PCSE Practice Test 21 — 15 Questions

Question 1

A financial institution is deploying a PCI DSS-compliant web application on Google Cloud. They need to isolate the cardholder data environment (CDE) from other environments and protect the web application against common web attacks. Which combination of services meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VPC Service Controls and Cloud Armor. VPC Service Controls create a perimeter around Google Cloud resources to prevent data exfiltration. Cloud Armor is a web application firewall that protects against OWASP Top 10 attacks. Together they isolate the CDE and protect the application. Cloud IDS is for network threat detection, not isolation. Cloud NAT provides outbound internet access, not security. Cloud Load Balancing distributes traffic but does not isolate.

Answer

Cloud NAT and Cloud IDS

Answer

Identity-Aware Proxy (IAP) and Cloud Storage

Answer

Shared VPC and Cloud Load Balancing

Question 2

A financial institution is required to retain records of all transactions for 7 years under regulatory compliance. They are using Cloud Storage for archive data and need to ensure that objects cannot be deleted or overwritten during the retention period. Which feature should they use?

Accepted Answer

Retention Policy with Retention Lock. A Retention Policy with Retention Lock enforces a retention period during which objects cannot be deleted or overwritten. Locking the policy makes it permanent and irreversible, ensuring compliance with regulations that require data immutability for 7 years. This is the correct feature for WORM storage.

Answer

Object lifecycle management

Answer

Bucket-level IAM conditions

Answer

Bucket-level versioning

Question 3

A security engineer needs to automatically remediate a high-severity finding in Security Command Center. The remediation involves restarting a Compute Engine instance. What is the recommended approach?

Accepted Answer

Create a Cloud Function triggered by a Pub/Sub notification from SCC, and use the Compute Engine API to restart the instance.. The recommended approach is to create a Cloud Function triggered by a Pub/Sub notification from Security Command Center, then use the Compute Engine API to restart the instance. SCC can publish findings to Pub/Sub, and the Cloud Function reacts in near real-time, invoking the Compute Engine API for remediation. This is event-driven and aligns with Google Cloud best practices.

Answer

Configure a log sink to Cloud Functions and parse logs for the finding.

Answer

Use a Compute Engine startup script to check SCC and restart.

Answer

Use Cloud Scheduler to periodically check SCC and restart instances.

Question 4

A company wants internal VMs to access Google APIs (e.g., Cloud Storage, BigQuery) without traversing the internet. What is the simplest configuration?

Accepted Answer

Enable Private Google Access on the subnet where the VMs reside.. Private Google Access allows VMs without external IPs to reach Google APIs and services (Cloud Storage, BigQuery, etc.) using internal IP addresses, keeping traffic off the public internet. Enabling it on the subnet is the simplest configuration and requires no NAT or proxy.

Answer

Assign external IPs to all VMs and use VPC firewall rules to restrict egress.

Answer

Use Cloud NAT to route traffic to Google APIs.

Answer

Set up Private Service Connect to googleapis.com.

Question 5

A financial firm uses Cloud Deployment Manager to manage their Google Cloud infrastructure. They have a strict change management policy requiring that all infrastructure changes in the production environment must be reviewed and approved by a senior engineer before being applied. Currently, developers can modify the Deployment Manager configurations directly, leading to unapproved changes. The company wants to enforce this policy without impacting development agility. What should they implement?

Accepted Answer

Use a CI/CD pipeline with Cloud Build and require approval gates.. Implementing a CI/CD pipeline with Cloud Build and requiring approval gates enforces the change management policy by ensuring that all infrastructure changes go through a controlled process where a senior engineer must approve before deployment. This maintains development agility by automating the pipeline while adding the necessary review step. It integrates with Cloud Deployment Manager to apply changes only after approval.

Answer

Use Deployment Manager snapshots to roll back changes if needed.

Answer

Set up Cloud Audit Logs to monitor changes and alert on unauthorized modifications.

Answer

Use organization policies to restrict access to the Deployment Manager service.

Question 6

A company has an organization policy that disables service account key creation (constraints/iam.disableServiceAccountKeyCreation). However, a legacy application requires a service account key to authenticate. What should the engineer do to satisfy this requirement while following best practices?

Accepted Answer

Use workload identity federation to authenticate the legacy application without keys. Workload identity federation lets external workloads (on-prem, other clouds, CI/CD) obtain short-lived GCP credentials by exchanging an OIDC/SAML token from a trusted identity provider, eliminating the need for long-lived service account keys. This satisfies the org policy constraint while following Google's recommended keyless authentication model. It's the canonical answer for 'legacy app needs to authenticate but keys are disabled.'

Answer

Create a service account key and use it despite the policy, then document the exception

Answer

Create a custom role that includes iam.serviceAccountKeys.create and assign it to the service account

Answer

Remove the organization policy constraint to allow key creation

Question 7

Which THREE are capabilities of Assured Workloads? (Choose three.)

Accepted Answer

Location-based access controls through VPC Service Controls. Assured Workloads is a Google Cloud compliance offering that bundles controls to meet regulatory frameworks, and it includes location-based access controls enforced through VPC Service Controls (A), which let organizations restrict data access to approved regions and prevent data exfiltration across perimeters. It also provides Access Transparency logs (D), which record actions taken by Google personnel on customer data, giving the audit visibility required by compliance regimes. Additionally, Assured Workloads supports Customer-managed encryption keys (CMEK) (E), allowing customers to control and manage their own encryption keys via Cloud KMS for data at rest, which is a common regulatory requirement. The remaining options are unrelated: Cloud Shell (B) is a browser-based terminal for managing resources, and Cloud Interconnect (C) is a dedicated network connectivity service; neither is a capability provided by Assured Workloads.

Answer

Cloud Shell for browser-based terminal access

Answer

Cloud Interconnect for dedicated connectivity

Question 8

A company must comply with PCI DSS requirements that mandate the use of a hardware security module (HSM) for key storage. They plan to use Cloud KMS for key management. Which implementation meets compliance?

Accepted Answer

Create a Cloud HSM key ring and use Cloud KMS with protection level 'HSM'.. PCI DSS requires that cryptographic keys be stored in a hardware security module (HSM) to ensure tamper resistance. Cloud HSM provides a FIPS 140-2 Level 3 validated HSM directly integrated with Cloud KMS, allowing you to create keys with the 'HSM' protection level that are generated and stored within the HSM hardware, meeting compliance without managing external infrastructure.

Answer

Use Cloud External Key Manager (EKM) with an external HSM.

Answer

Use Customer-Supplied Encryption Keys (CSEK) stored in an on-premises HSM.

Answer

Create keys in Cloud KMS using the default software protection level.

Question 9

A security engineer notices that a service account has been assigned the roles/iam.serviceAccountUser role at the project level. What actions can a user with this role perform?

Accepted Answer

Impersonate the service account to access resources.. The roles/iam.serviceAccountUser role grants the iam.serviceAccounts.actAs permission, which allows a principal to impersonate a service account — for example, by attaching it to a Compute Engine instance or using it to obtain short-lived credentials. It does not grant the ability to create, delete, or manage keys on the service account.

Answer

Create new service accounts in the project.

Answer

Delete the service account.

Answer

View the service account's keys.

Question 10

An incident responder needs to collect forensic evidence from a compromised Compute Engine instance for later analysis. They want to preserve disk state and network logs. Which THREE actions should they take?

Accepted Answer

Export and analyze VPC Flow Logs for the instance's network traffic.. Option A is correct because VPC Flow Logs capture the instance's network traffic metadata (5-tuple, bytes, timestamps) and can be exported to Cloud Storage or BigQuery for later forensic analysis, satisfying the requirement to preserve network logs. Option C is correct because creating a snapshot of the boot disk preserves the persistent disk state at a point in time, allowing the responder to attach the snapshot to a clean instance and analyze it without altering the original evidence. Option E is correct because isolating the instance with a firewall rule that blocks all traffic except from a forensic workstation contains the compromise while still permitting the responder to acquire live evidence or memory over the network. Option B is wrong because deleting the instance destroys the boot disk and any attached persistent disks, irreversibly losing forensic evidence. Option D is wrong because powering off the instance can destroy volatile evidence in memory and does not by itself preserve disk state or network logs as cleanly as a snapshot plus isolation.

Answer

Delete the instance to stop billing.

Answer

Power off the instance to prevent further compromise.

Question 11

A security engineer wants to export Cloud Audit Logs to a third-party SIEM in real time. Which log sink destination should they configure?

Accepted Answer

Pub/Sub. Pub/Sub is the only Cloud Logging sink destination that supports real-time streaming to external systems. A log sink with a Pub/Sub destination publishes log entries as messages to a topic, which a third-party SIEM can subscribe to via a pull or push subscription, enabling near-instant delivery. This is the standard pattern for exporting Cloud Audit Logs to external SIEMs.

Answer

BigQuery

Answer

Cloud Storage

Answer

Logging bucket

Question 12

A company uses Cloud KMS with a key purpose of ENCRYPT_DECRYPT. They want to rotate the key automatically every 90 days. What must the security engineer configure to achieve this?

Accepted Answer

Set the rotation period on the key to 7776000 seconds. To automatically rotate a Cloud KMS key every 90 days, you must set the rotation period on the key. The rotation period is specified in seconds, and 90 days equals 7,776,000 seconds (90 * 24 * 60 * 60). This configuration enables automatic rotation of the key material. The other options do not achieve automatic rotation: asymmetric keys cannot be rotated automatically, disabling versions does not rotate, and manual rotation is not automatic.

Answer

Use a key with ASYMMETRIC_SIGN purpose

Answer

Set the key version state to 'disabled' after 90 days

Answer

Manually rotate the key every 90 days using gcloud command

Question 13

A financial institution wants to encrypt data in Cloud Storage using keys that they rotate monthly through Cloud KMS. Which key management option should they use?

Accepted Answer

Customer-Managed Encryption Keys (CMEK). Customer-Managed Encryption Keys (CMEK) let the customer create, control, and rotate encryption keys in Cloud KMS while Google Cloud Storage uses those keys to encrypt data at rest. Because the customer owns the key lifecycle, they can enforce a monthly rotation schedule via Cloud KMS rotation policies. This satisfies both the encryption and the customer-controlled rotation requirements.

Answer

Google-managed encryption keys

Answer

Default encryption at rest

Answer

Customer-Supplied Encryption Keys (CSEK)

Question 14

A company is using Cloud Data Loss Prevention (DLP) to inspect and de-identify sensitive data in Cloud Storage. They want to classify data using infoTypes and apply de-identification techniques. Which TWO actions should they take?

Accepted Answer

Use the DLP API to inspect the storage for sensitive data.. The DLP API's `inspect` method is the primary mechanism to scan Cloud Storage objects for sensitive data patterns defined by infoTypes. Option C is correct because after inspection, de-identification transformations like masking or tokenization are applied via the DLP API's `deidentify` method to redact or replace sensitive content. Together, these two actions form the standard workflow for classifying and protecting data in Cloud Storage using Cloud DLP.

Answer

Create custom infoTypes for all sensitive data.

Answer

Store de-identification templates in Cloud KMS.

Answer

Use VPC Service Controls to restrict access to the data.

Question 15

A developer accidentally committed a file containing a service account key to a public GitHub repository. Which action should be taken immediately to invalidate the compromised key?

Accepted Answer

Disable the service account key using IAM.. Immediately disabling the service account key using IAM (Identity and Access Management) is the fastest way to revoke the compromised credential's access to Google Cloud resources. Disabling the key prevents any further use of that key for authentication, even if it is still present in the public repository. This action does not affect other keys or the service account itself, allowing the developer to later rotate or delete the key without disrupting existing workloads.

Answer

Delete the service account and create a new one.

Answer

Use Cloud DLP to find and redact the key.

Answer

Rotate the key using Cloud KMS.