PCSE Practice Test 20 — 15 Questions

Question 1

A company has multiple Google Cloud projects under an organization. They want to ensure that only service accounts from their own Cloud Identity domain (example.com) can be used in IAM policies. Which TWO steps should they take? (Choose 2)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Remove any IAM policies that include members from other domains.. The organization policy constraint constraints/iam.allowedPolicyMemberDomains restricts member domains in IAM policies. Setting it to ['example.com'] ensures only principals from that domain can be added. Additionally, removing other domains from existing policies is necessary to enforce the constraint.

Answer

Configure VPC Service Controls to restrict access.

Answer

Use Cloud Identity to block external users.

Answer

Create a deny policy that denies the resourcemanager.projects.setIamPolicy permission for non-example.com users.

Question 2

An organization has multiple GCP projects managed through folders in the resource hierarchy. They want to enforce a policy that prohibits the creation of service account keys across all projects. Which approach should be used?

Accepted Answer

Apply an organization policy with the constraint 'constraints/iam.disableServiceAccountKeyCreation' at the folder level.. Organization policies can be applied at the folder or organization level to enforce constraints across all projects. The constraint 'constraints/iam.disableServiceAccountKeyCreation' specifically disables service account key creation. Applying it at a folder level is the most efficient way to enforce the policy across all projects in that folder.

Answer

Use a deny policy at the project level to deny the 'iam.serviceAccountKeys.create' permission.

Answer

Configure a script that runs daily to delete any service account keys found in projects.

Answer

Create a custom IAM role that denies the permission to create keys and assign it to all users.

Question 3

A DevOps engineer needs to create a custom IAM role that allows creating and deleting Compute Engine instances but not stopping or starting them. Which permissions should be included?

Accepted Answer

compute.instances.create and compute.instances.delete. To create and delete instances, the permissions compute.instances.create and compute.instances.delete are required. compute.instances.stop and compute.instances.start are separate permissions for stopping/starting. compute.instances.update is for modifying existing instances.

Answer

compute.instances.start and compute.instances.stop

Answer

compute.instances.create, compute.instances.delete, and compute.instances.update

Answer

compute.instances.create

Question 4

A developer is troubleshooting a Cloud Run service that needs to read from a Cloud Storage bucket. The service runs as the compute engine default service account. The service account has been granted the Storage Object Viewer role at the project level, but the service still gets permission denied errors. What is the most likely cause?

Accepted Answer

The Cloud Run service is using a different service account than the one modified.. Cloud Run uses the runtime service account specified in the revision, not the compute engine default SA. The developer must explicitly set the service account when deploying, and grant it appropriate roles. The compute engine default SA is for Compute Engine VMs, not Cloud Run.

Answer

The bucket uses uniform bucket-level access, which overrides IAM.

Answer

The service account was not granted access to the specific bucket.

Answer

The Cloud Run service requires the Storage Admin role.

Question 5

A company uses Google Cloud Directory Sync to synchronize users from an on-premises Active Directory to Cloud Identity. They want to allow federated access from their external identity provider (IdP) that supports SAML 2.0. The IdP should be able to authenticate users from a specific AD domain. What configuration steps are required?

Accepted Answer

Configure the external IdP as a SAML identity provider in Cloud Identity, map the AD domain, and enable user provisioning via SCIM.. For federated access with an external SAML 2.0 IdP, configure the external IdP as a SAML identity provider in Cloud Identity, mapping the appropriate domain.

Answer

Use Workload Identity Federation to map the external IdP to Google Cloud service accounts.

Answer

Set up SAML SSO in Cloud Identity using Google as the IdP, and configure AD to trust Google's SAML response for the domain.

Answer

Create a custom OAuth 2.0 flow in Cloud Identity to integrate with the external IdP.

Question 6

A developer is running a batch job on Compute Engine that needs to read data from Cloud Storage. What is the recommended way to authenticate the VM to Cloud Storage without managing keys?

Accepted Answer

Use the Compute Engine default service account and grant it the roles/storage.objectViewer role.. The best practice is to use the Compute Engine default service account and grant it the appropriate Storage roles. This avoids managing keys and uses the VM's identity tied to the service account.

Answer

Create a service account key, download it to the VM, and use it with gcloud auth.

Answer

Add the user's personal credentials to the VM and use them.

Answer

Use Application Default Credentials (ADC) from a service account key stored in Secret Manager.

Question 7

A project manager needs to create custom IAM roles for a project. At which levels in the resource hierarchy can custom roles be defined?

Accepted Answer

Organization and project levels only. Custom roles can be defined at the organization level or the project level. They cannot be defined at the folder level. Organization-level roles can be used across all folders and projects under that organization.

Answer

All levels: organization, folder, project

Answer

Organization and folder levels only

Answer

Project level only

Question 8

A company wants to provide their employees access to a web application running on Compute Engine without exposing the VM to the public internet. The application uses a custom header to verify the user's identity. Which service should they use?

Accepted Answer

Cloud Identity-Aware Proxy (IAP). Identity-Aware Proxy (IAP) provides zero-trust access to web applications. It can be configured to verify identity and pass signed headers (e.g., X-Goog-Authenticated-User-Email) to the backend, allowing the application to verify the user without public IP exposure.

Answer

Cloud Armor with OAuth

Answer

Cloud Load Balancing with SSL termination

Answer

VPC firewall rules with source IP restrictions

Question 9

An organization wants to enforce a security policy that denies all egress traffic to the internet from all projects in the organization, except for traffic from a specific set of VMs tagged with 'allow-egress'. Which approach should be used?

Accepted Answer

Use a hierarchical firewall policy at the organization level with a deny-all egress rule and a higher priority allow rule for the tag.. Hierarchical firewall policies are inherited down the resource hierarchy and can be enforced at the organization or folder level. They cannot be overridden at lower levels, making them suitable for organization-wide baseline rules.

Answer

Create a VPC firewall rule at the organization level to deny all egress, then allow egress for the specific tag.

Answer

Use VPC Service Controls to block egress traffic.

Answer

Configure Cloud Armor with a deny-all egress rule and an exception for the tag.

Question 10

A security engineer needs to restrict access to a Cloud Storage bucket so that only a specific set of Compute Engine instances can read objects. The instances are in the same project and VPC network. The engineer wants to use VPC firewall rules for this purpose. Which two configurations are REQUIRED? (Choose two.)

Accepted Answer

Create an egress allow rule for the IP ranges of Cloud Storage (Google API IPs) and apply it to the target instances.. VPC firewall rules control network traffic to/from instances, but they cannot directly restrict access to Cloud Storage APIs. However, they can restrict which instances can reach the external IP of Cloud Storage. To achieve the goal, the engineer must allow egress traffic from the instances to the Cloud Storage IP ranges and deny all other egress. But more importantly, access to Cloud Storage is controlled by IAM, not firewall rules. However, the question specifically asks about VPC firewall rules. The typical approach is to use Private Google Access and firewall rules to restrict egress to Google API IPs. The correct answers are: allow egress to the Google API IP ranges (which include Cloud Storage) and deny all other egress. But the question might also consider using service accounts and firewall rule targets. Firewall rules can target service accounts, but that does not restrict access to Cloud Storage itself. The most direct answer is that to limit which instances can access Cloud Storage, you can create an egress rule that allows traffic to the Cloud Storage IP ranges only from instances with a specific service account or tag, and then deny all other egress. But the question asks for two configurations. The most reasonable answers: (1) Create an egress allow rule for the Cloud Storage IP ranges with a target tag or service account that matches the instances. (2) Create a deny all egress rule with lower priority. However, since Cloud Storage uses Google APIs, the IP ranges are from the published list. The correct choices are likely: A and D.

Answer

Enable Private Google Access on the subnet where the instances reside.

Answer

Assign a Cloud IAM role to the instances' service account to allow read access to the bucket.

Answer

Create an ingress allow rule from Cloud Storage IP ranges to the instances.

Question 11

A company wants to detect and block SQL injection attacks targeting their web application hosted on Compute Engine behind a Cloud Load Balancer. Which TWO steps should they take? (Choose TWO.)

Accepted Answer

Enable Cloud Armor adaptive protection to detect and block suspicious patterns.. Cloud Armor preconfigured rules (like OWASP ModSecurity CRS) can detect SQLi, and enabling adaptive protection provides ML-based anomaly detection. Cloud IDS is for network-level threats, not WAF; VPC firewall rules don't inspect application payloads.

Answer

Deploy Cloud IDS in the VPC to inspect packets for SQLi patterns.

Answer

Configure VPC firewall rules to deny traffic on port 443.

Answer

Use VPC Service Controls to restrict access to the backend instances.

Question 12

An organization wants to enforce that all egress traffic from a VPC to the internet must go through a Cloud NAT gateway for logging and IP management. They also need to block all other direct outbound traffic. Which THREE steps should they take? (Choose THREE.)

Accepted Answer

Delete the default route (0.0.0.0/0) from the VPC. To force traffic through Cloud NAT, you need to remove the default route (0.0.0.0/0), create a route that only allows traffic to the NAT gateway's IP range (or use a more specific route), and then add a deny egress rule for all other internet traffic.

Answer

Enable Private Google Access on the subnet

Answer

Add a firewall rule to allow egress to 0.0.0.0/0

Question 13

A security team is configuring Cloud Armor to protect a web application. They need to block requests that contain SQL injection patterns, block requests from a known malicious IP list, and limit requests from any single IP to 2000 requests per minute. Which THREE actions must they take? (Choose three.)

Accepted Answer

Create a custom rule with a deny action for the malicious IP list using a CEL expression. To implement these requirements, you need to enable the preconfigured SQL injection rule set, create a custom rule with an IP allow/deny list for the malicious IPs, and create a rate limiting rule. Cloud Armor does not have a built-in list of malicious IPs; you must provide the list. The rate limiting is configured as a separate rule with action 'rateBasedThrottle'.

Answer

Create a single rule that combines SQLi detection, IP blocking, and rate limiting using CEL

Answer

Enable Cloud Armor Managed Protection Plus for automatic IP reputation

Question 14

An engineer needs to block a specific IP address from accessing an HTTPS load balancer. Which Cloud Armor rule should be used?

Accepted Answer

A custom rule with a 'deny' action and the IP address in the 'src_ip_ranges' field. Cloud Armor custom rules allow IP allow/deny lists. A deny rule with the specific IP address will block traffic.

Answer

A VPC firewall rule with a deny ingress for that IP

Answer

A Cloud Armor rate limiting rule

Answer

A preconfigured rule from the OWASP ModSecurity CRS

Question 15

An engineer wants to allow egress traffic from a group of VM instances with a specific service account to a set of IP addresses. They need to choose between using tags or service accounts as targets in a VPC firewall rule. Which approach is recommended for better security and why?

Accepted Answer

Use service accounts because they are managed by IAM and provide a stronger identity-based security model.. Service account targets are preferred because they are more secure. Tags can be added or removed by anyone with compute.instances.setTags permission, while service accounts are managed centrally with IAM. Using service accounts ensures that the firewall rule applies based on the identity of the VM, which is harder to spoof.

Answer

Use tags because they are easier to manage and provide the same level of security as service accounts.

Answer

Use target tags with a network tag that is automatically assigned by a management tool.

Answer

Either is acceptable; Google recommends using tags for simplicity.