PCSE Practice Test 5 — 25 Questions

Question 1

A company uses Assured Workloads to meet FedRAMP High compliance in the US. They need to ensure that data cannot be moved outside the US region. Which control should they use?

Accepted Answer

Configure an organization policy with gcp.resourceLocations as part of the Assured Workloads configuration.. Assured Workloads enforces compliance boundaries through organization policies, and the `gcp.resourceLocations` constraint specifically restricts where Google Cloud resources can be created. By configuring this policy as part of the Assured Workloads configuration, you ensure that all resources are provisioned only within the US region, preventing data from being stored or processed outside that boundary. This directly meets the FedRAMP High requirement to keep data within the US.

Answer

Use VPC Service Controls to prevent data exfiltration.

Answer

Set IAM conditions on all resources to allow only US regions.

Answer

Use Cloud DLP to scan and block data leaving the US.

Question 2

A company wants to use Google Cloud resources but does not have a Google Workspace or Cloud Identity account. They want to manage identities for their users without paying for additional licenses. What is the most cost-effective identity solution?

Accepted Answer

Use Cloud Identity Free edition.. Cloud Identity Free edition provides identity and access management for Google Cloud without requiring Google Workspace and without per-user licensing costs. It supports user lifecycle management, SSO, and integration with GCP IAM, making it the most cost-effective option for organizations that only need identity management for cloud resources.

Answer

Use the Compute Engine default service account for all users.

Answer

Use Cloud Identity Premium edition.

Answer

Use Google Workspace.

Question 3

Which Google Cloud audit log captures administrator activity and is enabled by default?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs (option D) are enabled by default in Google Cloud and capture all administrator actions that modify the configuration or metadata of resources, such as creating a VM or changing IAM policies. These logs are essential for compliance and security auditing because they record 'who did what, where, and when' for management activities, and they cannot be disabled.

Answer

Policy Denied audit logs

Answer

System Event audit logs

Answer

Data Access audit logs

Question 4

A security team needs to centrally manage secrets for multiple Google Cloud projects. Which solution should they use?

Accepted Answer

Use Secret Manager. Google Cloud Secret Manager is the dedicated service for storing, managing, and accessing secrets such as API keys, passwords, and certificates. It supports central management across multiple projects via IAM policies, automatic rotation, versioning, and audit logging, making it the correct choice for centrally managing secrets for multiple projects.

Answer

Hardcode secrets in application code and use IAM with access scopes

Answer

Use Cloud Key Management Service (Cloud KMS) to store and manage secrets

Answer

Store secrets in encrypted Cloud Storage buckets

Question 5

A company is using VPC Service Controls to protect their Google Cloud Storage buckets. They want to allow a specific instance to access a bucket from within a VPC. What networking configuration is required?

Accepted Answer

Private Google Access must be enabled on the subnet. VPC Service Controls require Private Google Access to be enabled on the subnet so that the instance can access Google APIs using its internal IP address.

Answer

The instance must have a public IP

Answer

A VPC peering connection to Google services

Answer

A Cloud NAT gateway

Question 6

An organization handles ITAR-controlled data and must restrict Google personnel access to the underlying infrastructure. Which Google Cloud product should they use to enforce this restriction?

Accepted Answer

Assured Workloads. Assured Workloads is a Google Cloud service that enforces compliance and data residency controls, including restricting Google personnel access to customer data for ITAR and other regulated workloads. It provides a managed environment with technical controls that prevent Google support and engineering staff from accessing the data without explicit customer approval. This directly addresses the requirement to limit Google personnel access to the underlying infrastructure.

Answer

IAM Conditions

Answer

VPC Service Controls

Answer

Cloud HSM

Question 7

You are designing a multi-tier application with a frontend and backend. The frontend instances are in subnet A (10.0.1.0/24), and the backend instances are in subnet B (10.0.2.0/24). Both subnets are in the same VPC. You want to allow the frontend to communicate with the backend on TCP port 8080, but the backend must not be able to initiate connections to the frontend. Additionally, the backend must be able to send patches to the internet. Which set of firewall rules should you implement?

Accepted Answer

Ingress rule on backend: allow tcp:8080 from subnet A; Egress rule on backend: allow all to internet. The frontend in subnet A initiates connections to the backend on TCP port 8080, so an ingress rule on the backend allowing traffic from subnet A permits this. An egress rule on the backend allowing all traffic to the internet enables patch downloads. This setup prevents the backend from initiating connections to the frontend, as no egress rule on the backend targets the frontend, and no ingress rule on the frontend allows unsolicited traffic from the backend.

Answer

Ingress rule on frontend: allow tcp:8080 from backend's service account; Egress rule on backend: allow all to internet

Answer

Ingress rule on frontend: allow tcp:8080 from subnet B; Egress rule on backend: allow all to internet

Answer

Ingress rule on backend: allow tcp:8080 from subnet A; Egress rule on frontend: deny all to internet

Question 8

Which IAM role should be assigned to a user who needs to manage Cloud Storage objects in a specific project, but should not be able to create or delete buckets?

Accepted Answer

roles/storage.objectAdmin. The roles/storage.objectAdmin role grants full control over objects in a bucket, including listing, creating, viewing, and deleting objects, but it does not grant permission to create or delete buckets themselves. This matches the requirement to manage Cloud Storage objects without being able to create or delete buckets. roles/storage.admin would allow bucket creation and deletion, which is too permissive.

Answer

roles/storage.legacyBucketReader

Answer

roles/storage.admin

Answer

roles/storage.objectViewer

Question 9

A security engineer needs to audit changes to IAM policies across their Google Cloud organization. Which audit log type should they enable to capture IAM policy changes?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs record changes to resource configurations and metadata, including IAM policy changes such as creating, modifying, or deleting roles, bindings, and service accounts. They are enabled by default and are the correct log type for auditing who changed IAM policies and when. This makes them the authoritative source for configuration-change auditing.

Answer

System Event audit logs

Answer

Data Access audit logs

Answer

Access Transparency logs

Question 10

An organization has a hierarchical firewall policy at the organization level that denies all ingress traffic from the internet. A project team needs to allow HTTP traffic from the internet to a specific VM. How should they achieve this?

Accepted Answer

Create a project-level hierarchical firewall policy with a rule allowing HTTP from 0.0.0.0/0 and a lower priority number than the org-level deny. Hierarchical firewall policies cannot be overridden at lower levels; they are always evaluated first. Since the org-level policy denies all internet ingress, the only way to allow HTTP is to create a hierarchical policy at a lower level (folder or project) that allows it, but those are also part of the hierarchy and are evaluated after org-level. Actually, hierarchical policies can be overridden by a lower-level policy with a higher priority, but the org-level policy has no higher priority? In GCP, hierarchical firewall policies are evaluated in order of precedence: organization > folder > project. A policy at a lower level can override a higher-level policy if it has a higher priority (lower number) and is an allow rule. So the project team can create a project-level hierarchical policy with a higher priority (e.g., 100) allowing HTTP from 0.0.0.0/0, which will override the org-level deny (priority 1000).

Answer

Add a VPC firewall rule allowing HTTP from 0.0.0.0/0

Answer

Remove the VM from the organization hierarchy

Answer

Use Cloud Armor to allow the traffic

Question 11

A company uses Customer-Supplied Encryption Keys (CSEK) for Compute Engine persistent disks. They want to ensure that Google does not store the key material. What must they do?

Accepted Answer

Use the gcloud compute disks create command with the --csek-key-file flag to supply the key, and do not store the key in Cloud KMS.. Customer-Supplied Encryption Keys (CSEK) allow you to provide your own raw AES-256 key material when creating a persistent disk. By using the `gcloud compute disks create` command with the `--csek-key-file` flag, you supply the key directly to the API, and Google uses it only in memory to encrypt the disk; it does not persist the key material on Google's infrastructure. The key file is stored locally by the customer, ensuring Google never retains the key.

Answer

Enable Cloud HSM to protect the key.

Answer

Set an organization policy to prevent Google from storing keys.

Answer

Create a Cloud KMS key and use it as a CSEK.

Question 12

An organization wants to enforce that all Compute Engine instances must use a specific service account. Which three steps are necessary? (Choose three.)

Accepted Answer

Grant the service account the needed roles on the project.. The service account must be granted the necessary IAM roles on the project (or specific resources) to perform its intended actions. Without these grants, even if the service account is enforced, it will lack permissions to interact with Compute Engine resources. This step ensures the service account has the required access, such as compute.instanceAdmin or custom roles, to manage instances.

Answer

Create a custom role with compute.instances.create permission.

Answer

Grant the compute.instanceAdmin role to the service account.

Question 13

You are designing VPC firewall rules for a multi-tier application. Which TWO considerations are important when creating firewall rules in terms of security and manageability? (Choose TWO.)

Accepted Answer

Use hierarchical firewall policies to enforce baseline rules across all VPCs in the organization.. Option B is correct because hierarchical firewall policies in Google Cloud are attached at the organization or folder level and are inherited by all VPC networks beneath them, letting you enforce baseline allow/deny rules (such as blocking SSH from 0.0.0.0/0) consistently across every project without duplicating rules per VPC, which greatly improves manageability and security posture. Option C is correct because targeting rules by service account or network tag decouples the rule from static IP ranges, so as instances are created, scaled, or replaced in dynamic environments, the correct rules automatically apply to the right workloads without editing CIDRs. Option A is incorrect because network tags remain a supported and commonly recommended targeting mechanism, and hierarchical policies plus tag governance can manage them at scale. Option D is incorrect because enabling logging on every rule is not a universal best practice; logging all rules can generate significant cost and noise, so logging should be enabled selectively on rules where audit or troubleshooting value justifies it. Option E is incorrect because VPC firewall rules are enforced at the network level and are not scoped by region, so specifying a target region is not a valid consideration.

Answer

Network tags are not recommended for large deployments because they require managing many tags.

Answer

Enable firewall rules logging for all rules to ensure full auditability.

Answer

Always specify the target region for firewall rules to limit the scope.

Question 14

A developer wants to allow a CI/CD pipeline running on GitHub Actions to deploy resources to a GCP project without using service account keys. Which two components are needed? (Choose two.)

Accepted Answer

A Workload Identity Pool and Provider configured for GitHub.. Workload Identity Federation allows GitHub Actions to exchange GitHub OIDC tokens for GCP service account impersonation. You need to set up a workload identity pool and provider for GitHub. The GitHub Actions workflow must be configured to use the OIDC token and request impersonation of a service account.

Answer

A Cloud Build trigger to run the workflow.

Answer

A Cloud KMS key to encrypt the workflow.

Answer

A service account JSON key stored as a GitHub secret.

Question 15

A healthcare company's data science team needs to query BigQuery tables containing sensitive patient data. The company policy requires that all queries be logged and audited. The team has been granted the bigquery.user role on the project. However, when attempting to query a specific table in a dataset, they receive the error: "Access Denied: Table X: User does not have permission to query table X." The dataset has a custom IAM role assigned to the team's Google Group. The custom role includes the permissions: bigquery.datasets.get, bigquery.tables.get, bigquery.tables.list, and bigquery.jobs.create. The engineer verifies that the bigquery.user role does include bigquery.jobs.create. The engineer also confirms that the table exists and the dataset is in the same region as the project. What is the most likely cause of the access denied error?

Accepted Answer

The custom role does not include the bigquery.tables.getData permission.. The error 'Access Denied: Table X: User does not have permission to query table X' indicates that the user lacks the permission to read the actual table data. The custom role assigned to the team's Google Group includes bigquery.tables.get (metadata) and bigquery.tables.list, but not bigquery.tables.getData, which is required to read table rows. Without bigquery.tables.getData, even with bigquery.jobs.create and dataset-level metadata permissions, query execution fails because BigQuery enforces data access separately from metadata and job creation.

Answer

The team is not granted the bigquery.jobUser role on the project.

Answer

The team is not granted the bigquery.metadataViewer role on the dataset.

Answer

The dataset is in a different region than the project's default location, causing cross-region access restrictions.

Question 16

Match each Google Cloud logging/monitoring term to its definition.

Accepted Answer

Log bucket: A storage location for log entries. Log buckets store logs, log sinks route logs, log-based metrics derive metrics from logs, and log entries are individual records. Common confusions include mixing sinks with metrics and buckets with queries.

Answer

Log bucket: A query to filter log entries

Answer

Log sink: A metric derived from log data

Question 17

Drag and drop the steps to set up IAM conditions for a service account in the correct order.

Accepted Answer

Identify the scope, then write the condition, then bind the condition to the policy, then attach the policy, then test.. IAM conditions involve identifying the scope, writing the condition, binding it, attaching the policy, and testing.

Answer

Write the condition, then identify the scope, then bind the condition to the policy, then attach the policy, then test.

Answer

Identify the scope, then write the condition, then attach the policy, then bind the condition to the policy, then test.

Answer

Identify the scope, then write the condition, then test, then bind the condition to the policy, then attach the policy.

Question 18

A security engineer is tasked with automating the remediation of non-compliant resources in a Google Cloud organization. The organization uses Organization Policy Service to enforce constraints. The engineer needs to automatically disable a specific service (e.g., Compute Engine API) for a project that violates a policy. Which Google Cloud service should be used to trigger this remediation?

Accepted Answer

Cloud Functions. Cloud Functions is correct because it can be triggered by real-time event notifications (e.g., from Cloud Asset Inventory or Pub/Sub) when a policy violation is detected, and then execute custom code to disable the Compute Engine API via the Service Usage API. This serverless, event-driven model is ideal for automated remediation workflows without managing infrastructure.

Answer

Cloud Build

Answer

Cloud Run

Answer

Cloud Scheduler

Question 19

A company wants to encrypt data at rest in Cloud SQL. Which TWO methods are supported? (Choose TWO.)

Accepted Answer

Default encryption at rest with Google-managed keys. Cloud SQL provides default encryption at rest using AES-256 with Google-managed keys, which are automatically generated and rotated by Google. This encryption is transparent to the user and requires no additional configuration, ensuring data is encrypted before being written to disk.

Answer

Cloud HSM hardware security module for encryption

Answer

Cloud Key Management Service (Cloud KMS) as a standalone encryption method

Answer

Client-side encryption before storing data in Cloud SQL

Question 20

Drag and drop the steps to configure a security scanner to scan a web application in the correct order.

Accepted Answer

Configuration, then Scheduling, then Execution, then Review, then Remediation Verification. Security scanning involves configuration, scheduling, execution, review, and remediation verification.

Answer

Scheduling, then Configuration, then Execution, then Review, then Remediation Verification

Answer

Configuration, then Execution, then Scheduling, then Review, then Remediation Verification

Answer

Configuration, then Scheduling, then Review, then Execution, then Remediation Verification