PCSE Practice Test 34 — 15 Questions

Question 1

A company has a VPC with two subnets: subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). They have a firewall appliance (internal IP 10.0.1.100) that inspects all traffic between subnets. They configure a policy-based route to redirect traffic from subnet-a to subnet-b to the appliance. However, traffic from subnet-a to subnet-b still goes directly. What is missing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A VPC route with priority 1000 (direct routing between subnets) is overriding the policy-based route with a lower priority.. B is correct because VPCs have an implicit default route for subnet-to-subnet traffic with a priority of 1000, which is higher than the priority of a policy-based route (typically 2000). Since the policy-based route has a lower priority (higher numerical value), the default route takes precedence, causing traffic to bypass the firewall appliance. To override this, the policy-based route must have a priority lower than 1000 (e.g., 500) to be preferred.

Answer

Compute Engine instances must have a custom route table to use policy-based routes.

Answer

A firewall rule is required to allow traffic to be redirected to the appliance.

Answer

The policy-based route must have the next hop IP set to the appliance's external IP.

Question 2

Drag and drop the steps to set up IAM conditions for a service account in the correct order.

Accepted Answer

Identify the scope, then write the condition, then bind the condition to the policy, then attach the policy, then test.. IAM conditions involve identifying the scope, writing the condition, binding it, attaching the policy, and testing.

Answer

Write the condition, then identify the scope, then bind the condition to the policy, then attach the policy, then test.

Answer

Identify the scope, then write the condition, then attach the policy, then bind the condition to the policy, then test.

Answer

Identify the scope, then write the condition, then test, then bind the condition to the policy, then attach the policy.

Question 3

A company has configured a VPC firewall rule to allow HTTP traffic from a specific source IP range 203.0.113.0/24. However, HTTP requests from that range are being denied. Which initial verification should the security engineer perform?

Accepted Answer

Check the rule direction (ingress vs egress). The rule is configured to allow HTTP traffic, but if the rule direction is set to egress instead of ingress, it will not apply to incoming HTTP requests from the source IP range. In Google Cloud VPC firewall rules, direction determines whether the rule applies to inbound (ingress) or outbound (egress) traffic; an egress rule only controls traffic leaving the VPC network, so HTTP requests arriving from the internet would be denied by the implied deny ingress rule.

Answer

Check if the source range overlaps with a deny rule

Answer

Check if the target instances have the correct network tag

Answer

Check the rule priority

Question 4

Which TWO actions are required to meet FedRAMP Moderate baseline for Google Cloud?

Accepted Answer

Enable Multi-Factor Authentication (MFA) for all Google Cloud users with access to the project.. FedRAMP Moderate requires multi-factor authentication (MFA) for all users accessing the system, including Google Cloud users. Enabling MFA for all users with access to the project satisfies this control by adding an additional authentication factor beyond a password, as mandated by NIST SP 800-53 IA-2. Option C is correct because FedRAMP Moderate requires encryption at rest for all data, and using Customer-Managed Encryption Keys (CMEK) or Google-managed keys meets this requirement under NIST SP 800-53 SC-28.

Answer

Use Customer-Supplied Encryption Keys (CSEK) for all Cloud Storage buckets.

Answer

Enable Data Access audit logs for all Google Cloud services in the project.

Answer

Create VPC Service Controls perimeters to restrict data exfiltration.

Question 5

A company wants to use Cloud CDN to cache content from an HTTP Load Balancer. They have a custom domain and want to serve traffic over HTTPS. What must they configure on the load balancer?

Accepted Answer

Create an SSL certificate resource and attach it to the HTTPS target proxy.. To serve HTTPS traffic with Cloud CDN and a custom domain, the load balancer must have an SSL certificate attached to its HTTPS target proxy. This is because Cloud CDN relies on the load balancer's target proxy to terminate TLS and present the certificate to clients. Creating an SSL certificate resource (either Google-managed or self-managed) and attaching it to the HTTPS target proxy is the required step.

Answer

Set up a backend bucket with a public certificate.

Answer

Upload a custom SSL certificate directly to the Cloud CDN configuration.

Answer

Enable HTTP to HTTPS redirect on the load balancer.

Question 6

A government agency requires that all compute resources for a project are physically located in the United States (US) to comply with FedRAMP. The project contains Compute Engine instances, Cloud Storage buckets, and BigQuery datasets. Which configuration ensures that all future resources are created in the US?

Accepted Answer

Set an Organization Policy on the folder containing the project with constraint constraints/gcp.resourceLocations set to allowedLocations list of US regions.. The Organization Policy constraint `constraints/gcp.resourceLocations` enforces that all future resources in the project (Compute Engine instances, Cloud Storage buckets, BigQuery datasets) are created only in the allowed US regions. This policy is evaluated at resource creation time and prevents any resource from being provisioned outside the specified locations, directly meeting the FedRAMP requirement for physical location in the US.

Answer

Configure VPC Service Controls with a perimeter that only allows access from US-based IP addresses.

Answer

Assign the Compute Admin role to a security admin and restrict them to only create resources in US regions.

Answer

Use Cloud KMS with a key from a US-based location and require that all resources use that key.

Question 7

Refer to the exhibit. A company configured this VPC Service Controls perimeter for a PCI DSS project. The compliance auditor notes that BigQuery data can be accessed from outside the perimeter. Which change must be made to restrict access to BigQuery?

Accepted Answer

Set the perimeter enforcement mode to enforced instead of dry run. The dry run mode logs violations but does not enforce restrictions, allowing BigQuery data to be accessed from outside the perimeter. Changing the enforcement mode to 'enforced' activates the VPC Service Controls policies, blocking all out-of-perimeter access to the configured services. This directly addresses the auditor's finding by ensuring that only requests from within the perimeter are allowed.

Answer

Add storage.googleapis.com to restrictedServices

Answer

Move BigQuery to a separate perimeter

Answer

Add allUsers to the perimeter's access levels

Question 8

A security engineer is tasked with automating the remediation of non-compliant resources in a Google Cloud organization. The organization uses Organization Policy Service to enforce constraints. The engineer needs to automatically disable a specific service (e.g., Compute Engine API) for a project that violates a policy. Which Google Cloud service should be used to trigger this remediation?

Accepted Answer

Cloud Functions. Cloud Functions is correct because it can be triggered by real-time event notifications (e.g., from Cloud Asset Inventory or Pub/Sub) when a policy violation is detected, and then execute custom code to disable the Compute Engine API via the Service Usage API. This serverless, event-driven model is ideal for automated remediation workflows without managing infrastructure.

Answer

Cloud Build

Answer

Cloud Run

Answer

Cloud Scheduler

Question 9

Refer to the exhibit. A security engineer runs the gcloud command to analyze IAM policy for a user in an organization. The output shows that the user has the 'compute.instances.create' permission via a role at the organization level. However, the user is unable to create Compute Engine instances in a specific project. What is the most likely cause?

Accepted Answer

An organization policy constraint is denying the creation of Compute Engine instances.. Organization policy constraints in Google Cloud can override IAM permissions at any level. Even if the user has the 'compute.instances.create' permission via an organization-level role, an organization policy constraint (e.g., constraints/compute.vmExternalIpAccess or constraints/compute.restrictCreateVM) can explicitly deny the creation of Compute Engine instances in a specific project. This is a common scenario where IAM allows the action, but organization policy blocks it.

Answer

The user does not have the 'compute.instances.create' permission at the project level.

Answer

The user has the permission but through a different role than expected.

Answer

The user's role is not granted at the project level.

Question 10

Which TWO of the following are valid Google Cloud firewall rule components? (Choose TWO.)

Accepted Answer

Priority. A is correct because firewall rules in Google Cloud require a priority value (0–65535) to determine evaluation order. Lower numbers are evaluated first, and the first matching rule is applied. This is a mandatory component of every firewall rule.

Answer

Protocol signature

Answer

Next hop

Answer

Network tier

Question 11

Refer to the exhibit. Based on the exhibit, the corporate security policy requires that all Cloud KMS symmetric keys have automatic rotation enabled. Which statement is true?

Accepted Answer

Only the encryption-key is compliant.. The corporate security policy requires automatic rotation for all Cloud KMS symmetric keys. In the exhibit, the 'encryption-key' has automatic rotation enabled (as indicated by the rotation period being set), while the 'decryption-key' does not have automatic rotation enabled (rotation period is not set or is disabled). Therefore, only the encryption-key is compliant with the policy.

Answer

Both keys are compliant.

Answer

Neither key is compliant.

Answer

Only the decryption-key is compliant.

Question 12

Your organization has a hybrid network with an on-premises data center connected to Google Cloud via a Dedicated Interconnect. The on-premises network uses RFC 1918 addresses (10.0.0.0/8) and Google Cloud VPC has a subnet in 10.1.0.0/16. You've configured a Cloud Router with BGP to exchange routes. Recently, you set up a new VPC with a subnet in 10.2.0.0/16 and peered it with the first VPC using VPC Network Peering. You notice that on-premises traffic destined to 10.2.0.0/16 is being dropped. You verify that the firewall rules allow the traffic and that BGP routes for 10.2.0.0/16 are not advertised on-premises. What should you do to enable connectivity from on-premises to the new VPC?

Accepted Answer

Configure the Cloud Router to advertise the 10.2.0.0/16 range via custom route advertisement.. The Cloud Router uses BGP to advertise routes to the on-premises network via the Dedicated Interconnect. By default, only VPC subnet routes are advertised; custom route advertisements must be explicitly configured to propagate the peered VPC's subnet (10.2.0.0/16) to on-premises. This ensures the on-premises routers learn the route and can forward traffic to the new VPC.

Answer

Set up a Cloud VPN tunnel between the new VPC and on-premises.

Answer

Add a firewall rule in the new VPC allowing all traffic from 10.0.0.0/8.

Answer

Create a Shared VPC and attach the new VPC as a service project.

Question 13

A healthcare startup is using Google Cloud to process Protected Health Information (PHI) for a clinical study. They are HIPAA-compliant and use Cloud Storage with CMEK. They also use BigQuery to run analytics on de-identified data. The security team notices that some PHI data appears in BigQuery query results. Upon investigation, they find that a data engineer created a BigQuery table that directly references the Cloud Storage bucket containing PHI without using the de-identification pipeline. The startup needs to prevent any direct access to Cloud Storage from BigQuery unless it goes through the pipeline. They also need to ensure that any new datasets are automatically subject to the same restrictions. What should they do?

Accepted Answer

Create a VPC Service Control perimeter around the pipeline project, and use an organization policy to require that Cloud Storage buckets be in a perimeter.. VPC Service Controls create a security perimeter around the pipeline project, preventing data exfiltration and unauthorized access to Cloud Storage from BigQuery unless the request originates from within the perimeter. The organization policy requiring Cloud Storage buckets to be in a perimeter ensures that any new datasets are automatically subject to the same restrictions, enforcing the de-identification pipeline as the only allowed path.

Answer

Enable Access Transparency logs and set up alerts for any direct access to Cloud Storage.

Answer

Use DLP API to automatically de-identify data in Cloud Storage before BigQuery reads it.

Answer

Use IAM conditions to restrict access to the Cloud Storage bucket only from the service account used by the pipeline.

Question 14

A pharmaceutical company uses Google Cloud to process clinical trial data subject to HIPAA. They must ensure that only authorized applications can access the data, even if credentials are compromised. Which security control should they implement?

Accepted Answer

Use service account impersonation with IAM conditions to restrict access to specific trusted applications.. Service account impersonation with IAM conditions allows the company to bind access to specific trusted applications by requiring that the caller present a specific service account identity. Even if credentials are compromised, the attacker cannot impersonate that service account unless they also satisfy the IAM conditions (e.g., resource tags, IP ranges, or application identity). This directly addresses the requirement to restrict access to authorized applications only, as per HIPAA's minimum necessary standard.

Answer

Use Workload Identity Federation to allow workloads to access data without service account keys.

Answer

Create a VPC Service Control perimeter that allows only specific service accounts to access the data.

Answer

Require users to MFA and use IAM roles to grant access.

Question 15

A company needs to store PII in Google Cloud and comply with GDPR data residency requirements. What is the primary Google Cloud feature to enforce data residency?

Accepted Answer

VPC Service Controls. VPC Service Controls (option D) is the primary Google Cloud feature to enforce data residency because it allows you to define perimeters that restrict data movement and access to specific Google Cloud services within a chosen region. By creating a VPC Service Controls perimeter, you can prevent data from being copied or accessed outside of the allowed geographic boundaries, directly addressing GDPR data residency requirements. This is achieved through context-aware access policies that block egress of data to unauthorized regions, even if an attacker gains access to a project.

Answer

Organization policies

Answer

Cloud Data Loss Prevention

Answer

Cloud KMS