PCSE Practice Test 15 — 15 Questions

Question 1

A healthcare company's data science team needs to query BigQuery tables containing sensitive patient data. The company policy requires that all queries be logged and audited. The team has been granted the bigquery.user role on the project. However, when attempting to query a specific table in a dataset, they receive the error: "Access Denied: Table X: User does not have permission to query table X." The dataset has a custom IAM role assigned to the team's Google Group. The custom role includes the permissions: bigquery.datasets.get, bigquery.tables.get, bigquery.tables.list, and bigquery.jobs.create. The engineer verifies that the bigquery.user role does include bigquery.jobs.create. The engineer also confirms that the table exists and the dataset is in the same region as the project. What is the most likely cause of the access denied error?

Accepted Answer

The custom role does not include the bigquery.tables.getData permission.. The error 'Access Denied: Table X: User does not have permission to query table X' indicates that the user lacks the permission to read the actual table data. The custom role assigned to the team's Google Group includes bigquery.tables.get (metadata) and bigquery.tables.list, but not bigquery.tables.getData, which is required to read table rows. Without bigquery.tables.getData, even with bigquery.jobs.create and dataset-level metadata permissions, query execution fails because BigQuery enforces data access separately from metadata and job creation.

Answer

The team is not granted the bigquery.jobUser role on the project.

Answer

The team is not granted the bigquery.metadataViewer role on the dataset.

Answer

The dataset is in a different region than the project's default location, causing cross-region access restrictions.

Question 2

A financial services company is deploying a new payment processing system on Google Cloud that must comply with PCI DSS. The system processes credit card data. The security team has implemented encryption at rest and in transit, and uses Private Google Access for VPC communication. During a PCI assessment, the assessor points out that the company is missing a critical control: the need to regularly scan the external IP addresses of the VMs for vulnerabilities. What should the company do to address this requirement?

Accepted Answer

Set up a third-party vulnerability scanner (e.g., Nessus) from the Cloud Marketplace and run scans against external IPs.. Option D is correct because PCI DSS Requirement 11.2 mandates that external-facing IP addresses be scanned for vulnerabilities at least quarterly and after any significant change. Deploying a third-party scanner like Nessus from the Cloud Marketplace allows the company to run authenticated or unauthenticated scans against the external IPs of their VMs, meeting the specific requirement. Google Cloud does not provide a native active vulnerability scanning service for external IPs; Security Command Center Premium and Cloud IDS focus on asset discovery and threat detection, not active scanning of external endpoints.

Answer

Use Security Command Center Premium to perform vulnerability scanning.

Answer

Deploy Cloud IDS to perform active vulnerability scanning on external IPs.

Answer

Enable Cloud Armor to block all traffic and thus eliminate the need for scanning.

Question 3

A development team uses Cloud Secret Manager to store database credentials for an application running on Compute Engine. The application reads the secret using the Secret Manager API. After the team rotates the secret by adding a new version and setting it as the latest, the application continues to use the old secret version and fails to authenticate. The application is configured to fetch the secret with version 'latest' at startup. The team checks that the Compute Engine service account has the roles/secretmanager.secretAccessor role on the secret. What is the most likely cause of the issue?

Accepted Answer

Enable the new secret version by setting its state to 'enabled' via the Cloud Console, gcloud, or API.. When a new secret version is added via Cloud Secret Manager, it is created in the 'disabled' state by default. Even if it is set as the 'latest' version, the application cannot access it until the version is explicitly enabled. The application fetches the secret using the 'latest' label, which points to the disabled version, causing authentication failure. Enabling the new version resolves the issue.

Answer

Grant the service account the roles/secretmanager.secretAccessor at the project level instead of on the secret resource.

Answer

Update the application to use the specific version ID of the new secret instead of the 'latest' label.

Answer

Add an IAM condition on the secret that restricts access to only the latest version.

Question 4

A company has a VPC network named 'production' with subnets in us-central1 and europe-west1. They have on-premises data centers in New York and London connected via two HA VPN gateways to the respective regions. The on-premises networks use BGP with Cloud Routers in each region. The company also has a Shared VPC with service projects. Recently, they migrated a critical application to Google Cloud, which runs on Compute Engine instances in the europe-west1 subnet. The application needs to communicate with an on-premises database in London reachable via the London VPN. After the migration, the application fails to connect to the database. The Cloud Router in europe-west1 shows that it is receiving the on-premises routes. The instance has a default route to the internet via Cloud NAT. The firewall rules allow all traffic from the instance to the on-premises IP range. What is the most likely cause of the connectivity issue?

Accepted Answer

The Cloud Router in europe-west1 has dynamic route import from BGP disabled.. The Cloud Router in europe-west1 is receiving the on-premises routes via BGP, but if dynamic route import from BGP is disabled, those routes are not installed into the VPC route table. Without the specific route for the London on-premises database subnet, traffic from the Compute Engine instance will not be forwarded to the VPN tunnel, causing the connection failure. The default route via Cloud NAT only handles internet-bound traffic, not traffic destined for on-premises IP ranges.

Answer

The on-premises firewall is blocking traffic from the Google Cloud IP ranges.

Answer

The Cloud NAT is incorrectly configured and blocking traffic to on-premises IP ranges.

Answer

The Shared VPC configuration prevents service project instances from using VPC routes.

Question 5

A company runs a GKE cluster in a private cluster mode (no public endpoint) in a custom VPC. The cluster nodes are in a subnet that uses a secondary IP range for pods. The company needs the pods to access an on-premises service over a Cloud VPN connection that terminates in a different region. The on-premises service IP range is 10.100.0.0/16. The VPC has a route for 10.100.0.0/16 pointing to the VPN gateway. However, pods cannot reach the on-premises service. The GKE cluster is configured with a Cloud NAT for outbound internet access. The pod IP range is 10.200.0.0/16. Which step is required to allow pod traffic to reach the on-premises network?

Accepted Answer

Add a static route in the VPC for the pod IP range (10.200.0.0/16) with next hop set to the VPN gateway.. The VPC has a route for the on-premises range (10.100.0.0/16) pointing to the VPN gateway, but the GKE cluster's pod IP range (10.200.0.0/16) is not part of the VPC's primary or secondary subnet ranges. By default, GKE pods use IP addresses from a secondary IP range that is not automatically advertised over Cloud VPN. Adding a static route in the VPC for 10.200.0.0/16 with next hop set to the VPN gateway ensures that traffic from pods to the on-premises network is forwarded through the VPN tunnel, allowing the on-premises routers to learn the pod subnet and route return traffic back.

Answer

Configure Cloud NAT to also translate pod IPs to the node IPs for on-premises traffic.

Answer

Disable IP masquerade in the GKE cluster to use pod IPs directly.

Answer

Create a firewall rule allowing traffic from the pod IP range to the on-premises IP range.

Question 6

You are a security engineer for a startup that uses Google Workspace and Google Cloud. You have been asked to allow a contractor, who has a Google account (contractor@example.com), to manage Cloud Storage buckets in a specific project. The contractor should not have access to any other resources. You create a custom role with the necessary permissions and grant it to the user at the project level. However, the contractor reports that they cannot see the project in the Cloud Console. What is the most likely reason?

Accepted Answer

The custom role does not include the 'resourcemanager.projects.get' permission, which is required to view the project in the console.. The Cloud Console requires the 'resourcemanager.projects.get' permission to list and display projects. Even though the custom role grants permissions to manage Cloud Storage buckets, without this specific permission, the contractor cannot see the project in the console. Granting the permission at the project level allows the user to view the project in the console while still restricting access to other resources.

Answer

The contractor's Google account is not in the same domain as the Google Cloud organization.

Answer

The contractor needs to sign in using a different authentication method, such as SAML.

Answer

An organization policy denies access to the project for external users.

Question 7

A small company has a single VPC with subnets in us-central1 (10.0.1.0/24) and us-west1 (10.0.2.0/24). They have a Compute Engine VM (web-server) in us-central1 that needs to connect to a Cloud SQL MySQL instance also in us-central1 using its private IP address 10.0.1.3. The Cloud SQL instance is configured with private IP only and is deployed in the same VPC. The web-server can successfully ping the Cloud SQL private IP (10.0.1.3). However, the application on the web-server fails to connect to the MySQL database with an authentication error. There are no custom firewall rules; only the default VPC firewall rules are in place. What is the most likely cause of the connection failure?

Accepted Answer

The web-server's service account lacks the Cloud SQL Client IAM role.. The web-server can ping the Cloud SQL private IP (10.0.1.3), confirming network connectivity at Layer 3. The authentication error indicates the application is reaching the database but being denied access. Cloud SQL uses IAM for authentication when connecting via private IP; the web-server's service account must have the Cloud SQL Client IAM role to authenticate successfully. Without this role, the connection is rejected even though the network path is open.

Answer

The default-allow-internal firewall rule does not allow TCP port 3306.

Answer

The Cloud SQL instance does not have the public IP address enabled.

Answer

The Cloud SQL instance is in a different region than the web-server.

Question 8

A financial services company needs to inspect all inbound and outbound packets from a subnet containing highly sensitive data for compliance. They have enabled VPC Flow Logs on that subnet, which record metadata such as source and destination IP, ports, and protocol. However, the security team requires the actual packet payload to perform deep packet inspection (DPI) for malicious patterns. They want to capture the packets without disrupting network traffic. Which additional configuration should be implemented to meet this requirement?

Accepted Answer

Enable Packet Mirroring on a Compute Engine instance in the subnet to mirror all packets to a collector instance.. Option C is correct because Packet Mirroring clones all packets (including payload) from a source instance in the subnet and forwards them to a collector instance for deep packet inspection, without disrupting the original traffic flow. VPC Flow Logs only capture metadata (headers, timestamps) and cannot include payload content, making Packet Mirroring the only solution that meets the requirement for actual packet payload capture.

Answer

Configure Cloud Armor to log all HTTP requests with full request body.

Answer

Enable VPC Flow Logs with metadata capture set to 'include payload'.

Answer

Enable Cloud NAT logging to capture all outbound traffic payloads.

Question 9

A healthcare organization is migrating applications to Google Cloud and must comply with HIPAA. They plan to store protected health information (PHI) in Cloud Storage and BigQuery. The security engineer needs to ensure that all access to PHI is logged and that the data is encrypted at rest with customer-managed keys. The organization also requires that any audit logs containing PHI are stored in a separate project with restricted access. Which course of action meets all requirements?

Accepted Answer

Enable Data Access audit logs for Cloud Storage and BigQuery, create a sink to route logs to a BigQuery dataset in a separate project, and use CMEK in the data project.. Option D is correct because it meets all requirements: Data Access audit logs capture every access to PHI, a sink routes those logs to a BigQuery dataset in a separate project (fulfilling the separate-project storage requirement), and CMEK (customer-managed encryption keys) ensures encryption at rest with keys controlled by the organization. This combination satisfies HIPAA logging, encryption, and restricted-access log storage mandates.

Answer

Enable Data Access audit logs for Cloud Storage and BigQuery, and store logs in the same project. Use CMEK for encryption.

Answer

Use VPC Service Controls to create a perimeter around the project, and enable CMEK for encryption.

Answer

Enable Admin Read audit logs for Cloud Storage and BigQuery, and store logs in a different project. Use CSEK for encryption.

Question 10

A financial services company runs a PCI DSS-compliant workload on Google Cloud. They use a service account with roles/container.clusterAdmin to manage a GKE cluster. The security team has enabled Binary Authorization with a policy that requires all container images to be signed by a trusted authority. Recently, a developer reported that a new deployment failed with the error: 'Image verification failed: no signature found for digest sha256:abc...'. The image is stored in Artifact Registry and the developer built it using Cloud Build with a trigger that automatically signs images using Cloud KMS. The Cloud Build service account has roles/cloudkms.signerVerifier and roles/binaryauthorization.attestorsViewer. The Binary Authorization policy is configured to require at least one attestation from the trusted attestor. What is the most likely reason for the failure?

Accepted Answer

The Cloud Build service account lacks the roles/binaryauthorization.attestorsEditor role.. The Cloud Build service account has roles/cloudkms.signerVerifier and roles/binaryauthorization.attestorsViewer, which allow it to sign images and view attestors, but it lacks the roles/binaryauthorization.attestorsEditor role. Without this role, the service account cannot create or manage attestations in Binary Authorization, so even though the image is signed, no attestation is recorded, causing the policy to fail with 'no signature found'.

Answer

The container image is stored in a different registry that is not supported by Binary Authorization.

Answer

The GKE cluster's node service account does not have permission to verify attestations.

Answer

The Binary Authorization policy requires an attestation from a different attestor that is not configured.

Question 11

Your company has a hybrid cloud environment with on-premises servers and Google Cloud. You are using Cloud VPN to connect the on-premises network to a VPC in us-central1. The on-premises network uses RFC 1918 addresses (10.0.0.0/8). The VPC has subnets in 10.0.0.0/8 as well, causing IP overlap. To resolve this, you have configured the VPC with a custom IP range of 172.16.0.0/12 and migrated some workloads. However, some legacy on-premises servers still need to access a specific set of Compute Engine VMs in the VPC. The security team requires that only authenticated service accounts from the VPC can access on-premises resources, and that traffic from on-premises to Google Cloud must be limited to specific ports (e.g., 443, 8443). You have set up a Cloud VPN tunnel with route-based VPN. What should you do to enforce these access controls?

Accepted Answer

Create VPC firewall rules that allow ingress from the on-premises IP ranges on ports 443 and 8443 to the target VMs. On the on-premises side, configure firewall rules to allow only traffic from the VPC IP ranges and require that the source VMs present a valid service account token, which can be verified using a proxy or by using Google Cloud's Identity-Aware Proxy (IAP) for TCP forwarding.. Option D is correct because it addresses both requirements: limiting traffic to specific ports (443, 8443) via VPC firewall rules, and enforcing authenticated service account access from the VPC to on-premises resources. Identity-Aware Proxy (IAP) for TCP forwarding allows on-premises servers to verify that source VMs present a valid service account token, ensuring only authenticated VPC workloads can initiate connections. This combination satisfies the security team's need for both port restriction and authentication without relying on IP-based trust alone.

Answer

Use Cloud Armor to create a security policy that filters traffic from on-premises IP ranges on ports 443 and 8443, and attach it to the VPN gateway.

Answer

Assign network tags to the Compute Engine VMs and create a firewall rule that allows traffic from the on-premises IP ranges on ports 443 and 8443 only to VMs with that tag.

Answer

Use Cloud NAT to provide outbound-only access from the VPC, and create firewall rules to block inbound traffic from on-premises.

Question 12

A company uses Cloud Functions with a service account that has the role 'roles/cloudfunctions.invoker' to allow unauthenticated invocation. They want to change this so that only authenticated requests from a specific Cloud Scheduler job can invoke the function. The Cloud Scheduler job runs in the same project and uses a service account with the role 'roles/cloudscheduler.serviceAgent'. The security engineer updates the Cloud Function's ingress settings to 'Allow internal traffic only' and removes the 'allUsers' invoker binding. However, the Cloud Scheduler job now fails with a 403 error. What should the engineer do to fix this?

Accepted Answer

Grant the Cloud Scheduler's service account the role 'roles/cloudfunctions.invoker' on the Cloud Function.. A is correct because the Cloud Scheduler job uses a service account to authenticate its requests. By default, Cloud Scheduler does not automatically have permission to invoke a Cloud Function. Granting the Cloud Scheduler's service account the 'roles/cloudfunctions.invoker' role on the Cloud Function explicitly authorizes that identity to invoke the function, even when the function's ingress is set to 'Allow internal traffic only' and the 'allUsers' binding is removed.

Answer

Add 'allAuthenticatedUsers' as an invoker to the Cloud Function.

Answer

Change the ingress setting to 'Allow all traffic'.

Answer

Set the Cloud Function's ingress setting to 'Allow internal traffic only' and ensure the Cloud Scheduler job's region is the same as the function's region.

Question 13

A large enterprise is migrating its on-premises Active Directory to Google Cloud using Managed Microsoft AD (Microsoft AD). They have established a VPN connection between their on-premises network and VPC. The domain controllers are fully synced, and users can authenticate from on-premises. However, applications running on Compute Engine VMs in the same VPC as Managed Microsoft AD are failing to authenticate using LDAP. The VMs are Linux-based and configured to use the Managed Microsoft AD domain for authentication via SSSD. The security team has verified that the firewall rules allow TCP/UDP 389 and 636 from the VMs to the Managed Microsoft AD IP addresses. The VMs can resolve the domain name (corp.example.com) to the correct IP of the Managed Microsoft AD domain controllers. What is the most likely cause of the authentication failure?

Accepted Answer

The VMs do not have the required network tag to allow inbound traffic from Managed Microsoft AD.. Managed Microsoft AD in Google Cloud uses internal VPC IP addresses for its domain controllers. For Linux VMs using SSSD to authenticate via LDAP, the VMs must be able to initiate outbound LDAP traffic to the Managed Microsoft AD IPs, and the Managed Microsoft AD service must be able to respond. However, Managed Microsoft AD enforces network security by requiring that only VMs with a specific network tag (by default 'allow-ad') can receive inbound traffic from the Managed Microsoft AD service. Without this tag on the VMs, the Managed Microsoft AD service will drop its response packets, causing authentication failures even though outbound firewall rules are open. The security team verified firewall rules for outbound traffic but missed this inbound tag requirement.

Answer

The VPN tunnel does not support LDAP traffic.

Answer

The DNS resolution returns the on-premises domain controller IP instead of the Managed Microsoft AD IP.

Answer

The Managed Microsoft AD service account does not have the 'domain controller' IAM role.

Question 14

Your company, a global e-commerce platform, must comply with the PCI DSS requirement to secure cardholder data. You have a multi-cloud environment with workloads on Google Cloud and AWS. The Google Cloud environment consists of Compute Engine instances that process credit card transactions, and a Cloud SQL for MySQL database that stores encrypted cardholder data. The security team requires that only specific service accounts can connect to the database, and all connections must be encrypted. Additionally, you need to ensure that the database is not publicly accessible and that all access is logged. You have configured the Cloud SQL instance with a private IP and enabled SSL/TLS. However, a recent audit revealed that a Compute Engine instance with a public IP and no service account was able to connect to the database and execute queries. The instance was not authorized in the Cloud SQL authorized networks. What is the most likely cause of this security gap, and what should you do to prevent it?

Accepted Answer

The instance was in the same VPC and used the default Compute Engine service account with cloudsql.client role. You should disable the default service account and use a custom service account with the least privilege.. Option D is correct because the Compute Engine instance was in the same VPC as the Cloud SQL instance (private IP), and it used the default Compute Engine service account, which had the cloudsql.client role. This allowed the instance to connect via the Cloud SQL Proxy or directly using the private IP without being listed in authorized networks, as VPC internal connectivity bypasses authorized networks. The fix is to disable the default service account and assign a custom service account with only the necessary permissions, ensuring least privilege and preventing unauthorized access.

Answer

The instance bypassed SSL enforcement because the database was configured to accept non-encrypted connections. You should enable the 'require SSL' flag.

Answer

The instance used the Cloud SQL Proxy, which bypasses network controls. You should remove the proxy and require direct connections over private IP.

Answer

VPC Service Controls were not configured to block the connection. You should create a service perimeter to prevent data exfiltration.

Question 15

You are a security engineer for a financial services company that processes sensitive customer data. Your architecture includes two VPCs: 'data-vpc' (10.1.0.0/16) containing BigQuery datasets and Cloud Storage buckets, and 'app-vpc' (10.2.0.0/16) containing Compute Engine instances running a customer-facing application. The application needs to read from BigQuery and write to Cloud Storage. You have configured VPC Network Peering between the VPCs. Additionally, you have set up Private Google Access on all subnets in 'data-vpc' and 'app-vpc'. The application instances cannot connect to BigQuery or Cloud Storage. You have verified that firewall rules allow egress traffic to the Google APIs IP range (199.36.153.4/30) and that DNS resolution works correctly. What is the most likely cause of the connectivity failure?

Accepted Answer

The 'app-vpc' subnets do not have a default route (0.0.0.0/0) to the internet gateway.. Option C is correct because Private Google Access requires a default route (0.0.0.0/0) to the internet gateway in the VPC where the Compute Engine instances reside. Without this route, traffic destined for Google APIs (including BigQuery and Cloud Storage) cannot be forwarded to the internet gateway, even if Private Google Access is enabled on the subnet. The firewall rules and DNS are correctly configured, but the missing default route prevents the egress traffic from reaching the Google API IP range (199.36.153.4/30).

Answer

VPC Network Peering does not support Private Google Access.

Answer

Cloud NAT is not configured for 'app-vpc'.

Answer

Firewall rules are blocking traffic to the Google APIs IP range.