Google PCA Practice Test 20 — 15 Questions

Question 1

A company uses Cloud Armor to protect an HTTPS Load Balancer. They want to allow traffic only from users who have passed a reCAPTCHA challenge. Cloud Armor supports which feature for this?

Accepted Answer

WAF rules with reCAPTCHA. Cloud Armor security policies can include rules that use reCAPTCHA tokens to block or allow traffic based on the challenge outcome.

Answer

Preconfigured WAF rules

Answer

Adaptive Protection

Answer

Rate limiting

Question 2

An organization wants to ensure that only container images signed by an authorized CI/CD pipeline can be deployed to their GKE clusters. Which GCP service should they use?

Accepted Answer

Binary Authorization. Binary Authorization is a GCP service that enforces attestation-based policies, ensuring only signed container images are deployed to GKE.

Answer

Artifact Registry

Answer

Cloud Security Scanner

Answer

Cloud Build

Question 3

An engineer needs to grant a service account the ability to create and manage VMs in a specific project, but only those VMs with a certain label. Which IAM feature should they use?

Accepted Answer

IAM conditions. IAM conditions allow you to grant conditional access based on resource attributes such as labels, name, or creation time. Custom roles are a collection of permissions but do not enforce conditions. Service account impersonation is used to act as another service account. Primitive roles are broad and do not support conditions.

Answer

Primitive roles

Answer

Custom roles

Answer

Service account impersonation

Question 4

A company needs to store secrets used by multiple GCP services. They require automatic rotation of secrets every 30 days and integration with Cloud Functions. Which two GCP services should they use? (Choose TWO).

Accepted Answer

Cloud Functions. Secret Manager stores secrets and supports rotation. Cloud Functions can access secrets via the Secret Manager API or by mounting them as volumes.

Answer

Cloud Run

Answer

Cloud KMS

Answer

Cloud Scheduler

Question 5

A financial services company must store customer data in a GCP region that is certified for FedRAMP High. They also need to ensure that only authorized personnel can access the data, and that access logs are kept for 10 years. Which combination of services meets these requirements?

Accepted Answer

Assured Workloads with Cloud Audit Logs and IAM. Assured Workloads provides a FedRAMP High environment with specific regions. Cloud Audit Logs can be configured for extended retention. IAM controls access. CMEK is not required for compliance in this case. DLP is for data classification, not access control.

Answer

Cloud HSM and Cloud Audit Logs

Answer

VPC Service Controls with Cloud DLP

Answer

Cloud KMS with CMEK and Cloud Audit Logs

Question 6

A developer wants to store a database password securely and have it automatically rotated every 30 days. The password is used by a Compute Engine instance. Which Google Cloud service should they use?

Accepted Answer

Secret Manager. Secret Manager can store secrets and has built-in rotation capabilities. You can set a rotation period and a rotation function (e.g., Cloud Function) to generate a new password. This is the recommended service.

Answer

Cloud Storage with customer-supplied encryption keys

Answer

Cloud Key Management Service (Cloud KMS)

Answer

Environment variables in Compute Engine

Question 7

An organization needs to restrict access to a Cloud Storage bucket so that only resources in a specific VPC network can read the data. They want to prevent data exfiltration via the internet. Which combination of services should they use?

Accepted Answer

VPC Service Controls and Private Google Access. VPC Service Controls create service perimeters that protect Cloud Storage and other services. Private Google Access allows on-premises or VM access via private IP. Together they restrict access to the VPC network.

Answer

Firewall Rules and Cloud VPN

Answer

Cloud Armor and Cloud NAT

Answer

IAM Conditions and Cloud CDN

Question 8

An organization wants to use Cloud KMS to manage encryption keys for data in Cloud Storage and BigQuery. They require that key material never leaves a hardware security module (HSM) and must be FIPS 140-2 Level 3 certified. Which TWO actions should they take?

Accepted Answer

Create a key ring with protection level 'HSM'. To use HSM-backed keys, create a key ring with protection level HSM via Cloud HSM. Cloud KMS supports HSM keys that never leave the HSM.

Answer

Use Cloud External Key Manager (Cloud EKM)

Answer

Use Customer-Supplied Encryption Keys (CSEK)

Answer

Create a key ring with protection level 'software'

Question 9

A company wants to restrict access to their Cloud Storage bucket so that only requests from within a specific VPC network are allowed, and all other traffic (including internet) is denied. They also need to allow access from on-premises through a VPN. Which configuration should they use?

Accepted Answer

Configure the bucket with VPC Service Controls and enable Private Google Access. VPC Service Controls create a service perimeter around the bucket, and private Google Access allows resources in the VPC to use the bucket's private IP addresses. The on-premises network can connect via VPN using VPC Private Google Access. Public access is blocked by the perimeter. Firewall rules alone cannot block internet traffic to a public bucket.

Answer

Use IAM conditions to restrict access based on IP address

Answer

Use firewall rules to allow traffic only from the VPC IP range

Answer

Set up Cloud VPN and use Cloud NAT for egress

Question 10

A company wants to ensure that all audit logs for a project are retained for 7 years for compliance purposes. Which type of audit logs in Cloud Logging should they configure for the longest retention?

Accepted Answer

Export all audit logs to Cloud Storage with a retention policy. Cloud Logging retains logs for a default period, but for long-term retention you can export logs to Cloud Storage. All audit logs (Admin Activity, Data Access, System Event) can be exported and stored in a bucket with retention policies. The question might refer to the default retention: Admin Activity logs are retained for 400 days, Data Access for 30 days, but you can export to Cloud Storage for longer. The best answer is to export all audit logs to Cloud Storage.

Answer

Admin Activity audit logs

Answer

Data Access audit logs

Answer

System Event audit logs

Question 11

A DevOps engineer needs to grant a CI/CD pipeline (running in a different Google Cloud project) the ability to deploy resources into a target project. The pipeline uses a service account. What is the best way to grant this access?

Accepted Answer

Add the service account email as a member of the target project with appropriate roles.. IAM allows granting roles to a service account principal from another project by specifying the full email of the service account as a member.

Answer

Use VPC peering to allow cross-project access.

Answer

Use Cloud NAT to enable communication.

Answer

Create a new service account in the target project and share the key with the pipeline.

Question 12

A company uses Assured Workloads to meet FedRAMP compliance. They need to ensure that only authorized personnel can access data access audit logs for their projects. Which IAM role should they grant to the security team?

Accepted Answer

roles/logging.privateLogViewer. Data Access audit logs require the 'roles/logging.privateLogViewer' role (or equivalent) to view. Admin Activity logs are visible with 'roles/logging.viewer' or higher.

Answer

roles/logging.viewer

Answer

roles/iam.securityReviewer

Answer

roles/logging.admin

Question 13

A development team uses Cloud Build for their CI/CD pipeline. They want to reduce build times. Which action is most effective?

Accepted Answer

Enable parallel builds by separating build steps into multiple jobs. Enabling parallel builds by separating build steps into multiple jobs reduces total build time by running independent steps concurrently. Other options are less effective or add complexity.

Answer

Store build artifacts in a Cloud Storage bucket and reuse them

Answer

Use more powerful build machines by specifying larger machine types

Answer

Use a Cloud Run service to run builds asynchronously

Question 14

A company wants to use Customer-Managed Encryption Keys (CMEK) for data at rest in Cloud Storage, but also needs to ensure that the keys are stored in a hardware security module (HSM) to meet compliance requirements. Which Cloud KMS key type should they choose?

Accepted Answer

Cloud HSM key. Cloud HSM provides HSM-backed keys that are FIPS 140-2 Level 3 certified. Using Cloud HSM for the CMEK ensures the key material is stored in a hardware security module.

Answer

Predefined key

Answer

External key (Cloud External Key Manager)

Answer

Software-backed key

Question 15

A company is migrating an on-premises application to Google Cloud. The application requires access to a legacy database that can only be reached from a specific on-premises IP address. The company has established a Cloud VPN tunnel. What is the MOST secure way to ensure that only the migrated application's Compute Engine instances can initiate connections to the on-premises database?

Accepted Answer

Create a firewall egress rule with destination IP range of the on-premises database and source service account of the application instances. Using firewall rules with target service accounts allows you to control egress traffic based on the identity of the source instances, which is more secure than using tags or IP ranges.

Answer

Create a Cloud NAT and assign the application instances a static IP, then allow that IP in the on-premises firewall

Answer

Create a firewall egress rule with destination IP range of the on-premises database and source tags 'db-access'

Answer

Use VPC Service Controls to create a perimeter around the application VPC