PCSE Practice Exam 4 — 20 Questions

Question 1

A company uses Security Command Center (SCC) Premium tier and wants to automatically trigger a Cloud Function to remediate a threat finding. Which approach should they use?

Accepted Answer

Configure SCC to send findings to a Pub/Sub topic, and subscribe a Cloud Function to that topic.. SCC can send real-time notifications via Pub/Sub when findings of certain types or severities are created. A Cloud Function can subscribe to that topic to perform automated remediation. Cloud Scheduler cannot be triggered by events; Cloud Tasks is for asynchronous task execution but not designed for event-driven triggers from SCC; Logs Router exports logs but does not directly trigger Cloud Functions based on findings.

Answer

Use Cloud Tasks to periodically invoke Cloud Functions after reading findings from Security Command Center API.

Answer

Create a Cloud Scheduler job that polls SCC findings periodically and invokes Cloud Functions.

Answer

Export SCC findings to Cloud Storage, and set up a Cloud Function on object finalize.

Question 2

A company has a VPC with a subnet (10.1.0.0/24) in us-central1. They have a Cloud NAT configured for outbound traffic to the internet. They want instances in this subnet to access a third-party API that is only accessible over the internet and requires a specific static source IP for whitelisting. What is the recommended approach?

Accepted Answer

Reserve a static NAT IP in Cloud NAT and whitelist that IP with the third party.. Cloud NAT allows instances without external IPs to initiate outbound connections to the internet. By reserving a static NAT IP address in Cloud NAT, you ensure all outbound traffic from the subnet uses a consistent source IP, which can be whitelisted by the third-party API. This meets the requirement for a static source IP without assigning external IPs to individual instances.

Answer

Assign external IPs to the instances and use network-level access controls.

Answer

Use Private Google Access to route traffic through Google's network.

Answer

Configure a VPC Service Controls perimeter to restrict egress.

Question 3

A GKE cluster has Workload Identity enabled. A Kubernetes service account is bound to a GCP service account named 'sa-gcs'. A pod using the Kubernetes service account fails to list objects in a Cloud Storage bucket. The GCP service account has the Storage Object Viewer role. What is the most likely cause?

Accepted Answer

The Kubernetes service account does not have the iam.workloadIdentityUser role on the GCP service account.. The pod must use the Kubernetes service account, but the GCP service account may not have the required permission (storage.objects.list). However, with Workload Identity, the pod authenticates as the GCP SA. The issue could be that the GCP SA does not have the role on the specific bucket, or the binding is misconfigured. But the most common cause is missing the iam.workloadIdentityUser role on the GCP SA for the Kubernetes service account to impersonate it. Without that, the pod cannot use the GCP SA.

Answer

The pod is using the wrong GCP service account.

Answer

The bucket has uniform bucket-level access disabled.

Answer

The GCP service account lacks the storage.objects.list permission.

Question 4

A security analyst wants to detect when a user creates a Compute Engine instance with a public IP address in a sensitive project. What is the best method?

Accepted Answer

Use Cloud Logging with a log-based metric and alert.. Cloud Logging with a log-based metric and alert enables real-time detection by monitoring compute.instances.insert log entries for external IPs. Option A is incorrect: Cloud Functions can trigger on instance creation but require custom logic and may have latency. Option B is incorrect: Data Access audit logs track data access, not admin operations like instance creation. Option D is incorrect: Cloud Asset Inventory is not real-time and better suited for compliance checks, not immediate alerting.

Answer

Create a Cloud Function that triggers on instance creation events.

Answer

Enable Data Access audit logs and filter for insert calls.

Answer

Use Cloud Asset Inventory to create a feed for instance creation.

Question 5

Match each CVE or security concept to its description.

Accepted Answer

CVE-2017-0144: Exploits SMB protocol to allow remote code execution (EternalBlue). Correct matches: CVE-2017-0144 (EternalBlue) exploits SMB; CVE-2021-44228 (Log4Shell) targets Log4j; CVE-2014-0160 (Heartbleed) leaks OpenSSL memory; buffer overflow is a general memory corruption. Distractors swap descriptions between CVEs.

Answer

CVE-2017-0144: Exploits Apache Log4j logging library

Answer

CVE-2021-44228: Leaks memory from OpenSSL

Question 6

A company subject to GDPR receives a request from a data subject to delete all personal data from BigQuery audit logs. The logs contain query execution details with user identifiers. How can the company comply with the right to erasure (right to be forgotten)?

Accepted Answer

Use the Data Subject Request tool in Google Cloud to request erasure of the specific personal data from audit logs. BigQuery audit logs (Cloud Audit Logs) are immutable and cannot be deleted directly by customers. To comply with erasure requests, the company must use the Data Subject Request tool to request removal, as Google retains logs for 30 days and may need to remove them.

Answer

Create a log sink to export logs to Cloud Storage, then delete the sink and the exported objects

Answer

Delete the entire BigQuery dataset containing the logs

Answer

Use Cloud DLP to redact personally identifiable information from the logs

Question 7

A company is using Cloud SQL for MySQL to store customer data subject to SOX compliance. They need to ensure that all database changes are audited and that logs are immutable. They have enabled audit logs and exported them to a Cloud Storage bucket. However, the auditor discovers that some logs were deleted from the bucket. What is the most likely cause?

Accepted Answer

The Cloud Storage bucket has a lifecycle rule that deletes objects after a set number of days.. Cloud Storage lifecycle rules can automatically delete objects after a specified number of days. If a lifecycle rule is configured on the bucket, it would delete audit logs regardless of the export process, making them unavailable to the auditor. This is the most likely cause of logs being deleted from the bucket, as the other options do not explain actual deletion of already-exported objects.

Answer

The log sink filter is excluding certain events, causing incomplete export.

Answer

The bucket has retention policy enabled, which prevents deletion until the retention period expires.

Answer

The service account used for export does not have the storage.objects.delete permission.

Question 8

An organization needs to store cryptographic keys that must be protected in a FIPS 140-2 Level 3 validated hardware security module (HSM). Which Google Cloud service should they use?

Accepted Answer

Cloud HSM. Cloud HSM provides FIPS 140-2 Level 3 validated HSM for key material. Keys are generated and stored in the HSM.

Answer

Secret Manager

Answer

Cloud KMS with software-backed keys

Answer

Cloud External Key Manager

Question 9

A healthcare organization is migrating applications to Google Cloud and must comply with HIPAA. They plan to store protected health information (PHI) in Cloud Storage and BigQuery. The security engineer needs to ensure that all access to PHI is logged and that the data is encrypted at rest with customer-managed keys. The organization also requires that any audit logs containing PHI are stored in a separate project with restricted access. Which course of action meets all requirements?

Accepted Answer

Enable Data Access audit logs for Cloud Storage and BigQuery, create a sink to route logs to a BigQuery dataset in a separate project, and use CMEK in the data project.. It meets all requirements: Data Access audit logs capture every access to PHI, a sink routes those logs to a BigQuery dataset in a separate project (fulfilling the separate-project storage requirement), and CMEK (customer-managed encryption keys) ensures encryption at rest with keys controlled by the organization. This combination satisfies HIPAA logging, encryption, and restricted-access log storage mandates.

Answer

Enable Data Access audit logs for Cloud Storage and BigQuery, and store logs in the same project. Use CMEK for encryption.

Answer

Use VPC Service Controls to create a perimeter around the project, and enable CMEK for encryption.

Answer

Enable Admin Read audit logs for Cloud Storage and BigQuery, and store logs in a different project. Use CSEK for encryption.

Question 10

A company using Google Cloud wants to conduct a penetration test on their infrastructure. According to Google's acceptable use policy, what must they do before testing?

Accepted Answer

Ensure that the tests do not include Denial of Service (DoS) attacks. Google's policy allows penetration testing on most services without prior approval, as long as the tests are not Denial of Service (DoS) attacks. This applies to common GCP services like Compute Engine, GKE, and Cloud Functions.

Answer

Create a separate VPC network for testing

Answer

Submit a request to Google support for each test

Answer

Enable VPC Flow Logs for monitoring

Question 11

Refer to the exhibit. The security team created this key for encrypting database backups. After an audit, they found that data encrypted before May 1, 2023, cannot be decrypted. What is the most likely cause?

Accepted Answer

Key version 1 was deleted after the new primary was created.. When a new primary key version is created in Cloud KMS, the old primary key version is not automatically deleted. However, if the old key version (version 1) was manually deleted after promoting version 2 as the primary, any data encrypted with version 1 becomes permanently undecryptable. The audit finding that data encrypted before May 1, 2023 cannot be decrypted directly indicates that the key version used for that encryption (likely version 1) is no longer available, not just disabled or rotated.

Answer

The rotation period is too short, causing old versions to be destroyed.

Answer

The primary key version is disabled.

Answer

The algorithm GOOGLE_SYMMETRIC_ENCRYPTION is not supported by HSM.

Question 12

A security engineer notices that some developers are still uploading their own public SSH keys to Compute Engine instances despite the organization policy above being applied to the folder. What is the most likely reason?

Accepted Answer

The policy disables uploading service account keys, not user SSH keys.. The organization policy described likely restricts the uploading of service account keys, not user SSH keys. The policy in question is typically the 'Disable service account key upload' constraint (iam.disableServiceAccountKeyUpload), which prevents users from creating or uploading external service account keys. It does not affect the ability to add public SSH keys to Compute Engine instances, which is governed by separate metadata-based mechanisms (e.g., oslogin or instance metadata). Therefore, developers can still upload their own SSH keys despite the policy being applied.

Answer

The policy only applies to projects, not folders.

Answer

The policy takes 24 hours to propagate to all projects.

Answer

The policy was applied at the organization level, not the folder level.

Question 13

A healthcare organization must store protected health information (PHI) in Google Cloud and ensure compliance with HIPAA. They need to prevent data from being stored outside the United States. Which Google Cloud product should they use to enforce this requirement?

Accepted Answer

Organization Policy. Organization Policy allows you to define and enforce constraints on Google Cloud resources at the organization, folder, or project level. The `gcp.resourceRestriction` constraint can be used to restrict the location where data can be stored, ensuring PHI remains within the United States to meet HIPAA requirements.

Answer

Cloud Healthcare API

Answer

VPC Service Controls

Answer

Cloud Data Loss Prevention (DLP) API

Question 14

Refer to the exhibit. A developer created the firewall rule to allow HTTPS traffic from the API service account to instances tagged 'api-instances'. However, HTTPS requests from the API server (which runs on an instance with tag 'api-instances' and uses the default compute engine service account) are failing. What is the most likely cause?

Accepted Answer

The source instance is using the default compute engine service account, not the specified api-sa.. The firewall rule explicitly specifies the source as the API service account (api-sa), but the API server is using the default compute engine service account. In Google Cloud, firewall rules that use sourceServiceAccounts match traffic based on the service account attached to the source instance, not the instance's tags or the service account used by the application. Since the source instance's service account does not match the rule's specified service account, the HTTPS traffic is implicitly denied.

Answer

The rule should have a higher priority to override the default implicit deny.

Answer

The direction should be EGRESS because the traffic originates from the API server.

Answer

The rule should use sourceTags instead of sourceServiceAccounts to match the source instance.

Question 15

A financial services company is migrating to Google Cloud and needs to enforce strict security controls. They want to ensure that: 1) No service account keys are created. 2) All Compute Engine instances must be created with Shielded VM enabled. 3) Only users from the corporate domain (example.com) can be granted IAM roles. Which THREE Organization Policy constraints must be used? (Choose three.)

Accepted Answer

constraints/iam.allowedPolicyMemberDomains. The three constraints are: constraints/iam.disableServiceAccountKeyCreation (prevents key creation), constraints/compute.requireShieldedVm (requires Shielded VM), and constraints/iam.allowedPolicyMemberDomains (restricts IAM members to specific domains). The other constraints are not relevant: constraints/compute.restrictCloudArmorPolicies is about Cloud Armor policies, and constraints/compute.requireOsLogin is about OS Login.

Answer

constraints/compute.requireOsLogin

Answer

constraints/compute.restrictCloudArmorPolicies

Question 16

A financial services company must ensure that all data stored in Cloud Storage is encrypted with customer-managed encryption keys (CMEK) that are rotated every 90 days. They have enabled Organization Policy constraints to enforce CMEK. However, some new buckets are still being created without CMEK. What is the most likely cause?

Accepted Answer

The Organization Policy constraint is not applied to the folder that contains the project.. Organization Policy constraints are hierarchical and must be applied at the project, folder, or organization level to take effect. If the constraint is applied only at the organization level but the project resides in a folder that does not inherit the policy (or the constraint is not applied to that folder), the policy will not enforce CMEK on buckets created in that project. This explains why new buckets can still be created without CMEK despite the policy being enabled elsewhere.

Answer

VPC Service Controls are blocking the use of CMEK.

Answer

The buckets are created using a service account that has the CMEK permission but the key ring is not in the same region.

Answer

The buckets are using the Archive storage class, which does not support CMEK.

Question 17

A financial institution is deploying a PCI DSS-compliant web application on Google Cloud. They need to isolate the cardholder data environment (CDE) from other environments and protect the web application against common web attacks. Which combination of services meets these requirements?

Accepted Answer

VPC Service Controls and Cloud Armor. VPC Service Controls create a perimeter around Google Cloud resources to prevent data exfiltration. Cloud Armor is a web application firewall that protects against OWASP Top 10 attacks. Together they isolate the CDE and protect the application. Cloud IDS is for network threat detection, not isolation. Cloud NAT provides outbound internet access, not security. Cloud Load Balancing distributes traffic but does not isolate.

Answer

Cloud NAT and Cloud IDS

Answer

Identity-Aware Proxy (IAP) and Cloud Storage

Answer

Shared VPC and Cloud Load Balancing

Question 18

A company has a global HTTPS load balancer and wants to use a self-managed SSL certificate. They have uploaded the PEM-encoded certificate and private key to the load balancer. However, the certificate is about to expire. What is the correct way to renew it without downtime?

Accepted Answer

Create a new SSL certificate resource with the new certificate and key, then update the target HTTPS proxy to use it. To renew a self-managed certificate, you create a new SSL certificate resource with the updated certificate and key, and then update the load balancer's target HTTPS proxy to use the new certificate. This can be done without downtime by updating the proxy.

Answer

Use gcloud compute ssl-certificates update to replace the certificate

Answer

Update the existing SSL certificate resource with the new certificate and key

Answer

Delete the existing certificate and upload the new one with the same name

Question 19

A company needs to grant developers the ability to deploy applications to App Engine, but they should not be able to modify IAM policies. Which two roles should be assigned to the developers? (Choose two.)

Accepted Answer

roles/appengine.serviceAdmin. The correct roles are App Engine Deployer and App Engine Service Admin. App Engine Admin includes IAM policy modification.

Answer

roles/owner

Answer

roles/appengine.appViewer

Answer

roles/appengine.appAdmin

Question 20

During a security incident, a forensics team needs to capture a disk snapshot of a compromised Compute Engine instance for analysis. They want to ensure the snapshot is consistent and includes data in memory. Which step should be taken before taking the snapshot?

Accepted Answer

Stop the instance before taking the snapshot. For consistent snapshots of a running instance, you should first stop the instance (or at least freeze the filesystem). To capture memory, you would need to use a tool like LiME or dump the memory via a hypervisor; standard disk snapshots do not capture memory. However, the question asks about disk snapshot consistency; the best practice is to stop the instance.

Answer

Take a snapshot while the instance is running; consistency is automatic

Answer

Enable VPC Flow Logs on the network

Answer

Create an image from the disk first