Google PCA Practice Test 21 — 15 Questions

Question 1

A company with multiple projects must ensure that no data can be exfiltrated from a specific project's Cloud Storage buckets to unauthorized locations outside the organization. They also need to allow access only from a corporate VPN IP range. Which configuration meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a VPC Service Controls perimeter with an access level restricted to the corporate VPN IP range.. VPC Service Controls create a service perimeter around the project, preventing data exfiltration by default. Access levels (based on IP ranges) can be used to allow access only from the corporate VPN.

Answer

Set firewall rules to block all traffic except from the VPN.

Answer

Use IAM conditions to restrict access based on IP address.

Answer

Use Cloud Armor with IP whitelisting.

Question 2

A company uses Cloud Identity to manage users and wants to allow employees to authenticate to Google Cloud using their existing corporate Active Directory credentials. Which solution should they implement?

Accepted Answer

Cloud Directory Sync. Cloud Directory Sync synchronizes users and groups from on-premises AD to Cloud Identity, enabling SSO with existing credentials.

Answer

Workload Identity Federation

Answer

IAM policies

Answer

Identity-Aware Proxy

Question 3

A company needs to allow a third-party auditor to view all Compute Engine resources in a project but not allow any modifications. The auditor must not have access to any other services. Which THREE steps should be taken?

Accepted Answer

Grant the 'Compute Viewer' role (roles/compute.viewer). The correct IAM role is Compute Viewer. To restrict access to only Compute Engine, do not grant other roles. The viewer role should be assigned at the project level to cover all Compute resources.

Answer

Grant the 'Viewer' primitive role (roles/viewer)

Answer

Assign the role at the resource (VM) level

Question 4

A company is deploying a multi-tenant SaaS application on GKE. Each tenant's data must be isolated at the network level. They want to use a single GKE cluster but ensure that pods from different tenants cannot communicate with each other. Which GCP feature should they use?

Accepted Answer

Kubernetes Network Policies. Kubernetes Network Policies allow you to define rules for pod-to-pod communication within a cluster, enabling tenant isolation. GKE Sandbox provides stronger isolation at the kernel level but is not specifically for network isolation. VPC Service Controls are for Google Cloud services, not pod-level. Istio can also provide network control but is a more complex mesh.

Answer

Istio service mesh

Answer

VPC Service Controls

Answer

GKE Sandbox

Question 5

A company uses Cloud KMS with CMEK to encrypt data stored in BigQuery. They need to audit who has used the encryption key and when. Which type of audit log should they enable?

Accepted Answer

Data Access audit logs. Cloud KMS operations (e.g., encrypt, decrypt) are recorded in Data Access audit logs. Admin Activity logs record configuration changes, not data access.

Answer

Network Security audit logs

Answer

Admin Activity audit logs

Answer

System Event audit logs

Question 6

A company wants to enforce that all secrets used by applications running on Compute Engine are rotated automatically every 30 days. Which GCP service should they use to store and manage these secrets?

Accepted Answer

Secret Manager. Secret Manager supports automatic rotation of secrets based on a specified schedule, and applications can access the latest version without redeployment.

Answer

Cloud Key Management Service with CMEK

Answer

Environment variables

Answer

Cloud KMS

Question 7

Which Google Cloud service allows organizations to define perimeters that protect resources and data from exfiltration to other VPCs or networks?

Accepted Answer

VPC Service Controls. VPC Service Controls allow you to define service perimeters that restrict access to managed services from outside the perimeter, preventing data exfiltration.

Answer

Private Service Connect

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud Armor

Question 8

A company needs to protect an HTTPS load-balanced web application from OWASP Top 10 attacks, including SQL injection and cross-site scripting. Which GCP service should they enable?

Accepted Answer

Cloud Armor. Cloud Armor provides WAF capabilities that can be attached to HTTPS Load Balancers to filter requests based on OWASP signatures.

Answer

Cloud NAT

Answer

Cloud CDN

Answer

Identity-Aware Proxy

Question 9

A company wants to protect a web application from SQL injection and cross-site scripting (XSS) attacks. They also need to block traffic from specific geographic regions. Which three features of Cloud Armor should they use? (Choose THREE).

Accepted Answer

Rate limiting. WAF rules (preconfigured rules for SQLi, XSS), rate limiting (optional), and geographic restrictions (geo-based access control) are all features of Cloud Armor.

Answer

Cloud CDN

Answer

Adaptive Protection

Question 10

An organization requires that all container images deployed to GKE be signed and verified before deployment. Which GCP service should be used?

Accepted Answer

Binary Authorization. Binary Authorization enforces deployment policies that require images to be signed by trusted authorities (e.g., using Cloud KMS) and verified before being deployed to GKE.

Answer

Container Registry vulnerability scanning

Answer

Cloud Build

Answer

Artifact Registry

Question 11

A company wants to enforce that only approved container images can be deployed to GKE. They also want to ensure images are scanned for vulnerabilities before deployment. Which two GCP services should they use? (Choose TWO).

Accepted Answer

Container Analysis API. Binary Authorization enforces deployment policies based on image signatures. Container Analysis (or vulnerability scanning) identifies vulnerabilities in images.

Answer

Cloud Security Command Center

Answer

Container Registry vulnerability scanning

Answer

Cloud Build

Question 12

A company needs to ensure that only approved container images can be deployed to a GKE cluster. They already use Binary Authorization. What additional step is required to enforce this policy?

Accepted Answer

Create an attestor and attach it to a Binary Authorization policy. Binary Authorization requires an attestor that verifies image signatures. The attestor must be created and attached to a policy that requires at least one attestation.

Answer

Configure a VPC Service Perimeter

Answer

Enable Container Registry vulnerability scanning

Answer

Assign the container.deployer role to the GKE service account

Question 13

An organization needs to store secrets used by multiple GCP services. They require automatic rotation of secrets every 30 days and integration with Cloud Functions. Which service should they use?

Accepted Answer

Secret Manager. Secret Manager supports automatic rotation (via rotation period and next rotation time) and integrates with Cloud Functions via the API client libraries.

Answer

Cloud HSM

Answer

Cloud KMS

Answer

Cloud Asset Inventory

Question 14

A company uses Cloud Key Management Service (Cloud KMS) with a customer-managed encryption key (CMEK) to encrypt data in BigQuery. They want to ensure the key can only be used by the BigQuery service account in the 'us-central1' region. Which IAM condition should be added to the key's IAM policy?

Accepted Answer

resource.name.startsWith('projects/_/locations/us-central1') && request.auth.principalSet == 'serviceAccount:bq-<project-number>@bigquery-encryption.iam.gserviceaccount.com'. IAM conditions allow restricting access based on attributes like region and service account. The condition must check the 'destination_service' for BigQuery and the 'region' for us-central1.

Answer

resource.name.startsWith('projects/_/locations/us-central1') && request.auth.principal == 'bigquery@system.gserviceaccount.com'

Answer

resource.name.startsWith('projects/_/locations/global') && request.auth.principal == 'bigquery@system.gserviceaccount.com'

Answer

resource.service == 'bigquery.googleapis.com' && resource.location == 'us-central1'

Question 15

An organization uses Active Directory (AD) on-premises and wants to synchronize user identities to Google Cloud Identity so that users can access G Suite and GCP resources with their existing credentials. Which service should they use?

Accepted Answer

Cloud Directory Sync. Cloud Directory Sync (formerly Google Cloud Directory Sync) synchronizes users and groups from LDAP-compliant directories like Active Directory to Cloud Identity. It allows single sign-on and identity management.

Answer

Cloud Identity-Aware Proxy (IAP)

Answer

Federation with Google Identity Platform

Answer

SAML SSO