PCSE Practice Test 27 — 15 Questions

Question 1

A security administrator needs to audit all changes to IAM policies across the organization. They want to detect when a policy binding is added that grants a sensitive role to a user outside the organization. What is the most efficient method?

Accepted Answer

Create a log sink to export Admin Activity audit logs to BigQuery and run queries for setIamPolicy events.. Option A is correct because Admin Activity audit logs capture all setIamPolicy calls, and exporting them to BigQuery allows for powerful querying to detect specific changes. Option B is incorrect because Cloud Asset Inventory can monitor policy changes but setting up feeds and triggers is more complex. Option C is incorrect because Data Access audit logs are for data access, not admin changes. Option D is incorrect because VPC Service Controls are for perimeter security, not auditing.

Answer

Use Cloud Asset Inventory to monitor IAM policy changes and trigger Cloud Functions.

Answer

Enable Data Access audit logs for all services and filter for policy changes.

Answer

Set up VPC Service Controls to prevent external access.

Question 2

A developer accidentally deleted a Cloud SQL instance. The organization has automated backups enabled. How can the DBA restore the instance?

Accepted Answer

Use the gcloud sql backups restore command with the backup ID.. Option B is correct because the gcloud sql backups restore command can restore a backup to a new instance, even if the original instance was deleted. Option A is incorrect because importing a backup is a manual process that requires creating an instance first, which is less direct. Option C is incorrect because restoration is possible. Option D is incorrect because the Cloud Console does not support restoring a deleted instance directly.

Answer

The instance cannot be restored because deletion is permanent.

Answer

Use the Cloud Console to restore from backup of the deleted instance.

Answer

Create a new instance and then import the backup from Cloud Storage.

Question 3

A company uses Cloud Armor to protect their HTTP(S) load balancer. They want to block requests from a specific geographic region. Which TWO actions should they take? (Choose 2)

Accepted Answer

Create a security policy with a geo-match condition for the region.. Options A and B are correct. To block requests by geography in Cloud Armor, you create a security policy with a geo-match condition (A) and then attach that policy to the backend service (B). Option C is incorrect because the deny rule should have a higher priority (lower number) than the default rule, not lower. Option D is unnecessary. Option E is incorrect because Cloud CDN geo-restrictions affect caching, not request blocking.

Answer

Enable Cloud CDN and set geo-restrictions.

Answer

Configure the load balancer to use a custom header for geo-blocking.

Answer

Add a rule in the security policy with deny action and priority lower than the default.

Question 4

Your organization uses Cloud Key Management Service (KMS) to encrypt data at rest. You need to rotate keys automatically every 90 days. Which THREE steps are required? (Choose 3)

Accepted Answer

Re-encrypt any data encrypted with older versions using the new key version.. Options B, C, and E are correct. You need to set a rotation period on the Cloud KMS key (B), enable automatic rotation (C), and re-encrypt any data encrypted with older versions using the new key version (E) to ensure data is protected by the new key. Option A is incorrect because rotation should be automatic. Option D is incorrect because old key versions should not be destroyed immediately; they are needed to decrypt existing data. Option F is unnecessary because automatic rotation is a built-in feature.

Answer

Create a new key version every 90 days manually.

Answer

Ensure the key is destroyed after rotation.

Answer

Use a Cloud Function to trigger rotation.

Question 5

Refer to the exhibit. A VM in the default network with internal IP 10.128.0.5 is unable to reach a VM at 10.0.0.4 over TCP port 22. What is the most likely cause?

Accepted Answer

The deny-all rule has higher priority than default-allow-internal.. Option C is correct. The deny-all rule (priority 2000) has a higher priority (lower number) than the default-allow-internal rule (priority 65534). Since the deny-all rule blocks all TCP traffic from the 10.0.0.0/8 range, it overrides the default-allow-internal rule, blocking SSH traffic from 10.0.0.4 to 10.128.0.5. Option A is incorrect because the deny rule denies traffic from 10.0.0.0/8, not to it. Option B is incorrect because default-allow-internal allows all TCP traffic. Option D is incorrect because default-allow-internal covers SSH; the issue is priority.

Answer

The deny-all rule blocks traffic from 10.0.0.4 to the VM.

Answer

The default-allow-internal rule does not cover port 22.

Answer

There is no rule allowing SSH traffic from 10.0.0.4.

Question 6

Refer to the exhibit. This IAM policy is applied to a Google Cloud Storage bucket. Alice reports she cannot delete objects in the bucket. Bob can delete objects. What is the most likely reason?

Accepted Answer

Alice has only objectViewer role, which does not allow deletion.. Option A is correct. The policy shows Alice has only the roles/storage.objectViewer role, which does not include delete permissions. Bob, although listed in the same binding, must have additional permissions from another policy (e.g., at the project level) that allow him to delete objects. Option B is incorrect because Bob's ability is likely due to inherited permissions, but the exhibit only shows this policy. Option C is irrelevant because the service account does not affect Bob's permissions. Option D is incorrect; etag is used for concurrent modification prevention.

Answer

The service account has objectAdmin role, but Bob is not a member.

Answer

The etag mismatch causes a conflict.

Answer

Bob has a higher role inherited from the project level.

Question 7

Refer to the exhibit. A user tries to create a Compute Engine instance using a custom image from another project. What is the most likely cause of the error?

Accepted Answer

The image family does not exist in the specified project.. Option C is correct. The error message explicitly states that the image family does not exist in the specified project. Option A is possible, but the error specifically says the image family does not exist. Option B would result in a permission denied error, not this error. Option D is incorrect because the project ID is specified in the image path; if it were wrong, the error would indicate an invalid project.

Answer

The user does not have permission to use images from the other project.

Answer

The user specified the wrong project ID.

Answer

The image family name is misspelled.

Question 8

A company is using Cloud Monitoring to track latency of a microservice. They notice a sudden spike in the 99th percentile latency but no change in request count. What is the most likely cause?

Accepted Answer

A single slow query to a backend database. A single slow query to a backend database can increase p99 latency without affecting request count. Other options would affect availability or count.

Answer

A pod restart in GKE

Answer

A misconfigured health check causing 503s

Answer

A DDoS attack

Question 9

Which service provides a centralized view of all resource configurations and IAM policies across projects?

Accepted Answer

Cloud Asset Inventory. Option B is correct. Cloud Asset Inventory provides a centralized view of all resources and their IAM policies across projects. Option A, Cloud Security Command Center, provides security findings and vulnerabilities, not a full inventory. Option C, Access Transparency, logs Google support access. Option D, Cloud Audit Logs, records API calls but not a static inventory.

Answer

Cloud Security Command Center

Answer

Cloud Audit Logs

Answer

Access Transparency

Question 10

A security engineer needs to ensure that all compute instances are patched with the latest security updates. What is the recommended approach?

Accepted Answer

Use the VM Manager patch deployment feature.. Option D is correct. The VM Manager patch deployment feature within OS Config Management provides a managed, automated patching solution. Option A is not a built-in Google Cloud service. Option B is partially correct, but VM Manager is the specific managed patching service. Option C is less reliable and manual. Option D is the most comprehensive and automated.

Answer

Use OS Config Management with patch compliance reporting.

Answer

Use a configuration management tool like Chef.

Answer

Use Cloud Scheduler to run a script that patches instances.

Question 11

A DevOps team wants to automatically scale a managed instance group based on CPU utilization. Which metric should they use in the autoscaler?

Accepted Answer

'compute.googleapis.com/instance/cpu/utilization'. The compute.googleapis.com/instance/cpu/utilization metric measures actual CPU usage, suitable for autoscaling.

Answer

'compute.googleapis.com/instance/cpu/usage_time'

Answer

'compute.googleapis.com/instance/cpu/reserved_cores'

Answer

'agent.googleapis.com/cpu/utilization'

Question 12

A security operations team is using Cloud Audit Logs to investigate a suspicious data export from a Cloud Storage bucket. They need to see which user accessed a specific object and when. Which log type should they examine?

Accepted Answer

Admin Activity logs. Data Access logs record object-level operations on Cloud Storage. Admin Activity logs only cover configuration changes.

Answer

Data Access logs

Answer

Policy Denied logs

Answer

System Event logs

Question 13

A security team needs to centrally manage secrets for multiple Google Cloud projects. Which solution should they use?

Accepted Answer

Use Secret Manager. Option D is correct because Secret Manager provides a centralized, durable, and scalable solution for storing and managing secrets across projects. Option A is wrong because storing secrets in Cloud Storage with encryption still requires managing access and does not offer built-in versioning or rotation. Option B is wrong because hardcoding secrets in code is insecure. Option C is wrong because Cloud KMS is for managing encryption keys, not secrets.

Answer

Hardcode secrets in application code and use IAM with access scopes

Answer

Use Cloud Key Management Service (Cloud KMS) to store and manage secrets

Answer

Store secrets in encrypted Cloud Storage buckets

Question 14

Users are reporting 502 Bad Gateway errors when accessing an application behind an external HTTPS Load Balancer. What is the most likely cause?

Accepted Answer

The backend instances are unhealthy or the SSL certificate is invalid. Option B is correct because 502 errors typically indicate that the load balancer cannot communicate with the backend, often due to unhealthy instances or SSL certificate issues. Option A is wrong because connection limits cause 503 or 429 errors, not 502. Option C is wrong because the load balancer type is correct for HTTPS. Option D is wrong because CDN affects content delivery, not backend connectivity.

Answer

Cloud CDN is not enabled for the load balancer

Answer

The backend instances have reached maximum concurrent connections

Answer

The load balancer is configured as an internal load balancer

Question 15

Refer to the exhibit. A developer working from a workstation with IP 203.0.113.5 cannot SSH to a VM in the my-vpc network. Which firewall rule is most likely blocking the connection?

Accepted Answer

deny-ssh-all. Option C is correct because the deny-ssh-all rule has a priority of 200 (higher priority than the allow rules at 500 and 1000) and blocks SSH from all IPs. The order in GCP is based on priority (lower number = higher priority), so the deny overrides the allows. The allow-ssh-from-bastion only permits SSH from 10.0.1.2, not the developer's IP.

Answer

allow-ssh-from-bastion

Answer

default-allow-http

Answer

default-allow-ssh