PCSE Practice Test 34 — 15 Questions

Question 1

A company is using Cloud Monitoring to track latency of a microservice. They notice a sudden spike in the 99th percentile latency but no change in request count. What is the most likely cause?

Accepted Answer

A single slow query to a backend database. A spike in the 99th percentile latency with unchanged request count points to a small number of requests becoming much slower, not a systemic load increase. A single slow backend database query fits perfectly: it affects only the requests hitting that query, dragging the tail latency (p99) up while overall throughput stays flat. This is the classic tail-latency signature of a slow dependency rather than a traffic or availability event.

Answer

A pod restart in GKE

Answer

A misconfigured health check causing 503s

Answer

A DDoS attack

Question 2

An organization wants to use a FIPS 140-2 Level 3 validated hardware security module (HSM) to protect encryption keys in Cloud KMS. Which key protection level should they choose when creating a key ring?

Accepted Answer

hsm. In Cloud KMS, the 'hsm' protection level uses a FIPS 140-2 Level 3 validated hardware security module to protect key material, which is exactly what the organization requires. The 'software' and 'cloud' levels use software-based key protection, and 'external' refers to keys managed outside Google Cloud. Therefore, 'hsm' is the correct choice.

Answer

software

Answer

cloud

Answer

external

Question 3

A company runs a Cloud SQL for PostgreSQL instance that stores customer data. They must encrypt the database at rest using customer-managed encryption keys (CMEK) to meet regulatory requirements. The instance is currently using Google-managed encryption. What must they do to implement CMEK? The company wants to minimize downtime and avoid data loss.

Accepted Answer

Create a new Cloud SQL instance with CMEK enabled, then export data from the old instance and import into the new one.. Cloud SQL does not support enabling CMEK on an existing instance; you must create a new instance with CMEK enabled at provisioning time. Exporting data from the old instance and importing it into the new one ensures the database is re-encrypted under the customer-managed key with minimal downtime and no data loss, as the export/import process preserves the data.

Answer

Use the gcloud command to update the existing instance to use CMEK by specifying the key.

Answer

Configure Cloud External Key Manager (EKM) and attach it to the existing instance via a patch operation.

Answer

Implement client-side encryption in the application using a library like Tink and store the encrypted data in the existing database.

Question 4

An organization uses Cloud Identity-Aware Proxy (IAP) to secure access to an internal web application running on Compute Engine. Users are authenticated with Google accounts. Recently, some users report being denied access even though they are in the correct IAP-secured Web App User group. What is the most likely cause?

Accepted Answer

An Access Context Manager access level is configured that the users do not satisfy, such as requiring a corporate device.. Cloud IAP can be combined with Access Context Manager (ACM) access levels to enforce contextual requirements beyond group membership, such as device policy, IP range, or user identity attributes. If an access level is configured to require a corporate device and the user's device does not meet that policy, IAP will deny access even if the user is in the correct IAP-secured Web App User group. This explains why users who are correctly placed in the group still receive access denials.

Answer

The users are trying to use IAP TCP forwarding instead of HTTPS.

Answer

The users are not members of the IAP-secured Web App User group.

Answer

The OAuth consent screen requires approval from an admin.

Question 5

Your organization wants to assign a set of permissions to a group of users that allows them to create and delete Compute Engine instances, but not to modify other resources like Cloud Storage buckets. Which type of IAM role should you create?

Accepted Answer

Custom role with only compute.instances.create and compute.instances.delete. Custom IAM roles allow you to curate a specific set of permissions tailored to your needs. Predefined roles like roles/compute.instanceAdmin include broader permissions that may not be desired. Basic roles (Owner, Editor, Viewer) are too broad and should be avoided in production.

Answer

Predefined role (roles/compute.instanceAdmin.v1)

Answer

Basic role (Editor)

Answer

Predefined role (roles/editor)

Question 6

A DevOps engineer needs to allow a CI/CD pipeline running in Google Kubernetes Engine (GKE) to push images to a specific Artifact Registry repository. The pipeline uses a Kubernetes service account. What is the best practice to grant this access without creating a JSON key for a Google service account?

Accepted Answer

Use Workload Identity to bind the KSA to a GSA with the Artifact Registry Writer role. Workload Identity is the GKE-native mechanism that binds a Kubernetes service account (KSA) to a Google service account (GSA) via IAM, allowing pods to obtain GSA credentials without JSON keys. Granting the GSA the Artifact Registry Writer role then lets the pipeline push images using short-lived, automatically rotated tokens. This eliminates long-lived credentials and is Google's recommended best practice for GKE-to-GCP authentication.

Answer

Use a node pool with a service account that has the required roles

Answer

Grant the GSA the IAM role directly on the namespace using RBAC

Answer

Create a JSON key for the GSA, store it as a Kubernetes secret, and mount it into the pod

Question 7

Which TWO are benefits of using Cloud Armor with a global external HTTPS Load Balancer?

Accepted Answer

DDoS protection at the edge. Option D is correct because Cloud Armor is tightly integrated with Google Cloud's global external HTTPS Load Balancer, which terminates traffic at Google's edge points of presence, allowing Cloud Armor to absorb and mitigate volumetric and protocol-based DDoS attacks before they reach backend instances. Option E is correct because Cloud Armor provides preconfigured WAF rules based on the ModSecurity Core Rule Set (e.g., OWASP Top 10 protections like SQL injection and XSS), plus custom rules using security policies and IP/geo-based rules, all enforced at the load balancer edge. Option A is incorrect because content caching is a function of Cloud CDN, not Cloud Armor. Option B is incorrect because latency-based traffic management is a feature of the load balancer's traffic policies (e.g., least-latency routing), not Cloud Armor. Option C is incorrect because load balancing itself is provided by the global external HTTPS Load Balancer, not by Cloud Armor, which is a security service layered on top of it.

Answer

Automatic content caching

Answer

Traffic management based on latency

Answer

Built-in load balancing

Question 8

A security engineer needs to configure Identity-Aware Proxy (IAP) for a web application running on Compute Engine. The goal is to ensure that only authenticated users from the corporate domain can access the application. What is the first step in the configuration?

Accepted Answer

Configure OAuth 2.0 consent screen and create credentials.. Before IAP can be enabled on a backend service, you must configure the OAuth 2.0 consent screen and create OAuth credentials, because IAP uses OAuth to authenticate users. This is the prerequisite step that establishes the identity provider configuration. Only after this can IAP be enabled and roles granted.

Answer

Enable IAP on the backend service of the load balancer.

Answer

Create a firewall rule to allow traffic only from IAP IP ranges.

Answer

Grant the IAP-secured Web App User role to the corporate domain users.

Question 9

A government agency requires that all compute resources for a project are physically located in the United States (US) to comply with FedRAMP. The project contains Compute Engine instances, Cloud Storage buckets, and BigQuery datasets. Which configuration ensures that all future resources are created in the US?

Accepted Answer

Set an Organization Policy on the folder containing the project with constraint constraints/gcp.resourceLocations set to allowedLocations list of US regions.. The Organization Policy constraint `constraints/gcp.resourceLocations` enforces that all future resources in the project (Compute Engine instances, Cloud Storage buckets, BigQuery datasets) are created only in the allowed US regions. This policy is evaluated at resource creation time and prevents any resource from being provisioned outside the specified locations, directly meeting the FedRAMP requirement for physical location in the US.

Answer

Configure VPC Service Controls with a perimeter that only allows access from US-based IP addresses.

Answer

Assign the Compute Admin role to a security admin and restrict them to only create resources in US regions.

Answer

Use Cloud KMS with a key from a US-based location and require that all resources use that key.

Question 10

Refer to the exhibit. A security engineer is reviewing a Cloud KMS key. What can be concluded about this key?

Accepted Answer

This key is stored in a Hardware Security Module (HSM) and cannot be exported.. The exhibit shows a Cloud KMS key with the purpose 'symmetric encryption' and the protection level 'HSM'. Keys with HSM protection level are stored in a Hardware Security Module, which provides tamper-resistant hardware-based key storage. Additionally, the key is marked as 'Cannot be exported', meaning the key material never leaves the HSM boundary, ensuring it cannot be extracted or copied. This matches the description of a key stored in an HSM that cannot be exported.

Answer

This key is a customer-managed encryption key (CMEK) but is stored in software.

Answer

This key is an external key managed via Cloud EKM.

Answer

This is a software key managed by Cloud KMS.

Question 11

An organization wants to enforce that all Cloud Storage buckets are created with uniform bucket-level access enabled. Which policy can be used to achieve this?

Accepted Answer

Organization policy with constraint `constraints/storage.uniformBucketLevelAccess`. The Organization Policy with the constraint `constraints/storage.uniformBucketLevelAccess` is a native Google Cloud policy that can be applied at the organization, folder, or project level to enforce that all new Cloud Storage buckets are created with uniform bucket-level access enabled. This policy prevents the creation of buckets with fine-grained ACLs, ensuring consistent access control across the organization.

Answer

Audit logs to detect non-compliance

Answer

VPC Service Controls perimeter

Answer

IAM custom role with permission to enforce uniform access

Question 12

Which Google Cloud service provides near-real-time logs when Google administrators access your customer content?

Accepted Answer

Access Transparency. Access Transparency logs provide detailed information about actions taken by Google staff when accessing customer data. Access Approval is a separate feature that requires approval before access. Audit Logs is a broader category. Cloud DLP is for data loss prevention.

Answer

Access Approval

Answer

Cloud DLP

Answer

Cloud Audit Logs

Question 13

A financial services company uses Security Command Center (SCC) Premium tier to monitor its GCP environment. The security team wants to automatically respond to high-severity threat findings, such as 'Cryptomining' from Event Threat Detection. The response should include isolating the affected VM by removing its external IP and applying a firewall rule to block egress traffic. Which two steps should the team implement? (Choose two.)

Accepted Answer

Deploy a Cloud Function that listens on the Pub/Sub topic and uses Compute Engine API to modify the VM's network tags and update firewall rules. Option E is correct because SCC Premium can export findings to Pub/Sub via a NotificationConfig, which is the supported event-driven mechanism for triggering automated responses to findings like Event Threat Detection's Cryptomining. Option A is correct because a Cloud Function subscribed to that Pub/Sub topic can call the Compute Engine API to remove the VM's external IP (e.g., deleting the accessConfig) and modify network tags or firewall rules to block egress, achieving the required isolation. Option B is wrong because Security Health Analytics performs posture/misconfiguration scanning, not automated threat response. Option C is wrong because exporting Admin Activity logs to BigQuery is for auditing and analysis, not real-time remediation. Option D is wrong because VPC Flow Logs only provide network telemetry and cannot isolate a VM or block traffic.

Answer

Create a Security Health Analytics scan to detect similar threats

Answer

Set up a log sink to export Admin Activity logs to BigQuery

Answer

Enable VPC Flow Logs for the affected VM's subnet

Question 14

A DevOps team wants to grant a CI/CD pipeline (running on a Compute Engine VM) the ability to restart Compute Engine instances in a specific project. The VM has a service account attached. What is the best practice to grant this permission?

Accepted Answer

Create a custom role with compute.instances.stop and compute.instances.start permissions, and assign it to the service account at the project level.. The best practice is to create a custom role with only the required permissions (compute.instances.stop and compute.instances.start) and assign it to the service account.

Answer

Generate a service account key and use it in the CI/CD system to authenticate.

Answer

Grant the VM's service account the roles/iam.serviceAccountUser role so it can impersonate another service account that has Compute Admin.

Answer

Grant the service account the Compute Admin role (roles/compute.admin) at the project level.

Question 15

Refer to the exhibit. A company configured this VPC Service Controls perimeter for a PCI DSS project. The compliance auditor notes that BigQuery data can be accessed from outside the perimeter. Which change must be made to restrict access to BigQuery?

Accepted Answer

Set the perimeter enforcement mode to enforced instead of dry run. The dry run mode logs violations but does not enforce restrictions, allowing BigQuery data to be accessed from outside the perimeter. Changing the enforcement mode to 'enforced' activates the VPC Service Controls policies, blocking all out-of-perimeter access to the configured services. This directly addresses the auditor's finding by ensuring that only requests from within the perimeter are allowed.

Answer

Add storage.googleapis.com to restrictedServices

Answer

Move BigQuery to a separate perimeter

Answer

Add allUsers to the perimeter's access levels