PCSE Practice Exam 1 — 20 Questions

Question 1

Match each IAM role to its typical use case.

Question 2

Match each encryption scope to its description.

Question 3

Match each CVE or security concept to its description.

Question 4

Match each Google Cloud logging/monitoring term to its definition.

Question 5

Drag and drop the steps to rotate a customer-managed encryption key (CMEK) in Cloud KMS in the correct order.

Question 6

Drag and drop the steps to configure a Cloud NAT for private VM instances in the correct order.

Question 7

Drag and drop the steps to set up Cloud Armor with a WAF rule in the correct order.

Question 8

Drag and drop the steps to configure a VPC Service Controls perimeter in the correct order.

Question 9

Drag and drop the steps to set up a Private Google Access for on-premises hosts using Private Service Connect in the correct order.

Question 10

Drag and drop the steps to set up a binary authorization policy for a GKE cluster in the correct order.

Question 11

A company is designing a CI/CD pipeline using Cloud Build. Security requirements mandate that the pipeline deploy only to projects that have been explicitly authorized. The security team wants to use a service account that can be assumed by Cloud Build to perform deployments, and they want to restrict which projects can be deployed to using organization policies. Which approach should they take?

Answer

Use the organization policy constraint 'constraints/iam.serviceAccountKeyExpiryHours' to force key rotation.

Answer

Use the organization policy constraint 'constraints/iam.allowedPolicyMemberDomains' and set it to only allow the service account's domain.

Answer

Use the organization policy constraint 'constraints/compute.restrictCrossProjectNw' to limit network access.

Answer

Use the organization policy constraint 'constraints/iam.workloadIdentityPoolProviders' to restrict which workload identity pools can be used.

Question 12

A company must implement data residency requirements that prohibit storing data outside the European Union. They are using Cloud Bigtable and need to ensure that backups are also stored within the EU. Which configuration should they choose?

Accepted Answer

Create the Bigtable instance in a single EU region (e.g., europe-west1) and enable automatic backups.. Option D is correct because a single-region Bigtable instance in an EU region (e.g., europe-west1) ensures that all data, including backups, remains within the EU. Enabling automatic backups stores backup data in the same region, satisfying data residency requirements that prohibit storing data outside the EU.

Answer

Create the Bigtable instance with multi-region placement in europe-west1 and europe-west4.

Answer

Create an instance in a dual-region configuration (e.g., europe-west1 and europe-west4) and use backup policies.

Answer

Use a single-region instance in europe-west1 with customer-managed encryption keys (CMEK) for backups.

Question 13

A company wants to allow employees to access a web application running on Google Kubernetes Engine (GKE) using their corporate Active Directory credentials. The application is exposed via an HTTPS load balancer. The Security Engineer needs to integrate identity federation and ensure that only authenticated users can reach the application. Which combination of services should be used?

Accepted Answer

Set up federation between Active Directory and Google Cloud using OIDC, and enable IAP on the load balancer.. Option B is correct because it combines OIDC federation between Active Directory and Google Cloud with Identity-Aware Proxy (IAP) on the load balancer. IAP verifies user identity via OIDC tokens issued by the federated identity provider, ensuring only authenticated users can reach the application without exposing it to the public internet.

Answer

Use Cloud Armor to allow only traffic from specific IP ranges and require client certificates.

Answer

Enable IAP and configure it to use Active Directory as an identity provider.

Answer

Configure Cloud Identity as the identity provider and use IAP.

Question 14

A security engineer is investigating an incident where an attacker gained access to a Compute Engine instance's serial console logs, which contained sensitive data. Which TWO actions should the engineer take to prevent this type of exposure in the future? (Choose TWO.)

Accepted Answer

Enable Private Google Access on the VPC subnet to restrict serial console log access to internal IPs only.. Option B is correct because enabling Private Google Access on the VPC subnet ensures that serial console logs are accessed only via internal IP addresses, preventing exposure over the public internet. This restricts access to the serial console logs to resources within the VPC or connected networks, reducing the attack surface for data exfiltration.

Answer

Use Cloud NAT for outbound traffic to anonymize instance IP addresses in serial console logs.

Answer

Remove the roles/iam.serviceAccountUser role from all users to prevent them from accessing serial console.

Answer

Enable OS Login for the project to enforce SSH key management and prevent serial console access.

Question 15

A company is deploying a multi-tier application on Google Cloud. The web tier must be accessible from the internet, while the application and database tiers must only be accessible from the web tier. The security team wants to use VPC firewall rules and Cloud NAT for outbound internet access from private instances. Which architecture meets these requirements with the least operational overhead?

Accepted Answer

Place web tier in a public subnet with public IPs. Place app/db tiers in private subnets with no public IPs. Use firewall rules to allow traffic from web to app, and app to db. Configure Cloud NAT for private subnets.. Option D is correct because it uses a single VPC with separate public and private subnets, which minimizes operational overhead while meeting the security requirements. The web tier in the public subnet gets public IPs for internet access, while the app and database tiers in private subnets have no public IPs and rely on Cloud NAT for outbound internet. Firewall rules restrict traffic to only the necessary flows (web→app, app→db), and Cloud NAT provides scalable outbound connectivity without managing a proxy VM.

Answer

Use a single subnet for all tiers. Assign public IPs to all instances. Use firewall rules to restrict access between tiers. Use a proxy VM for outbound internet from app/db tiers.

Answer

Create separate VPCs for each tier. Use VPC peering to connect them. Use firewall rules to allow traffic. Use a bastion host for SSH access to app/db tiers.

Answer

Place all tiers in the same VPC. Use firewall rules to restrict access. Assign public IPs to web tier instances and private IPs to app/db tiers. Configure Cloud NAT for app/db tiers.

Question 16

A security engineer is configuring Cloud Armor to protect a global external HTTP(S) Load Balancer. Which TWO of the following are valid Cloud Armor security policies? (Choose two.)

Accepted Answer

Preconfigured OWASP Top 10 rules. Option D is correct because Cloud Armor includes preconfigured rules that map directly to the OWASP Top 10 web application vulnerabilities, such as SQL injection and cross-site scripting (XSS). These rules are managed by Google and automatically updated to protect against the latest attack patterns, making them a valid security policy for a global external HTTP(S) Load Balancer.

Answer

Web Security Scanner scan rule

Answer

Signed URL policy

Answer

Preconfigured Identity-Aware Proxy (IAP) rule

Question 17

Which TWO actions should a security engineer take to protect sensitive data in Cloud Storage buckets from accidental public exposure? (Choose two.)

Accepted Answer

Set the organization policy constraint 'iam.disableBucketPolicyOnlyGrantedByDefault' to enforce uniform bucket-level access across the organization.. Option B is correct because setting the organization policy constraint 'iam.disableBucketPolicyOnlyGrantedByDefault' enforces uniform bucket-level access across the organization, preventing the use of fine-grained ACLs that can accidentally expose data. This policy ensures that all new buckets default to IAM-based access control, reducing the risk of misconfigured public ACLs.

Answer

Use Cloud Data Loss Prevention (DLP) to scan buckets for public access.

Answer

Configure VPC Service Controls to restrict access to the buckets from within the VPC.

Answer

Enable bucket lock on all buckets to prevent deletion of objects.

Question 18

A company must ensure that all Compute Engine instances use only approved images from a specific project. They want to enforce this using Organization Policy. Which constraint should they use?

Accepted Answer

constraints/compute.restrictImageUsage. The correct constraint is `constraints/compute.restrictImageUsage` because it directly controls which images can be used to create Compute Engine instances by specifying a list of allowed projects. This enforces the requirement that only approved images from a specific project are used, blocking instances launched with images from other projects.

Answer

constraints/compute.restrictAuthorizedDomains

Answer

constraints/compute.trustedImageProjects

Answer

constraints/compute.restrictFirewallRules

Question 19

A company is implementing a data retention policy for Cloud Storage buckets. They need to ensure that objects cannot be deleted before a specified retention period. Which THREE features can they use? (Choose THREE.)

Accepted Answer

Retention Policy on the bucket.. A is correct because a Retention Policy on a Cloud Storage bucket enforces a minimum retention period for all objects in the bucket. Once set, objects cannot be deleted or overwritten until the retention period expires, directly meeting the requirement to prevent deletion before a specified time.

Answer

Lifecycle rules with a Delete action.

Answer

Object versioning.

Question 20

A financial services company is migrating its on-premises application to Google Cloud. The application needs to access a Cloud SQL instance and a Cloud Storage bucket. Security requirements mandate that the application must use short-lived credentials and avoid storing long-lived service account keys. The application runs on Compute Engine. What should the Security Engineer do to meet these requirements?

Accepted Answer

Attach a service account to the Compute Engine instance with appropriate roles for Cloud SQL and Cloud Storage.. Option C is correct because attaching a service account directly to a Compute Engine instance allows the application to automatically obtain short-lived access tokens from the instance metadata server (http://169.254.169.254) for accessing Cloud SQL and Cloud Storage. This approach eliminates the need to store long-lived service account keys, meeting the security requirement for short-lived credentials.

Answer

Create a service account and use Workload Identity Federation to impersonate it.

Answer

Use Cloud Key Management Service to generate and rotate keys for the service account.

Answer

Create a service account key and store it in Cloud Secret Manager.