PCSE Practice Test 31 — 15 Questions

Question 1

Your organization uses Cloud Identity with SAML 2.0 federation from an external identity provider (IdP). You need to ensure that only users from a specific group in the IdP can access a critical application behind an HTTPS load balancer. Which combination of steps is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable IAP on the load balancer and grant the roles/iap.httpsResourceAccessor role to the Google group representing the IdP group. To restrict access to a specific group, you must first configure IAP on the backend service, then create an IAP access policy (or IAM binding) that grants the roles/iap.httpsResourceAccessor role to the Google group that corresponds to the IdP group. The IdP group must be synced to Google Cloud via directory sync or SCIM.

Answer

Create a firewall rule that allows traffic only from the IdP's SAML endpoint IP

Answer

Set up a VPN between the IdP and Google Cloud and restrict access to the load balancer via VPC firewall

Answer

Configure Cloud Armor to allow traffic only from the IdP's IP range

Question 2

Refer to the exhibit. A security engineer is reviewing a Cloud KMS key. What can be concluded about this key?

Accepted Answer

This key is stored in a Hardware Security Module (HSM) and cannot be exported.. The exhibit shows a Cloud KMS key with the purpose 'symmetric encryption' and the protection level 'HSM'. Keys with HSM protection level are stored in a Hardware Security Module, which provides tamper-resistant hardware-based key storage. Additionally, the key is marked as 'Cannot be exported', meaning the key material never leaves the HSM boundary, ensuring it cannot be extracted or copied. This matches the description of a key stored in an HSM that cannot be exported.

Answer

This key is a customer-managed encryption key (CMEK) but is stored in software.

Answer

This key is an external key managed via Cloud EKM.

Answer

This is a software key managed by Cloud KMS.

Question 3

An organization wants to enforce that all new projects automatically have a specific set of IAM roles assigned to a security group. What is the best way to achieve this?

Accepted Answer

Assign the IAM roles to the security group at the organization level.. Use organization policies? No, organization policies enforce constraints on resources, not IAM role bindings. You can use a folder-level IAM policy that applies to all projects in the folder. If all projects are under a folder, assign the roles to the folder. Alternatively, use a custom script via Cloud Asset Inventory or Deployment Manager. The simplest is to assign IAM roles at the organization level, which are inherited by all projects. So assign the security group the necessary roles at the organization node.

Answer

Create an organization policy that requires the roles to be assigned.

Answer

Use a Cloud Function triggered by Cloud Asset Inventory to assign the roles when a new project is created.

Answer

Use a service account with the Security Admin role to periodically scan and update new projects.

Question 4

An organization has a hub-and-spoke VPC setup with Shared VPC. The security team wants to enforce a rule that all egress traffic from any project in the organization must pass through a central inspection appliance in the hub VPC. Which firewall configuration approach meets this requirement?

Accepted Answer

Set up a default route in each spoke VPC that sends egress traffic to the inspection appliance in the hub, and use firewall rules to allow only that traffic.. Hierarchical firewall policies apply to the entire organization, folder, or project and cannot be overridden by VPC firewall rules. They can be used to enforce mandatory inspection. However, they cannot specify next-hop appliances. To force traffic through an inspection appliance, you need to use a combination of routes and firewall rules. The correct approach is to set up a default route pointing to the inspection appliance as next hop, and use firewall rules to block direct egress unless it goes through the appliance.

Answer

Use VPC firewall rules with a deny-all egress rule, then allow egress only from instances running in the hub VPC.

Answer

Configure private Google Access and VPC Service Controls to restrict egress.

Answer

Create a hierarchical firewall policy that denies all egress traffic unless it has a specific tag.

Question 5

A company has a hybrid cloud setup with a Cloud VPN tunnel to an on-premises network. They want to ensure that traffic from on-premises to a specific VPC subnet is routed through a specific next hop appliance for inspection. How can they achieve this?

Accepted Answer

Create a route with a next hop to the appliance's internal IP and a high priority. Creating a static route with a next hop set to the appliance's internal IP and a high priority ensures that traffic from on-premises to the specific VPC subnet is forwarded to the inspection appliance before reaching its destination. In a hybrid cloud setup with Cloud VPN, the VPN gateway is the default next hop for on-premises traffic, but a higher-priority route overrides this, directing traffic to the appliance for security inspection. This leverages route priority (lower numerical value = higher priority) to enforce traffic steering without modifying the VPN tunnel itself.

Answer

Use Policy-based routing

Answer

Create a route with a next hop of the internal load balancer

Answer

Create a static route with a next hop of the VPN gateway

Question 6

A company uses BigQuery to store analytics data. They need to restrict access to specific rows based on the user's department. What should they implement?

Accepted Answer

Row-level security using authorized views. Authorized views in BigQuery can filter rows based on the user's identity or other context. Column-level security is for columns, not rows. IAM conditions cannot restrict rows. Data Catalog is for metadata.

Answer

Column-level security

Answer

Data Catalog tags

Answer

IAM conditions on BigQuery datasets

Question 7

You are designing a multi-tier application with a frontend and backend. The frontend instances are in subnet A (10.0.1.0/24), and the backend instances are in subnet B (10.0.2.0/24). Both subnets are in the same VPC. You want to allow the frontend to communicate with the backend on TCP port 8080, but the backend must not be able to initiate connections to the frontend. Additionally, the backend must be able to send patches to the internet. Which set of firewall rules should you implement?

Accepted Answer

Ingress rule on backend: allow tcp:8080 from subnet A; Egress rule on backend: allow all to internet. The frontend in subnet A initiates connections to the backend on TCP port 8080, so an ingress rule on the backend allowing traffic from subnet A permits this. An egress rule on the backend allowing all traffic to the internet enables patch downloads. This setup prevents the backend from initiating connections to the frontend, as no egress rule on the backend targets the frontend, and no ingress rule on the frontend allows unsolicited traffic from the backend.

Answer

Ingress rule on frontend: allow tcp:8080 from backend's service account; Egress rule on backend: allow all to internet

Answer

Ingress rule on frontend: allow tcp:8080 from subnet B; Egress rule on backend: allow all to internet

Answer

Ingress rule on backend: allow tcp:8080 from subnet A; Egress rule on frontend: deny all to internet

Question 8

A large enterprise is using Cloud Data Loss Prevention (DLP) to inspect a Cloud Storage bucket containing millions of files for sensitive data like credit card numbers and health information. The DLP inspection job is configured to scan the entire bucket with a schedule. Recently, the job has been failing with a 'Quota exceeded' error for the DLP inspect requests quota. The team needs to continue inspecting all files without increasing the quota limit, as the quota increase request would take weeks. They cannot skip any files due to compliance requirements. What should they do to work around the quota limit while inspecting all files?

Accepted Answer

Reconfigure the DLP job to use a smaller sampling size (e.g., 'bytesLimitPerFile' or 'filesLimitPercent') to stay within quota limits, and schedule more frequent runs to cover all files over time.. By reducing the per-job scan volume (e.g., via 'bytesLimitPerFile' or 'filesLimitPercent'), the job stays within the DLP inspect requests quota while still covering all files over multiple scheduled runs. This approach respects the quota ceiling without skipping any files, as the sampling is applied per job execution, not per file permanently. The team can increase the job frequency to ensure the entire bucket is eventually inspected, meeting compliance requirements.

Answer

Switch from file store inspection to content inspection (items) and send each file individually via the API to bypass the file-level quota.

Answer

Create de-identification templates to automatically redact the found sensitive data, which reduces the need for inspection.

Answer

Submit a quota increase request and pause the inspection job until the increase is approved.

Question 9

A company is migrating on-premises data to Cloud Storage. They have regulatory requirements to encrypt data using keys managed by their on-premises hardware security module (HSM). Which solution should they use?

Accepted Answer

Use Cloud External Key Manager (Cloud EKM) to reference keys in their on-premises HSM.. Cloud External Key Manager (Cloud EKM) allows you to use encryption keys stored in a supported on-premises HSM via a partner integration, meeting the regulatory requirement for key management outside of Google Cloud. This solution keeps the key material under your control while enabling Cloud Storage to encrypt data using those keys.

Answer

Use Cloud HSM to create and manage keys.

Answer

Use customer-supplied encryption keys (CSEK) for each object.

Answer

Use Cloud Key Management Service (Cloud KMS) with a key generated in the cloud.

Question 10

A multinational corporation must store all data subject to GDPR in the European Union. They have multiple projects and want to enforce this at the organization level. Which approach should they use to prevent resource creation outside allowed locations?

Accepted Answer

Apply Organization Policy constraints (constraints/gcp.resourceLocations) with allowed regions in EU. Organization policies provide centralized control to constrain resource locations, ensuring all projects under the organization adhere to the data residency requirement.

Answer

Configure VPC Service Controls to limit network traffic to EU regions

Answer

Use Cloud Deployment Manager to deploy resources only in EU regions

Answer

Enable Cloud Audit Logs to monitor resource locations and alert on violations

Question 11

A company uses VPC Service Controls to protect sensitive data. They notice that audit logs from a service perimeter are not being exported to a logging bucket inside the same perimeter. What is the likely cause?

Accepted Answer

The logging bucket is not within the service perimeter. The logging bucket must be inside the service perimeter for logs to be accessible from within the perimeter. If the bucket is outside, the logs cannot be exported due to the perimeter's data exfiltration protections.

Answer

The logging bucket is within a different VPC

Answer

The logging bucket is in a different project

Answer

The logging bucket has a retention policy

Question 12

An organization uses Binary Authorization with multiple attestors. They want to allow a deployment only if at least two attestors have signed the image. Which policy type should be used?

Accepted Answer

Require attestation with a list of attestors and a minimum number of 2. Binary Authorization allows you to define a policy with multiple attestors and set a minimum number of attestations required.

Answer

Allow all images

Answer

Require attestation with a single attestor

Answer

Deny all images

Question 13

A small company has a single VPC with subnets in us-central1 (10.0.1.0/24) and us-west1 (10.0.2.0/24). They have a Compute Engine VM (web-server) in us-central1 that needs to connect to a Cloud SQL MySQL instance also in us-central1 using its private IP address 10.0.1.3. The Cloud SQL instance is configured with private IP only and is deployed in the same VPC. The web-server can successfully ping the Cloud SQL private IP (10.0.1.3). However, the application on the web-server fails to connect to the MySQL database with an authentication error. There are no custom firewall rules; only the default VPC firewall rules are in place. What is the most likely cause of the connection failure?

Accepted Answer

The web-server's service account lacks the Cloud SQL Client IAM role.. The web-server can ping the Cloud SQL private IP (10.0.1.3), confirming network connectivity at Layer 3. The authentication error indicates the application is reaching the database but being denied access. Cloud SQL uses IAM for authentication when connecting via private IP; the web-server's service account must have the Cloud SQL Client IAM role to authenticate successfully. Without this role, the connection is rejected even though the network path is open.

Answer

The default-allow-internal firewall rule does not allow TCP port 3306.

Answer

The Cloud SQL instance does not have the public IP address enabled.

Answer

The Cloud SQL instance is in a different region than the web-server.

Question 14

Drag and drop the steps to set up a Private Google Access for on-premises hosts using Private Service Connect in the correct order.

Accepted Answer

Create a VPC network, then create a Private Service Connect endpoint, then configure DNS (e.g., Cloud DNS forwarding zone for *.googleapis.com), then set up hybrid connectivity (Cloud VPN or Dedicated Interconnect), then test connectivity from on-premises hosts.. Private Service Connect requires VPC, endpoint creation, DNS configuration, hybrid connectivity, and testing.

Answer

Create a Private Service Connect endpoint, then create a VPC network, then configure DNS, then set up hybrid connectivity, then test.

Answer

Create a VPC network, then set up hybrid connectivity, then create a Private Service Connect endpoint, then configure DNS, then test.

Answer

Configure DNS, then create a VPC network, then create a Private Service Connect endpoint, then set up hybrid connectivity, then test.

Question 15

Match each encryption scope to its description.

Accepted Answer

Google-managed encryption: Encryption keys are managed entirely by Google.. Correct matches: Google-managed encryption (A) is fully handled by Google; CMEK (B) lets you manage keys via Cloud KMS; CSEK (C) requires you to supply keys. Common confusions involve who manages the keys.

Answer

CMEK: Encryption is done by Google with no user involvement.

Answer

CSEK: Encryption keys are managed by Google.

Answer

Google-managed encryption: You manage your own encryption keys.