Google PCA Practice Test 11 — 15 Questions

Question 1

An organization has a security policy that prohibits the use of external IP addresses on Compute Engine instances to reduce attack surface. They want to enforce this policy across all new and existing projects. Which approach should they use?

Accepted Answer

Use Organization Policy with constraint compute.vmExternalIpAccess. Organization policy with constraint constraints/compute.vmExternalIpAccess can be set to block external IPs. IAM conditions are not effective for this; firewall rules do not prevent the IP assignment; and SCC only detects violations after creation.

Answer

Use IAM conditions to prevent creation of instances with external IPs

Answer

Use Cloud Security Command Center to detect and alert on external IPs

Answer

Use VPC Firewall rules to block traffic to external IPs

Question 2

A company wants to restrict data exfiltration from its Google Cloud projects by preventing resources from copying data to external IP addresses. Which service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls provide a security perimeter to reduce data exfiltration risk. Option A is wrong because Cloud Armor is for DDoS/ WAF protection. Option B is wrong because Cloud NAT allows outbound connectivity, not restriction. Option D is wrong because HTTPS load balancers do not prevent data exfiltration.

Answer

HTTPS Load Balancer

Answer

Cloud Armor

Answer

Cloud NAT

Question 3

A company wants to ensure that all access to their Cloud Storage bucket is logged for compliance purposes. Which type of audit log should they enable?

Accepted Answer

Data Access audit logs. Data Access audit logs record every access to user data. Admin Activity logs record administrative actions; System Event logs record GCP actions; Access Transparency logs record Google support access.

Answer

Admin Activity audit logs

Answer

System Event audit logs

Answer

Access Transparency logs

Question 4

A data scientist needs read-only access to a Cloud Storage bucket containing training data. What is the least privileged IAM role to grant at the bucket level?

Accepted Answer

roles/storage.objectViewer. The roles/storage.objectViewer role grants read access to objects without listing or other permissions. Option A is too broad (project-level). Option C allows listing but is more than read-only. Option D includes identity and access management permissions.

Answer

roles/storage.objectAdmin

Answer

roles/storage.objectCreator

Answer

roles/storage.admin

Question 5

Which THREE services can be used to audit changes to resources in a Google Cloud project?

Accepted Answer

Security Command Center. Cloud Audit Logs record admin activities; Cloud Asset Inventory tracks resource changes; Security Command Center provides findings and event monitoring. Option A is for runtime visibility; Option E is for host-based monitoring.

Answer

Cloud Monitoring

Answer

Cloud Endpoints

Question 6

A company is using Cloud Load Balancing to expose a web application. They want to protect against common web attacks like SQL injection and cross-site scripting. Which Google Cloud service should they configure?

Accepted Answer

Cloud Armor. Cloud Armor provides WAF rules that can detect and block SQLi and XSS. Cloud CDN is for caching; IAP is for authentication; VPC Firewall rules work at IP/port level.

Answer

VPC Firewall rules

Answer

Identity-Aware Proxy

Answer

Cloud CDN

Question 7

A company wants to automatically rotate cryptographic keys on a schedule without manual intervention. Which service should they use?

Accepted Answer

Cloud Key Management Service (KMS). Cloud KMS supports automatic key rotation. Option A is for managing secrets. Option C is for access control. Option D is for auditing.

Answer

Secret Manager

Answer

Cloud Audit Logs

Answer

Cloud IAM

Question 8

After executing the command, a security review reveals that the service account sa-bucket-reader can also list buckets in the project, which was not intended. What is the most likely cause?

Accepted Answer

The service account has a project-level role that includes storage.list.. The etag in the policy file was used, but the command replaces the entire policy. If the previous policy had a role like roles/storage.objectAdmin or roles/viewer that included bucket listing, and the new policy only set objectViewer, the service account might still have inherited permissions from a higher-level role (e.g., at project level). Option A is incorrect because there is no bucket-level IAM applied here. Option B is incorrect because the policy was updated. Option C is incorrect because the service account is in the same project.

Answer

The etag was incorrect, causing a concurrent modification.

Answer

The policy update failed due to a missing condition.

Answer

The service account also has bucket-level IAM roles.

Question 9

A company is using Cloud SQL with automatic backups enabled. They want to ensure that backups are encrypted with a customer-managed key (CMEK) and that the key used for backups is different from the one used for the database itself. How can they achieve this?

Accepted Answer

When creating the Cloud SQL instance, specify a CMEK for the database using 'root.encryptionKeyName' and a different CMEK for backups using 'backup.encryptionKeyName'.. Option D is correct because Cloud SQL allows you to specify a CMEK for the database and a separate CMEK for backups via the 'backup.encryptionKeyName' setting when creating the instance or later via patch. Option A is wrong because one master key wraps both; you cannot use two different CMEKs for the same instance unless using separate backups key. Option B is wrong because CMEK is supported, but you need to set the backup key separately. Option C is wrong because you can specify a different key for backups in the Cloud SQL API.

Answer

Create a Cloud KMS key ring with two keys, and use one key for the database and the other for backups, but Cloud SQL does not support separate keys.

Answer

Use the same CMEK for both the database and backups, as separate keys are not supported.

Answer

Enable CMEK on the Cloud SQL instance, and the backups will automatically use the same key.

Question 10

A financial services company must comply with PCI DSS. They use Cloud SQL for MySQL for transaction processing. They need to ensure that all data at rest is encrypted with keys generated and stored in a Hardware Security Module (HSM) and that key rotation occurs every 90 days. Which configuration should they use?

Accepted Answer

Use Cloud SQL with CMEK backed by Cloud HSM, and set automatic rotation period of 90 days. Cloud SQL CMEK with Cloud HSM allows HSM-backed keys and automatic rotation. Default encryption uses Google-managed keys; CSEK is for disks; EKM is for external KMS but adds complexity.

Answer

Use Cloud External Key Manager (EKM) to integrate with on-premises HSM

Answer

Use Cloud SQL with customer-supplied encryption keys (CSEK) and automate rotation with Cloud Scheduler

Answer

Use Cloud SQL's default encryption with organization policy requiring rotation

Question 11

A company has a fleet of Compute Engine instances that need to access a Cloud Storage bucket. The security team requires that only instances in specific VPC networks can access the bucket, and that the data is encrypted in transit. How can this be achieved?

Accepted Answer

Create a VPC Service Controls perimeter with access levels, and require HTTPS for the bucket.. VPC Service Controls with perimeter rules and usage of HTTPS for Cloud Storage ensures in-transit encryption. Option A provides encryption but not network restriction. Option C provides encryption but not network restriction. Option D provides network restriction but not encryption in transit.

Answer

Use a Cloud Storage bucket with encryption at rest using CSEK.

Answer

Use Cloud Armor with IP allowlists and enable TLS for the bucket.

Answer

Use a Cloud Storage bucket with encryption at rest using CMEK.

Question 12

A company needs to ensure that only approved machine images can be used to create Compute Engine instances to meet security compliance. Which two methods should they use? (Choose two.)

Accepted Answer

Use a custom role with permissions restricted to specific image families. The organization policy constraint compute.trustedImageProjects restricts allowed image projects. Creating a custom role with permissions limited to specific image projects also works. IAM conditions on instance creation are not effective; VPC Service Controls don't apply to images; detection alone is not prevention.

Answer

Use VPC Service Controls to prevent creation from unauthorized images

Answer

Use Cloud Asset Inventory to detect non-compliant images and trigger remediation

Answer

Use IAM conditions on compute.instances.create to require a specific family label

Question 13

A company hosts a web application on Google Kubernetes Engine (GKE) and wants to protect against SQL injection attacks. Which service should they configure?

Accepted Answer

Cloud Armor. Cloud Armor with WAF rules can block SQL injection. Option B is for identity. Option C is for container scanning. Option D is for audit logs.

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud Audit Logs

Answer

Container Analysis

Question 14

A data engineer needs to analyze data in BigQuery but must mask personally identifiable information (PII) based on user roles. Which service should they use?

Accepted Answer

BigQuery column-level security. BigQuery column-level security with data masking allows conditional masking. Option A provides classification but not role-based masking. Option B is for tokenization but not integrated with BigQuery. Option D is for data catalog.

Answer

Cloud Key Management Service

Answer

Cloud Data Catalog

Answer

Cloud Data Loss Prevention (DLP)

Question 15

A company wants to restrict access to a Cloud Storage bucket so that only objects encrypted with a specific Cloud KMS key can be read. Which approach should they use?

Accepted Answer

Use IAM conditions with the resource name condition 'resource.name.startsWith("projects/_/buckets/example-bucket/objects/")' and 'resource.hasTag("kmsKeyName", "projects/p/locations/l/keyRings/kr/cryptoKeys/ck")'.. Option D is correct because Cloud Storage Object has a 'kmsKeyName' condition that can be used in IAM conditions to require objects to be encrypted with a specific KMS key. Option A is wrong because VPC Service Controls prevent data exfiltration but do not enforce encryption at the object level. Option B is wrong because bucket policies do not directly examine encryption key metadata. Option C is wrong because Key Access Justifications only provide reasons for key access but do not restrict object access based on encryption key.

Answer

Enable Key Access Justifications on the Cloud KMS key and allow access only for justified requests.

Answer

Set a bucket policy that denies access if the object's encryption type is not CMEK.

Answer

Configure VPC Service Controls to include the bucket and the Cloud KMS key resource.