PCSE Practice Test 26 — 15 Questions

Question 1

A company wants to use Cloud Audit Logs to monitor for security incidents. They need to retain logs for 6 months for analysis and then archive them for 5 years. Which TWO steps should they take?

Accepted Answer

Create a log sink to Cloud Storage with the Archive storage class and Bucket Lock retention of 5 years.. Create a log sink to BigQuery for short-term analysis (6 months) with a table expiration. Create another sink to Cloud Storage with an archive class and a retention policy for long-term archival. A single sink cannot do both. Pub/Sub is not archival. Default retention is only 400 days.

Answer

Rely on the default 400-day retention in Cloud Logging.

Answer

Enable Data Access logs for all services.

Answer

Create a log sink to Pub/Sub and store in Cloud SQL.

Question 2

An organization wants to detect and respond to potential data exfiltration attempts via VPC Flow Logs. They plan to export VPC Flow Logs to BigQuery for analysis. Which TWO actions should they take to enable this? (Choose TWO.)

Accepted Answer

Create a log sink with a filter for compute.googleapis.com/vpc_flows and destination BigQuery.. To export VPC Flow Logs to BigQuery, you need to create a log sink that filters for VPC Flow Logs and exports to BigQuery. The sink must be configured with a destination of BigQuery. Enabling Data Access logs is not required for VPC Flow Logs.

Answer

Set up a Cloud Function to copy logs from Cloud Logging to BigQuery.

Answer

Create a BigQuery view to filter VPC Flow Logs.

Answer

Enable Data Access logs for Compute Engine.

Question 3

A company subject to PCI DSS is building a cardholder data environment (CDE) on Google Cloud. They need to encrypt cardholder data at rest and in transit. Which THREE measures should they implement? (Choose three.)

Accepted Answer

Enforce TLS 1.2 or higher for data in transit.. PCI DSS requires strong encryption. CMEK allows customer-managed keys for at-rest encryption. TLS 1.2 or higher encrypts data in transit. Cloud KMS is used to manage encryption keys. Cloud Armor is a WAF, not encryption. VPC Service Controls provide network segmentation, not encryption. Cloud HSM is a hardware-backed key storage, but the question asks for measures that encrypt data; CMEK, TLS, and Cloud KMS are directly related to encryption.

Answer

Configure Cloud Armor WAF to inspect traffic.

Answer

Use VPC Service Controls to isolate the CDE.

Question 4

Which Security Command Center (SCC) tier provides built-in compliance monitoring for standards like CIS and PCI DSS?

Accepted Answer

Premium tier. Compliance monitoring is a feature of SCC Premium tier. Standard tier includes Security Health Analytics but not compliance monitoring. Event Threat Detection is also Premium.

Answer

Neither; compliance monitoring is part of Cloud Audit Logs

Answer

Both Standard and Premium

Answer

Standard tier

Question 5

An organization wants to use Web Security Scanner to find vulnerabilities in their web application. Which TWO finding types can Web Security Scanner detect?

Accepted Answer

Cross-site scripting (XSS). Web Security Scanner detects XSS, mixed content, outdated libraries, and other common web vulnerabilities, but not SQL injection or SSRF.

Answer

Insecure deserialization

Answer

Server-side request forgery (SSRF)

Answer

SQL injection

Question 6

A company uses Chronicle as their SIEM. They need to ingest logs from an on-premises firewall that does not support direct integration with Chronicle. What is the recommended approach to ingest these logs?

Accepted Answer

Install a Chronicle forwarder on a local server to collect and forward logs to Chronicle.. Chronicle provides forwarders (software agents) that can be installed on a machine to collect logs from various sources like firewalls and forward them to Chronicle. The forwarder normalizes logs into UDM. The forwarder can be deployed on-premises or in a VM.

Answer

Use the firewall's syslog capabilities to send logs directly to a Chronicle endpoint.

Answer

Export firewall logs to Cloud Storage and then create a BigQuery external table for Chronicle.

Answer

Use a Cloud Function to pull logs from the firewall and push them to Chronicle via API.

Question 7

A company wants to enforce that all GKE clusters in their organization use Binary Authorization with a specific attestor. They have multiple projects and want to set this policy centrally. Which approach should they use?

Accepted Answer

Use the organization policy service to set a constraint that requires Binary Authorization enforcement across all projects.. Organization policies can enforce constraints at the organization, folder, or project level. The Binary Authorization policy can be set at the organization level using a constraint, but the specific attestor configuration is done via the Binary Authorization API per project. However, to enforce the use of Binary Authorization, you can use an organization policy constraint 'constraints/gcp.restrictBinaryAuthorizationPolicy'.

Answer

Create a Binary Authorization policy in each project and use a script to apply it.

Answer

Create a shared VPC and enable Binary Authorization on the host project.

Answer

Use Deployment Manager to deploy Binary Authorization configuration to all projects.

Question 8

You need to configure automated remediation for high-severity SCC findings. When a finding of type 'VULNERABILITY' with severity 'HIGH' is created, a Cloud Function should execute a script to patch the vulnerable VM. Which architecture is correct?

Accepted Answer

Configure SCC to publish findings to a Pub/Sub topic, and set up a Cloud Function subscribed to that topic. SCC can publish findings to a Pub/Sub topic. A Cloud Function subscribed to that topic can then trigger remediation actions. The Cloud Function must filter findings by severity and type.

Answer

Configure SCC to send findings to Cloud Storage, then use Cloud Functions on object change

Answer

Use Cloud Scheduler to poll SCC API every minute and trigger Cloud Function

Answer

Configure SCC to send notifications to Cloud Logging, then create a log-based metric and alert to trigger Cloud Function

Question 9

A company needs to store financial records for 7 years to meet regulatory requirements. They want to ensure that once written, the records cannot be modified or deleted by anyone, including cloud administrators. Which Cloud Storage feature should they enable?

Accepted Answer

Object Retention Lock with a locked retention policy. Object Retention Lock with a retention policy enforces a WORM (Write Once, Read Many) policy. Once a retention policy is locked, objects cannot be deleted or overwritten until the retention period expires, even by project owners. Bucket Lock (which is part of Object Retention Lock) makes the retention policy immutable. Object Versioning allows multiple versions but does not prevent deletion. CMEK provides encryption control, not immutability. Lifecycle management automates deletion, which is opposite of what is needed.

Answer

Lifecycle management rules

Answer

Object Versioning

Answer

Customer-Managed Encryption Keys (CMEK)

Question 10

A financial institution is required to retain records of all transactions for 7 years under regulatory compliance. They are using Cloud Storage for archive data and need to ensure that objects cannot be deleted or overwritten during the retention period. Which feature should they use?

Accepted Answer

Retention Policy with Retention Lock. Cloud Storage Object Retention Lock with a retention policy enforces a WORM (Write Once Read Many) state, preventing object deletion or modification for a specified duration. This meets regulatory retention requirements.

Answer

Object lifecycle management

Answer

Bucket-level IAM conditions

Answer

Bucket-level versioning

Question 11

A healthcare organization is required to protect Protected Health Information (PHI) stored in Cloud Storage. They want to automatically detect and redact PHI before storing it. Which Google Cloud service should they use?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud DLP can inspect Cloud Storage buckets for sensitive data like PHI and redact or de-identify it automatically using its inspect and transform pipeline.

Answer

Cloud Armor

Answer

VPC Service Controls

Answer

Security Command Center

Question 12

A company is using Assured Workloads to meet EU data residency requirements (EU_REGIONS_AND_SUPPORT). They want to monitor compliance drift when changes are made to the environment. Which service should they use?

Accepted Answer

Assured Workloads Compliance Monitoring. Assured Workloads Compliance Monitoring (part of Assured Workloads) continuously monitors the environment for compliance with the selected regime (e.g., data residency). It alerts on drift. Alternatively, Cloud Security Command Center (Cloud SCC) can be used, but the question asks for monitoring compliance drift specifically. The built-in monitoring in Assured Workloads is the correct answer.

Answer

Cloud Audit Logs

Answer

Cloud Monitoring

Answer

Cloud Security Command Center

Question 13

A financial institution is deploying a payment application on GKE that must comply with PCI DSS. They need to isolate the cardholder data environment (CDE) from other workloads and ensure only authorized services can communicate. Which combination of controls should they implement?

Accepted Answer

Use a separate VPC and VPC Service Controls perimeter for the CDE, and apply Kubernetes Network Policies to restrict pod communication.. VPC Service Controls provide a perimeter that prevents data exfiltration from managed services, while GKE network policies enforce pod-level isolation. Both are recommended for PCI DSS CDE isolation.

Answer

Use Cloud Armor to inspect all traffic and block non-compliant requests.

Answer

Enable Data Loss Prevention to scan payment data and restrict access.

Answer

Deploy the CDE in a separate project and use IAM roles to restrict access.

Question 14

A company using Assured Workloads with the FedRAMP High compliance regime wants to monitor for configuration changes that could cause the environment to become non-compliant. Which tool should they use to detect compliance drift?

Accepted Answer

Assured Workloads Compliance Status dashboard. Assured Workloads provides a Compliance Status dashboard that shows the compliance state of the folder. It monitors for policy violations and configuration drifts that could affect compliance. Security Command Center provides security posture, but not specifically compliance drift for Assured Workloads. Cloud Monitoring monitors metrics, not compliance. Cloud Asset Inventory tracks resources but does not evaluate compliance against a regime.

Answer

Security Command Center

Answer

Cloud Monitoring

Answer

Cloud Asset Inventory

Question 15

A company is using Assured Workloads to enforce FEDRAMP_HIGH compliance. They need to ensure that only US-based personnel from Google can access their data. Which configuration setting within the Assured Workloads folder should they enable?

Accepted Answer

Google personnel access restrictions. Assured Workloads provides access restrictions that can limit Google personnel access based on geographic location. The 'Google personnel access restrictions' setting can be configured to restrict access to Google personnel located in specific countries, e.g., the United States. The compliance regime selection defines the overall framework, while resource location restrictions control where data is stored.

Answer

Access Transparency logs

Answer

Resource location restrictions

Answer

Key Access Justification (KAJ) logs