PCSE Practice Test 4 — 25 Questions

Question 1

A security engineer needs to block traffic from all IP addresses in a specific geographic region from reaching an HTTPS load-balanced application. The application uses Cloud Load Balancing with an external HTTPS load balancer. Which approach should the engineer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Cloud Armor security policy with a geo-based deny rule and attach it to the load balancer.. Cloud Armor security policies can be attached to external HTTPS load balancers to filter traffic based on geolocation. The engineer can create a Cloud Armor security policy with a rule that uses the geo-tag to deny traffic from the specified region.

Answer

Create a VPC firewall rule that denies ingress from the region's IP ranges.

Answer

Use Identity-Aware Proxy (IAP) to block access based on the user's location.

Answer

Configure a Cloud CDN policy to block traffic from certain regions.

Question 2

An engineer needs to ensure that only VMs with a specific service account (sa-prod@project.iam.gserviceaccount.com) can access a Cloud Spanner instance. They want to control this at the network level, not using IAM. Which VPC firewall rule configuration should they use?

Accepted Answer

Egress rule with target service account 'sa-prod'. Firewall rules can target service accounts for egress rules. Since the VMs initiate connections to Spanner, an egress rule with target service account is appropriate.

Answer

Egress rule with source service account 'sa-prod'

Answer

Ingress rule with target service account 'sa-prod'

Answer

Ingress rule with source tag 'sa-prod'

Question 3

An organization wants to enforce a security policy that denies all egress traffic to the internet from all projects in the organization, except for traffic from a specific set of VMs tagged with 'allow-egress'. Which approach should be used?

Accepted Answer

Use a hierarchical firewall policy at the organization level with a deny-all egress rule and a higher priority allow rule for the tag.. Hierarchical firewall policies are inherited down the resource hierarchy and can be enforced at the organization or folder level. They cannot be overridden at lower levels, making them suitable for organization-wide baseline rules.

Answer

Create a VPC firewall rule at the organization level to deny all egress, then allow egress for the specific tag.

Answer

Use VPC Service Controls to block egress traffic.

Answer

Configure Cloud Armor with a deny-all egress rule and an exception for the tag.

Question 4

Which Security Command Center (SCC) tier provides built-in compliance monitoring for standards like CIS and PCI DSS?

Accepted Answer

Premium tier. Security Command Center Premium tier includes built-in compliance monitoring and reporting for standards such as CIS Google Cloud Foundations Benchmark, PCI DSS, ISO 27001, and NIST 800-53. The Standard tier provides security posture findings but not the compliance dashboards and standard-specific assessments. Therefore, Premium is the correct answer.

Answer

Neither; compliance monitoring is part of Cloud Audit Logs

Answer

Both Standard and Premium

Answer

Standard tier

Question 5

A security engineer wants to test a web application hosted on Compute Engine for vulnerabilities. According to Google Cloud's Acceptable Use Policy, which of the following is true regarding penetration testing?

Accepted Answer

Penetration testing is allowed without prior approval, but Denial of Service (DoS) testing is prohibited.. Google Cloud's Acceptable Use Policy permits customers to perform penetration testing against their own Google Cloud resources without prior approval, but explicitly prohibits Denial of Service (DoS) and Distributed Denial of Service (DDoS) testing, as well as testing that could impact other customers. This makes option C the accurate statement of policy.

Answer

Penetration testing is allowed only for customers with Enterprise support plans.

Answer

All penetration testing requires prior written approval from Google.

Answer

Testing must be limited to non-production environments only.

Question 6

A security engineer runs the command in the exhibit. The command fails with an error: 'Permission denied: cryptoKeyVersions.encrypt'. What is the most likely cause?

Accepted Answer

The user does not have the cloudkms.cryptoKeyVersions.encrypt permission on the key.. The error message 'Permission denied: cryptoKeyVersions.encrypt' explicitly indicates that the user lacks the cloudkms.cryptoKeyVersions.encrypt permission on the specific key version. In Google Cloud KMS, encrypt operations require the cloudkms.cryptoKeyVersions.encrypt permission (or a broader role like roles/cloudkms.cryptoKeyEncrypter) on the key resource. The command itself is syntactically correct, so the failure is due to insufficient IAM permissions, not resource existence or location.

Answer

The key ring 'my-keyring' does not exist.

Answer

The key ring location is incorrect.

Answer

The user does not have the cloudkms.cryptoKeyVersions.decrypt permission.

Question 7

A company uses Cloud Armor to protect a web application. They want to block requests that contain SQL injection patterns based on the OWASP ModSecurity Core Rule Set. Which preconfigured rule set should they enable?

Accepted Answer

OWASP ModSecurity CRS. Google Cloud Armor provides a preconfigured WAF rule set called 'OWASP ModSecurity Core Rule Set' (CRS) that includes rules to detect and block SQL injection, cross-site scripting, and other OWASP Top 10 attacks. Enabling this rule set applies the ModSecurity CRS signatures to incoming requests, satisfying the requirement to block SQL injection patterns based on OWASP CRS.

Answer

Custom rules using CEL expression

Answer

Google Cloud Armor Managed Rules (SQL Injection)

Answer

Rate limiting rules

Question 8

A company wants to implement least privilege for a service account that needs to read objects from a Cloud Storage bucket and publish messages to a Pub/Sub topic. Which TWO IAM roles should be granted to the service account? (Choose TWO)

Accepted Answer

roles/storage.objectViewer. Roles/storage.objectViewer grants read-only access to objects in Cloud Storage buckets, which is the minimum permission needed for the service account to read objects. This role includes permissions like storage.objects.get and storage.objects.list, allowing the service account to retrieve object data without any write or administrative capabilities.

Answer

roles/pubsub.subscriber

Answer

roles/storage.admin

Answer

roles/pubsub.viewer

Question 9

A company wants to enforce that no Compute Engine firewall rule in any project under an organization can have a source range of 0.0.0.0/0 for RDP (port 3389). Which approach should be used?

Accepted Answer

Apply a hierarchical firewall policy at the organization level that denies ingress on port 3389 from 0.0.0.0/0.. Hierarchical firewall policies are attached at the organization or folder level and are evaluated before VPC firewall rules, allowing centralized enforcement across all projects. A deny rule for ingress TCP/3389 from 0.0.0.0/0 at the org level ensures no project can override it with a lower-priority allow. This is the only option that provides organization-wide, non-bypassable enforcement.

Answer

Create a Cloud IDS rule to block RDP traffic.

Answer

Create a VPC firewall rule with priority 0 to deny RDP from 0.0.0.0/0 in each project.

Answer

Use organization policy with constraint `compute.skipDefaultNetworkCreation` set to true.

Question 10

A security engineer wants to enable Access Transparency for their organization. After enabling it in the Admin Console, they notice that some access logs are missing. What is the most likely reason?

Accepted Answer

The service being accessed does not support Access Transparency.. Access Transparency logs are generated only for Google personnel actions on supported services. If some logs are missing after organization-level enablement, the most likely cause is that the service being accessed does not support Access Transparency. Enablement at the organization level does not extend coverage to unsupported services.

Answer

Access Transparency only logs access by Google personnel, not by third-party vendors.

Answer

Access Transparency must be enabled for each individual project, not just the organization.

Answer

The IAM policy for the organization does not grant the required permissions.

Question 11

A data engineer wants to classify columns in BigQuery containing sensitive data like email addresses and apply data masking so that users see only masked values (e.g., 'j***@example.com'). Which feature should they use?

Accepted Answer

BigQuery column-level security with policy tags and data masking rules. BigQuery column-level security with policy tags and data masking rules allows classification of sensitive columns (e.g., email) and application of masking policies so users see masked values like 'j***@example.com'. Policy tags are managed via Data Catalog, and masking rules are applied to the tag. This is the native, centralized feature for dynamic data masking.

Answer

Cloud DLP inspection jobs

Answer

Cloud IAM roles for BigQuery

Answer

View with SQL masking

Question 12

A company wants to encrypt data at rest in Cloud Storage using a key that they manage and rotate periodically. They also need to ensure that the key material is stored in a FIPS 140-2 Level 3 validated HSM. Which encryption option should they use?

Accepted Answer

Customer-managed encryption keys (CMEK) using Cloud HSM. CMEK with Cloud HSM uses customer-managed keys stored in a FIPS 140-2 Level 3 HSM. GMEK uses Google-managed keys, CSEK requires the customer to supply the key with each API call and Google does not store it, and Cloud HSM alone is not an encryption option; it must be used with CMEK.

Answer

Google-managed encryption keys (GMEK)

Answer

Customer-managed encryption keys (CMEK) using Cloud KMS with software keys

Answer

Customer-supplied encryption keys (CSEK)

Question 13

Which Security Command Center tier provides Event Threat Detection and Container Threat Detection?

Accepted Answer

Premium tier. These threat detection services are available only in the Premium tier of Security Command Center. The Standard tier includes Security Health Analytics, Web Security Scanner, and Anomaly Detection. Compliance monitoring is also Premium-only.

Answer

Both tiers

Answer

Standard tier

Answer

Neither tier, they are separate services

Question 14

You are designing a network for a multi-tier application. The web tier must be accessible from the internet, while the application tier should only be accessible from the web tier. The database tier should only be accessible from the application tier. All tiers are in the same VPC. Which combination of firewall rules meets these requirements?

Accepted Answer

Create an ingress rule allowing traffic from 0.0.0.0/0 to instances with tag 'web', an ingress rule allowing traffic from instances with tag 'web' to instances with tag 'app', and an ingress rule allowing traffic from instances with tag 'app' to instances with tag 'db'.. It uses VPC firewall tags to enforce least-privilege network segmentation: the web tier is exposed to the internet (0.0.0.0/0), the app tier only accepts traffic from web-tagged instances, and the database tier only accepts traffic from app-tagged instances. This matches the multi-tier access requirements without exposing internal tiers to the internet or to each other unnecessarily. Option B is incorrect because while firewall rules in Google Cloud support source service accounts, they cannot be used to allow traffic from the internet, as internet traffic does not have a service account. The web tier's internet access requirement breaks the service account approach.

Answer

Create an ingress rule allowing traffic from the web tier subnet to the application tier subnet, and an ingress rule allowing traffic from the application tier subnet to database tier subnet.

Answer

Assign each tier a unique service account and create ingress rules allowing traffic from the appropriate service accounts.

Answer

Create a single ingress rule that allows all traffic within the VPC network and a separate rule to allow internet traffic to web tier.

Question 15

A company wants to use Cloud Armor to block traffic from specific countries to comply with data sovereignty requirements. They have a global HTTP Load Balancer configured. Where should they configure the Cloud Armor policy?

Accepted Answer

Attach to the backend service of the load balancer.. Cloud Armor policies must be attached to a backend service (or backend bucket) of a global HTTP(S) Load Balancer to filter traffic at the edge. This allows the policy to evaluate incoming requests based on geographic location before they reach the backend, enforcing data sovereignty rules without modifying VPC networking or firewall rules.

Answer

Attach to the VPC network that hosts the load balancer.

Answer

Configure as an Organization Policy constraint.

Answer

Configure as a firewall rule in the VPC network.

Question 16

A company uses a hub-and-spoke VPC topology with Network Connectivity Center. The spoke VPCs need to reach the internet. Cloud NAT is configured in the hub VPC. Spoke VPCs have routes to the hub via a VPN tunnel. However, instances in spoke VPCs cannot reach the internet. Which configuration is most likely missing?

Accepted Answer

The spoke VPCs are not receiving a default route (0.0.0.0/0) from the hub via Cloud Router.. In a hub-and-spoke topology with Network Connectivity Center, spoke VPCs rely on the hub for internet access via Cloud NAT. For this to work, the spoke VPCs must have a default route (0.0.0.0/0) pointing to the hub, typically advertised by Cloud Router over the VPN tunnel. Without this route, traffic from spoke instances to the internet will not be forwarded to the hub, and thus will not reach Cloud NAT.

Answer

A network virtual appliance (NVA) is required in the hub for spoke internet access.

Answer

Firewall rules for egress internet traffic are missing in spoke VPCs.

Answer

Cloud NAT is not configured in the spoke VPCs.

Question 17

A large enterprise has a security command center that uses SIEM to analyze logs. They are migrating to Google Cloud and want to export all Cloud Audit Logs (Admin Activity, Data Access, and System Events) from all projects into a centralized BigQuery dataset for analysis. They also need to ensure logs are available within 5 minutes of being generated. Which sink configuration should they use?

Accepted Answer

Create an aggregated sink at the organization level that includes all projects and uses a BigQuery dataset as destination, with inclusion filters for all audit log types.. An aggregated sink at the organization level can export logs from all projects within the organization to a single BigQuery dataset. Inclusion filters allow you to specify which log types (Admin Activity, Data Access, System Events) to export. Logs are typically available in BigQuery within seconds (near real-time), meeting the 5-minute requirement. Option B is incorrect because using Pub/Sub adds latency and complexity without benefit when the final destination is BigQuery. Option C is incorrect because creating per-project sinks is inefficient and harder to manage. Option D is incorrect because exporting to an external SIEM via syslog does not centralize logs in BigQuery as required.

Answer

Create a single aggregated sink at the organization level that uses a Pub/Sub topic as destination, and have a subscriber stream logs into BigQuery.

Answer

Create a sink in each project that exports Audit Logs to a shared BigQuery dataset.

Answer

Enable logging export using Cloud Logging's beta feature to stream logs to an external SIEM via syslog.

Question 18

A company wants to receive real-time notifications when Security Command Center (SCC) detects a high-severity vulnerability in their Google Cloud projects. They need to integrate with their existing SIEM. Which approach should they use?

Accepted Answer

Create a Pub/Sub notification config in SCC for the desired finding types and have the SIEM subscribe to the Pub/Sub topic.. Security Command Center supports Pub/Sub notification configs that publish findings (filtered by severity, category, or resource) to a Pub/Sub topic in near real-time. Having the existing SIEM subscribe to that topic is the officially recommended, low-latency integration pattern and avoids polling overhead. This is the standard SCC-to-SIEM integration path documented by Google Cloud.

Answer

Use the SCC API to poll for new findings every minute and push them to the SIEM via a custom script.

Answer

Enable Event Threat Detection in SCC Premium tier and configure it to stream findings to Cloud Logging via a log sink.

Answer

Configure SCC to send findings to Cloud Logging and set up a log-based metric that triggers a Cloud Function to send to the SIEM.

Question 19

Your organization uses Cloud Identity with SAML 2.0 federation from an external identity provider (IdP). You need to ensure that only users from a specific group in the IdP can access a critical application behind an HTTPS load balancer. Which combination of steps is required?

Accepted Answer

Enable IAP on the load balancer and grant the roles/iap.httpsResourceAccessor role to the Google group representing the IdP group. To restrict access to a specific group, you must first configure IAP on the backend service, then create an IAP access policy (or IAM binding) that grants the roles/iap.httpsResourceAccessor role to the Google group that corresponds to the IdP group. The IdP group must be synced to Google Cloud via directory sync or SCIM.

Answer

Create a firewall rule that allows traffic only from the IdP's SAML endpoint IP

Answer

Set up a VPN between the IdP and Google Cloud and restrict access to the load balancer via VPC firewall

Answer

Configure Cloud Armor to allow traffic only from the IdP's IP range

Question 20

Your organization uses Cloud CDN to distribute static content. Recently, users in a specific geographic region are experiencing high latency. What is the most likely cause?

Accepted Answer

There is no CDN edge node in that region. Cloud CDN relies on a global network of edge points of presence (PoPs) to cache and serve content close to users. If users in a specific geographic region experience high latency, the most likely cause is that there is no Cloud CDN edge node (PoP) in or near that region, forcing requests to travel to a distant PoP and increasing latency. Google Cloud's CDN has PoPs in many locations, but coverage is not universal, and some regions may be served from farther away.

Answer

The CDN cache has been purged for that region

Answer

The origin server is unhealthy

Answer

The DNS resolution is failing for that region