PCSE Practice Test 17 — 15 Questions

Question 1

A company uses VPC Service Controls to protect a service perimeter around BigQuery. They need to allow a specific on-premises application (with static IP 203.0.113.10) to query BigQuery tables within the perimeter, while still blocking other internet traffic. Which configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an ingress rule in the service perimeter with an access level that includes the on-premises IP.. Create an ingress rule in the service perimeter that allows access from the on-premises IP (using access level) to BigQuery. Access levels can be IP-based, so create an access level that includes 203.0.113.10, and use that in the ingress rule.

Answer

Use Cloud Armor to allow the IP.

Answer

Add the on-premises IP to the list of allowed IPs in the VPC firewall rules.

Answer

Set up a VPN connection and include the on-premises VPC in the perimeter.

Question 2

A financial services company must ensure that all data egress from a VPC to BigQuery goes through a Private Service Connect endpoint for private access. They have set up the PSC endpoint and configured DNS. However, connections from VMs are still using the public internet. What is the most likely cause?

Accepted Answer

Private Google Access is disabled on the subnet.. For private access to Google APIs via PSC, the VPC must have Private Google Access enabled on the subnet. Without it, VMs will use the default public route.

Answer

The VPC has a default route to the internet via NAT.

Answer

The DNS record for bigquery.googleapis.com points to the public IP.

Answer

The PSC endpoint is not associated with a forwarding rule.

Question 3

A company wants to enforce that all new Cloud Storage buckets are created in only the europe-west1 region. Which organization policy constraint should they use?

Accepted Answer

constraints/gcp.resourceLocations. The organization policy constraint gcp.resourceLocations restricts the locations where resources can be created. By setting this constraint with a list of allowed locations (e.g., europe-west1), new buckets can only be created in those regions.

Answer

constraints/storage.uniformBucketLevelAccess

Answer

constraints/compute.requireOsLogin

Answer

constraints/iam.disableServiceAccountCreation

Question 4

A security engineer is designing a VPC Service Controls perimeter to protect sensitive BigQuery data. They need to allow a specific on-premises application (source IP range 203.0.113.0/24) to query BigQuery, and also allow a managed instance group in another project (project 'analytics') to export data from BigQuery to Cloud Storage. Which THREE configurations are required? (Choose three.)

Accepted Answer

Add the analytics project to the service perimeter. To allow on-premises access, an ingress rule with the source IP range is needed. To allow the managed instance group in another project, that project must be added to the perimeter (as a project within the perimeter) and an ingress rule for the service account or VPC of that project must be created. Also, the managed instance group will need an egress rule to allow access to Cloud Storage from within the perimeter. So ingress rule for on-premises, adding the analytics project to the perimeter, and an egress rule for Cloud Storage are required.

Answer

Configure Cloud Armor to allow the on-premises IP

Answer

Create an ingress rule to allow the service account of the managed instance group

Question 5

An organization wants to restrict access to Google Cloud APIs such as BigQuery and Cloud Storage so that only requests originating from a specific VPC network are allowed. Which Google Cloud service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls allow you to define a service perimeter around a set of Google Cloud APIs, restricting access to only those identities and networks you specify. This is the correct service for this requirement. Firewall rules control network traffic to VM instances, not API access. Cloud Armor protects against web attacks. Private Service Connect provides private connectivity to Google APIs but does not restrict access.

Answer

Private Service Connect

Answer

VPC firewall rules

Answer

Cloud Armor

Question 6

A data engineer wants to classify columns in BigQuery containing sensitive data like email addresses and apply data masking so that users see only masked values (e.g., 'j***@example.com'). Which feature should they use?

Accepted Answer

BigQuery column-level security with policy tags and data masking rules. BigQuery column-level security with policy tags allows classification, and BigQuery Data Policy with data masking rules (like email masking) applies dynamic masking at query time.

Answer

Cloud DLP inspection jobs

Answer

Cloud IAM roles for BigQuery

Answer

View with SQL masking

Question 7

A healthcare organization uses BigQuery to store patient data with column-level encryption using CMEK. They need to ensure that data is encrypted at rest and in transit, and that only authorized users can query specific columns. Which combination of controls should they use?

Accepted Answer

Use BigQuery column-level encryption with CMEK keys, and grant access via Authorized Views.. BigQuery column-level encryption with CMEK ensures data is encrypted at rest using customer-managed keys, while Authorized Views provide row- and column-level access control without exposing the underlying encrypted columns to unauthorized users. This combination satisfies both encryption requirements (at rest and in transit, as BigQuery enforces TLS in transit) and fine-grained access control for specific columns.

Answer

Use VPC Service Controls to restrict access to BigQuery datasets, and use IAM conditions to limit column access.

Answer

Use Cloud HSM to create encryption keys and apply them to BigQuery tables using Cloud Key Management Service.

Answer

Use Cloud Data Loss Prevention to de-identify sensitive columns, and then use IAM to control access.

Question 8

A company uses Cloud Armor to protect a web application. They want to block requests that contain SQL injection patterns based on the OWASP ModSecurity Core Rule Set. Which preconfigured rule set should they enable?

Accepted Answer

OWASP ModSecurity CRS. Cloud Armor provides preconfigured WAF rules based on the OWASP ModSecurity CRS. To block SQL injection, the rule set 'owasp-crs' with the specific paranoia level can be used, or the 'sqli' rule set if available. The correct answer is the OWASP ModSecurity CRS rule set that includes SQL injection detection.

Answer

Custom rules using CEL expression

Answer

Google Cloud Armor Managed Rules (SQL Injection)

Answer

Rate limiting rules

Question 9

A company wants to automatically provision and renew SSL certificates for their HTTPS load balancer. They want Google to manage the certificate lifecycle. Which certificate type should they use?

Accepted Answer

Google-managed certificate. Google-managed SSL certificates are automatically provisioned, renewed, and managed by Google. They are the correct choice for automatic lifecycle management. Self-managed certificates require the user to upload the certificate and renew it manually. Certificate Manager is a service for managing certificates but does not automate renewal unless using Google-managed certificates.

Answer

Self-managed certificate

Answer

Upload a certificate via the Cloud Load Balancing UI

Answer

Certificate Manager with a self-managed certificate

Question 10

A company wants to detect and alert on potential network threats, such as malware and command-and-control traffic, within their VPC. They need a managed service that integrates with packet mirroring. Which Google Cloud service should they use?

Accepted Answer

Cloud IDS. Cloud IDS (Intrusion Detection System) is a managed network threat detection service that uses packet mirroring to inspect traffic for threats. It is powered by Palo Alto Networks.

Answer

Security Command Center

Answer

VPC Flow Logs

Answer

Cloud Armor

Question 11

A company is designing a secure multi-tenant environment in Google Cloud. Each tenant has its own VPC network and resources. The security team wants to centrally enforce a rule that denies all egress traffic to the internet from tenant VPCs, except for traffic to specific trusted IP ranges for software updates. They also want to ensure that tenant admins cannot override this rule. Which two actions should they take? (Choose two.)

Accepted Answer

Create a hierarchical firewall policy at the folder level that denies egress to 0.0.0.0/0 except for the trusted IP ranges.. Hierarchical firewall policies are inherited and cannot be overridden at lower levels. They can be used to enforce mandatory rules. The organization can create a hierarchical firewall policy at the organization or folder level that denies all egress to 0.0.0.0/0 except for the trusted IP ranges. Additionally, to prevent tenant admins from overriding, they should not grant them the compute.firewallPolicies.update permission or similar. The correct choices are: create a hierarchical firewall policy and restrict permissions to modify firewall policies.

Answer

Grant tenant admins the compute.securityAdmin role to manage firewall rules.

Answer

Use VPC Service Controls to block egress traffic.

Answer

Create a VPC firewall rule in each tenant project to deny egress traffic.

Question 12

A company wants to deploy a web application with a global load balancer and needs to configure SSL/TLS termination. They want to use a certificate from their own CA and have the ability to manage multiple certificates for different domains. Which THREE steps should they take?

Accepted Answer

Ensure the certificate chain includes intermediate CA certificates. To use self-managed certificates with a load balancer, you can upload the PEM file directly to the load balancer, or use Certificate Manager to manage multiple certificates. The steps: create a Certificate Manager certificate resource with your PEM, map it to the load balancer target, and ensure the certificate is properly uploaded. Self-managed certificates require manual renewal, so you need to monitor expiration.

Answer

Set up a Cloud DNS zone with DNSSEC

Answer

Use a Google-managed certificate for automatic renewal

Question 13

A security engineer needs to block traffic to a set of VMs from specific IP addresses and also apply rate limiting for HTTP traffic. The VMs are behind a global external HTTPS load balancer. Which service should they use?

Accepted Answer

Cloud Armor. Cloud Armor security policies can be attached to load balancers to provide WAF capabilities, including IP allow/deny lists and rate limiting. This is the appropriate service for this scenario.

Answer

Cloud IDS

Answer

VPC firewall rules

Answer

Network firewall policies

Question 14

A financial institution uses Cloud KMS to manage encryption keys. They want to ensure that key material is never exported from the KMS service. Which key protection method should they use?

Accepted Answer

HSM keys in Cloud KMS. HSM keys in Cloud KMS are generated and stored within a FIPS 140-2 Level 3 certified hardware security module (HSM) that is physically and logically controlled by Google. The key material never leaves the HSM boundary; all cryptographic operations are performed inside the HSM, and export of the key material is prevented by design. This satisfies the requirement that key material is never exported from the KMS service.

Answer

Cloud HSM

Answer

External key manager

Answer

Software keys in Cloud KMS

Question 15

A global e-commerce company must comply with GDPR and CCPA. They use BigQuery to store customer data and need to ensure that when a user requests data deletion, all copies are deleted within 30 days. Additionally, they want to minimize storage costs. Which TWO actions should they take?

Accepted Answer

Use the DDL statement to drop the table after 30 days using a scheduled query.. Using a DDL statement (e.g., DROP TABLE) in a scheduled query allows you to delete the entire table after exactly 30 days, ensuring all data copies (including storage and any snapshots) are removed. This directly meets the GDPR/CCPA deletion requirement while minimizing storage costs by not retaining data beyond the mandated period.

Answer

Create a Cloud Function to export the data before deletion.

Answer

Set a table retention policy of 30 days using ALTER TABLE SET OPTIONS.

Answer

Use BigQuery continuous backups with a 30-day retention.