PCSE Practice Test 10 — 10 Questions

Question 1

A company uses a hub-and-spoke VPC topology with Network Connectivity Center. The spoke VPCs need to reach the internet. Cloud NAT is configured in the hub VPC. Spoke VPCs have routes to the hub via a VPN tunnel. However, instances in spoke VPCs cannot reach the internet. Which configuration is most likely missing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The spoke VPCs are not receiving a default route (0.0.0.0/0) from the hub via Cloud Router.. In a hub-and-spoke topology with Network Connectivity Center, spoke VPCs rely on the hub for internet access via Cloud NAT. For this to work, the spoke VPCs must have a default route (0.0.0.0/0) pointing to the hub, typically advertised by Cloud Router over the VPN tunnel. Without this route, traffic from spoke instances to the internet will not be forwarded to the hub, and thus will not reach Cloud NAT.

Answer

A network virtual appliance (NVA) is required in the hub for spoke internet access.

Answer

Firewall rules for egress internet traffic are missing in spoke VPCs.

Answer

Cloud NAT is not configured in the spoke VPCs.

Question 2

A large enterprise has a security command center that uses SIEM to analyze logs. They are migrating to Google Cloud and want to export all Cloud Audit Logs (Admin Activity, Data Access, and System Events) from all projects into a centralized BigQuery dataset for analysis. They also need to ensure logs are available within 5 minutes of being generated. Which sink configuration should they use?

Accepted Answer

Create an aggregated sink at the organization level that includes all projects and uses a BigQuery dataset as destination, with inclusion filters for all audit log types.. An aggregated sink at the organization level can export logs from all projects within the organization to a single BigQuery dataset. Inclusion filters allow you to specify which log types (Admin Activity, Data Access, System Events) to export. Logs are typically available in BigQuery within seconds (near real-time), meeting the 5-minute requirement. Option B is incorrect because using Pub/Sub adds latency and complexity without benefit when the final destination is BigQuery. Option C is incorrect because creating per-project sinks is inefficient and harder to manage. Option D is incorrect because exporting to an external SIEM via syslog does not centralize logs in BigQuery as required.

Answer

Create a single aggregated sink at the organization level that uses a Pub/Sub topic as destination, and have a subscriber stream logs into BigQuery.

Answer

Create a sink in each project that exports Audit Logs to a shared BigQuery dataset.

Answer

Enable logging export using Cloud Logging's beta feature to stream logs to an external SIEM via syslog.

Question 3

A company wants to receive real-time notifications when Security Command Center (SCC) detects a high-severity vulnerability in their Google Cloud projects. They need to integrate with their existing SIEM. Which approach should they use?

Accepted Answer

Create a Pub/Sub notification config in SCC for the desired finding types and have the SIEM subscribe to the Pub/Sub topic.. Security Command Center supports Pub/Sub notification configs that publish findings (filtered by severity, category, or resource) to a Pub/Sub topic in near real-time. Having the existing SIEM subscribe to that topic is the officially recommended, low-latency integration pattern and avoids polling overhead. This is the standard SCC-to-SIEM integration path documented by Google Cloud.

Answer

Use the SCC API to poll for new findings every minute and push them to the SIEM via a custom script.

Answer

Enable Event Threat Detection in SCC Premium tier and configure it to stream findings to Cloud Logging via a log sink.

Answer

Configure SCC to send findings to Cloud Logging and set up a log-based metric that triggers a Cloud Function to send to the SIEM.

Question 4

Your organization uses Cloud Identity with SAML 2.0 federation from an external identity provider (IdP). You need to ensure that only users from a specific group in the IdP can access a critical application behind an HTTPS load balancer. Which combination of steps is required?

Accepted Answer

Enable IAP on the load balancer and grant the roles/iap.httpsResourceAccessor role to the Google group representing the IdP group. To restrict access to a specific group, you must first configure IAP on the backend service, then create an IAP access policy (or IAM binding) that grants the roles/iap.httpsResourceAccessor role to the Google group that corresponds to the IdP group. The IdP group must be synced to Google Cloud via directory sync or SCIM.

Answer

Create a firewall rule that allows traffic only from the IdP's SAML endpoint IP

Answer

Set up a VPN between the IdP and Google Cloud and restrict access to the load balancer via VPC firewall

Answer

Configure Cloud Armor to allow traffic only from the IdP's IP range

Question 5

Your organization uses Cloud CDN to distribute static content. Recently, users in a specific geographic region are experiencing high latency. What is the most likely cause?

Accepted Answer

There is no CDN edge node in that region. Cloud CDN relies on a global network of edge points of presence (PoPs) to cache and serve content close to users. If users in a specific geographic region experience high latency, the most likely cause is that there is no Cloud CDN edge node (PoP) in or near that region, forcing requests to travel to a distant PoP and increasing latency. Google Cloud's CDN has PoPs in many locations, but coverage is not universal, and some regions may be served from farther away.

Answer

The CDN cache has been purged for that region

Answer

The origin server is unhealthy

Answer

The DNS resolution is failing for that region

Question 6

An organization wants to grant a CI/CD pipeline (running on GitHub Actions) access to deploy resources in a GCP project without storing long-lived service account keys. Which approach is recommended?

Accepted Answer

Use Workload Identity Federation with GitHub as an identity provider.. Workload Identity Federation lets external workloads such as GitHub Actions exchange their OIDC token for short-lived GCP credentials, eliminating the need to store long-lived service account keys. GitHub is a supported identity provider, so the pipeline can impersonate a service account via a workload identity pool and provider. This is the recommended keyless authentication pattern for CI/CD on GCP.

Answer

Use a service account with the role roles/iam.serviceAccountTokenCreator.

Answer

Create a service account and store the JSON key as a GitHub secret.

Answer

Create a compute instance with a service account and run the pipeline from there.

Question 7

A GKE cluster runs workloads that need to access Cloud Storage. The security team wants to avoid using service account keys and ensure each pod has a unique identity. What is the best practice?

Accepted Answer

Use Workload Identity: create a Kubernetes service account and bind it to a Google service account.. Workload Identity is Google's recommended way to let GKE workloads authenticate to Google Cloud APIs without long-lived keys. It binds a Kubernetes service account (KSA) to a Google service account (GSA) via an IAM policy binding (roles/iam.workloadIdentityUser) and the cluster's workload identity pool, then injects a short-lived, auto-rotated token into the pod. This gives each pod a distinct, auditable identity and eliminates the key-management and rotation burden the security team wants to avoid.

Answer

Create a service account key and mount it as a secret in each pod.

Answer

Use the default compute engine service account for the cluster.

Answer

Attach a Google service account to the GKE node pool.

Question 8

A company is designing a network architecture for a multi-region application. They want to minimize latency and maximize availability. Which two features should they consider? (Choose two.)

Accepted Answer

Cloud CDN. Cloud CDN (B) is correct because it caches content at Google's globally distributed edge points of presence, serving users from the closest edge location and thereby reducing latency for the multi-region application. Global Cloud Load Balancer (D) is correct because a single global anycast IP routes users to the closest healthy backend across regions, providing both low-latency routing and automatic failover that maximizes availability. Cloud NAT (A) only provides outbound internet access for private instances and does not improve latency or availability for a multi-region application. Cloud Interconnect (C) offers dedicated private connectivity between on-premises networks and a VPC, which is not required for a multi-region design and does not by itself reduce end-user latency. VPC Network Peering (E) connects VPC networks for internal traffic but provides no global edge caching or anycast-based global load balancing.

Answer

Cloud NAT

Answer

Cloud Interconnect

Answer

VPC Network Peering

Question 9

Refer to the exhibit. A Security Engineer runs the command to grant Alice access to view objects in a Cloud Storage bucket. Later, Alice reports she can no longer access the bucket after January 1, 2024. What is the most likely reason?

Accepted Answer

The IAM condition expired on January 1, 2024, because the timestamp condition prevented access after that date.. The IAM condition attached to the binding includes a timestamp condition that expires on January 1, 2024. When the condition is no longer satisfied, the binding becomes ineffective, and Alice loses access to the bucket. This is a common use of IAM conditions to grant time-limited access.

Answer

Alice does not have the 'storage.objects.get' permission required to view objects.

Answer

The command removed Alice's existing access because it replaced all bindings.

Answer

The command failed to apply because the service account does not have permission to modify IAM policies.

Question 10

A company uses Cloud Identity-Aware Proxy (IAP) to secure access to an internal web application hosted on Compute Engine. After a recent security audit, the team wants to ensure that only users with specific attributes can access the app, such as belonging to the 'engineering' group and having a verified corporate email. What is the best approach to enforce this requirement?

Accepted Answer

Configure IAP with access levels that require the user to be in the 'engineering' group and have a verified email.. Cloud IAP integrates with Identity-Aware Proxy access levels, which allow you to enforce attribute-based access control (ABAC) using Google Cloud's context-aware access features. By configuring an access level that requires the user to belong to the 'engineering' group (via Cloud Identity or G Suite group membership) and have a verified corporate email (e.g., using the `email_verified` attribute from the identity provider), you can precisely restrict access to the Compute Engine web application without modifying the application code.

Answer

Use VPC Service Controls to restrict access based on user attributes.

Answer

Disable OAuth and use a custom JWT with group membership claims.

Answer

Set up an HTTP load balancer with a custom header that passes group membership from the identity provider.