PCSE Practice Test 33 — 15 Questions

Question 1

A company notices that some Compute Engine instances are making unexpected outbound connections to suspicious IP addresses. They want to investigate the traffic patterns and identify the source of these connections. Which tool should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about network traffic to and from Compute Engine instances, including source/destination IPs, ports, and protocols. By analyzing these logs, the company can identify the specific instances making unexpected outbound connections to suspicious IP addresses, enabling investigation of traffic patterns.

Answer

Cloud Armor

Answer

Cloud IAM

Answer

Firewall Rules Insights

Question 2

An organization uses Cloud DLP to inspect BigQuery tables for sensitive data. They want to automatically remove credit card numbers before the data is accessed by analysts but still allow the raw data for auditing purposes. Which DLP technique should they use?

Accepted Answer

De-identification transform with redact. The 'De-identification transform with redact' completely removes sensitive data (like credit card numbers) from the output, ensuring analysts never see the raw values while the original data remains intact in the source BigQuery table for auditing. This aligns with the requirement to automatically strip sensitive content before access, without altering the stored data.

Answer

De-identification transform with masking

Answer

Re-identification transform with tokenization

Answer

De-identification transform with replacement

Question 3

A company handles Controlled Unclassified Information (CUI) and needs to deploy a workload that complies with ITAR (International Traffic in Arms Regulations). They plan to use Assured Workloads. Which compliance regime should they select when creating the Assured Workloads folder?

Accepted Answer

ITAR. Assured Workloads provides a specific ITAR compliance regime designed for workloads handling International Traffic in Arms Regulations data, including CUI. Selecting ITAR enforces data residency in the US and restricts access to US persons, which is required for ITAR compliance.

Answer

FEDRAMP_HIGH

Answer

CJIS

Answer

IL4

Question 4

Which Cloud DLP transform should be used to replace sensitive data with a token that preserves the format and length of the original data for reversible de-identification?

Accepted Answer

CryptoReplaceFfxFpeConfig. CryptoReplaceFfxFpeConfig is a Cloud DLP transform that uses format-preserving encryption (FPE) with the FFX mode to replace sensitive data with a token that maintains the original format and length, and it is reversible if you have the crypto key. This matches the requirement for reversible de-identification that preserves format and length.

Answer

DateShiftConfig

Answer

MaskingConfig

Answer

BucketingConfig

Question 5

A junior developer created a service account with the roles/storage.admin role and downloaded a JSON key. What is the best practice to improve security?

Accepted Answer

Delete the key and use workload identity federation.. Long-lived JSON service account keys are a persistent credential that, if leaked, grants the bearer the full storage.admin role until manually revoked. Workload identity federation eliminates the key entirely by letting workloads exchange short-lived OIDC tokens from an external IdP (AWS, Azure, GitHub, Kubernetes) for temporary GCP access tokens. This removes the static secret from the attack surface and is Google's recommended best practice for any non-human identity.

Answer

Rotate the key every 30 days.

Answer

Use a user-managed service account instead.

Answer

Restrict the key's usage with IP allowlists.

Question 6

A company using Google Cloud wants to conduct a penetration test on their infrastructure. According to Google's acceptable use policy, what must they do before testing?

Accepted Answer

Ensure that the tests do not include Denial of Service (DoS) attacks. Google's policy allows penetration testing on most services without prior approval, as long as the tests are not Denial of Service (DoS) attacks. This applies to common GCP services like Compute Engine, GKE, and Cloud Functions.

Answer

Create a separate VPC network for testing

Answer

Submit a request to Google support for each test

Answer

Enable VPC Flow Logs for monitoring

Question 7

An organization uses Cloud Identity with a third-party IdP via SAML 2.0. A security engineer needs to enforce that all Google Cloud access requires multi-factor authentication (MFA) from the IdP. What is the recommended approach?

Accepted Answer

Require MFA in the third-party IdP before it issues SAML assertions.. When Cloud Identity federates with a third-party IdP via SAML 2.0, authentication and MFA are enforced at the IdP before it issues the SAML assertion. Google Cloud trusts that assertion, so the only reliable way to guarantee MFA for all Google Cloud access is to require MFA in the third-party IdP itself. This keeps enforcement at the authoritative authentication source.

Answer

Create an organization policy constraint requiring the use of security keys for all users.

Answer

Enable MFA enforcement in the Cloud Identity admin console for all users.

Answer

Configure a context-aware access level in Access Context Manager that requires MFA, and apply it to Google Cloud resources.

Question 8

A company wants to allow their employees to access an internal web application running on Compute Engine using Identity-Aware Proxy (IAP). They want to ensure that only users from their corporate domain (example.com) can access the app. What is the recommended approach?

Accepted Answer

Create a Cloud Identity group containing all corporate users, and grant the IAP-secured Web App User role to that group.. Identity-Aware Proxy (IAP) uses Cloud Identity groups to manage access at scale. By creating a group containing all corporate users (e.g., from example.com) and granting the IAP-secured Web App User role to that group, you enforce domain-level access without managing individual users. This approach leverages IAP's integration with Cloud Identity to verify the user's email domain against the group membership, ensuring only example.com users can reach the application.

Answer

Grant the IAP-secured Web App User role to each individual user from the corporate domain.

Answer

Use a custom SAML attribute in the IdP to filter access.

Answer

Configure a firewall rule that allows traffic only from the corporate IP range.

Question 9

A company must ensure that only authorized users can access sensitive data in Cloud Storage for PCI DSS compliance. They have configured a bucket with uniform bucket-level access. Which IAM policy should they use to grant access to a security team?

Accepted Answer

Bind the security team to roles/storage.objectViewer at the bucket level.. With uniform bucket-level access enabled, IAM policies are the only way to grant access — ACLs are disabled. Binding the security team to roles/storage.objectViewer at the bucket level grants read-only access to objects in that bucket, which is the least-privilege approach for a security team needing to view sensitive data for compliance. This satisfies PCI DSS's requirement for authorized access control.

Answer

Bind the security team to roles/storage.legacyBucketReader at the bucket level.

Answer

Use ACLs to give the security team READ access to the bucket.

Answer

Bind the security team to roles/storage.admin at the project level.

Question 10

A company uses multiple GCP projects and wants to allow a service account from Project A to initiate Dataflow jobs in Project B. The service account in Project A has the Dataflow Developer role at the organization level. However, it fails with permission denied when trying to submit a job to Project B. What is the most likely issue?

Accepted Answer

The service account needs the Service Account User role on the Dataflow service account in Project B.. The service account from Project A has the Dataflow Developer role at the organization level, which grants permissions to create Dataflow jobs, but it still needs the Service Account User role (roles/iam.serviceAccountUser) on the Dataflow service account in Project B. When a Dataflow job is submitted, the job runs as a service account in the target project (Project B), and the caller must have the iam.serviceAccounts.actAs permission on that service account. Without this role, the API call fails with a permission denied error even though the Dataflow Developer role is present.

Answer

The organization policy restricts cross-project access.

Answer

The service account does not have permission to create Dataflow jobs in Project B because it is not a member of Project B.

Answer

The Dataflow API is not enabled in Project B.

Question 11

A company wants to allow an application running on an on-premises server to access Cloud Storage without using long-lived service account keys. The on-premises environment uses Azure Active Directory (Azure AD) as its identity provider. Which GCP feature should they use?

Accepted Answer

Workload Identity Federation with Azure AD as an identity provider.. Workload Identity Federation allows on-premises workloads to access GCP resources without service account keys by using an external identity provider (IdP) such as Microsoft Entra ID. The application can exchange its Microsoft Entra ID token for a short-lived GCP access token via Security Token Service (STS), eliminating the need for long-lived credentials. This is the recommended approach for hybrid and multi-cloud scenarios.

Answer

Service Account Key rotation policy.

Answer

Create a custom OAuth 2.0 client ID for the application.

Answer

Use a VPN between on-premises and GCP, and allow the on-premises server to use a metadata server.

Question 12

A security engineer needs to configure Cloud KMS key rotation so that existing ciphertext can still be decrypted with old key versions, but new encryption uses the latest version. Which key management practice meets this requirement?

Accepted Answer

Set a rotation period on the key; Cloud KMS automatically creates new versions while old versions remain available for decryption.. Cloud KMS supports key rotation by creating new key versions while retaining all previous versions. When you set a rotation period, Cloud KMS automatically generates a new version at the specified interval, and the key's primary version (used for new encryption) is updated. Old key versions remain enabled and available for decryption of existing ciphertext, ensuring that data encrypted with older versions can still be decrypted without manual intervention.

Answer

Use a single key and manually update its material every 90 days.

Answer

Create a new key version manually and disable the previous version after a grace period.

Answer

Create a new key every rotation and delete the old key after confirming re-encryption.

Question 13

A company needs to meet a regulatory requirement that cryptographic keys for data at rest in Google Cloud must be managed in an on-premises HSM and never leave the HSM. Google Cloud services should be able to use those keys for encryption/decryption. Which solution should they implement?

Accepted Answer

Use Cloud External Key Manager (EKM) to connect to the on-premises HSM.. Cloud External Key Manager (EKM) allows you to use keys managed in a supported external key management system, such as an on-premises HSM, for Google Cloud services. The keys are used by Google Cloud for encryption and decryption but never leave the external HSM, satisfying the regulatory requirement that keys must remain on-premises.

Answer

Use Cloud HSM to protect keys imported from on-premises HSM.

Answer

Use Cloud KMS with automatic key rotation and store key versions on-premises.

Answer

Use customer-supplied encryption keys (CSEK) for each service.

Question 14

A healthcare organization is deploying a new application on Google Cloud that will process protected health information (PHI) subject to HIPAA. The security team has enabled encryption at rest using Google-managed keys and configured Cloud Audit Logs. During a compliance review, the auditor notes that the organization has not yet signed a Business Associate Agreement (BAA) with Google Cloud. What should the organization do to remediate this issue?

Accepted Answer

Sign a BAA with Google Cloud through the Google Cloud Console or by contacting Google Cloud Support.. Under HIPAA, a covered entity or business associate must have a signed Business Associate Agreement (BAA) with any service provider that creates, receives, maintains, or transmits protected health information (PHI) on its behalf. Google Cloud offers a standard BAA that customers must accept through the Google Cloud Console or by contacting support; encryption at rest and audit logs are separate technical controls that do not satisfy this contractual requirement. Option C is correct because signing a BAA is the only direct way to establish the legally required business associate relationship with Google Cloud for PHI processing.

Answer

Enable VPC Service Controls to satisfy HIPAA requirements without a BAA.

Answer

Use Customer-Managed Encryption Keys (CMEK) to meet the requirement for a signed BAA.

Answer

Configure Access Transparency logs as a substitute for a BAA.

Question 15

You are a security engineer for a startup that uses Google Workspace and Google Cloud. You have been asked to allow a contractor, who has a Google account (contractor@example.com), to manage Cloud Storage buckets in a specific project. The contractor should not have access to any other resources. You create a custom role with the necessary permissions and grant it to the user at the project level. However, the contractor reports that they cannot see the project in the Cloud Console. What is the most likely reason?

Accepted Answer

The custom role does not include the 'resourcemanager.projects.get' permission, which is required to view the project in the console.. The Cloud Console requires the 'resourcemanager.projects.get' permission to list and display projects. Even though the custom role grants permissions to manage Cloud Storage buckets, without this specific permission, the contractor cannot see the project in the console. Granting the permission at the project level allows the user to view the project in the console while still restricting access to other resources.

Answer

The contractor's Google account is not in the same domain as the Google Cloud organization.

Answer

The contractor needs to sign in using a different authentication method, such as SAML.

Answer

An organization policy denies access to the project for external users.