PCSE Practice Test 24 — 15 Questions

Question 1

A company must comply with regulatory requirements that restrict data access by Google Cloud support and engineering staff. They need to log all Google admin access to their data and also require explicit approval before access is granted. Which TWO features should they combine? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Access Approval. Access Transparency provides logs of Google admin access to customer content. Access Approval allows customers to approve or deny Google support access requests. Together, they satisfy the requirement for logging and approval. The other options: Audit Logs record customer project actions, not Google admin access. Data Loss Prevention is for data inspection. VPC Service Controls are for network perimeters.

Answer

Data Loss Prevention

Answer

VPC Service Controls

Answer

Audit Logs

Question 2

An organization needs to store API keys and database credentials in a secure, centralized service that supports automatic rotation and integrates with Cloud Functions. The solution must provide fine-grained access control at the secret version level. Which service should they use?

Accepted Answer

Secret Manager. Secret Manager is designed for storing secrets such as API keys and database credentials. It supports versioning, IAM roles with fine-grained access (e.g., secretmanager.versions.access), and automatic rotation via Pub/Sub notifications triggering Cloud Functions.

Answer

Cloud Key Management Service (Cloud KMS)

Answer

Cloud Storage with customer-managed encryption keys

Answer

Cloud HSM

Question 3

A company uses Cloud KMS to manage encryption keys for data at rest. They want to automatically rotate a symmetric key every 90 days. The key is used to encrypt Cloud Storage objects and BigQuery tables. What is the correct approach to achieve automatic rotation?

Accepted Answer

Set the rotation period on the key to 90 days and ensure the key purpose is ENCRYPT_DECRYPT.. In Cloud KMS, you can set a rotation period on a key. Automatic rotation creates a new key version at the specified interval. The key must have purpose ENCRYPT_DECRYPT for symmetric encryption. Manual rotation is not automatic, and setting a rotation period on key rings is not possible.

Answer

Use a Cloud Function to rotate the key every 90 days via the Cloud KMS API.

Answer

Create a Cloud Scheduler job to manually rotate the key every 90 days.

Answer

Set the rotation period on the key ring to 90 days.

Question 4

An organization needs to de-identify a BigQuery column containing US Social Security Numbers (SSNs) by replacing them with a consistent token that can be reversed if needed. Which Cloud DLP de-identification transform should they use?

Accepted Answer

CryptoReplaceFfxFpeConfig. CryptoReplaceFfxFpeConfig uses Format-Preserving Encryption (FPE) to replace sensitive data with a token that preserves the original format (e.g., 9 digits) and is reversible with the same key. BucketingConfig replaces with a range, MaskingConfig masks characters, and DateShiftConfig shifts dates.

Answer

BucketingConfig

Answer

MaskingConfig

Answer

DateShiftConfig

Question 5

An engineer needs to configure automatic key rotation for a symmetric encryption key in Cloud KMS. They have set the rotation period to 90 days. What happens to the old key material after rotation?

Accepted Answer

The old key version remains enabled and can still be used for decryption.. When a key is rotated, a new key version is created and becomes the primary. The old version is retained and remains available for decrypting data encrypted with it. Key material is not automatically deleted; it can be disabled or scheduled for destruction separately.

Answer

The old key version is disabled and can be re-enabled if needed.

Answer

The old key material is immediately deleted.

Answer

The old key material is moved to a pending destruction state for 24 hours.

Question 6

A security engineer needs to implement de-identification of sensitive data in a Cloud Storage bucket using Cloud DLP. They want to inspect the data for credit card numbers and then replace them with a tokenized value that preserves the format for downstream processing. Which TWO actions should they take? (Choose two.)

Accepted Answer

Configure an inspection job with the built-in CREDIT_CARD_NUMBER infoType. To de-identify credit card numbers while preserving format, the engineer should use a DLP inspection job first to identify the sensitive data, then apply a de-identification transform using CryptoReplaceFfxFpeConfig which replaces the data with a token that preserves the format. The other options: BucketingConfig groups values, DateShiftConfig shifts dates, and using a custom infoType is not necessary if the built-in CREDIT_CARD_NUMBER works.

Answer

Use the DateShiftConfig de-identification transform

Answer

Create a custom infoType for credit card numbers

Answer

Use the BucketingConfig de-identification transform

Question 7

A company needs to enforce that all data stored in Cloud Storage and BigQuery is encrypted with customer-managed keys (CMEK). Which TWO actions should they take? (Choose two.)

Accepted Answer

Set the organization policy constraint 'constraints/gcp.cmeKRequired' for Cloud Storage and BigQuery.. To enforce CMEK, a CMEK key must be created in Cloud KMS and then configured on the resources (buckets, datasets). An organization policy can also be set to require CMEK for certain services. Creating a Cloud HSM key is a type of CMEK but is not specifically required.

Answer

Enable Access Transparency logs.

Answer

Create a Cloud HSM key to ensure FIPS 140-2 Level 3 compliance.

Answer

Use Cloud DLP to inspect and classify data.

Question 8

A company needs to isolate development and production workloads within the same Google Cloud organization. Each environment must have its own VPC network, but they must share a common set of network security policies. Which design meets these requirements?

Accepted Answer

Use Shared VPC with separate service projects for dev and prod. Shared VPC allows development and production workloads to operate in separate service projects while attaching to a common host VPC. This provides network isolation (each environment has its own VPC network in its service project) while enforcing a unified set of security policies at the host VPC level, meeting the requirement for both isolation and shared policies. Option A is incorrect: VPC Network Peering connects two separate VPCs but does not centralize policy management; each project retains independent firewall rules and security policies. Option C is incorrect: creating separate VPCs within the same project does not provide the project-level isolation often required for dev/prod separation, and VPC peering alone does not enforce common security policies. Option D is incorrect: a single VPC with multiple subnets and firewall rules does not isolate workloads at the VPC level; the same firewall rules apply to the entire VPC, and subnet-level isolation is limited, failing to meet the requirement for separate VPC networks.

Answer

Create separate projects and use VPC Network Peering between them

Answer

Create separate VPCs in the same project and use VPC peering

Answer

Use a single VPC with multiple subnets and strict firewall rules

Question 9

An organization wants to use Chronicle for SIEM. They need to ingest logs from an on-premises firewall. Which method should they use?

Accepted Answer

Use a forwarder (e.g., Syslog to UDM) to send logs to Chronicle. Chronicle provides forwarders (e.g., Syslog, Winlogbeat) that parse and send logs to the Chronicle backend.

Answer

Configure a log sink from Cloud Logging to Chronicle

Answer

Export logs to Cloud Storage and have Chronicle import them

Answer

Directly send logs to a Pub/Sub topic that is ingested by Chronicle

Question 10

A security engineer needs to ensure that all Google Cloud API calls in the organization are logged and retained for 7 years for compliance. Admin Activity logs are enabled by default but retention is limited. Which combination of actions should the engineer take?

Accepted Answer

Create a log sink with _Required log view filter to export Admin Activity logs to Cloud Storage with a retention policy of 7 years.. Admin Activity logs are enabled by default but cannot be retained beyond the default period (400 days for audit logs). To retain for 7 years, you must use a log sink to export them to Cloud Storage (which can be configured with retention policies). BigQuery is for analysis, not archival. The default retention cannot be changed.

Answer

Create a log sink to export Admin Activity logs to BigQuery and set the table expiration to 7 years.

Answer

Enable Data Access logs for all services and set a custom retention period of 7 years on the log bucket.

Answer

Enable the 'Admin Activity logs' retention to 7 years in the Logging settings.

Question 11

A company wants to implement a vulnerability management program for their Google Cloud environment. They need to scan Compute Engine instances for OS vulnerabilities and container images for known vulnerabilities. Which two services should they use? (Choose two.)

Accepted Answer

VM Manager (OS patch assessment). VM Manager patch management can assess and patch OS vulnerabilities on Compute Engine instances. Container Analysis (Artifact Registry) scans container images for vulnerabilities. Web Security Scanner is for web apps. Binary Authorization is for attestation. Cloud Security Scanner does not exist.

Answer

Cloud Security Scanner

Answer

Binary Authorization

Answer

Web Security Scanner

Question 12

A company is using Security Command Center (SCC) Standard tier and wants to detect threats like crypto mining attacks and anomalous IAM activity in their GCP environment. Which built-in service should they enable?

Accepted Answer

Event Threat Detection. Event Threat Detection is a premium tier service that detects threats such as crypto mining and suspicious IAM activity. Security Health Analytics is misconfigurations. Web Security Scanner is for web apps. VM Threat Detection is also premium but for VMs.

Answer

Security Health Analytics

Answer

Web Security Scanner

Answer

VM Threat Detection

Question 13

A security analyst needs to investigate a potential breach in a Compute Engine instance. They want to create an offline forensic copy of the disk without affecting the running instance. Which action should they take?

Accepted Answer

Stop the instance and create a snapshot of the boot disk.. Creating a snapshot is the correct method to create a point-in-time copy of a persistent disk for forensic analysis. The snapshot can be used to create a new disk for analysis. Stopping or creating an image modifies the instance state or does not preserve all data.

Answer

Create an image from the disk while the instance is running.

Answer

Use the gcloud compute disks copy command to replicate the disk.

Answer

Attach a new blank disk to the instance and use dd to clone the data.

Question 14

A security team wants to use Web Security Scanner to find vulnerabilities in their web application hosted on Compute Engine. They need to scan the public-facing URL weekly and receive a report of findings. Which configuration is required?

Accepted Answer

Create a managed scan in Security Command Center with the target URL and schedule. Web Security Scanner requires a managed scan target (URL) to be configured. Scans can be scheduled. It does not require an App Engine or GKE; it can scan any public URL. The scan is managed by Google Cloud and reports findings to SCC.

Answer

Install the Web Security Scanner agent on the VM

Answer

Use gcloud compute instances scan command

Answer

Deploy the application to App Engine, then enable Web Security Scanner

Question 15

An organization uses Security Command Center Premium tier. They want to receive notifications when a finding of type 'Cryptomining' is detected in their Compute Engine instances. What should they configure?

Accepted Answer

Event Threat Detection and a Pub/Sub notification config. Event Threat Detection (Premium) detects cryptomining. You set up a notification config in SCC to send findings of that type to Pub/Sub.

Answer

Container Threat Detection and an email alert

Answer

Security Health Analytics and a Cloud Storage bucket

Answer

Web Security Scanner and a Cloud Function