PCSE Practice Test 16 — 15 Questions

Question 1

Match each Google Cloud security tool to its primary purpose.

Question 2

Match each VPC firewall rule component to its definition.

Question 3

Match each access control mechanism to its description.

Question 4

Match each Cloud KMS key purpose to its description.

Question 5

Match each security command center tier to its capabilities.

Question 6

A company uses Cloud SQL for MySQL and needs to automate the rotation of database user passwords every 30 days. They want to store the passwords in Secret Manager and have the application retrieve them at runtime. The application runs on Compute Engine. What is the most secure way to allow the Compute Engine instances to access the secrets?

Accepted Answer

Attach a service account to the Compute Engine instances with the role roles/secretmanager.secretAccessor, and grant that service account access to the specific secret versions.. Option A is correct because it follows the principle of least privilege by attaching a service account with the roles/secretmanager.secretAccessor role directly to the Compute Engine instances and granting that service account access only to the specific secret versions needed. This ensures that the instances can authenticate via the default service account metadata server (using OAuth 2.0 tokens) without exposing any long-lived credentials, and the access is scoped to exactly the secrets required for password rotation.

Answer

Grant the roles/secretmanager.secretAccessor role to all service accounts in the project.

Answer

Create a service account key for a dedicated service account, download it to the instance, and use it to access the secret.

Answer

Store the password in instance metadata and have the application read it from the metadata server.

Question 7

A financial services company must ensure that all data stored in Cloud Storage is encrypted with customer-managed encryption keys (CMEK) that are rotated every 90 days. They have enabled Organization Policy constraints to enforce CMEK. However, some new buckets are still being created without CMEK. What is the most likely cause?

Accepted Answer

The Organization Policy constraint is not applied to the folder that contains the project.. Organization Policy constraints are hierarchical and must be applied at the project, folder, or organization level to take effect. If the constraint is applied only at the organization level but the project resides in a folder that does not inherit the policy (or the constraint is not applied to that folder), the policy will not enforce CMEK on buckets created in that project. This explains why new buckets can still be created without CMEK despite the policy being enabled elsewhere.

Answer

VPC Service Controls are blocking the use of CMEK.

Answer

The buckets are created using a service account that has the CMEK permission but the key ring is not in the same region.

Answer

The buckets are using the Archive storage class, which does not support CMEK.

Question 8

A company wants to audit all changes to IAM policies in their organization. They need to set up logging to capture these changes. Which TWO steps should they take? (Choose TWO.)

Accepted Answer

Enable Admin Activity audit logs for the organization.. Admin Activity audit logs record operations that modify the configuration or metadata of resources, such as IAM policy changes. Enabling Admin Activity audit logs at the organization level captures these changes across all projects within the organization, providing a centralized audit trail. This is the correct step because IAM policy modifications are classified as admin activity, not system events or data access.

Answer

Enable Admin Activity audit logs for each individual project.

Answer

Enable System Event audit logs for the organization.

Answer

Enable Data Access audit logs for the organization.

Question 9

A healthcare organization uses BigQuery to store patient data with column-level encryption using CMEK. They need to ensure that data is encrypted at rest and in transit, and that only authorized users can query specific columns. Which combination of controls should they use?

Accepted Answer

Use BigQuery column-level encryption with CMEK keys, and grant access via Authorized Views.. Option D is correct because BigQuery column-level encryption with CMEK ensures data is encrypted at rest using customer-managed keys, while Authorized Views provide row- and column-level access control without exposing the underlying encrypted columns to unauthorized users. This combination satisfies both encryption requirements (at rest and in transit, as BigQuery enforces TLS in transit) and fine-grained access control for specific columns.

Answer

Use VPC Service Controls to restrict access to BigQuery datasets, and use IAM conditions to limit column access.

Answer

Use Cloud HSM to create encryption keys and apply them to BigQuery tables using Cloud Key Management Service.

Answer

Use Cloud Data Loss Prevention to de-identify sensitive columns, and then use IAM to control access.

Question 10

A Cloud Run service is failing to access a secret from Secret Manager. The service account used by Cloud Run has the roles/secretmanager.secretAccessor role. What is the most likely cause of the error?

Accepted Answer

The service account does not have access to the 'latest' version of the secret; it needs explicit version access.. D is correct because Secret Manager requires explicit access to a specific secret version. The `roles/secretmanager.secretAccessor` role grants access to all versions of a secret, but the Cloud Run service must reference a specific version (e.g., 'latest' or a version number) in its configuration. If the service is configured to access the 'latest' version without the `secretmanager.versions.access` permission on that version, access will fail. The error occurs because the service account lacks the necessary permission to access the 'latest' version, even though it has the role.

Answer

VPC Service Controls are blocking access to Secret Manager.

Answer

The service account does not have the iam.serviceAccounts.actAs permission on the Cloud Run service.

Answer

The secret does not exist in the specified project.

Question 11

A company stores sensitive customer data in Cloud Storage and uses CMEK with Cloud KMS. They want to ensure that data in transit to the storage bucket is always encrypted using TLS 1.2 or higher. Which configuration should they implement?

Accepted Answer

Set the bucket's 'requireTls' transport security setting to 'true' in the bucket's IAM policy.. Option B is correct because setting the bucket's 'requireTls' transport security setting to 'true' in the bucket's IAM policy enforces that all requests to the bucket must use TLS 1.2 or higher. This is a bucket-level policy condition that directly controls the encryption of data in transit, ensuring that any HTTP request without TLS 1.2+ is denied.

Answer

Use Cloud Armor to enforce HTTPS with a TLS 1.2 minimum.

Answer

Configure the bucket to use CMEK with a key from Cloud HSM.

Answer

Add a bucket policy that denies requests with 'sslEnabled' set to 'false'.

Question 12

A security engineer needs to investigate a potential data exfiltration incident in a Google Cloud environment. The engineer has access to Cloud Logging and wants to identify any unusual outbound network traffic from Compute Engine instances. Which log sink filter should the engineer create to capture VPC flow logs for traffic destined to an external IP address not in the internal network ranges?

Accepted Answer

Create a sink with filter: 'resource.type="gce_subnetwork" AND jsonPayload.connection.dest_ip!="10.0.0.0/8" AND jsonPayload.connection.dest_ip!="172.16.0.0/12" AND jsonPayload.connection.dest_ip!="192.168.0.0/16"'. Option C is correct because it uses a log sink filter that captures VPC flow logs for traffic destined to external IP addresses by explicitly excluding the private RFC 1918 address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). This filter ensures only outbound traffic to non-internal IPs is captured, which is essential for investigating potential data exfiltration. The filter correctly uses the `resource.type="gce_subnetwork"` to target VPC flow logs from Compute Engine instances.

Answer

Create a sink with filter: 'resource.type="gce_subnetwork" AND jsonPayload.connection.dest_ip="0.0.0.0/0"'

Answer

Create a sink with filter: 'resource.type="gce_subnetwork" AND jsonPayload.reporter="src" AND jsonPayload.connection.dest_ip="0.0.0.0/0"'

Answer

Create a sink with filter: 'compute.googleapis.com/vpc_flows'

Question 13

A company is migrating to Google Cloud and wants to ensure that all service account keys are rotated automatically every 90 days. The security engineer needs to implement a solution that detects keys older than 90 days and notifies the security team. What is the most efficient way to achieve this?

Accepted Answer

Use Cloud Asset Inventory to list service account keys, then run a Cloud Scheduler job that invokes a Cloud Function to check key ages and send notifications. Option B is correct because Cloud Asset Inventory can list all service account keys and their creation timestamps, and a Cloud Scheduler job can trigger a Cloud Function to check key ages against the 90-day threshold and send notifications via email or Slack. This approach is efficient as it uses serverless components and avoids polling the IAM API repeatedly, which would be less scalable and more complex.

Answer

Use Cloud Monitoring to query the IAM API for key creation timestamps and trigger an alert

Answer

Create a log-based metric for service account key creation and set up an alert in Cloud Monitoring

Answer

Configure a custom role in Cloud IAM that denies access to keys older than 90 days

Question 14

A company uses Cloud KMS to protect encryption keys for their Cloud SQL databases. They want to rotate keys every 30 days and ensure that old keys are retained for at least 90 days. What is the recommended approach?

Accepted Answer

Use a Cloud KMS key with automatic rotation period of 30 days and disable old key versions after 90 days.. Option C is correct because Cloud KMS supports automatic key rotation with a configurable period (e.g., 30 days), which creates new key versions automatically. To meet the 90-day retention requirement, you can disable old key versions after 90 days using the key version lifecycle policy, ensuring they are not used for encryption but remain available for decryption of older data.

Answer

Use a Cloud KMS key with manual rotation every 30 days and keep all key versions indefinitely.

Answer

Use Cloud HSM to generate a key and set key version lifecycle to disable after 90 days.

Answer

Use customer-supplied encryption keys (CSEK) and rotate them manually.

Question 15

A security engineer is reviewing a log entry in Cloud Logging with the above filter. The engineer wants to understand why this specific log entry was generated. Which action most likely caused this log entry?

Accepted Answer

A user stopped the Compute Engine instance. The log entry was generated because a user stopped the Compute Engine instance. In Cloud Logging, instance lifecycle events such as STOP, START, or RESET are recorded with the method `compute.instances.stop`. This specific log entry matches the filter criteria (e.g., `protoPayload.methodName="v1.compute.instances.stop"`), indicating that the action was a stop operation, not a failure or policy change.

Answer

An SSH login attempt failed due to incorrect credentials

Answer

A firewall rule blocked incoming traffic to the instance

Answer

An IAM policy change granted a user compute.instances.start access