PCSE Practice Test 28 — 15 Questions

Question 1

Refer to the exhibit. A user jane@example.com receives a 403 Access Denied error when trying to list objects in a Cloud Storage bucket. What is the most likely cause?

Accepted Answer

The IAM condition restricts access to requests originating from the 10.0.0.0/24 IP range. Option B is correct because the IAM policy includes a condition that requires the request to come from an IP starting with '10.0.0.' (private IP). If Jane is accessing from a different IP, the condition fails and access is denied. Option A is wrong; the role includes storage.objects.list. Option C is wrong; there is no indication of a different project. Option D is wrong; the policy is restrictive, not permissive.

Answer

Jane does not have the storage.objects.list permission

Answer

The bucket is in a different project

Answer

The IAM policy is too permissive and conflicts with other policies

Question 2

A company uses a multi-region Cloud Storage bucket for disaster recovery of critical data. They want to prevent accidental deletion of objects by requiring that objects be retained for at least 7 days after creation, and any attempt to delete or overwrite an object during that period must fail. Which configuration meets these requirements?

Accepted Answer

Set a retention policy for 7 days and apply object holds to all objects at upload time.. Option B is correct because retention policies with Object holds ensure minimum retention. Option A is incorrect because bucket lock is for permanent immutability, not flexible retention. Option C is incorrect because versioning alone does not prevent deletion; it allows recovery but does not block deletion. Option D is incorrect because lifecycle management only transitions or deletes based on age, not prevents.

Answer

Enable object versioning and set a lifecycle rule to delete old versions after 7 days.

Answer

Set a bucket lock with a retention policy of 7 days and lock the bucket.

Answer

Use a lifecycle rule to delete objects that are less than 7 days old as a way to block deletion.

Question 3

An organization uses Cloud NAT to allow private instances to access the internet. They notice that some connections are failing intermittently. What is a common cause?

Accepted Answer

The NAT IP address is exhausted because too many concurrent connections.. Option D is correct. Cloud NAT has a limit on the number of concurrent connections per NAT IP due to port exhaustion. When many connections are made, ports can be exhausted, causing intermittent failures. Option A is incorrect because Cloud NAT supports UDP. Option B is a potential cause but the specific failure mode is port exhaustion. Option C is unlikely because outbound traffic is typically allowed by default.

Answer

The NAT gateway does not support UDP traffic.

Answer

The VPC firewall rules block outbound traffic.

Answer

The instances are in a different region than the NAT gateway.

Question 4

Your organization uses Cloud CDN to distribute static content. Recently, users in a specific geographic region are experiencing high latency. What is the most likely cause?

Accepted Answer

There is no CDN edge node in that region. If there is no CDN edge node in that region, traffic must travel directly to the origin, increasing latency.

Answer

The CDN cache has been purged for that region

Answer

The origin server is unhealthy

Answer

The DNS resolution is failing for that region

Question 5

A global company must store customer data in a specific geographic region to comply with data residency regulations. The database needs strong transactional consistency and low-latency reads worldwide. Which database solution should they choose?

Accepted Answer

Use Cloud Spanner with a multi-region configuration that includes the required region. Option C is correct because Cloud Spanner offers global transactional consistency, horizontal scaling, and multi-region configurations for data residency. Option A is wrong because BigQuery is for analytics, not operational transactions. Option B is wrong because Cloud SQL in a single region cannot serve global reads with low latency. Option D is wrong because Firestore in multi-region does not guarantee strong consistency for all operations.

Answer

Use BigQuery with a multi-region dataset

Answer

Use Cloud SQL with cross-region replication

Answer

Use Firestore in multi-region mode

Question 6

Refer to the exhibit. A Cloud Run service fails to start and shows the above error. What is the most likely cause?

Accepted Answer

The application is configured to listen on a different port than the one specified by PORT. Option B is correct because the error explicitly states the container is not listening on the port defined by PORT. Cloud Run expects the container to bind to the port specified in the PORT env var (default 8080). Option A is wrong; the error is about listening, not the variable missing. Option C is wrong; insufficient memory causes different errors. Option D is wrong; concurrent requests are runtime limits, not startup issues.

Answer

The container requires more memory than allocated

Answer

The PORT environment variable is not defined in the container

Answer

The number of concurrent requests exceeds the container's limit

Question 7

Which TWO of the following are valid methods to automate responses to Cloud Security Command Center findings?

Accepted Answer

Create a Cloud Function that is triggered by a Pub/Sub topic receiving SCC notifications.. Options A and D are correct. Cloud Functions can subscribe to SCC notifications via Pub/Sub, and Eventarc triggers can react to findings. Option B is incorrect because Cloud Scheduler is for scheduled jobs. Option C is incorrect because Cloud Run does not directly integrate with SCC. Option E is incorrect because Cloud Tasks is for task distribution, not direct response.

Answer

Set up Cloud Tasks to process SCC findings and send alerts.

Answer

Configure Cloud Run to directly receive webhooks from SCC.

Answer

Use Cloud Scheduler to periodically query SCC and trigger a Cloud Run service.

Question 8

A junior developer created a service account with the roles/storage.admin role and downloaded a JSON key. What is the best practice to improve security?

Accepted Answer

Delete the key and use workload identity federation.. Option D is correct. The best practice is to delete the key and use workload identity federation, which eliminates the need for long-lived keys. Option A is not directly relevant. Option B is partially true, but rotation alone is not as secure as eliminating the key. Option C is not a standard best practice.

Answer

Rotate the key every 30 days.

Answer

Use a user-managed service account instead.

Answer

Restrict the key's usage with IP allowlists.

Question 9

A company has a multi-project setup with a shared VPC. They want to centrally audit all firewall rule changes. What is the most efficient way?

Accepted Answer

Export Admin Activity audit logs to a centralized project's BigQuery dataset.. Option C is correct. Exporting Admin Activity audit logs to a centralized BigQuery dataset allows querying all firewall rule changes across projects. Option A is incorrect because VPC Flow Logs capture network traffic, not rule changes. Option B is incorrect because Cloud Asset Inventory can track assets but not real-time changes efficiently. Option D is less efficient than a single export to BigQuery.

Answer

Create a log sink in each project that routes firewall-related logs to a Cloud Storage bucket and then aggregate.

Answer

Enable VPC Flow Logs on all subnets.

Answer

Use Cloud Asset Inventory with IAM policy change feed.

Question 10

A security analyst wants to detect when a user creates a Compute Engine instance with a public IP address in a sensitive project. What is the best method?

Accepted Answer

Use Cloud Logging with a log-based metric and alert.. Option D is correct. Using Cloud Logging with a log-based metric and alert on the compute.instances.insert log entry checking for the presence of an external IP provides real-time detection. Option A is incorrect because Data Access logs do not capture admin operations. Option B is incorrect because Cloud Asset Inventory is not real-time. Option C is possible but more complex to set up and maintain.

Answer

Create a Cloud Function that triggers on instance creation events.

Answer

Enable Data Access audit logs and filter for insert calls.

Answer

Use Cloud Asset Inventory to create a feed for instance creation.

Question 11

A Cloud Function is timing out. What is the maximum timeout for a Cloud Function (1st gen)?

Accepted Answer

540 seconds. Cloud Functions (1st gen) have a maximum timeout of 540 seconds.

Answer

60 seconds

Answer

900 seconds

Answer

3600 seconds

Question 12

A company is using Cloud Composer (Airflow) to orchestrate data pipelines. A DAG is failing with a 'Task received SIGTERM' error. What is the most likely cause?

Accepted Answer

The task exceeded its execution timeout. SIGTERM is sent when a task exceeds its execution timeout. Other causes produce different signals.

Answer

The worker node was preempted

Answer

The task ran out of memory

Answer

The Airflow scheduler crashed

Question 13

Which TWO actions should you take to reduce the attack surface of a Compute Engine VM? (Choose 2.)

Accepted Answer

Remove public IP addresses. Removing public IP and enabling Secure Boot reduce exposure. vTPM and other options do not directly reduce attack surface.

Answer

Enable Instance Termination Action

Answer

Use preemptible VMs

Answer

Enable Virtual Trusted Platform Module (vTPM)

Question 14

A company runs a batch processing workload on Compute Engine VMs for 6 months. They want to reduce costs without sacrificing performance. Which option should they implement?

Accepted Answer

Purchase committed use discounts for the relevant machine types and regions. Option A is correct because committed use discounts (CUDs) provide significant discounts in exchange for a 1- or 3-year commitment, ideal for steady-state workloads. Option B is wrong because preemptible VMs are not suitable for long-running batch jobs due to termination risk. Option C is wrong because custom machine types may optimize resource use but do not offer discounts like CUDs. Option D is wrong because sole-tenant nodes isolate VMs but do not reduce costs.

Answer

Switch to preemptible VMs

Answer

Use sole-tenant nodes to share resources across projects

Answer

Migrate to custom machine types to eliminate wasted resources

Question 15

A Cloud Function that processes financial data is timing out after 60 seconds. The function performs complex calculations and cannot be decomposed further. What is the best solution?

Accepted Answer

Increase the Cloud Functions timeout to 120 seconds and optimize the code. Option D is correct because Cloud Functions has a maximum timeout of 60 minutes (540 seconds) for HTTP functions; increasing the timeout to 120 seconds and optimizing code can resolve the timeout. Option A is wrong because changing the runtime won't inherently reduce execution time. Option B is wrong because Cloud Run has a similar timeout but also requires code changes; it's more complex than adjusting the function. Option C is wrong because increasing memory alone may improve performance but does not extend timeout beyond 60 seconds.

Answer

Migrate the function to Cloud Run with a longer timeout

Answer

Change the Cloud Functions runtime from Node.js to Python

Answer

Increase the allocated memory for the function

PCSE Practice Test 28 — 15 Questions

Exhibit

PCSE Practice Test 28 — 15 Questions

Exhibit