PCSE Practice Test 25 — 15 Questions

Question 1

Your organization wants to use Chronicle SIEM to analyze security events from both Google Cloud and on-premises firewalls. They want to normalize firewall logs into a common schema. Which Chronicle feature should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Unified Data Model (UDM). Chronicle's Unified Data Model (UDM) normalizes logs from different sources into a common schema, making it easier to search and analyze. Forwarders can send logs, but normalization is done via UDM parsing.

Answer

Log forwarder

Answer

Investigation timeline

Answer

YARA-L rules

Question 2

A company wants to receive real-time notifications when Security Command Center (SCC) detects a high-severity vulnerability in their Google Cloud projects. They need to integrate with their existing SIEM. Which approach should they use?

Accepted Answer

Create a Pub/Sub notification config in SCC for the desired finding types and have the SIEM subscribe to the Pub/Sub topic.. SCC findings can be exported to Pub/Sub for real-time integration. The SIEM can subscribe to the Pub/Sub topic. Cloud Logging can also be used but SCC does not directly write findings to Logging. Cloud Functions alone would require Pub/Sub as trigger.

Answer

Use the SCC API to poll for new findings every minute and push them to the SIEM via a custom script.

Answer

Enable Event Threat Detection in SCC Premium tier and configure it to stream findings to Cloud Logging via a log sink.

Answer

Configure SCC to send findings to Cloud Logging and set up a log-based metric that triggers a Cloud Function to send to the SIEM.

Question 3

A financial services company uses Security Command Center (SCC) Premium tier to monitor its GCP environment. The security team wants to automatically respond to high-severity threat findings, such as 'Cryptomining' from Event Threat Detection. The response should include isolating the affected VM by removing its external IP and applying a firewall rule to block egress traffic. Which two steps should the team implement? (Choose two.)

Accepted Answer

Deploy a Cloud Function that listens on the Pub/Sub topic and uses Compute Engine API to modify the VM's network tags and update firewall rules. SCC can be integrated with Pub/Sub to send real-time notifications for findings, and Cloud Functions can execute automated remediation actions like modifying VM network tags or applying firewall rules.

Answer

Create a Security Health Analytics scan to detect similar threats

Answer

Set up a log sink to export Admin Activity logs to BigQuery

Answer

Enable VPC Flow Logs for the affected VM's subnet

Question 4

A company using BigQuery for analytics needs to comply with the right to be forgotten (erasure) under GDPR. A data subject requests deletion of their personal data. What is the correct approach to delete data from BigQuery audit logs that contain the data subject's information?

Accepted Answer

Export audit logs to Cloud Storage and configure a log sink to filter out or redact personal data before it is stored.. BigQuery audit logs are immutable and cannot be deleted individually. The recommended approach is to export logs to Cloud Storage and use log sinks to filter out or redact personal data before storage.

Answer

Use Cloud DLP to scan and redact the audit logs in place within BigQuery.

Answer

Use a DELETE statement on the audit logs table in BigQuery to remove the records.

Answer

Set a table expiration on the audit logs dataset to delete all logs after a short period.

Question 5

A company needs to archive Cloud Audit Logs for compliance purposes for 7 years. The logs are rarely accessed after the first year. Which storage option is the most cost-effective?

Accepted Answer

Export logs to Cloud Storage with Archive storage class. Cloud Storage offers Archive class for long-term, low-cost storage. BigQuery is for analysis, not archival. Pub/Sub is for streaming. Cloud Storage is the right choice; Archive class is cheaper than Nearline or Coldline.

Answer

Export logs to Cloud Storage with Standard storage class

Answer

Export logs to BigQuery dataset

Answer

Export logs to Pub/Sub topic

Question 6

A security analyst wants to search for a specific IAM role change across all projects in the organization. Which tool can query Cloud Audit Logs across projects?

Accepted Answer

Cloud Logging Logs Explorer with a query that includes all projects in the organization. Logs Explorer allows querying logs across projects via resource scope, provided the user has the appropriate permissions.

Answer

Cloud Shell with gcloud logging read

Answer

Activity page in the Cloud Console (Home > Activity)

Answer

Cloud Monitoring dashboard

Question 7

An organization uses Chronicle SIEM to ingest logs from multiple GCP projects and on-premises firewalls. They need to write a detection rule that triggers when an IP address makes more than 100 failed login attempts across different GCP projects within 10 minutes. Which Chronicle feature should they use?

Accepted Answer

YARA-L detection rule. YARA-L is the detection language for Chronicle. It allows multi-event correlation across data sources, including timestamps and grouping by source IP. UDM is the data model. Dashboards are visual. Reference lists are for static data.

Answer

Dashboard and alerting

Answer

Reference list

Answer

Unified Data Model (UDM)

Question 8

During a forensic investigation, you need to analyze a Compute Engine instance that has been compromised. You want to preserve the disk state for analysis without affecting the running instance. Which action should you take?

Accepted Answer

Create a snapshot of the persistent disk and attach the snapshot to a new instance for analysis.. Creating a snapshot is the non-disruptive, best practice for forensic preservation.

Answer

Delete the instance but keep the disk, then attach the disk to a new instance.

Answer

Stop the instance and create a custom image from the boot disk.

Answer

Use gcloud compute disks export to export the disk to Cloud Storage.

Question 9

A company is subject to SOC 2 compliance and wants to demonstrate that they have implemented proper access controls on Google Cloud. Which TWO IAM best practices should they follow? (Choose two.)

Accepted Answer

Enable multi-factor authentication for all users.. SOC 2 requires access controls. The principle of least privilege (granting minimal permissions) and enabling multi-factor authentication (MFA) are key IAM best practices. Using predefined roles is not always best; custom roles may be needed. Service accounts are for applications, not user access. Cloud Audit Logs track access but are not an IAM best practice per se.

Answer

Use only predefined roles to ensure consistency.

Answer

Enable Cloud Audit Logs to monitor access.

Answer

Use service accounts for human user access.

Question 10

A security team wants to scan a web application hosted on Compute Engine for vulnerabilities like XSS and outdated libraries. They want the scan to be authenticated to cover areas behind login. Which Google Cloud service and configuration should they use?

Accepted Answer

Web Security Scanner with a managed scan and custom login credentials.. Web Security Scanner can perform authenticated scans by providing login credentials. It can scan applications on Compute Engine and App Engine. It identifies vulnerabilities like XSS, mixed content, and outdated libraries.

Answer

VM Manager patch management to check for outdated libraries.

Answer

Cloud Security Scanner with a custom scan configuration including authentication headers.

Answer

Container Analysis with a custom scanning schedule.

Question 11

A company wants to scan all container images stored in Artifact Registry for vulnerabilities before deployment. Which Google Cloud service should they use?

Accepted Answer

Container Analysis. Container Analysis (now part of Artifact Registry) provides vulnerability scanning for images. Binary Authorization enforces policies. Security Command Center aggregates findings. Cloud Build is for building images.

Answer

Binary Authorization

Answer

Cloud Build

Answer

Security Command Center

Question 12

Your organization uses VPC Flow Logs for network forensics. During an incident, you need to analyze traffic to a compromised instance for the last 72 hours. The Flow Logs are stored in Cloud Logging. Which approach allows you to query the logs most efficiently?

Accepted Answer

Use Logs Explorer in Cloud Logging to filter by instance and time range. Cloud Logging's Logs Explorer provides a query interface to filter and analyze logs. BigQuery is better for large-scale analysis, but for ad-hoc querying of recent logs, Logs Explorer is efficient. Note: Logs can be exported to BigQuery for complex analysis, but the question asks for efficient querying now.

Answer

Export logs to BigQuery and run SQL queries

Answer

Use the gcloud logging read command with appropriate filters

Answer

Download logs as CSV from Cloud Storage

Question 13

A security engineer wants to export Cloud Audit Logs to a third-party SIEM in real time. Which log sink destination should they configure?

Accepted Answer

Pub/Sub. To export logs in real time, configure a log sink with a Pub/Sub topic as the destination. The SIEM can then subscribe to that topic.

Answer

BigQuery

Answer

Cloud Storage

Answer

Logging bucket

Question 14

Which Security Command Center tier includes Event Threat Detection and Container Threat Detection?

Accepted Answer

Premium tier. Premium tier adds threat detection services beyond the Standard tier's health analytics and scanner.

Answer

Standard tier

Answer

Basic tier

Answer

Enterprise tier

Question 15

A company runs containerized applications on GKE and uses Binary Authorization. They want to enforce that only images from a specific Artifact Registry repository can be deployed, and those images must be signed by a trusted attestor. Which THREE configurations are required?

Accepted Answer

Set up a Binary Authorization policy that requires attestation.. The three requirements: a Binary Authorization policy requiring attestation, an attestor (with note), and a policy constraint to restrict allowed registries.

Answer

Configure an Artifact Registry repository with a vulnerability scanning policy.

Answer

Create a Cloud KMS key and an attestor in the same project as the repository.