PCSE Practice Test 4 — 25 Questions

Question 1

A financial services company must ensure that all data stored in Cloud Storage is encrypted with customer-managed encryption keys (CMEK) that are rotated every 90 days. They have enabled Organization Policy constraints to enforce CMEK. However, some new buckets are still being created without CMEK. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Organization Policy constraint is not applied to the folder that contains the project.. Organization Policy constraints are hierarchical and must be applied at the project, folder, or organization level to take effect. If the constraint is applied only at the organization level but the project resides in a folder that does not inherit the policy (or the constraint is not applied to that folder), the policy will not enforce CMEK on buckets created in that project. This explains why new buckets can still be created without CMEK despite the policy being enabled elsewhere.

Answer

VPC Service Controls are blocking the use of CMEK.

Answer

The buckets are created using a service account that has the CMEK permission but the key ring is not in the same region.

Answer

The buckets are using the Archive storage class, which does not support CMEK.

Question 2

A financial institution is deploying a PCI DSS-compliant web application on Google Cloud. They need to isolate the cardholder data environment (CDE) from other environments and protect the web application against common web attacks. Which combination of services meets these requirements?

Accepted Answer

VPC Service Controls and Cloud Armor. VPC Service Controls create a perimeter around Google Cloud resources to prevent data exfiltration. Cloud Armor is a web application firewall that protects against OWASP Top 10 attacks. Together they isolate the CDE and protect the application. Cloud IDS is for network threat detection, not isolation. Cloud NAT provides outbound internet access, not security. Cloud Load Balancing distributes traffic but does not isolate.

Answer

Cloud NAT and Cloud IDS

Answer

Identity-Aware Proxy (IAP) and Cloud Storage

Answer

Shared VPC and Cloud Load Balancing

Question 3

A company has a global HTTPS load balancer and wants to use a self-managed SSL certificate. They have uploaded the PEM-encoded certificate and private key to the load balancer. However, the certificate is about to expire. What is the correct way to renew it without downtime?

Accepted Answer

Create a new SSL certificate resource with the new certificate and key, then update the target HTTPS proxy to use it. To renew a self-managed certificate, you create a new SSL certificate resource with the updated certificate and key, and then update the load balancer's target HTTPS proxy to use the new certificate. This can be done without downtime by updating the proxy.

Answer

Use gcloud compute ssl-certificates update to replace the certificate

Answer

Update the existing SSL certificate resource with the new certificate and key

Answer

Delete the existing certificate and upload the new one with the same name

Question 4

A company needs to grant developers the ability to deploy applications to App Engine, but they should not be able to modify IAM policies. Which two roles should be assigned to the developers? (Choose two.)

Accepted Answer

roles/appengine.serviceAdmin. The correct roles are App Engine Deployer and App Engine Service Admin. App Engine Admin includes IAM policy modification.

Answer

roles/owner

Answer

roles/appengine.appViewer

Answer

roles/appengine.appAdmin

Question 5

During a security incident, a forensics team needs to capture a disk snapshot of a compromised Compute Engine instance for analysis. They want to ensure the snapshot is consistent and includes data in memory. Which step should be taken before taking the snapshot?

Accepted Answer

Stop the instance before taking the snapshot. For consistent snapshots of a running instance, you should first stop the instance (or at least freeze the filesystem). To capture memory, you would need to use a tool like LiME or dump the memory via a hypervisor; standard disk snapshots do not capture memory. However, the question asks about disk snapshot consistency; the best practice is to stop the instance.

Answer

Take a snapshot while the instance is running; consistency is automatic

Answer

Enable VPC Flow Logs on the network

Answer

Create an image from the disk first

Question 6

Refer to the exhibit. A compliance officer is reviewing an Access Transparency log entry. Which compliance benefit does this log provide?

Accepted Answer

It provides evidence of data access by Google engineers. Access Transparency logs are specifically designed to provide visibility into actions performed by Google personnel (e.g., engineers) on customer data. This log entry shows an operation by a Google support engineer, which directly supports compliance requirements by providing evidence of data access by Google engineers, as required for regulatory audits like SOC 2 or FedRAMP.

Answer

It shows a user accessing a storage object

Answer

It tracks encryption key usage

Answer

It is a Cloud Audit Log for admin activity

Question 7

A company wants to demonstrate to an auditor that all data access requests to a Cloud Storage bucket are logged, but they must exclude a specific service account from logging to reduce noise. What should they do to remain compliant with their audit policy?

Accepted Answer

Enable Data Access audit logs without exempting any service accounts. Enabling Data Access audit logs without exempting any service accounts ensures that all data access requests to the Cloud Storage bucket are logged, meeting the auditor's requirement. Exempting a service account (as in Option A) would violate the policy by excluding its requests from the logs entirely. Cloud Logging exclusion filters (Option D) operate after ingestion and cannot guarantee compliance, as the auditor may require logs to be captured in the first place.

Answer

Enable Data Access audit logs with exempted members set to that service account

Answer

Configure VPC Service Controls to block the service account from accessing the bucket

Answer

Use Cloud Logging exclusion filters to filter out the service account logs after ingestion

Question 8

A company enforces Binary Authorization on a GKE cluster. They want to require that all container images be signed by a specific attestor located in a different project. What must be configured?

Accepted Answer

A policy that requires attestation, an attestor in the same or different project, and a service account on the GKE node with the appropriate IAM permissions to access the attestor.. Binary Authorization allows attestors in different projects. The key requirement is the proper IAM role (roles/binaryauthorization.attestorsVerifier) on the GKE service account.

Answer

A Binary Authorization policy that allows all images, and an attestor with the same name in both projects.

Answer

A Cloud KMS key for the attestor in the same project as the cluster, and a policy that requires attestation.

Answer

A policy that denies all images, and a separate attestor for each project.

Question 9

A company wants to encrypt data at rest in Cloud Storage using a key that they manage and rotate periodically. They also need to ensure that the key material is stored in a FIPS 140-2 Level 3 validated HSM. Which encryption option should they use?

Accepted Answer

Customer-managed encryption keys (CMEK) using Cloud HSM. CMEK with Cloud HSM uses customer-managed keys stored in a FIPS 140-2 Level 3 HSM. GMEK uses Google-managed keys, CSEK requires the customer to supply the key with each API call and Google does not store it, and Cloud HSM alone is not an encryption option; it must be used with CMEK.

Answer

Google-managed encryption keys (GMEK)

Answer

Customer-managed encryption keys (CMEK) using Cloud KMS with software keys

Answer

Customer-supplied encryption keys (CSEK)

Question 10

A user has been granted the role roles/editor on a folder. What is the effective access in the projects within that folder? (Assume no deny policies)

Accepted Answer

Full editor access on all resources in the folder, including projects.. In Google Cloud, IAM roles are inherited from parent resources to child resources. Granting the roles/editor role on a folder automatically applies that role to all projects and resources within the folder, provided there are no deny policies to override it. This means the user has full editor access on all resources in the folder, including the projects themselves and all resources within those projects.

Answer

Editor access on the projects but not on resources within the projects.

Answer

The user must also be granted editor on each project separately.

Answer

Editor access on the folder resource only, not on projects.

Question 11

A company has deployed an internal HTTP Load Balancer (ILB) in us-west1 within a Shared VPC. The host project contains the ILB's forwarding rule and the backend service. The backend instances are Compute Engine VMs running in a service project in us-east1. The health checks for the ILB are consistently failing with 'unhealthy' status. The firewall rules in the host project allow ingress from the Google Cloud health checker ranges (130.211.0.0/22 and 35.191.0.0/16) on TCP port 80 to all VMs in the VPC. The backend VMs are running a web server listening on port 80. What is the most likely cause of the health check failures?

Accepted Answer

The ILB's forwarding rule and backends are in different regions.. The internal HTTP Load Balancer (ILB) in Google Cloud requires that the forwarding rule, backend service, and backend instances all reside in the same region. In this scenario, the ILB is deployed in us-west1, but the backend VMs are in us-east1. Cross-region backends are not supported for ILBs, causing health checks to fail because the load balancer cannot route traffic or verify health across regions.

Answer

The health checker firewall rule is not applied to the service project.

Answer

The backend VMs are not in the same project as the ILB.

Answer

The backend VMs do not have the correct IAM permissions for the ILB.

Question 12

Your organization uses Cloud Armor to protect HTTP Load Balancers. You need to block all incoming requests from a specific geographic region (country code 'XY') while allowing all other traffic. What is the correct configuration?

Accepted Answer

Create a custom rule with expression 'origin.region_code == "XY"' and set action to deny(403). Cloud Armor supports geolocation blocking using custom rules with expressions. The correct approach is to create a security policy rule that matches on the origin country code and sets the action to deny. The precedence (priority) ensures the deny rule is evaluated before the default allow rule.

Answer

Use Cloud IDS to detect and block requests from country XY

Answer

Configure a firewall rule in the VPC to deny ingress from IP ranges associated with country XY

Answer

Add a preconfigured OWASP rule set for geolocation blocking and enable it for country XY

Question 13

A company is implementing data loss prevention (DLP) for BigQuery. Which THREE capabilities are provided by Cloud DLP? (Choose THREE.)

Accepted Answer

Redacting sensitive data in query results.. Cloud DLP can inspect and redact sensitive data directly in BigQuery query results. When you configure a DLP job or use the DLP API with BigQuery, you can specify infoTypes to detect and then redact matching values before returning the results to the user, preventing exposure of sensitive information like credit card numbers or PII.

Answer

Auditing all queries that access sensitive columns.

Answer

Encrypting entire tables with customer-managed keys.

Question 14

A company wants to allow its on-premises applications to access Google Cloud resources using short-lived credentials without storing a service account key file. Which solution should they use?

Accepted Answer

Configure Workload Identity Federation between the on-premises identity provider and Google Cloud.. Workload Identity Federation allows on-premises applications to exchange tokens from an external identity provider (IdP) for short-lived Google Cloud access tokens, eliminating the need to store a service account key file. This solution meets the requirement for short-lived credentials and avoids the security risk of long-lived static keys.

Answer

Set up a Cloud VPN connection and use private IPs to access resources.

Answer

Create a service account and download a JSON key file to the on-premises server.

Answer

Use signed URLs to grant access for each request.

Question 15

Your organization has a security requirement that all traffic to and from Compute Engine instances must be logged and analyzed. You have enabled VPC Flow Logs for all subnets. However, you notice that flow logs are not capturing all traffic between instances in the same subnet. What is the most likely reason?

Accepted Answer

Traffic to the metadata server (169.254.169.254) is not captured by VPC Flow Logs.. VPC Flow Logs do not capture traffic to the metadata server (169.254.169.254) because that traffic is considered internal infrastructure communication and is excluded from flow log collection by design. This is a documented limitation in Google Cloud, and it explains why some traffic between instances in the same subnet—such as metadata queries—is missing from the logs.

Answer

VPC Flow Logs must be enabled on each individual instance, not on subnets.

Answer

VPC Flow Logs only capture traffic that crosses subnet boundaries.

Answer

VPC Flow Logs sample only 1 out of 10 packets by default.

Question 16

An organization uses Cloud Identity-Aware Proxy (IAP) to secure access to an internal web application running on Compute Engine. Users are authenticated with Google accounts. Recently, some users report being denied access even though they are in the correct IAP-secured Web App User group. What is the most likely cause?

Accepted Answer

An Access Context Manager access level is configured that the users do not satisfy, such as requiring a corporate device.. Cloud IAP can be combined with Access Context Manager (ACM) access levels to enforce contextual requirements beyond group membership, such as device policy, IP range, or user identity attributes. If an access level is configured to require a corporate device and the user's device does not meet that policy, IAP will deny access even if the user is in the correct IAP-secured Web App User group. This explains why users who are correctly placed in the group still receive access denials.

Answer

The users are trying to use IAP TCP forwarding instead of HTTPS.

Answer

The users are not members of the IAP-secured Web App User group.

Answer

The OAuth consent screen requires approval from an admin.

Question 17

A security engineer needs to prevent creation of long-lived service account keys across all projects in an organization. The solution should also block any existing keys older than 90 days. Which approach meets these requirements?

Accepted Answer

Use a deny policy to deny the permission iam.serviceAccountKeys.create and another deny policy to deny use of keys older than 90 days.. Deny policies can be used to prevent creation of new service account keys (by denying iam.serviceAccountKeys.create) and to block use of existing keys older than 90 days (by denying permissions like iam.serviceAccountKeys.signBlob with a condition on key age). This directly addresses both requirements: prevention of new long-lived keys and disabling existing keys older than 90 days. Option A only prevents creation of new keys via the built-in constraint but does not affect existing keys; while a custom policy can enforce key rotation on new keys, it cannot block or disable keys that already exist. Option C fails because custom constraints cannot delete existing resources. Option D does not block key creation via all methods and does not address existing keys.

Answer

Use the built-in constraint constraints/iam.disableServiceAccountKeyCreation and write a custom organization policy to enforce key rotation (max age 90 days).

Answer

Use a custom organization policy constraint to disable key creation and another custom constraint to delete keys older than 90 days.

Answer

Use a VPC Service Controls perimeter to block access to the IAM API for creating keys.

Question 18

Which Cloud DLP transform should be used to replace sensitive data with a token that preserves the format and length of the original data for reversible de-identification?

Accepted Answer

CryptoReplaceFfxFpeConfig. CryptoReplaceFfxFpeConfig uses Format-Preserving Encryption (FPE) to replace data with a token that retains the original format and length, and the process is reversible with the encryption key.

Answer

DateShiftConfig

Answer

MaskingConfig

Answer

BucketingConfig

Question 19

A compliance officer reviews the Cloud Audit Log entry above and wants to know if any sensitive data was exposed during the instance creation. What is the best course of action?

Accepted Answer

Enable data access audit logs for Compute Engine to capture request payloads.. Enabling data access audit logs for Compute Engine captures the request payloads of API calls, including the instance creation request. This allows the compliance officer to inspect the exact parameters sent, such as any sensitive data that might have been passed as metadata or startup scripts, which are not included in the default admin activity audit logs. Data access audit logs provide the granularity needed to determine if sensitive data was exposed during the operation.

Answer

Check the status field to see if the operation failed, which might indicate a misconfiguration.

Answer

Analyze the log entry to see the image used; the image metadata is included.

Answer

Use Cloud DLP to scan the log entry for sensitive data.

Question 20

A company must ensure that all Compute Engine instances use only approved images from a specific project. They want to enforce this using Organization Policy. Which constraint should they use?

Accepted Answer

constraints/compute.restrictImageUsage. The correct constraint is `constraints/compute.restrictImageUsage` because it directly controls which images can be used to create Compute Engine instances by specifying a list of allowed projects. This enforces the requirement that only approved images from a specific project are used, blocking instances launched with images from other projects.

Answer

constraints/compute.restrictAuthorizedDomains

Answer

constraints/compute.trustedImageProjects

Answer

constraints/compute.restrictFirewallRules