PCSE Practice Exam 4 — 20 Questions

Question 1

A company's security policy requires that all traffic to a Google Cloud load balancer use TLS 1.2 or higher and only accept strong ciphers. They want to enforce this using a Google Cloud resource. Which resource should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SSL policy. SSL policies on HTTPS load balancers allow you to specify the minimum TLS version and cipher profile (e.g., RESTRICTED for strong ciphers). This enforces encryption requirements at the load balancer level.

Answer

Cloud Armor security policy

Answer

Network firewall rule

Answer

SSL certificate

Question 2

A company is migrating its on-premises Microsoft Active Directory to Google Cloud using Managed Microsoft AD (Microsoft AD). They need to ensure that users can authenticate to Compute Engine Windows instances using their on-premises credentials without additional user setup. What is the most secure and scalable approach?

Accepted Answer

Create a two-way trust between the Managed Microsoft AD domain and the on-premises AD domain.. Establishing a two-way trust between Managed Microsoft AD and the on-premises AD domain allows users to authenticate to Compute Engine Windows instances using their existing on-premises credentials without any additional user setup. This trust enables Kerberos authentication to flow seamlessly across the two domains, ensuring that on-premises users can access cloud resources securely and scalably without duplicating identities or credentials.

Answer

Configure the Windows instances to join the on-premises AD domain directly via VPN.

Answer

Synchronize on-premises users to Managed Microsoft AD using Google Cloud Directory Sync (GCDS).

Answer

Store on-premises user credentials in Cloud KMS and use a custom authentication script.

Question 3

A company stores sensitive customer data in Cloud Storage. They want to ensure that data is encrypted at rest using customer-managed encryption keys (CMEK) and that access to the key is audited. Which approach should they use?

Accepted Answer

Use CMEK with a Cloud KMS key and enable Cloud Audit Logs for the key.. It combines customer-managed encryption keys (CMEK) via Cloud KMS with Cloud Audit Logs enabled on the key itself. This ensures the data is encrypted at rest using a key that the customer controls and rotates, and all operations against that key (e.g., encrypt, decrypt, enable, disable) are logged for auditing. Cloud Audit Logs on the bucket alone would not capture key access events, which is required for full auditability.

Answer

Use Google-managed encryption keys and enable Cloud Audit Logs for the bucket.

Answer

Use CMEK with key material stored in a Cloud Storage bucket.

Answer

Use customer-supplied encryption keys (CSEK) and store the keys in Secret Manager.

Question 4

A financial services company needs to inspect all inbound and outbound packets from a subnet containing highly sensitive data for compliance. They have enabled VPC Flow Logs on that subnet, which record metadata such as source and destination IP, ports, and protocol. However, the security team requires the actual packet payload to perform deep packet inspection (DPI) for malicious patterns. They want to capture the packets without disrupting network traffic. Which additional configuration should be implemented to meet this requirement?

Accepted Answer

Enable Packet Mirroring on a Compute Engine instance in the subnet to mirror all packets to a collector instance.. Packet Mirroring clones all packets (including payload) from a source instance in the subnet and forwards them to a collector instance for deep packet inspection, without disrupting the original traffic flow. VPC Flow Logs only capture metadata (headers, timestamps) and cannot include payload content, making Packet Mirroring the only solution that meets the requirement for actual packet payload capture.

Answer

Configure Cloud Armor to log all HTTP requests with full request body.

Answer

Enable VPC Flow Logs with metadata capture set to 'include payload'.

Answer

Enable Cloud NAT logging to capture all outbound traffic payloads.

Question 5

An organization has a deny policy at the folder level that denies the permission resourcemanager.projects.create. A user has an allow policy at the project level granting roles/owner. What is the effective permission for the user to create projects in that project?

Accepted Answer

The user cannot create projects because the deny policy at the folder level explicitly denies the permission.. In Google Cloud IAM, deny policies always override allow policies regardless of where they sit in the resource hierarchy. A deny policy at the folder level that denies resourcemanager.projects.create will block the permission even though the user has roles/owner at the project level, because deny takes precedence over allow.

Answer

The user cannot create projects because the deny policy is at a higher level in the hierarchy.

Answer

The user can create projects because Owner role includes all permissions.

Answer

The user can create projects if the project-level allow is more specific.

Question 6

A healthcare organization is migrating to Google Cloud and needs to store Protected Health Information (PHI) in Cloud Storage. They have signed a Business Associate Agreement (BAA) with Google. Which additional step is REQUIRED to ensure HIPAA compliance for the data stored?

Accepted Answer

No additional action is required; Cloud Storage is HIPAA-eligible and encrypts data at rest by default.. Cloud Storage is a HIPAA-eligible service under Google Cloud's BAA, and it encrypts all data at rest by default using AES-256. Once a BAA is in place, no additional configuration is strictly required to store PHI in Cloud Storage from a HIPAA compliance standpoint — encryption at rest and in transit is automatic. Organizations may choose CMEK or other controls for policy reasons, but they are not required for HIPAA eligibility.

Answer

Use Customer-Managed Encryption Keys (CMEK) for the bucket.

Answer

Configure the bucket to be in a VPC with no public access.

Answer

Enable Object Versioning on the bucket.

Question 7

A security team needs to apply a set of firewall rules that enforce baseline security for all VPC networks across multiple projects in an organization. These rules must be inherited and cannot be overridden by project-level rules. What should they use?

Accepted Answer

Hierarchical firewall policies. Hierarchical firewall policies can be applied at the organization or folder level and are inherited by all VPC networks in the hierarchy. They cannot be overridden by lower-level firewall rules, making them ideal for baseline security policies. Network firewall policies are applied to a specific VPC network. VPC firewall rules are per project and can be overridden.

Answer

VPC firewall rules

Answer

Network firewall policies

Answer

Cloud Armor security policies

Question 8

A financial services company uses BigQuery for analytics and needs to implement column-level security such that users with the role 'data_scientist' can see the last four digits of credit card numbers, while the full number is visible only to 'data_owner'. What approach should they use?

Accepted Answer

Use a policy tag with a data masking rule that masks the full number except last four digits, and grant UNMASKED access to data_owner and MASKED access to data_scientist.. BigQuery's policy tags with data masking rules allow you to define column-level masking policies. By creating a masking rule that reveals only the last four digits of the credit card number, you can grant the `data_scientist` role MASKED access (which applies the mask) and the `data_owner` role UNMASKED access (which bypasses the mask). This approach enforces column-level security without duplicating data or using row-level filters.

Answer

Set an IAM condition on the table that filters the column based on the user's role.

Answer

Use row-level security to restrict rows based on role.

Answer

Create two separate BigQuery tables (one with masked data, one with full data) and grant access based on role.

Question 9

A security engineer is designing a solution to monitor and detect anomalous IAM role usage across multiple Google Cloud projects. The engineer wants to create a centralized logging solution that captures all IAM policy changes and access attempts. Which THREE services should the engineer use together to achieve this?

Accepted Answer

BigQuery. BigQuery is correct because it serves as the centralized analytics destination for Cloud Audit Logs, enabling the security engineer to run SQL queries across IAM policy changes and access attempts from multiple Google Cloud projects. By exporting audit logs to BigQuery, you can perform complex aggregations and anomaly detection at scale, which is essential for monitoring IAM role usage across a fleet of projects.

Answer

Cloud Monitoring

Answer

Cloud Functions

Question 10

A company uses Cloud KMS with automatic rotation enabled for a symmetric key. The rotation period is set to 90 days. After 90 days, a new key version is created. The compliance team asks: what happens to data encrypted with the old key version?

Accepted Answer

The old key version remains available for decryption of existing data.. When Cloud KMS rotates a symmetric key, it creates a new key version but does not delete or disable the old version. The old key version remains enabled and available for decryption, so data encrypted with it can still be decrypted. New encryptions use the new primary version, but existing ciphertext is unaffected.

Answer

The old key version is immediately disabled, and all data must be re-encrypted.

Answer

Data encrypted with the old key is automatically re-encrypted with the new key.

Answer

The old key version is deleted after the rotation period.

Question 11

Which Cloud Armor feature uses machine learning to detect and mitigate DDoS attacks?

Accepted Answer

Adaptive Protection. Cloud Armor Adaptive Protection uses ML-based DDoS detection to automatically learn normal traffic patterns and alert or mitigate attacks.

Answer

Preconfigured WAF rules

Answer

Rate limiting

Answer

Custom rules

Question 12

A developer wants to grant a Compute Engine instance access to read objects from a Cloud Storage bucket. The instance runs under a service account. What is the best practice for granting this access?

Accepted Answer

Assign the Storage Object Viewer role to the service account attached to the instance.. The best practice is to assign the appropriate IAM role (e.g., Storage Object Viewer) to the service account that the instance is running as. Then, the instance can use the service account's credentials automatically via the metadata server. This avoids the need to manage service account keys. Generating keys is discouraged. Allowing the instance to use the default compute engine service account is common but less secure; a custom service account with minimal permissions is preferred.

Answer

Create an IAM policy on the bucket that grants access to the instance's external IP address.

Answer

Use a signed URL with a long expiration time for the instance.

Answer

Generate a JSON key for the service account, download it to the instance, and use it in application code.

Question 13

A company uses Google Workspace and wants to allow users to authenticate to a third-party SaaS application using their Google credentials. The SaaS application supports SAML 2.0. What should the administrator configure?

Accepted Answer

SAML 2.0 SSO in Google Admin Console. Google Workspace supports SAML 2.0 federation. The admin would set up a custom SAML app in the Google Admin console, configuring the IdP (Google) and SP (SaaS app) metadata.

Answer

Workload Identity Federation

Answer

Cloud Identity-Aware Proxy (IAP)

Answer

OAuth 2.0 consent screen

Question 14

An organization has multiple VPC networks in different projects. They need to centrally manage firewall rules that apply to all VPCs in the organization and ensure that project owners cannot override them. Which solution should they use?

Accepted Answer

Create a hierarchical firewall policy at the organization level. Hierarchical firewall policies can be applied at the organization or folder level and are inherited by all VPC networks. They cannot be overridden by lower-level firewall rules. This is the correct solution for centralized, unoverrideable rules. Network firewall policies are scoped to a single VPC network.

Answer

Create a network firewall policy and attach it to each VPC network

Answer

Use Cloud Armor security policies with the load balancers

Answer

Use VPC firewall rules with tags applied to all VMs across projects

Question 15

A security team wants to enforce SSL/TLS best practices for their HTTPS load balancer. They need to require TLS 1.2 or higher and restrict ciphers to strong ones only. Which TWO actions should they take? (Choose two.)

Accepted Answer

Attach the SSL policy to the target HTTPS proxy. To enforce TLS version and cipher strength, you create an SSL policy. The policy can set the minimum TLS version to 1.2 and the profile to RESTRICTED (which only allows strong ciphers). Then you attach the policy to the load balancer's target HTTPS proxy.

Answer

Enable Cloud Armor WAF rules

Answer

Set the SSL policy to COMPATIBLE profile

Answer

Use a Google-managed SSL certificate

Question 16

A security engineer needs to block traffic from all IP addresses in a specific geographic region from reaching an HTTPS load-balanced application. The application uses Cloud Load Balancing with an external HTTPS load balancer. Which approach should the engineer use?

Accepted Answer

Create a Cloud Armor security policy with a geo-based deny rule and attach it to the load balancer.. Cloud Armor security policies can be attached to external HTTPS load balancers to filter traffic based on geolocation. The engineer can create a Cloud Armor security policy with a rule that uses the geo-tag to deny traffic from the specified region.

Answer

Create a VPC firewall rule that denies ingress from the region's IP ranges.

Answer

Use Identity-Aware Proxy (IAP) to block access based on the user's location.

Answer

Configure a Cloud CDN policy to block traffic from certain regions.

Question 17

An engineer needs to ensure that only VMs with a specific service account (sa-prod@project.iam.gserviceaccount.com) can access a Cloud Spanner instance. They want to control this at the network level, not using IAM. Which VPC firewall rule configuration should they use?

Accepted Answer

Egress rule with target service account 'sa-prod'. Firewall rules can target service accounts for egress rules. Since the VMs initiate connections to Spanner, an egress rule with target service account is appropriate.

Answer

Egress rule with source service account 'sa-prod'

Answer

Ingress rule with target service account 'sa-prod'

Answer

Ingress rule with source tag 'sa-prod'

Question 18

An organization wants to enforce a security policy that denies all egress traffic to the internet from all projects in the organization, except for traffic from a specific set of VMs tagged with 'allow-egress'. Which approach should be used?

Accepted Answer

Use a hierarchical firewall policy at the organization level with a deny-all egress rule and a higher priority allow rule for the tag.. Hierarchical firewall policies are inherited down the resource hierarchy and can be enforced at the organization or folder level. They cannot be overridden at lower levels, making them suitable for organization-wide baseline rules.

Answer

Create a VPC firewall rule at the organization level to deny all egress, then allow egress for the specific tag.

Answer

Use VPC Service Controls to block egress traffic.

Answer

Configure Cloud Armor with a deny-all egress rule and an exception for the tag.

Question 19

Which Security Command Center (SCC) tier provides built-in compliance monitoring for standards like CIS and PCI DSS?

Accepted Answer

Premium tier. Security Command Center Premium tier includes built-in compliance monitoring and reporting for standards such as CIS Google Cloud Foundations Benchmark, PCI DSS, ISO 27001, and NIST 800-53. The Standard tier provides security posture findings but not the compliance dashboards and standard-specific assessments. Therefore, Premium is the correct answer.

Answer

Neither; compliance monitoring is part of Cloud Audit Logs

Answer

Both Standard and Premium

Answer

Standard tier

Question 20

A security engineer wants to test a web application hosted on Compute Engine for vulnerabilities. According to Google Cloud's Acceptable Use Policy, which of the following is true regarding penetration testing?

Accepted Answer

Penetration testing is allowed without prior approval, but Denial of Service (DoS) testing is prohibited.. Google Cloud's Acceptable Use Policy permits customers to perform penetration testing against their own Google Cloud resources without prior approval, but explicitly prohibits Denial of Service (DoS) and Distributed Denial of Service (DDoS) testing, as well as testing that could impact other customers. This makes option C the accurate statement of policy.

Answer

Penetration testing is allowed only for customers with Enterprise support plans.

Answer

All penetration testing requires prior written approval from Google.

Answer

Testing must be limited to non-production environments only.