PCSE Practice Test 36 — 15 Questions

Question 1

A company has a security policy that service account keys should not be created. They want to prevent anyone from creating keys for any service account in the organization. Which organization policy constraint should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

constraints/iam.disableServiceAccountKeyCreation. The `constraints/iam.disableServiceAccountKeyCreation` organization policy constraint explicitly prevents the creation of user-managed service account keys across the entire organization. This aligns with the security policy that service account keys should not be created, as it enforces the use of short-lived credentials or workload identity federation instead of long-lived keys.

Answer

Custom constraint with iam.serviceAccountKeys.create

Answer

constraints/iam.allowedPolicyMemberDomains

Answer

constraints/compute.requireShieldedVm

Question 2

A company uses Cloud Monitoring to track latency on their Compute Engine instances. They notice a spike in latency every day at 2:00 PM. The operations team wants to automate the creation of a support ticket when this spike occurs. What should they do?

Accepted Answer

Create a Cloud Monitoring alert that sends a notification to a Pub/Sub topic, which triggers a Cloud Function that creates a ticket.. Creating a Cloud Monitoring alert that sends a notification to a Pub/Sub topic, which then triggers a Cloud Function to create a ticket, is the most efficient and automated approach. This leverages Cloud Monitoring's alerting capabilities to detect the latency spike and Pub/Sub to decouple the alert from the ticketing action, allowing for scalable and reliable processing.

Answer

Create a Cloud Function that runs every minute to check latency and create a ticket.

Answer

Configure Cloud Tasks to periodically query the latency metric and create a ticket.

Answer

Use Cloud Scheduler to run a job that checks latency every hour and creates a ticket if spike is detected.

Question 3

A security engineer needs to configure firewall rules to allow traffic from a set of compute instances to a set of backend instances. The engineer wants to use a method that is more secure and scalable than using network tags. Which approach should they use?

Accepted Answer

Use firewall rules with source service accounts and target service accounts. Using firewall rules with source and target service accounts allows you to define granular, identity-based rules that are more secure and scalable than network tags. Service accounts are unique to instances and can be managed centrally, reducing the risk of misconfiguration and enabling dynamic environments. This approach aligns with Google Cloud best practices for least privilege.

Answer

Use hierarchical firewall policies

Answer

Use firewall rules with source tags and target tags

Answer

Use network firewall policies

Question 4

Refer to the exhibit. A compliance auditor reviews the key configuration and finds a potential issue. What is the most likely compliance impact?

Accepted Answer

The key lacks automatic rotation, which may violate compliance requirements. Many compliance frameworks (e.g., PCI DSS, SOC 2, NIST SP 800-57) require cryptographic keys to be rotated periodically to limit the amount of data encrypted under a single key and reduce the impact of key compromise. In Google Cloud KMS, if automatic rotation is not enabled or configured, the key remains static, which can violate these compliance mandates. The auditor identifies the lack of automatic rotation as a potential non-compliance issue, even if the key is otherwise valid and functional.

Answer

The key is disabled and cannot encrypt data

Answer

The key was created too recently

Answer

The key is not used for the correct purpose

Question 5

A company wants to enforce that only users from a specific domain (example.com) can be granted IAM roles on any resource in their organization. Which two steps are required? (Choose two.)

Accepted Answer

Configure Cloud Identity or Google Workspace to manage the example.com domain.. Option B is correct because Google Cloud's domain restriction enforcement relies on the domain being verified and managed through Cloud Identity or Google Workspace, which establishes the identity namespace that IAM recognizes for example.com principals. Option C is correct because the organization policy constraint 'constraints/iam.allowedPolicyMemberDomains' (Domain Restricted Sharing) is the mechanism that restricts which domains may be added as IAM members in the organization, so setting it to allow only example.com enforces the requirement. Option A is incorrect because custom roles define permissions, not which domains a principal may belong to, so they cannot restrict membership by domain. Option D is incorrect because an IAM deny policy denies specific permissions to specified principals and does not provide a domain-based allowlist for all role grants. Option E is incorrect because Cloud Directory Sync only provisions users from a directory into Cloud Identity or Google Workspace; it does not enforce domain restrictions on IAM policy bindings.

Answer

Create custom roles that only allow users from example.com.

Answer

Create an IAM deny policy to deny access to users from other domains.

Answer

Use Cloud Directory Sync to sync only example.com users.

Question 6

A company wants to use Google Cloud Directory Sync (GCDS) to synchronize users and groups from an on-premises Active Directory to Cloud Identity. Which two prerequisites must be met? (Choose two.)

Accepted Answer

A Cloud Identity or Google Workspace account with super admin privileges.. Option C is correct because GCDS requires a Cloud Identity or Google Workspace super admin account to authorize the sync and grant the necessary API access to the directory. Option E is correct because the GCDS server must be able to reach Google's servers over the network (typically HTTPS/443) to authenticate and push user and group data. Option A is not required because GCDS uses the super admin's credentials or a delegated admin, not a service account with a Directory Sync role. Option B is not required because there is no organization policy that enables directory sync. Option D is not required because GCDS runs on an on-premises or self-managed server, not necessarily a Compute Engine VM.

Answer

A service account with the Directory Sync role.

Answer

An organization policy that allows directory sync.

Answer

A Compute Engine VM to run the GCDS service.

Question 7

Your organization uses VM Manager for patch management. You need to configure patch deployments to run weekly on all Windows VMs. Which two resources must be configured? (Choose two.)

Accepted Answer

Create a patch deployment with a weekly schedule. Option C is correct because VM Manager patch management requires a patch deployment resource, and to run weekly you must define a schedule (e.g., a cron-like recurring schedule) on that patch deployment so it executes automatically each week. Option D is correct because a patch deployment must specify which VMs it targets, and VM Manager uses instance filters/labels (such as OS = Windows) to select the target VMs, ensuring only Windows VMs are patched. Option A is incorrect because VPC Flow Logs capture network traffic metadata and have nothing to do with patch deployment configuration. Option B is incorrect because manually creating a patch job each week is not a configured weekly schedule and defeats the purpose of automated recurring patch deployments. Option E is incorrect because, while the OS Config agent is needed on VMs for VM Manager to manage them, the question asks which resources must be configured for the deployment itself, and agent installation is a prerequisite rather than a patch deployment resource.

Answer

Enable VPC Flow Logs on the VMs

Answer

Create a patch job manually each week

Answer

Install the OS Config agent on all VMs

Question 8

A company uses a shared VPC with multiple service projects. A security administrator created an organization policy with the constraint 'gcp.resourceLocations' to restrict Cloud SQL instance creation to only the 'us-central1' region. The policy is applied at the organization level. A Cloud SQL administrator is using a service account with the predefined role 'roles/cloudsql.admin' (also granted at the organization level) to create instances. Despite the organization policy, the service account successfully creates a Cloud SQL instance in the 'europe-west1' region. The administrator verifies that the organization policy is active and the constraint is enforced. What is the most likely reason the policy is not preventing the creation?

Accepted Answer

The organization policy is set to 'dry-run' mode, so it logs violations but does not deny the operation.. The organization policy constraint 'gcp.resourceLocations' can be set to 'dry-run' mode, which logs violations but does not deny the operation. In this scenario, the policy is active and enforced, but if it is in dry-run mode, it will not block the creation of Cloud SQL instances in non-compliant regions. The service account's successful creation in 'europe-west1' indicates that the policy is not actively denying the request, which aligns with dry-run behavior.

Answer

The organization policy is applied at the organization level, but the service account's permissions are also at the organization level, causing an override.

Answer

The service account has the 'Organization Policy Administrator' role, which allows it to bypass constraints.

Answer

The gcp.resourceLocations constraint does not apply to Cloud SQL instances.

Question 9

A security engineer wants to review all IAM permission changes made in the last 30 days. Which type of Cloud Audit Log should they query?

Accepted Answer

Admin Activity logs. Admin Activity logs record API calls that modify configuration or metadata, including IAM policy and permission changes (e.g., SetIamPolicy). They are enabled by default and retained for 400 days, making them the correct source for auditing permission changes over the last 30 days. Data Access logs, by contrast, record reads/writes of user data, not IAM configuration.

Answer

Data Access logs

Answer

System Event logs

Answer

Policy Denied logs

Question 10

A company wants to prevent data exfiltration by restricting access to Google APIs from only authorized VPC networks. They also need to allow a specific on-premises IP range to access BigQuery. Which TWO services should be used together? (Choose 2)

Accepted Answer

Access levels (IP-based). VPC Service Controls (E) is the service designed to define a service perimeter around Google Cloud services such as BigQuery, preventing data exfiltration by restricting access to only authorized VPC networks and projects. Access levels (B) are the mechanism used within VPC Service Controls to define IP-based conditions, so a specific on-premises IP range can be allowed to reach BigQuery inside the perimeter. Together, VPC Service Controls enforces the perimeter while the IP-based access level grants the on-premises range the required access. Cloud Armor (A) is an edge WAF/DDoS protection for HTTP(S) load balancers and does not govern API access to BigQuery. Hierarchical firewall policy (C) filters network traffic at the VPC level but cannot restrict Google API access or data exfiltration. Private Service Connect (D) provides private connectivity to services but does not enforce access restrictions or IP-based authorization for BigQuery.

Answer

Cloud Armor

Answer

Hierarchical firewall policy

Answer

Private Service Connect

Question 11

A company processes healthcare data and has signed a BAA with Google Cloud. They need to implement controls for HIPAA compliance. Which THREE actions should they take? (Choose three.)

Accepted Answer

Provide security awareness training to all workforce members.. Option A is correct because HIPAA's Security Rule requires workforce security and awareness training so that all personnel who handle ePHI understand their responsibilities and can recognize threats; Google Cloud's BAA does not remove this customer obligation. Option D is correct because HIPAA requires audit controls and the ability to record and examine activity in systems containing ePHI, so enabling access logging (e.g., Cloud Audit Logs for data access) on covered services provides the necessary audit trail for PHI access. Option E is correct because Cloud DLP can discover, classify, and de-identify PHI in Cloud Storage and BigQuery, supporting the HIPAA Privacy Rule's minimum necessary and de-identification requirements while reducing exposure of sensitive data. Option B is not required because CMEK is an optional data-at-rest control; Google Cloud already encrypts data by default and CMEK is not mandated by HIPAA. Option C is not required because Cloud Armor addresses DDoS/edge protection, which is a general security control rather than a specific HIPAA compliance requirement for processing PHI.

Answer

Enable Customer-Managed Encryption Keys (CMEK) for all services.

Answer

Use Cloud Armor to protect the web application from DDoS attacks.

Question 12

A company is implementing a HIPAA-compliant environment on Google Cloud. They need to ensure that all access to protected health information (PHI) is logged and monitored. Which TWO steps should they take? (Choose two.)

Accepted Answer

Set up Cloud Logging-based alerts for suspicious access patterns.. Option E is correct because Cloud Audit Logs (Admin Activity, Data Access, and System Event logs) record who accessed what data and when across Google Cloud services, which is essential for HIPAA-required logging and monitoring of PHI access; Data Access logs in particular capture reads/writes of PHI. Option A is correct because setting up Cloud Logging-based alerts (log-based alerts or alerting policies on log entries) enables proactive monitoring and notification of suspicious access patterns, satisfying the HIPAA monitoring requirement rather than just passive logging. Option B is not required here because Cloud DLP classifies and de-identifies sensitive data but does not itself provide access logging or monitoring of PHI access. Option C addresses data exfiltration prevention via VPC Service Controls, which is a security control but not the logging/monitoring step the scenario asks for. Option D, Cloud NAT, only provides outbound internet connectivity for private instances and has no bearing on logging or monitoring PHI access.

Answer

Use Cloud DLP to automatically classify PHI in logs.

Answer

Configure VPC Service Controls to restrict PHI data egress.

Answer

Deploy Cloud NAT for outbound traffic from PHI instances.

Question 13

An organization wants to detect and respond to potential data exfiltration attempts via VPC Flow Logs. They plan to export VPC Flow Logs to BigQuery for analysis. Which TWO actions should they take to enable this? (Choose TWO.)

Accepted Answer

Create a log sink with a filter for compute.googleapis.com/vpc_flows and destination BigQuery.. Option E is correct because VPC Flow Logs must first be enabled on the subnet (or instance) to generate the flow log records; without enabling them, no vpc_flows log entries exist to export. Option A is correct because exporting logs from Cloud Logging to BigQuery requires a log sink whose filter targets the resource type compute.googleapis.com/vpc_flows and whose destination is a BigQuery dataset, which is the supported native export path. Option B is not needed because Cloud Logging supports a built-in BigQuery sink destination, so a Cloud Function to copy logs is unnecessary and adds complexity. Option C is incorrect because a BigQuery view only queries data already in BigQuery; it does not export or enable flow logs. Option D is incorrect because Data Access logs for Compute Engine record admin/data access API activity, not VPC flow telemetry, so they do not produce the flow log data needed for exfiltration analysis.

Answer

Set up a Cloud Function to copy logs from Cloud Logging to BigQuery.

Answer

Create a BigQuery view to filter VPC Flow Logs.

Answer

Enable Data Access logs for Compute Engine.

Question 14

A company subject to PCI DSS is building a cardholder data environment (CDE) on Google Cloud. They need to encrypt cardholder data at rest and in transit. Which THREE measures should they implement? (Choose three.)

Accepted Answer

Enforce TLS 1.2 or higher for data in transit.. Option A is correct because PCI DSS requires strong cryptography for cardholder data in transit, and enforcing TLS 1.2 or higher protects data moving between clients, services, and the CDE from interception or downgrade attacks. Option B is correct because Cloud KMS provides a centralized, FIPS 140-2 validated key management service that supports key rotation, separation of duties, and audit logging needed to satisfy PCI DSS key-management requirements. Option C is correct because Customer-Managed Encryption Keys (CMEK) let the company control the key lifecycle for data at rest in services like Cloud Storage, BigQuery, and Compute Engine, which PCI DSS expects for protecting stored cardholder data and demonstrating key custody. Option D is not correct here because Cloud Armor is a WAF for filtering HTTP(S) traffic at the edge; while useful for web protection, it does not itself encrypt cardholder data at rest or in transit. Option E is not correct here because VPC Service Controls create a security perimeter to mitigate data exfiltration, but they are an isolation control rather than an encryption measure for data at rest or in transit.

Answer

Configure Cloud Armor WAF to inspect traffic.

Answer

Use VPC Service Controls to isolate the CDE.

Question 15

A company is using Security Command Center (SCC) Premium tier and wants to automatically remediate certain high-severity findings. Which two services can be used together to achieve this? (Choose two.)

Accepted Answer

Pub/Sub. Option A (Pub/Sub) is correct because SCC Premium can export findings to Pub/Sub, which acts as the event transport that notifies downstream automation whenever a high-severity finding is created or updated. Option E (Cloud Functions) is correct because a Cloud Function can subscribe to that Pub/Sub topic and execute remediation logic, such as disabling a service account or removing a firewall rule, in response to the finding. Together, Pub/Sub and Cloud Functions form the standard event-driven remediation pattern for SCC. Dataflow (B) is a data processing service for pipelines, not an event-driven remediation trigger, so it does not fit. Cloud Scheduler (C) only runs jobs on a time schedule and cannot react to SCC findings. Cloud IAM (D) manages identities and permissions but does not perform automated remediation actions.

Answer

Dataflow

Answer

Cloud Scheduler

Answer

Cloud IAM