PCSE Practice Test 33 — 15 Questions

Question 1

A company has two Google Cloud projects: Project A (production) and Project B (development). They want to allow a service account in Project B to list Compute Engine instances in Project A. What is the most secure way to grant this access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add the service account as a member in Project A's IAM policy with the roles/compute.viewer role.. It uses IAM to grant the service account from Project B the roles/compute.viewer role on Project A, which allows it to list Compute Engine instances without sharing keys or granting excessive permissions. This follows the principle of least privilege and avoids the security risks of key management.

Answer

Create a new service account in Project A, generate a key, and share it with the application in Project B.

Answer

Make the service account a project owner of Project A.

Answer

Export the service account key from Project B and use it in an application in Project A.

Question 2

A security engineer runs the command in the exhibit. The command fails with an error: 'Permission denied: cryptoKeyVersions.encrypt'. What is the most likely cause?

Accepted Answer

The user does not have the cloudkms.cryptoKeyVersions.encrypt permission on the key.. The error message 'Permission denied: cryptoKeyVersions.encrypt' explicitly indicates that the user lacks the cloudkms.cryptoKeyVersions.encrypt permission on the specific key version. In Google Cloud KMS, encrypt operations require the cloudkms.cryptoKeyVersions.encrypt permission (or a broader role like roles/cloudkms.cryptoKeyEncrypter) on the key resource. The command itself is syntactically correct, so the failure is due to insufficient IAM permissions, not resource existence or location.

Answer

The key ring 'my-keyring' does not exist.

Answer

The key ring location is incorrect.

Answer

The user does not have the cloudkms.cryptoKeyVersions.decrypt permission.

Question 3

An application needs to authenticate to Google Cloud APIs from an on-premises server. Which approach is recommended for long-lived access?

Accepted Answer

Create a service account key and store it securely on the server.. Service account keys provide a long-lived, static credential that can be securely stored on an on-premises server for authenticating to Google Cloud APIs. Unlike user accounts or OAuth flows, service account keys do not require interactive login or token refresh, making them suitable for automated, long-running workloads.

Answer

Use a user account with OAuth 2.0 tokens.

Answer

Use workload identity federation with an on-premises identity provider.

Answer

Use API keys.

Question 4

Drag and drop the steps to set up Cloud Armor with a WAF rule in the correct order.

Accepted Answer

1. Create a Cloud Armor security policy. 2. Add WAF rules to the policy. 3. Attach the policy to a backend service. 4. Enable logging for the policy. 5. Test the policy.. Cloud Armor configuration involves creating the policy, defining rules, attaching to a backend, enabling logging, and testing.

Answer

1. Create a Cloud Armor security policy. 2. Attach the policy to a backend service. 3. Add WAF rules to the policy. 4. Enable logging for the policy. 5. Test the policy.

Answer

1. Add WAF rules to the policy. 2. Create a Cloud Armor security policy. 3. Attach the policy to a backend service. 4. Enable logging for the policy. 5. Test the policy.

Answer

1. Create a Cloud Armor security policy. 2. Enable logging for the policy. 3. Add WAF rules to the policy. 4. Attach the policy to a backend service. 5. Test the policy.

Question 5

A company uses hierarchical firewall policies to enforce security across all VPC networks in an organization. They have an organization policy that denies egress traffic to the internet. However, a team needs to allow outbound HTTPS traffic to a specific external API (api.example.com) for a project. What is the best way to achieve this?

Accepted Answer

Create a new hierarchical firewall policy rule that allows egress to the IP range of api.example.com with a higher priority than the deny rule.. Hierarchical firewall policies allow you to enforce organization-wide rules while still permitting exceptions via higher-priority rules. By creating a new rule that allows egress to the IP range of api.example.com with a priority higher than the deny rule, you override the deny for that specific traffic. This approach maintains the organization's security posture while enabling the required outbound HTTPS access.

Answer

Configure Cloud NAT with a static IP and allow that IP in the org policy.

Answer

Remove the organization policy and rely on VPC firewall rules.

Answer

Use VPC Service Controls to allow access to the API.

Question 6

A company is moving sensitive data to Google Cloud and must comply with GDPR data minimization principles. They want to ensure that only the minimum necessary data is collected and processed. Which Google Cloud service should they use to automatically identify and redact sensitive data before storage?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud Data Loss Prevention (DLP) is the correct service because it provides native capabilities to inspect, classify, and automatically redact sensitive data (e.g., PII, credit card numbers) before storage, directly supporting GDPR data minimization. It uses built-in infoType detectors and can be integrated with Cloud Storage, BigQuery, and other services to apply de-identification transformations such as masking, tokenization, or deletion at ingestion time.

Answer

Cloud Composer

Answer

Cloud Data Fusion

Answer

Cloud Dataprep

Question 7

Match each Google Cloud logging/monitoring term to its definition.

Accepted Answer

Log bucket: A storage location for log entries. Log buckets store logs, log sinks route logs, log-based metrics derive metrics from logs, and log entries are individual records. Common confusions include mixing sinks with metrics and buckets with queries.

Answer

Log bucket: A query to filter log entries

Answer

Log sink: A metric derived from log data

Question 8

A company uses Forseti Security to monitor their GCP environment for compliance violations. They want to automatically enforce policies that prevent the deployment of resources without required labels. What should they do?

Accepted Answer

Use Forseti Config Validator with a deny policy that blocks creation of resources without required labels. Forseti Config Validator can enforce policies at deployment time by using a deny policy that blocks resource creation if required labels are missing. This is the correct approach because it prevents non-compliant resources from being created in the first place, rather than detecting and remediating them after the fact.

Answer

Configure Forseti Inventory to scan and report resources missing labels, then manually delete them

Answer

Enable VPC Service Controls to restrict projects without labels from accessing resources

Answer

Use Cloud Asset Inventory to trigger Cloud Functions that delete resources missing labels

Question 9

A company is deploying a new application that will process credit card data and must comply with PCI DSS. They plan to use Google Cloud services. Which service should they use to detect and redact sensitive data stored in Cloud Storage buckets?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud Data Loss Prevention (DLP) is the correct service because it is specifically designed to inspect, classify, and redact sensitive data such as credit card numbers (PANs) in Cloud Storage buckets. It uses built-in infoType detectors (e.g., `CREDIT_CARD_NUMBER`) to identify PCI DSS-protected data and can automatically apply de-identification transformations like redaction or masking to comply with PCI DSS requirements.

Answer

Cloud Key Management Service (KMS)

Answer

VPC Service Controls

Answer

Cloud Audit Logs

Question 10

A financial services company is deploying a multi-region application on Google Kubernetes Engine (GKE) and needs to comply with PCI DSS. They must ensure that cardholder data is encrypted in transit between pods in different clusters. What is the MOST secure way to achieve this?

Accepted Answer

Enable Anthos Service Mesh with mutual TLS (mTLS) across clusters.. Anthos Service Mesh with mutual TLS (mTLS) provides authenticated and encrypted communication between pods across different GKE clusters, meeting PCI DSS encryption-in-transit requirements. mTLS ensures that each side of the connection presents a certificate, verifying identity and encrypting traffic at the application layer, which is more secure than relying solely on network-level encryption. This approach also integrates with GKE's multi-cluster service mesh capabilities, allowing fine-grained policy enforcement across clusters.

Answer

Configure TLS for each service using a Cloud Load Balancing with SSL policies.

Answer

Use HTTPS between services by configuring ingress with a Google-managed SSL certificate.

Answer

Use VPC Network Peering to connect the clusters and rely on the internal network encryption.

Question 11

For PCI DSS compliance, which of the following is required for Cloud KMS keys?

Accepted Answer

Enable automatic rotation with a rotation period set to 90 days. PCI DSS requirement 3.5.1 mandates that cryptographic keys must be rotated at least every 90 days to limit the impact of a potential key compromise. For Cloud KMS, enabling automatic rotation with a rotation period of 90 days ensures compliance by automating the key rotation process without manual intervention, reducing the risk of human error.

Answer

Use a separate key per service account

Answer

Disable key rotation after initial use

Answer

Key rotation every 30 days

Question 12

A company uses Cloud Storage with CMEK. The Cloud KMS key is disabled accidentally by an administrator. What will happen to existing objects encrypted with that key?

Accepted Answer

Objects become inaccessible immediately.. When a Cloud KMS key used for CMEK is disabled, Cloud Storage immediately loses the ability to decrypt the encrypted object data and its associated metadata. Without the key, the service cannot serve the object, making it inaccessible for read, write, or delete operations until the key is re-enabled. This is because CMEK objects are encrypted at rest using the customer-managed key, and Cloud Storage does not maintain a cached copy of the key material.

Answer

Objects are automatically re-encrypted with Google-managed keys.

Answer

Objects remain accessible until the key is destroyed.

Answer

Objects become inaccessible after a 24-hour grace period.

Question 13

A company has two VPC networks in the same project: VPC-A (10.0.0.0/16) and VPC-B (172.16.0.0/16). They have established VPC peering between them. An instance in VPC-A needs to communicate with an instance in VPC-B on TCP port 443. What is the minimal firewall configuration needed?

Accepted Answer

Add an ingress firewall rule in VPC-B allowing traffic from 10.0.0.0/16 on port 443.. VPC peering does not automatically allow traffic; firewall rules must explicitly permit the desired communication. Since the instance in VPC-A initiates the connection to VPC-B, VPC-B's firewall must have an ingress rule allowing traffic from VPC-A's CIDR (10.0.0.0/16) on TCP port 443. This is the minimal configuration because egress rules in VPC-A are implicitly permissive by default in Google Cloud, and only the destination VPC's ingress needs to be opened.

Answer

Add an ingress firewall rule in VPC-A allowing traffic from 172.16.0.0/16 on port 443.

Answer

Add a single firewall rule in the project with source 10.0.0.0/16 and destination 172.16.0.0/16 on port 443.

Answer

Add an egress firewall rule in VPC-A allowing traffic to 172.16.0.0/16 on port 443.

Question 14

Refer to the exhibit. A compliance officer sees this Organization Policy applied at the organization level. Which compliance requirement does this policy primarily address?

Accepted Answer

Data residency. The Organization Policy shown restricts the allowed locations for Compute Engine resources to a specific region (e.g., us-central1). This directly enforces data residency requirements by preventing resources from being created or moved outside of approved geographic boundaries, ensuring that data remains within a particular jurisdiction to comply with regulations like GDPR or HIPAA.

Answer

Encryption key management

Answer

Audit logging

Answer

Access control

Question 15

A company stores sensitive customer data in Cloud Storage. They want to ensure that only users with explicit IAM permissions can decrypt the data, and that Google does not have access to the encryption keys. Which encryption option should they use?

Accepted Answer

Customer-supplied encryption keys (CSEK). Customer-supplied encryption keys (CSEK) allow you to provide your own encryption keys, which are used to protect data at rest in Cloud Storage. Google does not store these keys on its servers; they are used only transiently during encryption/decryption operations and then discarded, ensuring that Google cannot access the keys or the decrypted data. This meets the requirement that only users with explicit IAM permissions can decrypt the data, as access to the CSEK must be granted through IAM roles like Storage Object Viewer with the CSEK key.

Answer

Customer-managed encryption keys (CMEK)

Answer

Google-managed encryption keys (GMEK)

Answer

Default encryption