PCSE Practice Test 10 — 10 Questions

Question 1

An organization uses Cloud Identity-Aware Proxy (IAP) to secure access to an internal web application running on Compute Engine. Users are authenticated with Google accounts. Recently, some users report being denied access even though they are in the correct IAP-secured Web App User group. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An Access Context Manager access level is configured that the users do not satisfy, such as requiring a corporate device.. Cloud IAP can be combined with Access Context Manager (ACM) access levels to enforce contextual requirements beyond group membership, such as device policy, IP range, or user identity attributes. If an access level is configured to require a corporate device and the user's device does not meet that policy, IAP will deny access even if the user is in the correct IAP-secured Web App User group. This explains why users who are correctly placed in the group still receive access denials.

Answer

The users are trying to use IAP TCP forwarding instead of HTTPS.

Answer

The users are not members of the IAP-secured Web App User group.

Answer

The OAuth consent screen requires approval from an admin.

Question 2

A security engineer needs to prevent creation of long-lived service account keys across all projects in an organization. The solution should also block any existing keys older than 90 days. Which approach meets these requirements?

Accepted Answer

Use a deny policy to deny the permission iam.serviceAccountKeys.create and another deny policy to deny use of keys older than 90 days.. Deny policies can be used to prevent creation of new service account keys (by denying iam.serviceAccountKeys.create) and to block use of existing keys older than 90 days (by denying permissions like iam.serviceAccountKeys.signBlob with a condition on key age). This directly addresses both requirements: prevention of new long-lived keys and disabling existing keys older than 90 days. Option A only prevents creation of new keys via the built-in constraint but does not affect existing keys; while a custom policy can enforce key rotation on new keys, it cannot block or disable keys that already exist. Option C fails because custom constraints cannot delete existing resources. Option D does not block key creation via all methods and does not address existing keys.

Answer

Use the built-in constraint constraints/iam.disableServiceAccountKeyCreation and write a custom organization policy to enforce key rotation (max age 90 days).

Answer

Use a custom organization policy constraint to disable key creation and another custom constraint to delete keys older than 90 days.

Answer

Use a VPC Service Controls perimeter to block access to the IAM API for creating keys.

Question 3

Which Cloud DLP transform should be used to replace sensitive data with a token that preserves the format and length of the original data for reversible de-identification?

Accepted Answer

CryptoReplaceFfxFpeConfig. CryptoReplaceFfxFpeConfig uses Format-Preserving Encryption (FPE) to replace data with a token that retains the original format and length, and the process is reversible with the encryption key.

Answer

DateShiftConfig

Answer

MaskingConfig

Answer

BucketingConfig

Question 4

A compliance officer reviews the Cloud Audit Log entry above and wants to know if any sensitive data was exposed during the instance creation. What is the best course of action?

Accepted Answer

Enable data access audit logs for Compute Engine to capture request payloads.. Enabling data access audit logs for Compute Engine captures the request payloads of API calls, including the instance creation request. This allows the compliance officer to inspect the exact parameters sent, such as any sensitive data that might have been passed as metadata or startup scripts, which are not included in the default admin activity audit logs. Data access audit logs provide the granularity needed to determine if sensitive data was exposed during the operation.

Answer

Check the status field to see if the operation failed, which might indicate a misconfiguration.

Answer

Analyze the log entry to see the image used; the image metadata is included.

Answer

Use Cloud DLP to scan the log entry for sensitive data.

Question 5

A company must ensure that all Compute Engine instances use only approved images from a specific project. They want to enforce this using Organization Policy. Which constraint should they use?

Accepted Answer

constraints/compute.restrictImageUsage. The correct constraint is `constraints/compute.restrictImageUsage` because it directly controls which images can be used to create Compute Engine instances by specifying a list of allowed projects. This enforces the requirement that only approved images from a specific project are used, blocking instances launched with images from other projects.

Answer

constraints/compute.restrictAuthorizedDomains

Answer

constraints/compute.trustedImageProjects

Answer

constraints/compute.restrictFirewallRules

Question 6

A global e-commerce company is using Google Cloud to store customer data subject to GDPR. They have implemented data residency controls to keep data within the EU. However, during a routine audit, the compliance team discovers that some backups of customer data are being replicated to a US region due to a misconfigured backup policy. The data includes personal information. The company must ensure that all data remains within the EU. What should the team do to prevent this from recurring and remediate the current situation?

Accepted Answer

Use Organization Policies to enforce a constraint that disables the creation of resources outside the EU, and then delete the US backups.. Organization Policies allow the company to enforce a resource location constraint (e.g., `constraints/gcp.resourceLocations`), which prevents the creation of any Google Cloud resources outside the EU. This proactively stops misconfigured backups from being replicated to non-EU regions. Deleting the US backups after applying the policy remediates the current GDPR violation by removing the non-compliant data.

Answer

Delete the backups in the US region immediately and reconfigure the backup policy to only use EU regions.

Answer

Enable Access Transparency for the US backups to monitor access.

Answer

Encrypt the US backups with CMEK and leave them in place, as encryption satisfies GDPR.

Question 7

A multinational corporation is required to protect sensitive data in BigQuery using column-level encryption. They want to use a customer-managed key stored in Cloud KMS. What is the correct approach?

Accepted Answer

Use Cloud KMS to create an AEAD key and use BigQuery SQL functions to encrypt/decrypt.. BigQuery supports column-level encryption and decryption using AEAD (Authenticated Encryption with Associated Data) keys created in Cloud KMS. The `AEAD.ENCRYPT` and `AEAD.DECRYPT` SQL functions allow you to encrypt specific columns at rest, using a customer-managed key that you control in Cloud KMS, ensuring that only authorized users with access to the key can decrypt the data.

Answer

Use Cloud DLP to de-identify columns in transit.

Answer

Use Cloud HSM to store the key and apply bucket-level encryption.

Answer

Use Customer-Supplied Encryption Keys (CSEK) with BigQuery.

Question 8

Which TWO options are required to use Cloud DLP to successfully inspect data in a Cloud Storage bucket?

Accepted Answer

A service account with roles/storage.objectViewer to read the bucket.. Cloud DLP requires read access to the Cloud Storage bucket to inspect objects. The service account used by the DLP job must have the roles/storage.objectViewer IAM role, which grants permission to list and read objects without needing to download them. This ensures the DLP API can access the data for content inspection.

Answer

A Cloud Function to send each file to the DLP API.

Answer

The bucket must be in the same project as the DLP job.

Answer

A Pub/Sub topic to receive inspection results.

Question 9

During an incident, a security engineer finds this audit log entry. What action was taken and by whom?

Accepted Answer

A user deleted an instance named 'instance-1'.. MethodName is 'v1.compute.instances.delete', indicating a delete operation, and the principal is admin@example.com. Option A is incorrect because the method is delete, not create. Option B is incorrect because the method is delete, not modify. Option C is incorrect because the method is delete, not update.

Answer

A user modified instance 'instance-1'.

Answer

A user created an instance named 'instance-1'.

Answer

A user stopped instance 'instance-1'.

Question 10

An organization uses Shared VPC with a host project and several service projects. A network administrator in a service project wants to create a firewall rule that allows traffic from a specific source CIDR to a Compute Engine instance in the service project. What is the correct way to achieve this?

Accepted Answer

Request the host project administrator to create the firewall rule in the host project.. In a Shared VPC architecture, firewall rules are a host-project-level resource. Service project administrators cannot create or manage firewall rules that apply to resources in the shared VPC network; only the host project administrator has the necessary permissions. Therefore, to allow traffic from a specific source CIDR to a Compute Engine instance in a service project, the host project administrator must create the firewall rule in the host project, targeting the instance's tags or service account.

Answer

Create the firewall rule in the service project targeting the instance's tags.

Answer

Create a firewall rule in the service project using the instance's service account.

Answer

Use VPC Flow Logs to generate a recommendation and apply it in the service project.