PCSE Practice Exam 2 — 20 Questions

Question 1

An organization uses Cloud Audit Logs to monitor admin activity. The security team wants to be alerted when a user creates a new IAM role at the organization level. Which type of audit log should they analyze?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs (option D) are the correct choice because they record operations that modify the configuration or metadata of resources, such as creating or modifying IAM roles and policies at the organization level. In Google Cloud, Admin Activity audit logs are enabled by default and capture all 'admin write' events, including the creation of an IAM role, which is a configuration change. The security team needs to monitor these logs to detect when a user creates a new IAM role, as this is an administrative action that alters the organization's security posture.

Answer

Policy Denied audit logs

Answer

System Event audit logs

Answer

Data Access audit logs

Question 2

A developer needs to deploy an application on Compute Engine that reads from a Cloud Storage bucket. The engineer wants to avoid managing service account keys. What is the recommended approach to grant the necessary permissions?

Accepted Answer

Create a custom service account, grant it required roles, and attach it to the Compute Engine instance.. Attaching a custom service account directly to a Compute Engine instance is the recommended approach to avoid managing service account keys. This method uses the instance's metadata to provide credentials via the instance metadata server, eliminating the need to download, store, or rotate JSON key files. The custom service account can be granted only the required roles (e.g., Storage Object Viewer) following the principle of least privilege.

Answer

Create a service account, generate a JSON key, and store it on the instance.

Answer

Use the default Compute Engine service account and grant it the Storage Object Viewer role.

Answer

Use Application Default Credentials (ADC) without a service account.

Question 3

A security engineer wants to ensure that sensitive data in BigQuery is masked for analysts but visible in full to data stewards. Which two components must be used together? (Choose TWO.)

Accepted Answer

Data Catalog taxonomy with policy tags. BigQuery column-level security requires a Data Catalog taxonomy with policy tags, and then BigQuery Data Policy to define masking rules (e.g., email masking). Policy tags alone provide access control but not masking; data policies provide the masking.

Answer

Cloud DLP de-identification templates

Answer

IAM roles with conditions on table

Answer

Cloud KMS key for encryption

Question 4

A company is designing a CI/CD pipeline using Cloud Build. Security requirements mandate that the pipeline deploy only to projects that have been explicitly authorized. The security team wants to use a service account that can be assumed by Cloud Build to perform deployments, and they want to restrict which projects can be deployed to using organization policies. Which approach should they take?

Accepted Answer

Use the organization policy constraint 'constraints/iam.allowedPolicyMemberDomains' and set it to only allow the service account's domain.. The organization policy constraint `constraints/iam.allowedPolicyMemberDomains` restricts which domains' principals can be granted roles in the organization. By setting this constraint to only allow the domain that contains the service account used by Cloud Build, you ensure that only service accounts from that domain can be granted roles. Then, you grant that service account the necessary deployment roles (e.g., Compute Instance Admin, Kubernetes Engine Admin) only in the explicitly authorized projects. This combination of organization policy and IAM grants restricts deployment to only those projects, meeting the security requirement.

Answer

Use the organization policy constraint 'constraints/iam.serviceAccountKeyExpiryHours' to force key rotation.

Answer

Use the organization policy constraint 'constraints/compute.restrictCrossProjectNw' to limit network access.

Answer

Use the organization policy constraint 'constraints/iam.workloadIdentityPoolProviders' to restrict which workload identity pools can be used.

Question 5

Which two authentication methods are available for applications to authenticate to Google Cloud APIs without using a service account key? (Choose TWO.)

Accepted Answer

Compute Engine metadata server default service account token. The Compute Engine metadata server provides a default service account token that applications running on Compute Engine can use to authenticate to Google Cloud APIs without needing to manage a service account key file. This token is automatically obtained from the metadata server at http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token, and it is rotated automatically by Google, eliminating the need for key storage and rotation.

Answer

API key

Answer

OAuth 2.0 client ID

Answer

Service account key

Question 6

Which TWO practices help implement the principle of least privilege when configuring access to Google Cloud resources? (Choose two.)

Accepted Answer

Create custom roles that include only the specific permissions needed.. Creating custom roles allows you to define a precise set of permissions, ensuring that a principal has only the minimum permissions required to perform their job function. This directly implements the principle of least privilege by avoiding the broad permissions often included in predefined roles.

Answer

Grant roles at the organization level to simplify administration.

Answer

Use a single service account for all Cloud Functions in a project to simplify key management.

Answer

Grant IAM roles directly to individual users for better traceability.

Question 7

A financial services company runs a PCI DSS-compliant workload on Google Cloud. They use a service account with roles/container.clusterAdmin to manage a GKE cluster. The security team has enabled Binary Authorization with a policy that requires all container images to be signed by a trusted authority. Recently, a developer reported that a new deployment failed with the error: 'Image verification failed: no signature found for digest sha256:abc...'. The image is stored in Artifact Registry and the developer built it using Cloud Build with a trigger that automatically signs images using Cloud KMS. The Cloud Build service account has roles/cloudkms.signerVerifier and roles/binaryauthorization.attestorsViewer. The Binary Authorization policy is configured to require at least one attestation from the trusted attestor. What is the most likely reason for the failure?

Accepted Answer

The Cloud Build service account lacks the roles/binaryauthorization.attestorsEditor role.. The Cloud Build service account has roles/cloudkms.signerVerifier and roles/binaryauthorization.attestorsViewer, which allow it to sign images and view attestors, but it lacks the roles/binaryauthorization.attestorsEditor role. Without this role, the service account cannot create or manage attestations in Binary Authorization, so even though the image is signed, no attestation is recorded, causing the policy to fail with 'no signature found'.

Answer

The container image is stored in a different registry that is not supported by Binary Authorization.

Answer

The GKE cluster's node service account does not have permission to verify attestations.

Answer

The Binary Authorization policy requires an attestation from a different attestor that is not configured.

Question 8

A company uses multiple GCP projects and wants to allow a service account from Project A to initiate Dataflow jobs in Project B. The service account in Project A has the Dataflow Developer role at the organization level. However, it fails with permission denied when trying to submit a job to Project B. What is the most likely issue?

Accepted Answer

The service account needs the Service Account User role on the Dataflow service account in Project B.. The service account from Project A has the Dataflow Developer role at the organization level, which grants permissions to create Dataflow jobs, but it still needs the Service Account User role (roles/iam.serviceAccountUser) on the Dataflow service account in Project B. When a Dataflow job is submitted, the job runs as a service account in the target project (Project B), and the caller must have the iam.serviceAccounts.actAs permission on that service account. Without this role, the API call fails with a permission denied error even though the Dataflow Developer role is present.

Answer

The organization policy restricts cross-project access.

Answer

The service account does not have permission to create Dataflow jobs in Project B because it is not a member of Project B.

Answer

The Dataflow API is not enabled in Project B.

Question 9

Which THREE components are required to configure VPC Flow Logs for a Compute Engine instance?

Accepted Answer

Enable VPC Flow Logs on the subnet. VPC Flow Logs capture network traffic metadata at the subnet level. Enabling flow logs on the subnet (A) is the primary configuration step that activates logging for all VM instances within that subnet. The VM's service account must have the compute.instances.get permission (B) to allow the flow log agent to retrieve instance metadata required for log entries. A VM with a network interface in the subnet (D) is necessary because flow logs are generated per network interface; without a VM in the subnet, there is no traffic to log.

Answer

A log sink to export logs to BigQuery

Answer

A metadata server to store logs

Question 10

An organization wants to enforce that all container images deployed to a GKE cluster must be signed by an approved authority. They have set up Binary Authorization with a policy that requires attestation. Where should the signing key be stored to meet security best practices?

Accepted Answer

Store the private key in Cloud Key Management Service (Cloud KMS).. Binary Authorization integrates with Cloud Key Management Service (KMS) to store attestor keys. Cloud KMS provides centralized key management, access control via IAM, and audit logging. Using a key stored in Cloud KMS is the recommended approach.

Answer

Store the private key in a GCS bucket with uniform bucket-level access.

Answer

Store the private key in Secret Manager.

Answer

Store the private key on the developer's workstation.

Question 11

A Cloud Function that processes financial data is timing out after 60 seconds. The function performs complex calculations and cannot be decomposed further. What is the best solution?

Accepted Answer

Increase the Cloud Functions timeout to 120 seconds and optimize the code. Cloud Functions provides a configurable timeout, and the maximum timeout for HTTP functions is 60 minutes, so increasing the timeout to 120 seconds is feasible. Additionally, optimizing the code can reduce execution time. Option A is wrong because migrating to Cloud Run adds complexity and does not necessarily resolve a timeout caused by slow code; Cloud Run also has a default timeout of 60 minutes, so it may not be better than simply increasing Cloud Functions timeout. Option B is wrong because changing the programming language does not inherently reduce execution time; performance depends on the logic and algorithms. Option C is wrong because increasing memory may slightly improve CPU performance but does not extend the timeout limit; the function still times out at 60 seconds if it is not completed.

Answer

Migrate the function to Cloud Run with a longer timeout

Answer

Change the Cloud Functions runtime from Node.js to Python

Answer

Increase the allocated memory for the function

Question 12

A company wants to ensure compliance with PCI DSS by monitoring access to BigQuery datasets containing sensitive data. They need to log all read operations and enable real-time alerting for anomalous access. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Create a log sink to export BigQuery Data Access logs to Pub/Sub.. BigQuery Data Access logs record read operations but are not enabled by default. To enable them, you must explicitly enable Data Access logs for BigQuery. For real-time alerting, you can export logs to Pub/Sub and process them with a Cloud Function.

Answer

Enable Admin Activity logs for BigQuery.

Answer

Use Security Command Center to detect sensitive data access.

Answer

Create a BigQuery view to restrict access to sensitive columns.

Question 13

Which THREE are best practices for managing encryption keys in Google Cloud?

Accepted Answer

Enable automatic rotation for keys that are used for encryption.. Cloud KMS supports automatic key rotation, which reduces the risk of key compromise by ensuring that encryption keys are periodically replaced without manual intervention. Automatic rotation creates new key versions at a specified interval (e.g., every 90 days) and automatically uses the latest version for encryption, while decryption can still use older versions. This aligns with the security best practice of limiting the amount of data encrypted under a single key version.

Answer

Import key material from on-premises HSMs to avoid vendor lock-in.

Answer

Automatically delete old key versions once they expire.

Question 14

A company has multiple Google Cloud projects organized under folders by department. The security team wants to enforce a policy that all Compute Engine instances must use Shielded VM features. They need to prevent non-compliant instances from being created. Which action should be taken to enforce this requirement most effectively?

Accepted Answer

Use the Organization Policy Service with the constraint constraints/compute.requireShieldedVm.. Organization Policy constraints are the correct mechanism to enforce requirements across the resource hierarchy. The built-in constraint 'constraints/compute.requireShieldedVm' ensures that any new Compute Engine instance must have Shielded VM features enabled. This policy can be applied at the organization, folder, or project level. IAM roles or custom roles cannot enforce instance configuration requirements. Service account impersonation is unrelated. Deny policies can deny specific permissions but not enforce Shielded VM settings.

Answer

Create an IAM deny policy at the organization level that denies the compute.instances.create permission unless the Shielded VM flag is set.

Answer

Create a custom role that includes the permission to create instances only with Shielded VM, and assign it to all users.

Answer

Implement a service account that only has permission to create instances and use service account impersonation for all instance creation.

Question 15

Which THREE of the following are best practices for using Cloud DLP to protect sensitive data in BigQuery?

Accepted Answer

Use inspection jobs to scan tables and identify sensitive data.. Cloud DLP inspection jobs can scan BigQuery tables to identify sensitive data types (e.g., PII, credit card numbers) using built-in infoTypes. This is a foundational step before applying any deidentification or access control measures, as it allows you to discover where sensitive data resides.

Answer

Store transformed data in a separate dataset with stricter access controls.

Answer

Encrypt the entire BigQuery table using CMEK.

Question 16

A company has a compliance policy requiring that all data at rest in Cloud Storage be encrypted with a Cloud KMS key that is rotated every 90 days. The company uses CMEK with automatic key rotation enabled. An auditor discovers that some older objects in a bucket were created with a previous key version that has since been disabled. The compliance team requires that all objects be re-encrypted with the current key version. The bucket does not have object versioning enabled. What should the security engineer do to remediate this issue?

Accepted Answer

Use the 'gsutil rewrite -k' command to re-encrypt the objects with the current key version.. The 'gsutil rewrite -k' command re-encrypts existing objects in Cloud Storage with the current Cloud KMS key version, without requiring object versioning or re-uploading. This directly addresses the compliance requirement to re-encrypt all objects with the current key version, even though the old key version is disabled.

Answer

Re-enable the disabled key version in Cloud KMS so that objects can be read with the old key.

Answer

Enable object versioning on the bucket and delete the non-compliant object versions.

Answer

Create a new bucket with default encryption set to the current key and copy objects to it.

Question 17

Alice tries to connect to Cloud SQL instance 'prod-instance' using the Cloud SQL Auth proxy. Will she succeed? Why?

Accepted Answer

Yes, because the admin role grants full access, and the condition only applies to the admin role, but the client role is unconditional.. The Cloud SQL Auth proxy uses IAM permissions for authentication and authorization. The `cloudsql.client` role grants the `cloudsql.instances.connect` permission unconditionally, allowing Alice to connect to any instance. The `cloudsql.admin` role's condition restricting access to 'dev' instances only applies to the `cloudsql.instances.update` permission, not to the connect permission, so the client role's unconditional access prevails.

Answer

Yes, because she has the client role with no condition.

Answer

No, because the admin role condition overrides the client role.

Answer

No, because the cloudsql.admin role condition restricts to dev instances only.

Question 18

During a security incident, a forensic investigator needs to analyze a compromised Compute Engine instance without affecting the live environment. The instance has persistent disks with critical data. What is the best first step to preserve evidence?

Accepted Answer

Create a snapshot of the persistent disks.. Creating a snapshot of the persistent disks preserves a point-in-time copy without affecting the running instance. The snapshot can then be used to create a new disk attached to a forensic VM for analysis. Disk cloning requires stopping the instance.

Answer

Clone the instance to a new VM.

Answer

Export the disk image to Cloud Storage.

Answer

Enable VPC Flow Logs for the instance's network.

Question 19

A company is using a Shared VPC in Google Cloud with multiple service projects. The security team wants to restrict egress traffic from a specific service project to only allowed external IP addresses. The network project hosts the VPC. What is the best approach?

Accepted Answer

Create a firewall rule in the host project that denies egress to all destinations except the allowed IPs, and apply it to the service project's VMs via service accounts.. In a Shared VPC, firewall rules are defined in the host project and apply to VM instances in service projects. Option D correctly creates a deny-all egress rule in the host project, then uses a higher-priority allow rule for specific external IPs, scoped to service accounts of the target VMs. This ensures egress traffic from the specific service project is restricted at the VPC firewall level, which is the only effective way to control outbound traffic in a Shared VPC architecture.

Answer

Use Private Google Access to restrict egress.

Answer

Use VPC Service Controls to restrict egress.

Answer

Create a firewall rule in the service project's VPC that denies egress.

Question 20

An organization stores sensitive customer data in BigQuery tables. They need to enforce column-level security such that users in the 'support' group see a masked version of email addresses (e.g., j***@example.com), while managers see the full email. Which approach should they use?

Accepted Answer

Apply a BigQuery data masking policy using policy tags on the email column.. BigQuery column-level security with policy tags and data masking rules can achieve this. Data masking policies can be applied to policy tags to mask data based on user access. Using views or separate tables is less maintainable, and Cloud DLP is for batch scanning/de-identification, not real-time masking.

Answer

Create a view that applies masking functions and grant access to the view.

Answer

Use Cloud DLP to scan and de-identify the data in place.

Answer

Create separate tables for each role and populate them with appropriate data.