PCSE Exam Simulation 1 — 100 Questions

Question 1

A company wants to allow employees to access a web application running on Google Kubernetes Engine (GKE) using their corporate Active Directory credentials. The application is exposed via an HTTPS load balancer. The Security Engineer needs to integrate identity federation and ensure that only authenticated users can reach the application. Which combination of services should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set up federation between Active Directory and Google Cloud using OIDC, and enable IAP on the load balancer.. It combines OIDC federation between Active Directory and Google Cloud with Identity-Aware Proxy (IAP) on the load balancer. IAP verifies user identity via OIDC tokens issued by the federated identity provider, ensuring only authenticated users can reach the application without exposing it to the public internet.

Answer

Use Cloud Armor to allow only traffic from specific IP ranges and require client certificates.

Answer

Enable IAP and configure it to use Active Directory as an identity provider.

Answer

Configure Cloud Identity as the identity provider and use IAP.

Question 2

An organization is using Assured Workloads to enforce ITAR compliance. They need to ensure that all resources are deployed in specific US regions and that Google personnel access is restricted. They also want to monitor for any configuration changes that violate compliance policies. Which service should they use for monitoring compliance drift?

Accepted Answer

Assured Workloads compliance monitoring. Assured Workloads includes built-in compliance monitoring that continuously evaluates the folder's resources against the selected compliance regime (e.g., ITAR) and surfaces violations such as resources deployed outside approved US regions or configuration drift. This is the native mechanism for monitoring compliance drift within an Assured Workloads environment.

Answer

Cloud Asset Inventory

Answer

Security Command Center

Answer

Cloud Monitoring

Question 3

Refer to the exhibit. A security engineer needs to ensure that all objects uploaded to the bucket are automatically encrypted with the specified KMS key. They also need to preserve older versions of objects. Which statement accurately describes the bucket configuration?

Accepted Answer

The bucket has default KMS encryption and versioning is enabled.. The question requires both automatic encryption of all uploaded objects using a specified KMS key and preservation of older object versions. Default KMS encryption ensures that any object uploaded without explicit encryption headers is automatically encrypted with the configured KMS key, while enabling versioning allows the bucket to retain noncurrent object versions. Together, these settings meet both requirements.

Answer

The bucket has default KMS encryption but versioning is disabled.

Answer

The bucket uses CSEK and versioning is enabled.

Answer

The bucket uses Google-managed encryption and versioning is disabled.

Question 4

A global e-commerce company is using Google Cloud to store customer data subject to GDPR. They have implemented data residency controls to keep data within the EU. However, during a routine audit, the compliance team discovers that some backups of customer data are being replicated to a US region due to a misconfigured backup policy. The data includes personal information. The company must ensure that all data remains within the EU. What should the team do to prevent this from recurring and remediate the current situation?

Accepted Answer

Use Organization Policies to enforce a constraint that disables the creation of resources outside the EU, and then delete the US backups.. Organization Policies allow the company to enforce a resource location constraint (e.g., `constraints/gcp.resourceLocations`), which prevents the creation of any Google Cloud resources outside the EU. This proactively stops misconfigured backups from being replicated to non-EU regions. Deleting the US backups after applying the policy remediates the current GDPR violation by removing the non-compliant data.

Answer

Delete the backups in the US region immediately and reconfigure the backup policy to only use EU regions.

Answer

Enable Access Transparency for the US backups to monitor access.

Answer

Encrypt the US backups with CMEK and leave them in place, as encryption satisfies GDPR.

Question 5

A healthcare company subject to HIPAA must prevent data exfiltration from Google Cloud storage buckets. They already use VPC Service Controls. Which additional control should they configure to directly block unauthorized copying of data to external projects?

Accepted Answer

Configure egress rules in the VPC Service Controls perimeter. VPC Service Controls allow you to define perimeters that restrict data movement between authorized and unauthorized projects. By configuring egress rules within the perimeter, you can explicitly block copying data to external projects, directly preventing data exfiltration. This is the correct additional control because it enforces policy at the network boundary, not just at the application or storage layer.

Answer

Enable Cloud Data Loss Prevention (DLP) scanning

Answer

Use Cloud Audit Logs to review access

Answer

Apply Cloud Identity-Aware Proxy (IAP) to buckets

Question 6

A company has two Google Cloud projects: Project A (production) and Project B (development). They want to allow a service account in Project B to list Compute Engine instances in Project A. What is the most secure way to grant this access?

Accepted Answer

Add the service account as a member in Project A's IAM policy with the roles/compute.viewer role.. It uses IAM to grant the service account from Project B the roles/compute.viewer role on Project A, which allows it to list Compute Engine instances without sharing keys or granting excessive permissions. This follows the principle of least privilege and avoids the security risks of key management.

Answer

Create a new service account in Project A, generate a key, and share it with the application in Project B.

Answer

Make the service account a project owner of Project A.

Answer

Export the service account key from Project B and use it in an application in Project A.

Question 7

A security team needs to automatically respond to high-severity vulnerability findings in Security Command Center. They want to trigger a Cloud Function that quarantines the affected VM. What is the recommended way to connect SCC findings to Cloud Functions?

Accepted Answer

Create a SCC notification config that sends findings to a Pub/Sub topic, and set up a Cloud Function to subscribe to that topic.. Security Command Center supports notification configs that publish findings to a Pub/Sub topic, and Cloud Functions can subscribe to that topic to trigger automated responses. This is the native, event-driven integration pattern recommended by Google Cloud for SCC-based automation, providing near-real-time response without polling.

Answer

Use Cloud Scheduler to poll SCC API every minute and invoke Cloud Function.

Answer

Configure Cloud Logging to capture SCC findings and create a log-based metric with an alert that triggers Cloud Function.

Answer

Export SCC findings to BigQuery and set up a BigQuery scheduled query to trigger Cloud Function.

Question 8

Refer to the exhibit. A user jane@example.com receives a 403 Access Denied error when trying to list objects in a Cloud Storage bucket. What is the most likely cause?

Accepted Answer

The IAM condition restricts access to requests originating from the 10.0.0.0/24 IP range. The IAM policy includes a condition that restricts access to requests originating from the 10.0.0.0/24 IP range. If jane@example.com is accessing the bucket from an IP outside this range, the condition fails and access is denied, resulting in a 403 error. Option B is incorrect; the role assigned to Jane includes the storage.objects.list permission, so lack of permission is not the issue. Option C is incorrect; there is no indication that the bucket is in a different project. Option D is incorrect; the policy is restrictive, not permissive, and there is no conflict with other policies.

Answer

Jane does not have the storage.objects.list permission

Answer

The bucket is in a different project

Answer

The IAM policy is too permissive and conflicts with other policies

Question 9

A company uses Access Context Manager to restrict access to Cloud Resources based on device policy. They want to allow access only from devices that are company-managed and have disk encryption enabled. What should they configure?

Accepted Answer

Create an access level with device policy conditions for corporate-owned and disk encryption.. Access Context Manager allows you to create access levels that define device policy conditions, such as requiring devices to be corporate-owned and have disk encryption enabled. These access levels are then applied to the organization's access policies to restrict access to cloud resources based on the device's compliance status.

Answer

Create an IAM condition requiring a specific device tag.

Answer

Use Identity-Aware Proxy with device policy.

Answer

Use VPC Service Controls with a device restriction.

Question 10

Which feature of Cloud Armor uses machine learning to detect and block distributed denial-of-service (DDoS) attacks?

Accepted Answer

Adaptive Protection. Adaptive Protection is the Cloud Armor capability that applies machine learning to model normal traffic to a backend service and detect deviations indicative of Layer 7 DDoS attacks. It then suggests or enforces rules to block the anomalous sources. This is the only Cloud Armor feature explicitly built on ML for DDoS detection.

Answer

Security policies

Answer

Rate limiting

Answer

Preconfigured WAF rules

Question 11

An organization uses Cloud Audit Logs to monitor admin activity. The security team wants to be alerted when a user creates a new IAM role at the organization level. Which type of audit log should they analyze?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs (option D) are the correct choice because they record operations that modify the configuration or metadata of resources, such as creating or modifying IAM roles and policies at the organization level. In Google Cloud, Admin Activity audit logs are enabled by default and capture all 'admin write' events, including the creation of an IAM role, which is a configuration change. The security team needs to monitor these logs to detect when a user creates a new IAM role, as this is an administrative action that alters the organization's security posture.

Answer

Policy Denied audit logs

Answer

System Event audit logs

Answer

Data Access audit logs

Question 12

A multinational company is migrating sensitive workloads to Google Cloud and must comply with GDPR data residency requirements. Which TWO actions ensure data remains stored only within the European Union? (Choose TWO.)

Accepted Answer

Define an Organization Policy with constraints/gcp.resourceLocations to allow resource creation only in EU regions.. The Organization Policy constraint `gcp.resourceLocations` explicitly restricts the Google Cloud regions where resources can be created. By setting this constraint to allow only EU regions (e.g., `europe-west1`, `europe-west4`), you enforce that all new resources are provisioned within the European Union, directly meeting GDPR data residency requirements. This policy is evaluated at resource creation time and prevents any resource from being deployed outside the allowed locations.

Answer

Enable Cloud Audit Logs with export to a BigQuery dataset in the EU region.

Answer

Use Cloud Data Loss Prevention (DLP) to scan for sensitive data and verify it remains in the EU.

Answer

Use Customer-Managed Encryption Keys (CMEK) stored in a Cloud KMS key ring located in the EU.

Question 13

Which TWO practices help implement the principle of least privilege when configuring access to Google Cloud resources? (Choose two.)

Accepted Answer

Create custom roles that include only the specific permissions needed.. Creating custom roles allows you to define a precise set of permissions, ensuring that a principal has only the minimum permissions required to perform their job function. This directly implements the principle of least privilege by avoiding the broad permissions often included in predefined roles.

Answer

Grant roles at the organization level to simplify administration.

Answer

Use a single service account for all Cloud Functions in a project to simplify key management.

Answer

Grant IAM roles directly to individual users for better traceability.

Question 14

A company needs to store financial records for 7 years to meet regulatory requirements. They want to ensure that once written, the records cannot be modified or deleted by anyone, including cloud administrators. Which Cloud Storage feature should they enable?

Accepted Answer

Object Retention Lock with a locked retention policy. Object Retention Lock with a locked retention policy enforces immutability on objects for a specified period, preventing deletion or modification even by administrators. Once the retention policy is locked, it cannot be removed or shortened, ensuring compliance with regulations like SEC Rule 17a-4. This directly meets the requirement of 7-year retention with no modifications.

Answer

Lifecycle management rules

Answer

Object Versioning

Answer

Customer-Managed Encryption Keys (CMEK)

Question 15

A security team wants to detect and block network-based threats such as malware and command-and-control traffic within their VPC. They need a managed service that provides deep packet inspection. Which Google Cloud service should they use?

Accepted Answer

Cloud IDS. Cloud IDS (Intrusion Detection System) is a managed service that uses Palo Alto Networks threat detection to inspect network traffic for threats. It integrates with packet mirroring to analyze traffic.

Answer

Security Command Center

Answer

VPC Flow Logs

Answer

Cloud Armor

Question 16

Which THREE are best practices for managing encryption keys in Google Cloud?

Accepted Answer

Enable automatic rotation for keys that are used for encryption.. Cloud KMS supports automatic key rotation, which reduces the risk of key compromise by ensuring that encryption keys are periodically replaced without manual intervention. Automatic rotation creates new key versions at a specified interval (e.g., every 90 days) and automatically uses the latest version for encryption, while decryption can still use older versions. This aligns with the security best practice of limiting the amount of data encrypted under a single key version.

Answer

Import key material from on-premises HSMs to avoid vendor lock-in.

Answer

Automatically delete old key versions once they expire.

Question 17

A company uses Cloud DLP to scan a BigQuery table for sensitive data. They want to automatically mask credit card numbers in query results for users who are not data stewards. Which approach should they use?

Accepted Answer

Create a BigQuery Data Policy with masking rules on the column and assign appropriate IAM roles. BigQuery column-level security with data masking rules (via BigQuery Data Policy) allows defining masking policies (e.g., email masking, hash masking) that are automatically applied to query results based on user IAM. DLP inspection can identify the sensitive columns, but the masking is enforced by BigQuery policies.

Answer

Enable Access Transparency to log queries and manually review

Answer

Use Cloud DLP de-identification jobs to replace credit card numbers with tokens in the source table

Answer

Use Cloud DLP inspect job and then manually apply a view that masks the column

Question 18

Alice tries to connect to Cloud SQL instance 'prod-instance' using the Cloud SQL Auth proxy. Will she succeed? Why?

Accepted Answer

Yes, because the admin role grants full access, and the condition only applies to the admin role, but the client role is unconditional.. The Cloud SQL Auth proxy uses IAM permissions for authentication and authorization. The `cloudsql.client` role grants the `cloudsql.instances.connect` permission unconditionally, allowing Alice to connect to any instance. The `cloudsql.admin` role's condition restricting access to 'dev' instances only applies to the `cloudsql.instances.update` permission, not to the connect permission, so the client role's unconditional access prevails.

Answer

Yes, because she has the client role with no condition.

Answer

No, because the admin role condition overrides the client role.

Answer

No, because the cloudsql.admin role condition restricts to dev instances only.

Question 19

A security team wants to automatically rotate a database password stored in Secret Manager every 60 days and notify the operations team when a new version is created. Which approach should they use?

Accepted Answer

Set a rotation period on the secret and configure a Pub/Sub topic for notifications; use a Cloud Function to generate new password. Secret Manager supports automatic rotation by setting a rotation period and a rotation schedule, and it can publish rotation notifications to a Pub/Sub topic. A Cloud Function (or Cloud Run) is typically used to generate the new password and add it as a new secret version. This combination provides automated rotation and event-driven notification to the operations team.

Answer

Use Cloud Scheduler to call Secret Manager API to add a new version

Answer

Use Cloud KMS key rotation to rotate the secret

Answer

Manually update the secret every 60 days

Question 20

Refer to the exhibit. The output shows that Alice has the following IAM policy binding: 
{
  "role": "roles/storage.objectAdmin",
  "members": ["user:alice@example.com"],
  "condition": {
    "title": "storage_access_condition",
    "expression": "request.time < timestamp('2024-12-31T23:59:59Z') && source.ip in ['203.0.113.0/24']"
  }
}
Alice is currently working from an IP address 198.51.100.10, and the date is 2025-01-01. What is the result when Alice tries to upload an object to a bucket in this project?

Accepted Answer

Access is denied because both the time and IP conditions are not satisfied.. Alice's IAM policy binding includes a condition that requires both the request time to be before 2024-12-31T23:59:59Z and the source IP to be within 203.0.113.0/24. Since the current date is 2025-01-01, the time condition fails, and her IP address 198.51.100.10 is not in the allowed range. With a condition that uses AND logic, both subconditions must be true for access to be granted; because neither is satisfied, access is denied.

Answer

Access is denied because the role does not include storage.objects.create permission.

Answer

Access is granted because the condition is not evaluated for uploads.

Answer

Access is granted because the IP condition is satisfied.