PCSE Practice Exam 2 — 20 Questions

Question 1

A global e-commerce company must comply with GDPR and CCPA. They use BigQuery to store customer data and need to ensure that when a user requests data deletion, all copies are deleted within 30 days. Additionally, they want to minimize storage costs. Which TWO actions should they take?

Accepted Answer

Use the DDL statement to drop the table after 30 days using a scheduled query.. Option A is correct because using a DDL statement (e.g., DROP TABLE) in a scheduled query allows you to delete the entire table after exactly 30 days, ensuring all data copies (including storage and any snapshots) are removed. This directly meets the GDPR/CCPA deletion requirement while minimizing storage costs by not retaining data beyond the mandated period.

Answer

Create a Cloud Function to export the data before deletion.

Answer

Set a table retention policy of 30 days using ALTER TABLE SET OPTIONS.

Answer

Use BigQuery continuous backups with a 30-day retention.

Question 2

An organization uses Cloud Audit Logs to monitor admin activity. The security team wants to be alerted when a user creates a new IAM role at the organization level. Which type of audit log should they analyze?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs (option D) are the correct choice because they record operations that modify the configuration or metadata of resources, such as creating or modifying IAM roles and policies at the organization level. In Google Cloud, Admin Activity audit logs are enabled by default and capture all 'admin write' events, including the creation of an IAM role, which is a configuration change. The security team needs to monitor these logs to detect when a user creates a new IAM role, as this is an administrative action that alters the organization's security posture.

Answer

Policy Denied audit logs

Answer

System Event audit logs

Answer

Data Access audit logs

Question 3

A company is migrating its on-premises Microsoft Active Directory to Google Cloud using Managed Microsoft AD (Microsoft AD). They need to ensure that users can authenticate to Compute Engine Windows instances using their on-premises credentials without additional user setup. What is the most secure and scalable approach?

Accepted Answer

Create a two-way trust between the Managed Microsoft AD domain and the on-premises AD domain.. Option B is correct because establishing a two-way trust between Managed Microsoft AD and the on-premises AD domain allows users to authenticate to Compute Engine Windows instances using their existing on-premises credentials without any additional user setup. This trust enables Kerberos authentication to flow seamlessly across the two domains, ensuring that on-premises users can access cloud resources securely and scalably without duplicating identities or credentials.

Answer

Configure the Windows instances to join the on-premises AD domain directly via VPN.

Answer

Synchronize on-premises users to Managed Microsoft AD using Google Cloud Directory Sync (GCDS).

Answer

Store on-premises user credentials in Cloud KMS and use a custom authentication script.

Question 4

A security engineer needs to ensure that a Compute Engine VM can securely access Cloud Storage buckets without exposing a public IP address. The VM is in a VPC with Private Google Access enabled. What is the recommended approach?

Accepted Answer

No additional configuration is needed; Private Google Access allows access to Cloud Storage from VMs without external IPs.. Private Google Access enables a VM without an external IP address to reach Google APIs and services, including Cloud Storage, using the VPC's internal IP and Google's private network. Since the VM is in a VPC with Private Google Access enabled, it can securely access Cloud Storage buckets without needing a public IP or additional proxy. No further configuration is required because the traffic stays within Google's network and never traverses the public internet.

Answer

Deploy a Squid proxy in the same VPC and configure the VM to use it for all outbound traffic.

Answer

Assign an external IP to the VM and configure a firewall rule to allow egress to 0.0.0.0/0.

Answer

Configure Cloud NAT and ensure the VM has a route to the internet.

Question 5

A Security Engineer is designing access controls for a multi-cloud environment where workloads on Google Cloud need to access on-premises databases. The company wants to use long-lived credentials. Which TWO options are valid approaches? (Choose TWO.)

Accepted Answer

Create an OAuth 2.0 client ID for an installed application and use offline access to obtain refresh tokens.. Option A is correct because OAuth 2.0 client IDs for installed applications can be configured for offline access, which returns refresh tokens. These refresh tokens are long-lived (typically do not expire unless revoked) and can be used by on-premises applications to obtain new access tokens for accessing Google Cloud APIs without user interaction. This meets the requirement for long-lived credentials in a multi-cloud environment.

Answer

Set up a Cloud VPN tunnel and use private IP addresses to access Google Cloud services.

Answer

Create a service account and use its key to generate short-lived tokens.

Answer

Use Workload Identity Federation to exchange on-premises credentials for Google Cloud tokens.

Question 6

Refer to the exhibit. A Security Engineer runs the command to grant Alice access to view objects in a Cloud Storage bucket. Later, Alice reports she can no longer access the bucket after January 1, 2024. What is the most likely reason?

Accepted Answer

The IAM condition expired on January 1, 2024, because the timestamp condition prevented access after that date.. Option D is correct because the IAM condition attached to the binding includes a timestamp condition that expires on January 1, 2024. When the condition is no longer satisfied, the binding becomes ineffective, and Alice loses access to the bucket. This is a common use of IAM conditions to grant time-limited access.

Answer

Alice does not have the 'storage.objects.get' permission required to view objects.

Answer

The command removed Alice's existing access because it replaced all bindings.

Answer

The command failed to apply because the service account does not have permission to modify IAM policies.

Question 7

A company uses Cloud Identity-Aware Proxy (IAP) to secure access to an internal web application hosted on Compute Engine. After a recent security audit, the team wants to ensure that only users with specific attributes can access the app, such as belonging to the 'engineering' group and having a verified corporate email. What is the best approach to enforce this requirement?

Accepted Answer

Configure IAP with access levels that require the user to be in the 'engineering' group and have a verified email.. Option D is correct because Cloud IAP integrates with Identity-Aware Proxy access levels, which allow you to enforce attribute-based access control (ABAC) using Google Cloud's context-aware access features. By configuring an access level that requires the user to belong to the 'engineering' group (via Cloud Identity or G Suite group membership) and have a verified corporate email (e.g., using the `email_verified` attribute from the identity provider), you can precisely restrict access to the Compute Engine web application without modifying the application code.

Answer

Use VPC Service Controls to restrict access based on user attributes.

Answer

Disable OAuth and use a custom JWT with group membership claims.

Answer

Set up an HTTP load balancer with a custom header that passes group membership from the identity provider.

Question 8

Your organization uses Shared VPC with a host project and several service projects. You need to ensure that all egress traffic from Compute Engine instances in a service project is routed through a centralized Cloud NAT in the host project. What is the required configuration?

Accepted Answer

Configure a Cloud NAT on the Cloud Router in the host project for the subnet that is shared with the service project. Option C is correct because a Cloud NAT configured on the Cloud Router in the host project for the shared subnet allows all Compute Engine instances in service projects attached to that subnet to use the host project's NAT IP for outbound traffic. This is the only way to centralize egress traffic through the host project's Cloud NAT while respecting Shared VPC architecture, as the NAT is tied to the subnet and Cloud Router in the host project.

Answer

Create a firewall rule in the host project that denies all egress traffic except to the Cloud NAT IP

Answer

Set the instances to use a custom route with next-hop as the Cloud NAT IP address

Answer

Configure a Cloud NAT in each service project and associate it with the subnet that the instances use

Question 9

You are designing network security for a multi-region GKE cluster with Pods that need to communicate across regions over a private network. The cluster uses VPC-native mode. Which Google Cloud networking feature should you use to ensure low-latency and secure inter-region Pod-to-Pod communication without traversing the public internet?

Accepted Answer

Cloud Interconnect. Cloud Interconnect provides a dedicated, high-bandwidth, low-latency connection between your on-premises network and Google Cloud, or between Google Cloud regions, bypassing the public internet. For multi-region GKE clusters using VPC-native mode, Cloud Interconnect enables secure, private inter-region Pod-to-Pod communication by routing traffic through Google's internal backbone, ensuring minimal latency and no exposure to the public internet.

Answer

Cloud VPN with dynamic routing

Answer

Private Service Connect

Answer

VPC Flow Logs

Question 10

Your company has a VPC with multiple subnets. You have deployed a set of Compute Engine instances that must communicate with each other over TCP port 4444. The instances are tagged with 'app-tier'. You need to ensure that only these instances can communicate on this port. Which THREE of the following steps are necessary to achieve this?

Accepted Answer

Create an egress firewall rule that allows TCP 4444 from target tag 'app-tier' to source tag 'app-tier'. Option B is correct because egress firewall rules control outbound traffic from instances. By creating an egress rule allowing TCP 4444 from source tag 'app-tier' to destination tag 'app-tier', you ensure that only instances with the 'app-tier' tag can send traffic on that port to other 'app-tier' instances, while all other outbound traffic is implicitly denied by the default deny egress rule (unless overridden by a higher-priority allow rule). This restricts communication to the intended group.

Answer

Remove the default allow egress rule that allows all outbound traffic

Answer

Create a VPC firewall rule to deny all egress traffic from the VPC

Question 11

A security engineer is using Cloud Asset Inventory to find all Compute Engine instances that are not labeled with a 'compliance' label. Based on the exhibit, which instance(s) are missing the compliance label?

Accepted Answer

instance-2 only. Option B is correct because the exhibit shows that instance-1 has a 'compliance' label with a value of 'true', while instance-2 has no 'compliance' label at all. Cloud Asset Inventory can query assets using label filters; the absence of the 'compliance' label on instance-2 means it fails the compliance labeling requirement. Therefore, only instance-2 is missing the compliance label.

Answer

Both instances

Answer

Neither instance

Answer

instance-1 only

Question 12

A company is using Cloud Data Loss Prevention (DLP) to inspect and de-identify sensitive data in Cloud Storage. They want to classify data using infoTypes and apply de-identification techniques. Which TWO actions should they take?

Accepted Answer

Use the DLP API to inspect the storage for sensitive data.. Option B is correct because the DLP API's `inspect` method is the primary mechanism to scan Cloud Storage objects for sensitive data patterns defined by infoTypes. Option C is correct because after inspection, de-identification transformations like masking or tokenization are applied via the DLP API's `deidentify` method to redact or replace sensitive content. Together, these two actions form the standard workflow for classifying and protecting data in Cloud Storage using Cloud DLP.

Answer

Create custom infoTypes for all sensitive data.

Answer

Store de-identification templates in Cloud KMS.

Answer

Use VPC Service Controls to restrict access to the data.

Question 13

A company is using Cloud SQL for MySQL to store financial data. They need to ensure that all data is encrypted at rest and in transit. What should they do?

Accepted Answer

Use the default encryption provided by Cloud SQL and enforce SSL/TLS connections.. Option D is correct because Cloud SQL for MySQL automatically encrypts data at rest using AES-256, with no additional configuration required. To protect data in transit, you must enforce SSL/TLS connections by configuring the instance to require SSL and downloading the server certificate for client connections. This combination satisfies both encryption requirements without unnecessary complexity.

Answer

Use client-side encryption before storing data in Cloud SQL.

Answer

Enable encryption at rest by checking a box in the Cloud Console.

Answer

Enable CMEK on the Cloud SQL instance and configure SSL/TLS.

Question 14

A security engineer needs to grant a data analyst read-only access to a BigQuery dataset containing customer data, but must prevent the analyst from viewing or querying a specific column that contains personally identifiable information (PII). Which approach should the engineer use?

Accepted Answer

Use BigQuery column-level security with a policy tag on the PII column, and assign the analyst a role that denies access to that tag.. Option A is correct because BigQuery column-level security uses policy tags to control access at the column level. By assigning a policy tag to the PII column and then granting the analyst a role that explicitly denies access to that tag (e.g., using a deny role or IAM deny policies), the analyst can query the dataset but will be blocked from viewing or querying the tagged column. This approach directly meets the requirement of read-only access while preventing access to the specific PII column.

Answer

Grant the analyst the roles/bigquery.user role, and use IAM conditions to deny access to the PII column.

Answer

Create a row-level access policy on the table that denies access to rows containing PII.

Answer

Grant the analyst the BigQuery Data Viewer role on the dataset, and create an authorized view that excludes the PII column.

Question 15

A security engineer is troubleshooting an issue where a Compute Engine VM cannot connect to a Cloud SQL instance that has a private IP address. Both resources are in the same VPC network. The VM's firewall rules allow egress to any destination, and the Cloud SQL instance's authorized networks include the VPC network. What is the most likely cause of the connection failure?

Accepted Answer

The VPC network does not have a private services access connection (VPC peering) to the Service Networking API.. Cloud SQL instances with private IP addresses require a private services access connection (VPC peering) between the VPC network and the Service Networking API's managed tenant project. Without this VPC peering, the VM cannot route traffic to the Cloud SQL instance's private IP, even if both are in the same VPC network. Option C directly identifies this missing prerequisite.

Answer

Private Google Access is not enabled on the subnet.

Answer

The VM's firewall rules block traffic to the Cloud SQL IP range.

Answer

The Cloud SQL instance requires the Cloud SQL Auth proxy to be installed on the VM.

Question 16

A company wants to use Cloud Armor to block traffic from specific countries to comply with data sovereignty requirements. They have a global HTTP Load Balancer configured. Where should they configure the Cloud Armor policy?

Accepted Answer

Attach to the backend service of the load balancer.. Cloud Armor policies must be attached to a backend service (or backend bucket) of a global HTTP(S) Load Balancer to filter traffic at the edge. This allows the policy to evaluate incoming requests based on geographic location before they reach the backend, enforcing data sovereignty rules without modifying VPC networking or firewall rules.

Answer

Attach to the VPC network that hosts the load balancer.

Answer

Configure as an Organization Policy constraint.

Answer

Configure as a firewall rule in the VPC network.

Question 17

Refer to the exhibit. A security engineer runs the command to view recent decrypt operations on a Cloud KMS key. The output shows a successful decryption. However, the engineer is concerned about the exposure of the plaintext. Based on the log entry, what is the most accurate statement regarding the visibility of the decrypted plaintext?

Accepted Answer

The plaintext field is redacted by Cloud KMS, and the actual plaintext is not visible in the log entry.. Option C is correct because Cloud KMS automatically redacts the plaintext field in Cloud Audit Logs for decrypt operations. The log entry shows a successful decryption, but the actual decrypted data is never written to the logs; instead, the plaintext field is replaced with a redacted marker (e.g., `[REDACTED]`). This is a security feature to prevent sensitive data from being exposed in audit logs, even to users with access to view them.

Answer

The plaintext field is not present in the log because the service does not log it.

Answer

The plaintext field contains the base64-encoded ciphertext, and the engineer needs to decode it.

Answer

The plaintext field contains the actual decrypted data in plaintext, and the engineer should restrict access to the logs.

Question 18

A healthcare organization is migrating sensitive patient data to Google Cloud and must comply with HIPAA. They plan to use Cloud SQL for MySQL with CMEK for encryption at rest. The security team is concerned about key management and access logging. Which additional measure should be implemented to meet HIPAA audit requirements?

Accepted Answer

Enable Data Access audit logs for the Cloud SQL instance and Cloud KMS key.. Option C is correct because HIPAA audit requirements mandate that access to protected health information (PHI) and the keys protecting it must be logged. Enabling Data Access audit logs on both the Cloud SQL instance and the Cloud KMS key captures read, write, and administrative operations, providing the necessary audit trail for compliance. Without these logs, the organization cannot demonstrate who accessed the data or the encryption keys, which is a core HIPAA requirement.

Answer

Configure VPC Service Controls to restrict access to the Cloud SQL instance.

Answer

Use Cloud DLP to de-identify the data before storing it in Cloud SQL.

Answer

Store the CMEK keys in Cloud HSM to meet FIPS 140-2 Level 3 requirements.

Question 19

A security engineer runs the command in the exhibit. The command fails with an error: 'Permission denied: cryptoKeyVersions.encrypt'. What is the most likely cause?

Accepted Answer

The user does not have the cloudkms.cryptoKeyVersions.encrypt permission on the key.. The error message 'Permission denied: cryptoKeyVersions.encrypt' explicitly indicates that the user lacks the cloudkms.cryptoKeyVersions.encrypt permission on the specific key version. In Google Cloud KMS, encrypt operations require the cloudkms.cryptoKeyVersions.encrypt permission (or a broader role like roles/cloudkms.cryptoKeyEncrypter) on the key resource. The command itself is syntactically correct, so the failure is due to insufficient IAM permissions, not resource existence or location.

Answer

The key ring 'my-keyring' does not exist.

Answer

The key ring location is incorrect.

Answer

The user does not have the cloudkms.cryptoKeyVersions.decrypt permission.

Question 20

A financial services company runs a sensitive application on Google Kubernetes Engine (GKE) with Workload Identity enabled. Security policy requires that only pods with a specific service account can access a Cloud Storage bucket containing customer data. The bucket has uniform bucket-level access enabled. What is the correct combination of IAM bindings to achieve this?

Accepted Answer

Bind the Google service account (linked to the Kubernetes service account via Workload Identity) to the bucket IAM policy with roles/storage.objectViewer. Workload Identity links a Kubernetes service account (KSA) to a Google service account (GSA). When a pod uses that KSA, it authenticates as the linked GSA. Since the bucket has uniform bucket-level access, IAM permissions must be granted directly on the bucket resource, not at the project level. Binding the GSA to the bucket with roles/storage.objectViewer ensures only pods using that specific KSA can read the bucket.

Answer

Add the Google service account as a member of the bucket with roles/storage.objectViewer

Answer

Grant the Google service account roles/storage.objectViewer at the project level

Answer

Bind the Kubernetes service account to the bucket IAM policy with roles/storage.objectViewer