PCSE Practice Test 12 — 15 Questions

Question 1

A company runs a Cloud SQL for PostgreSQL instance that stores customer data. They must encrypt the database at rest using customer-managed encryption keys (CMEK) to meet regulatory requirements. The instance is currently using Google-managed encryption. What must they do to implement CMEK? The company wants to minimize downtime and avoid data loss.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a new Cloud SQL instance with CMEK enabled, then export data from the old instance and import into the new one.. Cloud SQL does not support enabling CMEK on an existing instance; you must create a new instance with CMEK enabled at provisioning time. Exporting data from the old instance and importing it into the new one ensures the database is re-encrypted under the customer-managed key with minimal downtime and no data loss, as the export/import process preserves the data.

Answer

Use the gcloud command to update the existing instance to use CMEK by specifying the key.

Answer

Configure Cloud External Key Manager (EKM) and attach it to the existing instance via a patch operation.

Answer

Implement client-side encryption in the application using a library like Tink and store the encrypted data in the existing database.

Question 2

User user1@domain.com tries to SSH into a Compute Engine instance that has the service account sa1@project.iam.gserviceaccount.com attached. Will the SSH connection succeed? (Assume no other policies)

Accepted Answer

No, because user1 needs a role such as compute.osLogin to SSH into the instance.. SSH access to a Compute Engine instance requires the user to have the compute.osLogin role (or a role that includes compute.instances.osLogin permission) when OS Login is enabled. Without OS Login, the user needs the compute.instances.setMetadata permission to add SSH keys. The service account attached to the instance does not grant SSH access; it only allows the instance to authenticate to Google Cloud APIs. User1 has no relevant IAM roles for SSH, so the connection will fail.

Answer

No, because user1 lacks compute.instances.osLogin permission.

Answer

Yes, because user1 has iam.serviceAccountUser role on the service account, which is required to use it.

Answer

Yes, because user1 has compute.viewer role.

Question 3

An organization wants to ensure that only compute instances in a specific VPC can access a Cloud Storage bucket. They also want to prevent the bucket data from being downloaded to an external IP. Which TWO services should they combine? (Choose TWO.)

Accepted Answer

IAM conditions restricting access by VPC network. IAM conditions allow you to restrict access to a Cloud Storage bucket based on the requester's VPC network, ensuring only compute instances in that specific VPC can access the bucket. VPC Service Controls create a security perimeter around the bucket, preventing data exfiltration to external IPs by blocking unauthorized network paths. Together, they enforce both network-level access restriction and data download prevention.

Answer

Cloud NAT

Answer

Cloud VPN

Answer

Private Google Access

Question 4

An organization wants to grant a team of data analysts the ability to run BigQuery queries and create datasets, but prevent them from deleting datasets or modifying IAM policies. Which predefined IAM role should be assigned?

Accepted Answer

roles/bigquery.dataEditor. The BigQuery Data Editor role (roles/bigquery.dataEditor) allows creating datasets and running queries, but does not allow deleting datasets or modifying permissions. The Viewer role is read-only, Owner allows deletion and IAM changes, and Job User only allows running jobs without dataset creation.

Answer

roles/bigquery.dataOwner

Answer

roles/bigquery.dataViewer

Answer

roles/bigquery.jobUser

Question 5

Which Google Cloud service provides near-real-time logs when Google administrators access your customer content?

Accepted Answer

Access Transparency. Access Transparency logs provide detailed information about actions taken by Google staff when accessing customer data. Access Approval is a separate feature that requires approval before access. Audit Logs is a broader category. Cloud DLP is for data loss prevention.

Answer

Access Approval

Answer

Cloud DLP

Answer

Cloud Audit Logs

Question 6

Drag and drop the steps to respond to a data breach involving a Cloud Storage bucket in the correct order.

Accepted Answer

Step 1: Contain, Step 2: Investigate, Step 3: Notify, Step 4: Remediate, Step 5: Review. Incident response steps are: contain, investigate, notify, remediate, and review.

Answer

Step 1: Contain, Step 2: Remediate, Step 3: Investigate, Step 4: Notify, Step 5: Review

Answer

Step 1: Investigate, Step 2: Contain, Step 3: Notify, Step 4: Remediate, Step 5: Review

Answer

Step 1: Notify, Step 2: Contain, Step 3: Investigate, Step 4: Remediate, Step 5: Review

Question 7

Which Security Command Center tier provides Event Threat Detection and Container Threat Detection?

Accepted Answer

Premium tier. These threat detection services are available only in the Premium tier of Security Command Center. The Standard tier includes Security Health Analytics, Web Security Scanner, and Anomaly Detection. Compliance monitoring is also Premium-only.

Answer

Both tiers

Answer

Standard tier

Answer

Neither tier, they are separate services

Question 8

A security engineer needs to implement a logging pipeline that sends real-time Cloud Audit Logs to a third-party SIEM. They must ensure that if the SIEM is unavailable, logs are not lost. Which approach should they use?

Accepted Answer

Create a log sink that writes to a Pub/Sub topic, and use a subscription with a dead letter topic.. Using a Pub/Sub subscription with a dead letter topic allows messages to be retried and, if delivery fails persistently, moved to a dead letter topic for later reprocessing. This prevents data loss. Cloud Storage is not real-time; BigQuery is not for streaming to SIEM; Cloud Run without Pub/Sub would miss retries.

Answer

Configure a Cloud Run service to pull logs from Cloud Logging API and forward to SIEM.

Answer

Export logs to Cloud Storage via a sink, and have the SIEM ingest from there.

Answer

Use a log sink to BigQuery and have the SIEM query BigQuery periodically.

Question 9

Your company has hundreds of GKE clusters across multiple projects. You need to ensure that all clusters have Container Threat Detection enabled. Which approach is most scalable?

Accepted Answer

Write a script using gcloud container clusters update with --enable-threat-detection flag. SCC Premium includes Container Threat Detection. To enable it across clusters, you can use an organization policy or a custom script. Using Terraform or Config Controller to manage clusters as code is scalable. The most straightforward way: enable SCC Premium at the organization level and then enable Container Threat Detection per cluster via the API or gcloud. A script using gcloud commands can iterate through all clusters.

Answer

Create a new organization policy that enforces Container Threat Detection on all clusters

Answer

Deploy a DaemonSet that enables Container Threat Detection

Answer

Manually enable Container Threat Detection in each cluster via the Cloud Console

Question 10

A company wants to enforce that only users from a specific domain (example.com) can be granted IAM roles on any resource in their organization. Which two steps are required? (Choose two.)

Accepted Answer

Configure Cloud Identity or Google Workspace to manage the example.com domain.. Enforcing allowed member domains requires setting the organization policy constraint 'constraints/iam.allowedPolicyMemberDomains' to include example.com. Additionally, configuring Cloud Identity or Google Workspace with the domain is necessary for the constraint to work. IAM deny policies are not used. Custom roles are not required. Cloud Directory Sync is for syncing users, not enforcement.

Answer

Create custom roles that only allow users from example.com.

Answer

Create an IAM deny policy to deny access to users from other domains.

Answer

Use Cloud Directory Sync to sync only example.com users.

Question 11

A security analyst needs to mute a recurring false positive finding in Security Command Center so that it no longer appears in the active findings list. The analyst wants to keep the finding for historical reference. What should they do?

Accepted Answer

Mute the finding using the SCC console or API. Muting a finding in SCC hides it from active views but retains it for auditing. Muting can be done individually or via mute rules based on properties.

Answer

Set the finding's state to 'INACTIVE'

Answer

Create a filter to exclude the finding from view

Answer

Delete the finding from SCC

Question 12

Which Google Cloud compliance certification is most relevant for a company that processes credit card transactions and needs to demonstrate secure handling of cardholder data?

Accepted Answer

PCI DSS. PCI DSS is the Payment Card Industry Data Security Standard, specifically for organizations that handle credit card data. ISO 27001 is an information security management standard, SOC reports are for service organization controls, and FedRAMP is for federal cloud computing.

Answer

SOC 2 Type II

Answer

ISO 27001

Answer

FedRAMP

Question 13

A company runs a batch processing workload on Compute Engine VMs for 6 months. They want to reduce costs without sacrificing performance. Which option should they implement?

Accepted Answer

Purchase committed use discounts for the relevant machine types and regions. Committed use discounts (CUDs) provide significant discounts in exchange for a 1- or 3-year commitment, ideal for steady-state workloads like a 6-month batch processing job. Option A is wrong because preemptible VMs are not suitable for long-running batch jobs due to termination risk. Option B is wrong because sole-tenant nodes isolate VMs but do not reduce costs. Option C is wrong because custom machine types may optimize resource use but do not offer discounts like CUDs.

Answer

Switch to preemptible VMs

Answer

Use sole-tenant nodes to share resources across projects

Answer

Migrate to custom machine types to eliminate wasted resources

Question 14

Which THREE steps are most effective for troubleshooting a VPC firewall rule issue where desired traffic is being blocked?

Accepted Answer

Check firewall rule logs in Cloud Logging. Options B, C, and D are correct. Checking firewall rule logs in Cloud Logging (B) reveals whether traffic was denied by a firewall rule. Verifying that network tags on instances match the target tags in the firewall rule (C) ensures the rule applies to the correct VMs. Reviewing VPC flow logs (D) shows actual traffic flows to confirm whether traffic reaches the VM. Option A (check IAM permissions) is less relevant because firewall rules are network-level, not identity-based. Option E (inspect route tables) affects routing, not firewall blocking.

Answer

Check IAM permissions for the VM's service account

Answer

Inspect the route tables for the subnet

Question 15

Which THREE are requirements for HIPAA compliance when using Google Cloud? (Choose three.)

Accepted Answer

Enable audit logging for all PHI-related activities. HIPAA requires covered entities to implement audit controls that record and examine access and other activity in information systems that contain or use electronic protected health information (ePHI). In Google Cloud, enabling audit logging for all PHI-related activities, such as via Cloud Audit Logs (Admin Activity, Data Access, and System Event logs), satisfies this requirement by providing an immutable, tamper-evident record of who accessed what data and when.

Answer

Use Dedicated Interconnect for network connectivity

Answer

Enable Data Loss Prevention (DLP) for all data