PCSE Practice Test 32 — 15 Questions

Question 1

A company uses Cloud DLP to inspect BigQuery tables for sensitive data. They want to automatically de-identify the data before loading it into another BigQuery dataset for analysis. Which THREE components must be configured? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A DLP job trigger. To automatically de-identify data from BigQuery, a DLP job must be configured with a de-identification template. The inspection template identifies sensitive info types. The job can write results to a new BigQuery table. A job trigger schedules the job.

Answer

A Cloud KMS key for encryption of the output

Answer

A BigQuery authorized view

Question 2

A security engineer needs to store database credentials and API keys securely in GCP. The solution must support automatic rotation of secrets at a defined schedule and trigger a Cloud Function after each rotation to update dependent applications. Which service should they use?

Accepted Answer

Secret Manager. Secret Manager supports versioning, IAM access, and automatic rotation with Pub/Sub notifications. Cloud Functions can subscribe to the Pub/Sub topic to perform post-rotation tasks. Cloud KMS manages keys, not secrets. Cloud DLP is for data loss prevention. Cloud Storage is not designed for secret management with rotation.

Answer

Cloud KMS

Answer

Cloud DLP

Answer

Cloud Storage

Question 3

A security team wants to use Web Security Scanner to find vulnerabilities in their web application hosted on Compute Engine. They need to scan the public-facing URL weekly and receive a report of findings. Which configuration is required?

Accepted Answer

Create a managed scan in Security Command Center with the target URL and schedule. Web Security Scanner is a fully managed service within Google Cloud Security Command Center (SCC) that scans web applications for common vulnerabilities like XSS, SQL injection, and mixed content. To scan a public-facing URL on a scheduled basis, you create a managed scan in SCC, specifying the target URL and a schedule (e.g., weekly). No agent installation or code changes are required, and the scanner works with any publicly accessible endpoint, including those on Compute Engine.

Answer

Install the Web Security Scanner agent on the VM

Answer

Use gcloud compute instances scan command

Answer

Deploy the application to App Engine, then enable Web Security Scanner

Question 4

A company needs to enforce data residency in the European Union for all GCP resources. Which TWO actions should they take? (Choose two.)

Accepted Answer

Use Assured Workloads with an EU data boundary. Option B is correct because Assured Workloads provides a compliance-focused environment with an EU data boundary that enforces data residency controls (such as data location and personnel access) for the resources deployed within the folder it governs. Option C is correct because the organization policy constraint `gcp.resourceLocations` (set via `constraints/gcp.resourceLocations`) restricts where resources can be created at the organization, folder, or project level, allowing only EU locations and thereby enforcing data residency. Option A is not correct because a VPC Service Perimeter controls access to services and data based on context (e.g., trusted networks, identities), not the physical region where resources are stored, so it does not by itself enforce data residency. Option D is not correct because IAM policies govern identities and permissions, not the geographic location of resource creation or storage, so they cannot enforce data residency. Option E is not correct because Cloud Audit Logs only record and monitor activity; they provide visibility into resource creation but do not prevent or enforce resources from being created outside the EU.

Answer

Create a VPC Service Perimeter that only allows access from EU regions

Answer

Set IAM policies to deny access to non-EU regions

Answer

Enable Cloud Audit Logs to monitor resource creation outside EU

Question 5

A security administrator wants to prevent users from disabling Shielded VM on existing Compute Engine instances. Which IAM permission should they deny?

Accepted Answer

compute.instances.updateShieldedVmConfig. The permission compute.instances.updateShieldedVmConfig controls the ability to update the Shielded VM configuration (enable/disable) on an existing instance. Denying this permission will prevent users from changing Shielded VM settings on instances. The permission compute.instances.setMetadata is for metadata changes, compute.instances.update is for general updates, and compute.instances.setMachineResources is for changing machine types.

Answer

compute.instances.setMetadata

Answer

compute.instances.setMachineResources

Answer

compute.instances.update

Question 6

A security engineer is using Cloud Asset Inventory to find all Compute Engine instances that are not labeled with a 'compliance' label. Based on the exhibit, which instance(s) are missing the compliance label?

Accepted Answer

instance-2 only. The exhibit shows that instance-1 has a 'compliance' label with a value of 'true', while instance-2 has no 'compliance' label at all. Cloud Asset Inventory can query assets using label filters; the absence of the 'compliance' label on instance-2 means it fails the compliance labeling requirement. Therefore, only instance-2 is missing the compliance label.

Answer

Both instances

Answer

Neither instance

Answer

instance-1 only

Question 7

A company wants to enforce that traffic between two projects in the same organization must go through a central inspection VPC. They need a firewall rule that denies all traffic between the projects except through the inspection VPC. Which type of firewall rule should they use?

Accepted Answer

Hierarchical firewall policy at the folder level. A hierarchical firewall policy applied at the folder level lets an organization enforce rules that cascade to all projects beneath it, so a deny rule between the two projects (with an allow for traffic routed via the inspection VPC) is applied uniformly without per-project configuration drift. This is the intended GCP mechanism for org-wide network security guardrails.

Answer

Cloud IDS

Answer

VPC Service Controls

Answer

Network firewall rules in each project

Question 8

A healthcare organization needs to ensure that all access to ePHI in Cloud SQL is logged for HIPAA compliance. They have enabled audit logs. What additional step is required to ensure logs are retained for at least one year?

Accepted Answer

Create a log sink to export the logs to Cloud Storage.. Cloud Audit Logs in Cloud Logging have a default retention of 30 days (up to 365 for _Default bucket configuration, but not one year by default for all log types). To retain logs for at least one year, you must create a log sink that exports them to a destination like Cloud Storage, where you control retention via a bucket retention policy or lifecycle rule. Enabling audit logs alone does not extend retention.

Answer

Enable Access Transparency logs.

Answer

Set a retention policy on the Cloud SQL instance.

Answer

Adjust the retention period in the Logs Explorer to 1 year.

Question 9

A healthcare organization stores Protected Health Information (PHI) in Cloud Storage. They need to de-identify data before sharing it with researchers. Which service should they use?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud Data Loss Prevention (DLP) is the correct service because it is specifically designed to inspect, classify, and de-identify sensitive data such as Protected Health Information (PHI). It uses built-in infoTypes (e.g., US_INDIVIDUAL_HEALTHCARE_NPI) and de-identification techniques like masking, tokenization, and redaction to transform PHI into a de-identified dataset before sharing with researchers, ensuring compliance with HIPAA.

Answer

Cloud Key Management Service (KMS)

Answer

VPC Service Controls

Answer

Cloud IAM

Question 10

A company has a VPC Service Controls perimeter that includes BigQuery and Cloud Storage. They need to allow a specific on-premises application (with a static IP) to access a BigQuery dataset within the perimeter. Which configuration should they use?

Accepted Answer

Add the on-premises IP to an access level and create an ingress rule in the service perimeter.. VPC Service Controls perimeters block access from outside the perimeter unless an explicit ingress rule is configured. To allow a specific on-premises application with a static IP, you must create an access level that includes that IP and then add an ingress rule to the service perimeter that permits access from that access level to the BigQuery resources. This is the only supported mechanism for granting external access into a VPC SC perimeter.

Answer

Create a VPC firewall rule allowing ingress from the on-premises IP to the BigQuery API.

Answer

Exempt the on-premises service account from the perimeter.

Answer

Use Private Google Access from the on-premises network.

Question 11

A company has a policy that only specific service accounts can be used on Compute Engine instances. How can this be enforced?

Accepted Answer

Use an organization policy with constraint compute.restrictServiceAccountUsage.. The organization policy constraint `compute.restrictServiceAccountUsage` is specifically designed to enforce which service accounts can be used when creating Compute Engine instances. When applied at the project, folder, or organization level, this constraint allows you to define a list of allowed service accounts (by email or ID), and any attempt to launch an instance with a service account not on that list will be denied by the Resource Manager. This directly enforces the company policy that only specific service accounts are permitted on Compute Engine instances.

Answer

Use IAM conditions on the compute.instanceAdmin role to restrict the service account.

Answer

Use Identity-Aware Proxy (IAP).

Answer

Use a VPC Service Controls perimeter.

Question 12

A company is migrating on-premises data to Cloud Storage. They have regulatory requirements to encrypt data using keys managed by their on-premises hardware security module (HSM). Which solution should they use?

Accepted Answer

Use Cloud External Key Manager (Cloud EKM) to reference keys in their on-premises HSM.. Cloud External Key Manager (Cloud EKM) allows you to use encryption keys stored in a supported on-premises HSM via a partner integration, meeting the regulatory requirement for key management outside of Google Cloud. This solution keeps the key material under your control while enabling Cloud Storage to encrypt data using those keys.

Answer

Use Cloud HSM to create and manage keys.

Answer

Use customer-supplied encryption keys (CSEK) for each object.

Answer

Use Cloud Key Management Service (Cloud KMS) with a key generated in the cloud.

Question 13

An organization uses VPC Service Controls in dry-run mode for a project containing Google Cloud Storage. They notice that BigQuery jobs are being logged as violations. How should they interpret this?

Accepted Answer

The perimeters are logging potential violations; no action has been taken yet.. In dry-run mode, VPC Service Controls logs violations without enforcement, allowing administrators to review and adjust perimeters before enabling enforcement.

Answer

The dry-run mode is not supported for Cloud Storage projects.

Answer

The perimeters are not configured correctly because BigQuery should not be affected.

Answer

The perimeters are working correctly and BigQuery access is blocked.

Question 14

An organization uses BigQuery with column-level security. They have a column containing social security numbers (SSNs) that should only be visible to users with the 'PII_Viewer' role. How should they configure this?

Accepted Answer

Create a policy tag on the column and bind it to the role.. BigQuery column-level security uses policy tags to restrict access to sensitive columns. By creating a policy tag on the SSN column and binding it to the 'PII_Viewer' role, only users with that role can see the data; others see NULL or are denied access. This is the native, recommended approach for column-level access control in BigQuery.

Answer

Encrypt the column with CMEK and give decrypt permission only to PII_Viewer.

Answer

Use authorized views to filter the column.

Answer

Use BigQuery row-level access policies.

Question 15

A global company must store customer data in a specific geographic region to comply with data residency regulations. The database needs strong transactional consistency and low-latency reads worldwide. Which database solution should they choose?

Accepted Answer

Use Cloud Spanner with a multi-region configuration that includes the required region. Cloud Spanner with a multi-region configuration that includes the required region (A) is the correct choice because it provides strong transactional consistency and low-latency reads globally. Cloud Spanner is a globally distributed, horizontally scalable relational database that offers external consistency (strong consistency) and automatic replication across regions. By including the required region in the multi-region configuration, data residency compliance is met while ensuring low-latency reads from other regions through replication.

Answer

Use BigQuery with a multi-region dataset

Answer

Use Cloud SQL with cross-region replication

Answer

Use Firestore in multi-region mode