PCSE Practice Test 3 — 10 Questions

Question 1

An organization uses Cloud Audit Logs to monitor admin activity. The security team wants to be alerted when a user creates a new IAM role at the organization level. Which type of audit log should they analyze?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs (option D) are the correct choice because they record operations that modify the configuration or metadata of resources, such as creating or modifying IAM roles and policies at the organization level. In Google Cloud, Admin Activity audit logs are enabled by default and capture all 'admin write' events, including the creation of an IAM role, which is a configuration change. The security team needs to monitor these logs to detect when a user creates a new IAM role, as this is an administrative action that alters the organization's security posture.

Answer

Policy Denied audit logs

Answer

System Event audit logs

Answer

Data Access audit logs

Question 2

A developer needs to deploy an application on Compute Engine that reads from a Cloud Storage bucket. The engineer wants to avoid managing service account keys. What is the recommended approach to grant the necessary permissions?

Accepted Answer

Create a custom service account, grant it required roles, and attach it to the Compute Engine instance.. Attaching a custom service account directly to a Compute Engine instance is the recommended approach to avoid managing service account keys. This method uses the instance's metadata to provide credentials via the instance metadata server, eliminating the need to download, store, or rotate JSON key files. The custom service account can be granted only the required roles (e.g., Storage Object Viewer) following the principle of least privilege.

Answer

Create a service account, generate a JSON key, and store it on the instance.

Answer

Use the default Compute Engine service account and grant it the Storage Object Viewer role.

Answer

Use Application Default Credentials (ADC) without a service account.

Question 3

A security engineer wants to ensure that sensitive data in BigQuery is masked for analysts but visible in full to data stewards. Which two components must be used together? (Choose TWO.)

Accepted Answer

Data Catalog taxonomy with policy tags. BigQuery column-level security requires a Data Catalog taxonomy with policy tags, and then BigQuery Data Policy to define masking rules (e.g., email masking). Policy tags alone provide access control but not masking; data policies provide the masking.

Answer

Cloud DLP de-identification templates

Answer

IAM roles with conditions on table

Answer

Cloud KMS key for encryption

Question 4

A company is designing a CI/CD pipeline using Cloud Build. Security requirements mandate that the pipeline deploy only to projects that have been explicitly authorized. The security team wants to use a service account that can be assumed by Cloud Build to perform deployments, and they want to restrict which projects can be deployed to using organization policies. Which approach should they take?

Accepted Answer

Use the organization policy constraint 'constraints/iam.allowedPolicyMemberDomains' and set it to only allow the service account's domain.. The organization policy constraint `constraints/iam.allowedPolicyMemberDomains` restricts which domains' principals can be granted roles in the organization. By setting this constraint to only allow the domain that contains the service account used by Cloud Build, you ensure that only service accounts from that domain can be granted roles. Then, you grant that service account the necessary deployment roles (e.g., Compute Instance Admin, Kubernetes Engine Admin) only in the explicitly authorized projects. This combination of organization policy and IAM grants restricts deployment to only those projects, meeting the security requirement.

Answer

Use the organization policy constraint 'constraints/iam.serviceAccountKeyExpiryHours' to force key rotation.

Answer

Use the organization policy constraint 'constraints/compute.restrictCrossProjectNw' to limit network access.

Answer

Use the organization policy constraint 'constraints/iam.workloadIdentityPoolProviders' to restrict which workload identity pools can be used.

Question 5

Which two authentication methods are available for applications to authenticate to Google Cloud APIs without using a service account key? (Choose TWO.)

Accepted Answer

Compute Engine metadata server default service account token. The Compute Engine metadata server provides a default service account token that applications running on Compute Engine can use to authenticate to Google Cloud APIs without needing to manage a service account key file. This token is automatically obtained from the metadata server at http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token, and it is rotated automatically by Google, eliminating the need for key storage and rotation.

Answer

API key

Answer

OAuth 2.0 client ID

Answer

Service account key

Question 6

Which TWO practices help implement the principle of least privilege when configuring access to Google Cloud resources? (Choose two.)

Accepted Answer

Create custom roles that include only the specific permissions needed.. Creating custom roles allows you to define a precise set of permissions, ensuring that a principal has only the minimum permissions required to perform their job function. This directly implements the principle of least privilege by avoiding the broad permissions often included in predefined roles.

Answer

Grant roles at the organization level to simplify administration.

Answer

Use a single service account for all Cloud Functions in a project to simplify key management.

Answer

Grant IAM roles directly to individual users for better traceability.

Question 7

A financial services company runs a PCI DSS-compliant workload on Google Cloud. They use a service account with roles/container.clusterAdmin to manage a GKE cluster. The security team has enabled Binary Authorization with a policy that requires all container images to be signed by a trusted authority. Recently, a developer reported that a new deployment failed with the error: 'Image verification failed: no signature found for digest sha256:abc...'. The image is stored in Artifact Registry and the developer built it using Cloud Build with a trigger that automatically signs images using Cloud KMS. The Cloud Build service account has roles/cloudkms.signerVerifier and roles/binaryauthorization.attestorsViewer. The Binary Authorization policy is configured to require at least one attestation from the trusted attestor. What is the most likely reason for the failure?

Accepted Answer

The Cloud Build service account lacks the roles/binaryauthorization.attestorsEditor role.. The Cloud Build service account has roles/cloudkms.signerVerifier and roles/binaryauthorization.attestorsViewer, which allow it to sign images and view attestors, but it lacks the roles/binaryauthorization.attestorsEditor role. Without this role, the service account cannot create or manage attestations in Binary Authorization, so even though the image is signed, no attestation is recorded, causing the policy to fail with 'no signature found'.

Answer

The container image is stored in a different registry that is not supported by Binary Authorization.

Answer

The GKE cluster's node service account does not have permission to verify attestations.

Answer

The Binary Authorization policy requires an attestation from a different attestor that is not configured.

Question 8

A company uses multiple GCP projects and wants to allow a service account from Project A to initiate Dataflow jobs in Project B. The service account in Project A has the Dataflow Developer role at the organization level. However, it fails with permission denied when trying to submit a job to Project B. What is the most likely issue?

Accepted Answer

The service account needs the Service Account User role on the Dataflow service account in Project B.. The service account from Project A has the Dataflow Developer role at the organization level, which grants permissions to create Dataflow jobs, but it still needs the Service Account User role (roles/iam.serviceAccountUser) on the Dataflow service account in Project B. When a Dataflow job is submitted, the job runs as a service account in the target project (Project B), and the caller must have the iam.serviceAccounts.actAs permission on that service account. Without this role, the API call fails with a permission denied error even though the Dataflow Developer role is present.

Answer

The organization policy restricts cross-project access.

Answer

The service account does not have permission to create Dataflow jobs in Project B because it is not a member of Project B.

Answer

The Dataflow API is not enabled in Project B.

Question 9

Which THREE components are required to configure VPC Flow Logs for a Compute Engine instance?

Accepted Answer

Enable VPC Flow Logs on the subnet. VPC Flow Logs capture network traffic metadata at the subnet level. Enabling flow logs on the subnet (A) is the primary configuration step that activates logging for all VM instances within that subnet. The VM's service account must have the compute.instances.get permission (B) to allow the flow log agent to retrieve instance metadata required for log entries. A VM with a network interface in the subnet (D) is necessary because flow logs are generated per network interface; without a VM in the subnet, there is no traffic to log.

Answer

A log sink to export logs to BigQuery

Answer

A metadata server to store logs

Question 10

An organization wants to enforce that all container images deployed to a GKE cluster must be signed by an approved authority. They have set up Binary Authorization with a policy that requires attestation. Where should the signing key be stored to meet security best practices?

Accepted Answer

Store the private key in Cloud Key Management Service (Cloud KMS).. Binary Authorization integrates with Cloud Key Management Service (KMS) to store attestor keys. Cloud KMS provides centralized key management, access control via IAM, and audit logging. Using a key stored in Cloud KMS is the recommended approach.

Answer

Store the private key in a GCS bucket with uniform bucket-level access.

Answer

Store the private key in Secret Manager.

Answer

Store the private key on the developer's workstation.