Google PCA Design for security and compliance Practice Test 2 — 15 Questions

Question 1

A company is migrating its on-premises workloads to Google Cloud. They have strict compliance requirements that all data at rest must be encrypted with customer-managed encryption keys (CMEK). Which Google Cloud service should they use to manage the lifecycle of these keys?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Key Management Service (Cloud KMS). Cloud KMS is the correct service because it provides centralized management of customer-managed encryption keys (CMEK) for Google Cloud services. It allows you to create, rotate, destroy, and set permissions on symmetric and asymmetric keys, and integrates directly with services like Cloud Storage, BigQuery, and Compute Engine to enforce encryption at rest with keys you control.

Answer

Secret Manager

Answer

Cloud External Key Manager (Cloud EKM)

Answer

Cloud Hardware Security Module (Cloud HSM)

Question 2

Which TWO of the following are valid methods to control access to Google Cloud resources using Identity and Access Management (IAM)?

Accepted Answer

Attach an IAM policy to an organization. Attaching an IAM policy to an organization (option A) is a valid method because it allows you to set organization-wide policies that apply to all projects and resources within that organization. This is a fundamental feature of Google Cloud's hierarchical resource management, where policies can be inherited from the organization node down to folders and projects, enabling centralized control over access.

Answer

Attach an IAM policy to a user

Answer

Assign an IAM role directly to a user

Answer

Attach an IAM policy to a service account

Question 3

An organization has set the IAM policy constraint 'constraints/iam.allowedPolicyMemberDomains' with the values shown. Which of the following users can be granted an IAM role on a project in this organization? (Choose all that apply.)

Accepted Answer

service-account@project-id.iam.gserviceaccount.com. The constraint 'constraints/iam.allowedPolicyMemberDomains' restricts IAM role grants to members from specified domains. The correct answer includes both A and D. Option A: service-account@project-id.iam.gserviceaccount.com is allowed because service accounts ending in 'gserviceaccount.com' are Google-managed and implicitly exempt from the constraint. Option D: user@example.com is allowed because 'example.com' is one of the domains specified in the constraint (as implied by the correct marking). The constraint explicitly lists allowed domains, and 'example.com' is included. Options B and C are from domains not in the allowed list, so they cannot be granted roles.

Answer

external@otherdomain.com

Answer

admin@another-customer-domain.com

Question 4

Your company has a production environment on Google Cloud that includes Compute Engine instances, Cloud Storage buckets, and BigQuery datasets. Security policies require that all data at rest is encrypted with CMEK, and audit logs must be retained for 7 years. The current configuration uses Google-managed encryption keys. You have been asked to transition to CMEK for all resources. After enabling CMEK for new resources, you discover that the existing resources are not re-encrypted. To comply with the policy, you need to re-encrypt the existing data. What should you do?

Accepted Answer

For Compute Engine: create new disks with CMEK, attach them, and copy data. For Cloud Storage: rewrite objects with CMEK. For BigQuery: copy datasets to new datasets with CMEK.. CMEK is applied at the resource creation level for Compute Engine disks, Cloud Storage buckets, and BigQuery datasets. Existing resources encrypted with Google-managed keys cannot be re-encrypted in place; you must create new resources with CMEK enabled and migrate the data. For Compute Engine, this means creating new disks with CMEK, attaching them, and copying data. For Cloud Storage, you rewrite objects to a new bucket or use the rewrite API with CMEK. For BigQuery, you copy datasets to new datasets that have CMEK configured.

Answer

Enable CMEK on the existing resources by modifying the resource's encryption settings. This will automatically re-encrypt the data.

Answer

Delete the existing resources and recreate them with CMEK enabled. Then restore data from backups.

Answer

Enable Data Loss Prevention (DLP) API to scan and re-encrypt data automatically.

Question 5

A company is deploying a multi-tier web application on Google Cloud. The application must comply with PCI DSS. Which combination of Google Cloud services should be used to restrict access to the database tier to only the application tier, while also encrypting data at rest and in transit?

Accepted Answer

Use Cloud SQL with private IP and SSL/TLS, and enable Cloud Key Management Service (KMS) to create a key ring and customer-managed encryption key (CMEK). It meets all PCI DSS requirements: Cloud SQL with private IP ensures the database tier is not exposed to the public internet, restricting access to only the application tier within the same VPC. SSL/TLS encrypts data in transit, and using Cloud KMS with a customer-managed encryption key (CMEK) provides control over encryption keys for data at rest, which is often required for compliance.

Answer

Use Cloud Spanner with private IP and SSL/TLS, and enable Google-managed encryption keys

Answer

Use Cloud SQL with public IP and SSL/TLS, and enable Google-managed encryption keys

Answer

Use Cloud Datastore with secure WebSocket connections and enable customer-managed encryption keys

Question 6

An organization is implementing a data loss prevention (DLP) strategy for sensitive data stored in Cloud Storage. They want to automatically detect and redact credit card numbers in CSV files uploaded to a specific bucket. Which TWO Google Cloud services should they combine to achieve this?

Accepted Answer

Cloud DLP. Cloud DLP (option C) is correct because it provides native content inspection and de-identification (redaction) of sensitive data like credit card numbers using built-in infoType detectors. Cloud Functions (option D) is correct because it can be triggered by Cloud Storage events (e.g., finalize/create) to invoke the DLP API on newly uploaded CSV files, enabling serverless, event-driven processing without managing infrastructure.

Answer

Cloud Dataflow

Answer

Cloud Run

Answer

BigQuery

Question 7

An engineer runs the above command and sees two firewall rules that allow SSH access. A security review requires that SSH access be allowed only from the bastion subnet 10.0.1.0/24. What should the engineer do to meet the requirement?

Accepted Answer

Delete the allow-ssh-ingress rule. The allow-ssh-ingress rule has a higher priority (lower number) than the allow-ssh-from-bastion rule, allowing SSH from any source IP. Deleting this rule ensures that only the lower-priority rule (allow-ssh-from-bastion) remains, which restricts SSH access to the bastion subnet 10.0.1.0/24. In Google Cloud VPC firewall rules, lower priority numbers indicate higher precedence, so the allow-ssh-ingress rule (priority 1000) overrides the allow-ssh-from-bastion rule (priority 2000) for any traffic matching both.

Answer

Add a firewall rule with priority 500 that denies SSH from all IPs

Answer

Change the priority of allow-ssh-ingress to 2000

Answer

Remove the target tag 'ssh-allowed' from allow-ssh-from-bastion

Question 8

Drag and drop the steps to configure a Cloud Load Balancer with a backend service consisting of Compute Engine instances into the correct order.

Accepted Answer

First, create a health check. Then, create an instance group. Next, create a backend service that uses the health check and add the instance group as a backend. After that, create a URL map to route requests to the backend service. Then, create a target HTTP(S) proxy using the URL map. Finally, create a forwarding rule to assign an IP address and port to the proxy.. Health checks ensure traffic only goes to healthy instances; URL map defines routing; forwarding rule exposes the IP.

Answer

First, create a URL map. Then, create a target proxy. Next, create a forwarding rule. After that, create a health check. Then, create an instance group. Finally, create a backend service (with health check) and add the instance group.

Answer

First, create an instance group. Then, create a backend service (without a health check). Next, create a URL map. Then, create a target proxy. After that, create a forwarding rule. Finally, create a health check (too late to attach to the backend service).

Answer

First, create a forwarding rule. Then, create a target proxy. Next, create a URL map. After that, create a backend service. Then, create an instance group. Finally, create a health check.

Question 9

Drag and drop the steps to set up a shared VPC in Google Cloud for a multi-project environment into the correct order.

Accepted Answer

Enable Shared VPC in the host project, then attach service projects, then grant IAM roles to service project users, then deploy resources in service projects.. The host project holds the VPC network. Service projects use the subnets. IAM roles control who can use the subnets.

Answer

Attach service projects to the host project, then enable Shared VPC in the host project, then grant IAM roles, then deploy resources.

Answer

Enable Shared VPC in the host project, then grant IAM roles to service project users, then attach service projects, then deploy resources.

Answer

Enable Shared VPC in the host project, then attach service projects, then deploy resources in service projects, then grant IAM roles.

Question 10

Match each GCP compute service to its characteristic.

Accepted Answer

Compute Engine: Virtual machines on demand, IaaS.. Compute Engine provides IaaS virtual machines; GKE offers managed Kubernetes; Cloud Run enables serverless containers; App Engine is a PaaS for web apps. Common confusions include mixing serverless and Kubernetes features.

Answer

Compute Engine: Managed Kubernetes clusters.

Answer

Google Kubernetes Engine: Serverless container execution.

Answer

Cloud Run: PaaS for web apps with auto-scaling.

Question 11

Match each GCP data processing service to its use case.

Accepted Answer

Dataflow: Unified stream and batch data processing using Apache Beam. Dataflow is for unified stream/batch processing, Dataproc manages Spark/Hadoop, BigQuery is a serverless data warehouse, Pub/Sub is for messaging. Common confusions include mixing Dataflow with Dataproc and BigQuery with Pub/Sub.

Answer

Dataflow: Managed Spark and Hadoop clusters

Answer

BigQuery: Asynchronous messaging service

Question 12

A company is deploying a web application on Compute Engine. They want to ensure that only authenticated users can access the application. Which Google Cloud service should they use?

Accepted Answer

Identity-Aware Proxy. Identity-Aware Proxy (IAP) is the correct choice because it enforces access control at the edge of Google's network, verifying user identity and context before allowing traffic to reach the Compute Engine instance. IAP uses OAuth 2.0 and signed headers to authenticate users, ensuring only authorized requests are forwarded to the backend, without requiring any changes to the application itself.

Answer

Cloud Load Balancing

Answer

Cloud CDN

Answer

Cloud DNS

Question 13

A company stores sensitive customer data in Cloud Storage buckets. They want to ensure that access to these buckets is only allowed from within their VPC network. Which configuration should they use?

Accepted Answer

VPC Service Controls with a service perimeter. D is correct because VPC Service Controls (VPC-SC) allow you to define a service perimeter that restricts access to Google Cloud Storage (and other managed services) to only requests originating from a specified VPC network. This ensures that data exfiltration and unauthorized access from outside the VPC are blocked, even if the bucket is publicly accessible or IAM allows broader access.

Answer

Bucket IAM policies with condition on service account

Answer

Cloud Armor WAF rules

Answer

Private Google Access for on-premises

Question 14

A multinational corporation must comply with GDPR and requires that all customer data stored in BigQuery be encrypted using customer-managed encryption keys (CMEK) and that the keys are stored in a specific region. Which combination of steps should they take?

Accepted Answer

Create a Cloud KMS key ring and crypto key in the desired region, then associate the BigQuery dataset with the CMEK key using DDL. It directly fulfills the requirement: creating a Cloud KMS key ring and crypto key in the desired region, then associating the BigQuery dataset with that CMEK key using DDL (e.g., `ALTER SCHEMA mydataset SET OPTIONS(kms_key_name='...')`). This ensures that all data at rest in BigQuery is encrypted with a customer-managed key stored in a specific regional location, as mandated by GDPR for data residency and control.

Answer

Enable default encryption at rest in BigQuery and use Organization Policies to restrict key location

Answer

Create a Cloud HSM key, then use Cloud DLP to automatically encrypt the data before loading into BigQuery

Answer

Use Cloud External Key Manager (EKM) to integrate with an on-premises key management system

Question 15

A startup wants to grant a new employee read-only access to view all Compute Engine instances in a project. What is the minimum IAM role they should assign?

Accepted Answer

roles/compute.viewer. The roles/compute.viewer role grants read-only access to Compute Engine resources, including the ability to list and view instances, without allowing modifications. This is the minimum IAM role that satisfies the requirement for read-only access to all Compute Engine instances in a project, as it provides the necessary permissions (e.g., compute.instances.list, compute.instances.get) without granting broader project-level or write permissions.

Answer

roles/owner

Answer

roles/iam.securityReviewer

Answer

roles/compute.admin