PCSE Practice Test 18 — 15 Questions

Question 1

Refer to the exhibit. A security engineer runs the gcloud command to analyze IAM policy for a user in an organization. The output shows that the user has the 'compute.instances.create' permission via a role at the organization level. However, the user is unable to create Compute Engine instances in a specific project. What is the most likely cause?

Accepted Answer

An organization policy constraint is denying the creation of Compute Engine instances.. Option C is correct because organization policy constraints in Google Cloud can override IAM permissions at any level. Even if the user has the 'compute.instances.create' permission via an organization-level role, an organization policy constraint (e.g., constraints/compute.vmExternalIpAccess or constraints/compute.restrictCreateVM) can explicitly deny the creation of Compute Engine instances in a specific project. This is a common scenario where IAM allows the action, but organization policy blocks it.

Answer

The user does not have the 'compute.instances.create' permission at the project level.

Answer

The user has the permission but through a different role than expected.

Answer

The user's role is not granted at the project level.

Question 2

A financial services company must ensure that its Google Cloud environment complies with PCI DSS. The security team needs to implement controls to protect cardholder data. Which TWO measures should they implement? (Choose TWO.)

Accepted Answer

Configure VPC Service Controls to restrict data movement from managed services.. C is correct because VPC Service Controls create a security perimeter around Google Cloud managed services, preventing data exfiltration by restricting data movement from within the perimeter to unauthorized external networks. This is critical for PCI DSS compliance as it helps protect cardholder data from unauthorized access or transfer. E is correct because Customer-Managed Encryption Keys (CMEK) allow the organization to control and manage the encryption keys used to protect data at rest, meeting PCI DSS requirement 3.4 for rendering cardholder data unreadable.

Answer

Enable Data Access audit logs for all Cloud Storage buckets.

Answer

Use Security Command Center to detect misconfigurations.

Answer

Enable Shielded VMs on all Compute Engine instances.

Question 3

Drag and drop the steps to set up a Cloud VPN with a static route in the correct order.

Question 4

Drag and drop the steps to respond to a data breach involving a Cloud Storage bucket in the correct order.

Question 5

Drag and drop the steps to configure a security scanner to scan a web application in the correct order.

Question 6

A DevOps team wants to grant a contractor temporary access to a specific Cloud Storage bucket for 30 days. The contractor has a Google account (example@gmail.com). The bucket contains sensitive data, and the access should be as restrictive as possible. What is the recommended way to grant this access?

Accepted Answer

Add the contractor's email to the bucket-level IAM policy with the 'Storage Object Viewer' role.. Option C is correct because bucket-level IAM policies allow you to grant granular, time-bound access to a specific bucket without affecting other resources in the project. By adding the contractor's email (example@gmail.com) to the bucket-level IAM policy with the 'Storage Object Viewer' role, you restrict access to only that bucket and only to read objects, which is the most restrictive approach for a 30-day temporary access requirement.

Answer

Create a bucket ACL granting the contractor READ access.

Answer

Add the contractor's email to the project-level IAM policy with the 'Storage Object Viewer' role.

Answer

Generate a signed URL for the contractor to access the bucket objects.

Question 7

A security engineer is tasked with automating the remediation of non-compliant resources in a Google Cloud organization. The organization uses Organization Policy Service to enforce constraints. The engineer needs to automatically disable a specific service (e.g., Compute Engine API) for a project that violates a policy. Which Google Cloud service should be used to trigger this remediation?

Accepted Answer

Cloud Functions. Cloud Functions is correct because it can be triggered by real-time event notifications (e.g., from Cloud Asset Inventory or Pub/Sub) when a policy violation is detected, and then execute custom code to disable the Compute Engine API via the Service Usage API. This serverless, event-driven model is ideal for automated remediation workflows without managing infrastructure.

Answer

Cloud Build

Answer

Cloud Run

Answer

Cloud Scheduler

Question 8

Which THREE components are customer responsibilities under the Google Cloud Shared Responsibility Model for IaaS? (Choose 3.)

Accepted Answer

Security of virtual network controls. Option A is correct because under the IaaS shared responsibility model, the customer is responsible for configuring and managing virtual network controls such as firewalls, route tables, and network ACLs. Google Cloud provides the underlying network infrastructure, but the customer must secure traffic flows and access policies within their VPC.

Answer

Physical security of data centers

Answer

Security of the hypervisor

Question 9

A healthcare organization must ensure that only authorized personnel can access Protected Health Information (PHI) stored in Cloud Storage. They need to enforce encryption at rest and control access based on data classification. Which combination of Google Cloud services should they use?

Accepted Answer

Use customer-managed encryption keys (CMEK) with Cloud KMS and VPC Service Controls.. Option D is correct because it combines customer-managed encryption keys (CMEK) with Cloud KMS to enforce encryption at rest using keys controlled by the organization, and VPC Service Controls to restrict data access based on data classification by creating a security perimeter around Cloud Storage. This ensures that only authorized personnel within the defined perimeter can access PHI, meeting both encryption and access control requirements.

Answer

Use customer-supplied encryption keys (CSEK) and Cloud Audit Logs.

Answer

Use Cloud HSM for key management and Cloud DLP to inspect data.

Answer

Enable Access Transparency and use Organization Policies to restrict resource locations.

Question 10

A company is migrating to Google Cloud and needs to comply with the Health Insurance Portability and Accountability Act (HIPAA). They plan to use Cloud SQL for MySQL and Cloud Storage. Which TWO actions must they take to ensure HIPAA compliance?

Accepted Answer

Sign a Business Associate Agreement (BAA) with Google Cloud.. Option B and D are correct. HIPAA requires a Business Associate Agreement (BAA) with Google, and encryption at rest must be enabled. Cloud SQL and Cloud Storage both support encryption at rest. Option A is wrong because disabling automatic backups is not a HIPAA requirement. Option C is wrong because VPC Service Controls are for data exfiltration prevention, not specifically required by HIPAA. Option E is wrong because HIPAA does not mandate a specific key management service; CMEK is optional.

Answer

Disable automatic backups to prevent exposure of protected health information (PHI).

Answer

Implement VPC Service Controls to create a perimeter around the projects.

Answer

Use customer-managed encryption keys (CMEK) for all services.

Question 11

Match each compliance framework to its focus area.

Question 12

Drag and drop the steps to set up IAM conditions for a service account in the correct order.

Question 13

A multinational corporation operates multiple Google Cloud projects across several folders. They have a security requirement to enforce that all Cloud Storage buckets are created with uniform bucket-level access enabled and that no bucket has public access. They want to automatically remediate any non-compliant bucket that violates these policies. Currently, they use Organization Policies to enforce uniform bucket-level access, but they still find some buckets with public access due to exceptions. They have Cloud Security Command Center (Cloud SCC) enabled and receive findings about public buckets. The operations team wants to build a solution that automatically disables public access on non-compliant buckets. Which approach should they take?

Accepted Answer

Create a Cloud Security Command Center notification channel for public bucket findings, publish to a Pub/Sub topic, and trigger a Cloud Function that removes public IAM bindings from the bucket.. Option B is correct because using Cloud Functions triggered by Cloud SCC notifications allows real-time remediation. Option A is incorrect because Organization Policies can't automatically fix individual buckets after creation. Option C is incorrect because script runs on schedule, not real-time. Option D is incorrect because Cloud Monitoring alerts are not designed for this automatic remediation.

Answer

Create a new Organization Policy that denies public access to all buckets.

Answer

Configure a Cloud Monitoring alert policy that triggers a webhook to a third-party automation tool.

Answer

Write a script using gsutil and run it daily via Cloud Scheduler to check all buckets and remove public access.

Question 14

A large financial institution runs a critical application on Google Kubernetes Engine (GKE) clusters. Their security policy requires that all container images must be scanned for vulnerabilities and must come from a trusted artifact registry. They use Cloud Build to automatically build images from a CI/CD pipeline and push them to Artifact Registry. They want to enforce that only images that have passed vulnerability scanning and are signed can be deployed to the GKE cluster. Currently, they have set up Cloud Build to automatically tag images with a 'latest' tag on successful build, but they need a mechanism to prevent deployment of unsigned or vulnerable images. They also want to audit any attempts to deploy non-compliant images. What should they do?

Accepted Answer

Enable Binary Authorization on the GKE cluster, create Attestations for images that pass vulnerability scanning and signing in Cloud Build, and configure admission control to require attestations.. Option D is correct because combining Binary Authorization with Attestations from vulnerability and signing enables enforcement. Option A is incorrect because Cloud Nat is for outbound traffic, not image enforcement. Option B is incorrect because GKE policy does not natively enforce image contracts. Option C is incorrect because IAP is for access, not for image verification.

Answer

Use Cloud NAT to control which images can be pulled by GKE nodes.

Answer

Configure GKE policy to only allow images from a specific Artifact Registry repository and enable vulnerability scanning.

Answer

Use Cloud IAP to block nodes from pulling non-compliant images.

Question 15

A large enterprise runs a streaming data pipeline using Dataflow to process events from Pub/Sub, apply aggregations with fixed windows, and write results to BigQuery. They are experiencing high costs and long processing times. The Dataflow job uses Streaming Engine, but the workers show high CPU utilization. The pipeline has autoscaling enabled, but the number of workers rarely increases. The team wants to reduce processing time and cost. What should they do?

Accepted Answer

Optimize the windowing interval to reduce data shuffling.. Optimizing the windowing interval reduces data shuffling and can improve performance without adding resources. Long windows cause more state to be kept, increasing CPU and memory demands. Option A is incorrect because increasing maxNumWorkers may help but the job is already CPU-bound and not scaling; more workers might not reduce CPU per worker if the issue is data shuffling. Option B is incorrect because larger machines increase cost and may not address the root cause. Option D is incorrect because switching to batch would not meet real-time requirements and may cause data loss.

Answer

Use a larger machine type for workers, such as n1-standard-8.

Answer

Increase the number of workers by setting maxNumWorkers higher.

Answer

Switch from Streaming Engine to batch mode to reduce resource overhead.