PCSE Practice Test 14 — 15 Questions

Question 1

An organization wants to grant a DevOps team the ability to create and manage service accounts in a specific project, but prevent them from deleting existing service accounts or managing IAM policies. Which IAM role should be assigned to the team?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

roles/iam.serviceAccountAdmin. The roles/iam.serviceAccountAdmin role grants permissions to create, update, and delete service accounts, but not to manage IAM policies for them. The basic role (Editor) is too permissive, ServiceAccountUser only allows using existing service accounts, and ServiceAccountKeyAdmin focuses on key management.

Answer

roles/iam.serviceAccountUser

Answer

roles/iam.serviceAccountKeyAdmin

Answer

roles/editor

Question 2

A company wants to grant a group of external auditors read-only access to all resources in a GCP project. The auditors authenticate via a SAML 2.0 identity provider. What is the most secure way to grant access?

Accepted Answer

Create a Cloud Identity group, add the auditors, and assign the Viewer role to the group at the project level.. Cloud Identity groups can be used to manage access. The auditors should be added to a Google Group, and that group is assigned the Viewer role at the project level. This avoids managing individual accounts. IAP is for application access, not project-level. Service accounts are for workloads. Custom roles are not needed for read-only.

Answer

Create a service account for each auditor and assign the Viewer role.

Answer

Use IAP to restrict access to the GCP console.

Answer

Create a custom role with only list permissions and assign to each auditor individually.

Question 3

A company wants to deploy a containerized application on GKE that needs to access Cloud SQL. They want to avoid storing database credentials in the application. Which THREE components should they use?

Accepted Answer

Cloud SQL Auth Proxy (sidecar container). Workload Identity binds a Kubernetes service account to a GCP service account. The Cloud SQL Auth Proxy provides secure access to Cloud SQL using IAM database authentication. IAM database authentication allows the service account to authenticate to Cloud SQL without passwords.

Answer

Cloud SQL private IP

Answer

Service account key stored in a Kubernetes secret

Question 4

An organization has a folder-level organization policy that enforces 'constraints/compute.requireShieldedVm'. A development team wants to create a test VM that does not use Shielded VM features. What is the correct approach?

Accepted Answer

Override the organization policy at the project level to set the constraint to 'not enforce' for that project.. Organization policies can be overridden at a lower level in the resource hierarchy using policy inheritance rules. The dev team should request an exemption for their project or folder by creating a policy override that sets the constraint to 'not enforce'. This must be done by a user with the appropriate organization policy administrator role.

Answer

Create the VM in a different folder that does not have the policy.

Answer

Use a custom role that bypasses the organization policy.

Answer

Create the VM with Shielded VM disabled; the policy will not apply to test projects.

Question 5

A company has multiple GCP projects managed under a single organization node. They want to enforce that all Compute Engine VMs are created with Shielded VM features enabled. Which approach should they use?

Accepted Answer

Use the organization policy service with the constraint constraints/compute.requireShieldedVm at the organization level.. Organization policies can enforce constraints across projects. The constraint constraints/compute.requireShieldedVm can be applied at the organization, folder, or project level to require Shielded VM on all new VMs. IAM roles don't enforce configuration, and gcloud commands are manual. Deny policies are for permission denial, not resource configuration.

Answer

Run a gcloud command after each VM creation to enable Shielded VM.

Answer

Apply a deny policy that denies the compute.instances.create permission if Shielded VM is not enabled.

Answer

Create a custom IAM role that includes compute.instances.create permission and assign it to all users.

Question 6

A company wants to enforce that all Compute Engine instances are created with a specific set of tags for compliance. They also want to audit any changes to firewall rules. Which two Google Cloud services or features should they use? (Choose TWO.)

Accepted Answer

Cloud Audit Logs. Organization policies can enforce VM creation with tags via a custom constraint. Cloud Audit Logs can log changes to firewall rules for auditing. IAM is for permissions, not enforcement. Cloud Monitoring is for metrics. Cloud Deployment Manager is for infrastructure deployment but not continuous enforcement.

Answer

Cloud Deployment Manager

Answer

Cloud IAM

Answer

Cloud Monitoring

Question 7

A company uses Active Directory (AD) on-premises and wants to implement SSO for Google Cloud Console access. They want to maintain user lifecycle management (create/disable accounts) from AD. Which TWO components are required?

Accepted Answer

Cloud Directory Sync (CDS). Cloud Directory Sync synchronizes users from AD to Google Cloud Directory. SAML SSO with Cloud Identity allows users to sign in using their AD credentials. Both are needed: CDS for provisioning, SAML for authentication.

Answer

Workload Identity Federation

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud VPN

Question 8

An engineer needs to grant a group of external auditors read-only access to all resources in a specific project. The auditors authenticate via an external SAML 2.0 IdP. What is the most secure and efficient way to set this up?

Accepted Answer

Use Cloud Directory Sync to sync the auditors from the external IdP as Google Groups, then grant the group Viewer role.. The correct approach is to create a Google Group and configure SAML SSO for Cloud Identity. Then, grant the Google Group the 'Viewer' role at the project level. The auditors authenticate via SAML and become members of the group, inheriting the permissions.

Answer

Create individual Google accounts for each auditor and assign them the Viewer role.

Answer

Configure IAP with the external IdP and grant access to the project's resources through IAP.

Answer

Create a custom role with read-only permissions and assign it to each auditor individually.

Question 9

A company has a Kubernetes cluster on GKE that runs a microservice. The microservice needs to read from a Cloud Spanner database. The security team requires that the microservice uses the principle of least privilege and that credentials are never stored as Kubernetes secrets. What is the recommended configuration?

Accepted Answer

Enable Workload Identity, create a Kubernetes service account, and annotate it to map to a Google Cloud service account with the necessary roles.. Using Workload Identity, you bind a Kubernetes service account to a Google Cloud service account that has the necessary Spanner roles. The GKE node's metadata server provides the credentials, and the application uses the Kubernetes service account identity.

Answer

Use the Compute Engine default service account for the node pool.

Answer

Create a Kubernetes secret containing a service account key and mount it into the pod.

Answer

Assign the required IAM roles to the GKE node's default service account and use it from the pod.

Question 10

Which IAM role type is recommended for granting fine-grained permissions to Google Cloud services in production?

Accepted Answer

Predefined roles. Predefined roles are curated by Google and provide granular permissions for specific services. They are designed for production use. Basic roles (Owner/Editor/Viewer) are broad and not recommended. Custom roles can be used if predefined roles are insufficient, but predefined are preferred for simplicity and maintainability.

Answer

Basic roles (Owner, Editor, Viewer)

Answer

Custom roles

Answer

Primitive roles

Question 11

A company wants to allow users to access an internal web application running on Compute Engine behind a load balancer without requiring a VPN. The solution must authenticate users and enforce access based on user identity and context (e.g., device security). Which Google Cloud service should they use?

Accepted Answer

Identity-Aware Proxy (IAP). Identity-Aware Proxy (IAP) provides zero-trust access control for web applications, authenticating users and enforcing context-aware access policies without requiring VPN. IAP sits in front of the load balancer and verifies identity and context before allowing access.

Answer

Cloud NAT

Answer

Cloud Armor

Answer

VPC Service Controls

Question 12

An organization uses Cloud Identity with Google Workspace. They want to grant a group of external auditors read-only access to a specific folder in Google Cloud. The auditors have accounts in the organization's Cloud Identity domain. What is the most efficient way to grant this access?

Accepted Answer

Create a Google Group, add auditors to it, and grant the group the Viewer role at the folder level.. The best practice is to create a Google Group (which is a Cloud Identity group) containing the auditors, then grant the group the desired IAM role (e.g., Viewer) at the folder level. This simplifies management.

Answer

Create a custom role and assign it to each auditor.

Answer

Use Cloud Directory Sync to sync auditors from an external identity provider.

Answer

Grant each auditor the Viewer role individually at the folder level.

Question 13

A security engineer wants to allow egress traffic from Compute Engine instances to the internet only for updates to a specific set of packages. All other egress must be denied. Which VPC firewall rule configuration should the engineer use?

Accepted Answer

Create an egress allow rule for the specific package sources and a deny all egress rule with lower priority (higher number).. VPC firewall rules are stateful, so allowing egress for specific destinations (e.g., package repositories) automatically allows return traffic. Deny rules should be used to block all other egress. The correct approach is an egress allow rule for the specific destinations and a lower-priority egress deny rule for all other traffic.

Answer

Create an egress deny rule for all traffic and then a higher-priority allow rule for the package sources.

Answer

Create an ingress allow rule for the package sources and a deny all egress rule with higher priority.

Answer

Use Cloud NAT to force all egress through a single IP and then restrict with a firewall rule.

Question 14

A security engineer wants to encrypt data at rest in Cloud Storage using a key that Google manages but the customer can control the key material. They need to rotate the key automatically every 90 days. Which encryption option should they choose?

Accepted Answer

Customer-Managed Encryption Keys (CMEK) via Cloud KMS. Customer-Managed Encryption Keys (CMEK) using Cloud KMS allow customers to manage their own key material and configure automatic rotation (minimum 24h, but typically set to 90 days). GMEK is Google-managed (no customer control), CSEK requires customer to supply key with each API call (Google never stores it), and Cloud HSM is a key management service but still uses CMEK integration for rotation.

Answer

Google default encryption (GMEK)

Answer

Customer-Supplied Encryption Keys (CSEK)

Answer

Cloud HSM

Question 15

A company has an organization policy that disables service account key creation (constraints/iam.disableServiceAccountKeyCreation). However, a legacy application requires a service account key to authenticate. What should the engineer do to satisfy this requirement while following best practices?

Accepted Answer

Use workload identity federation to authenticate the legacy application without keys. The best practice is to avoid service account keys entirely. Use workload identity federation if the application runs outside GCP, or use Workload Identity for GKE if it runs in GKE. If the application must use keys, you can request an exception by creating a custom organization policy with a condition or by using the policy simulator to test, but the preferred approach is to eliminate key usage.

Answer

Create a service account key and use it despite the policy, then document the exception

Answer

Create a custom role that includes iam.serviceAccountKeys.create and assign it to the service account

Answer

Remove the organization policy constraint to allow key creation