PCSE Practice Test 31 — 15 Questions

Question 1

A company uses Access Context Manager to restrict access to Cloud Resources based on device policy. They want to allow access only from devices that are company-managed and have disk encryption enabled. What should they configure?

Accepted Answer

Create an access level with device policy conditions for corporate-owned and disk encryption.. Option C is correct because Access Context Manager allows you to create access levels that define device policy conditions, such as requiring devices to be corporate-owned and have disk encryption enabled. These access levels are then applied to the organization's access policies to restrict access to cloud resources based on the device's compliance status.

Answer

Create an IAM condition requiring a specific device tag.

Answer

Use Identity-Aware Proxy with device policy.

Answer

Use VPC Service Controls with a device restriction.

Question 2

A company uses multiple GCP projects and wants to allow a service account from Project A to initiate Dataflow jobs in Project B. The service account in Project A has the Dataflow Developer role at the organization level. However, it fails with permission denied when trying to submit a job to Project B. What is the most likely issue?

Accepted Answer

The service account needs the Service Account User role on the Dataflow service account in Project B.. The service account from Project A has the Dataflow Developer role at the organization level, which grants permissions to create Dataflow jobs, but it still needs the Service Account User role (roles/iam.serviceAccountUser) on the Dataflow service account in Project B. When a Dataflow job is submitted, the job runs as a service account in the target project (Project B), and the caller must have the iam.serviceAccounts.actAs permission on that service account. Without this role, the API call fails with a permission denied error even though the Dataflow Developer role is present.

Answer

The organization policy restricts cross-project access.

Answer

The service account does not have permission to create Dataflow jobs in Project B because it is not a member of Project B.

Answer

The Dataflow API is not enabled in Project B.

Question 3

An organization wants to enforce that all Cloud Storage buckets are created with uniform bucket-level access enabled. Which policy can be used to achieve this?

Accepted Answer

Organization policy with constraint `constraints/storage.uniformBucketLevelAccess`. Option D is correct because the Organization Policy with the constraint `constraints/storage.uniformBucketLevelAccess` is a native Google Cloud policy that can be applied at the organization, folder, or project level to enforce that all new Cloud Storage buckets are created with uniform bucket-level access enabled. This policy prevents the creation of buckets with fine-grained ACLs, ensuring consistent access control across the organization.

Answer

Audit logs to detect non-compliance

Answer

VPC Service Controls perimeter

Answer

IAM custom role with permission to enforce uniform access

Question 4

Which THREE are valid considerations when designing cross-organization access for Cloud Storage? (Choose three.)

Accepted Answer

Uniform bucket-level access disables ACLs, simplifying cross-org access management.. Uniform bucket-level access disables Access Control Lists (ACLs) and relies solely on IAM permissions for bucket access. This eliminates the complexity of managing both ACLs and IAM across organizations, making cross-org access management simpler and more consistent.

Answer

Signed URLs require the requester pays configuration to be enabled.

Answer

VPC Service Controls must be configured to allow cross-org IAM policies.

Question 5

Which TWO are correct statements about IAM deny policies? (Choose two.)

Accepted Answer

Deny policies support conditions to restrict when the deny applies.. Option B is correct because IAM deny policies support conditions that allow you to specify when the deny should apply, such as based on IP address, date/time, or resource tags. This enables fine-grained control over access restrictions, ensuring that the deny only takes effect under defined circumstances.

Answer

Deny policies are prioritized based on the resource hierarchy (organization highest).

Answer

Deny policies cannot override an allow policy if the member is explicitly granted.

Answer

Deny policies can be applied at any resource level including individual resources.

Question 6

A company uses Cloud Storage buckets to store sensitive data. They want to allow a third-party auditor to list bucket contents but not download the objects. Which IAM role should be assigned?

Accepted Answer

roles/storage.legacyBucketReader. The correct answer is A because roles/storage.legacyBucketReader grants permission to list the contents of a bucket (via the storage.buckets.get and storage.objects.list permissions) without allowing object downloads, which require storage.objects.get. This role is specifically designed for scenarios where a user needs to enumerate objects but not read their data, aligning with the auditor's requirement.

Answer

roles/storage.objectAdmin

Answer

roles/storage.objectViewer

Answer

roles/storage.objectCreator

Question 7

A security administrator wants to ensure that only requests coming through Identity-Aware Proxy (IAP) can access a backend service running on Compute Engine. Which configuration is required?

Accepted Answer

Set firewall rules to allow only traffic from IAP proxy IP ranges.. Option D is correct because Identity-Aware Proxy (IAP) uses a fixed set of Google-owned IP ranges to forward authenticated and authorized requests to backend services. By configuring VPC firewall rules to allow ingress only from these IAP proxy IP ranges, the administrator ensures that any traffic not originating from IAP is blocked, effectively restricting access to IAP-authorized requests only.

Answer

Use a VPN between IAP and backend.

Answer

Configure Cloud Armor to block non-IAP traffic.

Answer

Configure the backend service to require IAP credentials.

Question 8

A company wants to use service account keys for an on-premises application that needs to authenticate to Google Cloud APIs. Which two practices should they follow to minimize security risks? (Choose TWO.)

Accepted Answer

Enable automatic key generation and disable any unused keys.. Option B is correct because enabling automatic key generation ensures that keys are created with strong cryptographic standards and that unused keys are promptly disabled, reducing the attack surface. This practice aligns with Google Cloud's recommendation to minimize the number of active keys and to avoid manual key management errors.

Answer

Allow end users to download and use service account keys directly.

Answer

Store the service account key in the application's source code for easy access.

Answer

Use a single service account key for all environments to simplify management.

Question 9

Refer to the exhibit. A Terraform configuration applies an IAM binding with a condition. After applying this configuration, a member of the group data-scientists@example.com tries to query a BigQuery dataset on July 1, 2025. What will be the result?

Accepted Answer

Access is denied because the condition is no longer satisfied.. The correct answer is A because the IAM binding includes a condition that restricts access based on a date/time attribute. On July 1, 2025, the condition is no longer satisfied (e.g., the condition might require the request to occur before a specific date, such as before June 30, 2025). When the condition evaluates to false, the IAM binding does not grant access, even though the binding itself exists and the user is a member of the group.

Answer

Access is denied because the condition is invalid after the date.

Answer

Access is granted because the IAM binding exists.

Answer

Access is granted and the condition is ignored after the date.

Question 10

A company assigns roles to Google Groups to simplify management. They have a group called data-engineers@example.com that needs access to BigQuery datasets. Instead of adding each user individually, they want to grant the group roles/bigquery.dataViewer at the project level. After granting the role, a new member added to the group reports they cannot query a dataset. What is the most likely reason?

Accepted Answer

The dataset is in a different project than the one where the role was granted.. Option A is correct because IAM roles granted at the project level apply only to resources within that project. If the BigQuery dataset resides in a different project, the group's project-level role does not grant access to that dataset. The user would need either a role granted at the dataset's project level or direct dataset-level permissions.

Answer

The user needs to be added directly to the dataset's access control list.

Answer

The dataset has been configured with private access control that overrides the project-level IAM.

Answer

The group does not have the necessary permissions because BigQuery does not support IAM groups.

Question 11

A user should be able to download and delete objects in a specific Cloud Storage bucket. Which two permissions are required in a custom role? (Choose two.)

Accepted Answer

storage.objects.delete. To download an object, the user needs `storage.objects.get` permission, which allows reading the object's data and metadata from the bucket. To delete an object, the user needs `storage.objects.delete` permission, which authorizes the removal of the object from the bucket. These two permissions are the minimum required for download and delete operations on objects within a specific Cloud Storage bucket.

Answer

storage.buckets.list

Answer

storage.buckets.get

Answer

storage.objects.list

Question 12

Refer to the exhibit. The output shows that Alice has the following IAM policy binding: 
{
  "role": "roles/storage.objectAdmin",
  "members": ["user:alice@example.com"],
  "condition": {
    "title": "storage_access_condition",
    "expression": "request.time < timestamp('2024-12-31T23:59:59Z') && source.ip in ['203.0.113.0/24']"
  }
}
Alice is currently working from an IP address 198.51.100.10, and the date is 2025-01-01. What is the result when Alice tries to upload an object to a bucket in this project?

Accepted Answer

Access is denied because both the time and IP conditions are not satisfied.. Alice's IAM policy binding includes a condition that requires both the request time to be before 2024-12-31T23:59:59Z and the source IP to be within 203.0.113.0/24. Since the current date is 2025-01-01, the time condition fails, and her IP address 198.51.100.10 is not in the allowed range. With a condition that uses AND logic, both subconditions must be true for access to be granted; because neither is satisfied, access is denied.

Answer

Access is denied because the role does not include storage.objects.create permission.

Answer

Access is granted because the condition is not evaluated for uploads.

Answer

Access is granted because the IP condition is satisfied.

Question 13

A company wants to provide secure access to an internal web application hosted on Compute Engine without exposing it to the public internet. Which Google Cloud service should they use?

Accepted Answer

Identity-Aware Proxy (IAP). Identity-Aware Proxy (IAP) is the correct choice because it provides a centralized authentication and authorization layer for applications accessed via HTTPS, allowing you to enforce access control policies based on user identity and context without requiring a VPN or public IP exposure. IAP works with Cloud Load Balancing to verify user credentials before allowing traffic to reach the Compute Engine instance, effectively securing the internal web application from the public internet.

Answer

Cloud NAT

Answer

Cloud Storage signed URLs

Answer

Cloud Load Balancing

Question 14

Which two authentication methods are available for applications to authenticate to Google Cloud APIs without using a service account key? (Choose TWO.)

Accepted Answer

Compute Engine metadata server default service account token. Option B is correct because the Compute Engine metadata server provides a default service account token that applications running on Compute Engine can use to authenticate to Google Cloud APIs without needing to manage a service account key file. This token is automatically obtained from the metadata server at http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token, and it is rotated automatically by Google, eliminating the need for key storage and rotation.

Answer

API key

Answer

OAuth 2.0 client ID

Answer

Service account key

Question 15

An administrator wants to enforce that a user can only create virtual machines in a specific subnet of a VPC network. What IAM condition should be added to the compute.instanceAdmin role binding?

Accepted Answer

resource.name == "projects/PROJECT_ID/regions/us-central1/subnetworks/SUBNET". Option A is correct because the IAM condition `resource.name` with the full resource name of the subnet (including the region) is the proper way to restrict virtual machine creation to a specific subnet. The `compute.instanceAdmin` role binding with this condition ensures that the user can only create instances whose subnet matches the specified resource name, enforcing the subnet-level constraint.

Answer

resource.name == "projects/PROJECT_ID/subnetworks/SUBNET"

Answer

api.getAttribute("compute.googleapis.com/zone", "") != "us-central1"

Answer

resource.subnetwork == "projects/PROJECT_ID/subnetworks/SUBNET"