PCSE Practice Test 26 — 15 Questions

Question 1

A company needs to isolate development and production workloads within the same Google Cloud organization. Each environment must have its own VPC network, but they must share a common set of network security policies. Which design meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Shared VPC with separate service projects for dev and prod. Shared VPC in Google Cloud allows a host project to share its VPC network with multiple service projects, enabling centralized network administration while isolating dev and prod workloads in separate projects. Security policies (firewall rules, hierarchical firewall policies) can be applied at the host project or organization level, satisfying the shared-policy requirement. This is the canonical GCP pattern for multi-environment isolation with shared network controls.

Answer

Create separate projects and use VPC Network Peering between them

Answer

Create separate VPCs in the same project and use VPC peering

Answer

Use a single VPC with multiple subnets and strict firewall rules

Question 2

A data engineer needs to scan a Cloud Storage bucket for personally identifiable information (PII) such as credit card numbers and social security numbers. The scanning must be performed on a schedule (every week). Which GCP service and resource should they use?

Accepted Answer

Cloud Data Loss Prevention (DLP) with a DLP job trigger. Cloud Data Loss Prevention (DLP) is GCP's service for discovering, classifying, and de-identifying sensitive data such as credit card numbers and SSNs using built-in infoType detectors. To run scans on a schedule, you create a DLP job trigger that defines the scan configuration and a recurrence (e.g., every week), targeting the Cloud Storage bucket. This directly satisfies both the PII detection requirement and the weekly scheduling requirement.

Answer

Cloud Security Command Center (SCC)

Answer

Cloud Asset Inventory

Answer

Cloud Audit Logs

Question 3

An organization needs to store API keys and database credentials in a central, auditable service with versioning and IAM access control. Which GCP service should they use?

Accepted Answer

Secret Manager. Secret Manager is purpose-built for storing secrets like API keys, certificates, and database passwords. It provides versioning, IAM policies (e.g., secretmanager.versions.access), and automatic rotation with Pub/Sub notifications.

Answer

Cloud HSM

Answer

Cloud DLP

Answer

Cloud KMS

Question 4

A company wants to enforce that all Compute Engine disk encryption uses keys managed by their own HSM on-premises, with keys provided per API call. Which encryption type should they choose when creating a persistent disk?

Accepted Answer

Customer-supplied encryption (CSEK). Customer-supplied encryption keys (CSEK) are the only GCP disk encryption option where the customer provides the raw AES-256 key material with each API call to Compute Engine. Because the keys never reside in Google Cloud and are supplied per request, they satisfy the requirement that keys be managed by an on-premises HSM and passed in per API call. CSEK keys are not stored by Google; only a SHA-256 hash of the key is retained to validate future requests.

Answer

Google-managed encryption (GMEK)

Answer

Cloud HSM-backed keys

Answer

Customer-managed encryption (CMEK) with Cloud KMS

Question 5

An organization needs to store API keys and database credentials in a secure, centralized service that supports automatic rotation and integrates with Cloud Functions. The solution must provide fine-grained access control at the secret version level. Which service should they use?

Accepted Answer

Secret Manager. Secret Manager is purpose-built for storing API keys, passwords, and database credentials, supports automatic rotation via rotation schedules and Pub/Sub notifications, integrates natively with Cloud Functions through client libraries, and provides IAM access control at the secret and secret-version level. This matches every requirement in the question.

Answer

Cloud Key Management Service (Cloud KMS)

Answer

Cloud Storage with customer-managed encryption keys

Answer

Cloud HSM

Question 6

A company wants to enforce that all new Cloud Storage buckets are created in only the europe-west1 region. Which organization policy constraint should they use?

Accepted Answer

constraints/gcp.resourceLocations. The organization policy constraint constraints/gcp.resourceLocations allows you to restrict the locations where resources can be created, including Cloud Storage buckets. By setting this constraint to allow only europe-west1, you enforce that all new buckets are created in that region. This is the correct constraint for location-based restrictions.

Answer

constraints/storage.uniformBucketLevelAccess

Answer

constraints/compute.requireOsLogin

Answer

constraints/iam.disableServiceAccountCreation

Question 7

A company has a global HTTPS load balancer and wants to use a self-managed SSL certificate. They have uploaded the PEM-encoded certificate and private key to the load balancer. However, the certificate is about to expire. What is the correct way to renew it without downtime?

Accepted Answer

Create a new SSL certificate resource with the new certificate and key, then update the target HTTPS proxy to use it. To renew a self-managed certificate, you create a new SSL certificate resource with the updated certificate and key, and then update the load balancer's target HTTPS proxy to use the new certificate. This can be done without downtime by updating the proxy.

Answer

Use gcloud compute ssl-certificates update to replace the certificate

Answer

Update the existing SSL certificate resource with the new certificate and key

Answer

Delete the existing certificate and upload the new one with the same name

Question 8

Which THREE components are customer responsibilities under the Google Cloud Shared Responsibility Model for IaaS? (Choose 3.)

Accepted Answer

Security of virtual network controls. Under the IaaS shared responsibility model, the customer is responsible for configuring and managing virtual network controls such as firewalls, route tables, and network ACLs. Google Cloud provides the underlying network infrastructure, but the customer must secure traffic flows and access policies within their VPC.

Answer

Physical security of data centers

Answer

Security of the hypervisor

Question 9

A company needs to detect and redact sensitive data such as email addresses and phone numbers from documents stored in Cloud Storage. They plan to use Cloud DLP. Which two resources must they create first? (Choose TWO).

Accepted Answer

A de-identification template with a redaction transform (e.g., MaskingConfig). Option C is correct because Cloud DLP must first identify the sensitive content before it can be redacted, and an inspection template defines the infoTypes to detect — here EMAIL_ADDRESS and PHONE_NUMBER — which is exactly what is needed to find email addresses and phone numbers in the Cloud Storage documents. Option B is correct because, once findings are produced, a de-identification template specifies the transformation to apply, and a redaction transform (such as a MaskingConfig or redaction primitive) removes or obscures the matched sensitive values as required. Together, the inspection template and the de-identification template are the two reusable configuration resources that a DLP job (or job trigger) references to both detect and redact data. Option A is not required first because a job trigger merely schedules or runs jobs that reference the templates; the templates themselves must exist beforehand. Option D is not needed because Cloud KMS key rings are for customer-managed encryption keys, not for DLP detection or redaction. Option E is not needed because a BigQuery dataset is a storage/analytics resource and is irrelevant when scanning documents in Cloud Storage.

Answer

A DLP job trigger

Answer

A Cloud KMS key ring

Answer

A BigQuery dataset

Question 10

A company wants to enforce that all Compute Engine instances are created with a specific set of tags for compliance. They also want to audit any changes to firewall rules. Which two Google Cloud services or features should they use? (Choose TWO.)

Accepted Answer

Cloud Audit Logs. Organization Policy Service (E) is correct because it lets you enforce constraints across the organization, folder, or project hierarchy, such as requiring specific labels or tags on Compute Engine instances at creation time via constraints like compute.requireLabel or custom constraints, ensuring compliance is enforced rather than merely detected. Cloud Audit Logs (D) is correct because Admin Activity and Data Access audit logs record configuration changes, including firewall rule creations, updates, and deletions, providing the audit trail needed to track any modifications. Cloud Deployment Manager (A) is not correct because it is an infrastructure-as-code provisioning tool that can define tags in templates but cannot enforce that all instances across the organization are created with them. Cloud IAM (B) is not correct because it manages identity and access permissions, not resource tag enforcement or firewall rule change auditing. Cloud Monitoring (C) is not correct because it collects metrics, logs-based metrics, and alerts on operational health, but it does not enforce tag policies or serve as the primary audit record for firewall rule changes.

Answer

Cloud Deployment Manager

Answer

Cloud IAM

Answer

Cloud Monitoring

Question 11

A company uses Cloud KMS with an HSM key for encryption of sensitive data. The compliance team requires that the key material never leaves the HSM boundary. They plan to use the key for symmetric encryption/decryption. Which key purpose should they specify when creating the key?

Accepted Answer

ENCRYPT_DECRYPT. For symmetric encryption/decryption using Cloud KMS, the key purpose must be ENCRYPT_DECRYPT. This purpose supports both encryption and decryption operations with symmetric keys. The HSM-backed key ensures key material never leaves the HSM boundary, satisfying compliance.

Answer

ASYMMETRIC_SIGN

Answer

ASYMMETRIC_DECRYPT

Answer

MAC

Question 12

Which service provides a centralized view of all resource configurations and IAM policies across projects?

Accepted Answer

Cloud Asset Inventory. Cloud Asset Inventory provides a centralized, searchable inventory of all Google Cloud resources and their IAM policies across projects, folders, and organizations. It allows you to query resource metadata and policy bindings via the Cloud Asset API, export asset snapshots to BigQuery or Cloud Storage, and monitor changes. This makes it the correct service for a centralized view of resource configurations and IAM policies.

Answer

Cloud Security Command Center

Answer

Cloud Audit Logs

Answer

Access Transparency

Question 13

A company is designing a PCI DSS-compliant environment on Google Cloud. They need to isolate the cardholder data environment (CDE) and log all access to it. Which THREE actions should they take? (Choose 3)

Accepted Answer

Place all CDE resources in a dedicated VPC.. Option A is correct because placing all CDE resources in a dedicated VPC provides network-level isolation and segmentation from non-CDE workloads, which PCI DSS requires to prevent cardholder data from being exposed to out-of-scope systems. Option B is correct because VPC Service Controls creates a service perimeter around the CDE project, restricting data exfiltration and unauthorized access to Google Cloud APIs and services, directly supporting CDE isolation. Option C is correct because enabling Data Access audit logs for all CDE services records every read/write access to cardholder data, satisfying PCI DSS requirement 10 to log all access to system components and cardholder data. Option D is not correct because SSL policies on Cloud Load Balancing enforce TLS versions/ciphers for traffic termination but do not isolate the CDE or log access to it. Option E is not correct because Cloud Armor WAF protects web applications from external attacks but does not by itself isolate the CDE or provide the required access logging.

Answer

Use Cloud Load Balancing with SSL policies to enforce TLS 1.3.

Answer

Deploy Cloud Armor WAF to protect web applications in the CDE.

Question 14

A company uses Assured Workloads with the FEDRAMP_HIGH regime. They want to enforce resource location restrictions and restrict Google personnel access. Which TWO capabilities should they enable? (Choose two.)

Accepted Answer

Data residency restrictions in the Assured Workloads folder.. Option A (Data residency restrictions in the Assured Workloads folder) is correct because Assured Workloads lets you configure data residency controls at the folder level, ensuring that resources and their data are provisioned only in the compliant locations required by the FEDRAMP_HIGH regime. Option D (Google personnel access restrictions) is correct because Assured Workloads provides personnel access controls that limit Google support and engineering access to customer data, which is a key requirement for the FEDRAMP_HIGH compliance posture. VPC Service Controls (B) is a useful perimeter security tool but is not the Assured Workloads capability that enforces the location and personnel access restrictions described here. Access Transparency logs (C) provide visibility into Google personnel actions but do not themselves restrict access or enforce residency. Cloud KMS (E) manages encryption keys and supports compliance, but it does not implement the resource location or personnel access restrictions the scenario asks for.

Answer

VPC Service Controls.

Answer

Access Transparency logs.

Answer

Cloud KMS to manage encryption keys.

Question 15

An organization uses Cloud NAT to allow private instances to access the internet. They notice that some connections are failing intermittently. What is a common cause?

Accepted Answer

The NAT IP address is exhausted because too many concurrent connections.. Cloud NAT (and NAT gateways generally) allocate a finite pool of external IP addresses, and each IP supports a limited number of concurrent connections (roughly 64,000 per IP per protocol due to port exhaustion). When many private instances open many simultaneous outbound connections, the NAT IP's port range is exhausted, causing new connections to fail intermittently while existing ones continue. This is the classic symptom of NAT port/IP exhaustion rather than a protocol or routing problem.

Answer

The NAT gateway does not support UDP traffic.

Answer

The VPC firewall rules block outbound traffic.

Answer

The instances are in a different region than the NAT gateway.