PCSE Practice Test 15 — 15 Questions

Question 1

A security engineer needs to ensure that a specific Compute Engine instance can only be accessed via HTTPS from users authenticated through Cloud Identity. The instance is behind an HTTP(S) load balancer. What should the engineer configure on the load balancer to enforce this access control?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure IAP on the backend service of the load balancer. Identity-Aware Proxy (IAP) provides zero-trust access control for web applications and can be enabled on a load balancer backend service. It verifies user identity and context before allowing access. Configuring IAP on the backend service of the load balancer restricts access to authenticated users only.

Answer

Set firewall rules to allow only HTTPS traffic from the load balancer's IP ranges

Answer

Enable HTTPS only on the load balancer and use client certificates for authentication

Answer

Configure Cloud Armor with a security policy to require valid JWT tokens

Question 2

A company wants to implement a zero-trust access model for SSH access to Compute Engine instances. They need to ensure that only authorized users can connect and that all connections are logged. Which two services should they use? (Choose TWO.)

Accepted Answer

Identity-Aware Proxy (IAP). Identity-Aware Proxy (IAP) allows zero-trust TCP forwarding for SSH and RDP without a bastion host. Cloud Audit Logs record all IAP tunnel connections. Cloud NAT is for outbound internet, Cloud VPN is for network connectivity, and Cloud Shell is a browser-based terminal but does not provide zero-trust access control.

Answer

Cloud NAT

Answer

Cloud Shell

Answer

Cloud VPN

Question 3

An organization uses Cloud Directory Sync to synchronize users from on-premises Active Directory to Cloud Identity. After syncing, a user reports they cannot access a Google Cloud project even though they are a member of the correct AD group. The group has been assigned the roles/compute.admin role on the project. What is the most likely cause?

Accepted Answer

The group was not synced as a Google Group; only users were synced. Cloud Directory Sync synchronizes users and groups, but group membership changes may take time to propagate. Additionally, the group must be synced as a Google Group or Cloud Identity group with the proper membership synced. If the group is not recognized in Cloud Identity, the IAM binding will not apply to the users.

Answer

The role was assigned at the organization level instead of the project level

Answer

The user needs to log out and log back in to refresh their session

Answer

The user is not a direct member of the group; they are a nested group member

Question 4

A security engineer notices that a Cloud KMS key was accidentally deleted. The key had a pending destruction period of 24 hours. What is the maximum time window to recover the key after the deletion request?

Accepted Answer

24 hours. When a key version is destroyed, it enters a 24-hour pending destruction period. During this time, it can be restored. After 24 hours, destruction is permanent and irreversible.

Answer

30 days

Answer

7 days

Answer

Immediately after deletion it cannot be recovered

Question 5

An organization wants to use a third-party identity provider (IdP) that supports OpenID Connect (OIDC) to manage access to Google Cloud resources. They want users to authenticate with the external IdP and access GCP via the Cloud Console and gcloud CLI. Which feature should they use?

Accepted Answer

Cloud Identity with OIDC federation. Cloud Identity supports OIDC federation, allowing users to authenticate with an external OIDC IdP and access GCP.

Answer

Cloud Identity with SAML 2.0 federation

Answer

Service account key authentication

Answer

Workload Identity Federation

Question 6

An organization subject to GDPR receives a data subject request for erasure ('right to be forgotten'). The data subject's information is stored in BigQuery audit logs. What is the implication for the audit logs, and what should the organization do?

Accepted Answer

Use Cloud DLP to redact the personal data from the audit logs, and store the redacted version.. BigQuery audit logs are immutable by default for compliance reasons. You cannot delete individual entries. The recommended approach is to redact the personal data from the logs using Cloud DLP or to export logs to Cloud Storage and then delete the export. Deleting the entire log sink would affect future logging but not existing logs. The logs cannot be edited.

Answer

Delete the entire log bucket containing the audit logs.

Answer

Delete the BigQuery dataset containing the logs.

Answer

Edit the audit log entries directly using the Cloud Logging API.

Question 7

A DevOps engineer needs to allow a CI/CD pipeline running in Google Kubernetes Engine (GKE) to push images to a specific Artifact Registry repository. The pipeline uses a Kubernetes service account. What is the best practice to grant this access without creating a JSON key for a Google service account?

Accepted Answer

Use Workload Identity to bind the KSA to a GSA with the Artifact Registry Writer role. Workload Identity for GKE allows you to bind a Kubernetes service account (KSA) to a Google service account (GSA). The KSA can then impersonate the GSA when accessing Google Cloud APIs, eliminating the need for service account keys.

Answer

Use a node pool with a service account that has the required roles

Answer

Grant the GSA the IAM role directly on the namespace using RBAC

Answer

Create a JSON key for the GSA, store it as a Kubernetes secret, and mount it into the pod

Question 8

A developer needs to deploy a web application on Compute Engine that must access Cloud Storage buckets. The best practice for providing credentials to the VM is to:

Accepted Answer

Create a service account with the required roles and attach it to the Compute Engine instance.. The best practice is to create a service account, assign the appropriate roles to it, and attach it to the Compute Engine instance. This avoids managing static keys and uses the instance's metadata server for automatic credential retrieval.

Answer

Generate a JSON key for a service account and store it on the instance.

Answer

Use the Compute Engine default service account and grant it the required roles.

Answer

Store the user's personal credentials in the instance metadata.

Question 9

You need to grant a security auditor read-only access to all resources in a project, but they must not be able to view data within resources (e.g., table contents). Which predefined IAM role should you grant?

Accepted Answer

roles/viewer. The roles/viewer role provides read-only access to view resource configurations but not data. For example, it allows listing Compute Engine instances but not connecting to them or reading data from BigQuery tables. The Security Reviewer role (roles/iam.securityReviewer) is similar but includes additional permissions; however, the question asks for read-only access without data access, and roles/viewer is the standard read-only role.

Answer

roles/iam.securityReviewer

Answer

roles/owner

Answer

roles/editor

Question 10

A company is using Cloud DLP to inspect a BigQuery table containing customer PII. They want to redact all credit card numbers found in a column by replacing them with a token that preserves the format (e.g., last 4 digits visible). Which de-identification transform should they use?

Accepted Answer

CryptoReplaceFfxFpeConfig. CryptoReplaceFfxFpeConfig performs format-preserving encryption (FPE), which can replace a value with a token that retains the format, such as last 4 digits visible.

Answer

MaskingConfig with a masking character

Answer

DateShiftConfig

Answer

BucketingConfig

Question 11

An organization has a Google Cloud organization node with multiple folders for different departments. A deny policy is set at the organization level to block the use of shielded VM constraints. Later, an allow policy at the folder level grants the compute.instances.create permission. A user in that folder tries to create a new VM without shielded VM enabled. What will happen?

Accepted Answer

The VM creation fails because the deny policy at the organization level overrides the folder allow policy. Deny policies override allow policies. Since the deny policy at the organization level blocks shielded VM usage, the allow policy at the folder level cannot override it. The VM creation will fail because the deny policy explicitly denies permissions related to shielded VM constraints.

Answer

The user can create the VM because the folder allow policy grants compute.instances.create

Answer

The VM is created but without shielded VM because the folder policy allows it

Answer

The VM creation succeeds because allow policies take precedence over deny policies

Question 12

A security engineer needs to allow a group of external auditors to view all resources in a project but not modify anything. They must also prevent the auditors from viewing sensitive data in BigQuery datasets. Which TWO IAM bindings should the engineer configure? (Choose two.)

Accepted Answer

Grant roles/viewer on the project to the auditors group. To grant read-only access to resources (configurations) without data access, you can grant roles/viewer on the project. However, roles/viewer includes bigquery.tables.getData, which allows reading table data. To prevent that, you must also add a deny policy to block bigquery.tables.getData. Alternatively, you can use a custom role, but the question asks for IAM bindings.

Answer

Grant roles/bigquery.dataViewer on the project to the auditors group

Answer

Grant roles/iam.securityReviewer on the project to the auditors group

Answer

Remove the auditors group from all IAM bindings and grant them roles/browser only

Question 13

A company wants to enforce that all new projects have a specific set of tags to track cost centers. Which Google Cloud feature should they use?

Accepted Answer

Create an organization policy with a custom constraint to require tags. Organization policies can enforce constraints on resources. However, tags are not enforced by organization policies. Instead, you can use the Resource Manager with organization policies to require tags, but there is no built-in constraint for tags. Alternatively, you can use a custom constraint to require tags. The simplest approach is to use the `constraints/resourcemanager.tags` constraint or a custom constraint. But the question is about enforcing tags; the Organization Policy Service is the tool to set constraints.

Answer

Configure a Cloud Function to delete projects without tags

Answer

Use IAM roles to restrict project creation to users who promise to add tags

Answer

Use Cloud Asset Inventory to monitor tags

Question 14

A company uses a multi-region Cloud Storage bucket for disaster recovery of critical data. They want to prevent accidental deletion of objects by requiring that objects be retained for at least 7 days after creation, and any attempt to delete or overwrite an object during that period must fail. Which configuration meets these requirements?

Accepted Answer

Set a retention policy for 7 days and apply object holds to all objects at upload time.. A retention policy ensures objects cannot be deleted or overwritten for a specified duration, and object holds can be applied to enforce this on a per-object basis. Option A is incorrect because object versioning only preserves previous versions but does not prevent deletion of the current version; lifecycle rules can delete old versions but do not block deletion. Option B is incorrect because a bucket lock with a retention policy makes the retention policy permanent and cannot be removed, which is more restrictive than required and not flexible. Option D is incorrect because lifecycle rules automatically delete objects based on age, they do not prevent deletion of objects less than 7 days old.

Answer

Enable object versioning and set a lifecycle rule to delete old versions after 7 days.

Answer

Set a bucket lock with a retention policy of 7 days and lock the bucket.

Answer

Use a lifecycle rule to delete objects that are less than 7 days old as a way to block deletion.

Question 15

A security engineer is configuring a VPC Service Controls perimeter to protect a Cloud Storage bucket. They want to allow a specific on-premises network (IP range 203.0.113.0/24) to access the bucket, while still blocking other external networks. Which TWO components must they configure? (Choose TWO.)

Accepted Answer

Ingress rule that permits the access level. You need an access level (based on IP) to define the allowed IPs, and an ingress rule to allow traffic from that access level into the perimeter.

Answer

Cloud Armor security policy

Answer

Service perimeter in enforced mode

Answer

Egress rule to allow traffic to the on-premises network