PCSE Practice Test 2 — 10 Questions

Question 1

A security team has a Cloud KMS key used for encrypting Cloud Storage objects. They need to ensure that when the key is rotated, old data remains decryptable without manual re-encryption. They also want to minimize the number of key versions. Which approach should they take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use automatic rotation and keep one previous key version indefinitely.. Cloud KMS supports automatic key rotation while retaining previous key versions indefinitely. When a key is rotated, new data is encrypted with the latest version, but old data remains decryptable using the previous key version that is kept. This satisfies the requirement of minimizing manual intervention and key version count, as only one previous version is retained.

Answer

Use automatic rotation and disable previous key versions after 30 days.

Answer

Use manual rotation and delete old key versions after confirmation that all data has been re-encrypted.

Answer

Use symmetric key with purpose SYMMETRIC_ENCRYPT_DECRYPT and set rotation period to 0 (never).

Question 2

A company needs to retain audit logs for 7 years to meet regulatory compliance. They are using Cloud Logging. Which log storage strategy should they use to minimize costs while meeting the requirement?

Accepted Answer

Use a log sink to export logs to Cloud Storage with a retention policy of 7 years and nearline storage class.. Exporting logs to Cloud Storage via a log sink allows you to set a bucket retention policy of 7 years, meeting compliance requirements. Using the nearline storage class minimizes costs for logs that are accessed infrequently, as it offers lower storage costs than standard storage while still providing the necessary durability and retention capabilities.

Answer

Store logs in the _Required log bucket with a custom retention of 7 years.

Answer

Disable logging for non-critical resources to reduce log volume and retain only essential logs.

Answer

Use a log sink to export logs to BigQuery and set the table expiration to 7 years.

Question 3

A company wants to use Private Service Connect to publish a managed service (e.g., a custom application) so that consumers can access it privately within Google Cloud. Which THREE resources are involved in this setup?

Accepted Answer

PSC endpoint (forwarding rule). Private Service Connect involves creating a service attachment on the producer side (the managed service), which is then accessible via a PSC endpoint in the consumer's VPC. DNS configuration is needed to resolve the endpoint's IP address. IAM roles control who can create endpoints.

Answer

Cloud NAT gateway

Answer

VPC peering

Question 4

A security engineer is configuring VPC Service Controls to protect a Google Cloud project containing sensitive data. The project uses Cloud Storage and BigQuery. The engineer wants to ensure that data cannot be exfiltrated to external IP addresses outside the perimeter, but internal users should still be able to access the data from on-premises via a VPN. Which configuration should be applied?

Accepted Answer

Add the project to a VPC Service Controls perimeter and configure an ingress rule to allow traffic from the on-premises VPN CIDR ranges. VPC Service Controls (VPC-SC) allow you to define a security perimeter around Google Cloud services like Cloud Storage and BigQuery, preventing data exfiltration to external IPs. By adding the project to a perimeter and configuring an ingress rule that permits traffic from the on-premises VPN CIDR ranges, internal users can access the data via VPN while all other external traffic is blocked. This meets the requirement of preventing exfiltration to external IPs while allowing authorized on-premises access.

Answer

Do not use VPC Service Controls; instead, rely on IAM permissions and firewall rules to control access

Answer

Create a separate perimeter that denies all traffic and apply it to the project

Answer

Add the project to a VPC Service Controls perimeter with no additional ingress rules

Question 5

A security engineer needs to enforce that all Compute Engine VMs in an organization use Shielded VM features. Which approach should they use?

Accepted Answer

Create an organization policy with the constraint constraints/compute.requireShieldedVm set to True.. The organization policy constraint constraints/compute.requireShieldedVm is the correct way to enforce Shielded VM across all VMs.

Answer

Use IAP to enforce Shielded VM on all instances.

Answer

Enable Shielded VM in the project's compute engine settings.

Answer

Configure a firewall rule to block non-Shielded VMs.

Question 6

An engineer is configuring Cloud Armor for an HTTP(S) load balancer and needs to allow traffic only from users who have been authenticated by Identity-Aware Proxy (IAP). The backend service already has IAP enabled. What additional configuration is needed to ensure that only authenticated requests reach the backend?

Accepted Answer

No additional configuration is needed; IAP already blocks unauthenticated requests. When IAP is enabled on a backend service, it intercepts all requests and blocks unauthenticated traffic before it reaches the backend. Cloud Armor operates at the edge, but since IAP already enforces authentication at the application layer, no additional Cloud Armor configuration is required to restrict access to authenticated users. The load balancer forwards only requests that have passed IAP authentication to the backend.

Answer

Configure Cloud Armor to allow only traffic from the IP ranges used by IAP

Answer

Create a Cloud Armor security policy that requires a valid JWT token signed by IAP

Answer

Set a firewall rule on the backend instances to allow traffic only from the load balancer's health check IPs

Question 7

A healthcare company subject to HIPAA must prevent data exfiltration from Google Cloud storage buckets. They already use VPC Service Controls. Which additional control should they configure to directly block unauthorized copying of data to external projects?

Accepted Answer

Configure egress rules in the VPC Service Controls perimeter. VPC Service Controls allow you to define perimeters that restrict data movement between authorized and unauthorized projects. By configuring egress rules within the perimeter, you can explicitly block copying data to external projects, directly preventing data exfiltration. This is the correct additional control because it enforces policy at the network boundary, not just at the application or storage layer.

Answer

Enable Cloud Data Loss Prevention (DLP) scanning

Answer

Use Cloud Audit Logs to review access

Answer

Apply Cloud Identity-Aware Proxy (IAP) to buckets

Question 8

A company must ensure that only authorized users can access sensitive data in Cloud Storage for PCI DSS compliance. They have configured a bucket with uniform bucket-level access. Which IAM policy should they use to grant access to a security team?

Accepted Answer

Bind the security team to roles/storage.objectViewer at the bucket level.. The 'Storage Object Viewer' role grants read-only access to objects, which is sufficient for security monitoring. Option B is wrong because the admin role grants full access, violating least privilege. Option C is wrong because bucket-level access is already uniform, so ACLs are not needed. Option D is wrong because the bucket admin role gives full control, which is excessive.

Answer

Bind the security team to roles/storage.legacyBucketReader at the bucket level.

Answer

Use ACLs to give the security team READ access to the bucket.

Answer

Bind the security team to roles/storage.admin at the project level.

Question 9

Refer to the exhibit. A security engineer runs this command to check bucket permissions. What is the most significant security issue?

Accepted Answer

The bucket allows public read access via 'allUsers' in both ACL and legacy role.. The command output shows that the bucket has both an ACL granting 'allUsers' READER access and a legacy bucket role 'roles/storage.legacyBucketReader' assigned to 'allUsers'. This means the bucket is publicly readable via two independent mechanisms, which is the most significant security issue as it exposes all objects to the internet without authentication.

Answer

The domain example.com has viewer access, which may be too broad.

Answer

The legacy role 'roles/storage.legacyBucketReader' is used.

Answer

Uniform bucket-level access is disabled, allowing ACLs.

Question 10

A company has a Cloud Storage bucket containing sensitive data. They want to ensure that only users with specific IAM roles can access the bucket, and that access is logged for audit purposes. They also want to prevent public access. Which configuration steps should they take?

Accepted Answer

Enable uniform bucket-level access, set IAM policies, and enable Cloud Audit Logs.. Enabling uniform bucket-level access disables ACLs, forcing all access decisions to be made by IAM policies alone, which simplifies permission management and prevents public access. Setting IAM policies ensures only users with specific roles can access the bucket, and enabling Cloud Audit Logs captures all access requests for audit purposes. This combination meets all requirements: no public access, role-based access control, and logging.

Answer

Use IAM roles only and enable Cloud Audit Logs, but keep ACLs enabled.

Answer

Use VPC Service Controls and enable Cloud Audit Logs.

Answer

Enable fine-grained access using ACLs and enable Cloud Audit Logs.