qualifier. Ranking qualifier: among designs that pass the constraints, prefer a fully managed service over anything a four-person team must patch, replicate or reconcile.
  5. 5Keyword. The exam's strongest pointer to Spanner: a relational schema plus strong consistency across regions, which is exactly what Spanner is built for.
  6. 6Keyword. A preference, not a constraint, and a lure toward Cloud SQL or AlloyDB. Spanner's PostgreSQL interface satisfies it without giving up global consistency.
  1. ACloud SQL for PostgreSQL in the US region, with cross-region read replicas in Europe and Asia that are promoted if the primary region fails.OutFails the no-lost-order constraint: cross-region replicas receive changes asynchronously, so promoting one after a regional failure can lose recent committed orders. The replicas are read-only, so every booking still writes to one region.
  2. BSpanner with a multi-region instance configuration that spans North America, Europe and Asia, using the PostgreSQL interface.AnswerSpanner replicates between regions with strong consistency and stays available through a regional failure, so concurrent purchases of one seat are serialized and committed orders survive. It is fully managed, and the PostgreSQL interface covers the SQL preference.
  3. CBigtable with clusters in three regions, replication enabled, and an app profile that uses multi-cluster routing.OutFails the never-sold-twice constraint: Bigtable replication is eventually consistent, and multi-cluster routing lets two clusters accept conflicting writes to the same seat. It is also not a relational database.
  4. DPostgreSQL on Compute Engine in each region, kept in sync with bidirectional logical replication between the three primaries.OutKilled twice: multi-primary replication only meets conflicts after both writes have committed, so a seat can sell in two regions, and the team must build, patch and monitor it, the opposite of minimal overhead.

The lesson: In a case-study question, separate requirements from preferences: 'PostgreSQL-compatible preferred' can bend, 'never sold twice' and 'no confirmed order lost' cannot.

Two more: decode them yourself

Read each one as you would on the day: mark the constraints, find the qualifier, cross out what fails, and commit to a letter before you open the decode.

Scenario 2 · Section 3: Designing for security and complianceChoose two

Stopping an authorized insider from copying data out

A pharmaceutical company stores clinical trial results in BigQuery datasets and Cloud Storage buckets across two projects. A security review showed that an employee who holds valid IAM roles could export a table to a bucket in a project outside the organization. The CISO wants to prevent data exfiltration, even by users with valid credentials. Analysts must keep querying the data from the corporate office network. The company completed a SOC 2 Type II audit last quarter. The solution must follow Google-recommended practices.

Which TWO actions should you take? (Choose two.)

  1. ACreate a VPC Service Controls service perimeter around both projects that restricts the BigQuery and Cloud Storage APIs.
  2. BCreate an access level in Access Context Manager for the corporate office IP ranges and allow it into the perimeter.
  3. CRe-encrypt the datasets and buckets with customer-managed encryption keys in Cloud KMS.
  4. DEnforce the domain restricted sharing organization policy so IAM roles can be granted only to identities in the company's domain.
  5. EAdd VPC firewall egress rules that deny all traffic from the projects' VPC networks to the internet.
Decode it and show the answer

A pharmaceutical company stores clinical trial results in BigQuery datasets and Cloud Storage buckets across two projects. A security review showed that an employee who holds valid IAM roles could export a table to a bucket in a project outside the organization1. The CISO wants to prevent data exfiltration2, even by users with valid credentials3. Analysts must keep querying the data from the corporate office network4. The company completed a SOC 2 Type II audit last quarter5. The solution must follow Google-recommended practices6.

  1. 1Constraint. Defines the threat: data crossing an organizational boundary through Google APIs, not through a VM network. The control has to act on API calls.
  2. 2Keyword. Exam shorthand for VPC Service Controls. A service perimeter blocks API requests that read from or copy to resources outside the perimeter.
  3. 3Constraint. Rules out identity-only fixes. The employee is supposed to have access, so removing roles is not an option, and CMEK or sharing policies do not stop an authorized copy.
  4. 4Constraint. The second half of the answer: once a perimeter exists, legitimate access from outside it needs an explicit exception, such as an access level for the office IP ranges.
  5. 5Noise. Noise. A past audit attests to existing controls and does not change which control stops an authorized insider from moving data out.
  6. 6Qualifier. Prefer the purpose-built managed control over custom scripts or network workarounds that only approximate it.
  1. ACreate a VPC Service Controls service perimeter around both projects that restricts the BigQuery and Cloud Storage APIs.AnswerThe perimeter blocks reading data from or copying data to resources outside it, which is exactly the authorized-insider export the review found. It is Google's purpose-built control for exfiltration risk.
  2. BCreate an access level in Access Context Manager for the corporate office IP ranges and allow it into the perimeter.AnswerWithout it, the perimeter would also block analysts calling BigQuery from the office over the internet. An access level based on source IP admits those requests while the perimeter still blocks copies out.
  3. CRe-encrypt the datasets and buckets with customer-managed encryption keys in Cloud KMS.OutWrong layer. CMEK controls who owns and can revoke the key, but decryption is transparent to any identity allowed to read the data, so the insider's export still succeeds.
  4. DEnforce the domain restricted sharing organization policy so IAM roles can be granted only to identities in the company's domain.OutUseful, but it only stops roles being granted to outside identities. It does not stop an authorized employee from writing data into a bucket that another organization controls.
  5. EAdd VPC firewall egress rules that deny all traffic from the projects' VPC networks to the internet.OutMisses the threat: BigQuery exports and Cloud Storage copies are Google API operations, not VM traffic leaving your VPC, so firewall rules never see them.

The lesson: When the stem says 'even with valid credentials', identity and encryption controls are already ruled out; look for the control that governs where data can go.

Scenario 3 · Section 6: Ensuring solution and operations excellenceSingle answer

Checkout errors right after a release

An online retailer runs its checkout service on GKE Autopilot and promotes releases to production with Cloud Deploy. Twenty minutes after a new release reached production, the checkout error rate rose from 0.1% to 4%, and an SLO burn-rate alert paged the on-call engineer. No other service or configuration changed in that window, and the previous release had run cleanly for two weeks. The new release passed every unit test in Cloud Build. The team wants to restore checkout for customers as quickly as possible. What should you do FIRST?

What should you do FIRST?

  1. ARoll the checkout service back to the previous release with Cloud Deploy, then investigate the faulty release.
  2. BUse Cloud Logging and Cloud Trace to identify the root cause of the new errors before changing anything.
  3. CIncrease the checkout Deployment's replica count so more Pods share the load.
  4. DRaise the alert's burn-rate threshold to stop the pages while the team investigates.
Decode it and show the answer

An online retailer runs its checkout service on GKE Autopilot1 and promotes releases to production with Cloud Deploy. Twenty minutes after a new release reached production2, the checkout error rate rose from 0.1% to 4%, and an SLO burn-rate alert3 paged the on-call engineer. No other service or configuration changed in that window4, and the previous release had run cleanly for two weeks. The new release passed every unit test in Cloud Build5. The team wants to restore checkout for customers as quickly as possible. What should you do FIRST6?

  1. 1Noise. Noise. Autopilot or Standard, a regression shipped in application code is handled the same way; the cluster mode does not affect the first move.
  2. 2Constraint. The timing ties the failure to the release. When one change correlates with an incident, reverting it is the fastest path back to a known-good state.
  3. 3Keyword. Customers are being hurt now and the error budget is draining fast. That urgency points to mitigation, not analysis.
  4. 4Constraint. Removes competing suspects such as dependencies or configuration drift, so a rollback is very likely to restore service.
  5. 5Noise. Noise. It explains how the bug slipped through, a postmortem topic, but changes nothing about what to do in the next five minutes.
  6. 6Qualifier. An ordering qualifier. Several options are sensible at some point; the correct one is the step that has to come before the others.
  1. ARoll the checkout service back to the previous release with Cloud Deploy, then investigate the faulty release.AnswerGoogle's SRE guidance is that stopping the bleeding comes first. The release is the only change and the prior version is known-good, so rolling back restores checkout fastest while the faulty release stays available for analysis.
  2. BUse Cloud Logging and Cloud Trace to identify the root cause of the new errors before changing anything.OutRight action, wrong order. Diagnosis comes after mitigation; every minute spent investigating first leaves 4% of checkouts failing.
  3. CIncrease the checkout Deployment's replica count so more Pods share the load.OutNothing in the stem points to capacity. The errors began with a code change, and more replicas of a faulty release fail at the same rate.
  4. DRaise the alert's burn-rate threshold to stop the pages while the team investigates.OutSilences the signal without helping a single customer and hides whether any fix works. It addresses the pager, not the incident.

The lesson: With FIRST, every option may be reasonable eventually; ask which one must happen before the others, and during an active incident that is mitigation.

Now do it at exam speed

The GCP PCA app has 2,100+ exam-style questions with an explanation for every option. Read each stem with the routine above and check whether your elimination matches the explanation.

App StoreGoogle PlayFree GCP PCA practice test

Keyword decoder: what the stem is telling you

These phrases recur in GCP PCA stems. Each one narrows the answer before you read the options.

When the stem saysIt points toUsually the wrong pick
Data & storage
globally consistent, relational, transactions across regionsSpanner with a multi-region instance configurationCloud SQL cross-region replicas: asynchronous, read-only, one writable primary
petabyte-scale analytics, ad hoc SQL, enterprise data warehouseBigQueryCloud SQL or Bigtable for large analytical SQL scans
time-series or IoT writes at massive scale, single-digit millisecond readsBigtable, with a row key designed around the read patternBigQuery for low-latency single-row lookups
lift-and-shift MySQL, PostgreSQL or SQL Server in one regionCloud SQLSpanner when nothing needs global scale or cross-region consistency
keep for years, read rarely, lowest storage costCloud Storage Archive class with lifecycle rules; Bucket Lock if records must be immutableStandard or Nearline for data read less than once a year
Compute, processing & AI
containerized, stateless HTTP service, scale to zero, minimize operational overheadCloud RunA GKE Standard cluster the team must size, patch and upgrade
run code when a file lands or a message arrivesCloud Run functions with an Eventarc or Pub/Sub triggerAn always-on VM polling a bucket on a schedule
fault-tolerant batch job that can be interrupted, cost-effectiveSpot VMs, or Spot Pods on GKECommitted use discounts for short or irregular jobs
unified streaming and batch pipeline, serverlessDataflow (Apache Beam), often fed by Pub/SubA long-running Dataproc cluster built for a brand-new pipeline
existing Spark or Hadoop jobs, minimal code changesDataprocRewriting the jobs as Dataflow pipelines
use a foundation model or build an agent, no model trainingGemini models through Gemini Enterprise Agent Platform (formerly Vertex AI) and Model GardenTraining a custom model from scratch on GPUs or TPUs
Network & hybrid
private 10 Gbps or more to on-premises, with an SLADedicated Interconnect if you reach a colocation facility, otherwise Partner InterconnectCloud VPN for sustained high-bandwidth private traffic
encrypted link over the internet, quick to set up, 99.99% SLAHA VPN with two tunnels and Cloud Router (BGP)Classic VPN, whose SLA is 99.9%
central network team, many projects, one networkShared VPC with host and service projectsA mesh of VPC Network Peering between every project
consume or publish a service privately, overlapping IP rangesPrivate Service ConnectVPC Network Peering, which needs non-overlapping ranges and is not transitive
one global IP, users worldwide, HTTP(S), cache static contentGlobal external Application Load Balancer with Cloud CDNRegional load balancers per region behind DNS round robin
Security & compliance
prevent data exfiltration, even with valid credentialsVPC Service Controls perimeter, with access levels for legitimate outside accessCMEK, IAM role changes or VPC firewall rules on their own
we must control, rotate and revoke our own encryption keysCMEK in Cloud KMS; Cloud HSM or Cloud EKM when key custody demands itDefault Google-managed encryption, which gives no key control
reach internal apps without a VPN, identity-based accessIdentity-Aware Proxy with context-aware accessA bastion host with a public IP, or VPN accounts for every user
workloads on another cloud or on-premises call Google APIs without keysWorkload Identity FederationDownloading and distributing service account keys
resources may only be created in approved regions, across every projectOrganization Policy resource locations constraint at organization or folder levelPer-project IAM or audit scripts that react after creation
screen prompts and model responses for injection or harmful contentModel ArmorCloud Armor, which filters web traffic at the load balancer, not prompts

The qualifier words

The qualifier decides between options that all work. On the GCP PCA these words carry a specific meaning:

BEST

Several options would work. Pick the one that meets every stated requirement and the case study's stated priorities, not the one with the most features.

Which database design BEST meets the company's requirements?

FIRST

Order matters. Choose the step that must precede the others: mitigate before diagnosing, discover and assess before migrating, test before cutover.

Latency doubled after a release. What should you do FIRST?

Google-recommended practices

The documented Google approach: managed services, least privilege through groups and predefined roles, infrastructure as code, no exported service account keys.

How should you grant the analysts access, following Google-recommended practices?

minimize operational overhead

Prefer serverless and fully managed services, even when a self-managed design is cheaper or more flexible. Anything you must patch, scale or replicate yourself loses.

Which compute platform should you use to minimize operational overhead?

MOST cost-effective

The cheapest option that still meets every constraint. It never trades away a stated requirement such as availability, RPO or data location.

Which storage option is the MOST cost-effective for audit logs kept seven years?

Choose two

Exactly two answers. Often they are two halves of one design, such as a control plus its exception, and each must be correct on its own.

Which two actions should you take? (Choose two.)

How the wrong answers are built

Distractors are not random. Most wrong options on the GCP PCA fall into one of these patterns:

  1. The familiar-stack anchor

    The tellThe option names the product the company already runs (MySQL to Cloud SQL, Hadoop to Dataproc) while a stated requirement demands more.

    Why it temptsCase studies describe the existing environment in detail, so matching it feels faithful to the brief and low-risk.

  2. Right family, wrong layer

    The tellA genuine, recommended control that solves a different problem: CMEK against exfiltration, firewall rules against API-level copies, IAM against an authorized insider.

    Why it temptsEvery word in it is a real Google security product, so it reads as a correct answer to a security question.

  3. The build-it-yourself option

    The tellSelf-managed software on Compute Engine, custom scripts or cron jobs where a managed service exists for the job.

    Why it temptsIt would work and offers full control, so it survives 'would this run?' and dies only on overhead or Google-recommended wording.

  4. Right action, wrong order

    The tellIn a FIRST question, a sound step that belongs later: root-cause analysis before rollback, migrating before assessing dependencies.

    Why it temptsThe content of the option is correct, and it is often the most thorough-sounding choice on the list.

  5. Overbuilt for the stated need

    The tellMulti-region Spanner, Dedicated Interconnect or a GKE platform for a workload the stem describes as regional, small or bursty.

    Why it temptsMore resilience sounds like better architecture, until 'cost-effective' or 'minimize overhead' ranks the simpler option first.

Time budget by question type

Question typeBudgetTactic
Short standalone question1-1.5 minRead the ask, map the cue phrase to a product, eliminate. Bank the saved time for the case-study questions.
Long standalone scenario2-2.5 minMark constraints before reading options. If two options survive, reread only the qualifier, not the whole stem.
Case-study question2-3 minOpen the split-screen brief only at the requirement the question touches; your pre-made requirement-to-product map does the rest.
Multiple select (Choose two)2-2.5 minJudge each option alone as true or false against the constraints, then check the chosen pair forms one coherent design.

How to practise reading, not just content

Knowing the material is half of it. These drills train the reading:

Pre-map the four official case studies

Download Altostrat Media, Cymbal Retail, EHR Healthcare and KnightMotives Automotive from the current exam guide. For every business and technical requirement, write the Google Cloud product you would use, one alternative you would reject, and why. Repeat until you can state each company's top three priorities and constraints from memory, so exam-day reading becomes lookup rather than discovery.

Predict before you look

Cover the options of a practice question. Mark each phrase in the stem as constraint, qualifier, keyword or noise, then write the answer you expect in five words. Uncover the options and compare. When your prediction is missing from the list, find the phrase you misread.

Name the killing phrase

For every wrong option in a practice set, write the exact words in the stem that eliminate it. If you cannot point to a phrase, you guessed, and that topic goes back on your review list even if you picked the right answer.

The GCP PCA at a glance

Questions50-60
Time2 hours
Question typesMultiple choice and multiple select; 2 case studies per exam, 20-30% of questions
Going back / flaggingCase studies can be viewed on a split screen during the exam
Fee$200 (plus tax where applicable)
DeliveryOnline proctored (Pearson OnVUE) or Pearson VUE test center; English or Japanese

Practise the reading, not just the facts

Work GCP PCA questions by domain on the app or try the free practice test. After each miss, find the phrase in the stem you read past.

App StoreGoogle PlayFree GCP PCA practice test

FAQ

Are the scenarios on this page real Professional Cloud Architect exam questions?

No. Northgate Events, the pharmaceutical company and the online retailer are original examples written for this page in the exam's style, using Google's published exam guide. They are not taken from Google's sample questions, its official case studies or any exam dump. Their purpose is to show how stems are built and how wrong options are constructed, so you can read the real ones faster.

Which case studies are on the Professional Cloud Architect exam now?

Google's current exam guide lists four: Altostrat Media, a media company adding generative AI to its content platform; Cymbal Retail, an online retailer using gen AI for its catalog and shopping experience; EHR Healthcare, a health-records software provider leaving colocation facilities; and KnightMotives Automotive, a carmaker modernizing its vehicles and dealer tools. Each exam uses two of them. Older names such as Mountkirk Games and TerramEarth are no longer in the guide.

Can I see the case study during the exam?

Yes. Google says you can view the case studies on a split screen during the exam. Each exam includes two case studies, and questions about them make up 20 to 30 percent of the exam. Having the text on screen does not mean you should read it there for the first time; reading the briefs beforehand and mapping each requirement to products is what saves time.

What score do I need to pass the Professional Cloud Architect exam?

Google does not publish a passing score. Its certification FAQ says the exams determine only whether you meet a minimum passing standard, so you get a pass or fail result, shown provisionally on screen when you submit. If you do not pass, a detailed score report appears under Exam History in the candidate portal. Any percentage quoted elsewhere is an estimate, not a Google figure.

The exam guide mentions Gemini Enterprise Agent Platform. What happened to Vertex AI?

Google's certification page says the exam was updated to reflect recent branding changes and points you to the exam guide for current product names. The guide now uses Gemini Enterprise Agent Platform, which Google's own release notes describe as formerly Vertex AI, alongside Model Garden, Agent Builder and Gemini models. Learn the current names, but read stems for the capability being asked for, since the requirement decides the answer.

Sources

Figures on this page come from Google Cloud and the other primary sources below:

Checked October 14, 2026. Fees, outlines and eligibility rules change — confirm with Google Cloud before you book.