PCSE Practice Test 19 — 15 Questions

Question 1

A small startup recently moved their infrastructure to Google Cloud. They have a single project with a few Compute Engine instances running a web application. The security team wants to ensure that all SSH access to the instances is audited and that any failed SSH attempts are alerted in real time. They have enabled OS Login and are using Cloud Identity-Aware Proxy (IAP) for SSH access. However, they are not sure how to capture the audit logs for SSH sessions. What should they do?

Accepted Answer

Enable Data Access audit logs for the IAP service and filter the logs for SSH connection attempts.. Option C is correct because IAP TCP forwarding logs are available as Admin Activity audit logs when IAP is used for SSH. Option A is incorrect because guest attributes are not for audit logs. Option B is incorrect because Cloud Monitoring does not directly log SSH attempts. Option D is incorrect because Serial port access logs are separate and not for IAP.

Answer

Enable Serial Port access logs on the instances to capture SSH sessions.

Answer

Configure Cloud Monitoring to watch for SSH connections via agent metrics.

Answer

Enable guest attributes on the instances to log SSH attempts.

Question 2

A startup is deploying a containerized application on Google Kubernetes Engine (GKE). The application is stateless and experiences variable traffic patterns, with periodic spikes during promotional events. The startup wants to minimize costs while ensuring the application can handle the variable load without performance degradation. They also prefer to automate scaling as much as possible. Which GKE configuration should they choose?

Accepted Answer

Use a cluster with node auto-provisioning and preemptible nodes.. Node auto-provisioning automatically scales the node pool based on pod resource requests, and preemptible nodes significantly reduce cost. This combination handles variable load while being cost-effective. Option B is incorrect because regional persistent disks are for stateful applications and increase cost. Option C is incorrect because a single zone and regular nodes may not handle spikes and can be more expensive. Option D is incorrect because a fixed node pool does not automatically scale to meet variable demand.

Answer

Use a cluster with node auto-repair and a fixed node pool.

Answer

Use a cluster with a single zone and regular nodes.

Answer

Use a cluster with regional persistent disks for pods.

Question 3

A company uses Cloud Storage buckets to store customer uploads. Recently, a customer reported that a file they uploaded yesterday is missing. The bucket has object versioning enabled. The security team wants to investigate how the file went missing and whether any other files have been affected. The company's compliance requirements mandate that all object deletions must be logged and reviewed. What should the admin do first to investigate the missing file?

Accepted Answer

Check Cloud Logging for storage.googleapis.com/object_delete events.. Checking Cloud Logging for object delete events is the most direct way to determine if the file was deleted and by whom. Option A is incorrect because listing versions would only show if the object exists but not the cause of disappearance. Option C is incorrect because enabling lifecycle management does not help with investigation. Option D is incorrect because access logs are not automatically enabled and would not specifically show delete events.

Answer

Check the access logs in the Storage bucket's logs section.

Answer

Use gsutil ls -a to list all versions of objects in the bucket.

Answer

Enable Object Lifecycle Management to restore deleted objects.

Question 4

A company needs to grant a service account the ability to manage Compute Engine instances (start, stop, create) in a specific set of projects. The administrator wants to follow the principle of least privilege. Which TWO steps should the administrator take? (Choose TWO.)

Accepted Answer

Use IAM Conditions to restrict the service account's access to only the required projects or resources.. Option C is correct because IAM Conditions allow the administrator to restrict the service account's permissions to a specific set of projects or resources, enforcing least privilege by limiting the scope of the granted role. This ensures the service account can only manage Compute Engine instances in the designated projects, not all projects in the folder or organization.

Answer

Grant the predefined roles/compute.viewer role to the service account at the folder level.

Answer

Use Cloud IAP to tunnel into Compute Engine instances to perform management tasks.

Answer

Grant the predefined roles/compute.admin role to the service account at the organization level.

Question 5

A company uses a shared VPC with multiple service projects. A security administrator created an organization policy with the constraint 'gcp.resourceLocations' to restrict Cloud SQL instance creation to only the 'us-central1' region. The policy is applied at the organization level. A Cloud SQL administrator is using a service account with the predefined role 'roles/cloudsql.admin' (also granted at the organization level) to create instances. Despite the organization policy, the service account successfully creates a Cloud SQL instance in the 'europe-west1' region. The administrator verifies that the organization policy is active and the constraint is enforced. What is the most likely reason the policy is not preventing the creation?

Accepted Answer

The organization policy is set to 'dry-run' mode, so it logs violations but does not deny the operation.. Option A is correct because the organization policy constraint 'gcp.resourceLocations' can be set to 'dry-run' mode, which logs violations but does not deny the operation. In this scenario, the policy is active and enforced, but if it is in dry-run mode, it will not block the creation of Cloud SQL instances in non-compliant regions. The service account's successful creation in 'europe-west1' indicates that the policy is not actively denying the request, which aligns with dry-run behavior.

Answer

The organization policy is applied at the organization level, but the service account's permissions are also at the organization level, causing an override.

Answer

The service account has the 'Organization Policy Administrator' role, which allows it to bypass constraints.

Answer

The gcp.resourceLocations constraint does not apply to Cloud SQL instances.

Question 6

A company operates a hybrid cloud environment with on-premises data centers and Google Cloud Platform. They store sensitive customer data in Cloud Storage buckets and use Data Loss Prevention (DLP) to scan for and inspect sensitive content. They have automated DLP inspection jobs that run periodically, but they want to automatically redact sensitive data (e.g., Social Security numbers) in any new object as soon as it is written to a specific bucket. The redacted version should replace the original object in the same bucket. Which of the following is the most effective and recommended approach?

Accepted Answer

Set up a Cloud Function triggered by Cloud Storage 'finalize' events. The function calls the DLP API to inspect the object, creates a redacted version, and deletes the original object, replacing it with the redacted data.. Option A is correct: Triggering a Cloud Function on object finalize events, running DLP inspection, and rewriting the object with redacted data is the recommended pattern. Option B is incorrect because DLP cannot modify objects in place; it produces a new artifact. Option C is about retention, not redaction. Option D is about perimeter security and does not address redaction.

Answer

Enable a bucket retention policy and use DLP to scan objects and quarantine those with sensitive data by moving them to a different bucket.

Answer

Use Cloud Storage Object Change Notifications to alert a Compute Engine instance that runs a DLP job to modify the object in place.

Answer

Use VPC Service Controls to create a secure perimeter around the bucket and then run DLP scans on a schedule.

Question 7

A company wants to encrypt data at rest in Cloud SQL. Which TWO methods are supported? (Choose TWO.)

Accepted Answer

Default encryption at rest with Google-managed keys. Option A is correct because Cloud SQL provides default encryption at rest using AES-256 with Google-managed keys, which are automatically generated and rotated by Google. This encryption is transparent to the user and requires no additional configuration, ensuring data is encrypted before being written to disk.

Answer

Cloud HSM hardware security module for encryption

Answer

Cloud Key Management Service (Cloud KMS) as a standalone encryption method

Answer

Client-side encryption before storing data in Cloud SQL

Question 8

Your VPC has a default firewall rule that allows SSH (TCP port 22) from all sources. You need to allow HTTP traffic (TCP port 80) only from instances tagged 'web-servers' to the target instances, and block all other inbound traffic including SSH. Which TWO steps should you take?

Accepted Answer

Delete the default-allow-ssh rule.. Option C is correct because deleting the default-allow-ssh rule removes the rule that permits SSH from all sources (0.0.0.0/0), which is necessary to block all inbound SSH traffic as required. Option D is correct because creating a firewall rule with priority 1000 that allows ingress on TCP port 80 from instances tagged 'web-servers' explicitly permits HTTP traffic only from the desired source, and since lower priority numbers are evaluated first, this rule will be applied before any higher-numbered (lower priority) default rules.

Answer

Modify the default-allow-ssh rule to set its source filter to an empty range.

Answer

Create a firewall rule with priority 65535 allowing all traffic from 0.0.0.0/0.

Answer

Create a firewall rule with priority 1000 allowing ingress from instances with tag 'web-servers' on TCP port 443.

Question 9

Your company is deploying a multi-tier application in a single VPC with two subnets: web (10.0.1.0/24) and db (10.0.2.0/24). The web instances need to connect to a private Cloud SQL instance (MySQL) that is provisioned in a service project. The Cloud SQL instance has a private IP address 10.0.3.5 assigned using private services access. You have established VPC peering between your VPC and the service producer VPC (the Google-managed VPC hosting Cloud SQL). You verified that the peering connection is in 'ACTIVE' state. The web instances can reach internet sites, but connections to the Cloud SQL instance (using the MySQL client) are timing out. The db instances do not need to connect to Cloud SQL. What is the most likely cause and recommended solution?

Accepted Answer

Configure the VPC peering connection to export custom routes from your VPC to the service producer VPC.. The web instances are timing out when connecting to the Cloud SQL private IP (10.0.3.5) because the VPC peering connection is not exporting custom routes from your VPC to the service producer VPC. By default, VPC peering does not export custom routes (including the subnet routes for 10.0.1.0/24 and 10.0.2.0/24) unless explicitly configured. Without these routes, the Cloud SQL instance cannot send response traffic back to the web instances, causing the TCP handshake to fail (SYN sent, SYN-ACK never received). Enabling 'Export custom routes' on the peering connection from your VPC to the service producer VPC resolves this by advertising your subnet routes to the Cloud SQL host VPC.

Answer

Re-create the VPC peering connection because it might be misconfigured.

Answer

Change the Cloud SQL instance to use a public IP and allowlist your web subnet.

Answer

Set up Cloud NAT for the web subnet to enable outbound connections.

Question 10

A company is using Cloud Run for a containerized application. They notice increased latency during peak hours. The operations team wants to identify the root cause. Which two steps should they take?

Accepted Answer

Enable Cloud Logging and use Logs Explorer to query request latency for each endpoint.. Option A is correct because Cloud Logging with Logs Explorer allows the operations team to query and analyze request latency per endpoint, which is essential for identifying which specific endpoints contribute to increased latency during peak hours. This granular visibility into request-level performance helps pinpoint the root cause of latency issues in a Cloud Run service.

Answer

Implement Cloud Armor security policies to protect against DDoS attacks.

Answer

Set up a Cloud Monitoring dashboard to visualize CPU utilization for the Cloud Run service.

Answer

Enable VPC Flow Logs to analyze network traffic to and from the Cloud Run service.

Question 11

An organization wants to allow a group of external auditors read-only access to specific BigQuery datasets in a project, but only during working hours (9 AM to 5 PM). The auditors belong to an external Google Workspace domain. Which IAM configuration should be used?

Accepted Answer

Create a custom role with required permissions on the datasets, grant it to the auditors' group with an IAM condition using request.time between 9 AM and 5 PM.. Option A is correct because IAM conditions allow you to enforce time-based access using the `request.time` attribute, which can restrict access to specific hours. By granting a custom role with read-only permissions on the BigQuery datasets and attaching a condition that `request.time` falls between 9 AM and 5 PM, the auditors from the external Google Workspace domain will only have access during working hours. This approach is native to IAM and does not require external automation or network-level controls.

Answer

Configure a Cloud Scheduler job to add and remove the auditors' group membership at the required times.

Answer

Create an Organization Policy with a time constraint on the datasets.

Answer

Use VPC Service Controls with an access level that allows during working hours.

Question 12

A company has a Google Group called team-a@example.com that contains all developers. The developers need to deploy Cloud Functions. What is the best practice to grant the necessary permissions?

Accepted Answer

Grant the group roles/cloudfunctions.developer on the project.. Option C is correct because granting the IAM role `roles/cloudfunctions.developer` to the Google Group at the project level follows the principle of least privilege and allows all members of the group to deploy Cloud Functions without granting excessive permissions. This approach centralizes permission management via the group, avoiding the need to manage individual user IAM bindings.

Answer

Add each developer's email to the IAM policy with roles/cloudfunctions.developer.

Answer

Grant the group roles/cloudfunctions.developer at the organization level.

Answer

Grant the group roles/cloudfunctions.admin on the project.

Question 13

A developer is creating a Cloud Function that needs to access a Cloud SQL database. They have granted the function's service account the Cloud SQL Client role. However, the function still gets permission denied. What is the most likely issue?

Accepted Answer

The Cloud SQL instance is not configured with an authorized network that includes the function's IP range, or the function is not using the Cloud SQL Auth proxy.. Option C is correct because Cloud Functions use the Cloud SQL Auth proxy, which requires the service account to have the Cloud SQL Client role, but also the function must be in the same VPC or configured with VPC connector, otherwise it cannot reach the database IP. However, the most common reason is that the function is not using the Cloud SQL Auth proxy or the connection string is incorrect. But given the options, the most likely is that the function is trying to connect via public IP without proper authorized networks. Option A is wrong because the Cloud SQL Client role is sufficient if networking is correct. Option B is wrong because Cloud SQL Admin is unnecessary. Option D is wrong because Cloud SQL does not require VPN if using Cloud SQL Auth proxy.

Answer

The service account needs the Cloud SQL Admin role instead.

Answer

The function must use a VPN to connect to Cloud SQL.

Answer

The function needs to be in the same region as the Cloud SQL instance.

Question 14

Which TWO practices help implement the principle of least privilege when configuring access to Google Cloud resources? (Choose two.)

Accepted Answer

Create custom roles that include only the specific permissions needed.. Option C is correct because creating custom roles allows you to define a precise set of permissions, ensuring that a principal has only the minimum permissions required to perform their job function. This directly implements the principle of least privilege by avoiding the broad permissions often included in predefined roles.

Answer

Grant roles at the organization level to simplify administration.

Answer

Use a single service account for all Cloud Functions in a project to simplify key management.

Answer

Grant IAM roles directly to individual users for better traceability.

Question 15

A user is getting a permission denied error when trying to access a Cloud SQL instance from a Compute Engine VM. The VM's service account has the Cloud SQL Client role. What is the most likely cause?

Accepted Answer

The Cloud SQL API is not enabled for the project.. Even with correct IAM roles, the Cloud SQL API must be enabled for the project. The service account being attached is confirmed by the role assignment, private IP is not required for Client role, and using a proxy is optional but not the cause of permission denied.

Answer

The service account is not attached to the VM.

Answer

The user is not using a Cloud SQL proxy.

Answer

The Cloud SQL instance does not have a private IP.