PCSE Practice Test 24 — 15 Questions

Question 1

You have a Compute Engine VM that hosts a custom application. The VM has a tag 'app-server' and is in a VPC network with the following firewall rules (priority order from lowest to highest):

Rule 1: Priority 1000, direction INGRESS, source 0.0.0.0/0, target tag 'app-server', protocol tcp:80, action allow
Rule 2: Priority 500, direction INGRESS, source 10.0.0.0/8, target tag 'app-server', protocol tcp:80, action deny
Rule 3: Priority 2000, direction INGRESS, source 192.168.0.0/16, target tag 'app-server', protocol tcp:80, action allow

A user from IP 10.0.0.5 tries to access the application on port 80. Will the request be allowed or denied?

Accepted Answer

Denied, because Rule 2 has a lower priority number and explicitly denies traffic from 10.0.0.0/8. Rule 2 has a priority of 500, which is lower (higher priority) than Rule 1 (priority 1000) and Rule 3 (priority 2000). Since the source IP 10.0.0.5 falls within the 10.0.0.0/8 range, Rule 2 matches first and explicitly denies the traffic. In Google Cloud VPC firewall rules, lower priority numbers are evaluated first, and the first matching rule determines the action.

Answer

Denied, because Rule 3 has a higher priority number and denies traffic from 192.168.0.0/16

Answer

Allowed, because Rule 1 has a lower priority number and allows all traffic

Answer

Allowed, because Rule 3 has a higher priority number and allows traffic from 192.168.0.0/16

Question 2

An engineer wants to allow egress traffic from a group of VM instances with a specific service account to a set of IP addresses. They need to choose between using tags or service accounts as targets in a VPC firewall rule. Which approach is recommended for better security and why?

Accepted Answer

Use service accounts because they are managed by IAM and provide a stronger identity-based security model.. Service account targets are preferred because they are more secure. Tags can be added or removed by anyone with compute.instances.setTags permission, while service accounts are managed centrally with IAM. Using service accounts ensures that the firewall rule applies based on the identity of the VM, which is harder to spoof.

Answer

Use tags because they are easier to manage and provide the same level of security as service accounts.

Answer

Use target tags with a network tag that is automatically assigned by a management tool.

Answer

Either is acceptable; Google recommends using tags for simplicity.

Question 3

A security engineer is troubleshooting a VPC firewall rule that is not allowing traffic from a specific subnet to a Compute Engine instance. The target tag is set correctly. What is the most likely cause?

Accepted Answer

A deny rule with a higher priority (lower number) exists and blocks the traffic.. VPC firewall rules are evaluated by priority, where the lowest numeric value wins. If a deny rule with a lower priority number (higher precedence) exists and matches the traffic, it will block the traffic even if an allow rule also matches. This is the most likely cause when the target tag and source range are correct.

Answer

The firewall rule is in the wrong network.

Answer

The instance has an internal IP address that is not within the source range of the rule.

Answer

The firewall rule's target tag is misspelled.

Question 4

A company is using Cloud SQL with a private IP address in the same VPC as their Compute Engine web application server. The server can reach the Cloud SQL instance's IP address via ping, but the application is failing to connect with a permission error. The VPC firewall rules include the default allow internal rule. What is the most likely cause?

Accepted Answer

The Compute Engine server's service account does not have the Cloud SQL Client IAM role.. The default allow internal rule permits all protocols and ports, so network connectivity is fine. The permission error indicates insufficient IAM permissions. The Cloud SQL Client role is required for connecting to Cloud SQL instances via private IP.

Answer

The Cloud SQL instance's private IP address is not assigned to the correct subnetwork.

Answer

The firewall rules need an explicit allow rule for TCP port 3306 for the server's IP range.

Answer

The Cloud SQL instance requires the public IP address to be enabled for the application to connect.

Question 5

Your organization wants to monitor and audit IAM permission changes in real time. Which type of Cloud Audit Log is enabled by default and cannot be disabled?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs record API calls and administrative actions that modify the configuration or metadata of resources. They are enabled by default and cannot be disabled, making them ideal for monitoring IAM permission changes.

Answer

Data Access audit logs

Answer

System Event audit logs

Answer

Policy Denied audit logs

Question 6

Which Google Cloud compliance certification is most relevant for a company that processes credit card transactions and needs to demonstrate secure handling of cardholder data?

Accepted Answer

PCI DSS. PCI DSS (Payment Card Industry Data Security Standard) is specifically designed for organizations that handle credit card transactions, ensuring secure processing, storage, and transmission of cardholder data. It is the most relevant compliance certification for demonstrating secure handling of cardholder data on Google Cloud. SOC 2, ISO 27001, and FedRAMP are broader security frameworks but do not focus exclusively on payment card data.

Answer

SOC 2 Type II

Answer

ISO 27001

Answer

FedRAMP

Question 7

A security team needs to allow a third-party application running on AWS to access a Cloud Storage bucket without using service account keys. The application already uses AWS IAM roles. Which Google Cloud feature should they use?

Accepted Answer

Workload Identity Federation. Workload Identity Federation allows the AWS application to exchange its AWS IAM role credentials for Google Cloud temporary security tokens, enabling access to Cloud Storage without managing or storing service account keys. This is the correct approach because it directly addresses the requirement to avoid service account keys while leveraging the existing AWS IAM identity.

Answer

Secret Manager with a service account key

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud VPN

Question 8

A company uses Cloud Storage with CMEK. The Cloud KMS key is disabled accidentally by an administrator. What will happen to existing objects encrypted with that key?

Accepted Answer

Objects become inaccessible immediately.. When a Cloud KMS key used for CMEK is disabled, Cloud Storage immediately loses the ability to decrypt the encrypted object data and its associated metadata. Without the key, the service cannot serve the object, making it inaccessible for read, write, or delete operations until the key is re-enabled. This is because CMEK objects are encrypted at rest using the customer-managed key, and Cloud Storage does not maintain a cached copy of the key material.

Answer

Objects are automatically re-encrypted with Google-managed keys.

Answer

Objects remain accessible until the key is destroyed.

Answer

Objects become inaccessible after a 24-hour grace period.

Question 9

An organization has a hub-and-spoke VPC setup with Shared VPC. The security team wants to enforce a rule that all egress traffic from any project in the organization must pass through a central inspection appliance in the hub VPC. Which firewall configuration approach meets this requirement?

Accepted Answer

Set up a default route in each spoke VPC that sends egress traffic to the inspection appliance in the hub, and use firewall rules to allow only that traffic.. The correct approach is to set up a default route in each spoke VPC that sends egress traffic to the inspection appliance in the hub, and use firewall rules to allow only that traffic. This ensures all egress traffic is forced through the central inspection appliance, meeting the security requirement.

Answer

Use VPC firewall rules with a deny-all egress rule, then allow egress only from instances running in the hub VPC.

Answer

Configure private Google Access and VPC Service Controls to restrict egress.

Answer

Create a hierarchical firewall policy that denies all egress traffic unless it has a specific tag.

Question 10

Which TWO actions are required to meet FedRAMP Moderate baseline for Google Cloud?

Accepted Answer

Enable Multi-Factor Authentication (MFA) for all Google Cloud users with access to the project.. FedRAMP Moderate requires multi-factor authentication (MFA) for all users accessing the system, including Google Cloud users. Enabling MFA for all users with access to the project satisfies this control by adding an additional authentication factor beyond a password, as mandated by NIST SP 800-53 IA-2. Option C is correct because FedRAMP Moderate requires encryption at rest for all data, and using Customer-Managed Encryption Keys (CMEK) or Google-managed keys meets this requirement under NIST SP 800-53 SC-28.

Answer

Use Customer-Supplied Encryption Keys (CSEK) for all Cloud Storage buckets.

Answer

Enable Data Access audit logs for all Google Cloud services in the project.

Answer

Create VPC Service Controls perimeters to restrict data exfiltration.

Question 11

An organization uses Cloud DLP to scan a Cloud SQL database for PII. They want to automatically pseudonymize email addresses found in a specific column using a deterministic encryption that can be reversed for authorized users. The key must be stored in Cloud KMS. Which DLP transformation should they configure?

Accepted Answer

CryptoDeterministicConfig with a key from Cloud KMS.. CryptoDeterministicConfig performs deterministic encryption (same plaintext always produces the same ciphertext) using a key from Cloud KMS, which allows pseudonymization that can be reversed by authorized users. This matches the requirement for a reversible, deterministic transformation on email addresses in a Cloud SQL column.

Answer

CryptoHashConfig with a cryptographic key from Cloud KMS.

Answer

CryptoReplaceFfxFpeConfig using a key from Cloud KMS.

Answer

ReplaceWithInfoTypeConfig with a cryptographic key.

Question 12

An organization wants to encrypt data at rest using customer-managed keys on Compute Engine persistent disks. They need to provide the key material with each API call, and Google should never store the key. Which encryption approach should they use?

Accepted Answer

Customer-supplied encryption keys (CSEK). Customer-supplied encryption keys (CSEK) allow the customer to provide the encryption key with each API call, and Google does not store the key on its infrastructure. This matches the requirement that key material be supplied per API call and never retained by Google. CMEK, by contrast, stores the key in Cloud KMS, which Google manages.

Answer

Cloud HSM

Answer

Google-managed encryption keys (GMEK)

Answer

Customer-managed encryption keys (CMEK)

Question 13

A company uses VPC Service Controls to protect a BigQuery dataset. They need to allow an external on-premises application to query the dataset without being inside the service perimeter. The external application has a static IP address. Which configuration is required?

Accepted Answer

Add the external IP to an access level and configure an ingress rule in the service perimeter.. VPC Service Controls access levels can define IP-based conditions. By creating an ingress rule that allows traffic from the specified IP address to access the BigQuery API, the external application can be authorized.

Answer

Whitelist the external IP in the BigQuery dataset's IAM policy.

Answer

Create a Cloud VPN tunnel between the on-premises network and the VPC, and add the tunnel to the service perimeter.

Answer

Use Private Google Access on the VPC to allow on-premises traffic.

Question 14

Your company uses Security Command Center (SCC) Standard tier and wants to detect threats like cryptocurrency mining or anomalous network behavior in real-time. You need to recommend an upgrade to SCC Premium tier and configure the appropriate module. Which SCC Premium module should be enabled?

Accepted Answer

Event Threat Detection. Event Threat Detection (ETD) monitors logs (e.g., Cloud Audit Logs, DNS, network) and uses machine learning to detect threats like cryptomining, C2 communication, and data exfiltration. It provides real-time detection and is a Premium tier feature.

Answer

Container Threat Detection

Answer

Web Security Scanner

Answer

Security Health Analytics

Question 15

An organization is configuring a Cloud Storage bucket for a regulated workload. The bucket configuration shown in the exhibit was applied. Which compliance requirement is this configuration primarily designed to address?

Accepted Answer

Data retention and immutability.. The bucket configuration includes object versioning enabled and a retention policy with a retention period. This combination ensures that objects cannot be deleted or overwritten before the retention period expires, addressing data retention and immutability requirements. This is a common compliance need for regulated workloads where data must be preserved in its original state for a defined duration.

Answer

Encryption at rest using customer-managed encryption keys (CMEK).

Answer

Access transparency for data access.

Answer

Data residency within a specific geographic region.