PCSE Practice Test 4 — 25 Questions

Question 1

A multinational corporation must comply with GDPR requirements for storing and processing personal data of EU citizens. The company is using Google Cloud and wants to ensure that data remains within the European Union. Which TWO actions should the organization take? (Select TWO.)

Accepted Answer

Set up VPC Service Controls to block access from outside the EU.. Option A is correct because VPC Service Controls create a security perimeter around Google Cloud resources, allowing you to restrict data access based on attributes like IP address or geographic location. By configuring VPC Service Controls to block access from outside the EU, the organization can enforce that data stored and processed in Google Cloud remains within the European Union, directly supporting GDPR compliance for data residency.

Answer

Enable Access Transparency logs to monitor access by Google support personnel.

Answer

Use Cloud Data Loss Prevention (DLP) to automatically redact personal data before storage.

Answer

Use CMEK with a key stored in Cloud HSM located in a US region to encrypt data.

Question 2

A company needs to meet a regulatory requirement that cryptographic keys for data at rest in Google Cloud must be managed in an on-premises HSM and never leave the HSM. Google Cloud services should be able to use those keys for encryption/decryption. Which solution should they implement?

Accepted Answer

Use Cloud External Key Manager (EKM) to connect to the on-premises HSM.. Cloud External Key Manager (EKM) allows you to use keys managed in a supported external key management system, such as an on-premises HSM, for Google Cloud services. The keys are used by Google Cloud for encryption and decryption but never leave the external HSM, satisfying the regulatory requirement that keys must remain on-premises.

Answer

Use Cloud HSM to protect keys imported from on-premises HSM.

Answer

Use Cloud KMS with automatic key rotation and store key versions on-premises.

Answer

Use customer-supplied encryption keys (CSEK) for each service.

Question 3

A financial institution uses Cloud HSM to protect cryptographic keys used for signing sensitive transactions. They want to ensure that keys are never exportable and that key usage is logged. Which key type should they create in Cloud HSM?

Accepted Answer

Purpose: ASYMMETRIC_SIGN with algorithm: RSA_SIGN_PKCS1_2048_SHA256. Option A is correct because Cloud HSM supports ASYMMETRIC_SIGN key purpose with RSA_SIGN_PKCS1_2048_SHA256, which creates a non-exportable key pair used for signing. Cloud HSM ensures the private key never leaves the HSM boundary, and all key usage is automatically logged via Cloud Audit Logs, meeting the requirements for non-exportability and logging.

Answer

Purpose: SYMMETRIC_ENCRYPT_DECRYPT with algorithm: GOOGLE_SYMMETRIC_ENCRYPTION

Answer

Purpose: ASYMMETRIC_DECRYPT with algorithm: RSA_DECRYPT_OAEP_2048_SHA256

Answer

Purpose: MAC with algorithm: HMAC_SHA256

Question 4

A multinational organization must ensure that data for European users is stored only within the European Union to comply with GDPR. They use Cloud Storage and BigQuery. Which design should they implement?

Accepted Answer

Set an organization policy with constraints/gcp.resourceLocations to restrict resource creation to EU regions.. Option C is correct because the organization policy constraint `gcp/resourceLocations` is the only design that proactively prevents data from being stored outside the EU. By setting this constraint to allow only EU regions (e.g., `europe-west1`, `europe-west4`), any attempt to create a Cloud Storage bucket or BigQuery dataset in a non-EU region will be denied at the API level, ensuring GDPR compliance by design.

Answer

Use Cloud DLP to inspect and tag data for European origin.

Answer

Use VPC Service Controls to create a perimeter around European resources.

Answer

Use Cloud Armor with geo-based access control to restrict access from non-EU locations.

Question 5

A company has a VPC with two subnets: subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). They have a firewall appliance (internal IP 10.0.1.100) that inspects all traffic between subnets. They configure a policy-based route to redirect traffic from subnet-a to subnet-b to the appliance. However, traffic from subnet-a to subnet-b still goes directly. What is missing?

Accepted Answer

A VPC route with priority 1000 (direct routing between subnets) is overriding the policy-based route with a lower priority.. B is correct because VPCs have an implicit default route for subnet-to-subnet traffic with a priority of 1000, which is higher than the priority of a policy-based route (typically 2000). Since the policy-based route has a lower priority (higher numerical value), the default route takes precedence, causing traffic to bypass the firewall appliance. To override this, the policy-based route must have a priority lower than 1000 (e.g., 500) to be preferred.

Answer

Compute Engine instances must have a custom route table to use policy-based routes.

Answer

A firewall rule is required to allow traffic to be redirected to the appliance.

Answer

The policy-based route must have the next hop IP set to the appliance's external IP.

Question 6

A company uses Shared VPC with host project and service projects. They want to ensure that only specific service projects can create firewall rules in the host project's network. What is the correct IAM configuration?

Accepted Answer

Grant the Compute Security Admin role to the service project's service accounts in the host project.. In a Shared VPC setup, the host project owns the network, and service projects connect to it. To allow a service project to create firewall rules in the host project's network, you must grant the Compute Security Admin role (which includes compute.firewalls.create) to the service project's service accounts at the host project level. This grants the necessary permissions on the host project's resources without giving broader network administration rights.

Answer

Grant the Compute Security Admin role to the service project's compute service account in the service project.

Answer

Grant the Compute Network Admin role to the service project's service accounts in the host project.

Answer

Create a custom role with compute.firewalls.create and grant it to the host project's compute service account.

Question 7

A company wants to restrict access to a Cloud SQL instance so that only Compute Engine instances in a specific VPC subnet can connect. Which THREE methods can be used to achieve this? (Choose THREE.)

Accepted Answer

Configure authorized networks with the subnet's CIDR range (if using public IP).. Option A is correct because authorized networks allow you to restrict access to a Cloud SQL instance with a public IP by specifying the CIDR range of the subnet. Only traffic originating from IP addresses within that range can connect to the instance, effectively limiting access to Compute Engine instances in that subnet.

Answer

Create a VPC firewall rule that blocks all traffic to the Cloud SQL instance's IP.

Answer

Use VPC Service Controls to limit access to the Cloud SQL instance.

Question 8

Which THREE of the following are required to enable VPC Flow Logs for a subnet? (Choose THREE.)

Accepted Answer

A subnet in the VPC. A subnet in the VPC is required because VPC Flow Logs capture IP traffic metadata at the subnet level. Without a subnet, there is no network segment to monitor, as flow logs are associated with a specific subnet within a VPC.

Answer

A sample rate

Answer

An aggregation interval

Question 9

You have a Compute Engine VM that hosts a custom application. The VM has a tag 'app-server' and is in a VPC network with the following firewall rules (priority order from lowest to highest):

Rule 1: Priority 1000, direction INGRESS, source 0.0.0.0/0, target tag 'app-server', protocol tcp:80, action allow
Rule 2: Priority 500, direction INGRESS, source 10.0.0.0/8, target tag 'app-server', protocol tcp:80, action deny
Rule 3: Priority 2000, direction INGRESS, source 192.168.0.0/16, target tag 'app-server', protocol tcp:80, action allow

A user from IP 10.0.0.5 tries to access the application on port 80. Will the request be allowed or denied?

Accepted Answer

Denied, because Rule 2 has a lower priority number and explicitly denies traffic from 10.0.0.0/8. Rule 2 has a priority of 500, which is lower (higher priority) than Rule 1 (priority 1000) and Rule 3 (priority 2000). Since the source IP 10.0.0.5 falls within the 10.0.0.0/8 range, Rule 2 matches first and explicitly denies the traffic. In Google Cloud VPC firewall rules, lower priority numbers are evaluated first, and the first matching rule determines the action.

Answer

Denied, because Rule 3 has a higher priority number and denies traffic from 192.168.0.0/16

Answer

Allowed, because Rule 1 has a lower priority number and allows all traffic

Answer

Allowed, because Rule 3 has a higher priority number and allows traffic from 192.168.0.0/16

Question 10

Your organization has a VPC with several subnets and wants to enable Private Google Access for Compute Engine instances in a specific subnet to access Google APIs and services without external IP addresses. What must be configured?

Accepted Answer

Enable Private Google Access on the subnet and ensure that instances have a default route (0.0.0.0/0) with next hop to the default internet gateway.. Option C is correct because Private Google Access requires two components: enabling it on the subnet and having a default route (0.0.0.0/0) pointing to the internet gateway. This route allows instances without external IPs to use the VPC's default internet gateway to reach Google APIs via the 199.36.153.4/30 address range, which is advertised by Google's private IP space. Without the default route, traffic from the subnet cannot reach the internet gateway, even with Private Google Access enabled.

Answer

Assign external IPs to the instances and create a firewall rule allowing egress to Google APIs.

Answer

Create a Cloud NAT gateway and enable Private Google Access on the subnet.

Answer

Enable Private Google Access on the subnet only.

Question 11

A company is implementing VPC Service Controls to protect sensitive data in Google Cloud Storage. They want to allow a private on-premises subnet (10.1.0.0/16) to access the storage buckets via a Cloud VPN tunnel, but deny all other on-premises traffic. Which configuration approach meets this requirement with least privilege?

Accepted Answer

Create a bridged access level that includes the private IP range 10.1.0.0/16 and a VPC network condition.. Option B is correct because VPC Service Controls use access levels to define which client identities or network sources can access protected services. By creating a bridged access level that includes both the private IP range 10.1.0.0/16 and a VPC network condition (the VPC connected via Cloud VPN), you ensure that only traffic originating from that specific on-premises subnet and arriving through the authorized VPC is allowed, denying all other on-premises traffic by default. This follows the least-privilege principle by not allowing broader IP ranges or relying on implicit denies.

Answer

Create a service perimeter that allows all traffic from on-premises, then an explicit deny rule for other IP ranges.

Answer

Configure Cloud NAT in the on-premises network and allow the NAT IP in an access level.

Answer

Create an access level with the IP range 10.1.0.0/16 and apply it to a service perimeter.

Question 12

An organization is configuring a Cloud Storage bucket for a regulated workload. The bucket configuration shown in the exhibit was applied. Which compliance requirement is this configuration primarily designed to address?

Accepted Answer

Data retention and immutability.. The bucket configuration includes object versioning enabled and a retention policy with a retention period. This combination ensures that objects cannot be deleted or overwritten before the retention period expires, addressing data retention and immutability requirements. This is a common compliance need for regulated workloads where data must be preserved in its original state for a defined duration.

Answer

Encryption at rest using customer-managed encryption keys (CMEK).

Answer

Access transparency for data access.

Answer

Data residency within a specific geographic region.

Question 13

A company uses Shared VPC with a host project and multiple service projects. The security team wants to enforce that only specific VMs in service project A (using IP range 10.0.1.0/24) can communicate with specific VMs in service project B (tagged as 'app-b') on TCP port 443, and all other inter-service-project traffic should be blocked. Additionally, VMs should still be accessible via IAP TCP forwarding (SSH) on TCP port 22. Which three firewall rules should be created in the host project? (Choose three.)

Accepted Answer

Priority 1000: Allow ingress from 10.0.1.0/24 to VMs with tag 'app-b' on TCP 443.. Option A is correct because it creates an ingress firewall rule in the host project that allows traffic from the specific IP range 10.0.1.0/24 (VMs in service project A) to VMs tagged 'app-b' in service project B on TCP port 443. In Shared VPC, all firewall rules are defined in the host project and apply to all service projects, so this rule enforces the required communication while the deny rule (Option B) blocks all other inter-service-project traffic. The IAP rule (Option E) is needed to allow SSH access via IAP TCP forwarding, which uses the source range 35.235.240.0/20 on TCP port 22.

Answer

Priority 1000: Allow ingress from IAP forwarding ranges to all VMs on all protocols.

Answer

Priority 1000: Allow egress from VMs in service project A to service project B's VMs on TCP 443.

Question 14

Which Google Cloud audit log captures administrator activity and is enabled by default?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs (option D) are enabled by default in Google Cloud and capture all administrator actions that modify the configuration or metadata of resources, such as creating a VM or changing IAM policies. These logs are essential for compliance and security auditing because they record 'who did what, where, and when' for management activities, and they cannot be disabled.

Answer

Policy Denied audit logs

Answer

System Event audit logs

Answer

Data Access audit logs

Question 15

Refer to the exhibit. An operations engineer configured this alert policy to notify when any VM instance in project my-project has high CPU utilization. However, no notifications are received even when CPU is consistently above 90% on multiple instances in us-central1-a. What is the most likely cause?

Accepted Answer

The alert policy is configured in a different project than the VM instances.. Option B is correct because alert policies are project-scoped resources. If the VM instances reside in a different project than the one where the alert policy is defined, the policy cannot monitor those instances. The MQL query references the metric `compute.googleapis.com/instance/cpu/utilization` which is only visible within the same project as the monitored resources. Cross-project monitoring requires additional configuration such as a metrics scope or a separate alert policy in the target project.

Answer

The 'duration' of 0s in the MQL condition prevents the alert from firing because it needs a minimum duration.

Answer

The MQL query uses 'group_by' which causes the condition to be evaluated on the aggregate, but the threshold should be applied before grouping.

Answer

The notification channel is not configured or is invalid.

Question 16

A security team wants to explicitly deny access to a Cloud Storage bucket for all users except the bucket owner. Currently, there are allow policies at the project level granting Storage Object Viewer to all users. What is the most efficient way to implement this?

Accepted Answer

Create an IAM deny policy on the bucket with a deny rule for all principals (principalSet: allUsers) and an exception for the bucket owner.. Option D is correct because Google Cloud IAM deny policies explicitly deny access to resources, overriding any allow policies. By creating a deny rule on the bucket with `principalSet: allUsers` as the denied principal and an exception for the bucket owner, you effectively block all users except the owner, regardless of project-level allow roles. This is the most efficient approach as it does not require modifying existing project-level policies or removing roles.

Answer

Create an Organization Policy that denies access to the bucket for all users except the owner.

Answer

Modify the project-level role to include a condition that only allows the bucket owner.

Answer

Remove the project-level Storage Object Viewer role and grant it only to the bucket owner.

Question 17

A company wants to implement least privilege access for a team that needs to monitor and manage Cloud Run services. Which two IAM roles should be considered? (Choose two.)

Accepted Answer

roles/run.viewer. Option C (roles/run.viewer) is correct because it grants read-only permissions to view Cloud Run services, configurations, and revisions, which is sufficient for monitoring without allowing modifications. Option D (roles/run.developer) is correct because it allows both viewing and managing Cloud Run services (e.g., deploying new revisions, updating configurations) while still restricting access to other GCP resources, aligning with least privilege for a team that needs to both monitor and manage.

Answer

roles/iam.serviceAccountUser

Answer

roles/run.admin

Answer

roles/run.invoker

Question 18

A security team needs to enforce that only requests originating from a corporate IP range (203.0.113.0/24) can access a Cloud Storage bucket containing sensitive data. They have created a custom IAM role with storage.objects.get permission and attached a condition that requires the request to have a specific IP address. However, some legitimate users outside the IP range are unable to access the data. What is the most likely cause?

Accepted Answer

The IAM condition evaluates after authentication, and users are already authenticated; the condition is not restricting based on source IP correctly because the condition is on the user's identity, not the request's source IP.. Option D is correct because IAM conditions on a custom role are evaluated after the user is authenticated and authorized by IAM. The condition attribute 'source.ip' is used to restrict access based on the request's originating IP address, but if the condition is incorrectly applied to the user's identity (e.g., using a condition that checks the user's IP at the time of policy evaluation rather than the request's source IP), it may not enforce the intended restriction. In this scenario, the condition is likely misconfigured to evaluate the user's identity attributes rather than the request's source IP, allowing authenticated users from any IP to access the bucket, while legitimate users outside the corporate IP range are blocked because the condition does not correctly filter based on the request's source IP.

Answer

Users must use a VPN to be assigned a corporate IP, but some are not connected.

Answer

The condition uses the attribute 'request.network' instead of 'source.ip'.

Answer

The bucket ACL is set to deny all access by default.

Question 19

An organization is designing a secure multi-tenant SaaS environment on GKE. They want to isolate tenant workloads using GKE namespaces and IAM. Which two steps should they take? (Choose two.)

Accepted Answer

Use Kubernetes RBAC to restrict access within namespaces.. Option C is correct because Kubernetes RBAC is the native mechanism for controlling access to resources within a namespace. By defining Role and RoleBinding objects, you can precisely restrict which tenant users can perform actions (e.g., get, list, create pods) inside their assigned namespace, ensuring logical isolation without requiring separate clusters.

Answer

Enable GKE Dataplane V2 for network isolation.

Answer

Grant cluster-level IAM roles to tenant users.

Answer

Create a separate GKE cluster per tenant.

Question 20

A Dataflow job launched by service account 'my-sa@...' fails with permission denied. The audit log shows the above entry. What missing role is causing the failure?

Accepted Answer

roles/iam.serviceAccountUser on the worker service account. When a Dataflow job fails with permission denied and the audit log shows the entry, the missing role is typically roles/iam.serviceAccountUser on the worker service account. This role is required because the Dataflow service (or the service account launching the job) must be able to impersonate the worker service account to execute the pipeline's tasks. Without this role, the job cannot assume the identity of the worker service account, leading to the permission denied error.

Answer

roles/iam.workloadIdentityUser on the worker service account

Answer

roles/iam.serviceAccountAdmin on the worker service account

Answer

roles/iam.serviceAccountTokenCreator on the worker service account