PCSE Practice Test 19 — 15 Questions

Question 1

A developer needs to create a custom IAM role that allows only a specific set of permissions for managing Cloud SQL instances. The role should be available at the organization level. Which command should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

gcloud iam roles create ROLE_ID --organization=ORGANIZATION_ID --file=role.yaml. Custom roles can be created at the organization level using the 'gcloud iam roles create' command with the '--organization' flag (or '--org' for short). The role is defined in a YAML file that specifies the permissions. The 'gcloud organizations add-iam-policy-binding' is used to assign roles, not create them. The 'gcloud iam service-accounts create' is for service accounts. The 'gcloud projects add-iam-policy-binding' is for project-level IAM bindings.

Answer

gcloud projects add-iam-policy-binding PROJECT_ID --member=... --role=...

Answer

gcloud iam service-accounts create SA_NAME --display-name=...

Answer

gcloud organizations add-iam-policy-binding ORGANIZATION_ID --member=... --role=...

Question 2

Which of the following is a key advantage of using Workload Identity Federation over service account keys for authenticating workloads running on AWS?

Accepted Answer

It allows the use of short-lived tokens instead of long-lived keys.. Workload Identity Federation allows workloads to use short-lived tokens from the external identity provider (e.g., AWS STS) to impersonate a Google service account, eliminating the need to manage and rotate long-lived keys. Service account keys are long-lived secrets that can be leaked.

Answer

It eliminates the need to create service accounts.

Answer

It supports MFA for workload authentication.

Answer

It reduces latency compared to using keys.

Question 3

A company has a GKE cluster with a Kubernetes Service Account (KSA) that needs to access Cloud Storage. They want to bind the KSA to a Google Cloud service account (GCP SA) so that pods running under the KSA inherit the GCP SA's permissions. They have enabled Workload Identity on the cluster. What is the correct step to bind the KSA to the GCP SA?

Accepted Answer

Grant the KSA the role iam.workloadIdentityUser on the GCP SA by running: gcloud iam service-accounts add-iam-policy-binding GCP_SA_EMAIL --member=serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME] --role=roles/iam.workloadIdentityUser. The correct binding is to grant the 'iam.workloadIdentityUser' role on the GCP SA to the KSA's identity. The KSA identity is represented in IAM as the principal 'serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]'. This allows the KSA to impersonate the GCP SA. Creating a service account key defeats the purpose of Workload Identity. Adding an annotation to the KSA is necessary but not sufficient; the IAM binding is also required.

Answer

Annotate the KSA with iam.gke.io/gcp-service-account=GCP_SA_EMAIL. No further steps are needed.

Answer

Create a JSON key for the GCP SA and store it as a Kubernetes secret, then mount it into the pods.

Answer

Grant the GCP SA the role roles/iam.serviceAccountUser on the KSA.

Question 4

A DevOps team uses GitHub Actions to deploy infrastructure to Google Cloud. They want to avoid storing long-lived service account keys. Which approach should they use to authenticate from GitHub Actions to Google Cloud?

Accepted Answer

Use Workload Identity Federation by configuring a workload identity pool and provider for GitHub.. Workload Identity Federation allows GitHub Actions to exchange GitHub OIDC tokens for Google Cloud service account credentials. This eliminates the need for service account keys. The team must create a workload identity pool and provider in GCP, and configure GitHub Actions to use Google's action with 'workload_identity_provider'. Granting the service account token creator role is not the correct method. Using a Compute Engine instance is not relevant for GitHub Actions.

Answer

Grant the service account token creator role to the GitHub Actions runner.

Answer

Download a JSON service account key and store it as a GitHub secret.

Answer

Create a Compute Engine instance with a service account and run GitHub Actions from there.

Question 5

An organization wants to allow users to access a web application running on Compute Engine via HTTPS. The application requires users to authenticate with their corporate credentials (SAML 2.0 IdP). Which Google Cloud service should be used?

Accepted Answer

Identity-Aware Proxy (IAP) with HTTPS. Identity-Aware Proxy (IAP) with HTTPS provides authentication and authorization for web applications. It integrates with external SAML IdPs through Cloud Identity or G Suite. Cloud Load Balancing with SSL does not authenticate. Cloud Armor is for security policies. Cloud NAT is for outbound traffic.

Answer

Cloud NAT

Answer

Cloud Armor

Answer

Cloud Load Balancing with SSL certificates

Question 6

Your organization has an IAM policy at the folder level that grants a user the Compute Admin role. A deny policy at the project level denies the same user the compute.instances.create permission. What is the effective access for this user on the project?

Accepted Answer

The user cannot create instances because deny policies override allow policies.. Deny policies always override allow policies. The deny at the project level explicitly denies compute.instances.create, so the user cannot create instances despite the folder-level allow.

Answer

The user can create instances because the allow policy at the folder level takes precedence over the deny policy at the project level.

Answer

The user can create instances because the project-level deny policy only applies to resources within the project, not to permissions inherited from the folder.

Answer

The user can create instances because deny policies only block explicit allows, not inherited ones.

Question 7

A developer wants to allow a CI/CD pipeline running on GitHub Actions to deploy resources to a GCP project without using service account keys. Which two components are needed? (Choose two.)

Accepted Answer

A Workload Identity Pool and Provider configured for GitHub.. Workload Identity Federation allows GitHub Actions to exchange GitHub OIDC tokens for GCP service account impersonation. You need to set up a workload identity pool and provider for GitHub. The GitHub Actions workflow must be configured to use the OIDC token and request impersonation of a service account.

Answer

A Cloud Build trigger to run the workflow.

Answer

A Cloud KMS key to encrypt the workflow.

Answer

A service account JSON key stored as a GitHub secret.

Question 8

A company uses Google Workspace and wants to allow users to authenticate to a third-party SaaS application using their Google credentials. The SaaS application supports SAML 2.0. What should the administrator configure?

Accepted Answer

SAML 2.0 SSO in Google Admin Console. Google Workspace supports SAML 2.0 federation. The admin would set up a custom SAML app in the Google Admin console, configuring the IdP (Google) and SP (SaaS app) metadata.

Answer

Workload Identity Federation

Answer

Cloud Identity-Aware Proxy (IAP)

Answer

OAuth 2.0 consent screen

Question 9

An application running on Compute Engine needs to authenticate to Google Cloud APIs. The security engineer wants to avoid managing keys. What is the recommended method?

Accepted Answer

Attach a service account to the VM instance and use the metadata server to obtain tokens.. Use the default compute engine service account or a custom service account attached to the VM instance. The VM automatically obtains tokens via the metadata server, no keys required. This is the recommended approach for workloads on Compute Engine.

Answer

Store the service account key in Cloud Secret Manager and retrieve it at boot.

Answer

Create a service account key and store it in the instance's local disk.

Answer

Use workload identity federation to exchange a JWT from the application.

Question 10

A security engineer is configuring access for a service account used by a batch job that runs on Compute Engine. The job needs to read from a BigQuery dataset and write results to Cloud Storage. What is the recommended way to grant these permissions?

Accepted Answer

Create a custom role with bigquery.datasets.get, bigquery.tables.get, bigquery.tables.getData, storage.objects.create, storage.objects.get, and storage.objects.list.. Create a custom role with the required BigQuery and Storage permissions, or use predefined roles: BigQuery Data Viewer (roles/bigquery.dataViewer) and Storage Object Admin (roles/storage.objectAdmin) for write access. The best practice is to use the principle of least privilege: grant only the necessary permissions. Predefined roles are acceptable if they match the needs.

Answer

Use the default compute engine service account and grant it BigQuery Admin (roles/bigquery.admin) and Storage Admin (roles/storage.admin).

Answer

Grant the service account the BigQuery Data Owner role (roles/bigquery.dataOwner) and Storage Admin (roles/storage.admin).

Answer

Grant the service account the BigQuery Data Viewer (roles/bigquery.dataViewer) and Storage Object Viewer (roles/storage.objectViewer).

Question 11

Your organization wants to assign a set of permissions to a group of users that allows them to create and delete Compute Engine instances, but not to modify other resources like Cloud Storage buckets. Which type of IAM role should you create?

Accepted Answer

Custom role with only compute.instances.create and compute.instances.delete. Custom IAM roles allow you to curate a specific set of permissions tailored to your needs. Predefined roles like roles/compute.instanceAdmin include broader permissions that may not be desired. Basic roles (Owner, Editor, Viewer) are too broad and should be avoided in production.

Answer

Predefined role (roles/compute.instanceAdmin.v1)

Answer

Basic role (Editor)

Answer

Predefined role (roles/editor)

Question 12

A security team wants to enforce that all Compute Engine instances in the organization use Shielded VM features (Secure Boot, vTPM, Integrity Monitoring). What should they configure?

Accepted Answer

The built-in constraint constraints/compute.requireShieldedVm. The organization policy constraint constraints/compute.requireShieldedVm enforces that all new VMs must have Shielded VM enabled. It is a built-in constraint available in the Organization Policy service.

Answer

A custom organization policy with a CEL condition

Answer

An IAM policy that only allows creation of Shielded VMs

Answer

A deny policy that denies the permission compute.instances.create unless Shielded VM is enabled

Question 13

A security engineer needs to ensure that service account keys are not used in production workloads. They want to enforce this across the entire organization. Which TWO controls should they implement?

Accepted Answer

Use a custom organization policy constraint to enforce service account key rotation (max age 90 days). The built-in organization policy constraint constraints/iam.disableServiceAccountKeyCreation prevents creation of new keys. A custom organization policy can enforce key rotation and disable use of existing keys older than a certain age.

Answer

Use VPC Service Controls to restrict the IAM API

Answer

Use a deny policy to deny the permission iam.serviceAccountKeys.create

Answer

Use IAM roles to remove the ability to generate keys for all users

Question 14

A DevOps team wants to grant a CI/CD pipeline (running on a Compute Engine VM) the ability to restart Compute Engine instances in a specific project. The VM has a service account attached. What is the best practice to grant this permission?

Accepted Answer

Create a custom role with compute.instances.stop and compute.instances.start permissions, and assign it to the service account at the project level.. The best practice is to create a custom role with only the required permissions (compute.instances.stop and compute.instances.start) and assign it to the service account.

Answer

Generate a service account key and use it in the CI/CD system to authenticate.

Answer

Grant the VM's service account the roles/iam.serviceAccountUser role so it can impersonate another service account that has Compute Admin.

Answer

Grant the service account the Compute Admin role (roles/compute.admin) at the project level.

Question 15

A company runs a batch job on Compute Engine that processes sensitive data. The job uses a service account with a JSON key file stored on the VM. A security audit recommends removing long-lived keys. The job must run unattended. What is the best alternative?

Accepted Answer

Create a new service account and attach it to the VM instance; remove the old key.. Using a service account attached to the VM instance is the best practice. Compute Engine automatically obtains short-lived tokens from the metadata server, eliminating the need for keys. Workload Identity Federation is for external workloads. Secret Manager still requires a key to access. Default compute service account is less secure than a custom one.

Answer

Store the service account key in Secret Manager and retrieve it at runtime.

Answer

Use the default compute engine service account instead.

Answer

Use Workload Identity Federation to authenticate the batch job.