PCSE Practice Test 30 — 15 Questions

Question 1

A company needs to respond to a GDPR data subject deletion request for a user's data stored across BigQuery and Cloud Storage. The data must be completely erased upon request. What is the most effective approach to ensure compliance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Cloud DLP to identify the user's data across services, delete the data using API calls, and verify deletion with Cloud Audit Logs. Cloud DLP can be used to inspect and classify the user's data across BigQuery and Cloud Storage, then you can programmatically delete the identified data via API calls. Cloud Audit Logs provide a verifiable record that the deletion was performed, which is essential for demonstrating compliance with GDPR's right to erasure.

Answer

Set up BigQuery time-based table expiration and Cloud Storage lifecycle policies with a 1-day deletion rule

Answer

Use Cloud Identity-Aware Proxy to block the user's access and mark the data as deleted

Answer

Enable Access Transparency logs and request Google to delete the data on their behalf

Question 2

Which TWO organization policies can help enforce compliance with data residency requirements?

Accepted Answer

constraints/gcp.resourceLocations. The `constraints/gcp.resourceLocations` organization policy restricts the physical location where Google Cloud resources can be created, directly enforcing data residency requirements. Option D is incorrect because `constraints/gcp.restrictTrustedDomains` controls which domains can be used in IAM policies, which is about identity management, not data location. No other option enforces data residency.

Answer

constraints/storage.uniformBucketLevelAccess

Answer

constraints/iam.disableServiceAccountCreation

Answer

constraints/gcp.restrictTrustedDomains

Answer

constraints/compute.requireShieldedVm

Question 3

A company has a VPC network named 'production' with subnets in us-central1 and europe-west1. They have on-premises data centers in New York and London connected via two HA VPN gateways to the respective regions. The on-premises networks use BGP with Cloud Routers in each region. The company also has a Shared VPC with service projects. Recently, they migrated a critical application to Google Cloud, which runs on Compute Engine instances in the europe-west1 subnet. The application needs to communicate with an on-premises database in London reachable via the London VPN. After the migration, the application fails to connect to the database. The Cloud Router in europe-west1 shows that it is receiving the on-premises routes. The instance has a default route to the internet via Cloud NAT. The firewall rules allow all traffic from the instance to the on-premises IP range. What is the most likely cause of the connectivity issue?

Accepted Answer

The Cloud Router in europe-west1 has dynamic route import from BGP disabled.. The Cloud Router in europe-west1 is receiving the on-premises routes via BGP, but if dynamic route import from BGP is disabled, those routes are not installed into the VPC route table. Without the specific route for the London on-premises database subnet, traffic from the Compute Engine instance will not be forwarded to the VPN tunnel, causing the connection failure. The default route via Cloud NAT only handles internet-bound traffic, not traffic destined for on-premises IP ranges.

Answer

The on-premises firewall is blocking traffic from the Google Cloud IP ranges.

Answer

The Cloud NAT is incorrectly configured and blocking traffic to on-premises IP ranges.

Answer

The Shared VPC configuration prevents service project instances from using VPC routes.

Question 4

An organization needs to grant a contractor access to a specific project for 30 days, with the ability to start and stop Compute Engine instances but not delete them. Which IAM role should be used?

Accepted Answer

Compute Instance Admin (v1) (roles/compute.instanceAdmin.v1). The Compute Instance Admin (v1) role (roles/compute.instanceAdmin.v1) allows starting, stopping, and modifying instances, but not deleting them. It is suitable for this scenario. Compute Admin (roles/compute.admin) allows full control including deletion. Compute Viewer (roles/compute.viewer) is read-only. Compute Instance Operator (beta) might exist but not standard.

Answer

Compute Viewer (roles/compute.viewer)

Answer

Compute OS Login (roles/compute.osLogin)

Answer

Compute Admin (roles/compute.admin)

Question 5

A company is deploying a multi-region application that must store data only within the European Union to comply with GDPR data residency requirements. They also need to ensure that Google Cloud administrators cannot access customer content. Which two controls should they implement? (Choose TWO).

Accepted Answer

Apply the organization policy constraint gcp.resourceLocations with the allowed regions set to europe-west1, europe-west2, etc.. To enforce data residency, the organization policy constraint gcp.resourceLocations restricts resource creation to specific regions. For EU data residency, they would list EU regions. Access Transparency provides logs of Google admin access to customer content, allowing the customer to monitor and audit such access. Assured Workloads is for compliance frameworks like FedRAMP, not specifically for data residency. Cloud DLP is for data loss prevention, not residency. VPC Service Controls is for data exfiltration prevention, not residency.

Answer

Use VPC Service Controls.

Answer

Configure Cloud DLP inspection jobs to scan for GDPR-sensitive data.

Answer

Enable Assured Workloads with EU regions boundary.

Question 6

A company has a policy that only specific service accounts can be used on Compute Engine instances. How can this be enforced?

Accepted Answer

Use an organization policy with constraint compute.restrictServiceAccountUsage.. The organization policy constraint `compute.restrictServiceAccountUsage` is specifically designed to enforce which service accounts can be used when creating Compute Engine instances. When applied at the project, folder, or organization level, this constraint allows you to define a list of allowed service accounts (by email or ID), and any attempt to launch an instance with a service account not on that list will be denied by the Resource Manager. This directly enforces the company policy that only specific service accounts are permitted on Compute Engine instances.

Answer

Use IAM conditions on the compute.instanceAdmin role to restrict the service account.

Answer

Use Identity-Aware Proxy (IAP).

Answer

Use a VPC Service Controls perimeter.

Question 7

A security engineer wants to enable Access Transparency for their organization. After enabling it in the Admin Console, they notice that some access logs are missing. What is the most likely reason?

Accepted Answer

The service being accessed does not support Access Transparency.. Access Transparency logs are only generated for services that support Access Transparency and have the feature enabled. At the time of writing, not all GCP services support Access Transparency. If the missing logs are for unsupported services, they will not appear.

Answer

Access Transparency only logs access by Google personnel, not by third-party vendors.

Answer

Access Transparency must be enabled for each individual project, not just the organization.

Answer

The IAM policy for the organization does not grant the required permissions.

Question 8

A company needs to securely connect two VPC networks from different projects in the same organization. Each VPC has overlapping IP ranges (10.0.0.0/16). They require high throughput and low latency. What is the recommended approach?

Accepted Answer

Re-IP one of the VPC networks to a non-conflicting range and then use VPC Network Peering.. VPC Network Peering requires non-overlapping IP ranges to establish direct connectivity. By re-IPing one VPC to a non-conflicting range (e.g., 10.1.0.0/16), you eliminate the routing conflict, allowing peering to provide high throughput and low latency via Google's internal backbone, with no bandwidth limits or single points of failure.

Answer

Use Dedicated Interconnect to directly connect the two VPCs.

Answer

Use VPC Network Peering.

Answer

Use HA VPN with dynamic routing.

Question 9

Refer to the exhibit. A security engineer runs the command to view recent decrypt operations on a Cloud KMS key. The output shows a successful decryption. However, the engineer is concerned about the exposure of the plaintext. Based on the log entry, what is the most accurate statement regarding the visibility of the decrypted plaintext?

Accepted Answer

The plaintext field is redacted by Cloud KMS, and the actual plaintext is not visible in the log entry.. Cloud KMS automatically redacts the plaintext field in Cloud Audit Logs for decrypt operations. The log entry shows a successful decryption, but the actual decrypted data is never written to the logs; instead, the plaintext field is replaced with a redacted marker (e.g., `[REDACTED]`). This is a security feature to prevent sensitive data from being exposed in audit logs, even to users with access to view them.

Answer

The plaintext field is not present in the log because the service does not log it.

Answer

The plaintext field contains the base64-encoded ciphertext, and the engineer needs to decode it.

Answer

The plaintext field contains the actual decrypted data in plaintext, and the engineer should restrict access to the logs.

Question 10

A company uses Customer-Supplied Encryption Keys (CSEK) for Compute Engine persistent disks. They want to ensure that Google does not store the key material. What must they do?

Accepted Answer

Use the gcloud compute disks create command with the --csek-key-file flag to supply the key, and do not store the key in Cloud KMS.. Customer-Supplied Encryption Keys (CSEK) allow you to provide your own raw AES-256 key material when creating a persistent disk. By using the `gcloud compute disks create` command with the `--csek-key-file` flag, you supply the key directly to the API, and Google uses it only in memory to encrypt the disk; it does not persist the key material on Google's infrastructure. The key file is stored locally by the customer, ensuring Google never retains the key.

Answer

Enable Cloud HSM to protect the key.

Answer

Set an organization policy to prevent Google from storing keys.

Answer

Create a Cloud KMS key and use it as a CSEK.

Question 11

An organization uses Cloud NAT to allow private instances to access the internet. They notice that some connections are failing intermittently. What is a common cause?

Accepted Answer

The NAT IP address is exhausted because too many concurrent connections.. Cloud NAT maps private instances to a public IP address using port address translation (PAT). Each NAT IP supports approximately 64,512 concurrent connections (ports). When many connections are made, ports can be exhausted, causing intermittent failures. Option B is incorrect because Cloud NAT supports UDP traffic. Option C is unlikely as VPC firewall rules typically allow outbound traffic by default. Option D is incorrect because Cloud NAT is regional and can serve instances in any zone within that region; the instances are in the same region as the NAT gateway.

Answer

The NAT gateway does not support UDP traffic.

Answer

The VPC firewall rules block outbound traffic.

Answer

The instances are in a different region than the NAT gateway.

Question 12

A large enterprise has a security command center that uses SIEM to analyze logs. They are migrating to Google Cloud and want to export all Cloud Audit Logs (Admin Activity, Data Access, and System Events) from all projects into a centralized BigQuery dataset for analysis. They also need to ensure logs are available within 5 minutes of being generated. Which sink configuration should they use?

Accepted Answer

Create an aggregated sink at the organization level that includes all projects and uses a BigQuery dataset as destination, with inclusion filters for all audit log types.. An aggregated sink at the organization level can export logs from all projects within the organization to a single BigQuery dataset. Inclusion filters allow you to specify which log types (Admin Activity, Data Access, System Events) to export. Logs are typically available in BigQuery within seconds (near real-time), meeting the 5-minute requirement. Option B is incorrect because using Pub/Sub adds latency and complexity without benefit when the final destination is BigQuery. Option C is incorrect because creating per-project sinks is inefficient and harder to manage. Option D is incorrect because exporting to an external SIEM via syslog does not centralize logs in BigQuery as required.

Answer

Create a single aggregated sink at the organization level that uses a Pub/Sub topic as destination, and have a subscriber stream logs into BigQuery.

Answer

Create a sink in each project that exports Audit Logs to a shared BigQuery dataset.

Answer

Enable logging export using Cloud Logging's beta feature to stream logs to an external SIEM via syslog.

Question 13

A security engineer created the following IAM policy for a service account. The service account reports that it cannot access objects in bucket 'my-bucket'. What is the most likely cause?

Accepted Answer

The condition uses 'projects/my-project' but resource.name uses the numeric project ID.. The condition in the policy uses `resource.name.startsWith('projects/my-project')`, but the `resource.name` attribute for Google Cloud Storage objects uses the numeric project ID (e.g., `projects/123456789`), not the project name. This causes the condition to never evaluate to true, effectively denying all access to the bucket's objects. Option D correctly identifies this mismatch as the root cause.

Answer

The condition is too restrictive and blocks all objects.

Answer

The service account lacks the storage.buckets.get permission.

Answer

The role is missing storage.objects.list permission.

Question 14

A government contractor uses Google Cloud with Assured Workloads. They need to ensure that data stored in BigQuery is encrypted with keys generated and stored in a Cloud HSM key ring located in a specific region. The keys must be rotated every 90 days. Which approach meets these requirements?

Accepted Answer

Create a Cloud HSM key ring in the desired region, create a key with a rotation period of 90 days, and use that key to protect the BigQuery dataset via CMEK.. It uses a Cloud HSM key ring in the desired region, which meets the requirement for hardware-backed key generation and storage. Setting a rotation period of 90 days on the key satisfies the rotation requirement, and using that key as a customer-managed encryption key (CMEK) for BigQuery ensures data is encrypted with the specified key.

Answer

Use Cloud KMS with a software key and enable automatic rotation of 90 days.

Answer

Create a Cloud HSM key ring and manually rotate keys every 90 days.

Answer

Use Cloud External Key Manager (EKM) with an external key management partner.

Question 15

A company uses Active Directory (AD) on-premises and wants to synchronize user accounts to Google Cloud Identity for SSO with SAML 2.0. They require automatic user provisioning and de-provisioning. Which Google Cloud tool should they use?

Accepted Answer

Cloud Directory Sync (CDS). Cloud Directory Sync (CDS) is the tool that synchronizes users from Active Directory or LDAP to Google Cloud Directory. It handles automatic provisioning and de-provisioning based on AD changes. SAML SSO is configured separately, but CDS is for directory sync.

Answer

Cloud Identity Platform

Answer

Google Workspace Admin SDK

Answer

Cloud Identity-Aware Proxy (IAP)