Google PCA Practice Test 12 — 15 Questions

Question 1

A financial institution deploys a containerized application on GKE with Binary Authorization enabled. They want to ensure that only images signed by their internal CI/CD pipeline are deployed, and they also need to allow a break-glass procedure using a specific image from a curated registry. How should they configure Binary Authorization?

Accepted Answer

Create a policy with a default deny rule, and add a custom rule to allow images from the curated registry.. Binary Authorization allows a default deny rule with an exception for the curated registry. Option A does not allow break-glass. Option B would allow all unsigned images. Option D is not a valid attestor.

Answer

Create a policy with an evaluation mode to allow all images, but use a whitelist of approved registries.

Answer

Use Cloud Run instead, which has built-in image verification.

Answer

Create a policy with an evaluation mode to require all images to be signed, and configure a Cloud Build attestor.

Question 2

A security engineer is configuring VPC Service Controls to protect a project containing BigQuery datasets with PII. They want to prevent data exfiltration while allowing authorized users to query the data from outside the perimeter. Which configuration meets these requirements?

Accepted Answer

Create a perimeter that includes the project, and use an access level from Access Context Manager to grant access to authorized users.. Option C is correct because Access Context Manager (ACM) can define access levels based on user identity or device status, and VPC Service Controls perimeters can be configured with access levels that allow access from outside the perimeter for authorized users. Option A is wrong because allowing all traffic from outside the perimeter defeats the purpose of the perimeter. Option B is wrong because there is no 'exfiltration exception' flag; you must use access levels. Option D is wrong because perimeters can apply to projects with BigQuery datasets, not just compute.

Answer

Create a perimeter that includes the project, and set the 'allowed external access' flag to true.

Answer

Create a perimeter and enable the 'exfiltration exception' for BigQuery.

Answer

Create a perimeter that includes only Compute Engine instances, and use a separate perimeter for BigQuery.

Question 3

Which TWO security best practices should be applied when configuring Cloud Functions that process sensitive data? (Choose two.)

Accepted Answer

Enable VPC connector and set ingress to internal to avoid public internet exposure.. Options B and D are correct. Using internal traffic only (via VPC connector) ensures data does not traverse the public internet. Encrypting environment variables with CMEK protects sensitive configuration. Option A is wrong because the default service account often has excessive permissions; use a least-privilege identity. Option C is wrong because disabling ingress is not possible; you control egress. Option E is wrong because Cloud Functions support CMEK for environment variables, but not automatically; you must use Secret Manager.

Answer

Disable all inbound network traffic to the function.

Answer

Enable Cloud KMS customer-managed encryption for the function's environment variables.

Answer

Use the default Compute Engine default service account for simplicity.

Question 4

A security architect is designing a zero-trust network for applications running on Compute Engine. They want to enforce that all traffic between VMs must be encrypted and authenticated, regardless of the VPC network. Which approach meets this requirement?

Accepted Answer

Deploy Anthos Service Mesh with mTLS enabled.. Mutual TLS (mTLS) with service mesh provides encryption and authentication at application level. Option A only encrypts, not authenticates. Option B encrypts but not authenticates. Option D is not a standard approach.

Answer

Configure each VM to use IPsec tunnels to every other VM.

Answer

Use Cloud VPN to encrypt all inter-VM traffic.

Answer

Enable VPC Flow Logs and use firewall rules to allow only encrypted traffic.

Question 5

A company is deploying a web application on Google Kubernetes Engine (GKE) and needs to ensure that the application's service account can only pull images from a specific Container Registry repository. What is the best practice to enforce this?

Accepted Answer

Use Workload Identity and grant the Kubernetes service account's associated Google service account the roles/storage.objectViewer role on the registry bucket.. Option B is correct because Workload Identity allows you to bind a Kubernetes service account to a Google service account, and you can then grant the GSA only the roles/storage.objectViewer role on the specific registry bucket. Option A is wrong because IAM conditions on the node pool affect the nodes, not the pods. Option C is wrong because granting access at the project level is too broad. Option D is wrong because there is no direct IAM for the pod.

Answer

Grant the Compute Engine default service account the roles/storage.objectViewer role on the registry bucket.

Answer

Set an IAM policy on the pod directly using the 'gke-default' service account.

Answer

Create an IAM condition on the node pool's service account that limits access to the registry bucket.

Question 6

A company manages secrets for multiple microservices using Secret Manager. They need to ensure that each service can access only its own secrets, and that all access is logged. What is the best IAM architecture?

Accepted Answer

Create custom roles with secrets.get permission and bind to each service account at the individual secret resource.. Using custom roles with fine-grained permissions and audit logs on the secret level provides least privilege. Option A grants too much access (project-wide). Option B gives full access. Option D does not control access per service.

Answer

Grant each service account the roles/secretmanager.secretAccessor role at the project level.

Answer

Use a single service account for all microservices with access to all secrets.

Answer

Grant each service account the roles/secretmanager.admin role at the secret level.

Question 7

A healthcare organization is storing sensitive patient data in Cloud Storage. They need to ensure that all objects are encrypted with a key managed by their on-premises HSM. Which encryption approach should they use?

Accepted Answer

Use Cloud External Key Manager (EKM) with a key hosted on the on-premises HSM.. Option D is correct because Cloud External Key Manager (EKM) allows you to use an external key management system (like on-premises HSM) to wrap a Google-managed key. The data is encrypted with a Google-managed key, which is then encrypted with the external key. Option A is wrong because CSEK is deprecated and does not support on-premises key rotation. Option B is wrong because CMEK uses Cloud KMS, not an external HSM directly. Option C is wrong because CSEK requires supplying the key with each request, not managed by an HSM.

Answer

Use Customer-Supplied Encryption Keys (CSEK) and store the key in a Secret Manager accessible only from the on-premises HSM.

Answer

Use Customer-Managed Encryption Keys (CMEK) with a Cloud KMS key that is generated from the on-premises HSM.

Answer

Encrypt each object client-side with a key from the on-premises HSM before uploading to Cloud Storage.

Question 8

Which TWO methods can be used to encrypt data at rest in BigQuery?

Accepted Answer

Use Customer-Managed Encryption Keys (CMEK) via Cloud KMS.. BigQuery supports both CMEK (Cloud KMS key) and CSEK (customer-supplied encryption key) for data at rest encryption. Option C is for Cloud Storage, not BigQuery. Option D is for Cloud SQL. Option E is for Bigtable.

Answer

Use a Cloud Storage bucket with bucket-level default encryption.

Answer

Use Cloud SQL with encryption at rest.

Answer

Use Cloud Bigtable with encryption at rest.

Question 9

A company wants to use Cloud Armor to protect their HTTP load balancer from SQL injection attacks. Which rule action should they configure to block malicious requests?

Accepted Answer

Use a pre-configured WAF rule that includes 'evaluatePreconfiguredExpr('sqli-stable')' with action 'deny(403)'.. Option B is correct because Cloud Armor's pre-configured WAF rules include 'sqli' to detect SQL injection patterns. Option A is wrong because 'deny(403)' alone does not inspect the request body. Option C is wrong because 'rateLimit' limits request rate but does not inspect for SQL injection. Option D is wrong because 'redirect' does not block.

Answer

Configure a rate-limiting rule with action 'rateLimit' to throttle traffic from suspicious IPs.

Answer

Create a rule that redirects traffic to a reCAPTCHA challenge for validation.

Answer

Set a security policy rule with action 'deny(403)' and a simple condition on the user-agent header.

Question 10

Which TWO practices improve the security of a Cloud Run service?

Accepted Answer

Enable Cloud Armor for the service.. Use of Cloud Armor for DDoS protection and Identity-Aware Proxy for authentication are correct. Option C is for containers not specific to security; Option D is for infrastructure; Option E is for end-to-end encryption but Cloud Run already uses HTTPS.

Answer

Run the service in a VPC with firewall rules.

Answer

Use a canary deployment strategy.

Answer

Require client-side TLS certificates.

Question 11

An organization is implementing a data loss prevention (DLP) strategy for Cloud Storage. They want to automatically scan new objects uploaded to a specific bucket and redact sensitive data. Which service and configuration should they use?

Accepted Answer

Use Cloud Functions triggered by Cloud Storage events to call Cloud DLP API for each new object, and then store the redacted version.. Option C is correct because Cloud DLP can be triggered by Cloud Functions when a Cloud Storage event occurs (e.g., object finalize), and the function can send the object to DLP for inspection and redaction. Option A is wrong because BigQuery is for structured data, not storage. Option B is wrong because SCC provides security posture management, not DLP scanning. Option D is wrong because there is no Cloud Armor for storage.

Answer

Configure Cloud Armor with a WAF rule to inspect and redact data as it enters the bucket.

Answer

Enable Security Command Center (SCC) premium tier and configure it to scan the bucket for sensitive data.

Answer

Use Cloud DLP with a BigQuery external table to scan the bucket contents periodically.

Question 12

Alice needs to read objects in the bucket 'secret-bucket'. Based on the IAM policy, what is her effective access?

Accepted Answer

Alice can read objects because objectAdmin grants read access and is not denied.. The deny rule denies objectViewer specifically on secret-bucket, but she also has objectAdmin which overrides (deny does not block other roles). So she can read via objectAdmin. Option B is incorrect because deny rules only remove the specified role. Option C is incorrect because objectAdmin includes read. Option D is incorrect.

Answer

Alice cannot read objects because the deny rule overrides all allow bindings.

Answer

Alice can read objects only if she also has objectCreator role.

Answer

Alice cannot read objects because the deny rule removes objectViewer and she has no other read access.

Question 13

The firewall rule 'allow-ssh' was not created. According to the audit log, what is the most likely reason?

Accepted Answer

The user does not have the compute.firewalls.create permission.. The authorizationInfo indicates that the permission compute.firewalls.create was granted false, meaning the user lacked that permission. Option A is incorrect because the log shows admin@example.com. Option C is incorrect because the firewall already exists? The log says insert, and status is permission denied. Option D is incorrect because the specific permission is denied.

Answer

The user is not authenticated.

Answer

The user has the compute.securityAdmin role but not compute.firewalls.create.

Answer

The firewall rule already exists and cannot be duplicated.

Question 14

A company wants to allow developers to create service accounts in a project but prevent them from granting the 'roles/iam.serviceAccountUser' role to any user. Which organization policy constraint should they set?

Accepted Answer

Set the constraint 'iam.restrictGrantableRoles' to ['roles/iam.serviceAccountUser'].. Option A is correct because 'iam.disableServiceAccountKeyCreation' disables service account key creation, not role granting. Option B is correct because 'iam.allowedPolicyMemberDomains' restricts which domains can be granted roles. Actually the correct constraint to prevent granting roles is 'iam.restrictGrantableRoles'. Wait, let's think: The question asks to prevent developers from granting a specific role. The correct constraint is 'iam.restrictGrantableRoles' which allows you to restrict the roles that can be granted. Option B is about domains. Option D is about denying usage of service account impersonation? Actually, the correct answer is 'Workload Identity pools' not a constraint. The correct constraint is 'iam.restrictGrantableRoles'. So I need to pick the right one. Let's correct: Option A: iam.disableServiceAccountKeyCreation - that prevents creating keys, not granting roles. Option B: iam.allowedPolicyMemberDomains - limits which domains can be members. Option C: iam.restrictGrantableRoles - limits which roles can be granted. Option D: iam.workloadIdentityPoolProviders - for workload identity. So the correct is Option C. I need to adjust the JSON accordingly. Actually in the JSON below I had a mistake. I'll correct now.

Answer

Set the constraint 'iam.allowedPolicyMemberDomains' to include only the company's domain.

Answer

Set the constraint 'iam.disableServiceAccountKeyCreation' to True.

Answer

Set the constraint 'iam.workloadIdentityPoolProviders' to deny all.

Question 15

A security team wants to receive alerts when a user attempts to grant the 'roles/owner' role to a member outside of the organization's domain. Which log filter should they use to create a log-based metric?

Accepted Answer

Filter on Admin Activity log type with 'protoPayload.methodName="SetIamPolicy" AND protoPayload.serviceName="cloudresourcemanager.googleapis.com" AND NOT protoPayload.request.policy.bindings: member: "example.com"'.. Option B is correct because Cloud Audit Logs for Admin Activity capture all IAM policy changes. The filter checks for setIamPolicy on the project and that the binding includes a member with a domain outside the allowed list. Option A is wrong because Data Access logs do not include admin activity. Option C is wrong because it only checks for allAuthenticatedUsers. Option D is wrong because it checks for compute instances, not IAM.

Answer

Filter on Data Access log type with 'protoPayload.methodName="google.iam.v1.IAMPolicy.SetIamPolicy"'.

Answer

Filter on Admin Activity logs for 'resource.type="gce_instance" AND protoPayload.methodName="compute.instances.setServiceAccount"'.

Answer

Filter on System Event logs with a query for 'resource.type="project" AND protoPayload.response.status.code=7'.