PCSE Practice Test 11 — 15 Questions

Question 1

A company uses Assured Workloads to meet FedRAMP High compliance in the US. They need to ensure that data cannot be moved outside the US region. Which control should they use?

Accepted Answer

Configure an organization policy with gcp.resourceLocations as part of the Assured Workloads configuration.. Assured Workloads enforces compliance boundaries through organization policies, and the `gcp.resourceLocations` constraint specifically restricts where Google Cloud resources can be created. By configuring this policy as part of the Assured Workloads configuration, you ensure that all resources are provisioned only within the US region, preventing data from being stored or processed outside that boundary. This directly meets the FedRAMP High requirement to keep data within the US.

Answer

Use VPC Service Controls to prevent data exfiltration.

Answer

Set IAM conditions on all resources to allow only US regions.

Answer

Use Cloud DLP to scan and block data leaving the US.

Question 2

A company wants to use Google Cloud resources but does not have a Google Workspace or Cloud Identity account. They want to manage identities for their users without paying for additional licenses. What is the most cost-effective identity solution?

Accepted Answer

Use Cloud Identity Free edition.. Cloud Identity Free edition provides identity and access management for Google Cloud without requiring Google Workspace and without per-user licensing costs. It supports user lifecycle management, SSO, and integration with GCP IAM, making it the most cost-effective option for organizations that only need identity management for cloud resources.

Answer

Use the Compute Engine default service account for all users.

Answer

Use Cloud Identity Premium edition.

Answer

Use Google Workspace.

Question 3

Which Google Cloud audit log captures administrator activity and is enabled by default?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs (option D) are enabled by default in Google Cloud and capture all administrator actions that modify the configuration or metadata of resources, such as creating a VM or changing IAM policies. These logs are essential for compliance and security auditing because they record 'who did what, where, and when' for management activities, and they cannot be disabled.

Answer

Policy Denied audit logs

Answer

System Event audit logs

Answer

Data Access audit logs

Question 4

A security team needs to centrally manage secrets for multiple Google Cloud projects. Which solution should they use?

Accepted Answer

Use Secret Manager. Google Cloud Secret Manager is the dedicated service for storing, managing, and accessing secrets such as API keys, passwords, and certificates. It supports central management across multiple projects via IAM policies, automatic rotation, versioning, and audit logging, making it the correct choice for centrally managing secrets for multiple projects.

Answer

Hardcode secrets in application code and use IAM with access scopes

Answer

Use Cloud Key Management Service (Cloud KMS) to store and manage secrets

Answer

Store secrets in encrypted Cloud Storage buckets

Question 5

A company is using VPC Service Controls to protect their Google Cloud Storage buckets. They want to allow a specific instance to access a bucket from within a VPC. What networking configuration is required?

Accepted Answer

Private Google Access must be enabled on the subnet. VPC Service Controls require Private Google Access to be enabled on the subnet so that the instance can access Google APIs using its internal IP address.

Answer

The instance must have a public IP

Answer

A VPC peering connection to Google services

Answer

A Cloud NAT gateway

Question 6

An organization handles ITAR-controlled data and must restrict Google personnel access to the underlying infrastructure. Which Google Cloud product should they use to enforce this restriction?

Accepted Answer

Assured Workloads. Assured Workloads is a Google Cloud service that enforces compliance and data residency controls, including restricting Google personnel access to customer data for ITAR and other regulated workloads. It provides a managed environment with technical controls that prevent Google support and engineering staff from accessing the data without explicit customer approval. This directly addresses the requirement to limit Google personnel access to the underlying infrastructure.

Answer

IAM Conditions

Answer

VPC Service Controls

Answer

Cloud HSM

Question 7

You are designing a multi-tier application with a frontend and backend. The frontend instances are in subnet A (10.0.1.0/24), and the backend instances are in subnet B (10.0.2.0/24). Both subnets are in the same VPC. You want to allow the frontend to communicate with the backend on TCP port 8080, but the backend must not be able to initiate connections to the frontend. Additionally, the backend must be able to send patches to the internet. Which set of firewall rules should you implement?

Accepted Answer

Ingress rule on backend: allow tcp:8080 from subnet A; Egress rule on backend: allow all to internet. The frontend in subnet A initiates connections to the backend on TCP port 8080, so an ingress rule on the backend allowing traffic from subnet A permits this. An egress rule on the backend allowing all traffic to the internet enables patch downloads. This setup prevents the backend from initiating connections to the frontend, as no egress rule on the backend targets the frontend, and no ingress rule on the frontend allows unsolicited traffic from the backend.

Answer

Ingress rule on frontend: allow tcp:8080 from backend's service account; Egress rule on backend: allow all to internet

Answer

Ingress rule on frontend: allow tcp:8080 from subnet B; Egress rule on backend: allow all to internet

Answer

Ingress rule on backend: allow tcp:8080 from subnet A; Egress rule on frontend: deny all to internet

Question 8

Which IAM role should be assigned to a user who needs to manage Cloud Storage objects in a specific project, but should not be able to create or delete buckets?

Accepted Answer

roles/storage.objectAdmin. The roles/storage.objectAdmin role grants full control over objects in a bucket, including listing, creating, viewing, and deleting objects, but it does not grant permission to create or delete buckets themselves. This matches the requirement to manage Cloud Storage objects without being able to create or delete buckets. roles/storage.admin would allow bucket creation and deletion, which is too permissive.

Answer

roles/storage.legacyBucketReader

Answer

roles/storage.admin

Answer

roles/storage.objectViewer

Question 9

A security engineer needs to audit changes to IAM policies across their Google Cloud organization. Which audit log type should they enable to capture IAM policy changes?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs record changes to resource configurations and metadata, including IAM policy changes such as creating, modifying, or deleting roles, bindings, and service accounts. They are enabled by default and are the correct log type for auditing who changed IAM policies and when. This makes them the authoritative source for configuration-change auditing.

Answer

System Event audit logs

Answer

Data Access audit logs

Answer

Access Transparency logs

Question 10

An organization has a hierarchical firewall policy at the organization level that denies all ingress traffic from the internet. A project team needs to allow HTTP traffic from the internet to a specific VM. How should they achieve this?

Accepted Answer

Create a project-level hierarchical firewall policy with a rule allowing HTTP from 0.0.0.0/0 and a lower priority number than the org-level deny. Hierarchical firewall policies cannot be overridden at lower levels; they are always evaluated first. Since the org-level policy denies all internet ingress, the only way to allow HTTP is to create a hierarchical policy at a lower level (folder or project) that allows it, but those are also part of the hierarchy and are evaluated after org-level. Actually, hierarchical policies can be overridden by a lower-level policy with a higher priority, but the org-level policy has no higher priority? In GCP, hierarchical firewall policies are evaluated in order of precedence: organization > folder > project. A policy at a lower level can override a higher-level policy if it has a higher priority (lower number) and is an allow rule. So the project team can create a project-level hierarchical policy with a higher priority (e.g., 100) allowing HTTP from 0.0.0.0/0, which will override the org-level deny (priority 1000).

Answer

Add a VPC firewall rule allowing HTTP from 0.0.0.0/0

Answer

Remove the VM from the organization hierarchy

Answer

Use Cloud Armor to allow the traffic

Question 11

A company uses Customer-Supplied Encryption Keys (CSEK) for Compute Engine persistent disks. They want to ensure that Google does not store the key material. What must they do?

Accepted Answer

Use the gcloud compute disks create command with the --csek-key-file flag to supply the key, and do not store the key in Cloud KMS.. Customer-Supplied Encryption Keys (CSEK) allow you to provide your own raw AES-256 key material when creating a persistent disk. By using the `gcloud compute disks create` command with the `--csek-key-file` flag, you supply the key directly to the API, and Google uses it only in memory to encrypt the disk; it does not persist the key material on Google's infrastructure. The key file is stored locally by the customer, ensuring Google never retains the key.

Answer

Enable Cloud HSM to protect the key.

Answer

Set an organization policy to prevent Google from storing keys.

Answer

Create a Cloud KMS key and use it as a CSEK.

Question 12

An organization wants to enforce that all Compute Engine instances must use a specific service account. Which three steps are necessary? (Choose three.)

Accepted Answer

Grant the service account the needed roles on the project.. The service account must be granted the necessary IAM roles on the project (or specific resources) to perform its intended actions. Without these grants, even if the service account is enforced, it will lack permissions to interact with Compute Engine resources. This step ensures the service account has the required access, such as compute.instanceAdmin or custom roles, to manage instances.

Answer

Create a custom role with compute.instances.create permission.

Answer

Grant the compute.instanceAdmin role to the service account.

Question 13

You are designing VPC firewall rules for a multi-tier application. Which TWO considerations are important when creating firewall rules in terms of security and manageability? (Choose TWO.)

Accepted Answer

Use hierarchical firewall policies to enforce baseline rules across all VPCs in the organization.. Option B is correct because hierarchical firewall policies in Google Cloud are attached at the organization or folder level and are inherited by all VPC networks beneath them, letting you enforce baseline allow/deny rules (such as blocking SSH from 0.0.0.0/0) consistently across every project without duplicating rules per VPC, which greatly improves manageability and security posture. Option C is correct because targeting rules by service account or network tag decouples the rule from static IP ranges, so as instances are created, scaled, or replaced in dynamic environments, the correct rules automatically apply to the right workloads without editing CIDRs. Option A is incorrect because network tags remain a supported and commonly recommended targeting mechanism, and hierarchical policies plus tag governance can manage them at scale. Option D is incorrect because enabling logging on every rule is not a universal best practice; logging all rules can generate significant cost and noise, so logging should be enabled selectively on rules where audit or troubleshooting value justifies it. Option E is incorrect because VPC firewall rules are enforced at the network level and are not scoped by region, so specifying a target region is not a valid consideration.

Answer

Network tags are not recommended for large deployments because they require managing many tags.

Answer

Enable firewall rules logging for all rules to ensure full auditability.

Answer

Always specify the target region for firewall rules to limit the scope.

Question 14

A developer wants to allow a CI/CD pipeline running on GitHub Actions to deploy resources to a GCP project without using service account keys. Which two components are needed? (Choose two.)

Accepted Answer

A Workload Identity Pool and Provider configured for GitHub.. Workload Identity Federation allows GitHub Actions to exchange GitHub OIDC tokens for GCP service account impersonation. You need to set up a workload identity pool and provider for GitHub. The GitHub Actions workflow must be configured to use the OIDC token and request impersonation of a service account.

Answer

A Cloud Build trigger to run the workflow.

Answer

A Cloud KMS key to encrypt the workflow.

Answer

A service account JSON key stored as a GitHub secret.

Question 15

A healthcare company's data science team needs to query BigQuery tables containing sensitive patient data. The company policy requires that all queries be logged and audited. The team has been granted the bigquery.user role on the project. However, when attempting to query a specific table in a dataset, they receive the error: "Access Denied: Table X: User does not have permission to query table X." The dataset has a custom IAM role assigned to the team's Google Group. The custom role includes the permissions: bigquery.datasets.get, bigquery.tables.get, bigquery.tables.list, and bigquery.jobs.create. The engineer verifies that the bigquery.user role does include bigquery.jobs.create. The engineer also confirms that the table exists and the dataset is in the same region as the project. What is the most likely cause of the access denied error?

Accepted Answer

The custom role does not include the bigquery.tables.getData permission.. The error 'Access Denied: Table X: User does not have permission to query table X' indicates that the user lacks the permission to read the actual table data. The custom role assigned to the team's Google Group includes bigquery.tables.get (metadata) and bigquery.tables.list, but not bigquery.tables.getData, which is required to read table rows. Without bigquery.tables.getData, even with bigquery.jobs.create and dataset-level metadata permissions, query execution fails because BigQuery enforces data access separately from metadata and job creation.

Answer

The team is not granted the bigquery.jobUser role on the project.

Answer

The team is not granted the bigquery.metadataViewer role on the dataset.

Answer

The dataset is in a different region than the project's default location, causing cross-region access restrictions.