PCSE Practice Test 12 — 15 Questions

Question 1

Match each Google Cloud logging/monitoring term to its definition.

Accepted Answer

Log bucket: A storage location for log entries. Log buckets store logs, log sinks route logs, log-based metrics derive metrics from logs, and log entries are individual records. Common confusions include mixing sinks with metrics and buckets with queries.

Answer

Log bucket: A query to filter log entries

Answer

Log sink: A metric derived from log data

Question 2

Drag and drop the steps to set up IAM conditions for a service account in the correct order.

Accepted Answer

Identify the scope, then write the condition, then bind the condition to the policy, then attach the policy, then test.. IAM conditions involve identifying the scope, writing the condition, binding it, attaching the policy, and testing.

Answer

Write the condition, then identify the scope, then bind the condition to the policy, then attach the policy, then test.

Answer

Identify the scope, then write the condition, then attach the policy, then bind the condition to the policy, then test.

Answer

Identify the scope, then write the condition, then test, then bind the condition to the policy, then attach the policy.

Question 3

A security engineer is tasked with automating the remediation of non-compliant resources in a Google Cloud organization. The organization uses Organization Policy Service to enforce constraints. The engineer needs to automatically disable a specific service (e.g., Compute Engine API) for a project that violates a policy. Which Google Cloud service should be used to trigger this remediation?

Accepted Answer

Cloud Functions. Cloud Functions is correct because it can be triggered by real-time event notifications (e.g., from Cloud Asset Inventory or Pub/Sub) when a policy violation is detected, and then execute custom code to disable the Compute Engine API via the Service Usage API. This serverless, event-driven model is ideal for automated remediation workflows without managing infrastructure.

Answer

Cloud Build

Answer

Cloud Run

Answer

Cloud Scheduler

Question 4

A company wants to encrypt data at rest in Cloud SQL. Which TWO methods are supported? (Choose TWO.)

Accepted Answer

Default encryption at rest with Google-managed keys. Cloud SQL provides default encryption at rest using AES-256 with Google-managed keys, which are automatically generated and rotated by Google. This encryption is transparent to the user and requires no additional configuration, ensuring data is encrypted before being written to disk.

Answer

Cloud HSM hardware security module for encryption

Answer

Cloud Key Management Service (Cloud KMS) as a standalone encryption method

Answer

Client-side encryption before storing data in Cloud SQL

Question 5

Drag and drop the steps to configure a security scanner to scan a web application in the correct order.

Accepted Answer

Configuration, then Scheduling, then Execution, then Review, then Remediation Verification. Security scanning involves configuration, scheduling, execution, review, and remediation verification.

Answer

Scheduling, then Configuration, then Execution, then Review, then Remediation Verification

Answer

Configuration, then Execution, then Scheduling, then Review, then Remediation Verification

Answer

Configuration, then Scheduling, then Review, then Execution, then Remediation Verification

Question 6

A security engineer wants to restrict access to a Cloud Storage bucket so that only requests originating from within a specific VPC network can access the bucket. Which Google Cloud service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls creates a service perimeter that restricts access to Google Cloud services like Cloud Storage based on the network origin of the request. It enforces that only requests originating from within the defined VPC network (or allowed projects) can access the bucket, providing a network-based security boundary around the service. This is the only option designed specifically to limit Cloud Storage access by VPC network origin.

Answer

Identity-Aware Proxy (IAP)

Answer

Firewall rules

Answer

Cloud Armor

Question 7

A company wants to use Cloud CDN to cache content from an HTTP Load Balancer. They have a custom domain and want to serve traffic over HTTPS. What must they configure on the load balancer?

Accepted Answer

Create an SSL certificate resource and attach it to the HTTPS target proxy.. To serve HTTPS traffic with Cloud CDN and a custom domain, the load balancer must have an SSL certificate attached to its HTTPS target proxy. This is because Cloud CDN relies on the load balancer's target proxy to terminate TLS and present the certificate to clients. Creating an SSL certificate resource (either Google-managed or self-managed) and attaching it to the HTTPS target proxy is the required step.

Answer

Set up a backend bucket with a public certificate.

Answer

Upload a custom SSL certificate directly to the Cloud CDN configuration.

Answer

Enable HTTP to HTTPS redirect on the load balancer.

Question 8

A company is required to perform penetration testing on their Google Cloud infrastructure. According to Google Cloud's policy, which statement is true regarding penetration testing?

Accepted Answer

No prior approval is needed for testing most services, but denial-of-service (DoS) attacks are not permitted.. Google Cloud's penetration testing policy explicitly states that customers do not need prior approval for testing most Google Cloud services, but denial-of-service (DoS) attacks, DNS spoofing, and other disruptive activities are prohibited. This permissive stance allows organizations to conduct security assessments without bureaucratic delays while protecting Google's shared infrastructure. The policy applies to the customer's own projects and resources.

Answer

Customers must use Google's own penetration testing tools, such as Web Security Scanner.

Answer

Prior approval from Google is required for all penetration testing activities.

Answer

Penetration testing is prohibited on Google Cloud unless it is conducted by a certified third party.

Question 9

A company needs to archive Cloud Audit Logs for compliance purposes for 7 years. The logs are rarely accessed after the first year. Which storage option is the most cost-effective?

Accepted Answer

Export logs to Cloud Storage with Archive storage class. Cloud Storage Archive storage class is designed for data accessed less than once a year and retained for long periods, offering the lowest storage price among Cloud Storage classes. Since the logs are rarely accessed after year one but must be kept for seven years, Archive minimizes cost while meeting the retention requirement. Standard storage would be far more expensive for cold data.

Answer

Export logs to Cloud Storage with Standard storage class

Answer

Export logs to BigQuery dataset

Answer

Export logs to Pub/Sub topic

Question 10

A company is subject to ITAR regulations and needs to ensure that all data stored in GCP remains within the United States. They also require FIPS 140-2 Level 3 validation for encryption keys. Which two services should they use together to meet these requirements? (Choose 2)

Accepted Answer

Cloud HSM. Assured Workloads (D) is correct because it is the GCP service designed to enforce data residency and compliance controls, including ITAR and US-only data location restrictions, by applying policy guardrails to a folder or project. Cloud HSM (B) is correct because it provides FIPS 140-2 Level 3 validated hardware security modules for encryption key generation, storage, and cryptographic operations, satisfying the key protection requirement. Used together, Assured Workloads enforces the US data boundary while Cloud HSM supplies the required Level 3 validated key management. Cloud KMS with software keys (A) is not appropriate because software-backed keys only meet FIPS 140-2 Level 1, not Level 3. Cloud DLP (C) is a data discovery and redaction service, not a residency or key-validation control. Secret Manager (E) stores secrets such as API keys and passwords but does not provide FIPS 140-2 Level 3 HSM-backed keys or enforce ITAR data residency.

Answer

Cloud KMS with software keys

Answer

Cloud DLP

Answer

Secret Manager

Question 11

Your organization uses Cloud Armor to protect against web attacks. After a change to the security policy, legitimate traffic from certain IPs is being blocked. You need to quickly allow that traffic while preserving the security policy. What should you do?

Accepted Answer

Add a higher priority allow rule for those IPs. Adding a higher priority allow rule for the affected IPs is the correct approach because Cloud Armor evaluates rules in priority order (lowest number = highest priority), so a new allow rule with a lower priority number than the blocking rule will match first and permit the traffic. This preserves the existing security policy and its protections for all other traffic while surgically unblocking the legitimate IPs. It is the least disruptive, most targeted remediation.

Answer

Remove the offending rule from the security policy

Answer

Enable logging on the security policy

Answer

Set the security policy to preview mode

Question 12

A healthcare company stores patient data in BigQuery and needs to mask sensitive columns like SSN and email for analysts who do not need to see the actual values. They want to apply consistent masking across queries without modifying the underlying data. Which feature should they use?

Accepted Answer

BigQuery Data Policy with data masking rules. BigQuery Data Policy with data masking rules allows you to define column-level masking policies that automatically redact sensitive data (e.g., SSN, email) in query results based on the user's role, without altering the underlying table. This meets the requirement for consistent masking across all queries without modifying the source data.

Answer

IAM conditions on tables

Answer

Authorized views with row-level security

Answer

Cloud DLP de-identification transforms on export

Question 13

An organization uses Shared VPC with a host project and several service projects. A network administrator in a service project wants to create a firewall rule that allows traffic from a specific source CIDR to a Compute Engine instance in the service project. What is the correct way to achieve this?

Accepted Answer

Request the host project administrator to create the firewall rule in the host project.. In a Shared VPC architecture, firewall rules are a host-project-level resource. Service project administrators cannot create or manage firewall rules that apply to resources in the shared VPC network; only the host project administrator has the necessary permissions. Therefore, to allow traffic from a specific source CIDR to a Compute Engine instance in a service project, the host project administrator must create the firewall rule in the host project, targeting the instance's tags or service account.

Answer

Create the firewall rule in the service project targeting the instance's tags.

Answer

Create a firewall rule in the service project using the instance's service account.

Answer

Use VPC Flow Logs to generate a recommendation and apply it in the service project.

Question 14

A company uses Cloud Functions and wants to ensure that only authorized services can invoke them. The functions are triggered via HTTP. What is the best way to achieve this?

Accepted Answer

Use Cloud Endpoints with API keys and IAM.. Cloud Endpoints (or API Gateway) with API keys plus IAM provides authentication and authorization at the API layer, ensuring only authorized services with valid credentials can invoke the HTTP-triggered Cloud Functions. IAM controls which service accounts can invoke the function, while API keys/Endpoints handle API-level access control and rate limiting.

Answer

Set a VPC connector and allow only internal traffic.

Answer

Rely on the Cloud Functions URL being unguessable.

Answer

Use Firebase Authentication.

Question 15

A financial institution is required to store customer transaction data within the European Union to comply with GDPR data residency requirements. They want to prevent users from creating resources in any region outside the EU. Which organization policy constraint should they use?

Accepted Answer

constraints/gcp.resourceLocations. The organization policy constraint gcp.resourceLocations restricts the locations where Google Cloud resources can be created. By setting a list of allowed locations (e.g., europe-west1, europe-west4), resources cannot be created in non-EU regions.

Answer

constraints/compute.vmExternalIpAccess

Answer

constraints/iam.allowedPolicyMemberDomains

Answer

constraints/sql.restrictAuthorizedNetworks