PCSE Practice Test 11 — 15 Questions

Question 1

A security engineer is reviewing a log entry in Cloud Logging with the above filter. The engineer wants to understand why this specific log entry was generated. Which action most likely caused this log entry?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A user stopped the Compute Engine instance. The log entry was generated because a user stopped the Compute Engine instance. In Cloud Logging, instance lifecycle events such as STOP, START, or RESET are recorded with the method `compute.instances.stop`. This specific log entry matches the filter criteria (e.g., `protoPayload.methodName="v1.compute.instances.stop"`), indicating that the action was a stop operation, not a failure or policy change.

Answer

An SSH login attempt failed due to incorrect credentials

Answer

A firewall rule blocked incoming traffic to the instance

Answer

An IAM policy change granted a user compute.instances.start access

Question 2

An organization stores sensitive data in Cloud Storage and wants to use Cloud DLP to automatically scan new objects for PII as they are uploaded. Which two resources are needed? (Choose 2)

Accepted Answer

Cloud Storage Pub/Sub notifications. To scan objects automatically upon upload, you need a Cloud DLP job trigger that listens to Pub/Sub notifications from the storage bucket. The bucket must be configured to send Pub/Sub notifications for new objects. The job trigger will create inspect jobs when new objects are added.

Answer

Cloud Scheduler

Answer

Cloud Functions

Answer

Cloud DLP InspectTemplate

Question 3

A company uses Cloud SQL for MySQL with automated backups. They want to ensure that backup data is encrypted with a key that they manage and rotate on a schedule, separate from the primary database encryption. What should they do?

Accepted Answer

Use Cloud SQL's backup encryption with customer-managed key by specifying a CMEK for backups.. Cloud SQL allows enabling CMEK for backups separately by specifying a different CMEK key for backup encryption. Enabling CMEK on the instance encrypts both data and backups with the same key. Exporting to Cloud Storage is not automated.

Answer

Enable CMEK on the Cloud SQL instance, which automatically encrypts backups with the same key.

Answer

Use CSEK for the Cloud SQL instance and then re-encrypt backups.

Answer

Export backups to Cloud Storage and apply CMEK on the export bucket.

Question 4

A security engineer is using Cloud Asset Inventory to find all Compute Engine instances that are not labeled with a 'compliance' label. Based on the exhibit, which instance(s) are missing the compliance label?

Accepted Answer

instance-2 only. The exhibit shows that instance-1 has a 'compliance' label with a value of 'true', while instance-2 has no 'compliance' label at all. Cloud Asset Inventory can query assets using label filters; the absence of the 'compliance' label on instance-2 means it fails the compliance labeling requirement. Therefore, only instance-2 is missing the compliance label.

Answer

Both instances

Answer

Neither instance

Answer

instance-1 only

Question 5

Refer to the exhibit. An operations engineer configured this alert policy to notify when any VM instance in project my-project has high CPU utilization. However, no notifications are received even when CPU is consistently above 90% on multiple instances in us-central1-a. What is the most likely cause?

Accepted Answer

The alert policy is configured in a different project than the VM instances.. Alert policies are project-scoped resources. If the VM instances reside in a different project than the one where the alert policy is defined, the policy cannot monitor those instances. The MQL query references the metric `compute.googleapis.com/instance/cpu/utilization` which is only visible within the same project as the monitored resources. Cross-project monitoring requires additional configuration such as a metrics scope or a separate alert policy in the target project.

Answer

The 'duration' of 0s in the MQL condition prevents the alert from firing because it needs a minimum duration.

Answer

The MQL query uses 'group_by' which causes the condition to be evaluated on the aggregate, but the threshold should be applied before grouping.

Answer

The notification channel is not configured or is invalid.

Question 6

Which TWO of the following are benefits of using Cloud NAT? (Choose TWO.)

Accepted Answer

Instances without external IP addresses can connect to the internet.. Cloud NAT allows instances without external IP addresses to initiate outbound connections to the internet, translating their private IPs to a single public IP or a range. This is a core benefit because it enables secure outbound internet access without exposing instances to inbound traffic.

Answer

Cloud NAT provides inbound port forwarding to instances.

Answer

Cloud NAT can be used to enable connectivity between VPC networks via VPN.

Answer

Cloud NAT automatically provides high availability across zones.

Question 7

A security auditor needs to review all IAM policy changes made in the last 30 days across multiple projects. The auditor has the Organization Viewer role at the organization level. What is the most efficient way to provide access without giving unnecessary permissions?

Accepted Answer

Grant the auditor the roles/iam.securityReviewer role at the organization level.. The roles/iam.securityReviewer role at the organization level grants read-only access to all IAM policies and audit logs across all projects in the organization, without granting any write or management permissions. This allows the auditor to review IAM policy changes efficiently without needing per-project assignments.

Answer

Grant the auditor the Logs Viewer role at the organization level to view audit logs of IAM changes.

Answer

The existing Organization Viewer role already provides access to IAM policies across all projects.

Answer

Grant the auditor the Project Viewer role on each project.

Question 8

You are designing VPC firewall rules for a multi-tier application. Which TWO considerations are important when creating firewall rules in terms of security and manageability? (Choose TWO.)

Accepted Answer

Use hierarchical firewall policies to enforce baseline rules across all VPCs in the organization.. Options B and C are correct. Hierarchical firewall policies allow you to enforce baseline rules across all VPCs in an organization, simplifying management and ensuring consistent security. Using service accounts or network tags to target rules (rather than source CIDR) is recommended for dynamic environments where IP addresses may change, as it improves scalability and reduces manual updates. Option A is incorrect because network tags are actually recommended for large deployments to simplify rule targeting. Option D is incorrect because enabling firewall rules logging for all rules generates excessive logs and costs; it should be selectively applied to rules that require auditing. Option E is incorrect because firewall rules can be global or regional; specifying a target region is not always necessary and may overly restrict the rule's applicability.

Answer

Network tags are not recommended for large deployments because they require managing many tags.

Answer

Enable firewall rules logging for all rules to ensure full auditability.

Answer

Always specify the target region for firewall rules to limit the scope.

Question 9

A company operates a hybrid cloud environment with on-premises data centers and Google Cloud Platform. They store sensitive customer data in Cloud Storage buckets and use Data Loss Prevention (DLP) to scan for and inspect sensitive content. They have automated DLP inspection jobs that run periodically, but they want to automatically redact sensitive data (e.g., Social Security numbers) in any new object as soon as it is written to a specific bucket. The redacted version should replace the original object in the same bucket. Which of the following is the most effective and recommended approach?

Accepted Answer

Set up a Cloud Function triggered by Cloud Storage 'finalize' events. The function calls the DLP API to inspect the object, creates a redacted version, and deletes the original object, replacing it with the redacted data.. Triggering a Cloud Function on object finalize events, running DLP inspection, and rewriting the object with redacted data is the recommended pattern. Option B is incorrect because DLP cannot modify objects in place; it produces a new artifact. Option C is about retention, not redaction. Option D is about perimeter security and does not address redaction.

Answer

Enable a bucket retention policy and use DLP to scan objects and quarantine those with sensitive data by moving them to a different bucket.

Answer

Use Cloud Storage Object Change Notifications to alert a Compute Engine instance that runs a DLP job to modify the object in place.

Answer

Use VPC Service Controls to create a secure perimeter around the bucket and then run DLP scans on a schedule.

Question 10

A company is deploying a firewall appliance in a VPC to inspect traffic. They create custom routes to direct traffic to the appliance. Which step is necessary to ensure the appliance can forward traffic back?

Accepted Answer

Enable IP forwarding on the appliance instance. The firewall appliance instance must have IP forwarding enabled at the OS level (e.g., net.ipv4.ip_forward=1 on Linux) to forward packets between its network interfaces. Without this, the instance will drop any traffic not destined for its own IP address, even if VPC routes direct packets to it. This is a prerequisite for the appliance to act as a transparent or routed next-hop in the VPC routing table.

Answer

Use a load balancer

Answer

Configure the appliance as a next hop in a route

Answer

Assign a public IP to the appliance

Question 11

A healthcare organization is deploying a new application on Google Cloud that will process protected health information (PHI) subject to HIPAA. The security team has enabled encryption at rest using Google-managed keys and configured Cloud Audit Logs. During a compliance review, the auditor notes that the organization has not yet signed a Business Associate Agreement (BAA) with Google Cloud. What should the organization do to remediate this issue?

Accepted Answer

Sign a BAA with Google Cloud through the Google Cloud Console or by contacting Google Cloud Support.. Under HIPAA, a covered entity or business associate must have a signed Business Associate Agreement (BAA) with any service provider that creates, receives, maintains, or transmits protected health information (PHI) on its behalf. Google Cloud offers a standard BAA that customers must accept through the Google Cloud Console or by contacting support; encryption at rest and audit logs are separate technical controls that do not satisfy this contractual requirement. Option C is correct because signing a BAA is the only direct way to establish the legally required business associate relationship with Google Cloud for PHI processing.

Answer

Enable VPC Service Controls to satisfy HIPAA requirements without a BAA.

Answer

Use Customer-Managed Encryption Keys (CMEK) to meet the requirement for a signed BAA.

Answer

Configure Access Transparency logs as a substitute for a BAA.

Question 12

An organization wants to use a FIPS 140-2 Level 3 validated hardware security module (HSM) to protect encryption keys in Cloud KMS. Which key protection level should they choose when creating a key ring?

Accepted Answer

hsm. Cloud KMS offers two protection levels: software and HSM. HSM protection level uses Cloud HSM, which is FIPS 140-2 Level 3 validated. Software keys are validated to Level 1.

Answer

software

Answer

cloud

Answer

external

Question 13

A company is deploying a multi-region application in Cloud Run and must comply with data residency requirements in the European Union (EU). They want to ensure that only EU-based Cloud Run instances are created. Which approach should they use?

Accepted Answer

Set an Organization Policy with constraints/gcp.resourceLocations to restrict allowed regions to EU regions.. Organization Policies with the `constraints/gcp.resourceLocations` constraint allow administrators to enforce a list of allowed Google Cloud regions for resource creation. By setting this policy to include only EU-based regions (e.g., `europe-west1`, `europe-west4`), the company ensures that Cloud Run instances cannot be created outside the EU, directly meeting data residency compliance requirements. This is a preventive control that applies at the project or folder level, overriding any developer choices.

Answer

Add a label to the Cloud Run service specifying the region and rely on developers to follow it.

Answer

Use VPC Service Controls to limit access to the Cloud Run service from outside the EU.

Answer

Configure VPC Firewall rules to only allow egress to EU IP addresses.

Question 14

A security engineer wants to block all SSH access from the internet to a VPC network, except for a specific bastion host. What is the most efficient way to configure this?

Accepted Answer

Create a firewall rule allowing SSH only from the bastion host's IP and rely on the implicit deny. VPC firewall rules are implicitly deny-all at the end of the evaluation order. By creating a single allow rule for SSH from the bastion host's IP, all other SSH traffic is implicitly denied by the default deny rule, without needing an explicit deny rule. This is the most efficient approach as it minimizes rule count and avoids potential priority conflicts.

Answer

Create a firewall rule with deny SSH from 0.0.0.0/0 and a higher priority rule allowing SSH from the bastion host's IP

Answer

Use a service perimeter

Answer

Create a firewall rule denying SSH from all IPs except the bastion host using the 'except' sources

Question 15

A security engineer needs to enforce column-level masking on a BigQuery table such that: (1) users with role 'data_analyst' see masked values, (2) users with role 'data_scientist' see plaintext values, and (3) the masking is applied automatically without modifying the underlying table. Which three components must they configure? (Choose 3)

Accepted Answer

IAM roles (e.g., roles/bigquery.maskedReader). BigQuery column-level security uses: a Data Catalog taxonomy to define policy tags, a BigQuery Data Policy that specifies masking rules (e.g., hash, nullify) associated with the policy tag, and IAM roles (e.g., BigQuery Masked Reader) to grant access to masked data. The taxonomy contains the policy tags, the data policy defines the masking rule, and IAM controls who sees masked vs. plaintext.

Answer

Cloud KMS key for column encryption

Answer

Cloud DLP de-identification job