PCSE Practice Test 32 — 15 Questions

Question 1

A company must enforce that no data can be accessed from outside a specific set of Google Cloud projects. They want to ensure that only authorized services can communicate between projects. Which TWO controls should they implement? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Access Context Manager. VPC Service Controls create a perimeter around resources, and Access Context Manager defines context-aware access policies based on attributes like IP range, device policy, etc.

Answer

Cloud Armor

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud NAT

Question 2

A user is getting a permission denied error when trying to access a Cloud SQL instance from a Compute Engine VM. The VM's service account has the Cloud SQL Client role. What is the most likely cause?

Accepted Answer

The Cloud SQL API is not enabled for the project.. Even with correct IAM roles, the Cloud SQL API must be enabled for the project. The service account being attached is confirmed by the role assignment, private IP is not required for Client role, and using a proxy is optional but not the cause of permission denied.

Answer

The service account is not attached to the VM.

Answer

The user is not using a Cloud SQL proxy.

Answer

The Cloud SQL instance does not have a private IP.

Question 3

A company has a Shared VPC environment with multiple service projects. The security team wants to ensure that all Compute Engine VMs in service projects are only accessible via IAP TCP forwarding for SSH management, and direct external access is completely blocked. They have already applied an organization policy constraint that denies the attachment of external IP addresses to new VMs. However, there are several existing VMs that still have public IP addresses assigned. The team wants to remove the public IPs from these existing VMs without causing downtime for any ongoing SSH sessions or disrupting the applications running on them, but they must ensure the VMs can still reach the internet if needed (for example, to download updates). What should the team do?

Accepted Answer

First, deploy a Cloud NAT gateway for the VPC and subnet, then remove the public IP from each VM; the VMs will use Cloud NAT for outbound internet access.. Cloud NAT provides outbound internet access for private VMs without requiring public IPs, and removing the public IP from an existing VM does not interrupt running SSH sessions or applications—the VM continues running with its internal IP. After deploying Cloud NAT for the VPC and subnet, you can safely remove the public IP from each VM, and the VM will use Cloud NAT for outbound connections (e.g., downloading updates). This approach satisfies the security requirement of blocking direct external access while maintaining outbound connectivity and avoiding downtime.

Answer

Delete each VM and recreate it without a public IP address.

Answer

Detach the public IP from each VM in the console, and then create a new private IP for the VM.

Answer

For each VM, use the gcloud command to delete the public IP and assign a new private IP from the same subnet.

Question 4

A company has multiple VPC networks that need to communicate privately. They are evaluating VPC peering and Shared VPC. Which statement correctly describes a limitation of VPC peering compared to Shared VPC?

Accepted Answer

VPC peering does not support transitive peering. VPC peering does not support transitive peering, meaning if networks A and B are peered, and A and C are peered, B cannot communicate with C through A. Shared VPC does not have this limitation.

Answer

VPC peering cannot route traffic to an on-premises network via VPN

Answer

VPC peering does not support firewall rules

Answer

VPC peering requires all networks to be in the same project

Question 5

An organization uses Shared VPC to centrally manage network resources. They want to allow a service project to use its own firewall rules for certain instances. How should they configure the firewall rules?

Accepted Answer

Firewall rules can only be created in the host project. In Shared VPC, all firewall rules are created in the host project. Service projects cannot create firewall rules for the shared VPC network. Therefore, the only way is to create rules in the host project.

Answer

Create firewall rules in the service project with target tags

Answer

Create firewall rules in the host project with target tags for service project instances

Answer

Use hierarchical firewall policies

Question 6

A company is migrating its on-premises Microsoft Active Directory to Google Cloud using Managed Microsoft AD (Microsoft AD). They need to ensure that users can authenticate to Compute Engine Windows instances using their on-premises credentials without additional user setup. What is the most secure and scalable approach?

Accepted Answer

Create a two-way trust between the Managed Microsoft AD domain and the on-premises AD domain.. Establishing a two-way trust between Managed Microsoft AD and the on-premises AD domain allows users to authenticate to Compute Engine Windows instances using their existing on-premises credentials without any additional user setup. This trust enables Kerberos authentication to flow seamlessly across the two domains, ensuring that on-premises users can access cloud resources securely and scalably without duplicating identities or credentials.

Answer

Configure the Windows instances to join the on-premises AD domain directly via VPN.

Answer

Synchronize on-premises users to Managed Microsoft AD using Google Cloud Directory Sync (GCDS).

Answer

Store on-premises user credentials in Cloud KMS and use a custom authentication script.

Question 7

A company is deploying a multi-tier application on Google Cloud. The web tier must be accessible from the internet, while the application and database tiers must only be accessible from the web tier. The security team wants to use VPC firewall rules and Cloud NAT for outbound internet access from private instances. Which architecture meets these requirements with the least operational overhead?

Accepted Answer

Place web tier in a public subnet with public IPs. Place app/db tiers in private subnets with no public IPs. Use firewall rules to allow traffic from web to app, and app to db. Configure Cloud NAT for private subnets.. It uses a single VPC with separate public and private subnets, which minimizes operational overhead while meeting the security requirements. The web tier in the public subnet gets public IPs for internet access, while the app and database tiers in private subnets have no public IPs and rely on Cloud NAT for outbound internet. Firewall rules restrict traffic to only the necessary flows (web→app, app→db), and Cloud NAT provides scalable outbound connectivity without managing a proxy VM.

Answer

Use a single subnet for all tiers. Assign public IPs to all instances. Use firewall rules to restrict access between tiers. Use a proxy VM for outbound internet from app/db tiers.

Answer

Create separate VPCs for each tier. Use VPC peering to connect them. Use firewall rules to allow traffic. Use a bastion host for SSH access to app/db tiers.

Answer

Place all tiers in the same VPC. Use firewall rules to restrict access. Assign public IPs to web tier instances and private IPs to app/db tiers. Configure Cloud NAT for app/db tiers.

Question 8

Refer to the exhibit. The output shows that Alice has the following IAM policy binding: 
{
  "role": "roles/storage.objectAdmin",
  "members": ["user:alice@example.com"],
  "condition": {
    "title": "storage_access_condition",
    "expression": "request.time < timestamp('2024-12-31T23:59:59Z') && source.ip in ['203.0.113.0/24']"
  }
}
Alice is currently working from an IP address 198.51.100.10, and the date is 2025-01-01. What is the result when Alice tries to upload an object to a bucket in this project?

Accepted Answer

Access is denied because both the time and IP conditions are not satisfied.. Alice's IAM policy binding includes a condition that requires both the request time to be before 2024-12-31T23:59:59Z and the source IP to be within 203.0.113.0/24. Since the current date is 2025-01-01, the time condition fails, and her IP address 198.51.100.10 is not in the allowed range. With a condition that uses AND logic, both subconditions must be true for access to be granted; because neither is satisfied, access is denied.

Answer

Access is denied because the role does not include storage.objects.create permission.

Answer

Access is granted because the condition is not evaluated for uploads.

Answer

Access is granted because the IP condition is satisfied.

Question 9

A company uses Cloud Functions with a service account that has the role 'roles/cloudfunctions.invoker' to allow unauthenticated invocation. They want to change this so that only authenticated requests from a specific Cloud Scheduler job can invoke the function. The Cloud Scheduler job runs in the same project and uses a service account with the role 'roles/cloudscheduler.serviceAgent'. The security engineer updates the Cloud Function's ingress settings to 'Allow internal traffic only' and removes the 'allUsers' invoker binding. However, the Cloud Scheduler job now fails with a 403 error. What should the engineer do to fix this?

Accepted Answer

Grant the Cloud Scheduler's service account the role 'roles/cloudfunctions.invoker' on the Cloud Function.. A is correct because the Cloud Scheduler job uses a service account to authenticate its requests. By default, Cloud Scheduler does not automatically have permission to invoke a Cloud Function. Granting the Cloud Scheduler's service account the 'roles/cloudfunctions.invoker' role on the Cloud Function explicitly authorizes that identity to invoke the function, even when the function's ingress is set to 'Allow internal traffic only' and the 'allUsers' binding is removed.

Answer

Add 'allAuthenticatedUsers' as an invoker to the Cloud Function.

Answer

Change the ingress setting to 'Allow all traffic'.

Answer

Set the Cloud Function's ingress setting to 'Allow internal traffic only' and ensure the Cloud Scheduler job's region is the same as the function's region.

Question 10

A security engineer needs to encrypt data at rest in Cloud Storage using a key that is not managed by Google Cloud. The key must be stored on-premises and provided with each API call for data access. Which encryption approach should be used?

Accepted Answer

Use customer-supplied encryption keys (CSEK) by providing the key in the request headers.. Customer-supplied encryption keys (CSEK) allow you to provide your own AES-256 key with each API call to Cloud Storage. The key is not stored by Google Cloud; it is used only in memory to encrypt/decrypt data and then discarded, meeting the requirement of on-premises key storage and per-API-call key provision.

Answer

Use customer-managed encryption keys (CMEK) with key material imported from an on-premises HSM.

Answer

Use Cloud KMS with a key stored in an on-premises HSM via Cloud External Key Manager.

Answer

Use Google-managed encryption keys with an organizational policy to disable automatic encryption.

Question 11

A company has deployed a Cloud Run service that needs to access a Cloud SQL database. They have configured a service account for the Cloud Run service and granted it the Cloud SQL Client role. However, the application is receiving 'Permission denied' errors when trying to connect to the database. The database has a private IP and is in a VPC. What is the most likely cause?

Accepted Answer

Cloud Run cannot reach the private IP because it is not connected to the VPC via Serverless VPC Access.. Cloud Run services run in a Google-managed environment that is not automatically connected to a VPC. To reach a Cloud SQL instance with a private IP, the Cloud Run service must use Serverless VPC Access to establish a VPC connector, which enables direct traffic to the private IP. Without this connector, the service cannot route to the private IP, resulting in 'Permission denied' errors even though the IAM permissions are correct.

Answer

The service account lacks the cloudsql.instances.connect permission.

Answer

The service account is not authorized in the Cloud SQL instance's IAM policy.

Answer

The Cloud SQL instance requires a public IP for Cloud Run to connect.

Question 12

You are a security engineer for a startup that uses Google Workspace and Google Cloud. You have been asked to allow a contractor, who has a Google account (contractor@example.com), to manage Cloud Storage buckets in a specific project. The contractor should not have access to any other resources. You create a custom role with the necessary permissions and grant it to the user at the project level. However, the contractor reports that they cannot see the project in the Cloud Console. What is the most likely reason?

Accepted Answer

The custom role does not include the 'resourcemanager.projects.get' permission, which is required to view the project in the console.. The Cloud Console requires the 'resourcemanager.projects.get' permission to list and display projects. Even though the custom role grants permissions to manage Cloud Storage buckets, without this specific permission, the contractor cannot see the project in the console. Granting the permission at the project level allows the user to view the project in the console while still restricting access to other resources.

Answer

The contractor's Google account is not in the same domain as the Google Cloud organization.

Answer

The contractor needs to sign in using a different authentication method, such as SAML.

Answer

An organization policy denies access to the project for external users.

Question 13

A company wants to provide secure access to an internal web application hosted on Compute Engine without exposing it to the public internet. Which Google Cloud service should they use?

Accepted Answer

Identity-Aware Proxy (IAP). Identity-Aware Proxy (IAP) is the correct choice because it provides a centralized authentication and authorization layer for applications accessed via HTTPS, allowing you to enforce access control policies based on user identity and context without requiring a VPN or public IP exposure. IAP works with Cloud Load Balancing to verify user credentials before allowing traffic to reach the Compute Engine instance, effectively securing the internal web application from the public internet.

Answer

Cloud NAT

Answer

Cloud Storage signed URLs

Answer

Cloud Load Balancing

Question 14

A developer needs to deploy a Cloud Run service that will read from a Cloud Pub/Sub topic. What is the least privileged IAM role to grant to the Cloud Run service's service account?

Accepted Answer

roles/pubsub.subscriber. The Cloud Run service needs only the ability to pull (subscribe to) messages from the Pub/Sub topic. The `roles/pubsub.subscriber` role grants the `pubsub.subscriptions.consume` and `pubsub.subscriptions.get` permissions required to read messages, and when applied at the topic resource level (as implied by the option), it allows the service account to create and manage a subscription on that topic. This is the least privileged role that enables the read operation without granting unnecessary permissions like publishing or viewing all topics.

Answer

roles/pubsub.subscriber on the topic resource

Answer

roles/pubsub.viewer

Answer

roles/pubsub.publisher

Question 15

Which method ensures that Cloud Storage logs are encrypted with a key that is managed on-premises?

Accepted Answer

Cloud External Key Manager. Cloud External Key Manager (Cloud EKM) allows you to use an external key management system, such as one running on-premises, to manage encryption keys for Cloud Storage. This ensures that the keys used to encrypt your data are never stored in Google Cloud, meeting the requirement of on-premises key management.

Answer

CMEK

Answer

CSEK

Answer

Default encryption