PCSE Practice Test 2 — 25 Questions

Question 1

A company is using Cloud Data Loss Prevention (DLP) to inspect and de-identify sensitive data in Cloud Storage. They want to classify data using infoTypes and apply de-identification techniques. Which TWO actions should they take?

Accepted Answer

Use the DLP API to inspect the storage for sensitive data.. Option B is correct because the DLP API's `inspect` method is the primary mechanism to scan Cloud Storage objects for sensitive data patterns defined by infoTypes. Option C is correct because after inspection, de-identification transformations like masking or tokenization are applied via the DLP API's `deidentify` method to redact or replace sensitive content. Together, these two actions form the standard workflow for classifying and protecting data in Cloud Storage using Cloud DLP.

Answer

Create custom infoTypes for all sensitive data.

Answer

Store de-identification templates in Cloud KMS.

Answer

Use VPC Service Controls to restrict access to the data.

Question 2

A company is using Cloud SQL for MySQL to store financial data. They need to ensure that all data is encrypted at rest and in transit. What should they do?

Accepted Answer

Use the default encryption provided by Cloud SQL and enforce SSL/TLS connections.. Option D is correct because Cloud SQL for MySQL automatically encrypts data at rest using AES-256, with no additional configuration required. To protect data in transit, you must enforce SSL/TLS connections by configuring the instance to require SSL and downloading the server certificate for client connections. This combination satisfies both encryption requirements without unnecessary complexity.

Answer

Use client-side encryption before storing data in Cloud SQL.

Answer

Enable encryption at rest by checking a box in the Cloud Console.

Answer

Enable CMEK on the Cloud SQL instance and configure SSL/TLS.

Question 3

A security engineer needs to grant a data analyst read-only access to a BigQuery dataset containing customer data, but must prevent the analyst from viewing or querying a specific column that contains personally identifiable information (PII). Which approach should the engineer use?

Accepted Answer

Use BigQuery column-level security with a policy tag on the PII column, and assign the analyst a role that denies access to that tag.. Option A is correct because BigQuery column-level security uses policy tags to control access at the column level. By assigning a policy tag to the PII column and then granting the analyst a role that explicitly denies access to that tag (e.g., using a deny role or IAM deny policies), the analyst can query the dataset but will be blocked from viewing or querying the tagged column. This approach directly meets the requirement of read-only access while preventing access to the specific PII column.

Answer

Grant the analyst the roles/bigquery.user role, and use IAM conditions to deny access to the PII column.

Answer

Create a row-level access policy on the table that denies access to rows containing PII.

Answer

Grant the analyst the BigQuery Data Viewer role on the dataset, and create an authorized view that excludes the PII column.

Question 4

A security engineer is troubleshooting an issue where a Compute Engine VM cannot connect to a Cloud SQL instance that has a private IP address. Both resources are in the same VPC network. The VM's firewall rules allow egress to any destination, and the Cloud SQL instance's authorized networks include the VPC network. What is the most likely cause of the connection failure?

Accepted Answer

The VPC network does not have a private services access connection (VPC peering) to the Service Networking API.. Cloud SQL instances with private IP addresses require a private services access connection (VPC peering) between the VPC network and the Service Networking API's managed tenant project. Without this VPC peering, the VM cannot route traffic to the Cloud SQL instance's private IP, even if both are in the same VPC network. Option C directly identifies this missing prerequisite.

Answer

Private Google Access is not enabled on the subnet.

Answer

The VM's firewall rules block traffic to the Cloud SQL IP range.

Answer

The Cloud SQL instance requires the Cloud SQL Auth proxy to be installed on the VM.

Question 5

A company wants to use Cloud Armor to block traffic from specific countries to comply with data sovereignty requirements. They have a global HTTP Load Balancer configured. Where should they configure the Cloud Armor policy?

Accepted Answer

Attach to the backend service of the load balancer.. Cloud Armor policies must be attached to a backend service (or backend bucket) of a global HTTP(S) Load Balancer to filter traffic at the edge. This allows the policy to evaluate incoming requests based on geographic location before they reach the backend, enforcing data sovereignty rules without modifying VPC networking or firewall rules.

Answer

Attach to the VPC network that hosts the load balancer.

Answer

Configure as an Organization Policy constraint.

Answer

Configure as a firewall rule in the VPC network.

Question 6

Refer to the exhibit. A security engineer runs the command to view recent decrypt operations on a Cloud KMS key. The output shows a successful decryption. However, the engineer is concerned about the exposure of the plaintext. Based on the log entry, what is the most accurate statement regarding the visibility of the decrypted plaintext?

Accepted Answer

The plaintext field is redacted by Cloud KMS, and the actual plaintext is not visible in the log entry.. Option C is correct because Cloud KMS automatically redacts the plaintext field in Cloud Audit Logs for decrypt operations. The log entry shows a successful decryption, but the actual decrypted data is never written to the logs; instead, the plaintext field is replaced with a redacted marker (e.g., `[REDACTED]`). This is a security feature to prevent sensitive data from being exposed in audit logs, even to users with access to view them.

Answer

The plaintext field is not present in the log because the service does not log it.

Answer

The plaintext field contains the base64-encoded ciphertext, and the engineer needs to decode it.

Answer

The plaintext field contains the actual decrypted data in plaintext, and the engineer should restrict access to the logs.

Question 7

A healthcare organization is migrating sensitive patient data to Google Cloud and must comply with HIPAA. They plan to use Cloud SQL for MySQL with CMEK for encryption at rest. The security team is concerned about key management and access logging. Which additional measure should be implemented to meet HIPAA audit requirements?

Accepted Answer

Enable Data Access audit logs for the Cloud SQL instance and Cloud KMS key.. Option C is correct because HIPAA audit requirements mandate that access to protected health information (PHI) and the keys protecting it must be logged. Enabling Data Access audit logs on both the Cloud SQL instance and the Cloud KMS key captures read, write, and administrative operations, providing the necessary audit trail for compliance. Without these logs, the organization cannot demonstrate who accessed the data or the encryption keys, which is a core HIPAA requirement.

Answer

Configure VPC Service Controls to restrict access to the Cloud SQL instance.

Answer

Use Cloud DLP to de-identify the data before storing it in Cloud SQL.

Answer

Store the CMEK keys in Cloud HSM to meet FIPS 140-2 Level 3 requirements.

Question 8

A security engineer runs the command in the exhibit. The command fails with an error: 'Permission denied: cryptoKeyVersions.encrypt'. What is the most likely cause?

Accepted Answer

The user does not have the cloudkms.cryptoKeyVersions.encrypt permission on the key.. The error message 'Permission denied: cryptoKeyVersions.encrypt' explicitly indicates that the user lacks the cloudkms.cryptoKeyVersions.encrypt permission on the specific key version. In Google Cloud KMS, encrypt operations require the cloudkms.cryptoKeyVersions.encrypt permission (or a broader role like roles/cloudkms.cryptoKeyEncrypter) on the key resource. The command itself is syntactically correct, so the failure is due to insufficient IAM permissions, not resource existence or location.

Answer

The key ring 'my-keyring' does not exist.

Answer

The key ring location is incorrect.

Answer

The user does not have the cloudkms.cryptoKeyVersions.decrypt permission.

Question 9

A financial services company runs a sensitive application on Google Kubernetes Engine (GKE) with Workload Identity enabled. Security policy requires that only pods with a specific service account can access a Cloud Storage bucket containing customer data. The bucket has uniform bucket-level access enabled. What is the correct combination of IAM bindings to achieve this?

Accepted Answer

Bind the Google service account (linked to the Kubernetes service account via Workload Identity) to the bucket IAM policy with roles/storage.objectViewer. Workload Identity links a Kubernetes service account (KSA) to a Google service account (GSA). When a pod uses that KSA, it authenticates as the linked GSA. Since the bucket has uniform bucket-level access, IAM permissions must be granted directly on the bucket resource, not at the project level. Binding the GSA to the bucket with roles/storage.objectViewer ensures only pods using that specific KSA can read the bucket.

Answer

Add the Google service account as a member of the bucket with roles/storage.objectViewer

Answer

Grant the Google service account roles/storage.objectViewer at the project level

Answer

Bind the Kubernetes service account to the bucket IAM policy with roles/storage.objectViewer

Question 10

A company is migrating on-premises data to Cloud Storage. They have regulatory requirements to encrypt data using keys managed by their on-premises hardware security module (HSM). Which solution should they use?

Accepted Answer

Use Cloud External Key Manager (Cloud EKM) to reference keys in their on-premises HSM.. Cloud External Key Manager (Cloud EKM) allows you to use encryption keys stored in a supported on-premises HSM via a partner integration, meeting the regulatory requirement for key management outside of Google Cloud. This solution keeps the key material under your control while enabling Cloud Storage to encrypt data using those keys.

Answer

Use Cloud HSM to create and manage keys.

Answer

Use customer-supplied encryption keys (CSEK) for each object.

Answer

Use Cloud Key Management Service (Cloud KMS) with a key generated in the cloud.

Question 11

A security engineer reviews the IAM policy for a Cloud Storage bucket as shown in the exhibit. Alice reports that she cannot upload objects to the bucket, while Bob can view objects. What is the most likely issue?

Accepted Answer

The bucket has ACLs that deny Alice upload access.. Option A is correct because Cloud Storage buckets can have both IAM policies and Access Control Lists (ACLs) applied. If the bucket's ACL explicitly denies Alice the `WRITER` or `OWNER` permission, she will be unable to upload objects even if her IAM policy grants broader roles. Bob can view objects because his IAM role (e.g., `roles/storage.objectViewer`) is not overridden by a conflicting ACL, or his ACL entry grants `READER` access.

Answer

Alice has the objectViewer role but not the objectAdmin role.

Answer

Alice does not have the storage.buckets.getIamPolicy permission.

Answer

The objectAdmin role does not include the storage.objects.create permission.

Question 12

A healthcare organization stores PHI in BigQuery tables with row-level access policies. They need to ensure that data is automatically de-identified when exported to Cloud Storage for analytics. What is the most scalable solution with minimal manual intervention?

Accepted Answer

Use BigQuery data masking to define de-identification policies, then export the masked data directly.. Option D is correct because BigQuery data masking allows you to define column-level de-identification policies that are applied automatically at query time. When you export the masked data directly using an export job, the de-identification is enforced without additional scripting or post-processing, making it the most scalable and low-maintenance solution for PHI protection.

Answer

Set up VPC Service Controls to prevent data exfiltration and rely on access controls.

Answer

Create a scheduled query in BigQuery that exports data using a view with de-identification functions.

Answer

Use Cloud DLP API to scan and de-identify the export file after it is written to Cloud Storage.

Question 13

Refer to the exhibit. A security engineer runs this command to check bucket permissions. What is the most significant security issue?

Accepted Answer

The bucket allows public read access via 'allUsers' in both ACL and legacy role.. Option C is correct because the command output shows that the bucket has both an ACL granting 'allUsers' READER access and a legacy bucket role 'roles/storage.legacyBucketReader' assigned to 'allUsers'. This means the bucket is publicly readable via two independent mechanisms, which is the most significant security issue as it exposes all objects to the internet without authentication.

Answer

The domain example.com has viewer access, which may be too broad.

Answer

The legacy role 'roles/storage.legacyBucketReader' is used.

Answer

Uniform bucket-level access is disabled, allowing ACLs.

Question 14

A security engineer is configuring VPC Service Controls to protect a Google Cloud project containing sensitive data. The project uses Cloud Storage and BigQuery. The engineer wants to ensure that data cannot be exfiltrated to external IP addresses outside the perimeter, but internal users should still be able to access the data from on-premises via a VPN. Which configuration should be applied?

Accepted Answer

Add the project to a VPC Service Controls perimeter and configure an ingress rule to allow traffic from the on-premises VPN CIDR ranges. VPC Service Controls (VPC-SC) allow you to define a security perimeter around Google Cloud services like Cloud Storage and BigQuery, preventing data exfiltration to external IPs. By adding the project to a perimeter and configuring an ingress rule that permits traffic from the on-premises VPN CIDR ranges, internal users can access the data via VPN while all other external traffic is blocked. This meets the requirement of preventing exfiltration to external IPs while allowing authorized on-premises access.

Answer

Do not use VPC Service Controls; instead, rely on IAM permissions and firewall rules to control access

Answer

Create a separate perimeter that denies all traffic and apply it to the project

Answer

Add the project to a VPC Service Controls perimeter with no additional ingress rules

Question 15

A company runs a critical application on Compute Engine instances in a managed instance group (MIG) behind an external TCP/UDP Network Load Balancer. The security team requires that all traffic to the instances be inspected by a third-party next-generation firewall (NGFW) that is not yet deployed. Which architecture should the security engineer implement to meet the requirement with minimal disruption to traffic?

Accepted Answer

Deploy the NGFW as a Compute Engine instance in a separate instance group, and configure the load balancer to forward traffic to that instance group, which then forwards to the MIG.. Option A is correct because it inserts the NGFW as a middlebox in the traffic path without changing the existing load balancer or instance group configuration. The external TCP/UDP Network Load Balancer forwards traffic to the NGFW instance group, which then inspects and forwards packets to the backend MIG. This preserves the original client IP via proxy protocol or encapsulation, meets the security requirement, and minimizes disruption by avoiding reconfiguration of the existing MIG or load balancer type.

Answer

Change the load balancer type to Internal TCP/UDP Load Balancer and route traffic through the NGFW.

Answer

Replace the Network Load Balancer with a proxy-based load balancer that can integrate with the NGFW via Traffic Director.

Answer

Use Cloud NAT and route all egress traffic through the NGFW.

Question 16

A security engineer is investigating a potential data breach in a Google Cloud environment. The engineer suspects that a compromised service account key was used to access Cloud Storage buckets. Which TWO actions should the engineer take immediately to mitigate the risk?

Accepted Answer

Disable the service account. Disabling the service account immediately stops all access using any of its keys, including the compromised one, without deleting the account or its configuration. This is the fastest way to block the attacker while preserving the ability to investigate and re-enable the account later if needed. In Google Cloud, disabling a service account is a reversible action that revokes all authentication and authorization for that identity.

Answer

Revoke all IAM roles granted to the service account

Answer

Rotate the service account key

Answer

Enable Cloud Audit Logs for the service account

Question 17

A security engineer is designing a VPC Service Controls perimeter to protect a project containing sensitive data stored in Cloud Storage and BigQuery. The perimeter currently allows access from an on-premises data center via private connectivity (Cloud Interconnect). The business requires that a third-party SaaS application (outside the perimeter) be able to write data into a specific Cloud Storage bucket. Which action should the engineer take?

Accepted Answer

Create a service account for the SaaS application, grant it the Storage Object Creator role, and configure an access level that includes the service account. Then, add that access level to the perimeter's ingress policy.. Option B is correct because VPC Service Controls perimeters use ingress policies to explicitly allow access from outside the perimeter. By creating a service account for the SaaS application, granting it the Storage Object Creator role, and configuring an access level that includes that service account, the engineer can add the access level to the perimeter's ingress policy. This allows the external SaaS application to write data into the specific Cloud Storage bucket while still blocking all other external access, maintaining the security of the sensitive data.

Answer

Create a service account for the SaaS application and grant it the Storage Object Creator role; then add the service account to the perimeter's allowed identities.

Answer

Create an access level that includes the SaaS application's IP addresses and use that in the perimeter's ingress policy.

Answer

Add the SaaS application's external IP addresses to the perimeter's allowed IP ranges.

Question 18

A security engineer is designing a solution to monitor and detect anomalous IAM role usage across multiple Google Cloud projects. The engineer wants to create a centralized logging solution that captures all IAM policy changes and access attempts. Which THREE services should the engineer use together to achieve this?

Accepted Answer

BigQuery. BigQuery is correct because it serves as the centralized analytics destination for Cloud Audit Logs, enabling the security engineer to run SQL queries across IAM policy changes and access attempts from multiple Google Cloud projects. By exporting audit logs to BigQuery, you can perform complex aggregations and anomaly detection at scale, which is essential for monitoring IAM role usage across a fleet of projects.

Answer

Cloud Monitoring

Answer

Cloud Functions

Question 19

A security engineer is troubleshooting a connectivity issue between two VPCs connected via VPC Network Peering. VPC-A (project A) has a Compute Engine instance with internal IP 10.1.0.2. VPC-B (project B) has an instance with internal IP 10.2.0.2. The engineer has verified that the peering connection is active and the firewall rules allow ingress from 10.1.0.0/16. However, the instance in VPC-B cannot ping the instance in VPC-A. What is the most likely cause?

Accepted Answer

The VPC-B does not have a route to VPC-A's subnet ranges. Custom route exchange is not enabled on the peering connection.. The most likely cause is that custom route exchange is not enabled on the VPC Network Peering connection. By default, VPC peering does not exchange custom routes (including subnet routes) unless explicitly enabled. Without this, VPC-B has no route to the 10.1.0.0/16 subnet of VPC-A, so the instance in VPC-B cannot send traffic to 10.1.0.2, even though firewall rules allow ingress. The peering connection being active only means the link is established, not that routes are automatically propagated.

Answer

The VPC-A has a firewall rule that denies ICMP traffic from VPC-B.

Answer

The MTU configuration on the peering connection is set too low.

Answer

The instance in VPC-B does not have a public IP address.

Question 20

Refer to the exhibit. A Security Engineer is reviewing the IAM policy for a project. An administrator reports that a user named admin@example.com cannot create firewall rules, even though the command should allow it. According to the policy, what is the most likely reason?

Accepted Answer

The user has the 'compute.networkAdmin' role, which does not include permission to create firewall rules.. Option C is correct because the 'compute.networkAdmin' role in Google Cloud IAM does not include the 'compute.firewalls.create' permission required to create firewall rules. The user has this role, which grants permissions to manage network resources like subnets and routes, but firewall rule creation is a security function that requires the 'compute.securityAdmin' role.

Answer

The security-team group has the 'compute.securityAdmin' role, but the user is not in that group.

Answer

The user has the 'compute.instanceAdmin.v1' role, which conflicts with network admin permissions.

Answer

The IAM policy has an invalid etag, causing the policy to be rejected.