PCSE Practice Test 25 — 15 Questions

Question 1

A security engineer needs to archive Cloud Audit Logs for regulatory compliance for 7 years. The logs should be immutable and cost-effective. Which solution should they choose?

Accepted Answer

Export logs to Cloud Storage using a sink, and enable Bucket Lock with retention policy.. Cloud Storage with the Archive storage class and retention policy using Bucket Lock provides immutable, low-cost storage for long-term archival. Logging exports can be configured via a sink to write logs to a bucket with these settings. BigQuery is not suitable for long-term archival due to cost; Pub/Sub is for streaming; Cloud Spanner is transactional and expensive.

Answer

Export logs to Pub/Sub and store them in a Cloud Spanner table with 7-year TTL.

Answer

Export logs to BigQuery and set a 7-year table expiration.

Answer

Use the default log retention of 400 days and copy logs to a persistent disk snapshot.

Question 2

A DevOps team wants to automatically scale a managed instance group based on CPU utilization. Which metric should they use in the autoscaler?

Accepted Answer

'compute.googleapis.com/instance/cpu/utilization'. The Google Cloud Managed Instance Group (MIG) autoscaler natively supports a specific set of metric identifiers, and 'compute.googleapis.com/instance/cpu/utilization' is the canonical CPU metric used for CPU-based autoscaling policies. This metric reports the fraction of allocated CPU currently in use (0.0–1.0) per instance, which the autoscaler aggregates across the group to compare against the target utilization you configure. Because it is a first-party Compute Engine metric, it requires no Ops Agent installation and is available immediately for every VM in the group.

Answer

'compute.googleapis.com/instance/cpu/usage_time'

Answer

'compute.googleapis.com/instance/cpu/reserved_cores'

Answer

'agent.googleapis.com/cpu/utilization'

Question 3

A financial institution uses Cloud KMS to manage encryption keys. They want to ensure that key material is never exported from the KMS service. Which key protection method should they use?

Accepted Answer

HSM keys in Cloud KMS. HSM keys in Cloud KMS are generated and stored within a FIPS 140-2 Level 3 certified hardware security module (HSM) that is physically and logically controlled by Google. The key material never leaves the HSM boundary; all cryptographic operations are performed inside the HSM, and export of the key material is prevented by design. This satisfies the requirement that key material is never exported from the KMS service.

Answer

Cloud HSM

Answer

External key manager

Answer

Software keys in Cloud KMS

Question 4

A financial services company is migrating to Google Cloud and needs to enforce strict security controls. They want to ensure that: 1) No service account keys are created. 2) All Compute Engine instances must be created with Shielded VM enabled. 3) Only users from the corporate domain (example.com) can be granted IAM roles. Which THREE Organization Policy constraints must be used? (Choose three.)

Accepted Answer

constraints/iam.allowedPolicyMemberDomains. The three constraints are: constraints/iam.disableServiceAccountKeyCreation (prevents key creation), constraints/compute.requireShieldedVm (requires Shielded VM), and constraints/iam.allowedPolicyMemberDomains (restricts IAM members to specific domains). The other constraints are not relevant: constraints/compute.restrictCloudArmorPolicies is about Cloud Armor policies, and constraints/compute.requireOsLogin is about OS Login.

Answer

constraints/compute.requireOsLogin

Answer

constraints/compute.restrictCloudArmorPolicies

Question 5

A user is unable to SSH into an instance that has the tag 'ssh-access' and an internal IP 10.0.0.2. The user's IP is 198.51.100.1. What is the most likely reason?

Accepted Answer

The user's IP is not in the allowed source range. The user's IP (198.51.100.1) is a public address, while the instance's internal IP (10.0.0.2) is private. For SSH access from the internet, the firewall rule must allow the user's public IP as the source range. Since the user cannot connect, the most likely reason is that the firewall rule does not include 198.51.100.1 as an allowed source. This is a common misconfiguration in cloud environments where firewall rules are scoped to specific source IP ranges.

Answer

The instance is not using the correct service account

Answer

The instance does not have an external IP

Answer

The firewall rule is disabled

Question 6

Which of the following is true about IAM deny policies?

Accepted Answer

Deny policies take precedence over allow policies.. Deny policies override allow policies. They are evaluated after allow policies, and if a deny matches, the access is denied regardless of allowed roles. They apply to the resource hierarchy as well. Deny policies can be set at the organization, folder, project, or resource level.

Answer

Deny policies can only be applied at the organization level.

Answer

Deny policies are evaluated before allow policies.

Answer

Deny policies can grant permissions.

Question 7

Drag and drop the steps to set up Cloud Armor with a WAF rule in the correct order.

Accepted Answer

1. Create a Cloud Armor security policy. 2. Add WAF rules to the policy. 3. Attach the policy to a backend service. 4. Enable logging for the policy. 5. Test the policy.. Cloud Armor configuration involves creating the policy, defining rules, attaching to a backend, enabling logging, and testing.

Answer

1. Create a Cloud Armor security policy. 2. Attach the policy to a backend service. 3. Add WAF rules to the policy. 4. Enable logging for the policy. 5. Test the policy.

Answer

1. Add WAF rules to the policy. 2. Create a Cloud Armor security policy. 3. Attach the policy to a backend service. 4. Enable logging for the policy. 5. Test the policy.

Answer

1. Create a Cloud Armor security policy. 2. Enable logging for the policy. 3. Add WAF rules to the policy. 4. Attach the policy to a backend service. 5. Test the policy.

Question 8

A healthcare organization is designing a data pipeline that ingests patient health records into Cloud Storage, then processes them with Dataflow for analytics. They must ensure that data is encrypted at rest and in transit, and that only authorized users can access the raw data. They also need to guarantee that the encryption keys are stored outside of Google Cloud. Which solution meets all requirements?

Accepted Answer

Use Cloud External Key Manager (Cloud EKM) with a partner key manager.. Cloud EKM allows you to manage encryption keys using a supported external key management partner, ensuring keys are stored outside Google Cloud. This meets the requirement for encryption at rest and in transit (Dataflow and Cloud Storage use these keys transparently) while keeping key material external to Google's infrastructure. Only authorized users can access raw data via IAM and the external key manager's access controls.

Answer

Use default encryption and rely on Google's data residency commitments.

Answer

Use Customer-Supplied Encryption Keys (CSEK) for Cloud Storage and Dataflow.

Answer

Use Cloud HSM to generate and store keys.

Question 9

A company uses Cloud Armor to protect an external HTTPS load balancer. They want to block requests from a specific IP address range 198.51.100.0/24, but allow all other traffic. After creating a deny rule with the source IP condition, they notice that requests from that range are still reaching the backend. What is the most likely cause?

Accepted Answer

Another rule with a lower priority number that allows all traffic is overriding the deny rule.. In Cloud Armor, rules are evaluated in order of priority, where lower priority numbers indicate higher precedence. If a rule with a lower priority number (e.g., 1000) allows all traffic, it will be evaluated before a deny rule with a higher priority number (e.g., 2000), causing the deny rule to be overridden. This is the most likely reason the specific IP range is still reaching the backend despite the deny rule being created.

Answer

The rule action is set to 'allow' instead of 'deny'.

Answer

Cloud Armor cannot block traffic based on source IP; it only supports geographic and header-based conditions.

Answer

The rule uses the wrong match syntax, such as 'sourceIpRange' instead of 'inIpRange'.

Question 10

A company needs to allow developers to create and manage custom IAM roles at the project level, but restrict the permissions that can be added to those roles to a predefined list. What should be used?

Accepted Answer

Use a custom organization policy constraint to define the allowed permissions for custom roles.. A custom organization policy constraint is the correct mechanism because it lets an organization define an allowlist of permissions that can be included in custom IAM roles, enforced centrally across projects. Developers can still create and manage custom roles at the project level, but any attempt to add a permission outside the allowed list is blocked by the policy, providing guardrails without removing autonomy.

Answer

Grant the developers the IAM Role Administrator role (roles/iam.roleAdmin) and rely on training to only use allowed permissions.

Answer

Grant the developers the Project IAM Admin role (roles/resourcemanager.projectIamAdmin) and restrict roles via a deny policy.

Answer

Use the constraint constraints/iam.allowedPolicyMemberDomains to restrict the domains of members who can be assigned roles.

Question 11

A company uses Shared VPC in a host project with multiple service projects. The security team wants to ensure that all traffic between service projects is inspected by a third-party firewall appliance deployed in the host project. Which configuration should be implemented?

Accepted Answer

Create a policy-based route in the host project that matches traffic between service project subnets and has a next hop to the firewall appliance's internal IP.. A policy-based route in the host project can match traffic based on source and destination subnets from different service projects and force that traffic to be forwarded to the next-hop IP of the third-party firewall appliance. This ensures all inter-service-project traffic is inspected by the firewall, as the route overrides the default VPC routing behavior within the Shared VPC environment.

Answer

Enable Cloud NAT on each service project and configure a default route to the firewall appliance.

Answer

Set up VPC network peering between service projects and route traffic through the host project via a VPN tunnel.

Answer

Create a firewall rule in the host project that allows traffic between service projects only if the source is the firewall appliance.

Question 12

A company is moving sensitive data to Google Cloud and must comply with GDPR data minimization principles. They want to ensure that only the minimum necessary data is collected and processed. Which Google Cloud service should they use to automatically identify and redact sensitive data before storage?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud Data Loss Prevention (DLP) is the correct service because it provides native capabilities to inspect, classify, and automatically redact sensitive data (e.g., PII, credit card numbers) before storage, directly supporting GDPR data minimization. It uses built-in infoType detectors and can be integrated with Cloud Storage, BigQuery, and other services to apply de-identification transformations such as masking, tokenization, or deletion at ingestion time.

Answer

Cloud Composer

Answer

Cloud Data Fusion

Answer

Cloud Dataprep

Question 13

A company wants to enforce that no service account keys are created for service accounts in a specific project. Additionally, they want to allow only users from their corporate domain (example.com) to be granted IAM roles. Which TWO organization policy constraints should they apply at the project level?

Accepted Answer

constraints/iam.allowedPolicyMemberDomains. Option E, constraints/iam.disableServiceAccountKeyCreation, is correct because this organization policy constraint specifically prevents the creation of service account keys, directly satisfying the requirement that no service account keys be created for service accounts in the project. Option B, constraints/iam.allowedPolicyMemberDomains, is correct because it restricts IAM policy members to identities belonging to specified domains, which enforces that only users from the corporate domain example.com can be granted IAM roles. Option A, constraints/iam.workloadIdentityPoolProviders, governs which workload identity pool providers may be used and does not restrict service account key creation or IAM member domains. Option C, constraints/compute.requireShieldedVm, enforces Shielded VM settings on Compute Engine instances and is unrelated to service account keys or IAM domain restrictions. Option D, constraints/compute.restrictCloudArmorPolicies, limits Cloud Armor security policy usage and likewise has no bearing on the stated requirements.

Answer

constraints/iam.workloadIdentityPoolProviders

Answer

constraints/compute.requireShieldedVm

Answer

constraints/compute.restrictCloudArmorPolicies

Question 14

An organization wants to use Chronicle for SIEM. They need to ingest logs from an on-premises firewall. Which method should they use?

Accepted Answer

Use a forwarder (e.g., Syslog to UDM) to send logs to Chronicle. On-premises firewalls cannot natively push logs to Google Cloud services, so the standard Chronicle ingestion path is to deploy a forwarder (the Chronicle Forwarder, or a Syslog-based collector) that receives the firewall's syslog output, normalizes it to UDM, and forwards it to Chronicle over an authenticated channel. This is the documented method for ingesting third-party on-prem logs into Chronicle.

Answer

Configure a log sink from Cloud Logging to Chronicle

Answer

Export logs to Cloud Storage and have Chronicle import them

Answer

Directly send logs to a Pub/Sub topic that is ingested by Chronicle

Question 15

A service provider wants to expose an internal service to external consumers in a controlled manner, without giving them direct access to the VPC. Which Google Cloud service should be used?

Accepted Answer

Private Service Connect. Private Service Connect lets a service provider expose a service to consumers via a private endpoint in the consumer's VPC, without VPC peering or direct VPC access. It is designed exactly for controlled, one-way service exposure across projects and organizations.

Answer

Cloud VPN

Answer

Cloud NAT

Answer

VPC Peering