PCSE Practice Test 1 — 30 Questions

Question 1

A multi-national corporation must prevent data exfiltration from a project containing PII for GDPR compliance. They want to restrict access to only allow data transfer within the organization. Which Google Cloud service meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a VPC Service Control perimeter that includes the project and restricts access to other perimeters.. VPC Service Controls allow you to define perimeters that protect the resources and data of Google Cloud services. By creating a perimeter that includes the project containing PII, you can restrict data transfer to only within the organization, preventing exfiltration to external networks or unauthorized identities, which directly meets GDPR compliance requirements.

Answer

Use firewall rules to block all egress traffic except to approved IP ranges.

Answer

Set IAM policies to deny the storage.objectViewer role to non-compliant users.

Answer

Configure Cloud NAT for the VPC to route traffic through a single IP.

Question 2

A company is using Cloud SQL for MySQL to store financial data. They need to ensure that all data is encrypted at rest and in transit. What should they do?

Accepted Answer

Use the default encryption provided by Cloud SQL and enforce SSL/TLS connections.. Cloud SQL for MySQL automatically encrypts data at rest using AES-256, with no additional configuration required. To protect data in transit, you must enforce SSL/TLS connections by configuring the instance to require SSL and downloading the server certificate for client connections. This combination satisfies both encryption requirements without unnecessary complexity.

Answer

Use client-side encryption before storing data in Cloud SQL.

Answer

Enable encryption at rest by checking a box in the Cloud Console.

Answer

Enable CMEK on the Cloud SQL instance and configure SSL/TLS.

Question 3

A security engineer needs to grant a data analyst read-only access to a BigQuery dataset containing customer data, but must prevent the analyst from viewing or querying a specific column that contains personally identifiable information (PII). Which approach should the engineer use?

Accepted Answer

Use BigQuery column-level security with a policy tag on the PII column, and assign the analyst a role that denies access to that tag.. BigQuery column-level security uses policy tags to control access at the column level. By assigning a policy tag to the PII column and then granting the analyst a role that explicitly denies access to that tag (e.g., using a deny role or IAM deny policies), the analyst can query the dataset but will be blocked from viewing or querying the tagged column. This approach directly meets the requirement of read-only access while preventing access to the specific PII column.

Answer

Grant the analyst the roles/bigquery.user role, and use IAM conditions to deny access to the PII column.

Answer

Create a row-level access policy on the table that denies access to rows containing PII.

Answer

Grant the analyst the BigQuery Data Viewer role on the dataset, and create an authorized view that excludes the PII column.

Question 4

A company is migrating to Google Cloud and wants to ensure that all service account keys are rotated automatically every 90 days. The security engineer needs to implement a solution that detects keys older than 90 days and notifies the security team. What is the most efficient way to achieve this?

Accepted Answer

Use Cloud Asset Inventory to list service account keys, then run a Cloud Scheduler job that invokes a Cloud Function to check key ages and send notifications. Cloud Asset Inventory can list all service account keys and their creation timestamps, and a Cloud Scheduler job can trigger a Cloud Function to check key ages against the 90-day threshold and send notifications via email or Slack. This approach is efficient as it uses serverless components and avoids polling the IAM API repeatedly, which would be less scalable and more complex.

Answer

Use Cloud Monitoring to query the IAM API for key creation timestamps and trigger an alert

Answer

Create a log-based metric for service account key creation and set up an alert in Cloud Monitoring

Answer

Configure a custom role in Cloud IAM that denies access to keys older than 90 days

Question 5

A company must store API keys and database credentials securely in Google Cloud. They need automatic rotation of these secrets every 30 days, with notifications sent to a security team after each rotation. Which services should they use? (Choose TWO).

Accepted Answer

Secret Manager. Secret Manager provides a native API for storing secrets and supports automatic rotation via a rotation period and Pub/Sub notifications. Cloud Functions can be triggered by the Pub/Sub message to perform any additional actions (e.g., updating applications). Cloud KMS manages encryption keys, not secrets. Cloud Scheduler can trigger manual rotation but is not required with automatic rotation. Compute Engine is not a service for secrets management.

Answer

Cloud Scheduler

Answer

Compute Engine

Answer

Cloud KMS

Question 6

A company uses Cloud Data Loss Prevention (DLP) to inspect sensitive data in Cloud Storage. They want to automatically redact credit card numbers found in text files before the files are accessed by downstream applications. Which DLP method should be used?

Accepted Answer

Use the DLP API's `content.deidentify` method with a `PrimitiveTransformation` of `replaceWithInfoType`.. The DLP API's `content.deidentify` method with a `PrimitiveTransformation` of `replaceWithInfoType` is designed to automatically replace sensitive data (like credit card numbers) with their corresponding info type labels (e.g., `[CREDIT_CARD_NUMBER]`) in text files. This method operates on content in memory or from Cloud Storage, enabling automated redaction before downstream access, without requiring a separate job or manual intervention.

Answer

Create a DLP job that uses the InspectJobConfig with a redact transformation.

Answer

Use Cloud DLP's inspect-only functionality and manually redact.

Answer

Set up a DLP inspection scan on the bucket with a `CryptoReplaceFfxFpe` transformation.

Question 7

A multi-national company needs to ensure that customer data stored in BigQuery is encrypted with customer-managed encryption keys (CMEK) and that the keys are rotated every 90 days. Additionally, the company must be able to audit all key usage. Which steps are required to implement this compliance requirement?

Accepted Answer

Create a Cloud KMS key ring with a key using a protection level of software and set a rotation period of 90 days. Then configure BigQuery to use the key and enable Data Access audit logs for Cloud KMS.. It uses a Cloud KMS software-protection-level key with a 90-day rotation period, which meets the CMEK requirement for BigQuery. Enabling Data Access audit logs for Cloud KMS captures all key usage events, satisfying the auditing requirement. Automatic rotation in Cloud KMS handles the 90-day rotation without manual intervention, and BigQuery is configured to use the CMEK key for dataset encryption.

Answer

Create a Cloud External Key Manager (EKM) key and configure BigQuery to use it. The EKM provider handles key rotation.

Answer

Create a Cloud KMS key ring with a key, disable automatic rotation, and use Cloud Functions to rotate the key manually every 90 days. Enable Admin Activity audit logs for Cloud KMS.

Answer

Create a Cloud KMS key ring with a key using a protection level of HSM and set a rotation period of 90 days. Then configure the BigQuery dataset to use this key.

Question 8

A multinational company is migrating sensitive workloads to Google Cloud and must comply with GDPR data residency requirements. Which TWO actions ensure data remains stored only within the European Union? (Choose TWO.)

Accepted Answer

Define an Organization Policy with constraints/gcp.resourceLocations to allow resource creation only in EU regions.. The Organization Policy constraint `gcp.resourceLocations` explicitly restricts the Google Cloud regions where resources can be created. By setting this constraint to allow only EU regions (e.g., `europe-west1`, `europe-west4`), you enforce that all new resources are provisioned within the European Union, directly meeting GDPR data residency requirements. This policy is evaluated at resource creation time and prevents any resource from being deployed outside the allowed locations.

Answer

Enable Cloud Audit Logs with export to a BigQuery dataset in the EU region.

Answer

Use Cloud Data Loss Prevention (DLP) to scan for sensitive data and verify it remains in the EU.

Answer

Use Customer-Managed Encryption Keys (CMEK) stored in a Cloud KMS key ring located in the EU.

Question 9

A company uses Cloud KMS with a key purpose of ENCRYPT_DECRYPT. They need to rotate the key automatically every 30 days. What must they configure?

Accepted Answer

Set a rotation period of 30 days on the key.. Cloud KMS allows you to set a rotation period directly on a key (a CryptoKey resource) when its purpose is ENCRYPT_DECRYPT. Configuring a rotation period of 30 days on the key enables automatic, scheduled rotation, where Cloud KMS creates a new key version every 30 days and promotes it to primary, without any manual intervention.

Answer

Use a cron job to rotate keys manually every 30 days.

Answer

Set a rotation period of 30 days on the key ring.

Answer

Set a rotation period on the key version.

Question 10

An organization needs to store API keys for external services. Which Google Cloud service is designed for secure storage of secrets such as API keys, passwords, and certificates?

Accepted Answer

Secret Manager. Secret Manager is specifically designed for storing secrets like API keys, passwords, and certificates, with versioning, IAM access control, and rotation support.

Answer

Cloud KMS

Answer

Cloud Datastore

Answer

Cloud HSM

Question 11

A security team has a Cloud KMS key used for encrypting Cloud Storage objects. They need to ensure that when the key is rotated, old data remains decryptable without manual re-encryption. They also want to minimize the number of key versions. Which approach should they take?

Accepted Answer

Use automatic rotation and keep one previous key version indefinitely.. Cloud KMS supports automatic key rotation while retaining previous key versions indefinitely. When a key is rotated, new data is encrypted with the latest version, but old data remains decryptable using the previous key version that is kept. This satisfies the requirement of minimizing manual intervention and key version count, as only one previous version is retained.

Answer

Use automatic rotation and disable previous key versions after 30 days.

Answer

Use manual rotation and delete old key versions after confirmation that all data has been re-encrypted.

Answer

Use symmetric key with purpose SYMMETRIC_ENCRYPT_DECRYPT and set rotation period to 0 (never).

Question 12

A company needs to retain audit logs for 7 years to meet regulatory compliance. They are using Cloud Logging. Which log storage strategy should they use to minimize costs while meeting the requirement?

Accepted Answer

Use a log sink to export logs to Cloud Storage with a retention policy of 7 years and nearline storage class.. Exporting logs to Cloud Storage via a log sink allows you to set a bucket retention policy of 7 years, meeting compliance requirements. Using the nearline storage class minimizes costs for logs that are accessed infrequently, as it offers lower storage costs than standard storage while still providing the necessary durability and retention capabilities.

Answer

Store logs in the _Required log bucket with a custom retention of 7 years.

Answer

Disable logging for non-critical resources to reduce log volume and retain only essential logs.

Answer

Use a log sink to export logs to BigQuery and set the table expiration to 7 years.

Question 13

A company wants to use Private Service Connect to publish a managed service (e.g., a custom application) so that consumers can access it privately within Google Cloud. Which THREE resources are involved in this setup?

Accepted Answer

PSC endpoint (forwarding rule). Private Service Connect involves creating a service attachment on the producer side (the managed service), which is then accessible via a PSC endpoint in the consumer's VPC. DNS configuration is needed to resolve the endpoint's IP address. IAM roles control who can create endpoints.

Answer

Cloud NAT gateway

Answer

VPC peering

Question 14

A security engineer is configuring VPC Service Controls to protect a Google Cloud project containing sensitive data. The project uses Cloud Storage and BigQuery. The engineer wants to ensure that data cannot be exfiltrated to external IP addresses outside the perimeter, but internal users should still be able to access the data from on-premises via a VPN. Which configuration should be applied?

Accepted Answer

Add the project to a VPC Service Controls perimeter and configure an ingress rule to allow traffic from the on-premises VPN CIDR ranges. VPC Service Controls (VPC-SC) allow you to define a security perimeter around Google Cloud services like Cloud Storage and BigQuery, preventing data exfiltration to external IPs. By adding the project to a perimeter and configuring an ingress rule that permits traffic from the on-premises VPN CIDR ranges, internal users can access the data via VPN while all other external traffic is blocked. This meets the requirement of preventing exfiltration to external IPs while allowing authorized on-premises access.

Answer

Do not use VPC Service Controls; instead, rely on IAM permissions and firewall rules to control access

Answer

Create a separate perimeter that denies all traffic and apply it to the project

Answer

Add the project to a VPC Service Controls perimeter with no additional ingress rules

Question 15

A security engineer needs to enforce that all Compute Engine VMs in an organization use Shielded VM features. Which approach should they use?

Accepted Answer

Create an organization policy with the constraint constraints/compute.requireShieldedVm set to True.. The organization policy constraint constraints/compute.requireShieldedVm is the correct way to enforce Shielded VM across all VMs.

Answer

Use IAP to enforce Shielded VM on all instances.

Answer

Enable Shielded VM in the project's compute engine settings.

Answer

Configure a firewall rule to block non-Shielded VMs.

Question 16

An engineer is configuring Cloud Armor for an HTTP(S) load balancer and needs to allow traffic only from users who have been authenticated by Identity-Aware Proxy (IAP). The backend service already has IAP enabled. What additional configuration is needed to ensure that only authenticated requests reach the backend?

Accepted Answer

No additional configuration is needed; IAP already blocks unauthenticated requests. When IAP is enabled on a backend service, it intercepts all requests and blocks unauthenticated traffic before it reaches the backend. Cloud Armor operates at the edge, but since IAP already enforces authentication at the application layer, no additional Cloud Armor configuration is required to restrict access to authenticated users. The load balancer forwards only requests that have passed IAP authentication to the backend.

Answer

Configure Cloud Armor to allow only traffic from the IP ranges used by IAP

Answer

Create a Cloud Armor security policy that requires a valid JWT token signed by IAP

Answer

Set a firewall rule on the backend instances to allow traffic only from the load balancer's health check IPs

Question 17

A healthcare company subject to HIPAA must prevent data exfiltration from Google Cloud storage buckets. They already use VPC Service Controls. Which additional control should they configure to directly block unauthorized copying of data to external projects?

Accepted Answer

Configure egress rules in the VPC Service Controls perimeter. VPC Service Controls allow you to define perimeters that restrict data movement between authorized and unauthorized projects. By configuring egress rules within the perimeter, you can explicitly block copying data to external projects, directly preventing data exfiltration. This is the correct additional control because it enforces policy at the network boundary, not just at the application or storage layer.

Answer

Enable Cloud Data Loss Prevention (DLP) scanning

Answer

Use Cloud Audit Logs to review access

Answer

Apply Cloud Identity-Aware Proxy (IAP) to buckets

Question 18

A company must ensure that only authorized users can access sensitive data in Cloud Storage for PCI DSS compliance. They have configured a bucket with uniform bucket-level access. Which IAM policy should they use to grant access to a security team?

Accepted Answer

Bind the security team to roles/storage.objectViewer at the bucket level.. The 'Storage Object Viewer' role grants read-only access to objects, which is sufficient for security monitoring. Option B is wrong because the admin role grants full access, violating least privilege. Option C is wrong because bucket-level access is already uniform, so ACLs are not needed. Option D is wrong because the bucket admin role gives full control, which is excessive.

Answer

Bind the security team to roles/storage.legacyBucketReader at the bucket level.

Answer

Use ACLs to give the security team READ access to the bucket.

Answer

Bind the security team to roles/storage.admin at the project level.

Question 19

Refer to the exhibit. A security engineer runs this command to check bucket permissions. What is the most significant security issue?

Accepted Answer

The bucket allows public read access via 'allUsers' in both ACL and legacy role.. The command output shows that the bucket has both an ACL granting 'allUsers' READER access and a legacy bucket role 'roles/storage.legacyBucketReader' assigned to 'allUsers'. This means the bucket is publicly readable via two independent mechanisms, which is the most significant security issue as it exposes all objects to the internet without authentication.

Answer

The domain example.com has viewer access, which may be too broad.

Answer

The legacy role 'roles/storage.legacyBucketReader' is used.

Answer

Uniform bucket-level access is disabled, allowing ACLs.

Question 20

A company has a Cloud Storage bucket containing sensitive data. They want to ensure that only users with specific IAM roles can access the bucket, and that access is logged for audit purposes. They also want to prevent public access. Which configuration steps should they take?

Accepted Answer

Enable uniform bucket-level access, set IAM policies, and enable Cloud Audit Logs.. Enabling uniform bucket-level access disables ACLs, forcing all access decisions to be made by IAM policies alone, which simplifies permission management and prevents public access. Setting IAM policies ensures only users with specific roles can access the bucket, and enabling Cloud Audit Logs captures all access requests for audit purposes. This combination meets all requirements: no public access, role-based access control, and logging.

Answer

Use IAM roles only and enable Cloud Audit Logs, but keep ACLs enabled.

Answer

Use VPC Service Controls and enable Cloud Audit Logs.

Answer

Enable fine-grained access using ACLs and enable Cloud Audit Logs.