PCSE Practice Test 24 — 15 Questions

Question 1

A company runs a Cloud SQL for PostgreSQL instance that stores customer data. They must encrypt the database at rest using customer-managed encryption keys (CMEK) to meet regulatory requirements. The instance is currently using Google-managed encryption. What must they do to implement CMEK? The company wants to minimize downtime and avoid data loss.

Accepted Answer

Create a new Cloud SQL instance with CMEK enabled, then export data from the old instance and import into the new one.. Option B is correct because Cloud SQL does not support enabling CMEK on an existing instance; you must create a new instance with CMEK enabled at provisioning time. Exporting data from the old instance and importing it into the new one ensures the database is re-encrypted under the customer-managed key with minimal downtime and no data loss, as the export/import process preserves the data.

Answer

Use the gcloud command to update the existing instance to use CMEK by specifying the key.

Answer

Configure Cloud External Key Manager (EKM) and attach it to the existing instance via a patch operation.

Answer

Implement client-side encryption in the application using a library like Tink and store the encrypted data in the existing database.

Question 2

You want to encrypt data in Google Cloud Storage using a key that is managed and stored in a third-party key management system outside of Google Cloud. Which feature should you use?

Accepted Answer

Cloud External Key Manager (Cloud EKM). Option A is correct: Cloud EKM allows you to use keys from an external key manager, keeping keys outside Google. Option B (CSEK) also uses external keys but is deprecated and less integrated. Option C (Cloud HSM) stores keys in Google. Option D (default) uses Google-managed keys.

Answer

Cloud HSM

Answer

Default encryption at rest

Answer

Customer-Supplied Encryption Keys (CSEK)

Question 3

A healthcare startup is building a data pipeline on Google Cloud. They receive patient data via a REST API running on Cloud Run. The data includes sensitive health information that must be de-identified before being stored in BigQuery. They plan to use Cloud DLP to inspect and transform the data. However, due to latency requirements, they need to de-identify the data within 5 seconds of receiving the request. They have set up a Cloud DLP job to inspect the data synchronously using the DLP API. During testing, they notice that the de-identification sometimes takes over 10 seconds, causing API timeouts. They want to reduce the latency without compromising security. What should they do?

Accepted Answer

Use Cloud DLP with a content item size limit and stored infoTypes to reduce inspection time.. Option B is correct because Cloud DLP synchronous inspection latency is directly proportional to the content size and the number of infoTypes scanned. By limiting the content item size (e.g., to 1 MB) and using stored infoTypes (which are pre-compiled for faster matching), you reduce the inspection time significantly, enabling de-identification within the 5-second window without compromising security.

Answer

Use a Cloud Function to process the data and call the DLP API.

Answer

Instead of using Cloud DLP, use BigQuery column-level security with data masking.

Answer

Configure a Cloud DLP job to run asynchronously and store results in BigQuery, then modified the pipeline to read the de-identified data later.

Question 4

Refer to the exhibit. An auditor notices this log entry. Which of the following is true about this event?

Accepted Answer

The service account has the Cloud KMS CryptoKey Decrypter role.. The log entry indicates a successful decryption operation ("decrypt" action with a success status). For a service account to successfully decrypt data using Cloud KMS, it must have the Cloud KMS CryptoKey Decrypter role (roles/cloudkms.cryptoKeyDecrypter) on the key. The log shows the caller is a service account, and the operation succeeded, confirming it has the necessary permissions. Option B correctly identifies this.

Answer

The decryption operation was performed on a key version that is disabled.

Answer

The decryption operation failed due to insufficient permissions.

Answer

The service account used is impersonating a user to decrypt data.

Question 5

A retail company hosts an e-commerce website on Compute Engine behind an HTTPS load balancer. They want to encrypt traffic between the load balancer and backend instances. What should they do?

Accepted Answer

Use an internal HTTPS load balancer and configure SSL certificates on backend services.. Option B is correct because an internal HTTPS load balancer in Google Cloud can terminate HTTPS from clients and re-encrypt traffic to backend instances using SSL certificates configured on the backend services. This ensures end-to-end encryption between the load balancer and backends, meeting the requirement to encrypt traffic in that segment.

Answer

Enable HTTPS only between clients and load balancer; backend traffic uses HTTP.

Answer

Apply Cloud Armor policy to enforce TLS between load balancer and backends.

Answer

Use Cloud VPN to connect load balancer to backend instances.

Question 6

A healthcare organization ingests patient data into Cloud Storage and then processes it with Dataflow. They need to de-identify sensitive fields like Social Security numbers before storing in BigQuery. Which approach should they use?

Accepted Answer

Use Cloud DLP to inspect and transform the data, then store the de-identified results in BigQuery.. Option B is correct because Cloud DLP inspection and transformation jobs can be integrated with BigQuery and Dataflow. Option A is wrong because BigQuery data masking only masks at query time, not at rest. Option C is wrong because Dataflow with custom code is more error-prone and harder to maintain. Option D is wrong because Cloud Data Catalog only catalogs but does not transform.

Answer

Use BigQuery column-level security with data masking.

Answer

Write custom Dataflow transformations using a Java SDK to redact SSNs.

Answer

Use Cloud Data Catalog to tag sensitive columns and rely on access control.

Question 7

A security engineer needs to restrict outbound traffic from a VPC to only allow specific external IP ranges. Which three components must be configured? (Choose three.)

Accepted Answer

Cloud NAT. To restrict outbound traffic, you need egress firewall rules (B). If instances have no public IP, they need Cloud NAT for internet access (A). To enforce granular filtering, traffic must be routed through a firewall appliance (D).

Answer

Private Google Access

Answer

Firewall rules on the instance OS

Question 8

A company wants to protect its HTTP(S) Load Balancer from common web attacks like SQL injection and cross-site scripting. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is the correct service because it provides web application firewall (WAF) capabilities that can inspect HTTP(S) traffic and filter out common web attacks such as SQL injection and cross-site scripting (XSS). It integrates directly with HTTP(S) Load Balancers to enforce security policies at the edge, blocking malicious requests before they reach backend instances.

Answer

Identity-Aware Proxy (IAP)

Answer

VPC Service Controls

Answer

Cloud CDN

Question 9

An organization uses Shared VPC to centrally manage network resources. They want to allow a service project to use its own firewall rules for certain instances. How should they configure the firewall rules?

Accepted Answer

Firewall rules can only be created in the host project. In Shared VPC, all firewall rules are created in the host project. Service projects cannot create firewall rules for the shared VPC network. Therefore, the only way is to create rules in the host project.

Answer

Create firewall rules in the service project with target tags

Answer

Create firewall rules in the host project with target tags for service project instances

Answer

Use hierarchical firewall policies

Question 10

A company is using VPC Service Controls to protect their Google Cloud Storage buckets. They want to allow a specific instance to access a bucket from within a VPC. What networking configuration is required?

Accepted Answer

Private Google Access must be enabled on the subnet. VPC Service Controls require Private Google Access to be enabled on the subnet so that the instance can access Google APIs using its internal IP address.

Answer

The instance must have a public IP

Answer

A VPC peering connection to Google services

Answer

A Cloud NAT gateway

Question 11

A company has multiple VPC networks that need to communicate privately. They are evaluating VPC peering and Shared VPC. Which statement correctly describes a limitation of VPC peering compared to Shared VPC?

Accepted Answer

VPC peering does not support transitive peering. VPC peering does not support transitive peering, meaning if networks A and B are peered, and A and C are peered, B cannot communicate with C through A. Shared VPC does not have this limitation.

Answer

VPC peering cannot route traffic to an on-premises network via VPN

Answer

VPC peering does not support firewall rules

Answer

VPC peering requires all networks to be in the same project

Question 12

A company is migrating workloads to Google Cloud and wants to ensure that their VPC network is secure by default. Which two best practices should they follow? (Choose two.)

Accepted Answer

Remove the default firewall rules that allow all egress. Option A is correct because the default VPC firewall rules include an egress rule that allows all outbound traffic (target: all instances, action: allow, protocol: all, destination: 0.0.0.0/0). Removing this default egress rule and replacing it with more restrictive outbound rules is a security best practice to prevent unauthorized data exfiltration and limit outbound connections to only necessary destinations. This aligns with the principle of least privilege for network traffic.

Answer

Use Shared VPC for all projects

Answer

Create a firewall rule to deny all ingress except specific ports

Answer

Enable VPC Flow Logs

Question 13

A user is unable to SSH into an instance that has the tag 'ssh-access' and an internal IP 10.0.0.2. The user's IP is 198.51.100.1. What is the most likely reason?

Accepted Answer

The user's IP is not in the allowed source range. The firewall rule only allows SSH from the source range 203.0.113.0/24. The user's IP (198.51.100.1) is not in that range, so the connection is denied.

Answer

The instance is not using the correct service account

Answer

The instance does not have an external IP

Answer

The firewall rule is disabled

Question 14

A security engineer needs to provide secure SSH access to a Compute Engine instance that has no external IP address. What is the recommended method?

Accepted Answer

Use Identity-Aware Proxy (IAP) TCP forwarding.. Option B is correct because IAP TCP forwarding allows SSH without external IP. Option A is wrong because Cloud NAT is for outbound internet, not inbound SSH. Option C is wrong because VPC peering is for VPC-to-VPC, not for a single instance. Option D is wrong because firewall rules alone cannot provide access if there is no external IP.

Answer

Set up VPC peering with the instance's VPC.

Answer

Create a Cloud NAT to allow inbound SSH.

Answer

Add a firewall rule allowing SSH from any IP.

Question 15

You are designing a network for a multi-tier application. The web tier must be accessible from the internet, while the application tier should only be accessible from the web tier. The database tier should only be accessible from the application tier. All tiers are in the same VPC. Which combination of firewall rules meets these requirements?

Accepted Answer

Create an ingress rule allowing traffic from 0.0.0.0/0 to instances with tag 'web', an ingress rule allowing traffic from instances with tag 'web' to instances with tag 'app', and an ingress rule allowing traffic from instances with tag 'app' to instances with tag 'db'.. Option C is correct because it uses VPC firewall tags to enforce least-privilege network segmentation: the web tier is exposed to the internet (0.0.0.0/0), the app tier only accepts traffic from web-tagged instances, and the database tier only accepts traffic from app-tagged instances. This matches the multi-tier access requirements without exposing internal tiers to the internet or to each other unnecessarily.

Answer

Create an ingress rule allowing traffic from the web tier subnet to the application tier subnet, and an ingress rule allowing traffic from the application tier subnet to database tier subnet.

Answer

Assign each tier a unique service account and create ingress rules allowing traffic from the appropriate service accounts.

Answer

Create a single ingress rule that allows all traffic within the VPC network and a separate rule to allow internet traffic to web tier.