PCSE Practice Test 17 — 15 Questions

Question 1

A DevOps team uses GitHub Actions to deploy infrastructure to Google Cloud. They want to avoid storing long-lived service account keys. Which approach should they use to authenticate from GitHub Actions to Google Cloud?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Workload Identity Federation by configuring a workload identity pool and provider for GitHub.. Workload Identity Federation allows GitHub Actions to exchange GitHub OIDC tokens for Google Cloud service account credentials. This eliminates the need for service account keys. The team must create a workload identity pool and provider in GCP, and configure GitHub Actions to use Google's action with 'workload_identity_provider'. Granting the service account token creator role is not the correct method. Using a Compute Engine instance is not relevant for GitHub Actions.

Answer

Grant the service account token creator role to the GitHub Actions runner.

Answer

Download a JSON service account key and store it as a GitHub secret.

Answer

Create a Compute Engine instance with a service account and run GitHub Actions from there.

Question 2

An organization wants to allow users to access a web application running on Compute Engine via HTTPS. The application requires users to authenticate with their corporate credentials (SAML 2.0 IdP). Which Google Cloud service should be used?

Accepted Answer

Identity-Aware Proxy (IAP) with HTTPS. Identity-Aware Proxy (IAP) with HTTPS provides authentication and authorization for web applications. It integrates with external SAML IdPs through Cloud Identity or G Suite. Cloud Load Balancing with SSL does not authenticate. Cloud Armor is for security policies. Cloud NAT is for outbound traffic.

Answer

Cloud NAT

Answer

Cloud Armor

Answer

Cloud Load Balancing with SSL certificates

Question 3

Your company is deploying a multi-tier application in a single VPC with two subnets: web (10.0.1.0/24) and db (10.0.2.0/24). The web instances need to connect to a private Cloud SQL instance (MySQL) that is provisioned in a service project. The Cloud SQL instance has a private IP address 10.0.3.5 assigned using private services access. You have established VPC peering between your VPC and the service producer VPC (the Google-managed VPC hosting Cloud SQL). You verified that the peering connection is in 'ACTIVE' state. The web instances can reach internet sites, but connections to the Cloud SQL instance (using the MySQL client) are timing out. The db instances do not need to connect to Cloud SQL. What is the most likely cause and recommended solution?

Accepted Answer

Configure the VPC peering connection to export custom routes from your VPC to the service producer VPC.. The web instances are timing out when connecting to the Cloud SQL private IP (10.0.3.5) because the VPC peering connection is not exporting custom routes from your VPC to the service producer VPC. By default, VPC peering does not export custom routes (including the subnet routes for 10.0.1.0/24 and 10.0.2.0/24) unless explicitly configured. Without these routes, the Cloud SQL instance cannot send response traffic back to the web instances, causing the TCP handshake to fail (SYN sent, SYN-ACK never received). Enabling 'Export custom routes' on the peering connection from your VPC to the service producer VPC resolves this by advertising your subnet routes to the Cloud SQL host VPC.

Answer

Re-create the VPC peering connection because it might be misconfigured.

Answer

Change the Cloud SQL instance to use a public IP and allowlist your web subnet.

Answer

Set up Cloud NAT for the web subnet to enable outbound connections.

Question 4

A company wants to ensure compliance with PCI DSS by monitoring access to BigQuery datasets containing sensitive data. They need to log all read operations and enable real-time alerting for anomalous access. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Create a log sink to export BigQuery Data Access logs to Pub/Sub.. Option C is correct because BigQuery Data Access logs record read operations (such as tabledata.list and jobs.query) against datasets, which is exactly the audit trail PCI DSS requires for monitoring access to sensitive data. Option A is correct because creating a log sink that exports those Data Access logs to Pub/Sub enables downstream real-time processing and alerting on anomalous access patterns. Option B is wrong because Admin Activity logs only capture configuration and metadata changes (e.g., creating or deleting datasets), not the read operations the scenario requires. Option D is wrong because Security Command Center detects misconfigurations and threats but does not itself provide the BigQuery read-operation audit logging needed here. Option E is wrong because a BigQuery view restricts column-level access but does not log read operations or provide alerting.

Answer

Enable Admin Activity logs for BigQuery.

Answer

Use Security Command Center to detect sensitive data access.

Answer

Create a BigQuery view to restrict access to sensitive columns.

Question 5

Which TWO options are valid methods to secure data in transit between an on-premises data center and a Google Cloud VPC?

Accepted Answer

Dedicated Interconnect with MACsec. Dedicated Interconnect with MACsec (Media Access Control Security) provides encryption at Layer 2, securing data in transit over the dedicated connection between your on-premises data center and Google Cloud VPC. MACsec uses GCM-AES-128 or GCM-AES-256 encryption to protect all traffic on the link, ensuring confidentiality and integrity without the overhead of IPsec.

Answer

Private Google Access

Answer

VPC Network Peering

Answer

Internal HTTPS Load Balancing

Question 6

A company has deployed a multi-region Kubernetes cluster using GKE. The security team wants to ensure that only pods with a specific service account can access a Cloud Storage bucket containing sensitive data. What is the best practice to achieve this?

Accepted Answer

Use Workload Identity to bind the Kubernetes service account to a Google service account with appropriate roles on the bucket.. Workload Identity is the best practice because it allows you to bind a Kubernetes service account (KSA) to a Google service account (GSA) that has been granted specific IAM roles on the Cloud Storage bucket. This eliminates the need to manage and distribute static service account keys, as the pod authenticates directly to Google Cloud APIs using the GSA's identity via a secure token exchange. The GKE node's metadata server is configured to vend tokens for the bound GSA only to pods running with the designated KSA, ensuring that only those pods can access the bucket.

Answer

Store a service account key as a Kubernetes secret and mount it into the pod.

Answer

Create a bucket ACL that grants read access to the GKE node service account.

Answer

Create a PersistentVolume with a GCSFuse bucket and use a pod security policy to restrict access.

Question 7

A company assigns roles to Google Groups to simplify management. They have a group called data-engineers@example.com that needs access to BigQuery datasets. Instead of adding each user individually, they want to grant the group roles/bigquery.dataViewer at the project level. After granting the role, a new member added to the group reports they cannot query a dataset. What is the most likely reason?

Accepted Answer

The dataset is in a different project than the one where the role was granted.. IAM roles granted at the project level apply only to resources within that project. If the BigQuery dataset resides in a different project, the group's project-level role does not grant access to that dataset. The user would need either a role granted at the dataset's project level or direct dataset-level permissions.

Answer

The user needs to be added directly to the dataset's access control list.

Answer

The dataset has been configured with private access control that overrides the project-level IAM.

Answer

The group does not have the necessary permissions because BigQuery does not support IAM groups.

Question 8

A developer wants to grant a service account the ability to impersonate another service account in a different project. Which IAM permission is required for the developer to assign?

Accepted Answer

iam.serviceAccounts.actAs. To impersonate a service account, the developer needs the iam.serviceAccounts.actAs permission on the target service account. This permission allows the principal to impersonate the service account, which is required when assigning the Service Account User role. Therefore, the developer must assign iam.serviceAccounts.actAs to the user or service account that will perform the impersonation.

Answer

iam.serviceAccounts.getAccessToken

Answer

iam.serviceAccounts.create

Answer

iam.serviceAccounts.update

Question 9

Which THREE are valid considerations when designing cross-organization access for Cloud Storage? (Choose three.)

Accepted Answer

Uniform bucket-level access disables ACLs, simplifying cross-org access management.. Uniform bucket-level access disables Access Control Lists (ACLs) and relies solely on IAM permissions for bucket access. This eliminates the complexity of managing both ACLs and IAM across organizations, making cross-org access management simpler and more consistent.

Answer

Signed URLs require the requester pays configuration to be enabled.

Answer

VPC Service Controls must be configured to allow cross-org IAM policies.

Question 10

A security engineer needs to protect sensitive data in BigQuery. The data includes columns with personally identifiable information (PII). They want to automatically mask PII data for users with the role 'analyst' but allow full access for 'admin' users. Which approach should they use?

Accepted Answer

Apply policy tags with data masking policies to PII columns and assign the tag to the analyst role.. BigQuery's policy tags with data masking policies allow you to automatically mask sensitive columns (e.g., PII) at query time based on the user's role. You assign a masking policy to the policy tag, then attach that tag to the PII columns. By granting the 'analyst' role access to the tag with the masking rule applied, analysts see masked data, while 'admin' users (who have higher-level IAM permissions) see the full data without additional configuration.

Answer

Use VPC Service Controls to restrict access to the dataset.

Answer

Create authorized views that exclude PII columns for the analyst role.

Answer

Use column-level access control via IAM roles to deny access to PII columns for analysts.

Question 11

A company wants to use Cloud Armor Managed Protection Plus to protect their HTTP(S) load balancer from DDoS attacks. They need to automatically block traffic from IP addresses that exhibit anomalous behavior based on machine learning. Which Cloud Armor feature should they enable?

Accepted Answer

Adaptive Protection. Adaptive Protection is the Cloud Armor feature that uses machine learning to analyze traffic patterns and automatically generate and enforce rules that block Layer 7 DDoS and other anomalous traffic. It learns a baseline of normal behavior per backend service and flags deviations, then can apply suggested WAF rules in preview or enforcement mode. This directly matches the requirement to automatically block IPs exhibiting anomalous behavior based on ML.

Answer

Custom rules with CEL

Answer

Pre-configured WAF rules

Answer

Rate limiting

Question 12

An organization wants to enforce that all Compute Engine instances in a project have a specific tag (e.g., 'env=prod') before they can be created. Which approach should be used?

Accepted Answer

Use an organization policy with a list constraint to require a specific tag on Compute Engine instances.. Use Organization Policy with a constraint that requires tags on resources. The constraint `compute.requireOsLogin` is not related. Resource Manager tags can be enforced via Organization Policy using the `constraints/tags` constraint.

Answer

Create a Cloud Audit Logs sink and trigger a Cloud Function to delete instances without the tag.

Answer

Use a hierarchical firewall policy with a tag condition.

Answer

Create an organization policy with constraint `compute.requireOsLogin` set to true.

Question 13

A security operations team is using Cloud Audit Logs to investigate a suspicious data export from a Cloud Storage bucket. They need to see which user accessed a specific object and when. Which log type should they examine?

Accepted Answer

Data Access logs. Data Access logs record read and write operations on user data, including object-level access in Cloud Storage. They capture who accessed a specific object, when, and from where, which directly answers the investigation requirement. Admin Activity logs only cover configuration changes, not data reads. Therefore, Data Access logs are the correct source for object access details.

Answer

Policy Denied logs

Answer

System Event logs

Answer

Admin Activity logs

Question 14

An organization is designing a secure multi-tenant SaaS environment on GKE. They want to isolate tenant workloads using GKE namespaces and IAM. Which two steps should they take? (Choose two.)

Accepted Answer

Use Kubernetes RBAC to restrict access within namespaces.. Kubernetes RBAC is the native mechanism for controlling access to resources within a namespace. By defining Role and RoleBinding objects, you can precisely restrict which tenant users can perform actions (e.g., get, list, create pods) inside their assigned namespace, ensuring logical isolation without requiring separate clusters.

Answer

Enable GKE Dataplane V2 for network isolation.

Answer

Grant cluster-level IAM roles to tenant users.

Answer

Create a separate GKE cluster per tenant.

Question 15

A developer wants to run a containerized application on GKE that needs to read from a Cloud Storage bucket. The developer needs to securely provide credentials. What is the recommended approach?

Accepted Answer

Create a Google service account with necessary permissions, create a Kubernetes service account, and configure Workload Identity to bind them.. Workload Identity is the recommended way to securely access Google Cloud services from GKE. It binds a Kubernetes service account to a Google service account, allowing pods to authenticate as the Google service account without needing to manage keys. This eliminates the need to store service account keys in secrets or on nodes, reducing the risk of credential leakage.

Answer

Use the default compute engine service account for the GKE nodes.

Answer

Store the service account key in Cloud Secret Manager and retrieve it in the pod at startup.

Answer

Create a service account key, store it as a Kubernetes secret, and mount it in the pod.