PCSE Practice Test 36 — 15 Questions

Question 1

Your organization wants to ensure that no Compute Engine instance can have a public IP address. What is the best way to enforce this policy?

Accepted Answer

Use an Organization Policy with the constraint `compute.vmExternalIpAccess`. The Organization Policy constraint `compute.vmExternalIpAccess` is a native Google Cloud policy that can be applied at the project, folder, or organization level to explicitly deny the assignment of external IP addresses to Compute Engine instances. This policy is enforced at the resource creation time, preventing any instance from being launched with a public IP, and it cannot be overridden by project-level IAM permissions, making it the most direct and effective enforcement mechanism.

Answer

Use Cloud Audit Logs to monitor and alert on instances with public IPs

Answer

Use a firewall rule that blocks traffic from 0.0.0.0/0

Answer

Use a Service Perimeter from VPC Service Controls

Question 2

A company uses Cloud SQL for PostgreSQL and needs to ensure that database backups are retained for 30 days for compliance. They also want to be able to perform point-in-time recovery for the last 24 hours. What configuration should they use?

Accepted Answer

Enable automated backups with a retention of 30 days and enable binary logging (write-ahead logs) for point-in-time recovery.. Cloud SQL automated backups and binary log (WAL) archiving enable point-in-time recovery. Option B is incorrect because export to Cloud Storage is a manual process. Option C is incorrect because snapshots are not supported for Cloud SQL. Option D is incorrect because manual backups do not provide point-in-time recovery.

Answer

Manually take a full backup every day and store it in Cloud Storage with object lifecycle management set to 30 days.

Answer

Take daily snapshots of the Compute Engine instance running Cloud SQL.

Answer

Use Cloud Scheduler to run a script that exports the database to Cloud Storage every hour, and keep the exports for 30 days.

Question 3

Refer to the exhibit. An organization has the above IAM policy on a project. The user user@example.com is trying to view a list of objects in a bucket from IP address 10.1.1.1. What will be the result?

Accepted Answer

The user can list objects because the condition is satisfied.. The IAM policy grants the `storage.objects.list` permission to `user@example.com` with a condition that requires the request to come from an IP address within the `10.0.0.0/8` range. Since the user is accessing from `10.1.1.1`, which falls within that CIDR block, the condition evaluates to true, allowing the list operation.

Answer

The user cannot list objects because the condition is evaluated as false.

Answer

The user cannot list objects because IAM conditions do not support IP-based restrictions.

Answer

The user can list objects because they have inherited roles/storage.admin permissions from the admin.

Question 4

Which TWO are correct statements about IAM deny policies? (Choose two.)

Accepted Answer

Deny policies support conditions to restrict when the deny applies.. IAM deny policies support conditions that allow you to specify when the deny should apply, such as based on IP address, date/time, or resource tags. This enables fine-grained control over access restrictions, ensuring that the deny only takes effect under defined circumstances.

Answer

Deny policies are prioritized based on the resource hierarchy (organization highest).

Answer

Deny policies cannot override an allow policy if the member is explicitly granted.

Answer

Deny policies can be applied at any resource level including individual resources.

Question 5

A company is implementing VPC Service Controls to protect a project that contains Cloud Storage and BigQuery. They want to allow a specific on-premises service account to read data from Cloud Storage and write to BigQuery. The on-premises network connects via Cloud VPN. Which TWO components must be configured in the service perimeter? (Choose two.)

Accepted Answer

An ingress rule that allows the on-premises service account to access Cloud Storage and BigQuery. To allow external access, you need an ingress rule that specifies the source (on-premises service account and the Cloud VPN network) and the allowed services (Cloud Storage and BigQuery). An access level can be used to define the IP range, but the ingress rule is the primary mechanism. Adding the service to the perimeter is already done; you don't need to add it again. An egress rule is not needed for inbound access.

Answer

Add Cloud Storage and BigQuery to the list of restricted services in the perimeter (they already are)

Answer

A VPC firewall rule allowing traffic from the VPN to the Cloud Storage and BigQuery APIs

Answer

An egress rule that allows the on-premises service account to leave the perimeter

Question 6

An organization has three projects: dev, staging, prod. They use Cloud Build to deploy code. The Cloud Build service account in the dev project needs to deploy to GKE in the prod project. To allow cross-project deployment, what should the Cloud Build service account be granted in the prod project?

Accepted Answer

roles/container.developer on the prod project.. The Cloud Build service account in the dev project needs to deploy workloads to a GKE cluster in the prod project. The role `roles/container.developer` on the prod project grants the necessary permissions to create, update, and delete pods, deployments, and services within the cluster, which is required for deployment. This role also includes `container.clusters.get` and `container.clusters.update` to interact with the cluster, making it the correct choice for cross-project GKE deployment.

Answer

roles/container.clusterViewer on the prod cluster.

Answer

roles/storage.objectViewer on the prod bucket.

Answer

roles/iam.serviceAccountUser on the GKE node service account in prod.

Question 7

Which THREE steps are necessary to meet SOC 2 Type II requirements using Google Cloud?

Accepted Answer

Enable Cloud Audit Logs and retain them for at least one year.. SOC 2 Type II requires evidence of continuous monitoring and retention of audit logs for at least one year to demonstrate effective controls. Enabling Cloud Audit Logs in Google Cloud captures admin activity, data access, and system events, which are essential for audit evidence. Retaining these logs for a minimum of one year aligns with the SOC 2 common criteria for monitoring and response.

Answer

Use a single Google Cloud project for all data to simplify auditing.

Answer

Use Customer-Managed Encryption Keys (CMEK) for all storage services.

Question 8

A large enterprise runs a streaming data pipeline using Dataflow to process events from Pub/Sub, apply aggregations with fixed windows, and write results to BigQuery. They are experiencing high costs and long processing times. The Dataflow job uses Streaming Engine, but the workers show high CPU utilization. The pipeline has autoscaling enabled, but the number of workers rarely increases. The team wants to reduce processing time and cost. What should they do?

Accepted Answer

Optimize the windowing interval to reduce data shuffling.. Optimizing the windowing interval reduces data shuffling and can improve performance without adding resources. Long windows cause more state to be kept, increasing CPU and memory demands. Option A is incorrect because increasing maxNumWorkers may help but the job is already CPU-bound and not scaling; more workers might not reduce CPU per worker if the issue is data shuffling. Option B is incorrect because larger machines increase cost and may not address the root cause. Option D is incorrect because switching to batch would not meet real-time requirements and may cause data loss.

Answer

Use a larger machine type for workers, such as n1-standard-8.

Answer

Increase the number of workers by setting maxNumWorkers higher.

Answer

Switch from Streaming Engine to batch mode to reduce resource overhead.

Question 9

A company uses Shared VPC with a host project and multiple service projects. The security team wants to enforce that only specific VMs in service project A (using IP range 10.0.1.0/24) can communicate with specific VMs in service project B (tagged as 'app-b') on TCP port 443, and all other inter-service-project traffic should be blocked. Additionally, VMs should still be accessible via IAP TCP forwarding (SSH) on TCP port 22. Which three firewall rules should be created in the host project? (Choose three.)

Accepted Answer

Priority 1000: Allow ingress from 10.0.1.0/24 to VMs with tag 'app-b' on TCP 443.. It creates an ingress firewall rule in the host project that allows traffic from the specific IP range 10.0.1.0/24 (VMs in service project A) to VMs tagged 'app-b' in service project B on TCP port 443. In Shared VPC, all firewall rules are defined in the host project and apply to all service projects, so this rule enforces the required communication while the deny rule (Option B) blocks all other inter-service-project traffic. The IAP rule (Option E) is needed to allow SSH access via IAP TCP forwarding, which uses the source range 35.235.240.0/20 on TCP port 22.

Answer

Priority 1000: Allow ingress from IAP forwarding ranges to all VMs on all protocols.

Answer

Priority 1000: Allow egress from VMs in service project A to service project B's VMs on TCP 443.

Question 10

A company needs to allow developers to create and manage custom IAM roles at the project level, but restrict the permissions that can be added to those roles to a predefined list. What should be used?

Accepted Answer

Use a custom organization policy constraint to define the allowed permissions for custom roles.. Custom roles can be defined at the organization or project level. To restrict the permissions that can be included, use an organization policy with a custom constraint that specifies allowed permissions for custom roles. Roles Administrator (roles/iam.roleAdmin) allows managing all roles. Organization policy constraints like constraints/iam.allowedPolicyMemberDomains restrict member domains, not permissions. The correct approach is to create a custom organization policy constraint that limits the permissions that can be added to a custom role.

Answer

Grant the developers the IAM Role Administrator role (roles/iam.roleAdmin) and rely on training to only use allowed permissions.

Answer

Grant the developers the Project IAM Admin role (roles/resourcemanager.projectIamAdmin) and restrict roles via a deny policy.

Answer

Use the constraint constraints/iam.allowedPolicyMemberDomains to restrict the domains of members who can be assigned roles.

Question 11

Refer to the exhibit. You are analyzing the IAM policy for a project. You need to ensure that only authenticated users can access objects in bucket1 under the prefix "reports/". Which of the following statements is correct?

Accepted Answer

Bob can view, create, and delete any object in bucket1.. The IAM policy grants Bob the roles/storage.objectAdmin role on the entire bucket1, which includes permissions to view, create, and delete any object in the bucket. The condition restricting access to the "reports/" prefix applies only to the objectViewer role, not to Bob's role. Therefore, Bob has full administrative access to all objects in bucket1 without any prefix restriction.

Answer

The condition on objectViewer also prevents alice from listing objects under reports/.

Answer

The service account sa-1 can view objects under reports/ in bucket1.

Answer

Alice can only view objects under reports/ in bucket1.

Question 12

A company must implement data residency requirements that prohibit storing data outside the European Union. They are using Cloud Bigtable and need to ensure that backups are also stored within the EU. Which configuration should they choose?

Accepted Answer

Create the Bigtable instance in a single EU region (e.g., europe-west1) and enable automatic backups.. A single-region Bigtable instance in an EU region (e.g., europe-west1) ensures that all data, including backups, remains within the EU. Enabling automatic backups stores backup data in the same region, satisfying data residency requirements that prohibit storing data outside the EU.

Answer

Create the Bigtable instance with multi-region placement in europe-west1 and europe-west4.

Answer

Create an instance in a dual-region configuration (e.g., europe-west1 and europe-west4) and use backup policies.

Answer

Use a single-region instance in europe-west1 with customer-managed encryption keys (CMEK) for backups.

Question 13

A user in a Google Cloud organization wants to create a custom IAM role at the project level. Which permission is required to create custom roles?

Accepted Answer

iam.roles.create. The permission iam.roles.create is needed to create custom roles. This permission is included in roles like roles/iam.roleAdmin or roles/owner.

Answer

resourcemanager.projects.setIamPolicy

Answer

iam.serviceAccounts.create

Answer

iam.roles.update

Question 14

A company wants to enforce that all access to Cloud Storage buckets in a project is encrypted with Customer-Managed Encryption Keys (CMEK). The Security Engineer needs to configure the organization policy to meet this requirement. Which THREE steps should be taken? (Choose THREE.)

Accepted Answer

Create an organization policy with the constraint 'constraints/storage.requireCustomerManagedEncryption'.. The `constraints/storage.requireCustomerManagedEncryption` organization policy constraint enforces that all Cloud Storage buckets in the project must use CMEK. When this constraint is applied, any attempt to create a bucket without specifying a CMEK key is denied, ensuring compliance with the encryption requirement.

Answer

Grant the 'cloudkms.cryptoKeyEncrypterDecrypter' role to the Cloud Storage service account.

Answer

Disable the 'storage.objects.setIamPolicy' permission for all users except the key administrators.

Question 15

A company is implementing PCI DSS compliance on Google Cloud. They need to ensure that cardholder data is encrypted in transit and at rest. Which TWO encryption controls are required by PCI DSS?

Accepted Answer

Use TLS 1.2 or higher for all data in transit. PCI DSS requires strong encryption for data in transit (TLS 1.2 or higher) and for data at rest (e.g., using encryption keys managed by the customer or Google). CMEK ensures customer-managed keys for data at rest.

Answer

Enable Cloud CDN

Answer

Use Cloud NAT

Answer

Enable VPC Flow Logs