PCSE Practice Test 3 — 10 Questions

Question 1

A financial services company must retain audit logs for seven years to meet regulatory requirements. They are using Cloud Audit Logs. Which strategy should they implement to ensure logs are not deleted or modified during the retention period?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Export logs to Cloud Storage and apply a retention policy that is locked to prevent deletion.. Cloud Storage buckets with a locked retention policy provide immutable storage, preventing any deletion or modification of objects during the retention period. This meets the regulatory requirement for audit logs to be retained for seven years without alteration. Exporting logs to Cloud Storage and locking the retention policy ensures compliance with data retention regulations.

Answer

Export logs to BigQuery and set table expiration to 7 years.

Answer

Export logs to a Pub/Sub topic, then subscribe and store in a custom database.

Answer

Store logs in the default Cloud Logging bucket and set a retention period of 7 years.

Question 2

A company has deployed a Cloud Run service that needs to access a Cloud SQL database. They have configured a service account for the Cloud Run service and granted it the Cloud SQL Client role. However, the application is receiving 'Permission denied' errors when trying to connect to the database. The database has a private IP and is in a VPC. What is the most likely cause?

Accepted Answer

Cloud Run cannot reach the private IP because it is not connected to the VPC via Serverless VPC Access.. Cloud Run services run in a Google-managed environment that is not automatically connected to a VPC. To reach a Cloud SQL instance with a private IP, the Cloud Run service must use Serverless VPC Access to establish a VPC connector, which enables direct traffic to the private IP. Without this connector, the service cannot route to the private IP, resulting in 'Permission denied' errors even though the IAM permissions are correct.

Answer

The service account lacks the cloudsql.instances.connect permission.

Answer

The service account is not authorized in the Cloud SQL instance's IAM policy.

Answer

The Cloud SQL instance requires a public IP for Cloud Run to connect.

Question 3

You are configuring a new VPC network with a private subnet for Compute Engine instances that need to access the internet for updates. Which configuration is the simplest and most secure?

Accepted Answer

Configure Cloud NAT to provide outbound internet access for the instances and create a firewall rule that blocks inbound traffic from the internet.. Cloud NAT provides outbound internet access for instances without external IPs, and a firewall rule blocking inbound traffic ensures security. This is the simplest and most secure because it avoids exposing instances directly to the internet while allowing necessary updates.

Answer

Create a default VPC firewall rule that allows all egress traffic and assign only internal IPs to instances.

Answer

Use a managed instance group with a proxy instance that has an external IP, and route traffic through the proxy.

Answer

Assign static external IP addresses to each instance and configure firewall rules to allow egress.

Question 4

A company has an organization policy that denies the use of certain GCP services unless the project is in a specific folder. The DevOps team wants to create a new project in that folder. However, the project creation fails. What is the most likely cause?

Accepted Answer

The user does not have the resourcemanager.projects.create permission at the folder level.. The most likely cause is that the user lacks the `resourcemanager.projects.create` permission at the folder level. Even if the project is being created in a folder that allows GCP services, the user must have the Project Creator role (or equivalent) granted on that specific folder. Without this permission, the creation request is denied by the Resource Manager, regardless of the folder's capacity or the project name's uniqueness.

Answer

The folder has reached its maximum number of projects.

Answer

The project name is already taken.

Answer

The organization policy prevents any project creation in the organization.

Question 5

Match each CVE or security concept to its description.

Accepted Answer

CVE-2017-0144: Exploits SMB protocol to allow remote code execution (EternalBlue). Correct matches: CVE-2017-0144 (EternalBlue) exploits SMB; CVE-2021-44228 (Log4Shell) targets Log4j; CVE-2014-0160 (Heartbleed) leaks OpenSSL memory; buffer overflow is a general memory corruption. Distractors swap descriptions between CVEs.

Answer

CVE-2017-0144: Exploits Apache Log4j logging library

Answer

CVE-2021-44228: Leaks memory from OpenSSL

Question 6

An organization needs to store cryptographic keys that must be protected in a FIPS 140-2 Level 3 validated hardware security module (HSM). Which Google Cloud service should they use?

Accepted Answer

Cloud HSM. Cloud HSM provides FIPS 140-2 Level 3 validated HSM for key material. Keys are generated and stored in the HSM.

Answer

Secret Manager

Answer

Cloud KMS with software-backed keys

Answer

Cloud External Key Manager

Question 7

A security engineer needs to ensure that all container images deployed to a GKE cluster are signed by a trusted authority. The organization uses Cloud KMS for key management and wants to enforce the policy at admission time. Which two components are essential to implement this requirement? (Choose two.)

Accepted Answer

Attestor created in Binary Authorization with Cloud KMS key. Binary Authorization requires attestors to verify image signatures and a policy that requires at least one attestation. Attestors use Cloud KMS keys for signing, and the policy is enforced at GKE admission time.

Answer

Cloud Audit Logs enabled for GKE

Answer

Container Analysis vulnerability scanning

Answer

Web Security Scanner configured to scan the GKE cluster

Question 8

A security engineer notices that some developers are still uploading their own public SSH keys to Compute Engine instances despite the organization policy above being applied to the folder. What is the most likely reason?

Accepted Answer

The policy disables uploading service account keys, not user SSH keys.. The organization policy described likely restricts the uploading of service account keys, not user SSH keys. The policy in question is typically the 'Disable service account key upload' constraint (iam.disableServiceAccountKeyUpload), which prevents users from creating or uploading external service account keys. It does not affect the ability to add public SSH keys to Compute Engine instances, which is governed by separate metadata-based mechanisms (e.g., oslogin or instance metadata). Therefore, developers can still upload their own SSH keys despite the policy being applied.

Answer

The policy only applies to projects, not folders.

Answer

The policy takes 24 hours to propagate to all projects.

Answer

The policy was applied at the organization level, not the folder level.

Question 9

A company uses Cloud Armor Managed Protection Plus to protect their applications. They want to automatically block IP addresses that are identified as malicious by adaptive protection. How should they configure this?

Accepted Answer

Enable 'auto-deploy' in the adaptive protection configuration.. Cloud Armor Adaptive Protection, when part of Managed Protection Plus, can be configured with 'auto-deploy' so that when it detects an anomalous Layer 7 attack (e.g., a sudden spike from a set of IPs), it automatically creates and attaches a pre-configured WAF rule to the target backend service. This removes the need for manual triage and shrinks the response window from minutes to seconds. The auto-deploy option is the only mechanism that natively blocks adaptive-protection-identified IPs without human intervention.

Answer

Manually review adaptive protection alerts and create deny rules.

Answer

Use the 'rate limiting' rule to block high-traffic IPs.

Answer

Set up a Cloud Function to parse logs and create rules via API.

Question 10

A security engineer runs the above query in BigQuery and finds a column containing Social Security Numbers (SSNs). They must ensure that all SSNs in the dataset are automatically encrypted at rest using customer-managed keys (CMEK) and also that future queries do not expose SSNs to users without decryption access. Which approach should they take?

Accepted Answer

Enable CMEK on the dataset, create an authorized view that excludes the sensitive column, and grant view access to users.. Enabling CMEK on the dataset ensures all data, including SSNs, is encrypted at rest with customer-managed keys. Creating an authorized view that excludes the sensitive column and granting view access to users prevents exposure of SSNs in query results while still allowing access to non-sensitive data. This approach meets both the encryption and access control requirements without requiring manual encryption or de-identification.

Answer

Use BigQuery with CMEK on the dataset and create a separate table with encrypted columns.

Answer

Use Cloud DLP to de-identify the data in the table and then restrict access to the de-identified column.

Answer

Use Cloud KMS to encrypt the column values and store the encrypted data in BigQuery.