PCSE Practice Test 10 — 10 Questions

Question 1

Your organization has a VPC with several subnets and wants to enable Private Google Access for Compute Engine instances in a specific subnet to access Google APIs and services without external IP addresses. What must be configured?

Accepted Answer

Enable Private Google Access on the subnet and ensure that instances have a default route (0.0.0.0/0) with next hop to the default internet gateway.. Option C is correct because Private Google Access requires two components: enabling it on the subnet and having a default route (0.0.0.0/0) pointing to the internet gateway. This route allows instances without external IPs to use the VPC's default internet gateway to reach Google APIs via the 199.36.153.4/30 address range, which is advertised by Google's private IP space. Without the default route, traffic from the subnet cannot reach the internet gateway, even with Private Google Access enabled.

Answer

Assign external IPs to the instances and create a firewall rule allowing egress to Google APIs.

Answer

Create a Cloud NAT gateway and enable Private Google Access on the subnet.

Answer

Enable Private Google Access on the subnet only.

Question 2

A company is implementing VPC Service Controls to protect sensitive data in Google Cloud Storage. They want to allow a private on-premises subnet (10.1.0.0/16) to access the storage buckets via a Cloud VPN tunnel, but deny all other on-premises traffic. Which configuration approach meets this requirement with least privilege?

Accepted Answer

Create a bridged access level that includes the private IP range 10.1.0.0/16 and a VPC network condition.. Option B is correct because VPC Service Controls use access levels to define which client identities or network sources can access protected services. By creating a bridged access level that includes both the private IP range 10.1.0.0/16 and a VPC network condition (the VPC connected via Cloud VPN), you ensure that only traffic originating from that specific on-premises subnet and arriving through the authorized VPC is allowed, denying all other on-premises traffic by default. This follows the least-privilege principle by not allowing broader IP ranges or relying on implicit denies.

Answer

Create a service perimeter that allows all traffic from on-premises, then an explicit deny rule for other IP ranges.

Answer

Configure Cloud NAT in the on-premises network and allow the NAT IP in an access level.

Answer

Create an access level with the IP range 10.1.0.0/16 and apply it to a service perimeter.

Question 3

An organization is configuring a Cloud Storage bucket for a regulated workload. The bucket configuration shown in the exhibit was applied. Which compliance requirement is this configuration primarily designed to address?

Accepted Answer

Data retention and immutability.. The bucket configuration includes object versioning enabled and a retention policy with a retention period. This combination ensures that objects cannot be deleted or overwritten before the retention period expires, addressing data retention and immutability requirements. This is a common compliance need for regulated workloads where data must be preserved in its original state for a defined duration.

Answer

Encryption at rest using customer-managed encryption keys (CMEK).

Answer

Access transparency for data access.

Answer

Data residency within a specific geographic region.

Question 4

A company uses Shared VPC with a host project and multiple service projects. The security team wants to enforce that only specific VMs in service project A (using IP range 10.0.1.0/24) can communicate with specific VMs in service project B (tagged as 'app-b') on TCP port 443, and all other inter-service-project traffic should be blocked. Additionally, VMs should still be accessible via IAP TCP forwarding (SSH) on TCP port 22. Which three firewall rules should be created in the host project? (Choose three.)

Accepted Answer

Priority 1000: Allow ingress from 10.0.1.0/24 to VMs with tag 'app-b' on TCP 443.. Option A is correct because it creates an ingress firewall rule in the host project that allows traffic from the specific IP range 10.0.1.0/24 (VMs in service project A) to VMs tagged 'app-b' in service project B on TCP port 443. In Shared VPC, all firewall rules are defined in the host project and apply to all service projects, so this rule enforces the required communication while the deny rule (Option B) blocks all other inter-service-project traffic. The IAP rule (Option E) is needed to allow SSH access via IAP TCP forwarding, which uses the source range 35.235.240.0/20 on TCP port 22.

Answer

Priority 1000: Allow ingress from IAP forwarding ranges to all VMs on all protocols.

Answer

Priority 1000: Allow egress from VMs in service project A to service project B's VMs on TCP 443.

Question 5

Which Google Cloud audit log captures administrator activity and is enabled by default?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs (option D) are enabled by default in Google Cloud and capture all administrator actions that modify the configuration or metadata of resources, such as creating a VM or changing IAM policies. These logs are essential for compliance and security auditing because they record 'who did what, where, and when' for management activities, and they cannot be disabled.

Answer

Policy Denied audit logs

Answer

System Event audit logs

Answer

Data Access audit logs

Question 6

Refer to the exhibit. An operations engineer configured this alert policy to notify when any VM instance in project my-project has high CPU utilization. However, no notifications are received even when CPU is consistently above 90% on multiple instances in us-central1-a. What is the most likely cause?

Accepted Answer

The alert policy is configured in a different project than the VM instances.. Option B is correct because alert policies are project-scoped resources. If the VM instances reside in a different project than the one where the alert policy is defined, the policy cannot monitor those instances. The MQL query references the metric `compute.googleapis.com/instance/cpu/utilization` which is only visible within the same project as the monitored resources. Cross-project monitoring requires additional configuration such as a metrics scope or a separate alert policy in the target project.

Answer

The 'duration' of 0s in the MQL condition prevents the alert from firing because it needs a minimum duration.

Answer

The MQL query uses 'group_by' which causes the condition to be evaluated on the aggregate, but the threshold should be applied before grouping.

Answer

The notification channel is not configured or is invalid.

Question 7

A security team wants to explicitly deny access to a Cloud Storage bucket for all users except the bucket owner. Currently, there are allow policies at the project level granting Storage Object Viewer to all users. What is the most efficient way to implement this?

Accepted Answer

Create an IAM deny policy on the bucket with a deny rule for all principals (principalSet: allUsers) and an exception for the bucket owner.. Option D is correct because Google Cloud IAM deny policies explicitly deny access to resources, overriding any allow policies. By creating a deny rule on the bucket with `principalSet: allUsers` as the denied principal and an exception for the bucket owner, you effectively block all users except the owner, regardless of project-level allow roles. This is the most efficient approach as it does not require modifying existing project-level policies or removing roles.

Answer

Create an Organization Policy that denies access to the bucket for all users except the owner.

Answer

Modify the project-level role to include a condition that only allows the bucket owner.

Answer

Remove the project-level Storage Object Viewer role and grant it only to the bucket owner.

Question 8

A company wants to implement least privilege access for a team that needs to monitor and manage Cloud Run services. Which two IAM roles should be considered? (Choose two.)

Accepted Answer

roles/run.viewer. Option C (roles/run.viewer) is correct because it grants read-only permissions to view Cloud Run services, configurations, and revisions, which is sufficient for monitoring without allowing modifications. Option D (roles/run.developer) is correct because it allows both viewing and managing Cloud Run services (e.g., deploying new revisions, updating configurations) while still restricting access to other GCP resources, aligning with least privilege for a team that needs to both monitor and manage.

Answer

roles/iam.serviceAccountUser

Answer

roles/run.admin

Answer

roles/run.invoker

Question 9

A security team needs to enforce that only requests originating from a corporate IP range (203.0.113.0/24) can access a Cloud Storage bucket containing sensitive data. They have created a custom IAM role with storage.objects.get permission and attached a condition that requires the request to have a specific IP address. However, some legitimate users outside the IP range are unable to access the data. What is the most likely cause?

Accepted Answer

The IAM condition evaluates after authentication, and users are already authenticated; the condition is not restricting based on source IP correctly because the condition is on the user's identity, not the request's source IP.. Option D is correct because IAM conditions on a custom role are evaluated after the user is authenticated and authorized by IAM. The condition attribute 'source.ip' is used to restrict access based on the request's originating IP address, but if the condition is incorrectly applied to the user's identity (e.g., using a condition that checks the user's IP at the time of policy evaluation rather than the request's source IP), it may not enforce the intended restriction. In this scenario, the condition is likely misconfigured to evaluate the user's identity attributes rather than the request's source IP, allowing authenticated users from any IP to access the bucket, while legitimate users outside the corporate IP range are blocked because the condition does not correctly filter based on the request's source IP.

Answer

Users must use a VPN to be assigned a corporate IP, but some are not connected.

Answer

The condition uses the attribute 'request.network' instead of 'source.ip'.

Answer

The bucket ACL is set to deny all access by default.

Question 10

An organization is designing a secure multi-tenant SaaS environment on GKE. They want to isolate tenant workloads using GKE namespaces and IAM. Which two steps should they take? (Choose two.)

Accepted Answer

Use Kubernetes RBAC to restrict access within namespaces.. Option C is correct because Kubernetes RBAC is the native mechanism for controlling access to resources within a namespace. By defining Role and RoleBinding objects, you can precisely restrict which tenant users can perform actions (e.g., get, list, create pods) inside their assigned namespace, ensuring logical isolation without requiring separate clusters.

Answer

Enable GKE Dataplane V2 for network isolation.

Answer

Grant cluster-level IAM roles to tenant users.

Answer

Create a separate GKE cluster per tenant.