PCSE Practice Test 2 — 25 Questions

Question 1

An organization needs to store cryptographic keys that must be protected in a FIPS 140-2 Level 3 validated hardware security module (HSM). Which Google Cloud service should they use?

Accepted Answer

Cloud HSM. Cloud HSM provides FIPS 140-2 Level 3 validated HSM for key material. Keys are generated and stored in the HSM.

Answer

Secret Manager

Answer

Cloud KMS with software-backed keys

Answer

Cloud External Key Manager

Question 2

A security engineer needs to ensure that all container images deployed to a GKE cluster are signed by a trusted authority. The organization uses Cloud KMS for key management and wants to enforce the policy at admission time. Which two components are essential to implement this requirement? (Choose two.)

Accepted Answer

Attestor created in Binary Authorization with Cloud KMS key. Binary Authorization requires attestors to verify image signatures and a policy that requires at least one attestation. Attestors use Cloud KMS keys for signing, and the policy is enforced at GKE admission time.

Answer

Cloud Audit Logs enabled for GKE

Answer

Container Analysis vulnerability scanning

Answer

Web Security Scanner configured to scan the GKE cluster

Question 3

A security engineer notices that some developers are still uploading their own public SSH keys to Compute Engine instances despite the organization policy above being applied to the folder. What is the most likely reason?

Accepted Answer

The policy disables uploading service account keys, not user SSH keys.. The organization policy described likely restricts the uploading of service account keys, not user SSH keys. The policy in question is typically the 'Disable service account key upload' constraint (iam.disableServiceAccountKeyUpload), which prevents users from creating or uploading external service account keys. It does not affect the ability to add public SSH keys to Compute Engine instances, which is governed by separate metadata-based mechanisms (e.g., oslogin or instance metadata). Therefore, developers can still upload their own SSH keys despite the policy being applied.

Answer

The policy only applies to projects, not folders.

Answer

The policy takes 24 hours to propagate to all projects.

Answer

The policy was applied at the organization level, not the folder level.

Question 4

A company uses Cloud Armor Managed Protection Plus to protect their applications. They want to automatically block IP addresses that are identified as malicious by adaptive protection. How should they configure this?

Accepted Answer

Enable 'auto-deploy' in the adaptive protection configuration.. Cloud Armor Adaptive Protection, when part of Managed Protection Plus, can be configured with 'auto-deploy' so that when it detects an anomalous Layer 7 attack (e.g., a sudden spike from a set of IPs), it automatically creates and attaches a pre-configured WAF rule to the target backend service. This removes the need for manual triage and shrinks the response window from minutes to seconds. The auto-deploy option is the only mechanism that natively blocks adaptive-protection-identified IPs without human intervention.

Answer

Manually review adaptive protection alerts and create deny rules.

Answer

Use the 'rate limiting' rule to block high-traffic IPs.

Answer

Set up a Cloud Function to parse logs and create rules via API.

Question 5

A security engineer runs the above query in BigQuery and finds a column containing Social Security Numbers (SSNs). They must ensure that all SSNs in the dataset are automatically encrypted at rest using customer-managed keys (CMEK) and also that future queries do not expose SSNs to users without decryption access. Which approach should they take?

Accepted Answer

Enable CMEK on the dataset, create an authorized view that excludes the sensitive column, and grant view access to users.. Enabling CMEK on the dataset ensures all data, including SSNs, is encrypted at rest with customer-managed keys. Creating an authorized view that excludes the sensitive column and granting view access to users prevents exposure of SSNs in query results while still allowing access to non-sensitive data. This approach meets both the encryption and access control requirements without requiring manual encryption or de-identification.

Answer

Use BigQuery with CMEK on the dataset and create a separate table with encrypted columns.

Answer

Use Cloud DLP to de-identify the data in the table and then restrict access to the de-identified column.

Answer

Use Cloud KMS to encrypt the column values and store the encrypted data in BigQuery.

Question 6

A company is using Assured Workloads with the FEDRAMP_HIGH regime. They need to restrict where resources can be created and monitor for compliance violations. Which TWO settings should they configure? (Choose 2)

Accepted Answer

Resource location restrictions. Option C (Resource location restrictions) is correct because Assured Workloads lets you define the allowed resource locations for a folder, so any attempt to create resources outside the permitted regions is blocked, directly satisfying the requirement to restrict where resources can be created. Option E (Compliance monitoring / drift detection) is correct because Assured Workloads continuously monitors the folder for policy violations and configuration drift against the FEDRAMP_HIGH controls, alerting you to non-compliant changes. Option A (Access Transparency logs) is not one of the two settings that restrict creation locations or detect compliance drift; Access Transparency provides logs of Google personnel access actions and is a separate transparency control. Option B (Data residency controls) is not the correct selection here because Assured Workloads enforces location through resource location restrictions rather than a distinct 'data residency controls' setting. Option D (Google personnel access restrictions) is a personnel/access control (such as Access Approval or support access restrictions) and does not itself restrict resource creation locations or provide drift detection.

Answer

Access Transparency logs

Answer

Data residency controls

Answer

Google personnel access restrictions

Question 7

Drag and drop the steps to configure a VPC Service Controls perimeter in the correct order.

Accepted Answer

Set up an access policy, then define access levels, then create the perimeter, then add ingress/egress rules, then enforce and test. VPC Service Controls perimeters are configured by first setting up an access policy, defining access levels, creating the perimeter, adding ingress/egress rules, and finally enforcing and testing.

Answer

Create the perimeter, then set up an access policy, then define access levels, then add ingress/egress rules, then enforce and test

Answer

Define access levels, then create the perimeter, then set up an access policy, then add ingress/egress rules, then enforce and test

Answer

Set up an access policy, then create the perimeter, then define access levels, then add ingress/egress rules, then enforce and test

Question 8

A multinational organization uses Chronicle SIEM to aggregate and analyze security logs from multiple GCP projects and on-premises systems. The security team wants to detect a known threat pattern: a user authenticating from an anomalous geographic location followed by a large data egress from a Compute Engine instance within 10 minutes. Which three steps are necessary to create this detection? (Choose three.)

Accepted Answer

Ingest Cloud Audit Logs and VPC Flow Logs into Chronicle via forwarders or native integration. Option A is correct because Chronicle detection requires the relevant telemetry in UDM; ingesting Cloud Audit Logs (for authentication events) and VPC Flow Logs (for network egress) via native integration or forwarders provides the raw events the rule will match. Option B is correct because the scenario explicitly includes on-premises systems, so a forwarder must send those authentication logs into Chronicle to correlate them with GCP activity. Option E is correct because YARA-L is Chronicle's detection language, and a rule matching a UDM authentication event with anomalous geo-location followed within 10 minutes by a UDM network event with large bytes out directly implements the described threat pattern. Option C is not needed because BigQuery export is for long-term storage/analysis, not for creating a real-time Chronicle detection. Option D is not needed because Security Command Center findings are a separate GCP security service and do not create the Chronicle YARA-L detection logic.

Answer

Configure a BigQuery export of VPC Flow Logs for long-term analysis

Answer

Enable the Standard tier of Security Command Center to generate finding notifications

Question 9

A user has been granted the role roles/editor on a folder. What is the effective access in the projects within that folder? (Assume no deny policies)

Accepted Answer

Full editor access on all resources in the folder, including projects.. In Google Cloud, IAM roles are inherited from parent resources to child resources. Granting the roles/editor role on a folder automatically applies that role to all projects and resources within the folder, provided there are no deny policies to override it. This means the user has full editor access on all resources in the folder, including the projects themselves and all resources within those projects.

Answer

Editor access on the projects but not on resources within the projects.

Answer

The user must also be granted editor on each project separately.

Answer

Editor access on the folder resource only, not on projects.

Question 10

A security engineer needs to ensure that a Compute Engine VM can securely access Cloud Storage buckets without exposing a public IP address. The VM is in a VPC with Private Google Access enabled. What is the recommended approach?

Accepted Answer

No additional configuration is needed; Private Google Access allows access to Cloud Storage from VMs without external IPs.. Private Google Access enables a VM without an external IP address to reach Google APIs and services, including Cloud Storage, using the VPC's internal IP and Google's private network. Since the VM is in a VPC with Private Google Access enabled, it can securely access Cloud Storage buckets without needing a public IP or additional proxy. No further configuration is required because the traffic stays within Google's network and never traverses the public internet.

Answer

Deploy a Squid proxy in the same VPC and configure the VM to use it for all outbound traffic.

Answer

Assign an external IP to the VM and configure a firewall rule to allow egress to 0.0.0.0/0.

Answer

Configure Cloud NAT and ensure the VM has a route to the internet.

Question 11

Which THREE steps are most effective for troubleshooting a VPC firewall rule issue where desired traffic is being blocked?

Accepted Answer

Check firewall rule logs in Cloud Logging. Option B is correct because VPC firewall rule logging in Cloud Logging records allowed and denied connections with details such as the rule name, direction, and source/destination, which directly reveals whether a firewall rule is blocking the traffic. Option C is correct because Google Cloud firewall rules apply to instances based on matching network tags (targetTags), so if the instance's network tags do not match the rule's target tags, the rule will not be enforced as intended and traffic may be blocked by a default or other rule. Option D is correct because VPC Flow Logs capture IP traffic metadata for the subnet or instance, showing whether packets are reaching the VM and helping distinguish a firewall block from a routing or upstream issue. Option A is not relevant because IAM permissions control API-level access to manage resources, not packet filtering for VM traffic. Option E is not the most effective step here because route tables determine path selection, not firewall rule evaluation; while routing issues can cause connectivity failures, they do not explain a firewall rule blocking desired traffic.

Answer

Check IAM permissions for the VM's service account

Answer

Inspect the route tables for the subnet

Question 12

Which Google Cloud service is specifically designed to help customers meet compliance requirements by creating a folder with pre-defined organization policies, resource location restrictions, and access controls?

Accepted Answer

Assured Workloads. Assured Workloads is Google Cloud's purpose-built service for creating folders pre-configured with compliance controls — including organization policies, resource location restrictions, personnel access controls, and encryption requirements — tailored to specific regimes like FedRAMP, IL4, ITAR, CJIS, and HIPAA. It provisions a folder with these guardrails so workloads inherit compliance posture automatically.

Answer

VPC Service Controls

Answer

Cloud HSM

Answer

Security Command Center

Question 13

A security engineer is configuring VPC Service Controls to protect a Google Cloud project containing sensitive data. The project uses Cloud Storage and BigQuery. The engineer wants to ensure that data cannot be exfiltrated to external IP addresses outside the perimeter, but internal users should still be able to access the data from on-premises via a VPN. Which configuration should be applied?

Accepted Answer

Add the project to a VPC Service Controls perimeter and configure an ingress rule to allow traffic from the on-premises VPN CIDR ranges. VPC Service Controls (VPC-SC) allow you to define a security perimeter around Google Cloud services like Cloud Storage and BigQuery, preventing data exfiltration to external IPs. By adding the project to a perimeter and configuring an ingress rule that permits traffic from the on-premises VPN CIDR ranges, internal users can access the data via VPN while all other external traffic is blocked. This meets the requirement of preventing exfiltration to external IPs while allowing authorized on-premises access.

Answer

Do not use VPC Service Controls; instead, rely on IAM permissions and firewall rules to control access

Answer

Create a separate perimeter that denies all traffic and apply it to the project

Answer

Add the project to a VPC Service Controls perimeter with no additional ingress rules

Question 14

An organization wants to enforce that all new Cloud Storage buckets are created with uniform bucket-level access enabled to simplify access control and meet compliance requirements. What Google Cloud service should they use to enforce this?

Accepted Answer

Organization Policies. Organization Policies allow administrators to set constraints on Google Cloud resources at the organization, folder, or project level. The `constraints/storage.uniformBucketLevelAccess` constraint can be applied to enforce that all new Cloud Storage buckets are created with uniform bucket-level access enabled, simplifying access control and meeting compliance requirements.

Answer

VPC Service Controls

Answer

Cloud IAM

Answer

Cloud Armor

Question 15

A company uses Cloud Data Loss Prevention (DLP) to inspect sensitive data in Cloud Storage. They want to automatically redact credit card numbers found in text files before the files are accessed by downstream applications. Which DLP method should be used?

Accepted Answer

Use the DLP API's `content.deidentify` method with a `PrimitiveTransformation` of `replaceWithInfoType`.. The DLP API's `content.deidentify` method with a `PrimitiveTransformation` of `replaceWithInfoType` is designed to automatically replace sensitive data (like credit card numbers) with their corresponding info type labels (e.g., `[CREDIT_CARD_NUMBER]`) in text files. This method operates on content in memory or from Cloud Storage, enabling automated redaction before downstream access, without requiring a separate job or manual intervention.

Answer

Create a DLP job that uses the InspectJobConfig with a redact transformation.

Answer

Use Cloud DLP's inspect-only functionality and manually redact.

Answer

Set up a DLP inspection scan on the bucket with a `CryptoReplaceFfxFpe` transformation.

Question 16

A company is deploying a web application behind an external HTTPS load balancer. They want to protect against common web attacks such as XSS, SQLi, and LFI using preconfigured rules. They also need to allowlist specific IP addresses that belong to partners. Which three Cloud Armor features should they use? (Choose three.)

Accepted Answer

Attach the Cloud Armor security policy to the backend service or load balancer.. Option A is correct because a Cloud Armor security policy only takes effect once it is attached to the target backend service (or the backend service of the external HTTPS load balancer), which is the enforcement point for the rules. Option B is correct because the OWASP ModSecurity Core Rule Set (CRS) preconfigured WAF rules in Cloud Armor are specifically designed to detect and block common web attacks such as XSS, SQL injection, and local file inclusion without writing rules from scratch. Option E is correct because partner IP allowlisting is implemented with custom Cloud Armor rules using match conditions on source IP ranges (for example, srcIpRanges with an allow action at a suitable priority), which permits only the specified partner addresses. Option C is not correct because IAP controls user authentication/authorization to applications and does not provide WAF protection against XSS, SQLi, or LFI, nor IP allowlisting for partners. Option D is not correct because Cloud CDN only caches content at the edge to improve performance; it does not inspect or block malicious web requests.

Answer

Configure IAP to restrict access to the application.

Answer

Use Cloud CDN to cache static content.

Question 17

Your organization has an IAM policy at the folder level that grants a user the Compute Admin role. A deny policy at the project level denies the same user the compute.instances.create permission. What is the effective access for this user on the project?

Accepted Answer

The user cannot create instances because deny policies override allow policies.. Deny policies always override allow policies. The deny at the project level explicitly denies compute.instances.create, so the user cannot create instances despite the folder-level allow.

Answer

The user can create instances because the allow policy at the folder level takes precedence over the deny policy at the project level.

Answer

The user can create instances because the project-level deny policy only applies to resources within the project, not to permissions inherited from the folder.

Answer

The user can create instances because deny policies only block explicit allows, not inherited ones.

Question 18

A security engineer needs to implement a logging pipeline that sends real-time Cloud Audit Logs to a third-party SIEM. They must ensure that if the SIEM is unavailable, logs are not lost. Which approach should they use?

Accepted Answer

Create a log sink that writes to a Pub/Sub topic, and use a subscription with a dead letter topic.. Using a Pub/Sub subscription with a dead letter topic allows messages to be retried and, if delivery fails persistently, moved to a dead letter topic for later reprocessing. This prevents data loss. Cloud Storage is not real-time; BigQuery is not for streaming to SIEM; Cloud Run without Pub/Sub would miss retries.

Answer

Configure a Cloud Run service to pull logs from Cloud Logging API and forward to SIEM.

Answer

Export logs to Cloud Storage via a sink, and have the SIEM ingest from there.

Answer

Use a log sink to BigQuery and have the SIEM query BigQuery periodically.

Question 19

An organization uses a global HTTPS load balancer with a Google-managed SSL certificate. The certificate was automatically provisioned and renewed. Recently, the certificate renewal failed and the site shows a warning. The load balancer's frontend uses the certificate. What is the most likely cause?

Accepted Answer

The DNS CNAME record for domain validation is misconfigured or missing. Google-managed certificates are provisioned using DNS authorization. If the DNS records are misconfigured (e.g., the CNAME record for domain ownership validation is missing or incorrect), renewal will fail. The load balancer settings themselves are typically fine.

Answer

The load balancer's frontend IP address has changed

Answer

The certificate has reached its maximum validity period

Answer

The load balancer's SSL policy requires a minimum TLS version that the managed certificate does not support

Question 20

A company wants to automatically provision and renew SSL certificates for their HTTPS load balancer. They do not want to manually manage certificate files. Which approach should they use?

Accepted Answer

Create a Google-managed SSL certificate resource.. A Google-managed SSL certificate resource is automatically provisioned, renewed, and rotated by Google Cloud for use with HTTPS load balancers. It eliminates manual certificate file management, matching the requirement for automatic provisioning and renewal without manual intervention.

Answer

Upload a self-managed certificate in PEM format.

Answer

Configure SSL policies to enforce TLS version.

Answer

Use Certificate Manager with a DNS-authorized certificate.