PCSE Practice Test 20 — 15 Questions

Question 1

A healthcare organization is migrating PHI workloads to Google Cloud and needs to encrypt data at rest with keys that are generated and managed within their own on-premises hardware security module (HSM). Which encryption approach should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Cloud External Key Manager (Cloud EKM).. Cloud External Key Manager (Cloud EKM) allows you to use encryption keys that are generated and managed in an external key management system, such as an on-premises HSM, while still integrating with Google Cloud services. This meets the requirement of keeping key material outside Google Cloud and under the organization's direct control. Cloud EKM acts as a bridge between Google Cloud and the external key manager, so data at rest is encrypted with keys that never leave the customer's environment.

Answer

Apply default Google-managed AES-256 encryption.

Answer

Use Cloud Key Management Service (Cloud KMS) with Cloud HSM to generate keys.

Answer

Use customer-supplied encryption keys (CSEK).

Question 2

A company has a Kubernetes cluster on GKE that runs a microservice. The microservice needs to read from a Cloud Spanner database. The security team requires that the microservice uses the principle of least privilege and that credentials are never stored as Kubernetes secrets. What is the recommended configuration?

Accepted Answer

Enable Workload Identity, create a Kubernetes service account, and annotate it to map to a Google Cloud service account with the necessary roles.. Workload Identity is the GKE-recommended way to let Kubernetes workloads authenticate to Google Cloud APIs without storing long-lived credentials. By enabling Workload Identity on the cluster, creating a Kubernetes service account, and annotating it with iam.gke.io/gcp-service-account to map to a GCP service account with least-privilege roles, the pod receives short-lived federated tokens. This satisfies both least privilege and the prohibition on Kubernetes secrets holding credentials.

Answer

Use the Compute Engine default service account for the node pool.

Answer

Create a Kubernetes secret containing a service account key and mount it into the pod.

Answer

Assign the required IAM roles to the GKE node's default service account and use it from the pod.

Question 3

A healthcare organization is migrating to Google Cloud and needs to ensure that all data stored in Cloud Storage is encrypted at rest with customer-managed encryption keys (CMEK) to meet HIPAA requirements. The security team wants to centrally manage key rotation and access. Which solution should they implement?

Accepted Answer

Use Cloud Key Management Service (Cloud KMS) with CMEK and enable key rotation.. Cloud KMS with CMEK allows the organization to centrally manage encryption keys, including automated key rotation, while maintaining customer control over the keys used to encrypt Cloud Storage data. This meets HIPAA requirements for encryption at rest with customer-managed keys, as Cloud KMS integrates directly with Cloud Storage to enforce encryption using the specified key.

Answer

Use Cloud Data Loss Prevention (DLP) to de-identify data before storing.

Answer

Use Cloud Hardware Security Module (Cloud HSM) with CMEK.

Answer

Use customer-supplied encryption keys (CSEK) stored in Cloud Storage.

Question 4

A company wants to allow users from a specific on-premises IP range to access a service deployed on Google Cloud, but only if the user's device is compliant with corporate security policies (e.g., has antivirus enabled). Which combination of services can achieve this?

Accepted Answer

VPC Service Controls with an access level that includes IP and device conditions. VPC Service Controls with an access level that combines IP-based conditions (corporate CIDR) and device conditions (via Endpoint Verification / context-aware access) is the Google Cloud mechanism designed for exactly this: perimeter-based access control that evaluates both network origin and device posture before allowing access to a protected service. Access levels support both ip_subnetworks and device policy attributes in a single expression.

Answer

Firewall rules with source ranges and service accounts

Answer

Cloud Armor with geo-based access control

Answer

Cloud IDS with threat detection

Question 5

A company wants to detect and alert on potential network threats, such as malware and command-and-control traffic, within their VPC. They need a managed service that integrates with packet mirroring. Which Google Cloud service should they use?

Accepted Answer

Cloud IDS. Cloud IDS is a managed intrusion detection service that integrates with packet mirroring to inspect traffic for threats like malware and command-and-control. It uses Palo Alto Networks technology to detect and alert on malicious activity within a VPC. It is specifically designed for network threat detection, making it the correct choice.

Answer

Security Command Center

Answer

VPC Flow Logs

Answer

Cloud Armor

Question 6

A company wants to allow users to access an internal web application running on Compute Engine behind a load balancer without requiring a VPN. The solution must authenticate users and enforce access based on user identity and context (e.g., device security). Which Google Cloud service should they use?

Accepted Answer

Identity-Aware Proxy (IAP). Identity-Aware Proxy (IAP) is Google Cloud's zero-trust access layer that sits in front of Compute Engine backends behind an HTTPS load balancer, authenticating users via Google identity and enforcing IAM plus context-aware access (device posture, IP, location) before any packet reaches the VM. It removes the need for a VPN because access is brokered at the application layer rather than the network layer. IAP also integrates with Access Context Manager and BeyondCorp Enterprise for device-based policies.

Answer

Cloud NAT

Answer

Cloud Armor

Answer

VPC Service Controls

Question 7

Which Google Cloud service should be used for long-term archival of Audit Logs that must be immutable and stored for 10 years for compliance?

Accepted Answer

Cloud Storage with Archive storage class and retention policy. Cloud Storage with Archive storage class offers the lowest cost for long-term storage, and retention policies enforce immutability.

Answer

Cloud SQL with backups

Answer

BigQuery with time-based partitioning

Answer

Pub/Sub with message retention

Question 8

A company wants to ensure that data stored in Cloud Storage is encrypted at rest using keys that they generate and manage on-premises. Which encryption method should they use?

Accepted Answer

Customer-Supplied Encryption Keys (CSEK). Customer-Supplied Encryption Keys (CSEK) let you provide your own AES-256 key with each Cloud Storage request, and Google uses that key only in memory to encrypt/decrypt the object — the key is never stored by Google. This matches the requirement that keys be generated and managed on-premises by the customer. CMEK uses Cloud KMS, which is a Google-hosted key management service, so it does not satisfy the 'on-premises' constraint.

Answer

Customer-Managed Encryption Keys (CMEK) using Cloud KMS

Answer

Google-managed encryption keys

Answer

Client-side encryption before uploading

Question 9

A company is subject to PCI DSS and needs to protect a web application that processes credit card data. They want to block common web attacks such as SQL injection and cross-site scripting (XSS). Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Google Cloud Armor is the edge security service that attaches to external HTTP(S) load balancers and provides WAF rules, including preconfigured OWASP ModSecurity CRS rulesets that block SQL injection (SQLi) and cross-site scripting (XSS). It also supports Layer 7 rate limiting, geo-based rules, and adaptive protection, making it the correct choice for PCI DSS-relevant web attack mitigation. Because it inspects traffic at the Google edge before it reaches the backend, it satisfies PCI DSS Requirement 6.6 for protecting public-facing web applications.

Answer

Cloud NAT

Answer

Cloud CDN

Answer

Identity-Aware Proxy (IAP)

Question 10

A security team wants to monitor for compliance drift in an Assured Workloads folder that enforces FedRAMP High controls. Which Google Cloud service should they use to detect violations of organization policies?

Accepted Answer

Security Command Center. Security Command Center (SCC) is Google Cloud's centralized security and risk management platform, and it includes the Assured Workloads and organization policy violation detectors that surface compliance drift in regulated folders such as FedRAMP High. SCC Premium/Enterprise tiers provide continuous monitoring, compliance dashboards, and findings for policy violations, making it the correct service to detect drift.

Answer

Cloud Monitoring

Answer

Access Transparency

Answer

Cloud Audit Logs

Question 11

A company wants to automatically provision and renew SSL certificates for their HTTPS load balancer. They want Google to manage the certificate lifecycle. Which certificate type should they use?

Accepted Answer

Google-managed certificate. Google-managed certificates are provisioned, deployed, and renewed automatically by Google for use with external HTTPS load balancers. Google handles the entire lifecycle including renewal, which is exactly what the company wants.

Answer

Self-managed certificate

Answer

Upload a certificate via the Cloud Load Balancing UI

Answer

Certificate Manager with a self-managed certificate

Question 12

An organization uses Cloud Identity with Google Workspace. They want to grant a group of external auditors read-only access to a specific folder in Google Cloud. The auditors have accounts in the organization's Cloud Identity domain. What is the most efficient way to grant this access?

Accepted Answer

Create a Google Group, add auditors to it, and grant the group the Viewer role at the folder level.. Granting the Viewer role to a Google Group at the folder level follows Google Cloud IAM best practice: manage permissions via groups, not individuals, and apply them at the highest appropriate resource in the hierarchy so they inherit down. Because the auditors already exist in the Cloud Identity domain, they can simply be added to the group, and one IAM binding covers all of them. This minimizes policy churn and audit overhead.

Answer

Create a custom role and assign it to each auditor.

Answer

Use Cloud Directory Sync to sync auditors from an external identity provider.

Answer

Grant each auditor the Viewer role individually at the folder level.

Question 13

A financial services company wants to ensure that Google Cloud staff cannot access their encryption keys or the plaintext data. They must meet regulatory requirements for data sovereignty. Which combination of services should they use?

Accepted Answer

Use Cloud External Key Manager and enable Access Transparency logs.. Cloud External Key Manager (EKM) allows you to manage encryption keys using a supported external key management partner, ensuring that Google Cloud staff cannot access your keys or plaintext data. Enabling Access Transparency logs provides you with logs of Google Cloud staff access to your data, which helps meet regulatory requirements for data sovereignty by giving you visibility into administrative actions.

Answer

Use CMEK with Cloud HSM and disable Access Transparency.

Answer

Use Customer-Supplied Encryption Keys (CSEK) without Access Transparency.

Answer

Use VPC Service Controls and Cloud DLP.

Question 14

A security engineer wants to automatically rotate a database password stored in Secret Manager every 30 days. The new password should be generated and stored in Secret Manager without manual intervention. Which approach meets these requirements?

Accepted Answer

Configure a rotation period in Secret Manager, set a Pub/Sub topic, and implement a Cloud Function that listens for rotation messages to generate and add a new secret version.. Secret Manager supports automatic rotation by configuring a rotation period and a Pub/Sub topic. A Cloud Function or other subscriber can listen for rotation notifications, generate a new secret version, and add it. This automates the rotation without manual steps.

Answer

Set up a Cloud Lifecycle rule to delete the old secret version and create a new one with the same value.

Answer

Use a Cloud KMS key to re-encrypt the secret each month.

Answer

Use gcloud secrets versions add with a scheduled Cloud Scheduler job that generates a new password and adds it as a new version.

Question 15

A company wants to use a Google-managed SSL certificate for their external HTTPS load balancer. Which step is required to provision the certificate?

Accepted Answer

Create a DNS record for the domain that resolves to the load balancer's IP address.. Google-managed SSL certificates are provisioned by creating a certificate resource and then pointing a DNS record (A/AAAA) for the domain to the load balancer's IP address. Google validates domain ownership via the DNS record and provisions the certificate automatically once the domain resolves to the load balancer.

Answer

Install the certificate on each backend instance.

Answer

Submit a Certificate Signing Request (CSR) to Google.

Answer

Upload the private key and certificate in PEM format.