PCSE Practice Test 3 — 25 Questions

Question 1

An organization needs to enforce that all new Cloud Storage buckets are created only in the europe-west1 region to meet data residency requirements. Which method should they use?

Accepted Answer

Configure an organization policy with the constraint gcp.resourceLocations to allow only europe-west1.. Organization policies with the `gcp.resourceLocations` constraint allow you to restrict the physical location of resources at the organization, folder, or project level. This is the correct method because it enforces that all new Cloud Storage buckets (and other supported resources) can only be created in the specified region, meeting data residency requirements without relying on IAM conditions or bucket-level policies.

Answer

Assign the roles/storage.admin IAM role with a condition that restricts region.

Answer

Use Assured Workloads to enforce data residency.

Answer

Define a bucket policy that allows only europe-west1.

Question 2

Your organization wants to ensure that no Compute Engine instance can have a public IP address. What is the best way to enforce this policy?

Accepted Answer

Use an Organization Policy with the constraint `compute.vmExternalIpAccess`. The Organization Policy constraint `compute.vmExternalIpAccess` is a native Google Cloud policy that can be applied at the project, folder, or organization level to explicitly deny the assignment of external IP addresses to Compute Engine instances. This policy is enforced at the resource creation time, preventing any instance from being launched with a public IP, and it cannot be overridden by project-level IAM permissions, making it the most direct and effective enforcement mechanism.

Answer

Use Cloud Audit Logs to monitor and alert on instances with public IPs

Answer

Use a firewall rule that blocks traffic from 0.0.0.0/0

Answer

Use a Service Perimeter from VPC Service Controls

Question 3

A company is implementing data loss prevention (DLP) for BigQuery. Which THREE capabilities are provided by Cloud DLP? (Choose THREE.)

Accepted Answer

Redacting sensitive data in query results.. Cloud DLP can inspect and redact sensitive data directly in BigQuery query results. When you configure a DLP job or use the DLP API with BigQuery, you can specify infoTypes to detect and then redact matching values before returning the results to the user, preventing exposure of sensitive information like credit card numbers or PII.

Answer

Auditing all queries that access sensitive columns.

Answer

Encrypting entire tables with customer-managed keys.

Question 4

A security engineer wants to ensure that no IAM keys are created for service accounts in a Google Cloud organization. Which organization policy constraint should be applied?

Accepted Answer

constraints/iam.disableServiceAccountKeyCreation. The `constraints/iam.disableServiceAccountKeyCreation` organization policy constraint specifically prevents the creation of IAM keys for service accounts, which is exactly what the security engineer needs to enforce. This constraint, when applied at the organization level, blocks all users from creating or uploading service account keys, ensuring that no long-lived credentials are generated for service accounts.

Answer

constraints/compute.restrictCloudArmorPolicies

Answer

constraints/compute.requireShieldedVm

Answer

constraints/iam.allowedPolicyMemberDomains

Question 5

A security engineer needs to run a penetration test against their Google Cloud environment. According to Google's Acceptable Use Policy, which of the following is true regarding penetration testing?

Accepted Answer

Penetration testing is allowed without prior approval for most services, but DoS attacks are prohibited.. Google Cloud's Acceptable Use Policy permits customers to perform penetration testing against most of their own Google Cloud resources without prior approval, but explicitly prohibits Denial of Service (DoS) and Distributed Denial of Service (DDoS) testing, as well as testing that could impact other customers or Google's infrastructure. This aligns with the shared responsibility model: customers may test their own deployments but must not attack shared infrastructure.

Answer

Penetration testing is not allowed against any Google Cloud resources.

Answer

Denial of Service (DoS) testing is allowed with prior notification to Google.

Answer

All penetration tests require prior approval from Google Cloud Support.

Question 6

During an incident, a security engineer needs to isolate a compromised Compute Engine instance for forensic analysis without losing evidence. What should they do first?

Accepted Answer

Create a snapshot of the instance's persistent disks.. Creating a snapshot of the instance's persistent disks captures the forensic state of the compromised VM (memory-excluded but disk-resident evidence) before any remediation action alters it. This preserves evidence for later analysis while still allowing the instance to be isolated. It is the correct first step because it is non-destructive and reversible, unlike shutdown or deletion.

Answer

Disconnect the instance from the VPC network.

Answer

Shut down the instance immediately.

Answer

Delete the instance to prevent further damage.

Question 7

A developer needs to deploy a web application on Compute Engine that must access Cloud Storage buckets. The best practice for providing credentials to the VM is to:

Accepted Answer

Create a service account with the required roles and attach it to the Compute Engine instance.. Attaching a user-managed service account directly to the Compute Engine instance is the recommended best practice because the VM then obtains short-lived OAuth 2.0 access tokens automatically from the metadata server (http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token). No long-lived credentials are stored on disk, and access can be revoked centrally by changing IAM roles or detaching the service account. This follows the principle of least privilege and avoids key sprawl.

Answer

Generate a JSON key for a service account and store it on the instance.

Answer

Use the Compute Engine default service account and grant it the required roles.

Answer

Store the user's personal credentials in the instance metadata.

Question 8

A healthcare analytics team stores protected health information (PHI) in Cloud Storage buckets. They need to ensure that PHI is de-identified before it is written to the bucket, and they want to monitor for any accidental uploads of raw PHI. They are using Cloud DLP for inspection and de-identification. Which approach should they implement to meet both requirements?

Accepted Answer

Use Cloud DLP's de-identify API in a Cloud Function that is triggered by Cloud Storage object finalize events, so that each newly uploaded object is inspected and de-identified before being made available, and set up a DLP job to scan the bucket for any raw PHI that might have been missed.. De-identifying data before it is written requires an inline transformation at the time of upload. Cloud DLP's de-identify API can be invoked from a Cloud Function triggered by object finalize events, ensuring each object is processed before it becomes available. A supplementary DLP job scanning the bucket provides detection for any missed raw PHI. The other options either operate after the fact or misuse unrelated features.

Answer

Enable Cloud Storage bucket lock and Object Versioning, and configure a Cloud DLP inspection job to run every hour; if raw PHI is found, restore the previous object version to remove the PHI.

Answer

Configure a Cloud DLP de-identify template and apply it via a Cloud Storage bucket-level DLP job that runs on a schedule to de-identify existing objects, and rely on that job to also prevent future raw PHI uploads.

Answer

Create a Cloud DLP de-identify template and attach it to the bucket using a VPC Service Controls perimeter, which will automatically de-identify data as it is written and block any raw PHI uploads.

Question 9

A security engineer needs to monitor network traffic for potential threats in a VPC. They want to inspect all traffic for malware signatures and alert on high-severity threats. The solution should be natively integrated with GCP. Which service should they use?

Accepted Answer

Cloud IDS. Cloud IDS is Google Cloud's native intrusion detection service that inspects VPC traffic for malware, spyware, and command-and-control signatures, and generates alerts in Security Command Center. It is purpose-built for the requirement to inspect all traffic for malware signatures and alert on high-severity threats with native GCP integration.

Answer

VPC Flow Logs

Answer

Security Command Center

Answer

Cloud Armor

Question 10

A security team wants to block all incoming traffic from a specific country to their web application behind a global HTTPS load balancer. They also need to allow traffic from all other countries. Which Cloud Armor feature should be used?

Accepted Answer

Custom rule with geo-based condition. Cloud Armor custom rules support geo-based conditions using the origin.ip or, more precisely, the 'origin.region_code' expression, which maps to ISO 3166-1 alpha-2 country codes. A custom rule with a geo-based condition and a deny action (priority lower than the allow-all rule) blocks traffic from the specified country while allowing all others. This is the standard Cloud Armor pattern for country-level filtering on a global external HTTPS load balancer.

Answer

Rate limiting

Answer

Preconfigured WAF rules

Answer

Adaptive Protection

Question 11

A company's security policy requires that all traffic to a Google Cloud load balancer use TLS 1.2 or higher and only accept strong ciphers. They want to enforce this using a Google Cloud resource. Which resource should they configure?

Accepted Answer

SSL policy. SSL policies on HTTPS load balancers allow you to specify the minimum TLS version and cipher profile (e.g., RESTRICTED for strong ciphers). This enforces encryption requirements at the load balancer level.

Answer

Cloud Armor security policy

Answer

Network firewall rule

Answer

SSL certificate

Question 12

A company is migrating its on-premises Microsoft Active Directory to Google Cloud using Managed Microsoft AD (Microsoft AD). They need to ensure that users can authenticate to Compute Engine Windows instances using their on-premises credentials without additional user setup. What is the most secure and scalable approach?

Accepted Answer

Create a two-way trust between the Managed Microsoft AD domain and the on-premises AD domain.. Establishing a two-way trust between Managed Microsoft AD and the on-premises AD domain allows users to authenticate to Compute Engine Windows instances using their existing on-premises credentials without any additional user setup. This trust enables Kerberos authentication to flow seamlessly across the two domains, ensuring that on-premises users can access cloud resources securely and scalably without duplicating identities or credentials.

Answer

Configure the Windows instances to join the on-premises AD domain directly via VPN.

Answer

Synchronize on-premises users to Managed Microsoft AD using Google Cloud Directory Sync (GCDS).

Answer

Store on-premises user credentials in Cloud KMS and use a custom authentication script.

Question 13

A company stores sensitive customer data in Cloud Storage. They want to ensure that data is encrypted at rest using customer-managed encryption keys (CMEK) and that access to the key is audited. Which approach should they use?

Accepted Answer

Use CMEK with a Cloud KMS key and enable Cloud Audit Logs for the key.. It combines customer-managed encryption keys (CMEK) via Cloud KMS with Cloud Audit Logs enabled on the key itself. This ensures the data is encrypted at rest using a key that the customer controls and rotates, and all operations against that key (e.g., encrypt, decrypt, enable, disable) are logged for auditing. Cloud Audit Logs on the bucket alone would not capture key access events, which is required for full auditability.

Answer

Use Google-managed encryption keys and enable Cloud Audit Logs for the bucket.

Answer

Use CMEK with key material stored in a Cloud Storage bucket.

Answer

Use customer-supplied encryption keys (CSEK) and store the keys in Secret Manager.

Question 14

A financial services company needs to inspect all inbound and outbound packets from a subnet containing highly sensitive data for compliance. They have enabled VPC Flow Logs on that subnet, which record metadata such as source and destination IP, ports, and protocol. However, the security team requires the actual packet payload to perform deep packet inspection (DPI) for malicious patterns. They want to capture the packets without disrupting network traffic. Which additional configuration should be implemented to meet this requirement?

Accepted Answer

Enable Packet Mirroring on a Compute Engine instance in the subnet to mirror all packets to a collector instance.. Packet Mirroring clones all packets (including payload) from a source instance in the subnet and forwards them to a collector instance for deep packet inspection, without disrupting the original traffic flow. VPC Flow Logs only capture metadata (headers, timestamps) and cannot include payload content, making Packet Mirroring the only solution that meets the requirement for actual packet payload capture.

Answer

Configure Cloud Armor to log all HTTP requests with full request body.

Answer

Enable VPC Flow Logs with metadata capture set to 'include payload'.

Answer

Enable Cloud NAT logging to capture all outbound traffic payloads.

Question 15

An organization has a deny policy at the folder level that denies the permission resourcemanager.projects.create. A user has an allow policy at the project level granting roles/owner. What is the effective permission for the user to create projects in that project?

Accepted Answer

The user cannot create projects because the deny policy at the folder level explicitly denies the permission.. In Google Cloud IAM, deny policies always override allow policies regardless of where they sit in the resource hierarchy. A deny policy at the folder level that denies resourcemanager.projects.create will block the permission even though the user has roles/owner at the project level, because deny takes precedence over allow.

Answer

The user cannot create projects because the deny policy is at a higher level in the hierarchy.

Answer

The user can create projects because Owner role includes all permissions.

Answer

The user can create projects if the project-level allow is more specific.

Question 16

A healthcare organization is migrating to Google Cloud and needs to store Protected Health Information (PHI) in Cloud Storage. They have signed a Business Associate Agreement (BAA) with Google. Which additional step is REQUIRED to ensure HIPAA compliance for the data stored?

Accepted Answer

No additional action is required; Cloud Storage is HIPAA-eligible and encrypts data at rest by default.. Cloud Storage is a HIPAA-eligible service under Google Cloud's BAA, and it encrypts all data at rest by default using AES-256. Once a BAA is in place, no additional configuration is strictly required to store PHI in Cloud Storage from a HIPAA compliance standpoint — encryption at rest and in transit is automatic. Organizations may choose CMEK or other controls for policy reasons, but they are not required for HIPAA eligibility.

Answer

Use Customer-Managed Encryption Keys (CMEK) for the bucket.

Answer

Configure the bucket to be in a VPC with no public access.

Answer

Enable Object Versioning on the bucket.

Question 17

A security team needs to apply a set of firewall rules that enforce baseline security for all VPC networks across multiple projects in an organization. These rules must be inherited and cannot be overridden by project-level rules. What should they use?

Accepted Answer

Hierarchical firewall policies. Hierarchical firewall policies can be applied at the organization or folder level and are inherited by all VPC networks in the hierarchy. They cannot be overridden by lower-level firewall rules, making them ideal for baseline security policies. Network firewall policies are applied to a specific VPC network. VPC firewall rules are per project and can be overridden.

Answer

VPC firewall rules

Answer

Network firewall policies

Answer

Cloud Armor security policies

Question 18

A financial services company uses BigQuery for analytics and needs to implement column-level security such that users with the role 'data_scientist' can see the last four digits of credit card numbers, while the full number is visible only to 'data_owner'. What approach should they use?

Accepted Answer

Use a policy tag with a data masking rule that masks the full number except last four digits, and grant UNMASKED access to data_owner and MASKED access to data_scientist.. BigQuery's policy tags with data masking rules allow you to define column-level masking policies. By creating a masking rule that reveals only the last four digits of the credit card number, you can grant the `data_scientist` role MASKED access (which applies the mask) and the `data_owner` role UNMASKED access (which bypasses the mask). This approach enforces column-level security without duplicating data or using row-level filters.

Answer

Set an IAM condition on the table that filters the column based on the user's role.

Answer

Use row-level security to restrict rows based on role.

Answer

Create two separate BigQuery tables (one with masked data, one with full data) and grant access based on role.

Question 19

A security engineer is designing a solution to monitor and detect anomalous IAM role usage across multiple Google Cloud projects. The engineer wants to create a centralized logging solution that captures all IAM policy changes and access attempts. Which THREE services should the engineer use together to achieve this?

Accepted Answer

BigQuery. BigQuery is correct because it serves as the centralized analytics destination for Cloud Audit Logs, enabling the security engineer to run SQL queries across IAM policy changes and access attempts from multiple Google Cloud projects. By exporting audit logs to BigQuery, you can perform complex aggregations and anomaly detection at scale, which is essential for monitoring IAM role usage across a fleet of projects.

Answer

Cloud Monitoring

Answer

Cloud Functions

Question 20

A company uses Cloud KMS with automatic rotation enabled for a symmetric key. The rotation period is set to 90 days. After 90 days, a new key version is created. The compliance team asks: what happens to data encrypted with the old key version?

Accepted Answer

The old key version remains available for decryption of existing data.. When Cloud KMS rotates a symmetric key, it creates a new key version but does not delete or disable the old version. The old key version remains enabled and available for decryption, so data encrypted with it can still be decrypted. New encryptions use the new primary version, but existing ciphertext is unaffected.

Answer

The old key version is immediately disabled, and all data must be re-encrypted.

Answer

Data encrypted with the old key is automatically re-encrypted with the new key.

Answer

The old key version is deleted after the rotation period.