PCSE Practice Test 3 — 25 Questions

Question 1

You are designing a multi-tier application with a frontend and backend. The frontend instances are in subnet A (10.0.1.0/24), and the backend instances are in subnet B (10.0.2.0/24). Both subnets are in the same VPC. You want to allow the frontend to communicate with the backend on TCP port 8080, but the backend must not be able to initiate connections to the frontend. Additionally, the backend must be able to send patches to the internet. Which set of firewall rules should you implement?

Accepted Answer

Ingress rule on backend: allow tcp:8080 from subnet A; Egress rule on backend: allow all to internet. Option B is correct because the frontend in subnet A initiates connections to the backend on TCP port 8080, so an ingress rule on the backend allowing traffic from subnet A permits this. An egress rule on the backend allowing all traffic to the internet enables patch downloads. This setup prevents the backend from initiating connections to the frontend, as no egress rule on the backend targets the frontend, and no ingress rule on the frontend allows unsolicited traffic from the backend.

Answer

Ingress rule on frontend: allow tcp:8080 from backend's service account; Egress rule on backend: allow all to internet

Answer

Ingress rule on frontend: allow tcp:8080 from subnet B; Egress rule on backend: allow all to internet

Answer

Ingress rule on backend: allow tcp:8080 from subnet A; Egress rule on frontend: deny all to internet

Question 2

A company has a Cloud Storage bucket containing sensitive data. They want to ensure that only users with specific IAM roles can access the bucket, and that access is logged for audit purposes. They also want to prevent public access. Which configuration steps should they take?

Accepted Answer

Enable uniform bucket-level access, set IAM policies, and enable Cloud Audit Logs.. Option C is correct because enabling uniform bucket-level access disables ACLs, forcing all access decisions to be made by IAM policies alone, which simplifies permission management and prevents public access. Setting IAM policies ensures only users with specific roles can access the bucket, and enabling Cloud Audit Logs captures all access requests for audit purposes. This combination meets all requirements: no public access, role-based access control, and logging.

Answer

Use IAM roles only and enable Cloud Audit Logs, but keep ACLs enabled.

Answer

Use VPC Service Controls and enable Cloud Audit Logs.

Answer

Enable fine-grained access using ACLs and enable Cloud Audit Logs.

Question 3

A security engineer needs to protect sensitive data in BigQuery. The data includes columns with personally identifiable information (PII). They want to automatically mask PII data for users with the role 'analyst' but allow full access for 'admin' users. Which approach should they use?

Accepted Answer

Apply policy tags with data masking policies to PII columns and assign the tag to the analyst role.. Option D is correct because BigQuery's policy tags with data masking policies allow you to automatically mask sensitive columns (e.g., PII) at query time based on the user's role. You assign a masking policy to the policy tag, then attach that tag to the PII columns. By granting the 'analyst' role access to the tag with the masking rule applied, analysts see masked data, while 'admin' users (who have higher-level IAM permissions) see the full data without additional configuration.

Answer

Use VPC Service Controls to restrict access to the dataset.

Answer

Create authorized views that exclude PII columns for the analyst role.

Answer

Use column-level access control via IAM roles to deny access to PII columns for analysts.

Question 4

A company uses BigQuery to store sensitive data and wants to implement data masking using policy tags. They have three user groups: data_engineers (full access), data_analysts (masked PII), and data_scientists (masked financial data). Which THREE steps should they take?

Accepted Answer

Publish the taxonomy to make the policy tags available for use.. Option A is correct because after creating a taxonomy with policy tags in Cloud Data Catalog, you must publish the taxonomy to make those policy tags available for use in BigQuery. Publishing associates the taxonomy with the project and allows BigQuery to enforce data masking rules based on the policy tags applied to columns.

Answer

Apply only one policy tag per column.

Answer

Enable Cloud Audit Logs to track policy tag usage.

Question 5

A company stores sensitive customer data in Cloud Storage. They want to ensure that data is encrypted at rest using customer-managed encryption keys (CMEK) and that access to the key is audited. Which approach should they use?

Accepted Answer

Use CMEK with a Cloud KMS key and enable Cloud Audit Logs for the key.. Option D is correct because it combines customer-managed encryption keys (CMEK) via Cloud KMS with Cloud Audit Logs enabled on the key itself. This ensures the data is encrypted at rest using a key that the customer controls and rotates, and all operations against that key (e.g., encrypt, decrypt, enable, disable) are logged for auditing. Cloud Audit Logs on the bucket alone would not capture key access events, which is required for full auditability.

Answer

Use Google-managed encryption keys and enable Cloud Audit Logs for the bucket.

Answer

Use CMEK with key material stored in a Cloud Storage bucket.

Answer

Use customer-supplied encryption keys (CSEK) and store the keys in Secret Manager.

Question 6

Which THREE steps are required to implement field-level encryption for sensitive columns in a Cloud SQL for PostgreSQL database using Cloud KMS? (Choose three.)

Accepted Answer

Create a symmetric encryption key in Cloud KMS.. Option A is correct because Cloud KMS symmetric encryption keys are used to encrypt data encryption keys (DEKs) that protect the column data. In field-level encryption, the application or database encrypts each column value using a DEK, which is then wrapped (encrypted) by a Cloud KMS key. This ensures the sensitive data is encrypted at the application layer, independent of the underlying storage encryption.

Answer

Configure a Cloud HSM key to generate the data encryption key.

Answer

Enable CMEK on the Cloud SQL instance.

Question 7

A financial services company must store customer transaction records for 7 years to comply with SEC regulations. They currently use Cloud Storage with a lifecycle rule that deletes objects after 365 days. The compliance team needs to ensure that records are immutable and cannot be deleted or modified before the retention period expires. What should the security engineer do?

Accepted Answer

Enable Bucket Lock on the bucket and configure a retention policy of 7 years.. Option D is correct because Bucket Lock is the only Google Cloud Storage feature that enforces immutability by preventing object deletion or modification for a specified retention period. By enabling Bucket Lock and configuring a 7-year retention policy, the company ensures compliance with SEC regulations, as objects cannot be deleted or overwritten even by the bucket owner or lifecycle rules. This overrides the existing 365-day lifecycle rule because retention policies take precedence over lifecycle deletion actions.

Answer

Apply a retention policy to each object individually using object holds.

Answer

Use VPC Service Controls to restrict access to the bucket to only authorized compliance personnel.

Answer

Modify the lifecycle rule to delete objects after 2555 days instead of 365 days.

Question 8

You are a security engineer for a healthcare organization. You need to protect sensitive patient data stored in Cloud Storage. You want to ensure that data is encrypted at rest using a customer-managed key (CMEK) and that access to the key is logged. You also need to prevent data exfiltration by limiting which service accounts can decrypt data. Which TWO steps should you take? (Choose two.)

Accepted Answer

Configure a VPC Service Controls perimeter that includes the Cloud Storage bucket and the KMS key.. Option A is correct because VPC Service Controls creates a security perimeter around the Cloud Storage bucket and the KMS key, preventing data exfiltration by blocking unauthorized service accounts from decrypting data outside the perimeter. Option E is correct because creating a Cloud KMS key ring and key, configuring the bucket to use CMEK, and enabling Cloud Audit Logs for the KMS key ensures encryption at rest with a customer-managed key and logs all access to the key, meeting both requirements.

Answer

Use Cloud HSM to create and manage the encryption key, and disable Cloud Audit Logs for the HSM key.

Answer

Enable default encryption (Google-managed key) on the bucket and use Cloud Audit Logs to monitor access.

Answer

Use customer-supplied encryption keys (CSEK) and store the key in Cloud Key Management Service (KMS).

Question 9

A security engineer is configuring VPC Service Controls to protect a Google Cloud project containing sensitive data. The project contains Compute Engine instances, Cloud Storage buckets, and BigQuery datasets. The perimeter is defined with the project as a protected project. Which TWO actions are valid to restrict data exfiltration while maintaining necessary access?

Accepted Answer

Configure the service perimeter to allow access from the VPC network where the Compute Engine instances reside using private Google access.. Option B is correct because VPC Service Controls can allow traffic from a specific VPC network via private Google access, which uses RFC 1918 addresses and does not traverse the public internet. This restricts data exfiltration by ensuring that only resources within the defined VPC can access the protected services, while still allowing legitimate Compute Engine instances to reach Cloud Storage and BigQuery within the perimeter.

Answer

Use VPC Service Controls to block access to the Compute Engine metadata server to prevent credential extraction.

Answer

Create a service perimeter that includes all Google Cloud projects in the organization to simplify management.

Answer

Use VPC Service Controls to restrict access based on network tags on Compute Engine instances.

Question 10

A security engineer needs to set up access for a new team that will manage Cloud Storage buckets and objects. Which three IAM roles might be appropriate based on least privilege? (Choose three.)

Accepted Answer

roles/storage.objectAdmin. Option A (roles/storage.objectAdmin) is correct because it grants full control over objects in Cloud Storage buckets, including listing, reading, creating, and deleting objects, but does not allow modifying bucket-level permissions or deleting buckets. This aligns with least privilege for a team that needs to manage objects without full bucket administration.

Answer

roles/storage.legacyBucketOwner

Answer

roles/storage.admin

Question 11

A company is using Cloud Armor to protect their HTTP(S) load balancer. They have configured a security policy with a rule to block traffic from a specific IP address (10.0.0.1/32). During testing, they observe that requests from that IP are still reaching the backend. What is the most likely reason?

Accepted Answer

The security policy is not attached to the backend service.. Cloud Armor security policies must be explicitly attached to a backend service to take effect. If the policy is not attached, the rules within it—including the block rule for 10.0.0.1/32—are not evaluated, and traffic flows to the backend as if no policy exists. This is the most common cause when a configured rule appears to be ignored.

Answer

The backend service is configured to bypass Cloud Armor.

Answer

Cloud Armor does not support blocking specific IP addresses.

Answer

The rule has a lower priority than a default allow rule.

Question 12

A company needs to retain audit logs for 7 years to meet regulatory compliance. They are using Cloud Logging. Which log storage strategy should they use to minimize costs while meeting the requirement?

Accepted Answer

Use a log sink to export logs to Cloud Storage with a retention policy of 7 years and nearline storage class.. Option C is correct because exporting logs to Cloud Storage via a log sink allows you to set a bucket retention policy of 7 years, meeting compliance requirements. Using the nearline storage class minimizes costs for logs that are accessed infrequently, as it offers lower storage costs than standard storage while still providing the necessary durability and retention capabilities.

Answer

Store logs in the _Required log bucket with a custom retention of 7 years.

Answer

Disable logging for non-critical resources to reduce log volume and retain only essential logs.

Answer

Use a log sink to export logs to BigQuery and set the table expiration to 7 years.

Question 13

A company needs to comply with the General Data Protection Regulation (GDPR). They are using BigQuery to store personal data. Which THREE measures should they implement to meet GDPR requirements?

Accepted Answer

Enable audit logs via Cloud Audit Logs to track access to personal data.. Option A is correct because Cloud Audit Logs provide a comprehensive, immutable record of all administrative and data access activities in BigQuery, which is essential for demonstrating GDPR compliance through accountability and traceability. By enabling audit logs, the company can track who accessed personal data, when, and from where, fulfilling the GDPR requirement to maintain records of processing activities.

Answer

Use Cloud KMS to encrypt individual columns containing personal data.

Answer

Store data in a multi-region location like 'EU' to ensure availability across regions.

Question 14

A financial services company is deploying a multi-region application on Google Kubernetes Engine (GKE) and needs to comply with PCI DSS. They must ensure that cardholder data is encrypted in transit between pods in different clusters. What is the MOST secure way to achieve this?

Accepted Answer

Enable Anthos Service Mesh with mutual TLS (mTLS) across clusters.. Option B is correct because Anthos Service Mesh with mutual TLS (mTLS) provides authenticated and encrypted communication between pods across different GKE clusters, meeting PCI DSS encryption-in-transit requirements. mTLS ensures that each side of the connection presents a certificate, verifying identity and encrypting traffic at the application layer, which is more secure than relying solely on network-level encryption. This approach also integrates with GKE's multi-cluster service mesh capabilities, allowing fine-grained policy enforcement across clusters.

Answer

Configure TLS for each service using a Cloud Load Balancing with SSL policies.

Answer

Use HTTPS between services by configuring ingress with a Google-managed SSL certificate.

Answer

Use VPC Network Peering to connect the clusters and rely on the internal network encryption.

Question 15

Refer to the exhibit. A security engineer reviews the IAM policy for a service account. What is the effect of the condition?

Accepted Answer

The user can only use the service account before December 31, 2025.. Option D is correct because the condition in the IAM policy uses the `request.time` attribute with a date/time comparison operator, which is a supported variable in IAM conditions. The condition `StringEquals` with `request.time` and a specific date (e.g., `2025-12-31T23:59:59Z`) restricts access to only before that timestamp, effectively granting access only until December 31, 2025. This is a common pattern for time-based access control in cloud IAM policies.

Answer

The user can only use the service account when the request originates from a specific IP range.

Answer

The condition has no effect because request.time is not a supported variable in IAM conditions.

Answer

The user can only use the service account when the resource is in a specific region.

Question 16

A multinational company is migrating sensitive workloads to Google Cloud and must comply with GDPR data residency requirements. Which TWO actions ensure data remains stored only within the European Union? (Choose TWO.)

Accepted Answer

Define an Organization Policy with constraints/gcp.resourceLocations to allow resource creation only in EU regions.. Option D is correct because the Organization Policy constraint `gcp.resourceLocations` explicitly restricts the Google Cloud regions where resources can be created. By setting this constraint to allow only EU regions (e.g., `europe-west1`, `europe-west4`), you enforce that all new resources are provisioned within the European Union, directly meeting GDPR data residency requirements. This policy is evaluated at resource creation time and prevents any resource from being deployed outside the allowed locations.

Answer

Enable Cloud Audit Logs with export to a BigQuery dataset in the EU region.

Answer

Use Cloud Data Loss Prevention (DLP) to scan for sensitive data and verify it remains in the EU.

Answer

Use Customer-Managed Encryption Keys (CMEK) stored in a Cloud KMS key ring located in the EU.

Question 17

A security auditor needs to review all IAM policy changes made in the last 30 days across multiple projects. The auditor has the Organization Viewer role at the organization level. What is the most efficient way to provide access without giving unnecessary permissions?

Accepted Answer

Grant the auditor the roles/iam.securityReviewer role at the organization level.. Option D is correct because the roles/iam.securityReviewer role at the organization level grants read-only access to all IAM policies and audit logs across all projects in the organization, without granting any write or management permissions. This allows the auditor to review IAM policy changes efficiently without needing per-project assignments.

Answer

Grant the auditor the Logs Viewer role at the organization level to view audit logs of IAM changes.

Answer

The existing Organization Viewer role already provides access to IAM policies across all projects.

Answer

Grant the auditor the Project Viewer role on each project.

Question 18

A multinational organization must store customer data only in specific geographic regions to comply with data residency regulations. They use Cloud Spanner for their primary database. What should they do to enforce that data is stored only in approved regions?

Accepted Answer

Apply an organization policy with a constraint that restricts the location of Cloud Spanner resources to approved regions.. Organization policies with resource location constraints allow you to enforce that Cloud Spanner instances are created only in approved geographic regions. This policy is evaluated at resource creation time and prevents the deployment of Spanner instances outside the specified regions, directly addressing data residency compliance requirements.

Answer

Create a Cloud Spanner instance in the desired region and configure a backup in a different region for disaster recovery.

Answer

Configure a VPC Service Controls perimeter to restrict access to Cloud Spanner.

Answer

Use Cloud Spanner with data residency constraints by selecting a multi-region configuration that includes only approved regions.

Question 19

Which THREE of the following are valid requirements for using VPC Network Peering? (Choose three.)

Accepted Answer

Subnet routes are automatically exchanged between the peered VPCs.. Option B is correct because VPC Network Peering automatically exchanges subnet routes between the peered VPCs, enabling private IP connectivity without requiring additional route tables or VPN gateways. This route exchange is implicit once the peering connection is established, provided the networks do not have overlapping CIDR blocks.

Answer

Cloud NAT must be configured in at least one VPC.

Answer

An IAM role with compute.networkAdmin must be granted to all users.

Question 20

An application needs to authenticate to Google Cloud APIs from an on-premises server. Which approach is recommended for long-lived access?

Accepted Answer

Create a service account key and store it securely on the server.. Option D is correct because service account keys provide a long-lived, static credential that can be securely stored on an on-premises server for authenticating to Google Cloud APIs. Unlike user accounts or OAuth flows, service account keys do not require interactive login or token refresh, making them suitable for automated, long-running workloads.

Answer

Use a user account with OAuth 2.0 tokens.

Answer

Use workload identity federation with an on-premises identity provider.

Answer

Use API keys.