PCSE Practice Test 14 — 15 Questions

Question 1

A company uses Cloud Armor to protect their HTTP Load Balancer from DDoS attacks. They want to block requests from a specific malicious IP address range, 203.0.113.0/24. Which Cloud Armor policy configuration should they use?

Accepted Answer

Create a deny rule with a source IP condition for 203.0.113.0/24 and set priority to 1000.. Option D is correct because Cloud Armor security policies use priority-based rules, where lower numbers indicate higher priority. A deny rule with priority 1000 for the specific IP range 203.0.113.0/24 ensures that traffic from that range is blocked before any lower-priority allow rules are evaluated. This is the standard method to block specific IP ranges while allowing other traffic.

Answer

Create an allow rule with source IP condition for their own IP ranges and rely on default deny.

Answer

Create a rule with a 'source-ip' tag set to 'malicious' and assign to the load balancer.

Answer

Create a deny rule with priority 1000000 for the IP range.

Question 2

A company has a VPC network with a default route to the internet gateway. They want all egress traffic to go through a firewall appliance instead. They create a new route with a next hop to the appliance and a priority of 500. However, traffic is still going through the internet gateway. What is the most likely reason?

Accepted Answer

The new route's destination range is not 0.0.0.0/0. The default route to the internet gateway has a destination of 0.0.0.0/0. For the new route to override it, the new route must also have a destination of 0.0.0.0/0 (or a more specific prefix). If the new route's destination range is not 0.0.0.0/0, it will not match all egress traffic, and the existing default route with a lower priority (higher numerical value) will still be used for traffic that does not match the new route's destination.

Answer

The new route has a higher tag specification that overrides

Answer

The appliance does not have IP forwarding enabled

Answer

The firewall appliance is in a different network

Question 3

An engineer has enabled Private Google Access on the subnet. However, instances in the subnet cannot access Google APIs (e.g., storage.googleapis.com) using their internal IPs. What is the most likely issue?

Accepted Answer

The domain needs to be added to a DNS zone. Private Google Access allows instances without public IPs to reach Google APIs and services using their internal IPs, but it requires that the DNS resolution for the API domain (e.g., storage.googleapis.com) resolves to the private IP range used by Google's Private Access (199.36.153.8/30). If the domain is not added to a private DNS zone (e.g., googleapis.com) in the VPC, DNS will resolve to public IPs, causing connectivity failure. Option B correctly identifies this missing DNS configuration as the most likely issue.

Answer

The instances need a public IP

Answer

Private Google Access requires a VPC connector

Answer

The instances have no route to the default internet gateway

Question 4

A company needs to securely connect two VPC networks from different projects in the same organization. Each VPC has overlapping IP ranges (10.0.0.0/16). They require high throughput and low latency. What is the recommended approach?

Accepted Answer

Re-IP one of the VPC networks to a non-conflicting range and then use VPC Network Peering.. Option A is correct because VPC Network Peering requires non-overlapping IP ranges to establish direct connectivity. By re-IPing one VPC to a non-conflicting range (e.g., 10.1.0.0/16), you eliminate the routing conflict, allowing peering to provide high throughput and low latency via Google's internal backbone, with no bandwidth limits or single points of failure.

Answer

Use Dedicated Interconnect to directly connect the two VPCs.

Answer

Use VPC Network Peering.

Answer

Use HA VPN with dynamic routing.

Question 5

A company runs a GKE cluster with multiple node pools, including one pool of confidential VMs. The security team wants to ensure that only traffic from the internal VPC (10.0.0.0/8) can reach the nodes' metadata server. Which configuration should be applied?

Accepted Answer

Create a firewall rule that allows outbound traffic from nodes to 169.254.169.254 only from the internal VPC range, and deny all other outbound to that IP.. The metadata server for GKE nodes is accessible at the link-local IP 169.254.169.254. To restrict access to this server to traffic originating only from the internal VPC range (10.0.0.0/8), you must create a firewall rule that allows outbound traffic from the nodes to 169.254.169.254 only from that range, and then deny all other outbound traffic to that IP. This ensures that only workloads within the internal VPC can query instance metadata, preventing external or unauthorized pods from accessing sensitive metadata.

Answer

Configure Private Google Access on the subnets.

Answer

Enable IAP TCP forwarding on the cluster.

Answer

Apply a VPC Service Controls perimeter to the GKE cluster.

Question 6

A company wants to use Cloud CDN to cache content from an HTTP Load Balancer. They have a custom domain and want to serve traffic over HTTPS. What must they configure on the load balancer?

Accepted Answer

Create an SSL certificate resource and attach it to the HTTPS target proxy.. To serve HTTPS traffic with Cloud CDN and a custom domain, the load balancer must have an SSL certificate attached to its HTTPS target proxy. This is because Cloud CDN relies on the load balancer's target proxy to terminate TLS and present the certificate to clients. Creating an SSL certificate resource (either Google-managed or self-managed) and attaching it to the HTTPS target proxy is the required step.

Answer

Set up a backend bucket with a public certificate.

Answer

Upload a custom SSL certificate directly to the Cloud CDN configuration.

Answer

Enable HTTP to HTTPS redirect on the load balancer.

Question 7

A company connects their on-premises data center to Google Cloud via Dedicated Interconnect. They have two VLAN attachments (VLAN-A and VLAN-B) to a single VPC. They use BGP over the VLAN attachments with Cloud Router. Both VLAN attachments are in the same region. They want to use both links for active-active traffic and have redundancy. Which BGP configuration is correct?

Accepted Answer

Use the same BGP ASN and same MED for both VLAN attachments, and enable ECMP on Cloud Router.. For active-active traffic with two VLAN attachments to the same VPC in the same region, you must use the same BGP ASN on both sessions and enable ECMP (Equal Cost Multi-Path) on Cloud Router. This allows Cloud Router to install multiple equal-cost routes from both BGP sessions, enabling load balancing across both links. Using the same MED value ensures the routes are considered equal, which is required for ECMP to function correctly.

Answer

Use a different BGP ASN for each VLAN attachment.

Answer

Use a single VLAN attachment and rely on link redundancy.

Answer

Set different MED values for each BGP session to load-balance.

Question 8

A company notices that some Compute Engine instances are making unexpected outbound connections to suspicious IP addresses. They want to investigate the traffic patterns and identify the source of these connections. Which tool should they use?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about network traffic to and from Compute Engine instances, including source/destination IPs, ports, and protocols. By analyzing these logs, the company can identify the specific instances making unexpected outbound connections to suspicious IP addresses, enabling investigation of traffic patterns.

Answer

Cloud Armor

Answer

Cloud IAM

Answer

Firewall Rules Insights

Question 9

A company uses Shared VPC in a host project with multiple service projects. The security team wants to ensure that all traffic between service projects is inspected by a third-party firewall appliance deployed in the host project. Which configuration should be implemented?

Accepted Answer

Create a policy-based route in the host project that matches traffic between service project subnets and has a next hop to the firewall appliance's internal IP.. Option C is correct because a policy-based route in the host project can match traffic based on source and destination subnets from different service projects and force that traffic to be forwarded to the next-hop IP of the third-party firewall appliance. This ensures all inter-service-project traffic is inspected by the firewall, as the route overrides the default VPC routing behavior within the Shared VPC environment.

Answer

Enable Cloud NAT on each service project and configure a default route to the firewall appliance.

Answer

Set up VPC network peering between service projects and route traffic through the host project via a VPN tunnel.

Answer

Create a firewall rule in the host project that allows traffic between service projects only if the source is the firewall appliance.

Question 10

A company has a compliance policy requiring that all data at rest in Cloud Storage be encrypted with a Cloud KMS key that is rotated every 90 days. The company uses CMEK with automatic key rotation enabled. An auditor discovers that some older objects in a bucket were created with a previous key version that has since been disabled. The compliance team requires that all objects be re-encrypted with the current key version. The bucket does not have object versioning enabled. What should the security engineer do to remediate this issue?

Accepted Answer

Use the 'gsutil rewrite -k' command to re-encrypt the objects with the current key version.. Option B is correct because the 'gsutil rewrite -k' command re-encrypts existing objects in Cloud Storage with the current Cloud KMS key version, without requiring object versioning or re-uploading. This directly addresses the compliance requirement to re-encrypt all objects with the current key version, even though the old key version is disabled.

Answer

Re-enable the disabled key version in Cloud KMS so that objects can be read with the old key.

Answer

Enable object versioning on the bucket and delete the non-compliant object versions.

Answer

Create a new bucket with default encryption set to the current key and copy objects to it.

Question 11

A large healthcare organization is migrating its on-premises data center to Google Cloud. The organization must comply with HIPAA and has signed a BAA with Google Cloud. They plan to use BigQuery for analytics on PHI data. The security team has enabled encryption at rest with CMEK and has configured VPC Service Controls to prevent data exfiltration. During a penetration test, the testers discovered that they could query the BigQuery dataset using a service account that has BigQuery Data Viewer role from a non-VPC-SC-compliant network. This could allow unauthorized access to PHI data. The team needs to restrict all access to the BigQuery dataset to only originate from within the VPC perimeter defined by VPC Service Controls. What should the team do to enforce this requirement?

Accepted Answer

Enable VPC Service Controls perimeters for the BigQuery API and ensure that the project containing the dataset is in the perimeter, and configure ingress/egress rules to allow only requests from within the perimeter.. Option C is correct because VPC Service Controls are specifically designed to create a security perimeter around Google Cloud services like BigQuery, preventing data exfiltration and restricting access to only requests originating from within the defined perimeter. By placing the project containing the BigQuery dataset inside the VPC Service Controls perimeter and configuring ingress/egress rules, the team ensures that even a service account with BigQuery Data Viewer role cannot query the dataset from a non-VPC-SC-compliant network, as the API call is blocked at the Google Cloud edge before it reaches BigQuery.

Answer

Set up Private Google Access for the on-premises network and route all traffic through a VPN tunnel.

Answer

Configure an Organization Policy that restricts BigQuery access to only service accounts with a specific prefix.

Answer

Use Cloud IAP to require users to authenticate before accessing BigQuery.

Question 12

A company has configured a HA VPN between Google Cloud and an on-premises data center using two tunnels with separate Cloud Routers and BGP sessions in active/active mode. Each Cloud Router is configured to learn routes from the on-premises side and advertise VPC subnets. Recently, one of the tunnels experienced a physical link failure and went down. The security team notices that the remaining tunnel is still up and passing traffic, but some routes that were learned via the failed tunnel are no longer present in the routing table of that Cloud Router. The on-premises administrator confirms that the routes are still being advertised from the local router. What is the impact on traffic to the on-premises network?

Accepted Answer

Traffic destined to subnets only reachable via the failed tunnel will be dropped.. In an active/active HA VPN with separate Cloud Routers and BGP sessions, each Cloud Router maintains its own independent routing table. When a tunnel fails, the BGP session associated with that Cloud Router goes down, causing all routes learned via that session to be withdrawn. Even though the on-premises router continues to advertise the routes, the Cloud Router that lost its BGP session will no longer have those routes in its routing table. Traffic destined to subnets that were only reachable through the failed tunnel will be dropped because the remaining Cloud Router does not have a route for those subnets.

Answer

The failed tunnel will automatically be restored by BGP when the link comes back.

Answer

The Cloud Router will initiate a failover to a secondary BGP session.

Answer

All traffic will continue to flow through the remaining tunnel without any disruption.

Question 13

A company has a Shared VPC environment with multiple service projects. The security team wants to ensure that all Compute Engine VMs in service projects are only accessible via IAP TCP forwarding for SSH management, and direct external access is completely blocked. They have already applied an organization policy constraint that denies the attachment of external IP addresses to new VMs. However, there are several existing VMs that still have public IP addresses assigned. The team wants to remove the public IPs from these existing VMs without causing downtime for any ongoing SSH sessions or disrupting the applications running on them, but they must ensure the VMs can still reach the internet if needed (for example, to download updates). What should the team do?

Accepted Answer

First, deploy a Cloud NAT gateway for the VPC and subnet, then remove the public IP from each VM; the VMs will use Cloud NAT for outbound internet access.. Option B is correct because Cloud NAT provides outbound internet access for private VMs without requiring public IPs, and removing the public IP from an existing VM does not interrupt running SSH sessions or applications—the VM continues running with its internal IP. After deploying Cloud NAT for the VPC and subnet, you can safely remove the public IP from each VM, and the VM will use Cloud NAT for outbound connections (e.g., downloading updates). This approach satisfies the security requirement of blocking direct external access while maintaining outbound connectivity and avoiding downtime.

Answer

Delete each VM and recreate it without a public IP address.

Answer

Detach the public IP from each VM in the console, and then create a new private IP for the VM.

Answer

For each VM, use the gcloud command to delete the public IP and assign a new private IP from the same subnet.

Question 14

A startup is using Cloud Functions to process files uploaded to a Cloud Storage bucket. The Cloud Function is triggered by finalize events on the bucket. The developers created a service account for the Cloud Function and granted it the roles/storage.objectViewer role on the bucket. However, the function fails with a permission denied when trying to read the file. The function has the following XML in the event context: 'event_id'. What is the most likely issue?

Accepted Answer

The Cloud Function is using the default App Engine service account instead of the custom service account.. The most likely issue is that the Cloud Function is using the default App Engine service account instead of the custom service account that was granted the roles/storage.objectViewer role. When a Cloud Function is deployed without explicitly specifying a service account, it defaults to the App Engine default service account (project-id@appspot.gserviceaccount.com), which does not have the necessary permissions to read the file. The custom service account with the objectViewer role exists but is not assigned to the function, causing the permission denied error.

Answer

The service account does not exist.

Answer

The bucket is in a different project, and cross-project access is not configured.

Answer

The Cloud Function is not configured to be triggered by the correct event type.

Question 15

A multinational corporation is implementing a least-privilege access model for their CI/CD pipeline using Cloud Build, Artifact Registry, and GKE. The pipeline builds container images, pushes them to Artifact Registry, and deploys them to GKE clusters. The security team wants to ensure that the Cloud Build service account used by the pipeline has only the minimum necessary permissions. The service account currently has: roles/cloudbuild.builds.editor, roles/artifactregistry.writer, and roles/container.developer. After a successful build and push, the deployment step completes without errors, but the newly deployed pods on GKE immediately fail with ImagePullBackOff errors. The error message indicates: "Failed to pull image 'us-central1-docker.pkg.dev/my-project/my-repo/my-image:latest': rpc error: code = PermissionDenied desc = unauthenticated: Request had insufficient authentication scopes." The GKE cluster is a private cluster with Workload Identity enabled. The node pool uses a default Compute Engine service account with only the storage scope. What is the most likely missing permission or configuration that prevents the pods from pulling images?

Accepted Answer

The service account needs roles/iam.serviceAccountUser on the GKE node service account.. Option D is correct because the Cloud Build service account needs the `roles/iam.serviceAccountUser` permission on the GKE node's Compute Engine service account to impersonate it. With Workload Identity enabled, the GKE node's service account (not the Cloud Build service account) is what authenticates to Artifact Registry when pods pull images. Without this delegation, the Cloud Build service account cannot act on behalf of the node's service account, leading to the `PermissionDenied` error.

Answer

The service account needs roles/artifactregistry.reader on the repository.

Answer

The service account needs roles/storage.objectViewer on the bucket where images are cached.

Answer

The service account needs roles/container.clusterAdmin on the cluster.