PCSE Practice Test 32 — 15 Questions

Question 1

A DevOps engineer accidentally assigned the role roles/editor to a service account used by a backend service. This gives the service account excessive permissions. The engineer wants to remove the role from the service account. What is the correct command?

Accepted Answer

gcloud projects remove-iam-policy-binding PROJECT_ID --member serviceAccount:SA_EMAIL --role roles/editor. Option A is correct because `gcloud projects remove-iam-policy-binding` is the specific command to remove an IAM role binding from a project-level policy for a given member (service account). The syntax correctly includes the `--member` flag with the `serviceAccount:` prefix and the `--role` flag specifying `roles/editor`, which removes the excessive Editor role from the service account.

Answer

gcloud iam policy-bindings remove --member serviceAccount:SA_EMAIL --role roles/editor

Answer

gcloud iam service-accounts remove-role SA_EMAIL --role roles/editor

Answer

gcloud projects set-iam-policy PROJECT_ID policy.yaml

Question 2

An organization wants to enforce that all Compute Engine instances must use a specific service account. Which three steps are necessary? (Choose three.)

Accepted Answer

Grant the service account the needed roles on the project.. Option B is correct because the service account must be granted the necessary IAM roles on the project (or specific resources) to perform its intended actions. Without these grants, even if the service account is enforced, it will lack permissions to interact with Compute Engine resources. This step ensures the service account has the required access, such as compute.instanceAdmin or custom roles, to manage instances.

Answer

Create a custom role with compute.instances.create permission.

Answer

Grant the compute.instanceAdmin role to the service account.

Question 3

A developer needs to deploy a Cloud Run service that will read from a Cloud Pub/Sub topic. What is the least privileged IAM role to grant to the Cloud Run service's service account?

Accepted Answer

roles/pubsub.subscriber. Option C is correct because the Cloud Run service needs only the ability to pull (subscribe to) messages from the Pub/Sub topic. The `roles/pubsub.subscriber` role grants the `pubsub.subscriptions.consume` and `pubsub.subscriptions.get` permissions required to read messages, and when applied at the topic resource level (as implied by the option), it allows the service account to create and manage a subscription on that topic. This is the least privileged role that enables the read operation without granting unnecessary permissions like publishing or viewing all topics.

Answer

roles/pubsub.subscriber on the topic resource

Answer

roles/pubsub.viewer

Answer

roles/pubsub.publisher

Question 4

User user1@domain.com tries to SSH into a Compute Engine instance that has the service account sa1@project.iam.gserviceaccount.com attached. Will the SSH connection succeed? (Assume no other policies)

Accepted Answer

No, because user1 needs a role such as compute.osLogin to SSH into the instance.. Option B is correct because SSH access to a Compute Engine instance requires the user to have the compute.osLogin role (or a role that includes compute.instances.osLogin permission) when OS Login is enabled. Without OS Login, the user needs the compute.instances.setMetadata permission to add SSH keys. The service account attached to the instance does not grant SSH access; it only allows the instance to authenticate to Google Cloud APIs. User1 has no relevant IAM roles for SSH, so the connection will fail.

Answer

No, because user1 lacks compute.instances.osLogin permission.

Answer

Yes, because user1 has iam.serviceAccountUser role on the service account, which is required to use it.

Answer

Yes, because user1 has compute.viewer role.

Question 5

A company wants to grant a third-party auditor read-only access to specific BigQuery datasets in a project. The auditor's identity is managed in their own Google Cloud organization. What is the most secure way to grant access?

Accepted Answer

Create a service account in the company's project, grant it the BigQuery Data Viewer role, and allow the auditor's organization to use that service account via Workload Identity Federation.. Option C is correct because it uses Workload Identity Federation to allow the auditor's Google Cloud organization to impersonate a service account in the company's project without sharing a key. This grants read-only access via the BigQuery Data Viewer role while eliminating the risk of long-lived credentials. The auditor's identity is managed externally, and access is granted through a secure, federated trust relationship.

Answer

Share the project's service account key with the auditor so they can impersonate it.

Answer

Use VPC Service Controls to allow access only from the auditor's IP range.

Answer

Create a Google Group and add the auditor's email addresses, then grant the group the BigQuery Data Viewer role.

Question 6

An organization has three projects: dev, staging, prod. They use Cloud Build to deploy code. The Cloud Build service account in the dev project needs to deploy to GKE in the prod project. To allow cross-project deployment, what should the Cloud Build service account be granted in the prod project?

Accepted Answer

roles/container.developer on the prod project.. The Cloud Build service account in the dev project needs to deploy workloads to a GKE cluster in the prod project. The role `roles/container.developer` on the prod project grants the necessary permissions to create, update, and delete pods, deployments, and services within the cluster, which is required for deployment. This role also includes `container.clusters.get` and `container.clusters.update` to interact with the cluster, making it the correct choice for cross-project GKE deployment.

Answer

roles/container.clusterViewer on the prod cluster.

Answer

roles/storage.objectViewer on the prod bucket.

Answer

roles/iam.serviceAccountUser on the GKE node service account in prod.

Question 7

A company wants to grant a user the ability to delete a Cloud SQL instance but not be able to modify any other settings. What is the least privileged role?

Accepted Answer

Use a custom role with only cloudsql.instances.delete permission.. Option D is correct because the least privileged role that allows deleting a Cloud SQL instance without granting any other permissions is a custom role containing only the `cloudsql.instances.delete` permission. Predefined roles like viewer, editor, or admin include broader permissions that would allow modifying other settings, violating the principle of least privilege.

Answer

roles/cloudsql.viewer

Answer

roles/cloudsql.editor

Answer

roles/cloudsql.admin

Question 8

A healthcare organization must store protected health information (PHI) in Google Cloud and ensure compliance with HIPAA. They need to prevent data from being stored outside the United States. Which Google Cloud product should they use to enforce this requirement?

Accepted Answer

Organization Policy. Organization Policy allows you to define and enforce constraints on Google Cloud resources at the organization, folder, or project level. The `gcp.resourceRestriction` constraint can be used to restrict the location where data can be stored, ensuring PHI remains within the United States to meet HIPAA requirements.

Answer

Cloud Healthcare API

Answer

VPC Service Controls

Answer

Cloud Data Loss Prevention (DLP) API

Question 9

An organization has multiple Google Cloud projects and wants to enforce a policy that all new projects automatically have a specific set of IAM roles bound to an internal audit group at the project level. Which approach should be taken?

Accepted Answer

Create an Organization Policy with a custom constraint that requires specific IAM bindings on all projects.. Option C is correct because Organization Policies with custom constraints allow you to enforce that specific IAM bindings must exist on all projects within the organization. This ensures that every new project automatically includes the audit group with the required roles, as the policy is evaluated at project creation time and enforced by the Resource Manager service.

Answer

Define a custom role with the necessary permissions and assign it to the audit group at the organization level.

Answer

Configure Audit Logs to alert when new projects are created without the audit group.

Answer

Add the audit group to the organization node with the desired roles, and rely on inheritance for all new projects.

Question 10

A multi-national company needs to ensure that customer data stored in BigQuery is encrypted with customer-managed encryption keys (CMEK) and that the keys are rotated every 90 days. Additionally, the company must be able to audit all key usage. Which steps are required to implement this compliance requirement?

Accepted Answer

Create a Cloud KMS key ring with a key using a protection level of software and set a rotation period of 90 days. Then configure BigQuery to use the key and enable Data Access audit logs for Cloud KMS.. Option D is correct because it uses a Cloud KMS software-protection-level key with a 90-day rotation period, which meets the CMEK requirement for BigQuery. Enabling Data Access audit logs for Cloud KMS captures all key usage events, satisfying the auditing requirement. Automatic rotation in Cloud KMS handles the 90-day rotation without manual intervention, and BigQuery is configured to use the CMEK key for dataset encryption.

Answer

Create a Cloud External Key Manager (EKM) key and configure BigQuery to use it. The EKM provider handles key rotation.

Answer

Create a Cloud KMS key ring with a key, disable automatic rotation, and use Cloud Functions to rotate the key manually every 90 days. Enable Admin Activity audit logs for Cloud KMS.

Answer

Create a Cloud KMS key ring with a key using a protection level of HSM and set a rotation period of 90 days. Then configure the BigQuery dataset to use this key.

Question 11

A company has a Google Cloud organization with several hundred projects. They are using VPC Service Controls to protect sensitive data in BigQuery. They have a service perimeter that includes the projects containing the sensitive datasets. Users in a separate perimeter (perimeter B) need to query a BigQuery dataset in the sensitive perimeter using federated queries from Cloud SQL. The users are authenticated via Cloud Identity and have appropriate IAM roles, but queries are failing. The Cloud SQL instance is in perimeter B. What is the most likely cause?

Accepted Answer

The sensitive perimeter does not have an ingress rule to allow requests from the Cloud SQL service in perimeter B.. VPC Service Controls enforce perimeters that block all data access across perimeter boundaries by default. For a Cloud SQL instance in perimeter B to query BigQuery in the sensitive perimeter via federated queries, the sensitive perimeter must have an ingress rule explicitly allowing requests from the Cloud SQL service (or the VPC network) in perimeter B. Without this ingress rule, the request is denied at the perimeter boundary, regardless of IAM permissions.

Answer

The Cloud SQL instance must be moved into the sensitive perimeter to access BigQuery.

Answer

The users do not have the appropriate IAM role on the BigQuery dataset.

Answer

The BigQuery dataset does not have a corresponding table for export to Cloud SQL.

Question 12

A company is using Cloud SQL for MySQL to store customer data subject to SOX compliance. They need to ensure that all database changes are audited and that logs are immutable. They have enabled audit logs and exported them to a Cloud Storage bucket. However, the auditor discovers that some logs were deleted from the bucket. What is the most likely cause?

Accepted Answer

The Cloud Storage bucket has a lifecycle rule that deletes objects after a set number of days.. Option D is correct because Cloud Storage lifecycle rules can automatically delete objects after a specified number of days. If a lifecycle rule is configured on the bucket, it would delete audit logs regardless of the export process, making them unavailable to the auditor. This is the most likely cause of logs being deleted from the bucket, as the other options do not explain actual deletion of already-exported objects.

Answer

The log sink filter is excluding certain events, causing incomplete export.

Answer

The bucket has retention policy enabled, which prevents deletion until the retention period expires.

Answer

The service account used for export does not have the storage.objects.delete permission.

Question 13

A company is undergoing a SOC 2 audit and needs to demonstrate that access to production data is monitored and that any changes to IAM policies are reviewed. They have enabled Cloud Audit Logs. The auditor asks for a report showing all IAM policy changes in the last 6 months. The security team notices that some older changes are missing. What is the most likely reason?

Accepted Answer

The logs were never exported to a long-term storage destination.. Option D is correct because Cloud Audit Logs are retained for a limited default period (30 days for Admin Activity logs), and the question states that the company enabled Cloud Audit Logs but does not mention exporting them to a long-term destination like Cloud Storage or BigQuery. Without such an export, logs older than 30 days are automatically deleted, which explains why some IAM policy changes from the last 6 months are missing. The auditor's requirement for a 6-month report necessitates a configured log sink to a durable storage destination.

Answer

The log sink filter is excluding IAM policy changes.

Answer

Admin Activity audit logs are only retained for 30 days by default unless exported to a destination like Cloud Storage or BigQuery.

Answer

IAM policy changes are logged in Data Access audit logs, which are not enabled by default.

Question 14

A company needs to ensure that all data stored in Cloud Storage is encrypted using a key that is rotated every 30 days. Which encryption option should they choose to meet this requirement with automated rotation?

Accepted Answer

Customer-Managed Encryption Key (CMEK) using Cloud KMS. Option B is correct because Customer-Managed Encryption Keys (CMEK) with Cloud KMS allow you to control and rotate encryption keys on a schedule. Cloud KMS supports automatic key rotation with a configurable rotation period (e.g., every 30 days), meeting the requirement without manual intervention.

Answer

Cloud External Key Manager (EKM)

Answer

Google-managed encryption keys

Answer

Customer-Supplied Encryption Key (CSEK)

Question 15

Which TWO actions should be taken to ensure that a Google Cloud environment meets PCI-DSS requirements for protecting cardholder data? (Choose two.)

Accepted Answer

Encrypt all transmission of cardholder data using TLS 1.2 or higher.. Option B is correct because PCI-DSS Requirement 4 mandates that cardholder data must be encrypted during transmission over open, public networks. TLS 1.2 or higher is the specified protocol, and Google Cloud services such as HTTPS load balancers and Cloud VPN support this encryption natively, ensuring compliance with the transmission security requirement.

Answer

Use IAM roles to restrict access to cardholder data to the minimum necessary.

Answer

Use Cloud Data Loss Prevention to tokenize all credit card numbers before storage.

Answer

Enable automatic DLP inspection triggers for all Cloud Storage buckets.