PCSE Practice Test 16 — 15 Questions

Question 1

A company wants to use Cloud IDS to detect threats in their VPC. They have created a Cloud IDS endpoint and need to configure packet mirroring. Which TWO resources must be in place for packet mirroring to work? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A Collector VPC network with the IDS endpoint. Packet mirroring requires a Collector VPC (where the IDS endpoint resides) and a mirrored VPC (where source VMs are). The source VMs must be tagged.

Answer

Public IP addresses on the source VMs

Answer

Cloud NAT on the mirrored VPC

Answer

A VPN tunnel between the collector and mirrored VPCs

Question 2

A company wants to enforce that no Compute Engine firewall rule in any project under an organization can have a source range of 0.0.0.0/0 for RDP (port 3389). Which approach should be used?

Accepted Answer

Apply a hierarchical firewall policy at the organization level that denies ingress on port 3389 from 0.0.0.0/0.. Use a hierarchical firewall policy at the organization level that denies ingress traffic on port 3389 from any source (0.0.0.0/0). Hierarchical policies are inherited and cannot be overridden by lower-level firewall rules.

Answer

Create a Cloud IDS rule to block RDP traffic.

Answer

Create a VPC firewall rule with priority 0 to deny RDP from 0.0.0.0/0 in each project.

Answer

Use organization policy with constraint `compute.skipDefaultNetworkCreation` set to true.

Question 3

An organization needs to block all inbound SSH traffic (port 22) to a set of VM instances that have a common tag 'ssh-restricted'. They want to deny this traffic at the VPC firewall level. Which firewall rule configuration should they use?

Accepted Answer

Deny rule: direction INGRESS, protocol tcp, port 22, target tag 'ssh-restricted'. To block SSH, a deny rule with direction INGRESS, protocol tcp, port 22, and target tag 'ssh-restricted' is needed.

Answer

Allow rule: direction EGRESS, protocol tcp, port 22, target tag 'ssh-restricted'

Answer

Deny rule: direction INGRESS, protocol tcp, port 22, target service account 'ssh-restricted'

Answer

Allow rule: direction INGRESS, protocol tcp, port 22, source tag 'ssh-restricted'

Question 4

A company wants to use a Google Cloud load balancer with an SSL certificate that is automatically provisioned and renewed. Which type of certificate should they use?

Accepted Answer

Google-managed certificate. Google-managed SSL certificates are automatically provisioned, renewed, and managed by Google for use with load balancers. This is the simplest option for automatic management.

Answer

Certificate Manager with a self-managed certificate

Answer

Certificate Authority Service

Answer

Self-managed certificate

Question 5

A security engineer wants to restrict access to Cloud Storage buckets such that only workloads running on Compute Engine VMs in a specific VPC can read data. The VMs are managed by multiple GKE clusters and autoscaling instance groups. Which approach BEST enforces this restriction?

Accepted Answer

Create a VPC Service Controls service perimeter with an ingress rule that allows access from the VPC network.. Use VPC Service Controls to create a service perimeter around the Cloud Storage API, with an ingress rule allowing requests from the specific VPC (using VPC network source) and VMs using the appropriate service accounts. VPC Service Controls prevent data exfiltration by restricting access to Google-managed services from outside the perimeter.

Answer

Configure a Cloud Armor security policy to block requests to Cloud Storage from non-VPC IPs.

Answer

Create a firewall rule that denies all egress traffic from the VPC to Cloud Storage IP ranges except through a proxy VM.

Answer

Use IAM conditions on the Cloud Storage bucket to restrict access based on VPC network tags.

Question 6

A financial services company is migrating to Google Cloud and needs to meet SOX compliance. They have a production project containing a Cloud SQL instance with financial transactions. They must ensure that all database changes are logged, and logs are immutable for 7 years. They enabled Cloud Audit Logs for Cloud SQL and created a log sink to export Admin Activity logs to Cloud Storage. However, during a quarterly audit, the auditor cannot find logs for some SELECT queries that accessed sensitive columns. The company expected these SELECT queries to appear in audit logs because they enabled Data Access audit logs for Cloud SQL. You discover that the Data Access audit logs were enabled at the project level, but the log sink only exports Admin Activity logs. Additionally, auditors require that logs cannot be deleted before the retention period. What should you do?

Accepted Answer

Modify the log sink to include Data Access audit logs and update the Cloud Storage bucket to have a 7-year retention policy and object holds.. The root cause is that the log sink is configured to export only Admin Activity logs, while the missing SELECT queries are Data Access audit logs. By modifying the log sink to include Data Access audit logs, those queries will be exported. Additionally, setting a 7-year retention policy and object holds on the Cloud Storage bucket ensures logs are immutable and cannot be deleted before the retention period ends, meeting SOX compliance requirements.

Answer

Enable VPC Flow Logs and export them to Cloud Storage with a 7-year retention policy.

Answer

Export logs to BigQuery with table expiration of 7 years and use IAM to restrict deletion.

Answer

Enable Data Access audit logs at the Cloud SQL instance level and export them to a separate Cloud Storage bucket with a 7-year retention policy.

Question 7

An organization uses Certificate Manager to provision SSL certificates for multiple domains across several load balancers. They want to automate certificate renewal. Which type of certificate should be used?

Accepted Answer

Google-managed certificates with DNS authorization. Google-managed certificates automatically provision and renew certificates for domains that are DNS-authorized. Certificate Manager can manage these certificates and map them to load balancer targets.

Answer

Wildcard certificates purchased from a third-party CA

Answer

Self-managed certificates uploaded as PEM files

Answer

Certificates from a private CA

Question 8

A company is deploying a web application behind an external HTTPS load balancer. They want to protect against common web attacks such as XSS, SQLi, and LFI using preconfigured rules. They also need to allowlist specific IP addresses that belong to partners. Which three Cloud Armor features should they use? (Choose three.)

Accepted Answer

Attach the Cloud Armor security policy to the backend service or load balancer.. Cloud Armor provides preconfigured WAF rules (OWASP ModSecurity CRS) for XSS, SQLi, LFI, etc. It also supports custom rules for allowlisting IPs. The correct features are: using preconfigured rule sets for OWASP CRS, creating custom rules with IP allowlisting, and then applying the policy to the load balancer. The question asks for three, so the answers are the OWASP CRS rule set, custom rules, and security policy attachment.

Answer

Configure IAP to restrict access to the application.

Answer

Use Cloud CDN to cache static content.

Question 9

An organization uses SSL policies for their HTTPS load balancer. They need to allow TLS 1.2 and 1.3 only, and use the most secure cipher profile available. Which SSL policy configuration should they choose?

Accepted Answer

minTlsVersion: 1.2, profile: RESTRICTED. The 'RESTRICTED' cipher profile enforces strong ciphers (TLS 1.2+), while 'MODERN' allows TLS 1.2 and 1.3 with good security. However, 'RESTRICTED' is the most secure profile that supports TLS 1.2 and 1.3.

Answer

minTlsVersion: 1.2, profile: MODERN

Answer

minTlsVersion: 1.2, profile: COMPATIBLE

Answer

minTlsVersion: 1.3, profile: CUSTOM

Question 10

A security team needs to apply a security policy that blocks requests to their HTTP load balancer from a specific geographic region (e.g., Country A). Which Cloud Armor feature should they use?

Accepted Answer

Custom rules with CEL expressions. Cloud Armor supports geolocation-based blocking using custom rules with geographic origin matching (e.g., origin.region_code).

Answer

Preconfigured WAF rules

Answer

Adaptive Protection

Answer

Rate limiting

Question 11

A company wants to enforce that traffic between two projects in the same organization must go through a central inspection VPC. They need a firewall rule that denies all traffic between the projects except through the inspection VPC. Which type of firewall rule should they use?

Accepted Answer

Hierarchical firewall policy at the folder level. Hierarchical firewall policies are applied at the folder or organization level and can enforce rules across projects. They are inherited and cannot be overridden by lower-level rules, making them suitable for central enforcement.

Answer

Cloud IDS

Answer

VPC Service Controls

Answer

Network firewall rules in each project

Question 12

A security team wants to block all incoming traffic from a specific country to their web application behind a global HTTPS load balancer. They also need to allow traffic from all other countries. Which Cloud Armor feature should be used?

Accepted Answer

Custom rule with geo-based condition. Cloud Armor supports geo-based access control. By creating a custom rule that uses a GeoIP match condition to deny traffic from the specific country, all other traffic is allowed by default (or via another rule).

Answer

Rate limiting

Answer

Preconfigured WAF rules

Answer

Adaptive Protection

Question 13

A company wants to prevent data exfiltration by restricting access to Google APIs from only authorized VPC networks. They also need to allow a specific on-premises IP range to access BigQuery. Which TWO services should be used together? (Choose 2)

Accepted Answer

Access levels (IP-based). VPC Service Controls create a service perimeter around Google APIs, and an access level (IP-based) can be used to allow the on-premises IP range into the perimeter.

Answer

Cloud Armor

Answer

Hierarchical firewall policy

Answer

Private Service Connect

Question 14

A company is deploying an internal service on GKE that needs to be accessible privately from on-premises data centers over a VPN connection. The service should not be exposed to the internet. Which connectivity solution is MOST appropriate?

Accepted Answer

Private Service Connect with an internal load balancer. Private Service Connect (PSC) allows publishing services using internal IP addresses that are accessible via VPC peering or VPN. The service can be exposed as an internal load balancer and attached to a PSC service attachment. On-premises can reach it via the VPN tunnel to the VPC.

Answer

Expose the service via an external load balancer with Cloud Armor IP allowlisting

Answer

Cloud NAT with firewall rules to allow on-premises IPs

Answer

VPC peering between the GKE VPC and on-premises

Question 15

A service provider wants to expose an internal service to external consumers in a controlled manner, without giving them direct access to the VPC. Which Google Cloud service should be used?

Accepted Answer

Private Service Connect. Private Service Connect allows service providers to publish their services via PSC endpoints, which consumers can access privately from their own VPCs without traversing the internet.

Answer

Cloud VPN

Answer

Cloud NAT

Answer

VPC Peering