CertQuests
Top 10 GCP PCA interview questions and how to answer them in 2026
The Google Cloud Professional Cloud Architect (PCA) is the credential hiring managers use to filter candidates into GCP cloud architect, platform engineer, and ML platform architect roles. It costs $200, runs 50–60 questions in 120 minutes (anchored by four published case studies), and is valid for two years. The cert puts you in the pile; answering these 10 questions correctly — including the operational caveat each hides — gets you the offer.
These questions came up most frequently in GCP architect and platform interviews reported by candidates through 2025–2026. They test architectural judgment across networking (Shared VPC, Private Service Connect), IAM (service accounts, custom roles), compute selection (GKE Autopilot vs. Standard, Cloud Run, GCE), data (BigQuery, Spanner, AlloyDB), and resilience — not just product names.
The 10 questions
1. When do you use a Shared VPC versus a standalone VPC per project?
Shared VPC when a central network team owns IP allocation, firewall policy, and connectivity (Cloud Interconnect, HA VPN) for the whole organization, and individual app teams consume subnets in service projects. Standalone VPC per project when teams are truly independent, have small footprints, and you accept duplicated VPN, NAT, and firewall management. The strong PCA-exam pattern in 2026 is Shared VPC plus a hub-and-spoke topology with Network Connectivity Center for any org above ~30 services. Candidates who answer “VPC peering between every project” lose the round — peering is non-transitive, doesn’t scale, and creates a routing-table nightmare past about a dozen projects.
2. Design IAM for a 50-engineer org. What do you ship first?
Three principles, in order. (1) Groups, never users, on resource roles — bind group:platform-admins@example.com to roles, not individual emails. (2) Predefined roles before custom roles — custom roles are an operational tax (you own permission updates as Google adds APIs); only build them when no predefined role fits and the over-grant is material. (3) Service accounts impersonated, not keyed — iam.serviceAccountTokenCreator + Workload Identity Federation for CI/CD, never long-lived JSON keys on disk. The interviewer wants to hear “no service-account keys” explicitly — key material on disk is the GCP equivalent of leaked AWS access keys and a known compromise vector in 2026.
3. GKE Autopilot or GKE Standard — how do you choose?
Autopilot when the workload fits its constraints (no privileged pods, no host-network daemonsets, no custom kernels, supported GPU shapes only) and you want Google to own node management with per-pod billing. Standard when you need bring-your-own GPUs at scale, Windows node pools, Spot VM cost optimization with custom bin-packing, sidecars that need node-level access, or per-node licensing constraints. The 2026 greenfield default is Autopilot for stateless services and Standard for stateful, ML training, or anything with privileged-pod requirements. Saying “always Autopilot” or “always Standard” in interviews flags missing operational experience — the answer is workload-dependent.
4. Cloud SQL, AlloyDB, Spanner, or BigQuery for a new transactional workload?
Cloud SQL for single-region OLTP under ~10 TB on a managed Postgres or MySQL — the boring, correct default. AlloyDB for Postgres-compatible workloads needing higher write throughput, columnar acceleration for analytical queries on the same data, or AI-vector workloads. Spanner for multi-region strong consistency, horizontal scale beyond a single instance, and global writes with external-consistency guarantees — pay the premium only when you actually need it. BigQuery is not transactional; it is the OLAP destination, not a system of record. The trap answer: “Spanner for everything because it scales.” Spanner is dramatically more expensive than Cloud SQL and overkill for most workloads — hiring managers read it as a candidate who hasn’t had to defend a GCP bill.
5. GCE, GKE, Cloud Run, or App Engine — how do you pick a compute target?
Decision order: Cloud Run first for stateless containerized HTTP/event workloads with bursty traffic and scale-to-zero economics. GKE (Autopilot) for Kubernetes-native services needing sidecars, complex networking, or shared platform components (Istio, Knative-like patterns beyond Cloud Run’s scope). GCE for licensed software, custom kernels, Windows workloads, GPU shapes Cloud Run doesn’t expose, or stateful single-VM legacy. App Engine Standard exists but is now a maintenance target — greenfield builds in 2026 default to Cloud Run, not App Engine. Saying “App Engine because it’s serverless” in 2026 dates you.
6. A BigQuery bill jumped 4× this month. What’s your triage?
Open INFORMATION_SCHEMA.JOBS_BY_PROJECT and group by user_email and destination_table, sorted by total_bytes_billed. Most 4× jumps trace to one of three patterns: a new SELECT * from a wide partitioned table without a partition filter (fix: require partition filter on the table and rewrite the query), a scheduled query that started running hourly instead of daily (fix: throttle and add a cost label), or a materialized view rebuilding on a base table that’s being mutated (fix: change refresh policy). Long-term controls: switch heavy users to BI Engine or BigQuery editions reservations to cap on-demand scan cost, and put budget alerts on the project. “Just buy slots” loses the interview — the answer is diagnose the specific query, then put structural controls in place.
7. Design DR for a tier-1 service. What does GCP let you do that AWS doesn’t?
The unique GCP lever is multi-region Spanner and dual-region Cloud Storage with strong consistency at the global tier — no application-layer replication logic required. For RPO=0 / RTO seconds: Spanner multi-region (e.g., nam-eur-asia1), dual-region GCS for object durability, global HTTPS load balancer with regional backend services in two regions, and a Cloud DNS failover policy. For RPO=minutes / RTO=minutes: Cloud SQL with cross-region read replicas promoted on failover, regional GCS, and a regional load balancer per region with weighted DNS. The trap: applying AWS Aurora Global Database thinking 1:1 to Cloud SQL — cross-region Cloud SQL replicas are asynchronous and require manual promotion. The architect’s honest answer is “Spanner if RPO=0, Cloud SQL with planned manual failover otherwise.”
8. Anthos / GKE Enterprise — when is it actually worth the licensing?
Three scenarios where GKE Enterprise earns its license: (1) regulated hybrid — you must keep workloads on-prem or at the edge under audit and want consistent policy with cloud GKE via Config Sync and Policy Controller. (2) multi-cloud is a hard requirement from a regulator or major customer — you run identical GKE clusters in GCP and AWS/Azure and need one control plane. (3) service-mesh-anchored platform — you’ve standardized on managed Cloud Service Mesh across dozens of services. If none of those apply, you’re paying for a service mesh and policy engine you could run on stock GKE Autopilot with Istio and Kyverno — and hiring managers will press on that. Anthos for the sake of “multi-cloud option” without a regulator demanding it is a budget conversation that ends badly.
9. Walk me through Private Service Connect versus VPC Peering versus Private Google Access.
Three different problems. Private Google Access lets a VM with only an internal IP reach Google APIs (storage.googleapis.com, etc.) without a public route — subnet-level toggle, zero cost. VPC Peering connects two VPCs at the routing layer; transitive routing is not allowed and IP ranges must not overlap — fine for two networks, painful past a handful. Private Service Connect (PSC) exposes a specific service (a Cloud SQL instance, a partner SaaS, a Google API) as a private endpoint inside the consumer’s VPC with its own internal IP — no peering required, no IP overlap concerns. The 2026 preferred pattern is PSC for service-to-service and Network Connectivity Center for hub-and-spoke routing — full-mesh VPC peering is the legacy answer.
10. How much do GCP PCA anchored architect roles pay in 2026?
$140,000–$180,000 in US metros for GCP cloud architect and Google Cloud platform engineer roles requiring the PCA plus 3–5 years of cloud experience. Senior and principal architect roles reach $190,000–$240,000, with another premium in fintech and ML platform shops. The official GCP Professional Cloud Architect page lists the current exam guide and case studies. The BLS reports a 2024 median of $130,390 for computer network architects; PCA-anchored architecture roles cluster meaningfully above that median, and the premium widens when paired with the Professional Cloud Network Engineer or Professional Data Engineer cert.
What these questions test
Every question has a “product-page answer” and an “operational answer.” Interviewers want the operational one — the version that includes the gotcha (Shared VPC over peering past a dozen projects, no service-account keys, Autopilot is workload-dependent, Spanner only when you actually need global consistency, PSC over full-mesh peering, App Engine is a maintenance target). Passing the PCA proves you can pick the right product. Answering these correctly proves you’ve actually defended a GCP bill, a DR posture, and an IAM model in front of a regulator.
Practice GCP PCA questions right now — no signup
CertQuests has engineer-written GCP Professional Cloud Architect practice questions with full explanations on every answer. Free, no account required.
Frequently asked questions
Shared VPC or standalone VPC per project?
Shared VPC for any organization above roughly 30 services. A central network team owns subnets, firewalls, and connectivity in a host project; app teams consume them from service projects. Standalone VPC per project only when teams are truly independent and footprints stay small.
What IAM principle does the PCA care about most?
No long-lived service-account keys on disk. Use Workload Identity Federation for CI/CD and service-account impersonation between workloads. Bind roles to groups, not users. Use predefined roles before building custom ones.
Cloud SQL, AlloyDB, or Spanner?
Cloud SQL is the default for single-region OLTP under ~10 TB. AlloyDB for higher Postgres throughput plus analytical and AI-vector workloads on the same data. Spanner only when you actually need multi-region strong consistency — it is dramatically more expensive than Cloud SQL.
How much do GCP PCA anchored architect roles pay in 2026?
$140,000–$180,000 in US metros for cloud architect and platform engineer roles with the PCA plus 3–5 years of experience. Senior and principal architect roles reach $190,000–$240,000. Premium widens in fintech and ML platform shops.
What is the GCP PCA exam format?
50–60 multiple-choice and multiple-select questions in 120 minutes, anchored by four published case studies (EHR Healthcare, Helicopter Racing League, Mountkirk Games, TerramEarth). $200 USD. Google does not publish a numerical pass score; results are pass or fail, valid for 2 years.
Do I need the Associate Cloud Engineer before the PCA?
Not officially required, but practically helpful. The PCA assumes you can navigate gcloud, IAM, networking, and resource deployment without thinking about it — the exam tests architecting on top of that knowledge. Candidates who skip ACE often fail the case-study questions where the architecture decision depends on a platform concept they haven’t internalized.
How we wrote this
No Google or training-vendor revenue. Questions were sourced from candidate reports on Reddit r/googlecloud, the GCP Community Slack, GCP architect LinkedIn groups, and cloud-architecture hiring-manager interviews across 2025–2026, cross-referenced against the official GCP Professional Cloud Architect exam page and the four published case studies. Salary figures are cross-referenced against the BLS Occupational Outlook and open postings on LinkedIn and Levels.fyi as of Q1–Q2 2026. Tell us what you’d update.
Last reviewed: May 31, 2026.