PCSE Practice Test 2 — 25 Questions

Question 1

Which TWO practices help implement the principle of least privilege when configuring access to Google Cloud resources? (Choose two.)

Accepted Answer

Create custom roles that include only the specific permissions needed.. Creating custom roles allows you to define a precise set of permissions, ensuring that a principal has only the minimum permissions required to perform their job function. This directly implements the principle of least privilege by avoiding the broad permissions often included in predefined roles.

Answer

Grant roles at the organization level to simplify administration.

Answer

Use a single service account for all Cloud Functions in a project to simplify key management.

Answer

Grant IAM roles directly to individual users for better traceability.

Question 2

A financial services company runs a PCI DSS-compliant workload on Google Cloud. They use a service account with roles/container.clusterAdmin to manage a GKE cluster. The security team has enabled Binary Authorization with a policy that requires all container images to be signed by a trusted authority. Recently, a developer reported that a new deployment failed with the error: 'Image verification failed: no signature found for digest sha256:abc...'. The image is stored in Artifact Registry and the developer built it using Cloud Build with a trigger that automatically signs images using Cloud KMS. The Cloud Build service account has roles/cloudkms.signerVerifier and roles/binaryauthorization.attestorsViewer. The Binary Authorization policy is configured to require at least one attestation from the trusted attestor. What is the most likely reason for the failure?

Accepted Answer

The Cloud Build service account lacks the roles/binaryauthorization.attestorsEditor role.. The Cloud Build service account has roles/cloudkms.signerVerifier and roles/binaryauthorization.attestorsViewer, which allow it to sign images and view attestors, but it lacks the roles/binaryauthorization.attestorsEditor role. Without this role, the service account cannot create or manage attestations in Binary Authorization, so even though the image is signed, no attestation is recorded, causing the policy to fail with 'no signature found'.

Answer

The container image is stored in a different registry that is not supported by Binary Authorization.

Answer

The GKE cluster's node service account does not have permission to verify attestations.

Answer

The Binary Authorization policy requires an attestation from a different attestor that is not configured.

Question 3

A company uses multiple GCP projects and wants to allow a service account from Project A to initiate Dataflow jobs in Project B. The service account in Project A has the Dataflow Developer role at the organization level. However, it fails with permission denied when trying to submit a job to Project B. What is the most likely issue?

Accepted Answer

The service account needs the Service Account User role on the Dataflow service account in Project B.. The service account from Project A has the Dataflow Developer role at the organization level, which grants permissions to create Dataflow jobs, but it still needs the Service Account User role (roles/iam.serviceAccountUser) on the Dataflow service account in Project B. When a Dataflow job is submitted, the job runs as a service account in the target project (Project B), and the caller must have the iam.serviceAccounts.actAs permission on that service account. Without this role, the API call fails with a permission denied error even though the Dataflow Developer role is present.

Answer

The organization policy restricts cross-project access.

Answer

The service account does not have permission to create Dataflow jobs in Project B because it is not a member of Project B.

Answer

The Dataflow API is not enabled in Project B.

Question 4

Which THREE components are required to configure VPC Flow Logs for a Compute Engine instance?

Accepted Answer

Enable VPC Flow Logs on the subnet. VPC Flow Logs capture network traffic metadata at the subnet level. Enabling flow logs on the subnet (A) is the primary configuration step that activates logging for all VM instances within that subnet. The VM's service account must have the compute.instances.get permission (B) to allow the flow log agent to retrieve instance metadata required for log entries. A VM with a network interface in the subnet (D) is necessary because flow logs are generated per network interface; without a VM in the subnet, there is no traffic to log.

Answer

A log sink to export logs to BigQuery

Answer

A metadata server to store logs

Question 5

An organization wants to enforce that all container images deployed to a GKE cluster must be signed by an approved authority. They have set up Binary Authorization with a policy that requires attestation. Where should the signing key be stored to meet security best practices?

Accepted Answer

Store the private key in Cloud Key Management Service (Cloud KMS).. Binary Authorization integrates with Cloud Key Management Service (KMS) to store attestor keys. Cloud KMS provides centralized key management, access control via IAM, and audit logging. Using a key stored in Cloud KMS is the recommended approach.

Answer

Store the private key in a GCS bucket with uniform bucket-level access.

Answer

Store the private key in Secret Manager.

Answer

Store the private key on the developer's workstation.

Question 6

A Cloud Function that processes financial data is timing out after 60 seconds. The function performs complex calculations and cannot be decomposed further. What is the best solution?

Accepted Answer

Increase the Cloud Functions timeout to 120 seconds and optimize the code. Cloud Functions provides a configurable timeout, and the maximum timeout for HTTP functions is 60 minutes, so increasing the timeout to 120 seconds is feasible. Additionally, optimizing the code can reduce execution time. Option A is wrong because migrating to Cloud Run adds complexity and does not necessarily resolve a timeout caused by slow code; Cloud Run also has a default timeout of 60 minutes, so it may not be better than simply increasing Cloud Functions timeout. Option B is wrong because changing the programming language does not inherently reduce execution time; performance depends on the logic and algorithms. Option C is wrong because increasing memory may slightly improve CPU performance but does not extend the timeout limit; the function still times out at 60 seconds if it is not completed.

Answer

Migrate the function to Cloud Run with a longer timeout

Answer

Change the Cloud Functions runtime from Node.js to Python

Answer

Increase the allocated memory for the function

Question 7

A company wants to ensure compliance with PCI DSS by monitoring access to BigQuery datasets containing sensitive data. They need to log all read operations and enable real-time alerting for anomalous access. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Create a log sink to export BigQuery Data Access logs to Pub/Sub.. BigQuery Data Access logs record read operations but are not enabled by default. To enable them, you must explicitly enable Data Access logs for BigQuery. For real-time alerting, you can export logs to Pub/Sub and process them with a Cloud Function.

Answer

Enable Admin Activity logs for BigQuery.

Answer

Use Security Command Center to detect sensitive data access.

Answer

Create a BigQuery view to restrict access to sensitive columns.

Question 8

Which THREE are best practices for managing encryption keys in Google Cloud?

Accepted Answer

Enable automatic rotation for keys that are used for encryption.. Cloud KMS supports automatic key rotation, which reduces the risk of key compromise by ensuring that encryption keys are periodically replaced without manual intervention. Automatic rotation creates new key versions at a specified interval (e.g., every 90 days) and automatically uses the latest version for encryption, while decryption can still use older versions. This aligns with the security best practice of limiting the amount of data encrypted under a single key version.

Answer

Import key material from on-premises HSMs to avoid vendor lock-in.

Answer

Automatically delete old key versions once they expire.

Question 9

A company has multiple Google Cloud projects organized under folders by department. The security team wants to enforce a policy that all Compute Engine instances must use Shielded VM features. They need to prevent non-compliant instances from being created. Which action should be taken to enforce this requirement most effectively?

Accepted Answer

Use the Organization Policy Service with the constraint constraints/compute.requireShieldedVm.. Organization Policy constraints are the correct mechanism to enforce requirements across the resource hierarchy. The built-in constraint 'constraints/compute.requireShieldedVm' ensures that any new Compute Engine instance must have Shielded VM features enabled. This policy can be applied at the organization, folder, or project level. IAM roles or custom roles cannot enforce instance configuration requirements. Service account impersonation is unrelated. Deny policies can deny specific permissions but not enforce Shielded VM settings.

Answer

Create an IAM deny policy at the organization level that denies the compute.instances.create permission unless the Shielded VM flag is set.

Answer

Create a custom role that includes the permission to create instances only with Shielded VM, and assign it to all users.

Answer

Implement a service account that only has permission to create instances and use service account impersonation for all instance creation.

Question 10

Which THREE of the following are best practices for using Cloud DLP to protect sensitive data in BigQuery?

Accepted Answer

Use inspection jobs to scan tables and identify sensitive data.. Cloud DLP inspection jobs can scan BigQuery tables to identify sensitive data types (e.g., PII, credit card numbers) using built-in infoTypes. This is a foundational step before applying any deidentification or access control measures, as it allows you to discover where sensitive data resides.

Answer

Store transformed data in a separate dataset with stricter access controls.

Answer

Encrypt the entire BigQuery table using CMEK.

Question 11

A company has a compliance policy requiring that all data at rest in Cloud Storage be encrypted with a Cloud KMS key that is rotated every 90 days. The company uses CMEK with automatic key rotation enabled. An auditor discovers that some older objects in a bucket were created with a previous key version that has since been disabled. The compliance team requires that all objects be re-encrypted with the current key version. The bucket does not have object versioning enabled. What should the security engineer do to remediate this issue?

Accepted Answer

Use the 'gsutil rewrite -k' command to re-encrypt the objects with the current key version.. The 'gsutil rewrite -k' command re-encrypts existing objects in Cloud Storage with the current Cloud KMS key version, without requiring object versioning or re-uploading. This directly addresses the compliance requirement to re-encrypt all objects with the current key version, even though the old key version is disabled.

Answer

Re-enable the disabled key version in Cloud KMS so that objects can be read with the old key.

Answer

Enable object versioning on the bucket and delete the non-compliant object versions.

Answer

Create a new bucket with default encryption set to the current key and copy objects to it.

Question 12

Alice tries to connect to Cloud SQL instance 'prod-instance' using the Cloud SQL Auth proxy. Will she succeed? Why?

Accepted Answer

Yes, because the admin role grants full access, and the condition only applies to the admin role, but the client role is unconditional.. The Cloud SQL Auth proxy uses IAM permissions for authentication and authorization. The `cloudsql.client` role grants the `cloudsql.instances.connect` permission unconditionally, allowing Alice to connect to any instance. The `cloudsql.admin` role's condition restricting access to 'dev' instances only applies to the `cloudsql.instances.update` permission, not to the connect permission, so the client role's unconditional access prevails.

Answer

Yes, because she has the client role with no condition.

Answer

No, because the admin role condition overrides the client role.

Answer

No, because the cloudsql.admin role condition restricts to dev instances only.

Question 13

During a security incident, a forensic investigator needs to analyze a compromised Compute Engine instance without affecting the live environment. The instance has persistent disks with critical data. What is the best first step to preserve evidence?

Accepted Answer

Create a snapshot of the persistent disks.. Creating a snapshot of the persistent disks preserves a point-in-time copy without affecting the running instance. The snapshot can then be used to create a new disk attached to a forensic VM for analysis. Disk cloning requires stopping the instance.

Answer

Clone the instance to a new VM.

Answer

Export the disk image to Cloud Storage.

Answer

Enable VPC Flow Logs for the instance's network.

Question 14

A company is using a Shared VPC in Google Cloud with multiple service projects. The security team wants to restrict egress traffic from a specific service project to only allowed external IP addresses. The network project hosts the VPC. What is the best approach?

Accepted Answer

Create a firewall rule in the host project that denies egress to all destinations except the allowed IPs, and apply it to the service project's VMs via service accounts.. In a Shared VPC, firewall rules are defined in the host project and apply to VM instances in service projects. Option D correctly creates a deny-all egress rule in the host project, then uses a higher-priority allow rule for specific external IPs, scoped to service accounts of the target VMs. This ensures egress traffic from the specific service project is restricted at the VPC firewall level, which is the only effective way to control outbound traffic in a Shared VPC architecture.

Answer

Use Private Google Access to restrict egress.

Answer

Use VPC Service Controls to restrict egress.

Answer

Create a firewall rule in the service project's VPC that denies egress.

Question 15

An organization stores sensitive customer data in BigQuery tables. They need to enforce column-level security such that users in the 'support' group see a masked version of email addresses (e.g., j***@example.com), while managers see the full email. Which approach should they use?

Accepted Answer

Apply a BigQuery data masking policy using policy tags on the email column.. BigQuery column-level security with policy tags and data masking rules can achieve this. Data masking policies can be applied to policy tags to mask data based on user access. Using views or separate tables is less maintainable, and Cloud DLP is for batch scanning/de-identification, not real-time masking.

Answer

Create a view that applies masking functions and grant access to the view.

Answer

Use Cloud DLP to scan and de-identify the data in place.

Answer

Create separate tables for each role and populate them with appropriate data.

Question 16

A company has an on-premises data center connected to Google Cloud via a Dedicated Interconnect. They want to allow instances in a VPC (10.0.0.0/8) to access Google APIs (e.g., Cloud Storage) without traversing the public internet. They also want to ensure that traffic from on-premises to Google APIs uses the same private path. Which configuration is required?

Accepted Answer

Enable Private Google Access on the VPC subnet and advertise the default route (0.0.0.0/0) from on-premises with a specific route for Google APIs (199.36.153.4/30) pointing to the interconnect.. It enables Private Google Access on the VPC subnet, which allows instances with private IPs to reach Google APIs without public internet. Additionally, advertising a default route (0.0.0.0/0) from on-premises via the Dedicated Interconnect ensures that on-premises traffic to Google APIs also uses the private path, while the specific route for Google APIs (199.36.153.4/30) overrides the default to direct API traffic through the interconnect, avoiding asymmetric routing.

Answer

Set up Cloud VPN and use Private Google Access on the VPC.

Answer

Apply VPC Service Controls and enable Private Google Access on the subnet.

Answer

Configure Cloud NAT on the VPC and on-premises route via the interconnect.

Question 17

A company wants to use a Google-managed SSL certificate for their external HTTPS load balancer. Which step is required to provision the certificate?

Accepted Answer

Create a DNS record for the domain that resolves to the load balancer's IP address.. Google-managed SSL certificates require domain ownership verification. You must create a DNS record (CNAME or A record) that points to the load balancer's IP address or a specific verification record. The certificate is automatically provisioned and renewed.

Answer

Install the certificate on each backend instance.

Answer

Submit a Certificate Signing Request (CSR) to Google.

Answer

Upload the private key and certificate in PEM format.

Question 18

Drag and drop the steps to set up a Cloud VPN with a static route in the correct order.

Accepted Answer

Step 1: Create Cloud VPN gateway, Step 2: Create Cloud Router, Step 3: Create VPN tunnel, Step 4: Add static route, Step 5: Test connectivity. Cloud VPN setup requires gateway creation, Cloud Router, tunnel configuration, route addition, and connectivity testing.

Answer

Step 1: Create Cloud Router, Step 2: Create Cloud VPN gateway, Step 3: Create VPN tunnel, Step 4: Add static route, Step 5: Test connectivity

Answer

Step 1: Create Cloud VPN gateway, Step 2: Create VPN tunnel, Step 3: Create Cloud Router, Step 4: Add static route, Step 5: Test connectivity

Answer

Step 1: Create Cloud VPN gateway, Step 2: Create Cloud Router, Step 3: Add static route, Step 4: Create VPN tunnel, Step 5: Test connectivity

Question 19

A security engineer is investigating a compromised Compute Engine VM. They need to take a forensic snapshot of the disk without losing any data, including deleted files, and ensure the snapshot is not tampered with. Which steps should they take?

Accepted Answer

Create a snapshot of the disk while the instance is running, then detach the disk.. The correct approach is to first create a snapshot of the disk for forensic analysis, which captures the disk state including deleted files (unless overwritten). Then detach the disk from the instance to prevent further changes. Creating a snapshot after detaching would lose the current state. Powering off the instance may alter data. Using dd over SSH may change file access times.

Answer

Use dd to copy the disk over SSH to a forensic workstation.

Answer

Stop the instance, create a snapshot of the disk, then detach the disk.

Answer

Detach the disk first, then create a snapshot of the detached disk.

Question 20

A security team wants to ensure that a Cloud KMS key is rotated automatically every 30 days and that previous key versions are available for decryption for at least 6 months. Which THREE steps should they take? (Choose three.)

Accepted Answer

Ensure that the key's destruction policy does not automatically destroy versions before 6 months. To meet the requirements: 1) Set rotation period to 30 days on the key; 2) Do not destroy old key versions until after 6 months; 3) The default destruction policy does not automatically destroy old versions, so they remain available. Setting a primary version is not required for rotation, and disabling rotation is contrary.

Answer

Manually rotate the key every 30 days using a Cloud Function

Answer

Configure the key's `next_rotation_time` to start rotation immediately