PCSE Practice Test 15 — 15 Questions

Question 1

A company is using a Shared VPC in Google Cloud with multiple service projects. The security team wants to restrict egress traffic from a specific service project to only allowed external IP addresses. The network project hosts the VPC. What is the best approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a firewall rule in the host project that denies egress to all destinations except the allowed IPs, and apply it to the service project's VMs via service accounts.. In a Shared VPC, firewall rules are defined in the host project and apply to VM instances in service projects. Option D correctly creates a deny-all egress rule in the host project, then uses a higher-priority allow rule for specific external IPs, scoped to service accounts of the target VMs. This ensures egress traffic from the specific service project is restricted at the VPC firewall level, which is the only effective way to control outbound traffic in a Shared VPC architecture.

Answer

Use Private Google Access to restrict egress.

Answer

Use VPC Service Controls to restrict egress.

Answer

Create a firewall rule in the service project's VPC that denies egress.

Question 2

A government contractor needs to deploy workloads on GCP that meet FedRAMP High baseline requirements. They want to enforce resource location restrictions and access controls for Google personnel. Which product should they use?

Accepted Answer

Assured Workloads. Assured Workloads is Google Cloud's purpose-built product for deploying workloads that must meet specific compliance frameworks, including FedRAMP High, FedRAMP Moderate, IL2–IL5, CJIS, ITAR, and HIPAA. It enforces data residency (resource location restrictions), personnel access controls (U.S.-person support only for FedRAMP High), and cryptographic controls automatically within a dedicated folder. This directly matches the contractor's requirement to enforce location restrictions and Google personnel access controls.

Answer

Cloud Security Command Center

Answer

VPC Service Controls

Answer

Organization Policies

Question 3

A company uses Cloud KMS with a key purpose of ENCRYPT_DECRYPT. They need to rotate the key automatically every 30 days. What must they configure?

Accepted Answer

Set a rotation period of 30 days on the key.. Cloud KMS allows you to set a rotation period directly on a key (a CryptoKey resource) when its purpose is ENCRYPT_DECRYPT. Configuring a rotation period of 30 days on the key enables automatic, scheduled rotation, where Cloud KMS creates a new key version every 30 days and promotes it to primary, without any manual intervention.

Answer

Use a cron job to rotate keys manually every 30 days.

Answer

Set a rotation period of 30 days on the key ring.

Answer

Set a rotation period on the key version.

Question 4

A DevOps engineer accidentally assigned the role roles/editor to a service account used by a backend service. This gives the service account excessive permissions. The engineer wants to remove the role from the service account. What is the correct command?

Accepted Answer

gcloud projects remove-iam-policy-binding PROJECT_ID --member serviceAccount:SA_EMAIL --role roles/editor. `gcloud projects remove-iam-policy-binding` is the specific command to remove an IAM role binding from a project-level policy for a given member (service account). The syntax correctly includes the `--member` flag with the `serviceAccount:` prefix and the `--role` flag specifying `roles/editor`, which removes the excessive Editor role from the service account.

Answer

gcloud iam policy-bindings remove --member serviceAccount:SA_EMAIL --role roles/editor

Answer

gcloud iam service-accounts remove-role SA_EMAIL --role roles/editor

Answer

gcloud projects set-iam-policy PROJECT_ID policy.yaml

Question 5

A company wants to grant a user the ability to delete a Cloud SQL instance but not be able to modify any other settings. What is the least privileged role?

Accepted Answer

Use a custom role with only cloudsql.instances.delete permission.. The least privileged role that allows deleting a Cloud SQL instance without granting any other permissions is a custom role containing only the `cloudsql.instances.delete` permission. Predefined roles like viewer, editor, or admin include broader permissions that would allow modifying other settings, violating the principle of least privilege.

Answer

roles/cloudsql.viewer

Answer

roles/cloudsql.editor

Answer

roles/cloudsql.admin

Question 6

A company is deploying a multi-region application in Cloud Run and must comply with data residency requirements in the European Union (EU). They want to ensure that only EU-based Cloud Run instances are created. Which approach should they use?

Accepted Answer

Set an Organization Policy with constraints/gcp.resourceLocations to restrict allowed regions to EU regions.. Organization Policies with the `constraints/gcp.resourceLocations` constraint allow administrators to enforce a list of allowed Google Cloud regions for resource creation. By setting this policy to include only EU-based regions (e.g., `europe-west1`, `europe-west4`), the company ensures that Cloud Run instances cannot be created outside the EU, directly meeting data residency compliance requirements. This is a preventive control that applies at the project or folder level, overriding any developer choices.

Answer

Add a label to the Cloud Run service specifying the region and rely on developers to follow it.

Answer

Use VPC Service Controls to limit access to the Cloud Run service from outside the EU.

Answer

Configure VPC Firewall rules to only allow egress to EU IP addresses.

Question 7

A company has a Google Group called team-a@example.com that contains all developers. The developers need to deploy Cloud Functions. What is the best practice to grant the necessary permissions?

Accepted Answer

Grant the group roles/cloudfunctions.developer on the project.. Granting the IAM role `roles/cloudfunctions.developer` to the Google Group at the project level follows the principle of least privilege and allows all members of the group to deploy Cloud Functions without granting excessive permissions. This approach centralizes permission management via the group, avoiding the need to manage individual user IAM bindings.

Answer

Add each developer's email to the IAM policy with roles/cloudfunctions.developer.

Answer

Grant the group roles/cloudfunctions.developer at the organization level.

Answer

Grant the group roles/cloudfunctions.admin on the project.

Question 8

Drag and drop the steps to configure a Cloud NAT for private VM instances in the correct order.

Accepted Answer

Create Cloud Router, then create NAT gateway, then assign NAT to subnets, then configure private VMs, then test connectivity.. Cloud NAT requires a Cloud Router, NAT gateway creation, subnet assignment, private VM configuration, and testing.

Answer

Create NAT gateway, then create Cloud Router, then assign NAT to subnets, then configure private VMs, then test connectivity.

Answer

Create Cloud Router, then assign NAT to subnets, then create NAT gateway, then configure private VMs, then test connectivity.

Answer

Configure private VMs, then create Cloud Router, then create NAT gateway, then assign NAT to subnets, then test connectivity.

Question 9

A company is using Cloud NAT to allow instances in a private subnet to access the internet. They notice that some instances are unable to reach external services. The NAT gateway is configured with a single IP address. Which action would most likely resolve the issue?

Accepted Answer

Increase the number of NAT IPs. The issue is that a single NAT IP address can run out of available ports (each TCP/UDP session consumes a unique source port), causing new connections to fail. Increasing the number of NAT IPs expands the port pool, allowing more concurrent outbound connections. This directly addresses the port exhaustion problem without changing firewall rules or NAT type.

Answer

Change the NAT type to static

Answer

Change the VPC firewall rules to allow egress from the NAT IP

Answer

Enable TCP established connections only

Question 10

A data scientist needs to access a secret stored in Secret Manager from a Compute Engine VM. The VM has the default service account attached. Which IAM role should be granted to the service account to allow reading the secret?

Accepted Answer

roles/secretmanager.secretAccessor. The correct role is roles/secretmanager.secretAccessor because it grants the specific permission secretmanager.versions.access required to read the secret payload from Secret Manager. The default Compute Engine service account needs only this minimal permission to retrieve the secret value, following the principle of least privilege.

Answer

roles/secretmanager.admin

Answer

roles/iam.serviceAccountUser

Answer

roles/secretmanager.viewer

Question 11

A security engineer needs to block traffic to a set of VMs from specific IP addresses and also apply rate limiting for HTTP traffic. The VMs are behind a global external HTTPS load balancer. Which service should they use?

Accepted Answer

Cloud Armor. Google Cloud Armor is a web application firewall (WAF) and DDoS protection service that integrates directly with global external HTTPS load balancers. It supports security policies with IP-based deny/allow rules and rate-based ban rules that limit HTTP request rates per client, exactly matching the requirement to block specific IPs and apply rate limiting. Cloud Armor policies are attached to the backend service of the load balancer, so they inspect traffic at the edge before it reaches the VMs.

Answer

Cloud IDS

Answer

VPC firewall rules

Answer

Network firewall policies

Question 12

An organization wants to prevent data exfiltration from a Google Cloud project by restricting the copying of data from Cloud Storage to external IPs. Which Google Cloud service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls (C) is correct because it allows you to define security perimeters around Google Cloud services like Cloud Storage, preventing data exfiltration by blocking access from external IPs. By creating a service perimeter, you can enforce that data can only be accessed from within a specified VPC network or on-premises network via Private Google Access, effectively restricting copying to external IP addresses.

Answer

Cloud Armor

Answer

IAM

Answer

Cloud Data Loss Prevention (DLP)

Question 13

A company has deployed an application in Assured Workloads with the FEDRAMP_HIGH compliance regime. They need to ensure that Google Cloud personnel cannot access their data. Which additional control should they enable?

Accepted Answer

Enable Google personnel access restrictions. Assured Workloads with the FEDRAMP_HIGH compliance regime enforces a set of controls, but by default it does not prevent Google Cloud personnel from accessing customer data. To achieve that, you must enable the Google personnel access restrictions control, which is an optional add-on within Assured Workloads. This control ensures that only a limited set of Google personnel can access your data, and only for specific, audited purposes, aligning with FedRAMP High requirements for data access.

Answer

Enable Access Transparency logs

Answer

Enable CMEK for all services

Answer

Enable VPC Service Controls

Question 14

A financial services company is migrating to Google Cloud and needs to enforce strict access controls. They want to ensure that all access to Cloud Storage buckets containing sensitive data is logged and that only authorized IP ranges can write to those buckets. They have set up IAM conditions to allow access only from the corporate IP range. However, they notice that some write operations are not being logged in the Cloud Audit Logs for the bucket. The write operations are coming from a service account that is part of a batch job running on Compute Engine instances within the corporate network. What is the most likely reason for the missing logs?

Accepted Answer

Data Access audit logs for Cloud Storage are not enabled.. Cloud Audit Logs for Cloud Storage require explicit enabling of Data Access audit logs to capture read, write, and other data-level operations. By default, only Admin Activity audit logs are enabled, which log metadata changes but not data access like object writes. The IAM condition correctly restricts write access to the corporate IP range, but without enabling Data Access audit logs, the write operations from the service account are not recorded.

Answer

The IAM condition is preventing the audit logs from being generated.

Answer

The batch job is using a different service account that does not have permission to write.

Answer

The write operations are not being captured because they are performed by a service account.

Question 15

A company wants to allow their on-premises Active Directory users to access Google Cloud resources using their existing credentials. They need to synchronize user accounts and groups to Google Cloud Directory and enable federated authentication. Which TWO services should they use?

Accepted Answer

Cloud Directory Sync (CDS). Cloud Directory Sync (CDS) [D] is correct because it is the Google-provided tool that connects to on-premises Active Directory (via LDAP) and provisions/synchronizes users, groups, and other directory objects into Google Cloud Directory (Cloud Identity or Google Workspace), which is exactly the account-synchronization requirement. SAML 2.0 SSO with Cloud Identity [E] is correct because it configures federated authentication so AD users can sign in to Google Cloud using their existing on-premises credentials, with Cloud Identity acting as the SAML service provider and AD (typically via ADFS or another IdP) as the identity provider. Workload Identity Federation [A] is not appropriate here because it is designed for workloads/applications to access Google Cloud without service account keys, not for synchronizing human AD users and groups. Identity-Aware Proxy [B] is a zero-trust access control layer for applications and VMs, not a directory sync or federation mechanism. OAuth 2.0 consent screen [C] only configures the user consent experience for OAuth clients and does not synchronize accounts or federate AD authentication.

Answer

Workload Identity Federation

Answer

Identity-Aware Proxy

Answer

OAuth 2.0 consent screen