PCSE Practice Test 22 — 15 Questions

Question 1

During a security incident, a security engineer needs to revoke a compromised service account's access across all resources immediately. However, the service account has many roles across different projects. What is the most effective immediate step?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable the service account.. Disabling the service account immediately revokes all access because it invalidates the service account's credentials and prevents any new token generation. This is the most effective step to cut off access across all resources without having to track down and remove every IAM policy binding. Disabling the service account key only affects a specific key, and deleting the service account might be slower and could leave dangling references.

Answer

Remove all IAM policies that include the service account.

Answer

Disable the service account key.

Answer

Delete the service account from the project.

Question 2

Match each Google Cloud security tool to its primary purpose.

Accepted Answer

Cloud IAM: Manage access control by defining who has what access to resources.. Cloud IAM controls access, Security Command Center detects threats, and Cloud DLP protects sensitive data. Confusions often arise between these tools due to overlapping security contexts.

Answer

Cloud IAM: Protect applications from DDoS attacks.

Answer

Cloud Security Command Center: Manage access control.

Answer

Cloud DLP: Detect and respond to threats.

Question 3

Match each Cloud KMS key purpose to its description.

Accepted Answer

Symmetric encryption key: Used for encrypting and decrypting data with the same key.. Cloud KMS key purposes include symmetric encryption (same key for encrypt/decrypt), asymmetric signing (private key to sign, public key to verify), and MAC (key for message authentication). Common confusions involve mixing symmetric and asymmetric operations.

Answer

Symmetric encryption key: Used for signing messages with a private key.

Answer

Asymmetric signing key: Used for encrypting data with the same key.

Answer

MAC key: Used for encrypting small amounts of data.

Question 4

A government agency requires FedRAMP High compliance for their Google Cloud deployment. Which service should they use to create a compliant environment with pre-configured controls?

Accepted Answer

Assured Workloads. Assured Workloads is the correct service because it enables customers to create a Google Cloud environment that is pre-configured to meet specific compliance requirements, including FedRAMP High. It automatically applies a set of controls (e.g., data residency, encryption key management, and access restrictions) based on the chosen compliance regime, reducing the manual effort needed to achieve and maintain certification.

Answer

Cloud HSM

Answer

VPC Service Controls

Answer

Security Command Center

Question 5

A company uses Cloud Functions to process employee data and wants to ensure that personally identifiable information (PII) is redacted from log output. Which approach should they take?

Accepted Answer

Use Cloud DLP API to inspect and redact the log message before writing to Cloud Logging.. The Cloud DLP API can be integrated directly into a Cloud Function to inspect and redact PII from log messages before they are written to Cloud Logging. This ensures that sensitive data never appears in the logs, which is the most secure approach. Using Cloud DLP at the point of log generation prevents any exposure, rather than relying on post-hoc analysis or filtering.

Answer

Use Cloud Audit Logs to capture all access and redact at analysis.

Answer

Create a Logging sink with an exclusion filter to drop logs containing PII.

Answer

Enable VPC Service Controls to prevent PII from leaving the VPC.

Question 6

A startup company has a single Google Cloud project with multiple developers. To simplify identity management, they created a service account for each developer and granted them the roles/editor role on the project. However, the security team is concerned about the over-privileged access. They want to implement a more secure approach while maintaining operational efficiency. The developers need to: create Compute Engine instances, manage Cloud Storage buckets, and deploy App Engine apps. The company has a small team and does not require fine-grained access control per developer. What is the recommended approach to reduce privileges while meeting the developers' needs?

Accepted Answer

Remove the editor role, create a custom role with the required permissions, and assign the custom role to a Google Group containing all developers.. It removes the overly permissive Editor role and replaces it with a custom role containing only the specific permissions needed for Compute Engine, Cloud Storage, and App Engine. Assigning this custom role to a Google Group that contains all developers simplifies identity management and ensures consistent, least-privilege access without per-user assignment overhead.

Answer

Remove the editor role and grant each developer the roles/owner role on the project.

Answer

Remove the editor role and create a custom role with the required permissions, then assign the custom role to each developer individually.

Answer

Remove the editor role and grant each developer the roles/iam.securityReviewer role.

Question 7

A company wants to implement workload identity federation for a GitHub Actions workflow, allowing it to access Google Cloud resources without using service account keys. Which three steps are required? (Choose three.)

Accepted Answer

Create a service account in GCP and grant it the necessary roles.. Option C is correct because workload identity federation still requires a Google Cloud service account to be impersonated; you create it and grant it the IAM roles needed to access the target resources. Option D is correct because you must create a workload identity pool and an OIDC provider configured for GitHub's token issuer (https://token.actions.githubusercontent.com) so Google Cloud can trust GitHub-issued tokens. Option E is correct because the GitHub Actions workflow must request an OIDC token (via permissions: id-token: write) and use google-github-actions/auth to exchange it against the workload identity provider, obtaining short-lived credentials. Option A is not correct as written: the roles/iam.workloadIdentityUser role is granted to the external principal (the GitHub repo/branch, i.e., principalSet) on the service account, not to the service account on the pool. Option B is not correct because generating a JSON service account key and storing it as a GitHub secret is exactly the key-based approach that workload identity federation is meant to eliminate.

Answer

Grant the service account the roles/iam.workloadIdentityUser role on the workload identity pool.

Answer

Generate a JSON key for the service account and store it as a GitHub secret.

Question 8

A security administrator needs to ensure that all service account keys older than 90 days are automatically disabled to reduce the risk of key compromise. Which Google Cloud service should be used to implement this policy?

Accepted Answer

Organization Policy Service. Organization Policy Service allows administrators to set organization-wide policies, such as disabling service account key creation or setting key age constraints. Option A (Cloud Secret Manager) is incorrect because it is used for managing secrets like API keys, not service account keys. Option C (Cloud IAM) is incorrect because while IAM manages service account permissions, it does not provide lifecycle policies for keys. Option D (Cloud Key Management Service) is incorrect because it manages encryption keys, not service account keys.

Answer

Cloud Secret Manager

Answer

Cloud IAM

Answer

Cloud Key Management Service

Question 9

A DevOps engineer wants to allow a CI/CD pipeline running in GitHub Actions to deploy resources to a Google Cloud project without using long-lived service account keys. What should the engineer implement?

Accepted Answer

Configure Workload Identity Federation between GitHub and the service account.. Workload Identity Federation allows GitHub Actions to exchange OpenID Connect (OIDC) tokens for Google Cloud temporary credentials, eliminating the need for long-lived service account keys. This approach follows Google's security best practices by using short-lived, automatically rotated tokens and avoids the risk of key exposure in repository secrets.

Answer

Use a Cloud Functions HTTP trigger called from GitHub Actions.

Answer

Create a service account and distribute its JSON key to the GitHub repository secrets.

Answer

Enable Cloud Build triggers that watch the GitHub repository.

Question 10

A financial institution is deploying a payment application on GKE that must comply with PCI DSS. They need to isolate the cardholder data environment (CDE) from other workloads and ensure only authorized services can communicate. Which combination of controls should they implement?

Accepted Answer

Use a separate VPC and VPC Service Controls perimeter for the CDE, and apply Kubernetes Network Policies to restrict pod communication.. Isolating the CDE requires network-level segmentation and identity-aware perimeter controls. A separate VPC provides network isolation, VPC Service Controls creates a perimeter that prevents data exfiltration and restricts API access to authorized projects, and Kubernetes Network Policies enforce pod-to-pod communication rules inside GKE. Together these satisfy PCI DSS requirements for segmentation and least-privilege communication.

Answer

Use Cloud Armor to inspect all traffic and block non-compliant requests.

Answer

Enable Data Loss Prevention to scan payment data and restrict access.

Answer

Deploy the CDE in a separate project and use IAM roles to restrict access.

Question 11

Your organization wants to use Chronicle SIEM to analyze security events from both Google Cloud and on-premises firewalls. They want to normalize firewall logs into a common schema. Which Chronicle feature should they use?

Accepted Answer

Unified Data Model (UDM). The Unified Data Model (UDM) is Chronicle's common schema that normalizes logs from diverse sources, including Google Cloud and on-premises firewalls, into a consistent format for analysis. By mapping raw logs to UDM fields, Chronicle enables correlation and search across heterogeneous data. This is exactly the feature required to normalize firewall logs into a common schema.

Answer

Log forwarder

Answer

Investigation timeline

Answer

YARA-L rules

Question 12

A company wants to implement a zero-trust access model for SSH access to Compute Engine instances. They need to ensure that only authorized users can connect and that all connections are logged. Which two services should they use? (Choose TWO.)

Accepted Answer

Identity-Aware Proxy (IAP). Identity-Aware Proxy (IAP) is correct because it enforces zero-trust access to Compute Engine instances by authenticating and authorizing users through Google identities and IAM before allowing SSH connections via TCP forwarding, without requiring external IP addresses or a VPN. Cloud Audit Logs is correct because it records administrative and data access activity, including IAP TCP tunneling and SSH session events, providing the required logging and audit trail for all connections. Cloud NAT is not correct because it only provides outbound internet access for instances without external IPs and does not authenticate or log SSH user access. Cloud Shell is not correct because it is an interactive command-line environment, not an access-control or logging service for SSH to Compute Engine. Cloud VPN is not correct because it provides encrypted network connectivity between networks, not identity-based zero-trust authorization or per-user SSH logging.

Answer

Cloud NAT

Answer

Cloud Shell

Answer

Cloud VPN

Question 13

An organization uses Chronicle SIEM to ingest logs from multiple GCP projects and on-premises firewalls. They need to write a detection rule that triggers when an IP address makes more than 100 failed login attempts across different GCP projects within 10 minutes. Which Chronicle feature should they use?

Accepted Answer

YARA-L detection rule. YARA-L is Chronicle SIEM's detection rule language, purpose-built for writing multi-event correlation rules across the Unified Data Model. It supports aggregations, time windows, and cross-source joins — exactly what's needed to detect more than 100 failed logins from one IP across multiple GCP projects within a 10-minute window. A YARA-L rule can express the match condition, the 10-minute window, and the threshold in a single rule that fires a detection.

Answer

Dashboard and alerting

Answer

Reference list

Answer

Unified Data Model (UDM)

Question 14

A large enterprise runs analytics workloads on BigQuery containing sensitive financial data. They have implemented VPC Service Controls (VPC SC) to create a perimeter around the BigQuery dataset, allowing access only from a specific VPC network. Despite this, security auditors discovered that data was accessed from an IP address outside the perimeter. After investigation, they found the access originated from a user's personal laptop using the Google Cloud Console. The company's security policy requires that sensitive data can only be accessed from corporate-managed devices. What should they do to prevent this type of access?

Accepted Answer

Add a context-aware access level to the VPC Service perimeter that requires a corporate device policy (e.g., OS version, disk encryption).. VPC Service Controls can integrate with Access Context Manager to enforce context-aware access levels. By adding a level that requires a corporate device policy (e.g., verified OS version, disk encryption status), access from unmanaged personal laptops is blocked at the perimeter boundary, even if the user is authenticated. This directly addresses the security policy requirement that sensitive data must only be accessible from corporate-managed devices.

Answer

Enable Cloud Data Loss Prevention (DLP) to automatically redact sensitive data before it is displayed in the console.

Answer

Reconfigure the VPC Service perimeter to use a more restrictive set of allowed IP ranges.

Answer

Activate Access Transparency logs and create a log-based alert to notify security of anomalous access.

Question 15

A company is using Assured Workloads to enforce FEDRAMP_HIGH compliance. They need to ensure that only US-based personnel from Google can access their data. Which configuration setting within the Assured Workloads folder should they enable?

Accepted Answer

Google personnel access restrictions. Google personnel access restrictions is the Assured Workloads control specifically designed to limit access to customer data by Google personnel to those located in the compliance regime's required geography (e.g., US persons for FEDRAMP_HIGH). Enabling it ensures that only US-based Google support and operations staff can access the data, satisfying the personnel residency requirement. This control is part of the Assured Workloads folder configuration and is required for certain regimes like FEDRAMP_HIGH and ITAR.

Answer

Access Transparency logs

Answer

Resource location restrictions

Answer

Key Access Justification (KAJ) logs