PCSE Practice Test 35 — 15 Questions

Question 1

A DevOps team wants to grant a contractor temporary access to a specific Cloud Storage bucket for 30 days. The contractor has a Google account (example@gmail.com). The bucket contains sensitive data, and the access should be as restrictive as possible. What is the recommended way to grant this access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add the contractor's email to the bucket-level IAM policy with the 'Storage Object Viewer' role.. Bucket-level IAM policies allow you to grant granular, time-bound access to a specific bucket without affecting other resources in the project. By adding the contractor's email (example@gmail.com) to the bucket-level IAM policy with the 'Storage Object Viewer' role, you restrict access to only that bucket and only to read objects, which is the most restrictive approach for a 30-day temporary access requirement.

Answer

Create a bucket ACL granting the contractor READ access.

Answer

Add the contractor's email to the project-level IAM policy with the 'Storage Object Viewer' role.

Answer

Generate a signed URL for the contractor to access the bucket objects.

Question 2

A new employee needs to be able to create and manage Compute Engine instances. Which role should be granted at the project level?

Accepted Answer

roles/compute.instanceAdmin. The roles/compute.instanceAdmin role grants permissions to create, modify, and delete Compute Engine instances, including starting, stopping, and managing disks and snapshots, but does not allow changing project-wide network configurations or granting IAM policies. This is the least-privilege role that meets the requirement to 'create and manage Compute Engine instances' at the project level.

Answer

roles/compute.admin

Answer

roles/compute.networkAdmin

Answer

roles/compute.viewer

Question 3

An organization wants to allow a group of external auditors read-only access to specific BigQuery datasets in a project, but only during working hours (9 AM to 5 PM). The auditors belong to an external Google Workspace domain. Which IAM configuration should be used?

Accepted Answer

Create a custom role with required permissions on the datasets, grant it to the auditors' group with an IAM condition using request.time between 9 AM and 5 PM.. IAM conditions allow you to enforce time-based access using the `request.time` attribute, which can restrict access to specific hours. By granting a custom role with read-only permissions on the BigQuery datasets and attaching a condition that `request.time` falls between 9 AM and 5 PM, the auditors from the external Google Workspace domain will only have access during working hours. This approach is native to IAM and does not require external automation or network-level controls.

Answer

Configure a Cloud Scheduler job to add and remove the auditors' group membership at the required times.

Answer

Create an Organization Policy with a time constraint on the datasets.

Answer

Use VPC Service Controls with an access level that allows during working hours.

Question 4

Which Security Command Center tier includes Event Threat Detection and Container Threat Detection?

Accepted Answer

Premium tier. Security Command Center Premium tier includes Event Threat Detection and Container Threat Detection, along with other advanced detectors like Security Health Analytics, Web Security Scanner, and sensitive data discovery. These premium-only detectors provide near-real-time threat detection for GCP resources and GKE workloads.

Answer

Standard tier

Answer

Basic tier

Answer

Enterprise tier

Question 5

Which THREE steps are necessary to meet SOC 2 Type II requirements using Google Cloud?

Accepted Answer

Enable Cloud Audit Logs and retain them for at least one year.. Option A is correct because SOC 2 Type II requires demonstrable, continuous evidence of control operation over the audit period, and Cloud Audit Logs (Admin Activity, Data Access, System Event, and Policy Denied logs) provide the tamper-evident activity trail auditors examine; retaining them for at least one year aligns with the typical 12-month observation window and evidence-retention expectations. Option B is correct because the SOC 2 Security (and often Confidentiality) criteria require protecting data during transmission, and enforcing TLS for all in-transit traffic — for example via HTTPS load balancers, TLS on Cloud SQL connections, and rejecting plaintext protocols — is the standard control that satisfies this. Option E is correct because Type II demands ongoing monitoring of controls, and Cloud Monitoring alerting policies (with uptime checks, log-based alerts, and Security Command Center/Cloud Asset Inventory findings) generate the continuous evidence that misconfigurations and security events are detected and remediated during the period. Option C is not correct: consolidating everything into one project is an organizational choice, not a SOC 2 requirement, and it can actually weaken least-privilege and segregation-of-duties controls. Option D is not correct: CMEK is an optional key-management enhancement that supports certain encryption controls, but SOC 2 does not mandate customer-managed keys — Google-managed encryption at rest already satisfies the baseline encryption criterion.

Answer

Use a single Google Cloud project for all data to simplify auditing.

Answer

Use Customer-Managed Encryption Keys (CMEK) for all storage services.

Question 6

A DevOps team is implementing Binary Authorization for a GKE cluster. They want to ensure that only container images signed by a specific attestor can be deployed. They have created the attestor and configured Cloud KMS for signing. Which additional step is required to enforce the policy?

Accepted Answer

Create a Binary Authorization policy that requires at least one attestation and attach it to the GKE cluster.. After creating an attestor and configuring Cloud KMS, the team must create a Binary Authorization policy that requires at least one attestation and attach it to the GKE cluster. This policy enforces that only images with valid attestations from the specified attestor can be deployed.

Answer

Enable the 'gke-binary-authorization' feature flag on the cluster and update the kubeconfig.

Answer

Create a policy that allows all images and then override it with an admission webhook.

Answer

Configure the container registry to block unsigned images by setting a repository-level policy.

Question 7

A company wants to encrypt data at rest in Cloud Storage using their own keys. Which Cloud service should they use to manage these keys?

Accepted Answer

Cloud Key Management Service (Cloud KMS). Cloud Key Management Service (Cloud KMS) is the Google Cloud service designed to manage encryption keys, including customer-managed encryption keys (CMEK). You can use Cloud KMS to create and manage keys that you then use to encrypt data at rest in Cloud Storage, giving you control over the keys. This is the standard way to implement CMEK for Cloud Storage and other services.

Answer

Cloud Data Loss Prevention (Cloud DLP)

Answer

Secret Manager

Answer

Cloud HSM

Question 8

An organization wants to enforce that all container images deployed to a GKE cluster must be signed by an approved authority. They have set up Binary Authorization with a policy that requires attestation. Where should the signing key be stored to meet security best practices?

Accepted Answer

Store the private key in Cloud Key Management Service (Cloud KMS).. Storing the private key in Cloud KMS is the best practice because it provides a secure, managed environment for cryptographic keys, with access controls, auditing, and hardware security module (HSM) backing. This ensures the signing key is protected and meets security compliance requirements.

Answer

Store the private key in a GCS bucket with uniform bucket-level access.

Answer

Store the private key in Secret Manager.

Answer

Store the private key on the developer's workstation.

Question 9

What is the purpose of Cloud HSM?

Accepted Answer

To provide FIPS 140-2 Level 3 validated hardware security for key material. Cloud HSM provides FIPS 140-2 Level 3 validated hardware security modules for storing and managing encryption keys. Its primary purpose is to offer hardware-backed key protection, ensuring that key material is stored in tamper-resistant hardware. This meets stringent compliance requirements for key management.

Answer

To manage secrets such as API keys and passwords

Answer

To automatically rotate encryption keys

Answer

To encrypt data at rest using Google-managed keys

Question 10

A company is migrating a legacy on-premises application to Google Compute Engine. The application requires a static IP address for compliance with a regulatory requirement that outbound connections to a partner's IP whitelist must originate from a known, fixed IP. The application will run in a managed instance group (MIG) for high availability. Which of the following solutions meets the compliance requirement?

Accepted Answer

Use Cloud NAT with a static NAT IP address for all egress traffic from the instances.. Cloud NAT with a static NAT IP address provides a fixed source IP for all outbound traffic from instances in the managed instance group (MIG). This meets the compliance requirement for a known, static IP for partner whitelisting. Cloud NAT is designed for outbound connectivity and works seamlessly with MIGs for high availability. Option B is incorrect because a regional external HTTPS load balancer is designed for inbound traffic, not outbound routing; it cannot serve as a forward proxy for egress traffic.

Answer

Configure VPC Service Controls to allow egress only from a specific IP range.

Answer

Use a regional external HTTPS load balancer with a static IP address and configure the MIG to route outbound traffic through the load balancer.

Answer

Assign static external IP addresses to each instance in the MIG and configure the partner firewall accordingly.

Question 11

A retail company processes customer payment data and must comply with PCI DSS. They use Cloud SQL for database storage. They need to ensure that all database backups are encrypted at rest. What should they do?

Accepted Answer

No additional action required; Cloud SQL automatically encrypts backups.. C is correct because Cloud SQL automatically encrypts all data at rest, including backups, using either Google-managed encryption keys or customer-managed encryption keys (CMEK) if configured. No additional action is required to enable backup encryption by default, as this is a built-in feature of the service to meet PCI DSS compliance requirements.

Answer

Use Cloud HSM to generate a key and store in Cloud Storage for backup encryption.

Answer

Enable Cloud DLP to inspect and encrypt backup data.

Answer

Use Cloud KMS to create a CMEK key and attach it to the Cloud SQL instance.

Question 12

Which method ensures that Cloud Storage logs are encrypted with a key that is managed on-premises?

Accepted Answer

Cloud External Key Manager. Cloud External Key Manager (Cloud EKM) allows you to use an external key management system, such as one running on-premises, to manage encryption keys for Cloud Storage. This ensures that the keys used to encrypt your data are never stored in Google Cloud, meeting the requirement of on-premises key management.

Answer

CMEK

Answer

CSEK

Answer

Default encryption

Question 13

A security engineer needs to view logs of Google Cloud support engineers accessing their data to meet compliance requirements. Which GCP feature should they enable?

Accepted Answer

Access Transparency. Access Transparency provides logs of when Google Cloud support engineers (or other Google personnel) access your data or configuration, giving you an audit trail for compliance. It is specifically designed to show Google's own access to your environment, which is distinct from your users' access. This is the feature that satisfies the requirement to view logs of Google support engineer access.

Answer

Access Approval

Answer

Audit Logs

Answer

VPC Flow Logs

Question 14

An organization stores sensitive customer data in BigQuery tables. They need to enforce column-level security such that users in the 'support' group see a masked version of email addresses (e.g., j***@example.com), while managers see the full email. Which approach should they use?

Accepted Answer

Apply a BigQuery data masking policy using policy tags on the email column.. BigQuery data masking policies use policy tags from the Data Catalog to apply masking rules (e.g., email mask, last-four, hash) at the column level, and access to the unmasked data is controlled via IAM roles on the taxonomy. This lets the 'support' group see masked emails while managers with the fine-grained reader role see full values, all without duplicating data.

Answer

Create a view that applies masking functions and grant access to the view.

Answer

Use Cloud DLP to scan and de-identify the data in place.

Answer

Create separate tables for each role and populate them with appropriate data.

Question 15

A financial services company is deploying a multi-region application on Google Kubernetes Engine (GKE) and needs to comply with PCI DSS. They must ensure that cardholder data is encrypted in transit between pods in different clusters. What is the MOST secure way to achieve this?

Accepted Answer

Enable Anthos Service Mesh with mutual TLS (mTLS) across clusters.. Anthos Service Mesh with mutual TLS (mTLS) provides authenticated and encrypted communication between pods across different GKE clusters, meeting PCI DSS encryption-in-transit requirements. mTLS ensures that each side of the connection presents a certificate, verifying identity and encrypting traffic at the application layer, which is more secure than relying solely on network-level encryption. This approach also integrates with GKE's multi-cluster service mesh capabilities, allowing fine-grained policy enforcement across clusters.

Answer

Configure TLS for each service using a Cloud Load Balancing with SSL policies.

Answer

Use HTTPS between services by configuring ingress with a Google-managed SSL certificate.

Answer

Use VPC Network Peering to connect the clusters and rely on the internal network encryption.