Reinforce PCSE concepts with active-recall study cards covering all 5 blueprint domains. Each card shows the question on the front and the correct answer with a full explanation on the back.
Flashcards work through active recall — the process of retrieving information from memory rather than passively re-reading it. Research consistently shows that active recall produces stronger, longer-lasting memory than re-reading study guides. For PCSE preparation, this means flashcards are one of the highest-return study tools available.
Attempt recall first
Read the PCSE question on each card, pause, and attempt to formulate the answer in your own words before revealing. This retrieval attempt — even if wrong — dramatically strengthens memory compared to immediately reading the answer.
Review wrong cards again
When you get a card wrong, note it and add it back to your review pile. Spaced repetition — seeing difficult cards more frequently — is the mechanism that makes flashcard study far more efficient than linear reading.
Study by domain
Group your PCSE flashcard sessions by domain for the first 3–4 weeks. Master one domain before moving to the next. In the final week, shuffle all cards together to test cross-domain recall — which is what the real PCSE exam requires.
Short sessions beat marathon reviews
20–30 flashcard cards per session, done daily, produces better retention than a single 200-card marathon session. Five short daily sessions per week over 4 weeks gives you over 400 total card reviews — enough to reliably pass PCSE.
Sample cards from the PCSE flashcard bank. Read the question, think of the answer, then read the explanation below.
A security engineer needs to prevent users from creating service account keys in a Google Cloud project. The solution must be enforceable across all projects in the organization and should not block other IAM operations. Which approach should they use?
Use the Organization Policy Service with the constraint constraints/iam.disableServiceAccountKeyCreation.
Organization Policy constraints provide a way to enforce restrictions across the resource hierarchy. The built-in constraint 'constraints/iam.disableServiceAccountKeyCreation' specifically prevents creation of service account keys at the project, folder, or organization level. It does not affect other IAM operations. IAM deny policies can deny specific permissions but are more complex to manage and apply at the org level for this specific use case. Custom roles are not designed for enforcement across projects. The Organization Policy Service is the correct choice for such organization-wide restrictions.
An organization uses Active Directory (AD) on-premises and wants to synchronize user accounts and groups to Google Cloud Identity for SSO with SAML 2.0. The AD contains 50,000 users and 10,000 groups. The solution must support automatic provisioning and deprovisioning of users. Which tool should they use?
Use Google Cloud Directory Sync (GCDS) to synchronize users and groups from AD to Cloud Identity.
Google Cloud Directory Sync (GCDS) is the official tool for synchronizing users and groups from Active Directory (or LDAP) to Google Cloud Directory. It supports one-way sync, automatic provisioning, and deprovisioning. SAML SSO is configured separately using an IdP like Active Directory Federation Services (AD FS) or third-party. Workload Identity Federation is for external workloads (e.g., AWS, Azure) to access GCP resources, not for user identity synchronization. Cloud Identity API can be used programmatically but is not a ready-to-use sync tool. GCDS is the correct answer.
A developer wants to grant a Compute Engine instance access to read objects from a Cloud Storage bucket. The instance runs under a service account. What is the best practice for granting this access?
Assign the Storage Object Viewer role to the service account attached to the instance.
The best practice is to assign the appropriate IAM role (e.g., Storage Object Viewer) to the service account that the instance is running as. Then, the instance can use the service account's credentials automatically via the metadata server. This avoids the need to manage service account keys. Generating keys is discouraged. Allowing the instance to use the default compute engine service account is common but less secure; a custom service account with minimal permissions is preferred.
A company has multiple Google Cloud projects organized under folders by department. The security team wants to enforce a policy that all Compute Engine instances must use Shielded VM features. They need to prevent non-compliant instances from being created. Which action should be taken to enforce this requirement most effectively?
Use the Organization Policy Service with the constraint constraints/compute.requireShieldedVm.
Organization Policy constraints are the correct mechanism to enforce requirements across the resource hierarchy. The built-in constraint 'constraints/compute.requireShieldedVm' ensures that any new Compute Engine instance must have Shielded VM features enabled. This policy can be applied at the organization, folder, or project level. IAM roles or custom roles cannot enforce instance configuration requirements. Service account impersonation is unrelated. Deny policies can deny specific permissions but not enforce Shielded VM settings.
A security engineer needs to ensure that all customer data stored in Cloud Storage is encrypted at rest using keys that the organization manages and rotates themselves. Which encryption option should they use?
Customer-managed encryption keys (CMEK) using Cloud KMS
Customer-managed encryption keys (CMEK) using Cloud KMS is the correct choice because it allows the organization to create, manage, and rotate their own encryption keys for Cloud Storage data at rest, while still leveraging Google's infrastructure for encryption. CMEK uses Cloud KMS to wrap the data encryption keys (DEKs) with a customer-managed key encryption key (KEK), ensuring the organization retains control over key lifecycle operations such as rotation, disabling, and destruction, meeting the requirement for self-managed key rotation.
A company uses Cloud KMS with a key purpose of ENCRYPT_DECRYPT. They need to rotate the key automatically every 30 days. What must they configure?
Set a rotation period of 30 days on the key.
Cloud KMS allows you to set a rotation period directly on a key (a CryptoKey resource) when its purpose is ENCRYPT_DECRYPT. Configuring a rotation period of 30 days on the key enables automatic, scheduled rotation, where Cloud KMS creates a new key version every 30 days and promotes it to primary, without any manual intervention.
Which Google Cloud service provides near-real-time logs when Google administrators access your customer content?
Access Transparency
Access Transparency logs provide detailed information about actions taken by Google staff when accessing customer data. Access Approval is a separate feature that requires approval before access. Audit Logs is a broader category. Cloud DLP is for data loss prevention.
A company stores API keys in Secret Manager. They want to automatically rotate the secret every 60 days and have a Cloud Function triggered after each rotation to update dependent services. What is the correct approach?
Set a rotation period on the secret and configure a Pub/Sub topic for notifications. Create a Cloud Function subscribed to that topic.
Secret Manager can set a rotation period and publish a Pub/Sub message upon rotation. A Cloud Function can subscribe to that topic and execute updates. Directly triggering from Secret Manager is not possible. Cloud Scheduler is not needed.
A security engineer needs to ensure that all Google Cloud API calls in the organization are logged and retained for 7 years for compliance. Admin Activity logs are enabled by default but retention is limited. Which combination of actions should the engineer take?
Create a log sink with _Required log view filter to export Admin Activity logs to Cloud Storage with a retention policy of 7 years.
Admin Activity logs are enabled by default but cannot be retained beyond the default period (400 days for audit logs). To retain for 7 years, you must use a log sink to export them to Cloud Storage (which can be configured with retention policies). BigQuery is for analysis, not archival. The default retention cannot be changed.
A company wants to receive real-time notifications when Security Command Center (SCC) detects a high-severity vulnerability in their Google Cloud projects. They need to integrate with their existing SIEM. Which approach should they use?
Create a Pub/Sub notification config in SCC for the desired finding types and have the SIEM subscribe to the Pub/Sub topic.
SCC findings can be exported to Pub/Sub for real-time integration. The SIEM can subscribe to the Pub/Sub topic. Cloud Logging can also be used but SCC does not directly write findings to Logging. Cloud Functions alone would require Pub/Sub as trigger.
A DevOps team is implementing Binary Authorization for a GKE cluster. They want to ensure that only container images signed by a specific attestor can be deployed. They have created the attestor and configured Cloud KMS for signing. Which additional step is required to enforce the policy?
Create a Binary Authorization policy that requires at least one attestation and attach it to the GKE cluster.
Binary Authorization requires a policy to enforce attestation. The policy must be set to 'Require Attestations' and attached to the GKE cluster (via a policy binding). Creating the attestor alone is insufficient. The policy can be set at project level.
A security engineer needs to restrict access to Cloud Storage buckets so that only resources in a specific VPC can reach the Google APIs. Which Google Cloud service should be used?
VPC Service Controls
VPC Service Controls allows you to define a service perimeter that restricts access to Google Cloud APIs (like Cloud Storage) to only resources from authorized VPCs, preventing data exfiltration.
An organization wants to enforce a security policy that denies all egress traffic to the internet from all projects in the organization, except for traffic from a specific set of VMs tagged with 'allow-egress'. Which approach should be used?
Use a hierarchical firewall policy at the organization level with a deny-all egress rule and a higher priority allow rule for the tag.
Hierarchical firewall policies are inherited down the resource hierarchy and can be enforced at the organization or folder level. They cannot be overridden at lower levels, making them suitable for organization-wide baseline rules.
A company uses VPC Service Controls to protect a BigQuery dataset. They need to allow an external on-premises application to query the dataset without being inside the service perimeter. The external application has a static IP address. Which configuration is required?
Add the external IP to an access level and configure an ingress rule in the service perimeter.
VPC Service Controls access levels can define IP-based conditions. By creating an ingress rule that allows traffic from the specified IP address to access the BigQuery API, the external application can be authorized.
A healthcare organization is required to protect Protected Health Information (PHI) stored in Cloud Storage. They want to automatically detect and redact PHI before storing it. Which Google Cloud service should they use?
Cloud Data Loss Prevention (DLP)
Cloud DLP can inspect Cloud Storage buckets for sensitive data like PHI and redact or de-identify it automatically using its inspect and transform pipeline.
The PCSE flashcard bank covers all 5 official blueprint domains published by Google Cloud. Cards are distributed proportionally, so domains with higher exam weight have more cards.
Domain Coverage
Configuring Access Within a Cloud Solution Environment
Ensuring Data Protection
Managing Operations in a Cloud Solution Environment
Configuring Network Security
Supporting Compliance Requirements
Both flashcards and practice questions are evidence-based study tools. The difference is in what they train:
Flashcards — concept retention
Best for memorising definitions, acronyms, protocol behaviours, command syntax, and conceptual distinctions. Use flashcards to build the foundational vocabulary that PCSE questions assume you know.
Best in: weeks 1–3
Practice tests — application
Best for applying concepts to realistic scenarios, eliminating distractors, and building exam stamina.PCSE questions test scenario reasoning — not just recall — so practice tests are essential.
Best in: weeks 3–6
The most effective PCSE study plan combines both: use flashcards for the first 2–3 weeks to build conceptual foundations, then shift to practice tests and mock exams in the final 2–3 weeks to apply and benchmark that knowledge. Most candidates who pass on their first attempt use both tools.
Yes. Courseiva provides free PCSE flashcards across all official exam domains. Every card includes the correct answer and a full explanation of why it is right and why the distractors are wrong. The platform also includes topic-based practice, mock exams, and readiness tracking — no account required.
Courseiva has 960+ original PCSE flashcards across all 5 exam blueprint domains. New cards are added regularly as the question bank grows. All cards are written by certified engineers against the official Google Cloud exam objectives.
Courseiva flashcards are purpose-built for IT certification exams. Unlike generic flashcard platforms where content quality varies, every Courseiva card is mapped to the official PCSE exam blueprint, written by engineers who hold the certification, and includes a full explanation of the correct answer and why the distractors are wrong. This explanation quality is what separates genuine learning from rote memorisation.
Courseiva is a web platform — an internet connection is required. For offline study, we recommend creating free Courseiva account, using the platform in your browser, and using your device's offline capabilities if your browser supports offline web apps.
Save your results, see which domains need more work, and get spaced repetition recommendations — all free.
Sign Up FreeFree forever · Every certification included