PCSE Practice Test 27 — 15 Questions

Question 1

A security team wants to mirror all traffic from a critical VM to a network intrusion detection system (NIDS) appliance running in the same VPC. They need to ensure that the NIDS receives both ingress and egress traffic, and that the original traffic is not impacted. Which solution should they implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a packet mirroring policy that mirrors traffic from the VM to the NIDS instance.. Packet Mirroring (also known as VPC Packet Mirroring) is the correct solution because it copies all ingress and egress traffic from the VM's network interface (vNIC) to the NIDS instance without affecting the original traffic flow. This is achieved by creating a packet mirroring policy that forwards a copy of the packets to the NIDS, ensuring the VM's performance and connectivity remain unchanged.

Answer

Apply a network tag to the VM and create a firewall rule to copy traffic to the NIDS.

Answer

Configure the VM to use the NIDS as a proxy for all traffic.

Answer

Enable VPC Flow Logs on the VM's subnet and forward logs to the NIDS.

Question 2

A company uses Cloud Identity to manage users and groups. They want to synchronize users from their on-premises Active Directory to Cloud Identity. Which tool should they use?

Accepted Answer

Google Cloud Directory Sync (GCDS). Google Cloud Directory Sync (GCDS) is the tool designed to synchronize users, groups, and other directory data from an on-premises Active Directory or LDAP server to Cloud Identity or Google Workspace. It runs on-premises, reads from AD/LDAP, and provisions or updates accounts in the Google directory. This directly matches the requirement to synchronize users from on-premises AD to Cloud Identity.

Answer

Identity and Access Management (IAM)

Answer

Cloud Deployment Manager

Answer

Cloud Identity SDK

Question 3

A healthcare organization needs to redact Social Security Numbers (SSNs) from patient records stored in Cloud Storage before sharing them with a research partner. They plan to use Cloud DLP. Which TWO actions should they take to configure the DLP job correctly? (Choose two.)

Accepted Answer

Apply a de-identification template that uses the 'redact' transformation on the identified SSNs.. Option A is correct because Cloud DLP de-identification templates support the 'redact' transformation, which replaces matched sensitive values with a blacked-out or removed representation, exactly what is needed to strip SSNs from patient records before sharing. Option B is correct because the built-in infoType US_SOCIAL_SECURITY_NUMBER is the predefined detector designed to recognize US SSN patterns (e.g., 123-45-6789), so it must be used to identify the SSNs that will then be redacted. Option C is incorrect because Access Transparency logs only record Google personnel access to customer data; they do not perform redaction or SSN detection. Option D is incorrect because CMEK encryption protects data at rest but does not identify or remove SSNs from the content shared with the research partner. Option E is incorrect because VPC Service Controls restrict network access to the bucket but do not detect or redact SSNs within the objects.

Answer

Configure Access Transparency logs to track who accesses the objects.

Answer

Encrypt the objects with a CMEK key before running the DLP inspection.

Answer

Enable VPC Service Controls to prevent unauthorized access to the bucket.

Question 4

A company wants to implement single sign-on (SSO) for its employees to access the Google Cloud Console using their existing corporate credentials from an on-premises Active Directory. Which THREE components are required? (Choose 3)

Accepted Answer

Cloud Directory Sync to synchronize user and group objects from Active Directory to Google Cloud Directory.. Option B is correct because Cloud Directory Sync (GCDS) is the tool that synchronizes users and groups from on-premises Active Directory into Google Cloud Directory, ensuring the identities exist in Google before SSO is configured. Option D is correct because SSO to the Google Cloud Console requires a SAML 2.0 identity provider, such as AD FS, that authenticates users against Active Directory and issues the SAML assertions Google consumes. Option E is correct because Cloud Identity or Google Workspace is the account layer where the SAML SSO profile is configured and where the synchronized users reside, making it the required Google-side component. Option A is not needed: Workload Identity Federation is for granting external workloads access to Google Cloud resources via service accounts, not for human SSO to the Console. Option C is not required because SAML SSO flows over the public internet via the browser and IdP endpoints; a VPN is not a prerequisite for Console SSO.

Answer

Workload Identity Federation to map AD users to service accounts.

Answer

A VPN connection between the on-premises network and Google Cloud.

Question 5

An organization wants to allow an external identity provider (IdP) that supports OpenID Connect (OIDC) to access GCP resources. They want to avoid creating and managing service account keys. What should they use?

Accepted Answer

Configure Workload Identity Federation to allow the external IdP to impersonate a service account.. Workload Identity Federation allows an external identity provider (IdP) that supports OpenID Connect (OIDC) to impersonate a GCP service account without requiring service account keys. This enables the external IdP to obtain short-lived, scoped tokens directly from GCP, eliminating the need to create, store, or rotate long-lived keys.

Answer

Use Cloud Identity Platform to federate the external IdP.

Answer

Create a service account key and share it with the external IdP.

Answer

Use a VPN tunnel to connect the external IdP to GCP and use internal IPs.

Question 6

A company wants to use Cloud IDS to detect threats in their VPC. They have created a Cloud IDS endpoint and need to configure packet mirroring. Which TWO resources must be in place for packet mirroring to work? (Choose TWO.)

Accepted Answer

A Collector VPC network with the IDS endpoint. Cloud IDS packet mirroring requires two distinct VPC networks: a mirrored VPC network containing the workloads whose traffic is to be inspected (option C), and a separate collector VPC network where the Cloud IDS endpoint is deployed to receive the mirrored packets (option A). The mirrored VPC is the source of the traffic, while the collector VPC hosts the IDS endpoint that performs threat detection, and Google Cloud's packet mirroring policy links the two. Option B is incorrect because source VMs do not need public IP addresses; packet mirroring operates on internal traffic within the VPC regardless of external addressing. Option D is incorrect because Cloud NAT is only needed for outbound internet access and plays no role in mirroring packets to the IDS endpoint. Option E is incorrect because packet mirroring is an internal VPC mechanism and does not require a VPN tunnel between the collector and mirrored networks.

Answer

Public IP addresses on the source VMs

Answer

Cloud NAT on the mirrored VPC

Answer

A VPN tunnel between the collector and mirrored VPCs

Question 7

A security engineer needs to ensure that no one in the organization can disable or delete Cloud Key Management Service (Cloud KMS) keys, except for a designated security team. Which TWO approaches should be combined? (Choose 2 correct answers)

Accepted Answer

Grant the security team the Cloud KMS Admin role (roles/cloudkms.admin) at the organization level.. Option B is correct because granting the security team roles/cloudkms.admin at the organization level ensures they retain the full set of Cloud KMS administrative permissions (including cloudkms.cryptoKeys.disable and cloudkms.cryptoKeys.destroy) across all projects in the org, so they remain the only principals able to manage keys. Option C is correct because an IAM deny policy attached at the organization level explicitly denies cloudkms.cryptoKeys.disable and cloudkms.cryptoKeys.destroy to all principals, and deny policies override allow policies; combined with B, the deny blocks everyone (including inherited admins) while the security team's org-level admin grant is the intended exception path when the deny is scoped to exclude them. Option A is not correct because constraints/cloudkms.disableKeyDeletion is not a valid organization policy constraint for this purpose (the relevant constraint is constraints/cloudkms.disableKeyDeletion is not the documented mechanism; key deletion protection is handled via IAM deny or the key's destroyScheduledDuration), so it would not reliably prevent disabling or deleting keys. Option D is not correct because storing key material in a separate project with private key access control addresses key material isolation, not the disable/delete permissions on Cloud KMS keys. Option E is not correct because an allow policy alone cannot override broader allow grants held by other principals, so it would not prevent non-security-team users from disabling or deleting keys.

Answer

Apply the organization policy constraint constraints/cloudkms.disableKeyDeletion with value True.

Answer

Store the key material in a separate project with a private key access control.

Answer

Create an IAM allow policy at the organization level that grants the same permissions only to the security team.

Question 8

A company is designing a key destruction process for Cloud KMS. They need to ensure that after a key is destroyed, the ciphertext encrypted with that key becomes permanently undecryptable. They also need to allow a 7-day recovery window in case of accidental destruction. Which three steps should they take? (Choose THREE).

Accepted Answer

Schedule destruction of the key and set a destruction period of 7 days.. Option A is correct because scheduling destruction with a 7-day destruction period provides the required recovery window. Option B is correct because in Cloud KMS a key version must be disabled before it can be scheduled for destruction. Option D is correct because you should verify the key is no longer used by active resources before destruction to avoid breaking dependent workloads. Option C is not required: Cloud HSM protects key material in hardware, but it is not required for permanent undecryptability—Cloud KMS permanently destroys key material for software-backed keys as well. Option E is not required: rotation creates a new key version but does not destroy the old version or make existing ciphertext undecryptable.

Answer

Use Cloud HSM to store the key material for additional protection.

Answer

Rotate the key before destruction to create a new version.

Question 9

A developer is running a batch job on Compute Engine that needs to read data from Cloud Storage. What is the recommended way to authenticate the VM to Cloud Storage without managing keys?

Accepted Answer

Use the Compute Engine default service account and grant it the roles/storage.objectViewer role.. The best practice is to use the Compute Engine default service account and grant it the appropriate Storage roles. This avoids managing keys and uses the VM's identity tied to the service account.

Answer

Create a service account key, download it to the VM, and use it with gcloud auth.

Answer

Add the user's personal credentials to the VM and use them.

Answer

Use Application Default Credentials (ADC) from a service account key stored in Secret Manager.

Question 10

A security team wants to enforce that all Compute Engine instances in the organization use Shielded VM features (Secure Boot, vTPM, Integrity Monitoring). What should they configure?

Accepted Answer

The built-in constraint constraints/compute.requireShieldedVm. The organization policy constraint constraints/compute.requireShieldedVm enforces that all new VMs must have Shielded VM enabled. It is a built-in constraint available in the Organization Policy service.

Answer

A custom organization policy with a CEL condition

Answer

An IAM policy that only allows creation of Shielded VMs

Answer

A deny policy that denies the permission compute.instances.create unless Shielded VM is enabled

Question 11

A company is deploying a workload that must comply with FedRAMP High. They are using Assured Workloads. Which TWO controls are automatically enabled when they select the FEDRAMP_HIGH regime?

Accepted Answer

Resource location restrictions (data must remain in the US). When selecting the FEDRAMP_HIGH regime in Assured Workloads, only resource location restrictions (data must remain in the US) and compliance monitoring are automatically enforced. Google personnel access restrictions is an optional control that must be manually enabled. VPC Service Controls and Cloud Armor WAF are not automatically enforced by Assured Workloads.

Answer

Google personnel access restrictions

Answer

VPC Service Controls

Answer

Cloud Armor WAF

Question 12

A company wants to use Chronicle to ingest logs from their on-premises firewalls into Google Cloud. They need to normalize logs into a common schema for analysis. Which Chronicle capability should they use?

Accepted Answer

Unified Data Model (UDM). Chronicle uses the Unified Data Model (UDM) to normalize logs from various sources into a common schema. Log forwarders can collect and send logs to Chronicle, but UDM is the normalization engine. YARA-L rules are for detection, not normalization. The dashboard is for visualization.

Answer

Log forwarders

Answer

YARA-L rules

Answer

Chronicle dashboards

Question 13

A company wants to provide private connectivity from its on-premises network to Google Cloud APIs (e.g., BigQuery, Cloud Storage) without traversing the public internet. They have an existing Dedicated Interconnect connection. Which solution should they use?

Accepted Answer

Private Service Connect. Private Service Connect (PSC) allows private access to Google APIs via private endpoints using internal IP addresses. With Dedicated Interconnect, on-premises traffic can reach these endpoints without going over the internet.

Answer

Cloud NAT

Answer

Cloud VPN with VPC peering

Answer

VPC Service Controls

Question 14

An organization uses Cloud Identity with SAML 2.0 federation. They want to enable single sign-on (SSO) for users accessing Google Cloud Console and also allow access to a custom application behind an HTTPS load balancer using IAP. Which TWO configurations are required? (Choose two.)

Accepted Answer

Enable IAP on the backend service of the HTTPS load balancer. Option E is correct because configuring SAML 2.0 SSO in the Cloud Identity console establishes the federation between Cloud Identity and the external IdP, which is what enables users to sign in once and access Google Cloud Console. Option D is correct because IAP must be enabled on the backend service behind the HTTPS load balancer so that IAP can intercept requests and enforce identity-based access to the custom application. Option A is wrong because a VPN is a network-level tunnel and is not required for SAML-based SSO or IAP. Option B is wrong because IAP uses the user's federated identity, not per-user service accounts, to authorize access. Option C is wrong because Cloud Armor provides WAF/DDoS and IP-based rules, not SAML authentication enforcement.

Answer

Deploy a VPN between the IdP and Google Cloud

Answer

Create a service account for each user to access the application

Answer

Create a Cloud Armor security policy to allow only SAML-authenticated requests

Question 15

A security team wants to analyze VPC Flow Logs for potential data exfiltration. They need a solution that allows querying with SQL and requires minimal setup. Which approach should they take?

Accepted Answer

Export VPC Flow Logs to BigQuery via a log sink, then run SQL queries.. VPC Flow Logs can be exported to BigQuery via a log sink, which enables SQL analysis with minimal setup. Chronicle uses YARA-L rules, not SQL, and requires its own ingestion configuration. Cloud SQL requires a custom pipeline. Cloud Logging Log Analytics also supports SQL queries over logs, but the BigQuery log sink is the standard, managed approach for exporting flow logs to a SQL-queryable dataset.

Answer

Ingest VPC Flow Logs into Chronicle and use YARA-L rules.

Answer

Stream VPC Flow Logs to Cloud SQL using a custom pipeline.

Answer

Export VPC Flow Logs to Cloud Logging and use Log Analytics with SQL.