PCSE Practice Test 19 — 15 Questions

Question 1

What is the purpose of Identity-Aware Proxy (IAP) in Google Cloud?

Accepted Answer

To authenticate users and enforce access policies for applications and VMs based on identity and context.. Identity-Aware Proxy (IAP) authenticates users and enforces access control policies for applications and VMs based on identity and context (such as user identity, device posture, and IP address). It acts as a gatekeeper in front of App Engine, Compute Engine, and GKE services, verifying the user's identity via Google accounts or external IdPs before allowing access. This is the core purpose of IAP.

Answer

To manage API keys for services running on Google Cloud.

Answer

To provide network-level firewall rules for HTTP traffic.

Answer

To encrypt data in transit between clients and Google Cloud.

Question 2

A Google Kubernetes Engine (GKE) cluster has applications that need to access Cloud Storage. The security team wants to grant fine-grained access per pod. What is the recommended approach?

Accepted Answer

Use Workload Identity: map each Kubernetes service account to a dedicated GCP service account with minimal permissions.. Workload Identity maps a Kubernetes service account to a dedicated GCP service account, allowing pods to authenticate to Cloud Storage with fine-grained, least-privilege IAM permissions without managing keys. This is the Google-recommended approach for per-pod access control in GKE.

Answer

Use node-level service accounts and rely on network policies to restrict pod access.

Answer

Store service account keys as Kubernetes secrets and mount them into pods.

Answer

Create a single GCP service account with Storage permissions, and use it for all pods in the cluster.

Question 3

Which of the following is a benefit of using organization policies over IAM policies for enforcing restrictions on resources?

Accepted Answer

Organization policies can restrict resources even if the user has Owner role.. Organization policies are constraints applied at the organization, folder, or project level that restrict resource configurations regardless of a user's IAM permissions. Even a user with the Owner role cannot bypass an organization policy, making them a powerful guardrail against misconfiguration and privilege abuse.

Answer

Organization policies can grant permissions to users.

Answer

Organization policies are applied to identities.

Answer

Organization policies are easier to audit than IAM policies.

Question 4

A web application behind an HTTPS load balancer is experiencing a high volume of malicious requests with SQL injection patterns. The security team wants to block these requests with minimal latency impact. Which Cloud Armor feature should they use?

Accepted Answer

Preconfigured WAF rules (OWASP ModSecurity CRS). Cloud Armor's preconfigured WAF rules are based on the OWASP ModSecurity Core Rule Set and are designed to detect and block common web attacks like SQL injection and XSS with minimal configuration and low latency. They run at the edge on the load balancer, so malicious requests are dropped before reaching the backend. This directly addresses the requirement to block SQL injection with minimal latency impact.

Answer

Rate limiting per IP

Answer

Custom rules with CEL expressions

Answer

Adaptive Protection

Question 5

A security engineer needs to ensure that a specific Compute Engine instance can only be accessed via HTTPS from users authenticated through Cloud Identity. The instance is behind an HTTP(S) load balancer. What should the engineer configure on the load balancer to enforce this access control?

Accepted Answer

Configure IAP on the backend service of the load balancer. Identity-Aware Proxy (IAP) is a Google Cloud service that enforces access control to applications based on user identity and context. When configured on the backend service of an HTTP(S) load balancer, IAP intercepts requests and requires users to authenticate via Cloud Identity (or Google Workspace) before allowing access. This ensures that only authenticated users can reach the Compute Engine instance, and it works seamlessly with HTTPS.

Answer

Set firewall rules to allow only HTTPS traffic from the load balancer's IP ranges

Answer

Enable HTTPS only on the load balancer and use client certificates for authentication

Answer

Configure Cloud Armor with a security policy to require valid JWT tokens

Question 6

A security engineer is designing data protection for Cloud Storage. Which TWO methods can be used to enforce encryption at rest for objects? (Choose TWO.)

Accepted Answer

Setting a bucket-level default encryption with a CMEK key.. Setting a bucket-level default encryption with a CMEK (Customer-Managed Encryption Key) ensures that all new objects written to the bucket are encrypted at rest using a key managed by the customer in Cloud KMS. This enforces encryption at rest at the bucket level, meeting the requirement.

Answer

Enabling VPC Service Controls.

Answer

Applying a retention policy.

Answer

Using a bucket policy that requires the x-goog-encryption header for uploads.

Question 7

A company is using Cloud SQL for MySQL to store financial data. They need to ensure that all data is encrypted at rest and in transit. What should they do?

Accepted Answer

Use the default encryption provided by Cloud SQL and enforce SSL/TLS connections.. Cloud SQL for MySQL automatically encrypts data at rest using AES-256, with no additional configuration required. To protect data in transit, you must enforce SSL/TLS connections by configuring the instance to require SSL and downloading the server certificate for client connections. This combination satisfies both encryption requirements without unnecessary complexity.

Answer

Use client-side encryption before storing data in Cloud SQL.

Answer

Enable encryption at rest by checking a box in the Cloud Console.

Answer

Enable CMEK on the Cloud SQL instance and configure SSL/TLS.

Question 8

A financial services company must store customer transaction records for 7 years to comply with SEC regulations. They currently use Cloud Storage with a lifecycle rule that deletes objects after 365 days. The compliance team needs to ensure that records are immutable and cannot be deleted or modified before the retention period expires. What should the security engineer do?

Accepted Answer

Enable Bucket Lock on the bucket and configure a retention policy of 7 years.. Bucket Lock is the only Google Cloud Storage feature that enforces immutability by preventing object deletion or modification for a specified retention period. By enabling Bucket Lock and configuring a 7-year retention policy, the company ensures compliance with SEC regulations, as objects cannot be deleted or overwritten even by the bucket owner or lifecycle rules. This overrides the existing 365-day lifecycle rule because retention policies take precedence over lifecycle deletion actions.

Answer

Apply a retention policy to each object individually using object holds.

Answer

Use VPC Service Controls to restrict access to the bucket to only authorized compliance personnel.

Answer

Modify the lifecycle rule to delete objects after 2555 days instead of 365 days.

Question 9

Which three actions help protect Cloud KMS key material? (Choose three.)

Accepted Answer

Use VPC Service Controls to restrict access to the key.. B is correct because VPC Service Controls create a security perimeter around Cloud KMS resources, preventing data exfiltration by restricting access to the key material from unauthorized networks or projects. This helps protect the key material even if an attacker gains credentials to the key, as the request must originate from within the allowed VPC scope.

Answer

Store the key in an HSM cluster.

Answer

Assign the Cloud KMS Admin role to all developers.

Question 10

A company wants to provide their employees access to a web application running on Compute Engine without exposing the VM to the public internet. The application uses a custom header to verify the user's identity. Which service should they use?

Accepted Answer

Cloud Identity-Aware Proxy (IAP). Identity-Aware Proxy (IAP) provides zero-trust access to web applications. It can be configured to verify identity and pass signed headers (e.g., X-Goog-Authenticated-User-Email) to the backend, allowing the application to verify the user without public IP exposure.

Answer

Cloud Armor with OAuth

Answer

Cloud Load Balancing with SSL termination

Answer

VPC firewall rules with source IP restrictions

Question 11

During a security incident, a forensic investigator needs to analyze a compromised Compute Engine instance without affecting the live environment. The instance has persistent disks with critical data. What is the best first step to preserve evidence?

Accepted Answer

Create a snapshot of the persistent disks.. Creating a snapshot of the persistent disks is the correct first step because it produces a point-in-time, read-only copy of the disk state in Cloud Storage without modifying the running instance, preserving evidence for forensic analysis. The snapshot can then be used to create a new disk attached to an isolated forensic VM.

Answer

Clone the instance to a new VM.

Answer

Export the disk image to Cloud Storage.

Answer

Enable VPC Flow Logs for the instance's network.

Question 12

A financial services company uses Cloud Storage to store sensitive customer data. They want to encrypt this data at rest using customer-managed encryption keys (CMEK) and automate key rotation every 90 days. Which approach should they take?

Accepted Answer

Create a Cloud KMS key ring and a key with rotation period 90 days. Use the key as CMEK for the Cloud Storage bucket.. Cloud KMS allows you to create a key ring and a key with a defined rotation period of 90 days, which can then be used as a customer-managed encryption key (CMEK) for a Cloud Storage bucket. This satisfies the requirement for customer-controlled key management and automated rotation without custom code.

Answer

Rely on Google-managed encryption keys (default Cloud Storage encryption) and enable key rotation logs for auditing.

Answer

Configure Cloud External Key Manager (EKM) to manage the encryption key externally and have Cloud Storage use it via CMEK integration.

Answer

Use customer-supplied encryption keys (CSEK) and implement a custom Cloud Function to rotate keys every 90 days.

Question 13

Which Google Cloud compliance certification requires the customer to sign a Business Associate Agreement (BAA) with Google?

Accepted Answer

HIPAA. HIPAA (Health Insurance Portability and Accountability Act) requires covered entities and their business associates to sign a Business Associate Agreement (BAA) with Google when using Google Cloud services that may involve protected health information (PHI). Google Cloud offers a BAA for HIPAA compliance, and customers must accept it to use services in a HIPAA-compliant manner.

Answer

PCI DSS

Answer

SOC 2

Answer

FedRAMP

Question 14

An organization uses Certificate Manager to provision SSL certificates for multiple domains across several load balancers. They want to automate certificate renewal. Which type of certificate should be used?

Accepted Answer

Google-managed certificates with DNS authorization. Google-managed certificates with DNS authorization are automatically provisioned, renewed, and rotated by Google when the domain's DNS records are configured with the required CNAME or A records. This eliminates manual renewal overhead and is the recommended approach for automating certificate lifecycle management across multiple load balancers.

Answer

Wildcard certificates purchased from a third-party CA

Answer

Self-managed certificates uploaded as PEM files

Answer

Certificates from a private CA

Question 15

A company wants to use a Google Cloud load balancer with an SSL certificate that is automatically provisioned and renewed. Which type of certificate should they use?

Accepted Answer

Google-managed certificate. Google-managed SSL certificates are automatically provisioned, renewed, and managed by Google Cloud for use with external HTTP(S) load balancers. They eliminate the operational overhead of manual certificate management, including renewal and deployment. The certificate is created and attached directly to the load balancer's target proxy, and Google handles the entire lifecycle. This is the only option that provides automatic provisioning and renewal without customer intervention.

Answer

Certificate Manager with a self-managed certificate

Answer

Certificate Authority Service

Answer

Self-managed certificate