PCSE Practice Test 14 — 15 Questions

Question 1

An organization needs to scan container images stored in Artifact Registry for vulnerabilities before deployment. They want to use a managed service that integrates with their CI/CD pipeline. Which Google Cloud service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Container Analysis. Container Analysis is the Google Cloud managed service that performs vulnerability scanning on container images stored in Artifact Registry (and previously Container Registry). It integrates natively with CI/CD pipelines by exposing scan results via the Container Analysis API and Pub/Sub notifications, allowing builds to be gated on vulnerability findings. This makes it the correct choice for pre-deployment image scanning in a managed, pipeline-friendly way.

Answer

Web Security Scanner

Answer

Cloud Security Scanner

Answer

VM Manager patch management

Question 2

A company needs to respond to a GDPR data subject deletion request for a user's data stored across BigQuery and Cloud Storage. The data must be completely erased upon request. What is the most effective approach to ensure compliance?

Accepted Answer

Use Cloud DLP to identify the user's data across services, delete the data using API calls, and verify deletion with Cloud Audit Logs. Cloud DLP can be used to inspect and classify the user's data across BigQuery and Cloud Storage, then you can programmatically delete the identified data via API calls. Cloud Audit Logs provide a verifiable record that the deletion was performed, which is essential for demonstrating compliance with GDPR's right to erasure.

Answer

Set up BigQuery time-based table expiration and Cloud Storage lifecycle policies with a 1-day deletion rule

Answer

Use Cloud Identity-Aware Proxy to block the user's access and mark the data as deleted

Answer

Enable Access Transparency logs and request Google to delete the data on their behalf

Question 3

An organization uses Binary Authorization with multiple attestors. They want to allow a deployment only if at least two attestors have signed the image. Which policy type should be used?

Accepted Answer

Require attestation with a list of attestors and a minimum number of 2. Binary Authorization allows you to define a policy with multiple attestors and set a minimum number of attestations required.

Answer

Allow all images

Answer

Require attestation with a single attestor

Answer

Deny all images

Question 4

An organization needs to store API keys for external services. Which Google Cloud service is designed for secure storage of secrets such as API keys, passwords, and certificates?

Accepted Answer

Secret Manager. Google Cloud Secret Manager is purpose-built for storing, managing, and accessing secrets like API keys, passwords, and certificates. It provides versioning, IAM-based access control, audit logging, and automatic rotation capabilities, making it the correct service for secure secret storage.

Answer

Cloud KMS

Answer

Cloud Datastore

Answer

Cloud HSM

Question 5

A company is using Cloud SQL for MySQL to store customer data subject to SOX compliance. They need to ensure that all database changes are audited and that logs are immutable. They have enabled audit logs and exported them to a Cloud Storage bucket. However, the auditor discovers that some logs were deleted from the bucket. What is the most likely cause?

Accepted Answer

The Cloud Storage bucket has a lifecycle rule that deletes objects after a set number of days.. Cloud Storage lifecycle rules can automatically delete objects after a specified number of days. If a lifecycle rule is configured on the bucket, it would delete audit logs regardless of the export process, making them unavailable to the auditor. This is the most likely cause of logs being deleted from the bucket, as the other options do not explain actual deletion of already-exported objects.

Answer

The log sink filter is excluding certain events, causing incomplete export.

Answer

The bucket has retention policy enabled, which prevents deletion until the retention period expires.

Answer

The service account used for export does not have the storage.objects.delete permission.

Question 6

A security engineer needs to enforce that all new Compute Engine disks are created in a specific geographic region to meet data residency requirements. Which organization policy constraint should they use?

Accepted Answer

gcp.resourceLocations. The constraint 'gcp.resourceLocations' restricts where Google Cloud resources can be created. It can be set to a list of allowed locations. The other constraints: 'iam.allowedPolicyMemberDomains' restricts member domains, 'compute.skipDefaultNetworkCreation' prevents default network creation, 'constraints/compute.trustedImageProjects' restricts image projects.

Answer

constraints/compute.trustedImageProjects

Answer

compute.skipDefaultNetworkCreation

Answer

iam.allowedPolicyMemberDomains

Question 7

A financial institution is deploying a PCI DSS-compliant cardholder data environment (CDE) on Google Cloud. They need to segment the CDE from other environments and restrict data egress from the CDE. Which two services should they use together? (Choose the best combination.)

Accepted Answer

VPCs and VPC Service Controls. For PCI DSS network segmentation, VPCs provide network isolation, and VPC Service Controls enforce perimeter security by preventing data egress from the CDE to unauthorized destinations. Cloud NAT provides outbound internet access but does not restrict egress. Cloud Armor is a WAF for inbound traffic. Cloud VPN connects on-premises but does not segment.

Answer

Cloud VPN and VPC Service Controls

Answer

VPCs and Cloud NAT

Answer

VPC Service Controls and Cloud Armor

Question 8

A security engineer is configuring Cloud Armor to protect a global external HTTP(S) Load Balancer. Which TWO of the following are valid Cloud Armor security policies? (Choose two.)

Accepted Answer

Preconfigured OWASP Top 10 rules. Cloud Armor includes preconfigured rules that map directly to the OWASP Top 10 web application vulnerabilities, such as SQL injection and cross-site scripting (XSS). These rules are managed by Google and automatically updated to protect against the latest attack patterns, making them a valid security policy for a global external HTTP(S) Load Balancer.

Answer

Web Security Scanner scan rule

Answer

Signed URL policy

Answer

Preconfigured Identity-Aware Proxy (IAP) rule

Question 9

A DevOps team wants to allow a CI/CD pipeline to deploy to Compute Engine using a service account. What is the best practice for managing service account keys?

Accepted Answer

Use workload identity federation.. Workload identity federation is the best practice because it allows the CI/CD pipeline to impersonate a service account without managing or storing any long-lived service account keys. This eliminates the risk of key leakage and rotation overhead, as authentication is done via an external identity provider (e.g., GitHub Actions, GitLab CI) using OIDC tokens. Google Cloud's workload identity federation supports OIDC (OpenID Connect) and SAML 2.0, enabling secure, keyless access from external workloads.

Answer

Use a service account key distributed to each developer.

Answer

Generate a key and store it in Cloud Secret Manager.

Answer

Use a service account key stored in the source code repository.

Question 10

A company uses Cloud KMS to protect encryption keys for their Cloud SQL databases. They want to rotate keys every 30 days and ensure that old keys are retained for at least 90 days. What is the recommended approach?

Accepted Answer

Use a Cloud KMS key with automatic rotation period of 30 days and disable old key versions after 90 days.. Cloud KMS supports automatic key rotation with a configurable period (e.g., 30 days), which creates new key versions automatically. To meet the 90-day retention requirement, you can disable old key versions after 90 days using the key version lifecycle policy, ensuring they are not used for encryption but remain available for decryption of older data.

Answer

Use a Cloud KMS key with manual rotation every 30 days and keep all key versions indefinitely.

Answer

Use Cloud HSM to generate a key and set key version lifecycle to disable after 90 days.

Answer

Use customer-supplied encryption keys (CSEK) and rotate them manually.

Question 11

A developer is creating a Cloud Function that needs to access a Cloud SQL database. They have granted the function's service account the Cloud SQL Client role. However, the function still gets permission denied. What is the most likely issue?

Accepted Answer

The Cloud SQL instance is not configured with an authorized network that includes the function's IP range, or the function is not using the Cloud SQL Auth proxy.. Even with the Cloud SQL Client role, the function cannot connect unless the network path is allowed. Cloud Functions run outside the VPC by default, so they must either use the Cloud SQL Auth proxy (via a Unix socket or connector) or the Cloud SQL instance must authorize the function's egress IP range. Without one of these, connections are refused despite correct IAM permissions.

Answer

The service account needs the Cloud SQL Admin role instead.

Answer

The function must use a VPN to connect to Cloud SQL.

Answer

The function needs to be in the same region as the Cloud SQL instance.

Question 12

An organization wants to restrict access to Google Cloud APIs such as BigQuery and Cloud Storage so that only resources within a specific VPC network can call these APIs, and no traffic from other VPCs or on-premises networks is allowed. Which Google Cloud service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls create service perimeters that restrict access to Google Cloud APIs based on the requesting network's context. This prevents data exfiltration and ensures only resources in the specified VPC can access the APIs.

Answer

Firewall Rules

Answer

Identity-Aware Proxy

Answer

Cloud Armor

Question 13

An organization has multiple GCP projects managed through folders in the resource hierarchy. They want to enforce a policy that prohibits the creation of service account keys across all projects. Which approach should be used?

Accepted Answer

Apply an organization policy with the constraint 'constraints/iam.disableServiceAccountKeyCreation' at the folder level.. Organization policies can be applied at the folder or organization level to enforce constraints across all projects. The constraint 'constraints/iam.disableServiceAccountKeyCreation' specifically disables service account key creation. Applying it at a folder level is the most efficient way to enforce the policy across all projects in that folder.

Answer

Use a deny policy at the project level to deny the 'iam.serviceAccountKeys.create' permission.

Answer

Configure a script that runs daily to delete any service account keys found in projects.

Answer

Create a custom IAM role that denies the permission to create keys and assign it to all users.

Question 14

A company needs to grant a service account the ability to manage Compute Engine instances (start, stop, create) in a specific set of projects. The administrator wants to follow the principle of least privilege. Which TWO steps should the administrator take? (Choose TWO.)

Accepted Answer

Use IAM Conditions to restrict the service account's access to only the required projects or resources.. IAM Conditions allow the administrator to restrict the service account's permissions to a specific set of projects or resources, enforcing least privilege by limiting the scope of the granted role. This ensures the service account can only manage Compute Engine instances in the designated projects, not all projects in the folder or organization.

Answer

Grant the predefined roles/compute.viewer role to the service account at the folder level.

Answer

Use Cloud IAP to tunnel into Compute Engine instances to perform management tasks.

Answer

Grant the predefined roles/compute.admin role to the service account at the organization level.

Question 15

An organization's security policy requires that all audit logs be stored in a separate project for centralized monitoring. Which Google Cloud service should be used to aggregate logs from multiple projects?

Accepted Answer

Cloud Logging with log sinks. Cloud Logging with log sinks allows you to route logs from multiple projects to a centralized destination, such as a separate project's log bucket, Pub/Sub topic, or BigQuery dataset. This enables centralized monitoring and compliance with audit log storage requirements. Log sinks are the correct mechanism for aggregating logs across projects.

Answer

Cloud Monitoring

Answer

Cloud Audit Logs

Answer

Security Command Center