PCSE Practice Test 17 — 15 Questions

Question 1

A security engineer is reviewing the IAM policy of a Cloud Storage bucket that contains sensitive data. The exhibit shows the current policy. A developer reports that they can read objects in the bucket using service account sa-2, but they cannot delete objects. What is the most likely reason?

Accepted Answer

The service account sa-2 has roles/storage.objectAdmin, which includes delete permissions, but there might be a condition or organization policy preventing deletion. Option B is correct because the IAM policy shows that service account sa-2 has the roles/storage.objectAdmin role, which includes the storage.objects.delete permission. However, the presence of a condition or an organization policy (such as a VPC Service Controls perimeter or a boolean constraint) can override this permission, preventing deletion even though the role is assigned. The developer can read objects (permitted by the role) but cannot delete them, indicating that a higher-level policy is blocking the delete action.

Answer

There is an explicit deny on the bucket for sa-2

Answer

The bucket has uniform bucket-level access disabled, so ACLs override IAM

Answer

The service account sa-2 actually has roles/storage.objectViewer, not objectAdmin

Question 2

An organization wants to enforce data loss prevention (DLP) for sensitive data stored in Cloud Storage. Which THREE of the following Google Cloud services can be used together to inspect, classify, and automatically redact sensitive data in Cloud Storage? (Choose three.)

Accepted Answer

Cloud Storage. Cloud Storage is the target data repository where sensitive data resides, making it a necessary component of the DLP workflow. The Cloud Data Loss Prevention (DLP) API inspects and classifies the data, and Cloud Functions can be triggered by Cloud Storage events to automatically redact or transform the sensitive content before it is stored or accessed.

Answer

BigQuery

Answer

Dialogflow CX

Question 3

Your company is deploying a web application on Google Kubernetes Engine (GKE) with an Internal Load Balancer (ILB) as the ingress. The application must only be accessible from within the same VPC and from an on-premises network connected via Cloud VPN. The on-premises network uses IP range 10.0.0.0/8. You have already created the ILB with a backend service. What is the most secure way to restrict access to the ILB?

Accepted Answer

Configure the backend service's firewall rules to only allow traffic from the ILB's health check ranges and from the VPC and on-premises source ranges. Option B is correct because the most secure way to restrict access to an Internal Load Balancer (ILB) is to apply firewall rules directly on the backend service (the instance group or NEG). This ensures that only traffic from the ILB's health check probe ranges (130.211.0.0/22 and 35.191.0.0/16 for GKE) and the allowed source ranges (VPC and on-premises) can reach the backend instances. This approach prevents any traffic from reaching the backend except through the ILB, which is the intended secure design for an internal-only application.

Answer

Configure a VPC firewall rule to deny all ingress traffic to the ILB's forwarding rule IP address, and then create a higher-priority allow rule for the VPC and on-premises ranges

Answer

Use GKE Network Policy to restrict ingress traffic to the application pods from the VPC and on-premises ranges

Answer

Use Cloud Armor to create a security policy that allows traffic only from the VPC and on-premises ranges, and attach it to the ILB

Question 4

Your organization has a VPC with several subnets hosting Compute Engine instances. You need to allow SSH access (port 22) to instances in the 'management' subnet from the internet, but only from the office's static IP range (203.0.113.0/24). All other ingress traffic to that subnet should be blocked. Which firewall rule configuration should you create?

Accepted Answer

Create an ingress rule with target tag 'management', source IP range 203.0.113.0/24, protocol tcp:22, action allow. Option C is correct because it creates an ingress firewall rule that explicitly allows TCP port 22 traffic from the office's static IP range (203.0.113.0/24) to instances tagged 'management'. In Google Cloud VPC firewall rules, the default action is to deny all ingress traffic unless an allow rule matches, so this single allow rule satisfies the requirement: only SSH from the office IP range is permitted, and all other ingress is implicitly blocked.

Answer

Create an ingress rule with target tag 'management', source IP range 0.0.0.0/0, protocol tcp:22, action allow

Answer

Create an ingress rule with target tag 'management', source IP range 203.0.113.0/24, protocol tcp:22, action deny

Answer

Create an ingress rule with target tag 'management', source IP range 203.0.113.0/24, protocol all, action allow

Question 5

An organization uses Cloud Run to deploy microservices. Each microservice needs to authenticate to Cloud Pub/Sub topics. The Security Engineer wants to enforce that each service only uses its own service account and cannot impersonate others. The team also wants to rotate credentials automatically. What is the best practice to achieve this?

Accepted Answer

Assign a dedicated service account to each Cloud Run service with the necessary Pub/Sub publisher role.. Option A is correct because Cloud Run allows you to assign a dedicated, per-service service account at deployment time. By granting each service account only the Pub/Sub publisher role on its specific topic, you enforce least-privilege access and prevent impersonation. Cloud Run automatically rotates the short-lived tokens associated with these service accounts via the metadata server, eliminating the need for manual key management.

Answer

Configure each Cloud Run service to use the Compute Engine default service account and rely on the metadata server.

Answer

Use Workload Identity Federation to map each service to a Google service account.

Answer

Create a service account key for each service and store it in Cloud Secret Manager.

Question 6

A company wants to enforce that all access to Cloud Storage buckets in a project is encrypted with Customer-Managed Encryption Keys (CMEK). The Security Engineer needs to configure the organization policy to meet this requirement. Which THREE steps should be taken? (Choose THREE.)

Accepted Answer

Create an organization policy with the constraint 'constraints/storage.requireCustomerManagedEncryption'.. Option A is correct because the `constraints/storage.requireCustomerManagedEncryption` organization policy constraint enforces that all Cloud Storage buckets in the project must use CMEK. When this constraint is applied, any attempt to create a bucket without specifying a CMEK key is denied, ensuring compliance with the encryption requirement.

Answer

Grant the 'cloudkms.cryptoKeyEncrypterDecrypter' role to the Cloud Storage service account.

Answer

Disable the 'storage.objects.setIamPolicy' permission for all users except the key administrators.

Question 7

A company wants to implement least privilege for a service account that needs to read objects from a Cloud Storage bucket and publish messages to a Pub/Sub topic. Which TWO IAM roles should be granted to the service account? (Choose TWO)

Accepted Answer

roles/storage.objectViewer. Option A is correct because roles/storage.objectViewer grants read-only access to objects in Cloud Storage buckets, which is the minimum permission needed for the service account to read objects. This role includes permissions like storage.objects.get and storage.objects.list, allowing the service account to retrieve object data without any write or administrative capabilities.

Answer

roles/pubsub.subscriber

Answer

roles/storage.admin

Answer

roles/pubsub.viewer

Question 8

Your organization wants to ensure that no Compute Engine instance can have a public IP address. What is the best way to enforce this policy?

Accepted Answer

Use an Organization Policy with the constraint `compute.vmExternalIpAccess`. Option B is correct because the Organization Policy constraint `compute.vmExternalIpAccess` is a native Google Cloud policy that can be applied at the project, folder, or organization level to explicitly deny the assignment of external IP addresses to Compute Engine instances. This policy is enforced at the resource creation time, preventing any instance from being launched with a public IP, and it cannot be overridden by project-level IAM permissions, making it the most direct and effective enforcement mechanism.

Answer

Use Cloud Audit Logs to monitor and alert on instances with public IPs

Answer

Use a firewall rule that blocks traffic from 0.0.0.0/0

Answer

Use a Service Perimeter from VPC Service Controls

Question 9

You are a security engineer for a company that runs a critical application on Google Cloud. You need to implement defense in depth for network security. Which TWO of the following are effective network security controls that you should implement?

Accepted Answer

VPC firewall rules to restrict traffic between subnets. VPC firewall rules (B) are a fundamental network security control that allow you to restrict traffic between subnets based on source/destination IP ranges, protocols, and ports. This implements network segmentation and micro-segmentation, which is a core principle of defense in depth. Cloud Armor (E) provides Web Application Firewall (WAF) capabilities and DDoS protection at the edge of Google's network, filtering malicious traffic before it reaches your VMs or load balancers.

Answer

OS-level host-based firewalls on each VM

Answer

IAM roles to control who can create Compute Engine instances

Answer

Workload Identity Federation to allow workloads to authenticate to Google APIs

Question 10

A security engineer is troubleshooting connectivity issues between two Compute Engine instances in the same VPC but in different subnets. Both instances have internal IPs and are in the same region. The firewall rules allow ingress from 10.0.0.0/8. However, traffic is failing. What is the most likely cause?

Accepted Answer

The ingress firewall rule is applied to a network tag that is not assigned to the destination instances.. Option C is correct because firewall rules in Google Cloud VPC are applied to the destination instance based on network tags, not just the subnet or IP range. If the ingress rule allowing traffic from 10.0.0.0/8 is configured with a target tag that is not assigned to the destination Compute Engine instances, the rule will not apply, and traffic will be dropped. This is a common misconfiguration when using tags to selectively apply firewall rules.

Answer

The instances are using external IPs and the source IP is being NATed.

Answer

The VPC has dynamic routing mode set to global, causing routing conflicts.

Answer

There is a firewall rule with a lower priority that denies egress traffic between subnets.

Question 11

Your organization requires that all egress traffic from a VPC network be inspected by a third-party security appliance before leaving the network. The appliance is deployed in a separate VPC. What is the most scalable and maintainable way to route traffic through the appliance?

Accepted Answer

Deploy the appliance in a separate VPC and create a route with next hop as the appliance's internal IP, and tag the VMs that need inspection.. Option C is correct because it uses a route with a next hop of the appliance's internal IP, combined with VM tags to selectively route egress traffic through the appliance. This approach is scalable and maintainable as it avoids complex peering or interconnect setups, and tags allow granular control without modifying routes for every VM.

Answer

Use Cloud Interconnect to connect the two VPCs and configure BGP to advertise a default route from the appliance VPC.

Answer

Use Private Google Access to route traffic through the appliance.

Answer

Deploy the appliance in a separate VPC and use VPC Network Peering with route export/import to redirect traffic.

Question 12

A company is using a Shared VPC in Google Cloud with multiple service projects. The security team wants to restrict egress traffic from a specific service project to only allowed external IP addresses. The network project hosts the VPC. What is the best approach?

Accepted Answer

Create a firewall rule in the host project that denies egress to all destinations except the allowed IPs, and apply it to the service project's VMs via service accounts.. In a Shared VPC, firewall rules are defined in the host project and apply to VM instances in service projects. Option D correctly creates a deny-all egress rule in the host project, then uses a higher-priority allow rule for specific external IPs, scoped to service accounts of the target VMs. This ensures egress traffic from the specific service project is restricted at the VPC firewall level, which is the only effective way to control outbound traffic in a Shared VPC architecture.

Answer

Use Private Google Access to restrict egress.

Answer

Use VPC Service Controls to restrict egress.

Answer

Create a firewall rule in the service project's VPC that denies egress.

Question 13

An organization uses Cloud Run to deploy microservices. They need to restrict access to a specific Cloud Run service to only requests coming from a different Cloud Run service within the same project. The services communicate over HTTP. Which configuration should be used?

Accepted Answer

Configure the Cloud Run service to use 'Internal and Cloud Load Balancing' ingress control and use VPC Service Controls with an access level based on the caller's identity.. Option D is correct because it combines ingress control set to 'Internal and Cloud Load Balancing' with VPC Service Controls, which restricts access to the Cloud Run service to only requests originating from within the specified VPC or from Cloud Load Balancing. By adding an access level based on the caller's identity (the calling service's Google service account), you ensure that only the specific Cloud Run service can invoke the target service, meeting the requirement for service-to-service authentication within the same project.

Answer

Deploy both services in a VPC and use VPC firewall rules to allow traffic only from the caller's internal IP.

Answer

Use Cloud Armor with a rule to allow only requests with a specific header set by the caller.

Answer

Set the Cloud Run service to require authentication and grant the invoker role to the calling service's Google service account.

Question 14

A company has deployed a multi-region Kubernetes cluster using GKE. The security team wants to ensure that only pods with a specific service account can access a Cloud Storage bucket containing sensitive data. What is the best practice to achieve this?

Accepted Answer

Use Workload Identity to bind the Kubernetes service account to a Google service account with appropriate roles on the bucket.. Workload Identity is the best practice because it allows you to bind a Kubernetes service account (KSA) to a Google service account (GSA) that has been granted specific IAM roles on the Cloud Storage bucket. This eliminates the need to manage and distribute static service account keys, as the pod authenticates directly to Google Cloud APIs using the GSA's identity via a secure token exchange. The GKE node's metadata server is configured to vend tokens for the bound GSA only to pods running with the designated KSA, ensuring that only those pods can access the bucket.

Answer

Store a service account key as a Kubernetes secret and mount it into the pod.

Answer

Create a bucket ACL that grants read access to the GKE node service account.

Answer

Create a PersistentVolume with a GCSFuse bucket and use a pod security policy to restrict access.

Question 15

Refer to the exhibit. You are analyzing the IAM policy for a project. You need to ensure that only authenticated users can access objects in bucket1 under the prefix "reports/". Which of the following statements is correct?

Accepted Answer

Bob can view, create, and delete any object in bucket1.. Option C is correct because the IAM policy grants Bob the roles/storage.objectAdmin role on the entire bucket1, which includes permissions to view, create, and delete any object in the bucket. The condition restricting access to the "reports/" prefix applies only to the objectViewer role, not to Bob's role. Therefore, Bob has full administrative access to all objects in bucket1 without any prefix restriction.

Answer

The condition on objectViewer also prevents alice from listing objects under reports/.

Answer

The service account sa-1 can view objects under reports/ in bucket1.

Answer

Alice can only view objects under reports/ in bucket1.

PCSE Practice Test 17 — 15 Questions

Exhibit

PCSE Practice Test 17 — 15 Questions

Exhibit