PCSE Practice Test 13 — 15 Questions

Question 1

A company stores sensitive customer data in Cloud Storage and uses CMEK with Cloud KMS. They want to ensure that data in transit to the storage bucket is always encrypted using TLS 1.2 or higher. Which configuration should they implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the bucket's 'requireTls' transport security setting to 'true' in the bucket's IAM policy.. Setting the bucket's 'requireTls' transport security setting to 'true' in the bucket's IAM policy enforces that all requests to the bucket must use TLS 1.2 or higher. This is a bucket-level policy condition that directly controls the encryption of data in transit, ensuring that any HTTP request without TLS 1.2+ is denied.

Answer

Use Cloud Armor to enforce HTTPS with a TLS 1.2 minimum.

Answer

Configure the bucket to use CMEK with a key from Cloud HSM.

Answer

Add a bucket policy that denies requests with 'sslEnabled' set to 'false'.

Question 2

A multinational corporation must comply with GDPR requirements for storing and processing personal data of EU citizens. The company is using Google Cloud and wants to ensure that data remains within the European Union. Which TWO actions should the organization take? (Select TWO.)

Accepted Answer

Set up VPC Service Controls to block access from outside the EU.. VPC Service Controls create a security perimeter around Google Cloud resources, allowing you to restrict data access based on attributes like IP address or geographic location. By configuring VPC Service Controls to block access from outside the EU, the organization can enforce that data stored and processed in Google Cloud remains within the European Union, directly supporting GDPR compliance for data residency.

Answer

Enable Access Transparency logs to monitor access by Google support personnel.

Answer

Use Cloud Data Loss Prevention (DLP) to automatically redact personal data before storage.

Answer

Use CMEK with a key stored in Cloud HSM located in a US region to encrypt data.

Question 3

A security engineer wants to review all IAM permission changes made in the last 30 days. Which type of Cloud Audit Log should they query?

Accepted Answer

Admin Activity logs. Admin Activity logs contain all API calls that modify configurations or metadata, such as IAM policy changes. They are enabled by default and retained for 400 days. Data Access logs would capture read events but not permission changes, System Event logs are for GCP infrastructure actions, and Policy Denied logs record denied requests.

Answer

Data Access logs

Answer

System Event logs

Answer

Policy Denied logs

Question 4

A company runs a containerized application on Google Kubernetes Engine (GKE) that reads from a Cloud Storage bucket encrypted with a customer-managed key (CMEK) in Cloud KMS. The application uses a dedicated Google service account with the roles/storage.objectViewer role and a Cloud KMS CryptoKey Decrypter binding on the key. After a scheduled key rotation, the application started receiving '403 Access Denied' errors when accessing objects. The Cloud KMS key has multiple versions. The service account's IAM permissions have not changed. What is the most likely cause and the appropriate fix?

Accepted Answer

Ensure the service account has the 'Cloud KMS CryptoKey Decrypter' role on the key, which applies to all key versions, including the old version used for encryption.. In Cloud KMS, IAM permissions are evaluated at the key level, not per key version. When a key is rotated, the new primary version is automatically enabled, but the old version remains active for decrypting data encrypted with it. The service account already has the 'Cloud KMS CryptoKey Decrypter' role on the key, which grants permission to decrypt with any version of that key. The 403 error likely occurred because the application's client library or configuration was explicitly referencing the old key version ID, which may have been disabled or is no longer primary, but the IAM binding on the key itself is sufficient. The fix is to ensure the service account has the role on the key (which it does) and that the application uses the key resource name (not a specific version) to allow automatic use of the correct version.

Answer

In Cloud KMS, enable the new key version and ensure it is set as primary.

Answer

Create a new key ring and migrate the service account to use a new key.

Answer

Disable the old key version and re-encrypt all objects with the new key version.

Question 5

A startup is using Cloud Functions to process files uploaded to a Cloud Storage bucket. The Cloud Function is triggered by finalize events on the bucket. The developers created a service account for the Cloud Function and granted it the roles/storage.objectViewer role on the bucket. However, the function fails with a permission denied when trying to read the file. The function has the following XML in the event context: 'event_id'. What is the most likely issue?

Accepted Answer

The Cloud Function is using the default App Engine service account instead of the custom service account.. The most likely issue is that the Cloud Function is using the default App Engine service account instead of the custom service account that was granted the roles/storage.objectViewer role. When a Cloud Function is deployed without explicitly specifying a service account, it defaults to the App Engine default service account (project-id@appspot.gserviceaccount.com), which does not have the necessary permissions to read the file. The custom service account with the objectViewer role exists but is not assigned to the function, causing the permission denied error.

Answer

The service account does not exist.

Answer

The bucket is in a different project, and cross-project access is not configured.

Answer

The Cloud Function is not configured to be triggered by the correct event type.

Question 6

An organization wants to grant a CI/CD pipeline (running on GitHub Actions) access to deploy resources in a GCP project without storing long-lived service account keys. Which approach is recommended?

Accepted Answer

Use Workload Identity Federation with GitHub as an identity provider.. Workload Identity Federation allows binding an external identity provider (like GitHub Actions) to a GCP service account. The GitHub Actions workflow can exchange a GitHub OIDC token for a GCP access token, no static keys needed.

Answer

Use a service account with the role roles/iam.serviceAccountTokenCreator.

Answer

Create a service account and store the JSON key as a GitHub secret.

Answer

Create a compute instance with a service account and run the pipeline from there.

Question 7

What is the purpose of Identity-Aware Proxy (IAP) in Google Cloud?

Accepted Answer

To authenticate users and enforce access policies for applications and VMs based on identity and context.. IAP provides zero-trust access control for web applications and SSH/RDP connections. It verifies user identity and context (device, location) before granting access, without requiring VPNs.

Answer

To manage API keys for services running on Google Cloud.

Answer

To provide network-level firewall rules for HTTP traffic.

Answer

To encrypt data in transit between clients and Google Cloud.

Question 8

A company has a Google Cloud organization with multiple folders representing departments. The security team wants to enforce that all Compute Engine VMs in the organization must have Shielded VM enabled. Which approach should the team use to enforce this requirement?

Accepted Answer

Apply an organization policy with the constraint constraints/compute.requireShieldedVm at the organization level.. Organization policies with constraints can be applied at the organization level and are inherited by all descendants. The constraint constraints/compute.requireShieldedVm enforces Shielded VM on all new VMs. Deny policies are for IAM permissions, not resource configurations. VPC Service Controls is for data exfiltration prevention.

Answer

Use VPC Service Controls to restrict VM creation.

Answer

Create a deny policy that denies the compute.instances.create permission unless Shielded VM is enabled.

Answer

Configure a custom role that includes the permission to create VMs only if Shielded VM is enabled.

Question 9

An organization uses Cloud Identity with a third-party IdP via SAML 2.0. A security engineer needs to enforce that all Google Cloud access requires multi-factor authentication (MFA) from the IdP. What is the recommended approach?

Accepted Answer

Require MFA in the third-party IdP before it issues SAML assertions.. The best practice is to configure MFA at the IdP level because the IdP is the authoritative source for authentication. This ensures MFA is enforced before SAML assertion is issued, and it works for all applications relying on that IdP, including Google Cloud. Enforcing MFA on Google Cloud side via IAP or context-aware access is possible but not the recommended primary enforcement for SAML federated users; it should be done at the IdP.

Answer

Create an organization policy constraint requiring the use of security keys for all users.

Answer

Enable MFA enforcement in the Cloud Identity admin console for all users.

Answer

Configure a context-aware access level in Access Context Manager that requires MFA, and apply it to Google Cloud resources.

Question 10

A security administrator needs to deploy a solution that allows a group of developers to access a web application running on Compute Engine behind an internal HTTP load balancer. The solution must enforce access based on user identity and device security status, and must not expose the application to the public internet. Which THREE components are required?

Accepted Answer

Access Context Manager (Access Levels). Identity-Aware Proxy (IAP) provides identity and context-aware access. An internal HTTP load balancer keeps the app private. Context-aware access requires an access level (e.g., based on device policy). IAP uses access levels to enforce security.

Answer

Cloud NAT

Answer

Cloud Armor

Question 11

A Google Kubernetes Engine (GKE) cluster has applications that need to access Cloud Storage. The security team wants to grant fine-grained access per pod. What is the recommended approach?

Accepted Answer

Use Workload Identity: map each Kubernetes service account to a dedicated GCP service account with minimal permissions.. Workload Identity for GKE allows you to bind a Kubernetes service account to a GCP service account. Pods running with that Kubernetes SA can then authenticate as the GCP SA to access GCP resources. This provides pod-level granularity.

Answer

Use node-level service accounts and rely on network policies to restrict pod access.

Answer

Store service account keys as Kubernetes secrets and mount them into pods.

Answer

Create a single GCP service account with Storage permissions, and use it for all pods in the cluster.

Question 12

A company wants to implement single sign-on (SSO) for its employees to access the Google Cloud Console using their existing corporate credentials from an on-premises Active Directory. Which THREE components are required? (Choose 3)

Accepted Answer

Cloud Directory Sync to synchronize user and group objects from Active Directory to Google Cloud Directory.. SAML 2.0 federation requires a SAML Identity Provider (AD FS or similar) to authenticate users, Cloud Identity or Google Workspace as the identity platform to configure the SAML trust, and Cloud Directory Sync to synchronize users from AD to Google Cloud Directory so that users exist in Google's directory for IAM binding.

Answer

Workload Identity Federation to map AD users to service accounts.

Answer

A VPN connection between the on-premises network and Google Cloud.

Question 13

A company wants to enforce that no service account keys are created for service accounts in a specific project. Additionally, they want to allow only users from their corporate domain (example.com) to be granted IAM roles. Which TWO organization policy constraints should they apply at the project level?

Accepted Answer

constraints/iam.allowedPolicyMemberDomains. The constraint 'constraints/iam.disableServiceAccountKeyCreation' prevents key creation. 'constraints/iam.allowedPolicyMemberDomains' restricts IAM members to specified domains. Both can be applied at the project level.

Answer

constraints/iam.workloadIdentityPoolProviders

Answer

constraints/compute.requireShieldedVm

Answer

constraints/compute.restrictCloudArmorPolicies

Question 14

An organization wants to allow users to authenticate to Google Cloud using their existing Active Directory credentials via SAML 2.0. Which Google Cloud identity service should they configure?

Accepted Answer

Cloud Identity. Cloud Identity or Google Workspace can be configured as a SAML 2.0 service provider (or identity provider) to federate with an external IdP like Active Directory. For SAML 2.0 SSO, Cloud Identity supports integration with external IdPs. Cloud Directory Sync syncs users but doesn't handle SSO. IAP is for access control, not identity federation.

Answer

Workload Identity Federation

Answer

Identity-Aware Proxy

Answer

Cloud Directory Sync

Question 15

Which of the following is a benefit of using organization policies over IAM policies for enforcing restrictions on resources?

Accepted Answer

Organization policies can restrict resources even if the user has Owner role.. Organization policies can enforce restrictions on resources regardless of the IAM roles assigned to users. They are applied to resources, not identities, and are evaluated before IAM policies.

Answer

Organization policies can grant permissions to users.

Answer

Organization policies are applied to identities.

Answer

Organization policies are easier to audit than IAM policies.