PCSE Practice Test 29 — 15 Questions

Question 1

An organization wants to run a penetration test on their Google Cloud environment to validate security controls. According to Google's Acceptable Use Policy, which of the following is true regarding penetration testing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Customers can conduct penetration testing without prior approval, but must avoid DoS attacks.. According to Google Cloud's Acceptable Use Policy, customers can conduct penetration testing without prior approval, but they must not perform denial of service (DoS) attacks or other prohibited activities. This policy applies to customer-owned resources and certain Google Cloud services.

Answer

Denial of Service (DoS) testing is permitted as long as it targets only customer-owned IPs.

Answer

All penetration tests require prior approval from Google Cloud support.

Answer

Penetration testing is only allowed on Compute Engine, not on managed services like Cloud SQL.

Question 2

An organization wants to enforce data loss prevention (DLP) for sensitive data stored in Cloud Storage. Which THREE of the following Google Cloud services can be used together to inspect, classify, and automatically redact sensitive data in Cloud Storage? (Choose three.)

Accepted Answer

Cloud Storage. Cloud Storage (B) is correct because it is the target repository where the sensitive data resides; the DLP API can scan and redact objects stored in Cloud Storage buckets, and the redacted output is written back to a bucket. The Cloud Data Loss Prevention (DLP) API (D) is correct because it provides the infoType detectors that inspect and classify sensitive data (e.g., credit card numbers, SSNs) and the de-identification transforms (redaction, masking, tokenization) needed to remove it. Cloud Functions (E) is correct because it can be triggered by Cloud Storage events (via Eventarc or Cloud Storage triggers) to invoke the DLP API and automate the inspection and redaction workflow on newly uploaded objects. BigQuery (A) is not part of this Cloud Storage inspection/redaction pipeline, and Dialogflow CX (C) is a conversational AI service unrelated to DLP.

Answer

BigQuery

Answer

Dialogflow CX

Question 3

An organization wants to restrict access to Google Cloud APIs such as BigQuery and Cloud Storage so that only requests originating from a specific VPC network are allowed. Which Google Cloud service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls creates a service perimeter around Google Cloud APIs (BigQuery, Cloud Storage, etc.) and enforces that requests to those APIs originate from within authorized VPC networks, projects, or identities. It is the only service in the list designed specifically to restrict API access based on VPC network origin.

Answer

Private Service Connect

Answer

VPC firewall rules

Answer

Cloud Armor

Question 4

Which TWO techniques can be used to secure a Cloud Storage bucket containing sensitive data? (Choose 2.)

Accepted Answer

Enable uniform bucket-level access. Option A (Enable uniform bucket-level access) is correct because it disables object ACLs and enforces IAM-only permissions across the entire bucket, eliminating the risk of per-object ACLs inadvertently granting public or overly broad access to sensitive data. Option B (Use a VPC Service Control perimeter) is correct because a VPC Service Controls perimeter creates a security boundary around Cloud Storage (and other services) that restricts data exfiltration by blocking access from outside the perimeter, even if IAM permissions would otherwise allow it. Option C (Set a retention policy) is not a security control for access; it only prevents deletion or modification of objects for a period, which addresses data durability/compliance, not unauthorized access. Option D (Use a CMEK) is a data-at-rest encryption key management choice, but by itself it does not restrict who can read the data—Google-managed encryption already encrypts at rest, and CMEK mainly affects key control/compliance rather than access authorization. Option E (Enable object versioning) only preserves prior object versions to aid recovery from overwrites or deletions; it does not prevent unauthorized access to sensitive data.

Answer

Set a retention policy

Answer

Use a Customer-managed encryption key (CMEK)

Answer

Enable object versioning

Question 5

Your company needs to implement real-time monitoring of security events from Google Cloud resources. They want to ingest logs into a third-party SIEM system. Which two services should they use together? (Choose two.)

Accepted Answer

Cloud Logging log sink with Pub/Sub destination. Option B is correct because a Cloud Logging log sink can route log entries to a Pub/Sub topic, which is the standard mechanism for streaming logs out of Google Cloud in real time to an external system. Option E is correct because the third-party SIEM must consume those messages via a Pub/Sub subscription, where a subscriber pulls (or receives push) the log data for ingestion. Together, the log sink with a Pub/Sub destination plus a Pub/Sub subscription with a pulling subscriber form the real-time streaming pipeline to the third-party SIEM. Option A (Cloud Storage export) is batch-oriented and not real-time, so it does not fit. Option C (Chronicle SIEM) is itself a SIEM, not the ingestion mechanism for a third-party SIEM. Option D (BigQuery export) is for analytics/querying and is not a real-time streaming path to an external SIEM.

Answer

Cloud Storage export

Answer

Chronicle SIEM

Answer

BigQuery export

Question 6

Which THREE Google Cloud services can encrypt data at rest?

Accepted Answer

Cloud Storage. Cloud Storage encrypts data at rest by default using server-side encryption (SSE) with either Google-managed keys or customer-managed keys via Cloud KMS. This ensures that all objects stored in buckets are encrypted before being written to disk, protecting data from unauthorized access at the storage layer.

Answer

Cloud CDN

Answer

Cloud Functions

Question 7

A healthcare organization ingests patient data into Cloud Storage and then processes it with Dataflow. They need to de-identify sensitive fields like Social Security numbers before storing in BigQuery. Which approach should they use?

Accepted Answer

Use Cloud DLP to inspect and transform the data, then store the de-identified results in BigQuery.. Cloud DLP (Data Loss Prevention) is a fully managed service designed to inspect, classify, and de-identify sensitive data such as SSNs. It can be integrated into Dataflow pipelines to transform data before storing it in BigQuery. Using Cloud DLP ensures that de-identification is performed using predefined infoType detectors and transformation methods like masking or tokenization, which is more robust than custom code.

Answer

Use BigQuery column-level security with data masking.

Answer

Write custom Dataflow transformations using a Java SDK to redact SSNs.

Answer

Use Cloud Data Catalog to tag sensitive columns and rely on access control.

Question 8

A company wants to protect its HTTP(S) Load Balancer from common web attacks like SQL injection and cross-site scripting. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is the correct service because it provides web application firewall (WAF) capabilities that can inspect HTTP(S) traffic and filter out common web attacks such as SQL injection and cross-site scripting (XSS). It integrates directly with HTTP(S) Load Balancers to enforce security policies at the edge, blocking malicious requests before they reach backend instances.

Answer

Identity-Aware Proxy (IAP)

Answer

VPC Service Controls

Answer

Cloud CDN

Question 9

Which type of Cloud Audit Logs must be explicitly enabled and incur additional cost?

Accepted Answer

Data Access logs. Data Access logs track read and write operations on resources. They are opt-in, cost extra, and have additional retention costs. Admin Activity logs are free and enabled by default. System Event logs are also free. Policy Denied logs are generated automatically when access is denied.

Answer

Admin Activity logs

Answer

System Event logs

Answer

Policy Denied logs

Question 10

A user should be able to download and delete objects in a specific Cloud Storage bucket. Which two permissions are required in a custom role? (Choose two.)

Accepted Answer

storage.objects.delete. To download an object, the user needs `storage.objects.get` permission, which allows reading the object's data and metadata from the bucket. To delete an object, the user needs `storage.objects.delete` permission, which authorizes the removal of the object from the bucket. These two permissions are the minimum required for download and delete operations on objects within a specific Cloud Storage bucket.

Answer

storage.buckets.list

Answer

storage.buckets.get

Answer

storage.objects.list

Question 11

A company is designing a PCI DSS-compliant architecture on Google Cloud. They need to ensure that the cardholder data environment (CDE) is isolated from other environments and that all access to the CDE is logged. Which THREE controls should they implement? (Choose three.)

Accepted Answer

Separate VPC networks for the CDE and non-CDE environments.. Option A is correct because using separate VPC networks for the CDE and non-CDE environments provides network-level isolation, which is a foundational PCI DSS requirement for segmenting the cardholder data environment from other systems. Option D is correct because Cloud Audit Logs (Admin Activity, Data Access, System Event, and Policy Denied logs) capture access and activity for Google Cloud services in the CDE, satisfying the requirement that all access to the CDE is logged. Option E is correct because VPC Service Controls create a service perimeter that restricts data movement and access to Google Cloud services, adding a strong isolation boundary around the CDE beyond basic VPC segmentation. Option B is not correct because Cloud NAT only provides outbound internet connectivity for private instances and does not isolate the CDE or log access to it. Option C is not correct because Cloud Armor is a WAF for protecting web applications from external attacks, which is useful but does not by itself isolate the CDE or log all access to it.

Answer

Cloud NAT to allow outbound internet access from the CDE.

Answer

Cloud Armor WAF to protect web applications in the CDE.

Question 12

Which TWO of the following are valid reasons to enable VPC Flow Logs? (Choose two.)

Accepted Answer

To perform network forensics after a security incident. Option D is correct because VPC Flow Logs capture metadata about IP traffic to and from network interfaces in a VPC, providing the packet-level records needed to reconstruct what happened during or after a security incident for network forensics. Option E is correct because these same flow records show source/destination IPs, ports, protocol, and whether traffic was allowed or denied, which is exactly the data used to diagnose why connectivity between VMs is failing (e.g., a blocked firewall rule or wrong route). Option A is not a valid reason because Cloud NAT translation logging is provided by Cloud NAT logging, not VPC Flow Logs. Option B is not valid because VPC Flow Logs are passive and observational; they cannot detect or block DDoS attacks, which is handled by Cloud Armor and related network security controls. Option C is not valid because VPC Flow Logs do not automatically enforce or modify firewall rules based on observed traffic patterns; firewall rules must be configured explicitly.

Answer

To log Cloud NAT translations for audit purposes

Answer

To detect and block DDoS attacks at the network layer

Answer

To enforce firewall rules automatically based on traffic patterns

Question 13

Which TWO actions help ensure compliance with data residency requirements in Google Cloud? (Choose two.)

Accepted Answer

Configure Organization policy `gcp.resourceLocations` to restrict allowed locations. The `gcp.resourceLocations` Organization policy constraint explicitly defines the set of Google Cloud regions where resources can be created. By configuring this policy, an organization can enforce that all resources are provisioned only in approved geographic locations, directly meeting data residency requirements that mandate data remain within specific jurisdictions.

Answer

Use Cloud CDN to cache content globally

Answer

Enable Cloud Interconnect for dedicated connectivity

Answer

Use Cloud VPN for site-to-site encryption

Question 14

An organization wants to implement a zero-trust network security model for their Google Cloud environment. Which TWO practices should they adopt? (Choose TWO.)

Accepted Answer

Implement VPC Service Controls to create perimeters around sensitive APIs.. Option A is correct because VPC Service Controls let you define a service perimeter around sensitive Google Cloud APIs (such as Cloud Storage or BigQuery), which enforces context-aware access and prevents data exfiltration even if credentials are compromised—a core zero-trust principle of never trusting the network by default. Option B is correct because using service account targets in firewall rules binds access control to a workload's verified identity rather than to mutable network tags, aligning with zero trust's identity-centric enforcement model. Option C is not correct because Private Google Access only allows VMs without external IPs to reach Google APIs, which is a connectivity feature, not a zero-trust access-control practice. Option D is not correct because network tags are mutable metadata that any user with compute.instances.setTags can change, making them a weak, non-identity-based grouping mechanism unsuitable for zero trust. Option E is not correct because allowing all outbound traffic and relying on intrusion detection violates zero trust's least-privilege and explicit-verification principles.

Answer

Enable Private Google Access for all subnets.

Answer

Use network tags to group VMs for firewall rules.

Answer

Allow all outbound traffic and rely on intrusion detection.

Question 15

Which GCP service provides managed intrusion detection by analyzing mirrored network traffic and using threat signatures from Palo Alto Networks?

Accepted Answer

Cloud IDS. Cloud IDS is Google Cloud's managed intrusion detection service that uses Palo Alto Networks threat signatures to analyze mirrored network traffic and detect intrusions. It provides threat detection without needing to deploy and manage third-party appliances. This exactly matches the description.

Answer

Security Command Center

Answer

Chronicle

Answer

Cloud Armor