PCSE Practice Test 26 — 15 Questions

Question 1

An organization's security policy requires that all audit logs be stored in a separate project for centralized monitoring. Which Google Cloud service should be used to aggregate logs from multiple projects?

Accepted Answer

Cloud Logging with log sinks. Option C is correct because Cloud Logging log sinks can be configured to route logs from multiple projects to a common destination like a Cloud Storage bucket or BigQuery dataset in a separate project. Option A is for metrics and alerting, not log aggregation. Option B is a type of log, not a service. Option D is for security findings and compliance, not log aggregation.

Answer

Cloud Monitoring

Answer

Cloud Audit Logs

Answer

Security Command Center

Question 2

A security engineer notices that a service account has been granted the 'roles/editor' role on a project. According to least privilege, what is the best course of action?

Accepted Answer

Create a custom role with only the necessary permissions and reassign it to the service account.. Option D is correct because creating a custom role with only the necessary permissions and reassigning it minimizes privileges while maintaining functionality. Option A is too drastic and may break services. Option B may be too restrictive. Option C doesn't change the permissions; VPC Service Controls restrict access at the network level, not permissions.

Answer

Remove the service account and create a new one with a custom role containing only required permissions.

Answer

Change the role to 'roles/viewer' to be more restrictive.

Answer

Keep the role but add an access boundary using VPC Service Controls.

Question 3

A company uses Cloud Functions and wants to ensure that only authorized services can invoke them. The functions are triggered via HTTP. What is the best way to achieve this?

Accepted Answer

Use Cloud Endpoints with API keys and IAM.. Option A is correct because Cloud Endpoints can authenticate and authorize requests using API keys and IAM, providing fine-grained access control. Option B is not suitable for HTTP-triggered Cloud Functions as VPC connectors are for internal network access. Option C is designed for Firebase mobile clients, not service-to-service. Option D is insecure as URLs can be guessed or leaked.

Answer

Set a VPC connector and allow only internal traffic.

Answer

Rely on the Cloud Functions URL being unguessable.

Answer

Use Firebase Authentication.

Question 4

During an incident, a security engineer needs to isolate a compromised Compute Engine instance for forensic analysis without losing evidence. What should they do first?

Accepted Answer

Create a snapshot of the instance's persistent disks.. Option B is correct because taking a snapshot of the persistent disks preserves the disk state for forensic analysis without altering the instance. Option A may cause loss of volatile data but is acceptable; however, snapshot is the recommended first step to capture data. Option C disconnects the instance but may not prevent further damage. Option D destroys evidence.

Answer

Disconnect the instance from the VPC network.

Answer

Shut down the instance immediately.

Answer

Delete the instance to prevent further damage.

Question 5

An organization uses Cloud VPN tunnels to connect multiple VPCs. They need to record all network metadata for compliance audits without affecting throughput. What is the most effective approach?

Accepted Answer

Enable VPC Flow Logs on all subnets and export logs to a centralized BigQuery dataset.. Option A is correct because VPC Flow Logs capture metadata of all network flows with minimal performance impact, and exporting to BigQuery enables analysis. Option B is resource-intensive and may impact throughput. Option C only captures VPN tunnel status, not traffic metadata. Option D mirrors traffic, which can be costly and impact performance.

Answer

Install a third-party packet inspection appliance in each VPC.

Answer

Configure Packet Mirroring to mirror all VPN traffic to a collector.

Answer

Use Cloud Logging to capture VPN tunnel logs from Cloud Router.

Question 6

During a security incident, a security engineer needs to revoke a compromised service account's access across all resources immediately. However, the service account has many roles across different projects. What is the most effective immediate step?

Accepted Answer

Disable the service account.. Option D is correct because disabling the service account immediately revokes all access without removing IAM policies, allowing quick recovery later. Option A is irreversible and may break dependencies. Option B only prevents key-based authentication; the account can still be used from VM instances. Option C is time-consuming and error-prone.

Answer

Remove all IAM policies that include the service account.

Answer

Disable the service account key.

Answer

Delete the service account from the project.

Question 7

A company uses Cloud Identity-Aware Proxy (IAP) to secure access to their web applications. They notice that some users are able to access the application even though they are not in the IAP access policy. What could be the cause?

Accepted Answer

The backend service has an external IP address and firewall rule allowing public access.. Option C is correct because if the backend service has an external IP address and a firewall rule allowing public access, users can bypass IAP entirely. Option A would actually grant legitimate access. Option B would cause IAP to fail for all users. Option D is a legitimate way to grant access.

Answer

The users have been granted the 'roles/iap.httpsResourceAccessor' role at the folder level.

Answer

The load balancer is not using HTTPS.

Answer

The users are using a service account that has the 'roles/iap.httpsResourceAccessor' role.

Question 8

A security engineer is configuring VPC Service Controls to protect a service perimeter. Which TWO conditions must be met for a request to be allowed across the perimeter? (Choose TWO.)

Accepted Answer

The request includes a valid access context manager access level.. Options B and D are correct. A request is allowed if it originates from a project within the perimeter and meets the required access levels. Option A is not a direct condition; IP ranges are part of access levels. Option C is not a standalone condition; service accounts are allowed based on identity and access levels. Option E is also part of access levels.

Answer

The request is made by an identity that belongs to an allowed domain.

Answer

The request comes from an allowed IP range.

Answer

The request is made by a service account that has been granted access.

Question 9

A security engineer is designing a logging and monitoring strategy to meet compliance requirements. Which THREE services should be integrated to ensure log data is tamper-proof and available for analysis? (Choose THREE.)

Accepted Answer

Cloud Logging. Options A, B, and D are correct. Cloud Logging ingests logs, Cloud Storage with Object Lock provides immutability, and BigQuery allows querying. Option C is a type of log, not a service. Option E is for security findings, not log management.

Answer

Cloud Audit Logs

Answer

Security Command Center

Question 10

An organization wants to ensure that all service accounts used by Compute Engine instances have the minimal permissions required. Which TWO practices should be implemented? (Choose 2)

Accepted Answer

Create custom service accounts with only the needed roles.. Options B and D are correct. Creating custom service accounts with only the needed roles (B) ensures minimal permissions. Disabling service account key creation (D) reduces the risk of key exposure. Option A is incorrect because the default compute service account often has excessive permissions. Option C is incorrect because Access Transparency is for auditing Google support access. Option E is incorrect because attaching a service account after instance creation is possible but not a best practice for minimal permissions; it should be assigned at creation.

Answer

Attach service accounts to instances using the gcloud compute instances set-service-account command after creation.

Answer

Use the default compute service account and restrict its scopes.

Answer

Use Access Transparency to audit service account usage.

Question 11

A security engineer is responding to a data breach where an attacker exfiltrated data from a Cloud Storage bucket. Which TWO steps should the engineer take to contain the breach and preserve evidence? (Choose TWO.)

Accepted Answer

Disable the bucket's public access.. Options A and C are correct. Disabling public access stops further exfiltration, and creating a copy preserves the bucket's data for forensics. Removing IAM policies (B) may disrupt analysis. Enabling logs (D) after the breach won't capture past events. Deleting the bucket (E) destroys evidence.

Answer

Remove the bucket's IAM policies.

Answer

Delete the bucket to prevent further exfiltration.

Answer

Enable Cloud Audit Logs for data access.

Question 12

An engineer notices that traffic on port 80 is not reaching instances with the tag 'http-server'. The instances have external IPs and are in the default VPC. What could be the reason?

Accepted Answer

A deny rule with a lower priority number (higher priority) exists and blocks the traffic.. Option B is correct because if a deny rule with a lower priority number (higher priority) exists, it will block traffic despite the allow rule. Option A is incorrect because sourceRanges includes all IPs. Option C is incorrect because the rule targets the correct tags. Option D is incorrect because direction is correctly INGRESS for incoming traffic.

Answer

The sourceRanges does not include the instance's public IP.

Answer

The targetTags are not applied to the instances.

Answer

The direction should be EGRESS.

Question 13

A security engineer is reviewing an IAM policy for a Cloud Storage bucket. The engineer wants to ensure that the service account 'sa@project.iam.gserviceaccount.com' can only read objects. What is the current effective permission?

Accepted Answer

The service account has objectViewer access as assigned.. Option C is correct because the service account is assigned the objectViewer role, which allows read-only access. Option A is incorrect because the service account does not have objectAdmin. Option B is incorrect because there is no explicit deny; the viewer role is assigned. Option D is incorrect because objectCreator is not granted.

Answer

The service account has objectCreator access by default.

Answer

The service account has no access because the policy is incomplete.

Answer

The service account has objectAdmin access because it is not explicitly denied.

Question 14

During an incident, a security engineer finds this audit log entry. What action was taken and by whom?

Accepted Answer

A user deleted an instance named 'instance-1'.. Option D is correct because methodName is 'v1.compute.instances.delete', indicating a delete operation, and the principal is admin@example.com. Option A is incorrect because the method is delete, not create. Option B is incorrect because the method is delete, not modify. Option C is incorrect because the method is delete, not update.

Answer

A user modified instance 'instance-1'.

Answer

A user created an instance named 'instance-1'.

Answer

A user stopped instance 'instance-1'.

Question 15

A company has a VPC with several subnets. They want to restrict traffic between instances in the same subnet using firewall rules while allowing traffic from a specific load balancer health check range. What is the best approach?

Accepted Answer

Create a firewall rule that allows only health check traffic and deny all other ingress by default using implied deny.. Option C is correct because GCP VPC firewall rules have an implied deny at the end; therefore, allowing only the health check traffic and relying on the implied deny for other traffic is the simplest and most secure approach. Option A is incorrect because a deny rule with higher priority than an allow rule would block the allowed traffic. Option B is incorrect because target tags are useful but do not directly address restricting internal subnet traffic. Option D is incorrect because hierarchical policies are for organization-level rules, not for this specific subnet restriction.

Answer

Create an ingress firewall rule denying all traffic from the subnet CIDR, then create a higher priority rule allowing traffic from the health check range.

Answer

Use hierarchical firewall policies to enforce the rule at the organization level.

Answer

Use VPC firewall rules with target tags to apply rules only to instances that need health checks.