PCSE Practice Test 30 — 15 Questions

Question 1

A security engineer receives an alert from Cloud Security Command Center (Cloud SCC) about a resource that is publicly accessible. The engineer identifies that the resource is a Cloud Storage bucket containing sensitive data. After making the bucket private, what is the next best step to prevent recurrence?

Accepted Answer

Create a Cloud Security Command Center notification for public bucket findings and use a Cloud Function to automatically disable public access.. Option B is correct because creating a security health analytics sink to Pub/Sub enables automated remediation. Option A is incorrect because deleting the bucket may lose data. Option C is incorrect because disabling public access at the organization level might be too broad and impact legitimate needs. Option D is incorrect because relying on documentation is not preventive.

Answer

Add a note in the operations runbook to check bucket permissions weekly.

Answer

Delete the bucket and all its contents to avoid future exposure.

Answer

Set an organization policy to disable public access to all Cloud Storage buckets.

Question 2

A security administrator needs to ensure that all service account keys older than 90 days are automatically disabled to reduce the risk of key compromise. Which Google Cloud service should be used to implement this policy?

Accepted Answer

Organization Policy Service. Option D is correct because Organization Policies can enforce constraints like disabling automatic key creation or setting key expiration. Option A is incorrect because IAM itself does not have lifecycle policies. Option B is incorrect because Secret Manager does not manage service account keys. Option C is incorrect because Cloud Key Management Service does not manage service account keys.

Answer

Cloud Secret Manager

Answer

Cloud IAM

Answer

Cloud Key Management Service

Question 3

Which TWO of the following are true regarding Cloud Audit Logs?

Accepted Answer

Admin Activity audit logs are enabled by default and cannot be disabled.. Options A and C are correct. Admin Activity audit logs are always enabled by default and cannot be disabled. System Event audit logs are also enabled but capture Google Cloud actions. Option B is incorrect because Data Access logs are disabled by default and need to be enabled. Option D is incorrect because Cloud Audit Logs do NOT include metrics, only logs. Option E is incorrect because all audit logs are retained for 400 days by default.

Answer

Data Access audit logs are enabled by default for all services.

Answer

Cloud Audit Logs are retained indefinitely unless a retention policy is set.

Answer

Cloud Audit Logs include monitoring metrics for log volume.

Question 4

A company wants to monitor for suspicious login attempts across all their Google Cloud projects. They want to send a real-time Slack notification when a login fails from an IP address outside their corporate CIDR range. What is the most efficient way to achieve this?

Accepted Answer

Export Admin Activity audit logs to a Pub/Sub topic via a sink, and use a Cloud Function that subscribes to the topic to filter and post to Slack.. Option A is correct because Admin Activity audit logs capture login events, and a Cloud Logging sink to Pub/Sub enables real-time streaming to a Cloud Function that posts to Slack. Option B is incorrect because Cloud Monitoring does not directly analyze audit logs. Option C is incorrect because Cloud Scheduler would not provide real-time response. Option D is incorrect because Cloud Audit Logs alone cannot send Slack notifications.

Answer

Create a Cloud Monitoring alert policy that checks for failed logins in logs and sends a notification to Slack via webhook.

Answer

Use Cloud Scheduler to run a batch job every hour that queries logs and sends a summary to Slack.

Answer

Enable Cloud Audit Logs and configure a log router to forward logs directly to Slack.

Question 5

During a security incident, the forensic team needs to capture the memory and disk state of a compromised Compute Engine VM without shutting it down. The VM is running a critical application and cannot be stopped. What is the best approach to gather forensic data?

Accepted Answer

Use gcloud compute ssh to connect and run a memory capture tool, then create a disk snapshot at the same time.. Option D is correct because Cloud Memorystore is not relevant; the best practice is to use a forensic tool via OS Login or gcloud compute ssh to acquire memory, and create a snapshot after using gcloud compute disks snapshot for disk state. Option A is incorrect because stopping the VM loses memory state. Option B is incorrect because snapshots while running are crash-consistent but memory is not captured. Option C is incorrect because Cloud Memorystore does not handle VM memory.

Answer

Clone the VM and perform forensics on the clone while the original continues running.

Answer

Take a snapshot of the disk while the VM is running, and use Cloud Memorystore to capture memory.

Answer

Stop the VM, take a snapshot of the disk, and then start the VM.

Question 6

A financial firm uses Cloud Deployment Manager to manage their Google Cloud infrastructure. They have a strict change management policy requiring that all infrastructure changes in the production environment must be reviewed and approved by a senior engineer before being applied. Currently, developers can modify the Deployment Manager configurations directly, leading to unapproved changes. The company wants to enforce this policy without impacting development agility. What should they implement?

Accepted Answer

Use a CI/CD pipeline with Cloud Build and require approval gates.. A CI/CD pipeline with Cloud Build can include manual approval gates that block deployments until approved. This enforces change review while allowing development to proceed. Option A is incorrect because organization policies would block all Deployment Manager usage, including in development. Option C is incorrect because auditing only monitors changes but does not prevent them. Option D is incorrect because snapshots allow rollback but do not prevent unapproved changes.

Answer

Use Deployment Manager snapshots to roll back changes if needed.

Answer

Set up Cloud Audit Logs to monitor changes and alert on unauthorized modifications.

Answer

Use organization policies to restrict access to the Deployment Manager service.

Question 7

Alice has the role roles/storage.objectAdmin on the bucket my-bucket via the IAM policy shown. She is unable to access the object gs://my-bucket/reports/data.csv. What is the most likely reason?

Accepted Answer

The condition restricts access to objects with a prefix 'uploads/', and the requested object is under 'reports/'.. The IAM policy condition uses the `resource.name.startsWith('my-bucket/uploads/')` condition key, which restricts the `storage.objects.get` permission to objects whose name starts with `uploads/`. The requested object `gs://my-bucket/reports/data.csv` is under the `reports/` prefix, so the condition evaluates to false, denying access. This is the most likely reason Alice cannot access the object.

Answer

The bucket has a retention policy that prevents access to objects older than a certain period.

Answer

The condition uses the wrong resource attribute; it should be resource.name.startsWith('my-bucket/uploads/').

Answer

Alice does not have the storage.objects.get permission on the bucket.

Question 8

Which THREE are capabilities of Assured Workloads? (Choose three.)

Accepted Answer

Location-based access controls through VPC Service Controls. Assured Workloads is a Google Cloud service that helps customers meet compliance requirements (e.g., FedRAMP, PCI DSS) by enforcing a set of security and data residency controls. Option A is correct because VPC Service Controls can be used to create a perimeter around the workload, restricting data access based on location (e.g., only allowing access from within a specific VPC or IP range), which is a key capability for compliance. Option D is correct because Access Transparency logs provide detailed logs of actions taken by Google personnel on customer data, which is critical for audit and compliance. Option E is correct because Customer-Managed Encryption Keys (CMEK) allow customers to control the encryption keys used to protect their data, a fundamental requirement for many compliance frameworks.

Answer

Cloud Shell for browser-based terminal access

Answer

Cloud Interconnect for dedicated connectivity

Question 9

A company uses multiple Google Cloud projects. A service account in Project A needs to read data from a Cloud Storage bucket in Project B. What is the correct way to grant access?

Accepted Answer

Add the service account as a member of the bucket's IAM policy with the Storage Object Viewer role.. Option D is correct because Cloud Storage uses IAM policies at the resource (bucket) level to grant cross-project access. By adding the service account from Project A as a member of the bucket's IAM policy in Project B with the Storage Object Viewer role, you grant the service account read-only access to objects in that bucket without requiring membership in Project B itself. This follows the principle of least privilege and avoids unnecessary project-level permissions.

Answer

Make the bucket publicly accessible and use signed URLs.

Answer

Grant the service account the Project Viewer role on Project B.

Answer

Add the service account as a member of Project B with the Storage Object Viewer role.

Question 10

Refer to the exhibit. A developer created the firewall rule to allow HTTPS traffic from the API service account to instances tagged 'api-instances'. However, HTTPS requests from the API server (which runs on an instance with tag 'api-instances' and uses the default compute engine service account) are failing. What is the most likely cause?

Accepted Answer

The source instance is using the default compute engine service account, not the specified api-sa.. Option B is correct because the firewall rule explicitly specifies the source as the API service account (api-sa), but the API server is using the default compute engine service account. In Google Cloud, firewall rules that use sourceServiceAccounts match traffic based on the service account attached to the source instance, not the instance's tags or the service account used by the application. Since the source instance's service account does not match the rule's specified service account, the HTTPS traffic is implicitly denied.

Answer

The rule should have a higher priority to override the default implicit deny.

Answer

The direction should be EGRESS because the traffic originates from the API server.

Answer

The rule should use sourceTags instead of sourceServiceAccounts to match the source instance.

Question 11

A user receives a "403 Forbidden" error when trying to access a Compute Engine instance via SSH from the Cloud Console. The user has the Compute Admin role on the project. What is the most likely cause?

Accepted Answer

The user does not have the roles/iap.tunnelResourceAccessor role.. The 403 Forbidden error when using Cloud Console SSH indicates that Identity-Aware Proxy (IAP) TCP forwarding is being used, which requires the roles/iap.tunnelResourceAccessor role. Even with Compute Admin, the user lacks this IAP-specific role, so the request is denied at the IAP layer before reaching the instance.

Answer

The user does not have the compute.instances.setMetadata permission.

Answer

The firewall rules do not allow SSH from the user's IP.

Answer

OS Login is enabled on the instance and the user lacks the osLogin role.

Question 12

A new employee needs to be able to create and manage Compute Engine instances. Which role should be granted at the project level?

Accepted Answer

roles/compute.instanceAdmin. The roles/compute.instanceAdmin role grants permissions to create, modify, and delete Compute Engine instances, including starting, stopping, and managing disks and snapshots, but does not allow changing project-wide network configurations or granting IAM policies. This is the least-privilege role that meets the requirement to 'create and manage Compute Engine instances' at the project level.

Answer

roles/compute.admin

Answer

roles/compute.networkAdmin

Answer

roles/compute.viewer

Question 13

An organization wants to enforce that all Compute Engine instances are created with a specific service account that has only the permissions defined by a custom role. Additionally, users must not be able to override this service account. Which two mechanisms should be combined?

Accepted Answer

An Organization Policy with constraint constraints/compute.setServiceAccount and an IAM deny policy to deny the iam.serviceAccounts.actAs permission on other service accounts.. Option C is correct because it combines an Organization Policy constraint (`constraints/compute.setServiceAccount`) that prevents users from specifying a different service account when creating Compute Engine instances, with an IAM deny policy that blocks the `iam.serviceAccounts.actAs` permission on all other service accounts. Together, these enforce that only the designated service account can be used, and users cannot override it.

Answer

Use Cloud Audit Logs to monitor and alert on non-compliant instances.

Answer

VPC Service Controls to restrict the service account usage.

Answer

Grant users only the Compute Instance Admin v1 role and remove the actAs permission.

Question 14

A company wants to allow its on-premises applications to access Google Cloud resources using short-lived credentials without storing a service account key file. Which solution should they use?

Accepted Answer

Configure Workload Identity Federation between the on-premises identity provider and Google Cloud.. Workload Identity Federation allows on-premises applications to exchange tokens from an external identity provider (IdP) for short-lived Google Cloud access tokens, eliminating the need to store a service account key file. This solution meets the requirement for short-lived credentials and avoids the security risk of long-lived static keys.

Answer

Set up a Cloud VPN connection and use private IPs to access resources.

Answer

Create a service account and download a JSON key file to the on-premises server.

Answer

Use signed URLs to grant access for each request.

Question 15

A DevOps team wants to allow a CI/CD pipeline to deploy to Compute Engine using a service account. What is the best practice for managing service account keys?

Accepted Answer

Use workload identity federation.. Workload identity federation is the best practice because it allows the CI/CD pipeline to impersonate a service account without managing or storing any long-lived service account keys. This eliminates the risk of key leakage and rotation overhead, as authentication is done via an external identity provider (e.g., GitHub Actions, GitLab CI) using OIDC tokens. Google Cloud's workload identity federation supports OIDC (OpenID Connect) and SAML 2.0, enabling secure, keyless access from external workloads.

Answer

Use a service account key distributed to each developer.

Answer

Generate a key and store it in Cloud Secret Manager.

Answer

Use a service account key stored in the source code repository.