PCSE Practice Test 22 — 15 Questions

Question 1

An organization wants to restrict access to Google Cloud APIs such as BigQuery and Cloud Storage so that only resources within a specific VPC network can call these APIs, and no traffic from other VPCs or on-premises networks is allowed. Which Google Cloud service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VPC Service Controls. VPC Service Controls create service perimeters that restrict access to Google Cloud APIs based on the requesting network's context. This prevents data exfiltration and ensures only resources in the specified VPC can access the APIs.

Answer

Firewall Rules

Answer

Identity-Aware Proxy

Answer

Cloud Armor

Question 2

A security engineer needs to block traffic from all IP addresses in a specific geographic region from reaching an HTTPS load-balanced application. The application uses Cloud Load Balancing with an external HTTPS load balancer. Which approach should the engineer use?

Accepted Answer

Create a Cloud Armor security policy with a geo-based deny rule and attach it to the load balancer.. Cloud Armor security policies can be attached to external HTTPS load balancers to filter traffic based on geolocation. The engineer can create a Cloud Armor security policy with a rule that uses the geo-tag to deny traffic from the specified region.

Answer

Create a VPC firewall rule that denies ingress from the region's IP ranges.

Answer

Use Identity-Aware Proxy (IAP) to block access based on the user's location.

Answer

Configure a Cloud CDN policy to block traffic from certain regions.

Question 3

An engineer needs to ensure that only VMs with a specific service account (sa-prod@project.iam.gserviceaccount.com) can access a Cloud Spanner instance. They want to control this at the network level, not using IAM. Which VPC firewall rule configuration should they use?

Accepted Answer

Egress rule with target service account 'sa-prod'. Firewall rules can target service accounts for egress rules. Since the VMs initiate connections to Spanner, an egress rule with target service account is appropriate.

Answer

Egress rule with source service account 'sa-prod'

Answer

Ingress rule with target service account 'sa-prod'

Answer

Ingress rule with source tag 'sa-prod'

Question 4

An organization uses VPC Service Controls to protect BigQuery datasets. They need to allow a specific on-premises application, which uses a static IP address, to query a BigQuery dataset inside the service perimeter. Which configuration is required?

Accepted Answer

Create an ingress rule in the service perimeter with the on-premises IP as the source. VPC Service Controls allow ingress rules to permit traffic from specific IP ranges into a perimeter. By creating an ingress rule that allows the on-premises IP and specifies the BigQuery API, the on-premises application can access the dataset.

Answer

Create a Cloud Armor rule to allow the on-premises IP

Answer

Use Private Google Access for the on-premises network

Answer

Add the on-premises IP to an access level and create an egress rule

Question 5

A company wants to provide private connectivity from its on-premises network to Google Cloud APIs (e.g., BigQuery, Cloud Storage) without traversing the public internet. They have an existing Dedicated Interconnect connection. Which solution should they use?

Accepted Answer

Private Service Connect. Private Service Connect (PSC) allows private access to Google APIs via private endpoints using internal IP addresses. With Dedicated Interconnect, on-premises traffic can reach these endpoints without going over the internet.

Answer

Cloud NAT

Answer

Cloud VPN with VPC peering

Answer

VPC Service Controls

Question 6

A DevOps team wants to automatically provision and renew SSL certificates for a global HTTPS load balancer. Which certificate management option should be used?

Accepted Answer

Use Certificate Manager with a DNS authorization to create a Google-managed certificate.. Google-managed SSL certificates automatically provision and renew certificates for domains hosted on Google Cloud, ideal for load balancers without manual intervention.

Answer

Create a Google-managed certificate directly on the load balancer and configure a cron job to check renewal.

Answer

Use a third-party CA and upload the certificate with a longer validity.

Answer

Upload a self-managed certificate and configure a cron job to renew it.

Question 7

Your company uses Security Command Center (SCC) Standard tier and wants to detect threats like cryptocurrency mining or anomalous network behavior in real-time. You need to recommend an upgrade to SCC Premium tier and configure the appropriate module. Which SCC Premium module should be enabled?

Accepted Answer

Event Threat Detection. Event Threat Detection (ETD) monitors logs (e.g., Cloud Audit Logs, DNS, network) and uses machine learning to detect threats like cryptomining, C2 communication, and data exfiltration. It provides real-time detection and is a Premium tier feature.

Answer

Container Threat Detection

Answer

Web Security Scanner

Answer

Security Health Analytics

Question 8

A security team wants to detect and block network-based threats such as malware and command-and-control traffic within their VPC. They need a managed service that provides deep packet inspection. Which Google Cloud service should they use?

Accepted Answer

Cloud IDS. Cloud IDS (Intrusion Detection System) is a managed service that uses Palo Alto Networks threat detection to inspect network traffic for threats. It integrates with packet mirroring to analyze traffic.

Answer

Security Command Center

Answer

VPC Flow Logs

Answer

Cloud Armor

Question 9

A company wants to enforce that all BigQuery datasets are created in the 'US' multi-region to comply with data residency policies. Which organization policy constraint can achieve this?

Accepted Answer

gcp.resourceLocations. The 'gcp.resourceLocations' constraint restricts the locations where resources can be created. By setting the allowed locations to 'us' (or specific US regions), BigQuery datasets must be created in those locations. The other constraints: 'constraints/bigquery.restrictDatasetLocation' is not a valid organization policy. 'constraints/gcp.restrictNoncompliantResources' is not specific to locations. 'constraints/compute.trustedImageProjects' is for images.

Answer

constraints/gcp.restrictNoncompliantResources

Answer

constraints/compute.trustedImageProjects

Answer

constraints/bigquery.restrictDatasetLocation

Question 10

A company uses Cloud DLP to scan a BigQuery table containing customer data. They want to de-identify credit card numbers so that the first 12 digits are masked with 'X' and the last 4 digits remain visible. Which de-identification transform should they use?

Accepted Answer

MaskingConfig. MaskingConfig with a masking character 'X' and a character mask range from -12 to -1 (or similar) can achieve this. However, for consistent de-identification of credit card numbers, the CryptoReplaceFfxFpeConfig with an appropriate range might be used, but it preserves format. The direct mask is MaskingConfig. The correct answer is MaskingConfig as it allows masking specific character ranges. The other options: DateShiftConfig shifts dates, BucketingConfig groups values, and CryptoReplaceFfxFpeConfig preserves format but does not mask.

Answer

DateShiftConfig

Answer

BucketingConfig

Answer

CryptoReplaceFfxFpeConfig

Question 11

A company is using Cloud KMS with software keys for encryption. They want to increase security by using an HSM backend without changing their existing key rings or key names. Which TWO steps should they take? (Choose two.)

Accepted Answer

Create a new key version with the protection level set to HSM.. To switch a key from software to HSM backend, you need to create a new key version with the protection level HSM, and then update the key's default protection level to HSM so that future versions are also HSM-backed. You cannot change the protection level of an existing key version.

Answer

Create a new key ring and migrate all keys to it.

Answer

Change the protection level of the existing key version to HSM using the API.

Answer

Delete the existing software key versions and recreate them with HSM protection.

Question 12

A financial institution is required to store customer transaction data within the European Union to comply with GDPR data residency requirements. They want to prevent users from creating resources in any region outside the EU. Which organization policy constraint should they use?

Accepted Answer

constraints/gcp.resourceLocations. The organization policy constraint gcp.resourceLocations restricts the locations where Google Cloud resources can be created. By setting a list of allowed locations (e.g., europe-west1, europe-west4), resources cannot be created in non-EU regions.

Answer

constraints/compute.vmExternalIpAccess

Answer

constraints/iam.allowedPolicyMemberDomains

Answer

constraints/sql.restrictAuthorizedNetworks

Question 13

A company wants to use Cloud DLP to de-identify sensitive data in a BigQuery table. They need to replace credit card numbers with a token that preserves the format and also mask email addresses by showing only the first character. Which TWO de-identification transforms should they use? (Choose two.)

Accepted Answer

MaskingConfig. CryptoReplaceFfxFpeConfig performs format-preserving encryption, suitable for credit card numbers. MaskingConfig with a 'x' character can mask email addresses (e.g., first character visible).

Answer

DateShiftConfig

Answer

ReplaceValueConfig

Answer

BucketingConfig

Question 14

A company uses Cloud DLP to scan a BigQuery table for sensitive data. They want to automatically mask credit card numbers in query results for users who are not data stewards. Which approach should they use?

Accepted Answer

Create a BigQuery Data Policy with masking rules on the column and assign appropriate IAM roles. BigQuery column-level security with data masking rules (via BigQuery Data Policy) allows defining masking policies (e.g., email masking, hash masking) that are automatically applied to query results based on user IAM. DLP inspection can identify the sensitive columns, but the masking is enforced by BigQuery policies.

Answer

Enable Access Transparency to log queries and manually review

Answer

Use Cloud DLP de-identification jobs to replace credit card numbers with tokens in the source table

Answer

Use Cloud DLP inspect job and then manually apply a view that masks the column

Question 15

A security engineer needs to enforce that all new Compute Engine disks are created in a specific geographic region to meet data residency requirements. Which organization policy constraint should they use?

Accepted Answer

gcp.resourceLocations. The constraint 'gcp.resourceLocations' restricts where Google Cloud resources can be created. It can be set to a list of allowed locations. The other constraints: 'iam.allowedPolicyMemberDomains' restricts member domains, 'compute.skipDefaultNetworkCreation' prevents default network creation, 'constraints/compute.trustedImageProjects' restricts image projects.

Answer

constraints/compute.trustedImageProjects

Answer

compute.skipDefaultNetworkCreation

Answer

iam.allowedPolicyMemberDomains