PCSE Practice Test 16 — 15 Questions

Question 1

A company wants to allow an application running in an on-premises data center to access Google Cloud Storage buckets without storing long-lived service account keys. The on-premises application authenticates using an external identity provider (IdP) that supports OpenID Connect (OIDC). Which Google Cloud feature should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use workload identity federation to exchange OIDC tokens for Google Cloud tokens. Workload identity federation allows the on-premises application to exchange OIDC tokens from the external IdP for short-lived Google Cloud access tokens, eliminating the need to store long-lived service account keys. This directly meets the requirement of accessing Cloud Storage buckets without managing static credentials.

Answer

Use Cloud VPN to connect the on-premises network and access Cloud Storage via private IP

Answer

Configure a VPN between on-premises and Google Cloud and use a Compute Engine instance as a proxy

Answer

Create a service account key and store it securely on-premises

Question 2

A company needs to ensure that all data stored in Cloud Storage is encrypted at rest using keys that they generate and manage themselves. They also need to rotate the keys every 90 days. Which encryption option should they use?

Accepted Answer

Customer-managed encryption keys (CMEK) using Cloud KMS. Customer-managed encryption keys (CMEK) using Cloud KMS allow the customer to generate, manage, and rotate keys themselves. Cloud KMS supports automatic rotation schedules (e.g., every 90 days), and CMEK integrates with Cloud Storage to encrypt data at rest with those keys. This meets the requirement for self-managed keys with rotation.

Answer

Customer-supplied encryption keys (CSEK)

Answer

Cloud External Key Manager (Cloud EKM)

Answer

Google-managed encryption keys (GMEK)

Question 3

An organization uses VPC Service Controls to protect BigQuery datasets. They need to allow a specific on-premises application, which uses a static IP address, to query a BigQuery dataset inside the service perimeter. Which configuration is required?

Accepted Answer

Create an ingress rule in the service perimeter with the on-premises IP as the source. VPC Service Controls allow ingress rules to permit traffic from specific IP ranges into a perimeter. By creating an ingress rule that allows the on-premises IP and specifies the BigQuery API, the on-premises application can access the dataset.

Answer

Create a Cloud Armor rule to allow the on-premises IP

Answer

Use Private Google Access for the on-premises network

Answer

Add the on-premises IP to an access level and create an egress rule

Question 4

A healthcare organization is migrating workloads to Google Cloud and needs to process Protected Health Information (PHI) under HIPAA. Which step is required before storing PHI in any GCP service?

Accepted Answer

Sign a Business Associate Agreement (BAA) with Google Cloud. Under HIPAA, before storing PHI in any GCP service, an organization must sign a Business Associate Agreement (BAA) with Google Cloud. The BAA contractually obligates Google to safeguard PHI and is a legal prerequisite. Without a BAA, storing PHI in GCP is not compliant, regardless of technical controls.

Answer

Enable VPC Service Controls on all projects

Answer

Configure Cloud DLP to classify all data

Answer

Enable Cloud Audit Logs for all services

Question 5

Your VPC has a default firewall rule that allows SSH (TCP port 22) from all sources. You need to allow HTTP traffic (TCP port 80) only from instances tagged 'web-servers' to the target instances, and block all other inbound traffic including SSH. Which TWO steps should you take?

Accepted Answer

Delete the default-allow-ssh rule.. Deleting the default-allow-ssh rule removes the rule that permits SSH from all sources (0.0.0.0/0), which is necessary to block all inbound SSH traffic as required. Option D is correct because creating a firewall rule with priority 1000 that allows ingress on TCP port 80 from instances tagged 'web-servers' explicitly permits HTTP traffic only from the desired source, and since lower priority numbers are evaluated first, this rule will be applied before any higher-numbered (lower priority) default rules.

Answer

Modify the default-allow-ssh rule to set its source filter to an empty range.

Answer

Create a firewall rule with priority 65535 allowing all traffic from 0.0.0.0/0.

Answer

Create a firewall rule with priority 1000 allowing ingress from instances with tag 'web-servers' on TCP port 443.

Question 6

A healthcare organization is migrating to Google Cloud and needs to achieve HIPAA compliance. Which THREE actions are required to meet HIPAA requirements on GCP? (Choose THREE.)

Accepted Answer

Enable Cloud Audit Logs for all services handling ePHI. Enabling Cloud Audit Logs for all services handling ePHI is a direct requirement under HIPAA's Security Rule (45 CFR § 164.312(b)), which mandates audit controls to record and examine activity in systems that contain or use electronic protected health information. Cloud Audit Logs provide immutable, tamper-evident logs of admin activities, data access, and system events, which are essential for demonstrating compliance during audits or breach investigations. Without these logs, the organization cannot meet the audit control standard for ePHI environments on GCP.

Answer

Enable VPC Flow Logs for all subnets

Answer

Use Cloud NAT for outbound internet access

Question 7

A company wants to ensure that all data stored in Cloud Storage buckets is encrypted with a customer-managed key (CMEK) that is managed in Cloud KMS. The security team requires that only authorized applications can access the key. Which configuration step should be taken to achieve this?

Accepted Answer

Grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Storage service account at the Cloud KMS key resource.. Cloud Storage uses its own Google-managed service account to interact with Cloud KMS when encrypting or decrypting data with a CMEK. By granting the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Storage service account at the specific key resource, you authorize only that service account to use the key, ensuring that only authorized applications (via Cloud Storage) can access the key. This follows the principle of least privilege and meets the security team's requirement.

Answer

Use a customer-supplied encryption key (CSEK) instead of CMEK.

Answer

Create a bucket with default encryption set to use a CMEK, and grant the service account the Cloud KMS Admin role.

Answer

Grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Storage service account at the project level.

Question 8

A company is implementing a data retention policy for Cloud Storage buckets. They need to ensure that objects cannot be deleted before a specified retention period. Which THREE features can they use? (Choose THREE.)

Accepted Answer

Retention Policy on the bucket.. A is correct because a Retention Policy on a Cloud Storage bucket enforces a minimum retention period for all objects in the bucket. Once set, objects cannot be deleted or overwritten until the retention period expires, directly meeting the requirement to prevent deletion before a specified time.

Answer

Lifecycle rules with a Delete action.

Answer

Object versioning.

Question 9

A company is deploying a new application that will process credit card data and must comply with PCI DSS. They plan to use Google Cloud services. Which service should they use to detect and redact sensitive data stored in Cloud Storage buckets?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud Data Loss Prevention (DLP) is the correct service because it is specifically designed to inspect, classify, and redact sensitive data such as credit card numbers (PANs) in Cloud Storage buckets. It uses built-in infoType detectors (e.g., `CREDIT_CARD_NUMBER`) to identify PCI DSS-protected data and can automatically apply de-identification transformations like redaction or masking to comply with PCI DSS requirements.

Answer

Cloud Key Management Service (KMS)

Answer

VPC Service Controls

Answer

Cloud Audit Logs

Question 10

A company is using Security Command Center (SCC) Standard tier and wants to detect threats like crypto mining attacks and anomalous IAM activity in their GCP environment. Which built-in service should they enable?

Accepted Answer

Event Threat Detection. Event Threat Detection is a built-in SCC service that continuously monitors Cloud Logging and other telemetry to surface threats such as crypto mining, anomalous IAM activity, data exfiltration, and malware. It uses Google's threat intelligence and ML-based detectors, making it the correct choice for detecting the specific threats described.

Answer

Security Health Analytics

Answer

Web Security Scanner

Answer

VM Threat Detection

Question 11

A security engineer notices that a service account has been granted the 'roles/editor' role on a project. According to least privilege, what is the best course of action?

Accepted Answer

Create a custom role with only the necessary permissions and reassign it to the service account.. The least-privilege principle requires granting only the permissions actually needed, so the correct action is to create a custom role containing just the required permissions and reassign it to the service account, replacing the overly broad roles/editor. This preserves the service account's identity (and any existing bindings or audit history) while reducing its blast radius. Removing and recreating the service account is unnecessary and disruptive.

Answer

Remove the service account and create a new one with a custom role containing only required permissions.

Answer

Change the role to 'roles/viewer' to be more restrictive.

Answer

Keep the role but add an access boundary using VPC Service Controls.

Question 12

Your organization uses Cloud Armor to protect HTTP Load Balancers. You need to block all incoming requests from a specific geographic region (country code 'XY') while allowing all other traffic. What is the correct configuration?

Accepted Answer

Create a custom rule with expression 'origin.region_code == "XY"' and set action to deny(403). Cloud Armor security policies support custom rules written in the Common Expression Language (CEL), and the origin.region_code attribute exposes the geographic region of the client IP as determined by Google's GeoIP database. Setting the action to deny(403) blocks matching requests with an HTTP 403 response while the default rule allows all other traffic. This is the canonical way to perform geo-based blocking at the HTTP(S) Load Balancer edge.

Answer

Use Cloud IDS to detect and block requests from country XY

Answer

Configure a firewall rule in the VPC to deny ingress from IP ranges associated with country XY

Answer

Add a preconfigured OWASP rule set for geolocation blocking and enable it for country XY

Question 13

A DevOps engineer wants to use Cloud Armor to block common web application attacks like SQL injection and cross-site scripting. Which feature should they enable?

Accepted Answer

Preconfigured rules (OWASP CRS). Google Cloud Armor's preconfigured WAF rules are based on the OWASP ModSecurity Core Rule Set (CRS) and are designed to detect and block common web attacks like SQL injection (SQLi) and cross-site scripting (XSS). Enabling the preconfigured rules (with appropriate paranoia levels and sensitivity) is the correct way to protect against these OWASP Top 10 threats.

Answer

Rate limiting

Answer

Custom rules with IP allow/deny

Answer

Adaptive Protection

Question 14

A security engineer wants to ensure that all API calls to Google Cloud services are logged for audit purposes. Which service should they enable?

Accepted Answer

Cloud Audit Logs. Cloud Audit Logs (now part of Cloud Logging) is the Google Cloud service that records API calls and administrative activities across Google Cloud services. It captures Admin Activity, Data Access, System Event, and Policy Denied logs, providing the audit trail required for compliance and security investigations. Enabling Cloud Audit Logs ensures all API calls to Google Cloud services are logged.

Answer

VPC Flow Logs

Answer

Cloud NAT Logs

Answer

Firewall Rules Logging

Question 15

A company wants to grant a support team member the ability to view the IAM policy of a project (who has which roles) without being able to modify it. What is the least privileged predefined role that provides this access?

Accepted Answer

roles/iam.securityReviewer. The roles/iam.securityReviewer role grants read-only access to IAM policies and permissions across the project, including the ability to view who has which roles, without allowing modifications. This is the least privileged predefined role that provides exactly this access, as it is scoped to security-related read operations only.

Answer

roles/viewer

Answer

roles/iam.securityAdmin

Answer

roles/iam.roleViewer