PCSE Practice Test 35 — 15 Questions

Question 1

A company wants to ensure that all data stored in Cloud Storage buckets is encrypted with a customer-managed key (CMEK) that is managed in Cloud KMS. The security team requires that only authorized applications can access the key. Which configuration step should be taken to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Storage service account at the Cloud KMS key resource.. Cloud Storage uses its own Google-managed service account to interact with Cloud KMS when encrypting or decrypting data with a CMEK. By granting the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Storage service account at the specific key resource, you authorize only that service account to use the key, ensuring that only authorized applications (via Cloud Storage) can access the key. This follows the principle of least privilege and meets the security team's requirement.

Answer

Use a customer-supplied encryption key (CSEK) instead of CMEK.

Answer

Create a bucket with default encryption set to use a CMEK, and grant the service account the Cloud KMS Admin role.

Answer

Grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Storage service account at the project level.

Question 2

A company wants to encrypt data at rest in Cloud SQL. Which TWO methods are supported? (Choose TWO.)

Accepted Answer

Default encryption at rest with Google-managed keys. Cloud SQL provides default encryption at rest using AES-256 with Google-managed keys, which are automatically generated and rotated by Google. This encryption is transparent to the user and requires no additional configuration, ensuring data is encrypted before being written to disk.

Answer

Cloud HSM hardware security module for encryption

Answer

Cloud Key Management Service (Cloud KMS) as a standalone encryption method

Answer

Client-side encryption before storing data in Cloud SQL

Question 3

Drag and drop the steps to configure a VPC Service Controls perimeter in the correct order.

Accepted Answer

Set up an access policy, then define access levels, then create the perimeter, then add ingress/egress rules, then enforce and test. VPC Service Controls perimeters are configured by first setting up an access policy, defining access levels, creating the perimeter, adding ingress/egress rules, and finally enforcing and testing.

Answer

Create the perimeter, then set up an access policy, then define access levels, then add ingress/egress rules, then enforce and test

Answer

Define access levels, then create the perimeter, then set up an access policy, then add ingress/egress rules, then enforce and test

Answer

Set up an access policy, then create the perimeter, then define access levels, then add ingress/egress rules, then enforce and test

Question 4

Your organization has a VPC with several subnets hosting Compute Engine instances. You need to allow SSH access (port 22) to instances in the 'management' subnet from the internet, but only from the office's static IP range (203.0.113.0/24). All other ingress traffic to that subnet should be blocked. Which firewall rule configuration should you create?

Accepted Answer

Create an ingress rule with target tag 'management', source IP range 203.0.113.0/24, protocol tcp:22, action allow. It creates an ingress firewall rule that explicitly allows TCP port 22 traffic from the office's static IP range (203.0.113.0/24) to instances tagged 'management'. In Google Cloud VPC firewall rules, the default action is to deny all ingress traffic unless an allow rule matches, so this single allow rule satisfies the requirement: only SSH from the office IP range is permitted, and all other ingress is implicitly blocked.

Answer

Create an ingress rule with target tag 'management', source IP range 0.0.0.0/0, protocol tcp:22, action allow

Answer

Create an ingress rule with target tag 'management', source IP range 203.0.113.0/24, protocol tcp:22, action deny

Answer

Create an ingress rule with target tag 'management', source IP range 203.0.113.0/24, protocol all, action allow

Question 5

A retail company processes customer payment data and must comply with PCI DSS. They use Cloud SQL for database storage. They need to ensure that all database backups are encrypted at rest. What should they do?

Accepted Answer

No additional action required; Cloud SQL automatically encrypts backups.. C is correct because Cloud SQL automatically encrypts all data at rest, including backups, using either Google-managed encryption keys or customer-managed encryption keys (CMEK) if configured. No additional action is required to enable backup encryption by default, as this is a built-in feature of the service to meet PCI DSS compliance requirements.

Answer

Use Cloud HSM to generate a key and store in Cloud Storage for backup encryption.

Answer

Enable Cloud DLP to inspect and encrypt backup data.

Answer

Use Cloud KMS to create a CMEK key and attach it to the Cloud SQL instance.

Question 6

Drag and drop the steps to configure a security scanner to scan a web application in the correct order.

Accepted Answer

Configuration, then Scheduling, then Execution, then Review, then Remediation Verification. Security scanning involves configuration, scheduling, execution, review, and remediation verification.

Answer

Scheduling, then Configuration, then Execution, then Review, then Remediation Verification

Answer

Configuration, then Execution, then Scheduling, then Review, then Remediation Verification

Answer

Configuration, then Scheduling, then Review, then Execution, then Remediation Verification

Question 7

You are a security engineer for a financial services company that processes sensitive customer data. Your architecture includes two VPCs: 'data-vpc' (10.1.0.0/16) containing BigQuery datasets and Cloud Storage buckets, and 'app-vpc' (10.2.0.0/16) containing Compute Engine instances running a customer-facing application. The application needs to read from BigQuery and write to Cloud Storage. You have configured VPC Network Peering between the VPCs. Additionally, you have set up Private Google Access on all subnets in 'data-vpc' and 'app-vpc'. The application instances cannot connect to BigQuery or Cloud Storage. You have verified that firewall rules allow egress traffic to the Google APIs IP range (199.36.153.4/30) and that DNS resolution works correctly. What is the most likely cause of the connectivity failure?

Accepted Answer

The 'app-vpc' subnets do not have a default route (0.0.0.0/0) to the internet gateway.. Private Google Access requires a default route (0.0.0.0/0) to the internet gateway in the VPC where the Compute Engine instances reside. Without this route, traffic destined for Google APIs (including BigQuery and Cloud Storage) cannot be forwarded to the internet gateway, even if Private Google Access is enabled on the subnet. The firewall rules and DNS are correctly configured, but the missing default route prevents the egress traffic from reaching the Google API IP range (199.36.153.4/30).

Answer

VPC Network Peering does not support Private Google Access.

Answer

Cloud NAT is not configured for 'app-vpc'.

Answer

Firewall rules are blocking traffic to the Google APIs IP range.

Question 8

A company is migrating a PCI DSS-compliant application to GCP. They need to meet encryption requirements for cardholder data. Which TWO options satisfy PCI DSS encryption requirements? (Choose two.)

Accepted Answer

Use Cloud External Key Manager (EKM) with a supported partner.. PCI DSS requires strong encryption; TLS 1.2+ is required for data in transit, and CMEK for data at rest provides customer-managed keys that meet compliance.

Answer

Use SHA-1 for SSL certificates.

Answer

Use default Google encryption keys (Google-managed) for data at rest.

Answer

Use TLS 1.0 for data in transit.

Question 9

A company uses Cloud Armor to protect their HTTP Load Balancer from DDoS attacks. They want to block requests from a specific malicious IP address range, 203.0.113.0/24. Which Cloud Armor policy configuration should they use?

Accepted Answer

Create a deny rule with a source IP condition for 203.0.113.0/24 and set priority to 1000.. Cloud Armor security policies use priority-based rules, where lower numbers indicate higher priority. A deny rule with priority 1000 for the specific IP range 203.0.113.0/24 ensures that traffic from that range is blocked before any lower-priority allow rules are evaluated. This is the standard method to block specific IP ranges while allowing other traffic.

Answer

Create an allow rule with source IP condition for their own IP ranges and rely on default deny.

Answer

Create a rule with a 'source-ip' tag set to 'malicious' and assign to the load balancer.

Answer

Create a deny rule with priority 1000000 for the IP range.

Question 10

Your Cloud SQL PostgreSQL instance is experiencing high replication lag between primary and read replica. You have verified the network and instance metrics. What is a likely cause?

Accepted Answer

Long-running queries on the replica. Long-running queries on the replica can block the apply process, increasing lag. Other options do not directly affect replication lag.

Answer

The replica is using a different machine type

Answer

The replica has point-in-time recovery enabled

Answer

The primary has automated backups enabled

Question 11

A security engineer needs to configure Identity-Aware Proxy (IAP) for a web application running on Compute Engine. The goal is to ensure that only authenticated users from the corporate domain can access the application. What is the first step in the configuration?

Accepted Answer

Configure OAuth 2.0 consent screen and create credentials.. To configure Identity-Aware Proxy (IAP) for a web application on Compute Engine, the first step is to configure the OAuth 2.0 consent screen and create OAuth credentials. This establishes the authentication mechanism that IAP will use to verify user identity. After this, you can enable IAP on the backend service, create access policies, and assign roles. Attempting to enable IAP before setting up OAuth credentials will result in a configuration error.

Answer

Enable IAP on the backend service of the load balancer.

Answer

Create a firewall rule to allow traffic only from IAP IP ranges.

Answer

Grant the IAP-secured Web App User role to the corporate domain users.

Question 12

A company wants to automatically rotate secrets stored in Secret Manager every 30 days. They have set up a Pub/Sub topic and a Cloud Function to perform the rotation. Which TWO actions are required to complete the configuration? (Choose two.)

Accepted Answer

Set the rotation period on the secret to 30 days.. To enable automatic rotation, you need to configure a rotation period and a Pub/Sub topic. The rotation period defines how often the secret is rotated, and the Pub/Sub topic is used to notify the Cloud Function when rotation is due.

Answer

Grant the Cloud Functions service account the secretmanager.secretVersionManager role on the secret.

Answer

Create a Cloud Scheduler job to call the Secret Manager API every 30 days.

Answer

Enable automatic rotation in the Cloud Console by toggling the 'Enable rotation' switch.

Question 13

A security engineer is troubleshooting a connectivity issue between two VPCs connected via VPC Network Peering. VPC-A (project A) has a Compute Engine instance with internal IP 10.1.0.2. VPC-B (project B) has an instance with internal IP 10.2.0.2. The engineer has verified that the peering connection is active and the firewall rules allow ingress from 10.1.0.0/16. However, the instance in VPC-B cannot ping the instance in VPC-A. What is the most likely cause?

Accepted Answer

The VPC-B does not have a route to VPC-A's subnet ranges. Custom route exchange is not enabled on the peering connection.. The most likely cause is that custom route exchange is not enabled on the VPC Network Peering connection. By default, VPC peering does not exchange custom routes (including subnet routes) unless explicitly enabled. Without this, VPC-B has no route to the 10.1.0.0/16 subnet of VPC-A, so the instance in VPC-B cannot send traffic to 10.1.0.2, even though firewall rules allow ingress. The peering connection being active only means the link is established, not that routes are automatically propagated.

Answer

The VPC-A has a firewall rule that denies ICMP traffic from VPC-B.

Answer

The MTU configuration on the peering connection is set too low.

Answer

The instance in VPC-B does not have a public IP address.

Question 14

A small business stores backup archives in Cloud Storage and wants to encrypt them at rest using a key that is automatically rotated annually. They do not want to manage key material themselves. Which encryption option should they use?

Accepted Answer

Use Google-managed encryption keys (GMEK).. Google-managed encryption keys (GMEK) are automatically rotated and require no customer management. Option B is wrong because CMEK requires customer management. Option C is wrong because CSEK requires the customer to supply and manage keys. Option D is wrong because client-side encryption is not handled by Google.

Answer

Use Cloud KMS customer-managed keys (CMEK) with rotation period.

Answer

Use Customer-Supplied Encryption Keys (CSEK).

Answer

Use client-side encryption with a third-party key management service.

Question 15

A user receives a "403 Forbidden" error when trying to access a Compute Engine instance via SSH from the Cloud Console. The user has the Compute Admin role on the project. What is the most likely cause?

Accepted Answer

The user does not have the roles/iap.tunnelResourceAccessor role.. The 403 Forbidden error when using Cloud Console SSH indicates that Identity-Aware Proxy (IAP) TCP forwarding is being used, which requires the roles/iap.tunnelResourceAccessor role. Even with Compute Admin, the user lacks this IAP-specific role, so the request is denied at the IAP layer before reaching the instance.

Answer

The user does not have the compute.instances.setMetadata permission.

Answer

The firewall rules do not allow SSH from the user's IP.

Answer

OS Login is enabled on the instance and the user lacks the osLogin role.