PCSE Practice Test 21 — 15 Questions

Question 1

A user with this role tries to create a VM instance with a specific machine type and boot disk image. The creation fails due to missing permissions. Which permission is most likely missing?

Accepted Answer

compute.machineTypes.get. When creating a VM instance, the user must have permission to view the machine type definition to verify it exists and is available in the specified zone. The `compute.machineTypes.get` permission is required for this check, and without it, the creation fails even if other permissions are present. This is a prerequisite permission that the Compute Engine API checks before proceeding with instance provisioning.

Answer

compute.networks.use

Answer

compute.images.get

Answer

compute.instances.list

Question 2

Which TWO of the following are true regarding Cloud Identity and Access Management (IAM) conditions?

Accepted Answer

IAM conditions can restrict access based on the current date and time.. Option A is correct because IAM conditions support temporal attributes, including date/time restrictions, using the `request.time` attribute. This allows policies to grant access only during specific hours or days, such as allowing access only during business hours. The condition is expressed using the Common Expression Language (CEL) syntax, e.g., `request.time.getHours("America/New_York") >= 9 && request.time.getHours("America/New_York") <= 17`.

Answer

IAM conditions are supported for all Google Cloud resources.

Answer

IAM conditions can be applied to a role binding that supports all resources.

Answer

IAM conditions can restrict access based on the user's email domain.

Question 3

A security team wants to ensure that all service account key creation events in their organization are logged and alerted on. Which logging feature should they use?

Accepted Answer

Enable Admin Activity audit logs for the IAM service.. Admin Activity audit logs capture operations that modify the configuration or metadata of resources, such as creating or deleting service account keys. Since the question asks about logging key creation events, Admin Activity logs are the correct choice because they record all administrative actions, including service account key creation, by default and cannot be disabled. Data Access audit logs, by contrast, track data-level operations like reading or writing data, not administrative changes.

Answer

Enable System Event audit logs for the IAM service.

Answer

Enable Data Access audit logs for the IAM service.

Answer

Enable Access Transparency logs for the IAM service.

Question 4

A financial services company is required to retain audit logs for at least 7 years to comply with PCI-DSS. They have enabled Data Access audit logs for Cloud Audit Logs. However, after 6 months they notice that older logs are being automatically deleted. What is the most likely cause?

Accepted Answer

The default retention period for Cloud Audit Logs is 30 days, and logs are automatically deleted after that.. The default retention period for Cloud Audit Logs is 30 days. After this period, logs are automatically deleted unless a custom retention policy is configured or logs are exported to a long-term storage destination like Cloud Storage. Since the company enabled Data Access audit logs but did not adjust the retention setting, the logs older than 30 days are purged, explaining the 6-month observation.

Answer

The log sink exporting to Cloud Storage has been deleted.

Answer

The log sink filter is incorrectly excluding certain log entries.

Answer

An IAM policy has revoked the Logs Viewer role for the security team.

Question 5

A company is deploying a multi-region application in Cloud Run and must comply with data residency requirements in the European Union (EU). They want to ensure that only EU-based Cloud Run instances are created. Which approach should they use?

Accepted Answer

Set an Organization Policy with constraints/gcp.resourceLocations to restrict allowed regions to EU regions.. Option B is correct because Organization Policies with the `constraints/gcp.resourceLocations` constraint allow administrators to enforce a list of allowed Google Cloud regions for resource creation. By setting this policy to include only EU-based regions (e.g., `europe-west1`, `europe-west4`), the company ensures that Cloud Run instances cannot be created outside the EU, directly meeting data residency compliance requirements. This is a preventive control that applies at the project or folder level, overriding any developer choices.

Answer

Add a label to the Cloud Run service specifying the region and rely on developers to follow it.

Answer

Use VPC Service Controls to limit access to the Cloud Run service from outside the EU.

Answer

Configure VPC Firewall rules to only allow egress to EU IP addresses.

Question 6

Which TWO configurations are required to use Customer-Managed Encryption Keys (CMEK) with Cloud Storage to meet a compliance requirement that keys must be rotated every 30 days? (Choose two.)

Accepted Answer

Create a Cloud KMS key ring and key with a rotation period of 30 days.. Option C is correct because Cloud KMS allows you to set a rotation period on a key, and when you use a CMEK with Cloud Storage, the key is used to encrypt the data encryption keys (DEKs). Setting a rotation period of 30 days ensures that the key material is automatically rotated every 30 days, meeting the compliance requirement. Option E is correct because the Cloud Storage service account must be granted the Cloud KMS CryptoKey Encrypter/Decrypter role to be authorized to use the CMEK for encrypting and decrypting objects.

Answer

Set a key destruction policy to prevent accidental deletion of the key.

Answer

Use Cloud External Key Manager (EKM) to manage the key externally.

Answer

Use a Cloud HSM key with protection level HSM to meet key storage requirements.

Question 7

An organization uses Assured Workloads for Google Cloud to meet FedRAMP compliance. They have enabled Access Transparency logs. During an audit, they need to provide evidence that Google personnel access was logged and reviewed. What is the primary benefit of using Access Transparency?

Accepted Answer

It provides logs detailing the actions of Google personnel when accessing customer data.. Option D is correct because Access Transparency logs provide near-real-time logs of Google administrators' access to customer data. Option A is wrong because Access Transparency does not block access; it logs it. Option B is wrong because encryption is separate. Option C is wrong because VPC Service Controls, not Access Transparency, restrict data movement.

Answer

It blocks all Google personnel access to customer data.

Answer

It encrypts data with customer-managed keys.

Answer

It prevents data from being moved outside the organization's VPC.

Question 8

A company is deploying a new application that must comply with HIPAA. They are using Google Cloud services. Which TWO services are required to be enabled with appropriate configurations to support HIPAA compliance?

Accepted Answer

Cloud Key Management Service (KMS) with customer-managed keys (CMEK). Cloud Key Management Service (KMS) with customer-managed encryption keys (CMEK) is required for HIPAA compliance because it allows the customer to control the encryption keys used to protect protected health information (PHI) at rest. HIPAA mandates that covered entities implement mechanisms to encrypt and decrypt PHI, and using CMEK ensures the customer retains sole control over key material, which is a key requirement for meeting the Security Rule's addressable implementation specification for encryption.

Answer

Cloud Armor

Answer

Cloud Content Delivery Network (CDN)

Answer

Cloud Functions

Question 9

A multinational corporation must comply with GDPR and requires that data stored in BigQuery is physically located in the European Union. They have set up BigQuery datasets in the EU region. However, a compliance audit reveals that some queries may process data in the US region due to BigQuery's multi-region behavior. What should the organization do to ensure data remains in the EU?

Accepted Answer

Create BigQuery datasets in a specific European region (e.g., europe-west1) instead of the EU multi-region.. Option A is correct because creating a BigQuery dataset in a specific European region (e.g., europe-west1) ensures that all data storage and query processing are physically confined to that single region. In contrast, the EU multi-region (EU) is a geographic entity that includes multiple Google Cloud regions within the European Union, and BigQuery may process data in any of those regions, including potentially outside the EU if the multi-region expands. By using a specific regional dataset, the organization guarantees that data never leaves the designated European location, meeting GDPR's data residency requirements.

Answer

Use the EU multi-region dataset and configure VPC Service Controls to restrict access.

Answer

Enable BigQuery CMEK with keys stored in a European Cloud KMS key ring.

Answer

Use BigQuery reservations to guarantee that data processing happens in the EU.

Question 10

An organization wants to enforce that all new Cloud Storage buckets are created with uniform bucket-level access enabled to simplify access control and meet compliance requirements. What Google Cloud service should they use to enforce this?

Accepted Answer

Organization Policies. Organization Policies allow administrators to set constraints on Google Cloud resources at the organization, folder, or project level. The `constraints/storage.uniformBucketLevelAccess` constraint can be applied to enforce that all new Cloud Storage buckets are created with uniform bucket-level access enabled, simplifying access control and meeting compliance requirements.

Answer

VPC Service Controls

Answer

Cloud IAM

Answer

Cloud Armor

Question 11

Refer to the exhibit. A security engineer reviews this IAM policy. Which compliance requirement does this policy help satisfy?

Accepted Answer

Data residency by limiting access to European regions. The IAM policy includes a `Condition` block using `aws:RequestedRegion` to explicitly deny access to any AWS region outside of the specified European regions (eu-west-1, eu-central-1, etc.). This enforces data residency by ensuring that API calls that would create or modify resources are restricted to approved geographic boundaries, helping satisfy compliance requirements such as GDPR or local data sovereignty laws.

Answer

Key rotation schedule for encryption keys

Answer

Audit logging of data access

Answer

Encryption of data at rest

Question 12

A multi-national corporation must prevent data exfiltration from a project containing PII for GDPR compliance. They want to restrict access to only allow data transfer within the organization. Which Google Cloud service meets this requirement?

Accepted Answer

Create a VPC Service Control perimeter that includes the project and restricts access to other perimeters.. VPC Service Controls allow you to define perimeters that protect the resources and data of Google Cloud services. By creating a perimeter that includes the project containing PII, you can restrict data transfer to only within the organization, preventing exfiltration to external networks or unauthorized identities, which directly meets GDPR compliance requirements.

Answer

Use firewall rules to block all egress traffic except to approved IP ranges.

Answer

Set IAM policies to deny the storage.objectViewer role to non-compliant users.

Answer

Configure Cloud NAT for the VPC to route traffic through a single IP.

Question 13

A company uses Cloud Audit Logs for compliance. They want to capture all data access events to a Cloud Storage bucket containing sensitive data. What must they enable?

Accepted Answer

Data Access audit logs with a configuration to log all methods. Data Access audit logs record API calls that read or modify customer data, such as reading objects from a Cloud Storage bucket. To capture all data access events, including reads and writes, you must enable Data Access audit logs and configure them to log all methods (not just admin methods). This ensures compliance by recording every access to the sensitive data.

Answer

System Event audit logs

Answer

Admin Activity audit logs

Answer

Access Transparency logs

Question 14

A company must enforce that no data can be accessed from outside a specific set of Google Cloud projects. They want to ensure that only authorized services can communicate between projects. Which TWO controls should they implement? (Choose TWO.)

Accepted Answer

Access Context Manager. VPC Service Controls create a perimeter around resources, and Access Context Manager defines context-aware access policies based on attributes like IP range, device policy, etc.

Answer

Cloud Armor

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud NAT

Question 15

A gaming company must comply with the Children's Online Privacy Protection Act (COPPA). They use BigQuery to store user data, including age. They want to automatically classify and restrict access to data of users under 13. Which approach should they take?

Accepted Answer

Use DLP API to inspect BigQuery tables and apply de-identification or restriction policies.. Option A is correct because DLP API can classify sensitive data and set access controls accordingly. Option B is wrong because bucket-level policies apply to Cloud Storage, not BigQuery. Option C is wrong because VPC Service Controls do not inspect data content. Option D is wrong because Data Catalog does not enforce access; it only tags metadata.

Answer

Create a Cloud Data Catalog tag template for age and assign tags to columns, then use IAM to restrict access based on tags.

Answer

Store user data in Cloud Storage with uniform bucket-level access and use IAM to restrict access based on age.

Answer

Use VPC Service Controls to limit access to the BigQuery dataset from only approved IP ranges.

PCSE Practice Test 21 — 15 Questions

Exhibit

PCSE Practice Test 21 — 15 Questions

Exhibit