PCSE Practice Test 13 — 15 Questions

Question 1

A company needs to meet compliance requirements that mandate they be notified about all actions performed by Google personnel on their data. Which Google Cloud feature should they enable?

Accepted Answer

Access Transparency. Access Transparency provides logs that record when Google personnel access customer data. It is specifically designed to meet compliance requirements for notification of Google personnel actions on customer data. It provides near real-time logs of such access.

Answer

Cloud Asset Inventory

Answer

Access Approval

Answer

Cloud Audit Logs for Admin Activities

Question 2

A government contractor uses Google Cloud with Assured Workloads. They need to ensure that data stored in BigQuery is encrypted with keys generated and stored in a Cloud HSM key ring located in a specific region. The keys must be rotated every 90 days. Which approach meets these requirements?

Accepted Answer

Create a Cloud HSM key ring in the desired region, create a key with a rotation period of 90 days, and use that key to protect the BigQuery dataset via CMEK.. It uses a Cloud HSM key ring in the desired region, which meets the requirement for hardware-backed key generation and storage. Setting a rotation period of 90 days on the key satisfies the rotation requirement, and using that key as a customer-managed encryption key (CMEK) for BigQuery ensures data is encrypted with the specified key.

Answer

Use Cloud KMS with a software key and enable automatic rotation of 90 days.

Answer

Create a Cloud HSM key ring and manually rotate keys every 90 days.

Answer

Use Cloud External Key Manager (EKM) with an external key management partner.

Question 3

A company uses CMEK with Cloud HSM to encrypt a BigQuery table. The security engineer accidentally deleted the key in Cloud KMS. The key is now in a 'pending destruction' state with a grace period of 24 hours. Which action should the engineer take to restore the key and avoid data loss?

Accepted Answer

Restore the key by canceling the destruction within the grace period. When a Cloud KMS key is deleted, it enters a 'pending destruction' state with a configurable grace period (default 24 hours). During this window, the key is not yet destroyed and can be restored by canceling the scheduled destruction. This action returns the key to an enabled state, allowing BigQuery to continue decrypting data encrypted with that key. Since the key material is still intact, canceling destruction is the correct and only way to restore the key without data loss.

Answer

Recreate the key with the same name and version

Answer

Wait for the grace period to expire and then use a backup key

Answer

Use Access Transparency logs to recover the key material

Question 4

A company wants to expose an internal web service running on a private GKE cluster to other services within the same VPC network using a private IP address. They do not want to use a public load balancer. Which Google Cloud service should they use?

Accepted Answer

Internal load balancer. An Internal Load Balancer in Google Cloud provides a private IP address within the VPC and distributes traffic to backend services like those running on a private GKE cluster. It is the correct choice for exposing an internal service to other services in the same VPC without using a public load balancer.

Answer

Cloud NAT

Answer

Private Service Connect

Answer

Cloud VPN

Question 5

A company uses Cloud Armor to protect their HTTP Load Balancer from DDoS attacks. They want to block requests from a specific malicious IP address range, 203.0.113.0/24. Which Cloud Armor policy configuration should they use?

Accepted Answer

Create a deny rule with a source IP condition for 203.0.113.0/24 and set priority to 1000.. Cloud Armor security policies use priority-based rules, where lower numbers indicate higher priority. A deny rule with priority 1000 for the specific IP range 203.0.113.0/24 ensures that traffic from that range is blocked before any lower-priority allow rules are evaluated. This is the standard method to block specific IP ranges while allowing other traffic.

Answer

Create an allow rule with source IP condition for their own IP ranges and rely on default deny.

Answer

Create a rule with a 'source-ip' tag set to 'malicious' and assign to the load balancer.

Answer

Create a deny rule with priority 1000000 for the IP range.

Question 6

A company wants to implement a vulnerability management program for their Google Cloud environment. They need to scan Compute Engine instances for OS vulnerabilities and container images for known vulnerabilities. Which two services should they use? (Choose two.)

Accepted Answer

VM Manager (OS patch assessment). VM Manager's OS patch assessment (option A) is correct because it evaluates Compute Engine VM instances against OS vulnerability and patch baselines, giving the OS-level vulnerability scanning the company needs. Container Analysis with Artifact Registry vulnerability scanning (option C) is correct because it automatically scans container images stored in Artifact Registry for known OS and language package vulnerabilities, covering the container image requirement. Cloud Security Scanner (option B) is a legacy App Engine/Compute Engine web app scanner for XSS and mixed content, not an OS or container image vulnerability scanner. Binary Authorization (option D) is a deploy-time policy control that enforces attestations on container images, not a vulnerability scanner. Web Security Scanner (option E) scans web applications for common web vulnerabilities, not OS or container image CVEs.

Answer

Cloud Security Scanner

Answer

Binary Authorization

Answer

Web Security Scanner

Question 7

A large enterprise runs a streaming data pipeline using Dataflow to process events from Pub/Sub, apply aggregations with fixed windows, and write results to BigQuery. They are experiencing high costs and long processing times. The Dataflow job uses Streaming Engine, but the workers show high CPU utilization. The pipeline has autoscaling enabled, but the number of workers rarely increases. The team wants to reduce processing time and cost. What should they do?

Accepted Answer

Optimize the windowing interval to reduce data shuffling.. Optimizing the windowing interval reduces data shuffling and can improve performance without adding resources. Long windows cause more state to be kept, increasing CPU and memory demands. Option A is incorrect because increasing maxNumWorkers may help but the job is already CPU-bound and not scaling; more workers might not reduce CPU per worker if the issue is data shuffling. Option B is incorrect because larger machines increase cost and may not address the root cause. Option D is incorrect because switching to batch would not meet real-time requirements and may cause data loss.

Answer

Use a larger machine type for workers, such as n1-standard-8.

Answer

Increase the number of workers by setting maxNumWorkers higher.

Answer

Switch from Streaming Engine to batch mode to reduce resource overhead.

Question 8

A security team is configuring Cloud Armor to protect a web application. They need to block requests that contain SQL injection patterns, block requests from a known malicious IP list, and limit requests from any single IP to 2000 requests per minute. Which THREE actions must they take? (Choose three.)

Accepted Answer

Create a custom rule with a deny action for the malicious IP list using a CEL expression. To implement these requirements, you need to enable the preconfigured SQL injection rule set, create a custom rule with an IP allow/deny list for the malicious IPs, and create a rate limiting rule. Cloud Armor does not have a built-in list of malicious IPs; you must provide the list. The rate limiting is configured as a separate rule with action 'rateBasedThrottle'.

Answer

Create a single rule that combines SQLi detection, IP blocking, and rate limiting using CEL

Answer

Enable Cloud Armor Managed Protection Plus for automatic IP reputation

Question 9

A company wants to allow a Compute Engine VM to access a Cloud SQL instance without exposing the SQL instance to the internet. The VM is in the same VPC but different subnet. Which configuration is required?

Accepted Answer

Create a private IP for the Cloud SQL instance using Private Services Access, grant the VM's service account the Cloud SQL Client role, and ensure the VM is in the same VPC.. Cloud SQL requires a private services access connection and the VM must have the cloudsql.client role to connect. Option A is wrong because the Cloud SQL Proxy can be used but requires a public IP if not within the VPC. Option B is wrong because VPC peering alone does not grant IAM permissions. Option D is wrong because a firewall rule is not sufficient without IAM.

Answer

Use the Cloud SQL Proxy on the VM and a public IP for the Cloud SQL instance.

Answer

Configure VPC peering between the VM's subnet and the Cloud SQL instance's VPC.

Answer

Add a firewall rule allowing ingress from the VM's IP to the Cloud SQL instance's internal IP.

Question 10

A security engineer needs to provide secure SSH access to a Compute Engine instance that has no external IP address. What is the recommended method?

Accepted Answer

Use Identity-Aware Proxy (IAP) TCP forwarding.. Identity-Aware Proxy (IAP) TCP forwarding allows SSH access to instances without external IP addresses. Option A is incorrect because VPC peering connects VPC networks, not provide SSH access. Option B is incorrect because Cloud NAT is for outbound internet access, not inbound SSH. Option C is incorrect because a firewall rule allowing SSH from any IP would still require the instance to have an external IP address.

Answer

Set up VPC peering with the instance's VPC.

Answer

Create a Cloud NAT to allow inbound SSH.

Answer

Add a firewall rule allowing SSH from any IP.

Question 11

A company wants to allow an external auditor to view all IAM policies in a project but not modify them. The auditor's Google account is from a different domain. Which IAM role should be assigned?

Accepted Answer

roles/iam.securityReviewer. The roles/iam.securityReviewer role grants permission to view IAM policies and other security settings without write access. roles/viewer does not include iam.roles.list or iam.policies.get. roles/iam.roleViewer only lists roles, not policies. roles/securityAdmin includes write permissions.

Answer

roles/iam.roleViewer

Answer

roles/viewer

Answer

roles/securityAdmin

Question 12

A DevOps engineer needs to create a custom IAM role that allows creating and deleting Compute Engine instances but not stopping or starting them. Which permissions should be included?

Accepted Answer

compute.instances.create and compute.instances.delete. To create and delete instances, the permissions compute.instances.create and compute.instances.delete are required. compute.instances.stop and compute.instances.start are separate permissions for stopping/starting. compute.instances.update is for modifying existing instances.

Answer

compute.instances.start and compute.instances.stop

Answer

compute.instances.create, compute.instances.delete, and compute.instances.update

Answer

compute.instances.create

Question 13

An organization needs to audit when Google administrators access their customer content stored in GCP. Which service provides near-real-time logs of such access?

Accepted Answer

Access Transparency. Access Transparency provides near-real-time logs when Google staff access customer content, offering visibility into administrative actions.

Answer

VPC Flow Logs

Answer

Cloud Monitoring

Answer

Cloud Audit Logs

Question 14

A company using Cloud KMS wants to automatically rotate a symmetric encryption key every 90 days. What is the correct way to configure this?

Accepted Answer

Set the rotation period on the cryptographic key to 90 days. In Cloud KMS, automatic rotation is configured on the cryptographic key itself, not on the key ring. The rotation period is set when creating or updating a key, and it applies to symmetric encryption keys. Setting the rotation period to 90 days on the key ensures that a new key version is generated every 90 days, and the old versions are retained for decryption. This is the correct way to automate key rotation.

Answer

Set the key purpose to ASYMMETRIC_SIGN for automatic rotation

Answer

Set the rotation period to 90 days when creating the key ring

Answer

Use Cloud Scheduler to call `cloudkms.rotateKey` every 90 days

Question 15

A company is migrating a PCI DSS-compliant application to GCP. They need to meet encryption requirements for cardholder data. Which TWO options satisfy PCI DSS encryption requirements? (Choose two.)

Accepted Answer

Use Cloud External Key Manager (EKM) with a supported partner.. PCI DSS requires strong encryption; TLS 1.2+ is required for data in transit, and CMEK for data at rest provides customer-managed keys that meet compliance.

Answer

Use SHA-1 for SSL certificates.

Answer

Use default Google encryption keys (Google-managed) for data at rest.

Answer

Use TLS 1.0 for data in transit.