Crucial Exams

GCP Professional Cloud Architect Practice Question

Your retail company is moving its payment API containers and a Cloud SQL for PostgreSQL instance that store card-holder data into Google Cloud. PCI DSS requires the Cardholder Data Environment (CDE) to be isolated from other workloads and to expose the smallest possible attack surface. Several other Google Cloud projects need to receive hourly, aggregated sales data, but must never initiate network connections back into the CDE. Which network design best meets PCI segmentation requirements while still allowing the data to flow to the consumer projects?

  • Host all payment services in a dedicated project and VPC protected by a VPC Service Controls perimeter. Use Cloud NAT and an organization-level hierarchical firewall rule that blocks all inbound traffic except Identity-Aware Proxy, and have an internal service account publish sanitized sales data to a Pub/Sub topic in an analytics project.

  • Deploy payment services in one project and peer its VPC with the analytics project's VPC; allow traffic from the analytics subnet to the payment subnet on TCP 443 via custom firewall rules and Cloud Router-advertised routes.

  • Place payment and analytics workloads in separate subnets of the same Shared VPC; restrict access with firewall rules allowing the analytics subnet to reach the database over TCP 5432 and use Cloud NAT for outbound traffic.

  • Run all workloads in a single project; enable Private Google Access for the payment services to export data directly to BigQuery, relying on IAM Conditions instead of network isolation to meet PCI DSS requirements.

GCP Professional Cloud Architect
Designing for security and compliance
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot