PCSE Practice Test 13 — 15 Questions

Question 1

Refer to the exhibit. A security administrator is troubleshooting why a user cannot access a BigQuery dataset. The user analyst@example.com is not a member of data-team@example.com. The user is trying to query a table in the dataset. What is the most likely reason for the denial?

Accepted Answer

The user has the role roles/bigquery.dataViewer, which does not allow querying tables; it only allows viewing dataset metadata.. Option B is correct because the role roles/bigquery.dataViewer only grants permission to view dataset metadata (e.g., table names, schema) but does not include the bigquery.tables.getData permission required to actually query table rows. Since the user is not a member of data-team@example.com and has only this role, any query attempt will be denied with an access denied error.

Answer

The user needs to be added as a dataOwner to query tables.

Answer

The dataset policy includes a condition that the user does not satisfy.

Answer

The table itself might have additional restrictions such as row-level security.

Question 2

A healthcare organization stores Protected Health Information (PHI) in Cloud Storage. They need to de-identify data before sharing it with researchers. Which service should they use?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud Data Loss Prevention (DLP) is the correct service because it is specifically designed to inspect, classify, and de-identify sensitive data such as Protected Health Information (PHI). It uses built-in infoTypes (e.g., US_INDIVIDUAL_HEALTHCARE_NPI) and de-identification techniques like masking, tokenization, and redaction to transform PHI into a de-identified dataset before sharing with researchers, ensuring compliance with HIPAA.

Answer

Cloud Key Management Service (KMS)

Answer

VPC Service Controls

Answer

Cloud IAM

Question 3

Which three actions help protect Cloud KMS key material? (Choose three.)

Accepted Answer

Use VPC Service Controls to restrict access to the key.. B is correct because VPC Service Controls create a security perimeter around Cloud KMS resources, preventing data exfiltration by restricting access to the key material from unauthorized networks or projects. This helps protect the key material even if an attacker gains credentials to the key, as the request must originate from within the allowed VPC scope.

Answer

Store the key in an HSM cluster.

Answer

Assign the Cloud KMS Admin role to all developers.

Question 4

A security engineer is designing data protection for Cloud Storage. Which TWO methods can be used to enforce encryption at rest for objects? (Choose TWO.)

Accepted Answer

Setting a bucket-level default encryption with a CMEK key.. Option A is correct because setting a bucket-level default encryption with a CMEK (Customer-Managed Encryption Key) ensures that all new objects written to the bucket are encrypted at rest using a key managed by the customer in Cloud KMS. This enforces encryption at rest at the bucket level, meeting the requirement.

Answer

Enabling VPC Service Controls.

Answer

Applying a retention policy.

Answer

Using a bucket policy that requires the x-goog-encryption header for uploads.

Question 5

A company uses Cloud Functions to process employee data and wants to ensure that personally identifiable information (PII) is redacted from log output. Which approach should they take?

Accepted Answer

Use Cloud DLP API to inspect and redact the log message before writing to Cloud Logging.. Option B is correct because the Cloud DLP API can be integrated directly into a Cloud Function to inspect and redact PII from log messages before they are written to Cloud Logging. This ensures that sensitive data never appears in the logs, which is the most secure approach. Using Cloud DLP at the point of log generation prevents any exposure, rather than relying on post-hoc analysis or filtering.

Answer

Use Cloud Audit Logs to capture all access and redact at analysis.

Answer

Create a Logging sink with an exclusion filter to drop logs containing PII.

Answer

Enable VPC Service Controls to prevent PII from leaving the VPC.

Question 6

An organization uses Cloud DLP to scan a Cloud SQL database for PII. They want to automatically pseudonymize email addresses found in a specific column using a deterministic encryption that can be reversed for authorized users. The key must be stored in Cloud KMS. Which DLP transformation should they configure?

Accepted Answer

CryptoDeterministicConfig with a key from Cloud KMS.. Option B is correct because CryptoDeterministicConfig performs deterministic encryption (same plaintext always produces the same ciphertext) using a key from Cloud KMS, which allows pseudonymization that can be reversed by authorized users. This matches the requirement for a reversible, deterministic transformation on email addresses in a Cloud SQL column.

Answer

CryptoHashConfig with a cryptographic key from Cloud KMS.

Answer

CryptoReplaceFfxFpeConfig using a key from Cloud KMS.

Answer

ReplaceWithInfoTypeConfig with a cryptographic key.

Question 7

A healthcare organization needs to redact Social Security Numbers (SSNs) from patient records stored in Cloud Storage before sharing them with a research partner. They plan to use Cloud DLP. Which TWO actions should they take to configure the DLP job correctly? (Choose two.)

Accepted Answer

Apply a de-identification template that uses the 'redact' transformation on the identified SSNs.. Option A is correct because Cloud DLP de-identification templates allow you to specify a 'redact' transformation that completely removes or replaces the matched sensitive data, such as SSNs, from the content. This ensures that the output files shared with the research partner contain no trace of the original SSNs, meeting the redaction requirement.

Answer

Configure Access Transparency logs to track who accesses the objects.

Answer

Encrypt the objects with a CMEK key before running the DLP inspection.

Answer

Enable VPC Service Controls to prevent unauthorized access to the bucket.

Question 8

Refer to the exhibit. Based on the exhibit, the corporate security policy requires that all Cloud KMS symmetric keys have automatic rotation enabled. Which statement is true?

Accepted Answer

Only the encryption-key is compliant.. The corporate security policy requires automatic rotation for all Cloud KMS symmetric keys. In the exhibit, the 'encryption-key' has automatic rotation enabled (as indicated by the rotation period being set), while the 'decryption-key' does not have automatic rotation enabled (rotation period is not set or is disabled). Therefore, only the encryption-key is compliant with the policy.

Answer

Both keys are compliant.

Answer

Neither key is compliant.

Answer

Only the decryption-key is compliant.

Question 9

Refer to the exhibit. The security team created this key for encrypting database backups. After an audit, they found that data encrypted before May 1, 2023, cannot be decrypted. What is the most likely cause?

Accepted Answer

Key version 1 was deleted after the new primary was created.. Option B is correct because when a new primary key version is created in Cloud KMS, the old primary key version is not automatically deleted. However, if the old key version (version 1) was manually deleted after promoting version 2 as the primary, any data encrypted with version 1 becomes permanently undecryptable. The audit finding that data encrypted before May 1, 2023 cannot be decrypted directly indicates that the key version used for that encryption (likely version 1) is no longer available, not just disabled or rotated.

Answer

The rotation period is too short, causing old versions to be destroyed.

Answer

The primary key version is disabled.

Answer

The algorithm GOOGLE_SYMMETRIC_ENCRYPTION is not supported by HSM.

Question 10

Which TWO of the following are valid methods to protect data in transit between on-premises and Google Cloud using Cloud VPN?

Accepted Answer

Use Cloud VPN with IPsec IKEv2.. Cloud VPN supports both IPsec IKEv1 and IKEv2 as valid protocols for establishing secure tunnels between on-premises networks and Google Cloud. IKEv2 offers improved stability and mobility support, but both are explicitly supported by Google Cloud VPN for protecting data in transit.

Answer

Use Cloud VPN with SSL VPN.

Answer

Use Cloud NAT for outbound traffic.

Answer

Use Cloud Interconnect with MACsec.

Question 11

A financial services company wants to ensure that Google Cloud staff cannot access their encryption keys or the plaintext data. They must meet regulatory requirements for data sovereignty. Which combination of services should they use?

Accepted Answer

Use Cloud External Key Manager and enable Access Transparency logs.. Option C is correct because Cloud External Key Manager (EKM) allows you to manage encryption keys using a supported external key management partner, ensuring that Google Cloud staff cannot access your keys or plaintext data. Enabling Access Transparency logs provides you with logs of Google Cloud staff access to your data, which helps meet regulatory requirements for data sovereignty by giving you visibility into administrative actions.

Answer

Use CMEK with Cloud HSM and disable Access Transparency.

Answer

Use Customer-Supplied Encryption Keys (CSEK) without Access Transparency.

Answer

Use VPC Service Controls and Cloud DLP.

Question 12

A company is deploying a firewall appliance in a VPC to inspect traffic. They create custom routes to direct traffic to the appliance. Which step is necessary to ensure the appliance can forward traffic back?

Accepted Answer

Enable IP forwarding on the appliance instance. Option A is correct because the firewall appliance instance must have IP forwarding enabled at the OS level (e.g., net.ipv4.ip_forward=1 on Linux) to forward packets between its network interfaces. Without this, the instance will drop any traffic not destined for its own IP address, even if VPC routes direct packets to it. This is a prerequisite for the appliance to act as a transparent or routed next-hop in the VPC routing table.

Answer

Use a load balancer

Answer

Configure the appliance as a next hop in a route

Answer

Assign a public IP to the appliance

Question 13

A company wants to ensure that all data stored in Cloud Storage buckets is encrypted at rest using a customer-managed key that is automatically rotated every 90 days. What should they do?

Accepted Answer

Create a Cloud KMS key ring and a key with rotation period set to 7776000s (90 days).. Option A is correct because Cloud KMS allows you to create a customer-managed encryption key (CMEK) with an automatic rotation period of 7776000 seconds (90 days). When you set the rotation period on a key, Cloud KMS automatically rotates the key material at the specified interval, ensuring that all data encrypted with that key is protected by a new key version without manual intervention. This satisfies the requirement for customer-managed keys with automatic rotation.

Answer

Use customer-supplied encryption keys (CSEK) and update them manually every 90 days.

Answer

Use default Google-managed encryption keys.

Answer

Use Cloud HSM to generate a key and implement a custom rotation script.

Question 14

A company has configured a VPC firewall rule to allow HTTP traffic from a specific source IP range 203.0.113.0/24. However, HTTP requests from that range are being denied. Which initial verification should the security engineer perform?

Accepted Answer

Check the rule direction (ingress vs egress). Option D is correct because the rule is configured to allow HTTP traffic, but if the rule direction is set to egress instead of ingress, it will not apply to incoming HTTP requests from the source IP range. In Google Cloud VPC firewall rules, direction determines whether the rule applies to inbound (ingress) or outbound (egress) traffic; an egress rule only controls traffic leaving the VPC network, so HTTP requests arriving from the internet would be denied by the implied deny ingress rule.

Answer

Check if the source range overlaps with a deny rule

Answer

Check if the target instances have the correct network tag

Answer

Check the rule priority

Question 15

A security engineer wants to block all SSH access from the internet to a VPC network, except for a specific bastion host. What is the most efficient way to configure this?

Accepted Answer

Create a firewall rule allowing SSH only from the bastion host's IP and rely on the implicit deny. Option A is correct because VPC firewall rules are implicitly deny-all at the end of the evaluation order. By creating a single allow rule for SSH from the bastion host's IP, all other SSH traffic is implicitly denied by the default deny rule, without needing an explicit deny rule. This is the most efficient approach as it minimizes rule count and avoids potential priority conflicts.

Answer

Create a firewall rule with deny SSH from 0.0.0.0/0 and a higher priority rule allowing SSH from the bastion host's IP

Answer

Use a service perimeter

Answer

Create a firewall rule denying SSH from all IPs except the bastion host using the 'except' sources

PCSE Practice Test 13 — 15 Questions

Exhibit

PCSE Practice Test 13 — 15 Questions

Exhibit