PCSE Practice Test 2 — 30 Questions

Question 1

A company is using Assured Workloads with the FEDRAMP_HIGH regime. They need to restrict where resources can be created and monitor for compliance violations. Which TWO settings should they configure? (Choose 2)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Resource location restrictions. Option C (Resource location restrictions) is correct because Assured Workloads lets you define the allowed resource locations for a folder, so any attempt to create resources outside the permitted regions is blocked, directly satisfying the requirement to restrict where resources can be created. Option E (Compliance monitoring / drift detection) is correct because Assured Workloads continuously monitors the folder for policy violations and configuration drift against the FEDRAMP_HIGH controls, alerting you to non-compliant changes. Option A (Access Transparency logs) is not one of the two settings that restrict creation locations or detect compliance drift; Access Transparency provides logs of Google personnel access actions and is a separate transparency control. Option B (Data residency controls) is not the correct selection here because Assured Workloads enforces location through resource location restrictions rather than a distinct 'data residency controls' setting. Option D (Google personnel access restrictions) is a personnel/access control (such as Access Approval or support access restrictions) and does not itself restrict resource creation locations or provide drift detection.

Answer

Access Transparency logs

Answer

Data residency controls

Answer

Google personnel access restrictions

Question 2

Drag and drop the steps to configure a VPC Service Controls perimeter in the correct order.

Accepted Answer

Set up an access policy, then define access levels, then create the perimeter, then add ingress/egress rules, then enforce and test. VPC Service Controls perimeters are configured by first setting up an access policy, defining access levels, creating the perimeter, adding ingress/egress rules, and finally enforcing and testing.

Answer

Create the perimeter, then set up an access policy, then define access levels, then add ingress/egress rules, then enforce and test

Answer

Define access levels, then create the perimeter, then set up an access policy, then add ingress/egress rules, then enforce and test

Answer

Set up an access policy, then create the perimeter, then define access levels, then add ingress/egress rules, then enforce and test

Question 3

A multinational organization uses Chronicle SIEM to aggregate and analyze security logs from multiple GCP projects and on-premises systems. The security team wants to detect a known threat pattern: a user authenticating from an anomalous geographic location followed by a large data egress from a Compute Engine instance within 10 minutes. Which three steps are necessary to create this detection? (Choose three.)

Accepted Answer

Ingest Cloud Audit Logs and VPC Flow Logs into Chronicle via forwarders or native integration. Option A is correct because Chronicle detection requires the relevant telemetry in UDM; ingesting Cloud Audit Logs (for authentication events) and VPC Flow Logs (for network egress) via native integration or forwarders provides the raw events the rule will match. Option B is correct because the scenario explicitly includes on-premises systems, so a forwarder must send those authentication logs into Chronicle to correlate them with GCP activity. Option E is correct because YARA-L is Chronicle's detection language, and a rule matching a UDM authentication event with anomalous geo-location followed within 10 minutes by a UDM network event with large bytes out directly implements the described threat pattern. Option C is not needed because BigQuery export is for long-term storage/analysis, not for creating a real-time Chronicle detection. Option D is not needed because Security Command Center findings are a separate GCP security service and do not create the Chronicle YARA-L detection logic.

Answer

Configure a BigQuery export of VPC Flow Logs for long-term analysis

Answer

Enable the Standard tier of Security Command Center to generate finding notifications

Question 4

A user has been granted the role roles/editor on a folder. What is the effective access in the projects within that folder? (Assume no deny policies)

Accepted Answer

Full editor access on all resources in the folder, including projects.. In Google Cloud, IAM roles are inherited from parent resources to child resources. Granting the roles/editor role on a folder automatically applies that role to all projects and resources within the folder, provided there are no deny policies to override it. This means the user has full editor access on all resources in the folder, including the projects themselves and all resources within those projects.

Answer

Editor access on the projects but not on resources within the projects.

Answer

The user must also be granted editor on each project separately.

Answer

Editor access on the folder resource only, not on projects.

Question 5

A security engineer needs to ensure that a Compute Engine VM can securely access Cloud Storage buckets without exposing a public IP address. The VM is in a VPC with Private Google Access enabled. What is the recommended approach?

Accepted Answer

No additional configuration is needed; Private Google Access allows access to Cloud Storage from VMs without external IPs.. Private Google Access enables a VM without an external IP address to reach Google APIs and services, including Cloud Storage, using the VPC's internal IP and Google's private network. Since the VM is in a VPC with Private Google Access enabled, it can securely access Cloud Storage buckets without needing a public IP or additional proxy. No further configuration is required because the traffic stays within Google's network and never traverses the public internet.

Answer

Deploy a Squid proxy in the same VPC and configure the VM to use it for all outbound traffic.

Answer

Assign an external IP to the VM and configure a firewall rule to allow egress to 0.0.0.0/0.

Answer

Configure Cloud NAT and ensure the VM has a route to the internet.

Question 6

Which THREE steps are most effective for troubleshooting a VPC firewall rule issue where desired traffic is being blocked?

Accepted Answer

Check firewall rule logs in Cloud Logging. Option B is correct because VPC firewall rule logging in Cloud Logging records allowed and denied connections with details such as the rule name, direction, and source/destination, which directly reveals whether a firewall rule is blocking the traffic. Option C is correct because Google Cloud firewall rules apply to instances based on matching network tags (targetTags), so if the instance's network tags do not match the rule's target tags, the rule will not be enforced as intended and traffic may be blocked by a default or other rule. Option D is correct because VPC Flow Logs capture IP traffic metadata for the subnet or instance, showing whether packets are reaching the VM and helping distinguish a firewall block from a routing or upstream issue. Option A is not relevant because IAM permissions control API-level access to manage resources, not packet filtering for VM traffic. Option E is not the most effective step here because route tables determine path selection, not firewall rule evaluation; while routing issues can cause connectivity failures, they do not explain a firewall rule blocking desired traffic.

Answer

Check IAM permissions for the VM's service account

Answer

Inspect the route tables for the subnet

Question 7

Which Google Cloud service is specifically designed to help customers meet compliance requirements by creating a folder with pre-defined organization policies, resource location restrictions, and access controls?

Accepted Answer

Assured Workloads. Assured Workloads is Google Cloud's purpose-built service for creating folders pre-configured with compliance controls — including organization policies, resource location restrictions, personnel access controls, and encryption requirements — tailored to specific regimes like FedRAMP, IL4, ITAR, CJIS, and HIPAA. It provisions a folder with these guardrails so workloads inherit compliance posture automatically.

Answer

VPC Service Controls

Answer

Cloud HSM

Answer

Security Command Center

Question 8

A security engineer is configuring VPC Service Controls to protect a Google Cloud project containing sensitive data. The project uses Cloud Storage and BigQuery. The engineer wants to ensure that data cannot be exfiltrated to external IP addresses outside the perimeter, but internal users should still be able to access the data from on-premises via a VPN. Which configuration should be applied?

Accepted Answer

Add the project to a VPC Service Controls perimeter and configure an ingress rule to allow traffic from the on-premises VPN CIDR ranges. VPC Service Controls (VPC-SC) allow you to define a security perimeter around Google Cloud services like Cloud Storage and BigQuery, preventing data exfiltration to external IPs. By adding the project to a perimeter and configuring an ingress rule that permits traffic from the on-premises VPN CIDR ranges, internal users can access the data via VPN while all other external traffic is blocked. This meets the requirement of preventing exfiltration to external IPs while allowing authorized on-premises access.

Answer

Do not use VPC Service Controls; instead, rely on IAM permissions and firewall rules to control access

Answer

Create a separate perimeter that denies all traffic and apply it to the project

Answer

Add the project to a VPC Service Controls perimeter with no additional ingress rules

Question 9

An organization wants to enforce that all new Cloud Storage buckets are created with uniform bucket-level access enabled to simplify access control and meet compliance requirements. What Google Cloud service should they use to enforce this?

Accepted Answer

Organization Policies. Organization Policies allow administrators to set constraints on Google Cloud resources at the organization, folder, or project level. The `constraints/storage.uniformBucketLevelAccess` constraint can be applied to enforce that all new Cloud Storage buckets are created with uniform bucket-level access enabled, simplifying access control and meeting compliance requirements.

Answer

VPC Service Controls

Answer

Cloud IAM

Answer

Cloud Armor

Question 10

A company uses Cloud Data Loss Prevention (DLP) to inspect sensitive data in Cloud Storage. They want to automatically redact credit card numbers found in text files before the files are accessed by downstream applications. Which DLP method should be used?

Accepted Answer

Use the DLP API's `content.deidentify` method with a `PrimitiveTransformation` of `replaceWithInfoType`.. The DLP API's `content.deidentify` method with a `PrimitiveTransformation` of `replaceWithInfoType` is designed to automatically replace sensitive data (like credit card numbers) with their corresponding info type labels (e.g., `[CREDIT_CARD_NUMBER]`) in text files. This method operates on content in memory or from Cloud Storage, enabling automated redaction before downstream access, without requiring a separate job or manual intervention.

Answer

Create a DLP job that uses the InspectJobConfig with a redact transformation.

Answer

Use Cloud DLP's inspect-only functionality and manually redact.

Answer

Set up a DLP inspection scan on the bucket with a `CryptoReplaceFfxFpe` transformation.

Question 11

A company is deploying a web application behind an external HTTPS load balancer. They want to protect against common web attacks such as XSS, SQLi, and LFI using preconfigured rules. They also need to allowlist specific IP addresses that belong to partners. Which three Cloud Armor features should they use? (Choose three.)

Accepted Answer

Attach the Cloud Armor security policy to the backend service or load balancer.. Option A is correct because a Cloud Armor security policy only takes effect once it is attached to the target backend service (or the backend service of the external HTTPS load balancer), which is the enforcement point for the rules. Option B is correct because the OWASP ModSecurity Core Rule Set (CRS) preconfigured WAF rules in Cloud Armor are specifically designed to detect and block common web attacks such as XSS, SQL injection, and local file inclusion without writing rules from scratch. Option E is correct because partner IP allowlisting is implemented with custom Cloud Armor rules using match conditions on source IP ranges (for example, srcIpRanges with an allow action at a suitable priority), which permits only the specified partner addresses. Option C is not correct because IAP controls user authentication/authorization to applications and does not provide WAF protection against XSS, SQLi, or LFI, nor IP allowlisting for partners. Option D is not correct because Cloud CDN only caches content at the edge to improve performance; it does not inspect or block malicious web requests.

Answer

Configure IAP to restrict access to the application.

Answer

Use Cloud CDN to cache static content.

Question 12

Your organization has an IAM policy at the folder level that grants a user the Compute Admin role. A deny policy at the project level denies the same user the compute.instances.create permission. What is the effective access for this user on the project?

Accepted Answer

The user cannot create instances because deny policies override allow policies.. Deny policies always override allow policies. The deny at the project level explicitly denies compute.instances.create, so the user cannot create instances despite the folder-level allow.

Answer

The user can create instances because the allow policy at the folder level takes precedence over the deny policy at the project level.

Answer

The user can create instances because the project-level deny policy only applies to resources within the project, not to permissions inherited from the folder.

Answer

The user can create instances because deny policies only block explicit allows, not inherited ones.

Question 13

A security engineer needs to implement a logging pipeline that sends real-time Cloud Audit Logs to a third-party SIEM. They must ensure that if the SIEM is unavailable, logs are not lost. Which approach should they use?

Accepted Answer

Create a log sink that writes to a Pub/Sub topic, and use a subscription with a dead letter topic.. Using a Pub/Sub subscription with a dead letter topic allows messages to be retried and, if delivery fails persistently, moved to a dead letter topic for later reprocessing. This prevents data loss. Cloud Storage is not real-time; BigQuery is not for streaming to SIEM; Cloud Run without Pub/Sub would miss retries.

Answer

Configure a Cloud Run service to pull logs from Cloud Logging API and forward to SIEM.

Answer

Export logs to Cloud Storage via a sink, and have the SIEM ingest from there.

Answer

Use a log sink to BigQuery and have the SIEM query BigQuery periodically.

Question 14

An organization uses a global HTTPS load balancer with a Google-managed SSL certificate. The certificate was automatically provisioned and renewed. Recently, the certificate renewal failed and the site shows a warning. The load balancer's frontend uses the certificate. What is the most likely cause?

Accepted Answer

The DNS CNAME record for domain validation is misconfigured or missing. Google-managed certificates are provisioned using DNS authorization. If the DNS records are misconfigured (e.g., the CNAME record for domain ownership validation is missing or incorrect), renewal will fail. The load balancer settings themselves are typically fine.

Answer

The load balancer's frontend IP address has changed

Answer

The certificate has reached its maximum validity period

Answer

The load balancer's SSL policy requires a minimum TLS version that the managed certificate does not support

Question 15

A company wants to automatically provision and renew SSL certificates for their HTTPS load balancer. They do not want to manually manage certificate files. Which approach should they use?

Accepted Answer

Create a Google-managed SSL certificate resource.. A Google-managed SSL certificate resource is automatically provisioned, renewed, and rotated by Google Cloud for use with HTTPS load balancers. It eliminates manual certificate file management, matching the requirement for automatic provisioning and renewal without manual intervention.

Answer

Upload a self-managed certificate in PEM format.

Answer

Configure SSL policies to enforce TLS version.

Answer

Use Certificate Manager with a DNS-authorized certificate.

Question 16

A security engineer needs to encrypt data at rest in Cloud Storage using a key that is not managed by Google Cloud. The key must be stored on-premises and provided with each API call for data access. Which encryption approach should be used?

Accepted Answer

Use customer-supplied encryption keys (CSEK) by providing the key in the request headers.. Customer-supplied encryption keys (CSEK) allow you to provide your own AES-256 key with each API call to Cloud Storage. The key is not stored by Google Cloud; it is used only in memory to encrypt/decrypt data and then discarded, meeting the requirement of on-premises key storage and per-API-call key provision.

Answer

Use customer-managed encryption keys (CMEK) with key material imported from an on-premises HSM.

Answer

Use Cloud KMS with a key stored in an on-premises HSM via Cloud External Key Manager.

Answer

Use Google-managed encryption keys with an organizational policy to disable automatic encryption.

Question 17

A healthcare organization is migrating to Google Cloud and needs to store Protected Health Information (PHI) while maintaining HIPAA compliance. They have executed a Business Associate Agreement (BAA) with Google. Which additional step is required to ensure that PHI is properly classified and protected?

Accepted Answer

Use Cloud Data Loss Prevention (DLP) to inspect and classify storage buckets containing PHI.. Cloud DLP is the service designed to inspect, classify, and de-identify sensitive data such as PHI. After signing a BAA, the next step to ensure PHI is properly classified and protected is to use DLP to discover and label PHI in storage buckets, which enables appropriate controls. Audit logs, Cloud Armor, and VPC Service Controls are important but do not fulfill the classification requirement.

Answer

Enable Audit Logs for all services that process PHI.

Answer

Configure Cloud Armor to protect web applications handling PHI.

Answer

Enable VPC Service Controls and restrict access to Cloud Storage buckets containing PHI.

Question 18

A user in a Google Cloud organization wants to create a custom IAM role at the project level. Which permission is required to create custom roles?

Accepted Answer

iam.roles.create. Creating a custom IAM role at the project level requires the iam.roles.create permission, which is included in roles like roles/iam.roleAdmin or roles/iam.organizationRoleAdmin. This permission allows the user to define a new custom role with a specified set of permissions. Without it, the API call to create a role will fail with a PERMISSION_DENIED error.

Answer

resourcemanager.projects.setIamPolicy

Answer

iam.serviceAccounts.create

Answer

iam.roles.update

Question 19

An organization wants to allow only specific trusted IP ranges to access a web application behind a Cloud Load Balancer. Which Cloud Armor feature should be used?

Accepted Answer

Custom rules with source IP allow/deny lists. Cloud Armor custom rules allow you to define source IP allow/deny lists using CIDR ranges, which directly satisfies the requirement to restrict access to specific trusted IP ranges. Preconfigured WAF rules, geolocation, and adaptive protection do not provide granular IP-based allow/deny control.

Answer

Preconfigured rules for OWASP ModSecurity CRS

Answer

Geolocation-based access control

Answer

Adaptive protection

Question 20

A company is using Cloud Armor to protect their HTTP(S) load balancer. They have configured a security policy with a rule to block traffic from a specific IP address (10.0.0.1/32). During testing, they observe that requests from that IP are still reaching the backend. What is the most likely reason?

Accepted Answer

The security policy is not attached to the backend service.. Cloud Armor security policies must be explicitly attached to a backend service to take effect. If the policy is not attached, the rules within it—including the block rule for 10.0.0.1/32—are not evaluated, and traffic flows to the backend as if no policy exists. This is the most common cause when a configured rule appears to be ignored.

Answer

The backend service is configured to bypass Cloud Armor.

Answer

Cloud Armor does not support blocking specific IP addresses.

Answer

The rule has a lower priority than a default allow rule.