Google PCA Practice Test 46 — 15 Questions

Question 1

A company wants to enforce that all data stored in Cloud Storage buckets is encrypted with a key that they manage and rotate quarterly. They also want to ensure that the key is stored in a hardware security module (HSM). Which combination of services should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud KMS with a key backed by Cloud HSM, and set the bucket's default encryption to use that key (CMEK). Cloud HSM provides HSM-backed keys, and Cloud KMS allows you to create and manage those keys. CMEK (Customer-Managed Encryption Keys) with Cloud KMS (backed by HSM) meets the requirements.

Answer

Customer-Supplied Encryption Keys (CSEK) with Cloud Storage

Answer

Cloud External Key Manager (Cloud EKM)

Answer

Cloud HSM with default Google-managed keys

Question 2

A company wants to use its existing Active Directory credentials to authenticate users to the GCP Console. Which service should they integrate with?

Accepted Answer

Cloud Identity with SAML SSO. Cloud Identity can federate with Active Directory via SAML or OIDC, allowing users to sign in with their AD credentials.

Answer

Identity-Aware Proxy

Answer

Cloud KMS

Answer

Cloud Directory Sync

Question 3

A company uses Cloud Armor to protect an HTTP(S) Load Balancer. They want to block traffic from a specific IP address range during off-peak hours but allow it during peak hours. How can they achieve this?

Accepted Answer

Use a Cloud Armor security policy rule with a condition on the IP address and a time condition. Cloud Armor security policies can use rules with conditions based on IP addresses and can also have time-based conditions (e.g., via headers or custom conditions). However, natively, Cloud Armor does not support scheduled rules. An alternative is to use a Cloud Function to modify the security policy based on time. But the simplest approach is to configure a rule with a condition that evaluates the request time using the `request.time` attribute if supported; else, use a Cloud Function to update rules. Given the options, the closest is using a rule that includes a time condition via `request.time` but that is not a standard feature. Actually, Cloud Armor rules can use expressions including `request.time` to match time windows. So the correct answer is a rule with a time condition.

Answer

Implement a Cloud Function that updates the security policy on a schedule

Answer

Create two separate security policies and switch between them using Cloud Load Balancer URL maps

Answer

Use VPC firewall rules to block the IP range during off-peak hours

Question 4

Which IAM role should be granted to a user who needs to view but not modify resources in a project?

Accepted Answer

roles/viewer. The Viewer role (roles/viewer) provides read-only access to all resources in a project.

Answer

roles/editor

Answer

roles/owner

Answer

roles/browser

Question 5

A security team needs to detect and redact personally identifiable information (PII) from documents uploaded to Cloud Storage before they are stored. Which GCP service should they use?

Accepted Answer

Cloud Data Loss Prevention (DLP) API. Cloud DLP (Data Loss Prevention) API can inspect and de-identify sensitive data in documents and can be integrated with Cloud Storage workflows.

Answer

Cloud Audit Logs

Answer

Security Command Center

Answer

Access Transparency

Question 6

A security admin wants to audit all 'create' and 'delete' operations on Compute Engine instances in a project for the last 90 days. Which type of audit log should they query?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs record all API calls that modify configuration or metadata of resources. They are retained for 400 days by default.

Answer

Data Access audit logs

Answer

System Event audit logs

Answer

Policy Denied audit logs

Question 7

A data engineer needs to automatically detect and redact sensitive data such as credit card numbers from text files uploaded to Cloud Storage before the data is loaded into BigQuery. Which GCP service should be used?

Accepted Answer

Cloud Data Loss Prevention (DLP) API. Cloud Data Loss Prevention (DLP) API can inspect text for sensitive patterns and de-identify (redact, mask, etc.) the content. It can be triggered via Cloud Functions or Cloud Workflows on file upload.

Answer

Cloud KMS

Answer

Cloud Audit Logs

Answer

Cloud Vision API

Question 8

A company wants to allow users to authenticate to a web application running on Compute Engine using their existing corporate Active Directory credentials without exposing the application to the public internet. Which approach should they use?

Accepted Answer

Set up Identity-Aware Proxy (IAP) and sync Active Directory to Cloud Identity. Identity-Aware Proxy (IAP) provides zero-trust access to applications by verifying identity and context. It integrates with Cloud Identity, which can be synced with Active Directory via Cloud Directory Sync.

Answer

Configure a Cloud VPN and allow only corporate IP addresses in firewall rules

Answer

Use Cloud Load Balancing with SSL and client certificates

Answer

Configure Cloud NAT and assign static IPs to users

Question 9

An organization uses Active Directory (AD) on-premises. They want to synchronize user accounts and groups to Google Cloud Identity so that users can sign in with their existing AD credentials. Which service should they use?

Accepted Answer

Google Cloud Directory Sync. Google Cloud Directory Sync (GCDS) is the tool that synchronizes users and groups from an existing LDAP directory, such as Active Directory, to Cloud Identity. It does not handle SAML SSO directly.

Answer

Cloud Identity Platform

Answer

Cloud Identity-Aware Proxy

Answer

Security Command Center

Question 10

A company wants to allow a Kubernetes pod in GKE to access a Cloud Storage bucket using a specific service account without storing long-lived credentials. Which method should be used?

Accepted Answer

Use Workload Identity to bind the Kubernetes service account to a Google Cloud service account. Workload Identity allows a Kubernetes service account to act as a Google Cloud service account by binding them. This eliminates the need for static keys and uses short-lived tokens.

Answer

Assign the service account directly to the GKE node pool

Answer

Create a JSON key for a service account and mount it as a secret in the pod

Answer

Use Application Default Credentials on the pod

Question 11

A company wants to migrate on-premises workloads to Google Cloud. They need to assess the existing infrastructure, plan the migration, and track progress. Which tool should they use?

Accepted Answer

Migrate for Compute Engine.. Migrate for Compute Engine (formerly Velostrata) is the correct tool because it is specifically designed to assess, plan, and migrate on-premises workloads to Google Cloud. It provides discovery of existing infrastructure, generates migration plans, and tracks progress through a dashboard, directly addressing the need for assessment, planning, and tracking.

Answer

Cloud Endpoints.

Answer

Cloud Deployment Manager.

Answer

Cloud Foundation Toolkit.

Question 12

A company uses Cloud NAT to allow private instances to access the internet. They notice intermittent connectivity issues. What should they check first?

Accepted Answer

Cloud NAT gateway has at least one NAT IP address configured.. Intermittent connectivity issues when using Cloud NAT are most commonly caused by a lack of NAT IP addresses. Cloud NAT uses source network address translation (SNAT) to map private instance traffic to a public IP address; if the gateway has no NAT IP addresses configured, or if the number of concurrent connections exceeds the available port capacity of the assigned NAT IPs, packets are dropped, leading to intermittent failures. Checking that at least one NAT IP address is assigned is the first and most critical troubleshooting step.

Answer

Cloud NAT router has a configured IP address range.

Answer

Cloud NAT gateway is in the same region as the instances.

Answer

The VPC subnet has private Google access enabled.

Answer

The instances have external IP addresses assigned.

Question 13

An e-commerce platform uses Cloud SQL for MySQL to store user profiles and order history. The security team wants to ensure that database administrators (DBAs) cannot view plaintext credit card numbers stored in the database. They also want to minimize application changes. What should they do?

Accepted Answer

Use Cloud DLP with de-identification and re-identification transforms on the Cloud SQL database.. Cloud DLP can be used to de-identify sensitive data like credit card numbers at rest in Cloud SQL, using deterministic or reversible transformations (e.g., format-preserving encryption or tokenization) that allow re-identification only by authorized applications. This approach minimizes application changes because DLP can scan and transform the data directly in the database, and the application can use re-identification transforms via the DLP API when needed, without modifying existing queries or schema.

Answer

Implement column-level encryption using Cloud KMS in the application layer.

Answer

Grant DBAs the Cloud SQL Viewer role to restrict access to data.

Answer

Use Cloud SQL Proxy to encrypt connections and limit DBA access.

Question 14

A company runs a service on Cloud Run that needs to access a Cloud SQL instance via private IP. Both are in the same VPC network. The service cannot connect to the database. What is the most likely cause?

Accepted Answer

Cloud Run needs a Serverless VPC Access connector.. Cloud Run services run in a Google-managed environment and cannot directly reach resources on a VPC network via private IP. A Serverless VPC Access connector is required to bridge the serverless environment to the VPC, enabling private IP connectivity to Cloud SQL. Without this connector, the Cloud Run service cannot route traffic to the Cloud SQL private IP, even if both are in the same VPC network.

Answer

Cloud Run must be deployed in the same zone as Cloud SQL.

Answer

The IAM permissions for Cloud Run to access Cloud SQL are missing.

Answer

A firewall rule is blocking traffic.

Answer

The Cloud SQL instance needs a public IP assigned.

Question 15

After executing the command, a security review reveals that the service account sa-bucket-reader can also list buckets in the project, which was not intended. What is the most likely cause?

Accepted Answer

The service account has a project-level role that includes storage.list.. The service account sa-bucket-reader was able to list buckets in the project, which requires the storage.buckets.list permission. This permission is included in several predefined project-level roles, such as roles/storage.objectViewer or roles/storage.legacyBucketReader. If the service account was granted a project-level role that includes storage.buckets.list, it would have the unintended ability to list all buckets in the project, even if bucket-level IAM was configured to restrict access to specific buckets.

Answer

The etag was incorrect, causing a concurrent modification.

Answer

The policy update failed due to a missing condition.

Answer

The service account also has bucket-level IAM roles.