PCSE Practice Test 18 — 15 Questions

Question 1

A company needs to meet the EU data boundary requirements for Assured Workloads, ensuring that data processing and storage remain within the European Union. Which TWO configurations are required? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an Assured Workloads folder with a location of 'eu'.. Assured Workloads provides a folder with specific compliance controls. The organization policy constraint gcp.resourceLocations restricts resource creation to allowed regions. The folder itself is created in a specific location (e.g., eu) to enforce the boundary.

Answer

Enable Cloud Logging with log sinks in the US.

Answer

Enable Access Approval for all projects.

Answer

Use a CMEK key from a key ring in a non-EU region.

Question 2

A security engineer needs to archive Cloud Audit Logs for regulatory compliance for 7 years. The logs should be immutable and cost-effective. Which solution should they choose?

Accepted Answer

Export logs to Cloud Storage using a sink, and enable Bucket Lock with retention policy.. Cloud Storage with the Archive storage class and retention policy using Bucket Lock provides immutable, low-cost storage for long-term archival. Logging exports can be configured via a sink to write logs to a bucket with these settings. BigQuery is not suitable for long-term archival due to cost; Pub/Sub is for streaming; Cloud Spanner is transactional and expensive.

Answer

Export logs to Pub/Sub and store them in a Cloud Spanner table with 7-year TTL.

Answer

Export logs to BigQuery and set a 7-year table expiration.

Answer

Use the default log retention of 400 days and copy logs to a persistent disk snapshot.

Question 3

An organization wants to restrict access to a Cloud Storage bucket so that only resources in a specific VPC network can reach it, without using public IP addresses. Which solution should they implement?

Accepted Answer

Private Google Access. Private Google Access allows on-premises hosts or VM instances using internal IPs to reach Google APIs and services (like Cloud Storage) by routing traffic through the VPC network, without requiring public IPs.

Answer

VPC Service Controls

Answer

Cloud NAT

Answer

Cloud VPN

Question 4

A cloud architect is designing a multi-project environment in Google Cloud. They want to ensure that a specific folder-level IAM policy cannot be overridden by project-level policies. Which TWO statements about IAM policy inheritance and deny policies are correct? (Choose two.)

Accepted Answer

If a deny policy denies a permission, an allow policy granting the same permission at a lower level will not be effective.. Correct statements: 1) Organization policies (deny policies) can block permissions even if an allow policy grants them. 2) Deny policies can be applied at any level and override allow policies. The other statements are incorrect: allow policies are hierarchical with additive inheritance, but they cannot be made 'hard' to prevent override; deny policies are the mechanism for that. Project-level allow policies can override folder-level allow policies (inheritance is additive). Deny policies can be applied at the folder level.

Answer

Deny policies can only be applied at the organization level.

Answer

Allow policies at the folder level are inherited by all projects in that folder and cannot be overridden by project-level allow policies.

Answer

Allow policies are evaluated before deny policies.

Question 5

A developer wants to grant a Compute Engine instance access to read objects from a Cloud Storage bucket. The instance runs under a service account. What is the best practice for granting this access?

Accepted Answer

Assign the Storage Object Viewer role to the service account attached to the instance.. The best practice is to assign the appropriate IAM role (e.g., Storage Object Viewer) to the service account that the instance is running as. Then, the instance can use the service account's credentials automatically via the metadata server. This avoids the need to manage service account keys. Generating keys is discouraged. Allowing the instance to use the default compute engine service account is common but less secure; a custom service account with minimal permissions is preferred.

Answer

Create an IAM policy on the bucket that grants access to the instance's external IP address.

Answer

Use a signed URL with a long expiration time for the instance.

Answer

Generate a JSON key for the service account, download it to the instance, and use it in application code.

Question 6

A security engineer wants to ensure that all Compute Engine VMs in an organization use Shielded VM features. The organization uses Cloud Identity as the identity provider. What is the most efficient way to enforce this requirement?

Accepted Answer

Apply the built-in constraint 'constraints/compute.requireShieldedVm' via the Organization Policy Service.. Organization policies can enforce constraints across all projects. The built-in constraint 'constraints/compute.requireShieldedVm' requires all new VMs to have Shielded VM features enabled. This is more efficient than manual audits, scripts, or custom constraints.

Answer

Configure a Cloud Security Command Center (SCC) policy to scan and alert on non-compliant VMs.

Answer

Use an IAM deny policy to prevent users from creating VMs without Shielded VM.

Answer

Create a custom organization policy using the Organization Policy Service.

Question 7

A company wants to allow an external auditor to view all IAM policies in a project but not modify them. The auditor's Google account is from a different domain. Which IAM role should be assigned?

Accepted Answer

roles/iam.securityReviewer. The roles/iam.securityReviewer role grants permission to view IAM policies and other security settings without write access. roles/viewer does not include iam.roles.list or iam.policies.get. roles/iam.roleViewer only lists roles, not policies. roles/securityAdmin includes write permissions.

Answer

roles/iam.roleViewer

Answer

roles/viewer

Answer

roles/securityAdmin

Question 8

An organization has set up IAP to protect a web application running on Compute Engine. The application needs to know the authenticated user's email address for logging. How can the application securely obtain this information?

Accepted Answer

Extract the email from the X-Goog-Authenticated-User-Email header after verifying the JWT signed by IAP.. IAP passes the authenticated user's identity to the backend application via signed HTTP headers (X-Goog-Authenticated-User-Email, X-Goog-Authenticated-User-Id). The application should verify the JWT signature of the IAP token (using Google's public keys) to trust these headers. The headers cannot be spoofed if the application verifies the JWT. Using Cloud Logging is not for real-time identity. The metadata server does not provide IAP user identity. The IAP API is for managing IAP configuration, not for retrieving user identity per request.

Answer

Read the user's email from the instance's metadata server.

Answer

Use the Cloud Logging API to query the most recent IAP access logs.

Answer

Call the IAP API to retrieve the user identity.

Question 9

What is the purpose of Identity-Aware Proxy (IAP) on Google Cloud?

Accepted Answer

To enforce identity-based access control for web applications and SSH/RDP to VMs without requiring a VPN.. Identity-Aware Proxy (IAP) is a service that provides a zero-trust access control layer for applications and resources. It verifies a user's identity and context before allowing access, enforcing application-level access control. It is not a VPN or firewall; it works at the identity level, not network level. It does not replace Cloud Armor or VPC firewalls but complements them.

Answer

To manage firewall rules for VPC networks.

Answer

To provide a VPN connection between on-premises and Google Cloud.

Answer

To act as a web application firewall (WAF) that blocks SQL injection and XSS attacks.

Question 10

A security administrator wants to prevent users from disabling Shielded VM on existing Compute Engine instances. Which IAM permission should they deny?

Accepted Answer

compute.instances.updateShieldedVmConfig. The permission compute.instances.updateShieldedVmConfig controls the ability to update the Shielded VM configuration (enable/disable) on an existing instance. Denying this permission will prevent users from changing Shielded VM settings on instances. The permission compute.instances.setMetadata is for metadata changes, compute.instances.update is for general updates, and compute.instances.setMachineResources is for changing machine types.

Answer

compute.instances.setMetadata

Answer

compute.instances.setMachineResources

Answer

compute.instances.update

Question 11

Which of the following is true about IAM deny policies?

Accepted Answer

Deny policies take precedence over allow policies.. Deny policies override allow policies. They are evaluated after allow policies, and if a deny matches, the access is denied regardless of allowed roles. They apply to the resource hierarchy as well. Deny policies can be set at the organization, folder, project, or resource level.

Answer

Deny policies can only be applied at the organization level.

Answer

Deny policies are evaluated before allow policies.

Answer

Deny policies can grant permissions.

Question 12

A security engineer needs to prevent users from creating service account keys in a Google Cloud project. The solution must be enforceable across all projects in the organization and should not block other IAM operations. Which approach should they use?

Accepted Answer

Use the Organization Policy Service with the constraint constraints/iam.disableServiceAccountKeyCreation.. Organization Policy constraints provide a way to enforce restrictions across the resource hierarchy. The built-in constraint 'constraints/iam.disableServiceAccountKeyCreation' specifically prevents creation of service account keys at the project, folder, or organization level. It does not affect other IAM operations. IAM deny policies can deny specific permissions but are more complex to manage and apply at the org level for this specific use case. Custom roles are not designed for enforcement across projects. The Organization Policy Service is the correct choice for such organization-wide restrictions.

Answer

Use IAM Conditions to restrict service account key creation to only a specific project.

Answer

Create a custom role that excludes the permission iam.serviceAccountKeys.create and assign it to all users.

Answer

Create an IAM deny policy at the organization level to deny the permission iam.serviceAccountKeys.create.

Question 13

An organization uses Active Directory (AD) on-premises and wants to synchronize user accounts and groups to Google Cloud Identity for SSO with SAML 2.0. The AD contains 50,000 users and 10,000 groups. The solution must support automatic provisioning and deprovisioning of users. Which tool should they use?

Accepted Answer

Use Google Cloud Directory Sync (GCDS) to synchronize users and groups from AD to Cloud Identity.. Google Cloud Directory Sync (GCDS) is the official tool for synchronizing users and groups from Active Directory (or LDAP) to Google Cloud Directory. It supports one-way sync, automatic provisioning, and deprovisioning. SAML SSO is configured separately using an IdP like Active Directory Federation Services (AD FS) or third-party. Workload Identity Federation is for external workloads (e.g., AWS, Azure) to access GCP resources, not for user identity synchronization. Cloud Identity API can be used programmatically but is not a ready-to-use sync tool. GCDS is the correct answer.

Answer

Use SAML 2.0 federation with AD FS to synchronize users.

Answer

Use Workload Identity Federation to connect AD to Google Cloud.

Answer

Use the Cloud Identity API to manually create users and groups.

Question 14

A company uses Google Cloud Directory Sync (GCDS) to synchronize users from an on-premises Active Directory to Cloud Identity. The security team wants to ensure that only synchronized users can access Google Cloud resources. Which TWO actions are part of a secure configuration? (Choose two.)

Accepted Answer

Disable manual user creation in the Cloud Identity admin console.. Correct actions: 1) Disable the creation of manual users in Cloud Identity to ensure all users come from AD only. 2) Restrict the allowed domains for IAM members to the company's domain (e.g., example.com) using Organization Policy constraint 'constraints/iam.allowedPolicyMemberDomains' to prevent external users from being added. Enabling automatic license assignment is not a security measure. Using the default admin account is not recommended. Syncing passwords is not recommended; GCDS does not sync passwords.

Answer

Enable automatic license assignment for all synchronized users.

Answer

Configure GCDS to sync user passwords.

Answer

Create a custom role that allows only synchronized users to access resources.

Question 15

A company uses SAML 2.0 federation with an external IdP. Users are synced from Active Directory to Cloud Identity using Google Cloud Directory Sync (GCDS). The security engineer needs to ensure that only users from a specific Active Directory group can access Google Cloud resources. What should be configured?

Accepted Answer

Create a Cloud Identity group that is synced with the AD group via GCDS, and assign IAM roles to that group.. The correct approach is to configure the IdP to only send SAML assertions for users in that specific AD group, and then in Cloud Identity, map that group to a Cloud Identity group or use attribute-based access. Alternatively, use organization policies with constraints/iam.allowedPolicyMemberDomains to restrict members to specific domains. But the question is about user access, not policy binding. The best answer is to create a Cloud Identity group that syncs with the AD group, and grant IAM roles to that group. This ensures only members of the AD group get access.

Answer

Configure the SAML IdP to include a custom attribute indicating group membership, and use attribute-based access control in Google Cloud.

Answer

Use IAP to restrict access based on user identity.

Answer

Configure an organization policy constraint (constraints/iam.allowedPolicyMemberDomains) to restrict IAM policies to the company's domain.