PCSE Practice Test 37 — 15 Questions

Question 1

A security engineer is investigating a potential data exfiltration incident. They suspect that a compromised VM is sending sensitive data to an external IP. Which three data sources should they examine to trace the exfiltration? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VPC Flow Logs. VPC Flow Logs (B) are correct because they capture IP-level metadata for traffic to and from VM network interfaces, letting the engineer identify connections from the compromised VM to the suspicious external IP, including ports, protocols, and byte/packet counts that reveal exfiltration volume. Cloud Audit Logs Data Access (D) are correct because they record data-plane operations such as reads or downloads of sensitive resources (for example, Cloud Storage object access via storage.objects.get), showing what data was accessed before being sent out. Cloud DNS logging (E) is correct because it records DNS queries from the VPC, which can reveal resolution of external exfiltration domains or command-and-control hostnames used by the compromised VM. Cloud NAT logs (A) are not among the marked answers because NAT logging primarily records NAT translations and errors for egress, not the full flow-level or data-access context needed here. Compute Engine serial port output (C) is not marked because it only shows console/serial output from the VM and does not provide network flow, DNS, or data-access records for tracing exfiltration.

Answer

Cloud NAT logs

Answer

Compute Engine serial port output

Question 2

A developer needs to create a custom IAM role that allows only a specific set of permissions for managing Cloud SQL instances. The role should be available at the organization level. Which command should they use?

Accepted Answer

gcloud iam roles create ROLE_ID --organization=ORGANIZATION_ID --file=role.yaml. Custom roles can be created at the organization level using the 'gcloud iam roles create' command with the '--organization' flag (or '--org' for short). The role is defined in a YAML file that specifies the permissions. The 'gcloud organizations add-iam-policy-binding' is used to assign roles, not create them. The 'gcloud iam service-accounts create' is for service accounts. The 'gcloud projects add-iam-policy-binding' is for project-level IAM bindings.

Answer

gcloud projects add-iam-policy-binding PROJECT_ID --member=... --role=...

Answer

gcloud iam service-accounts create SA_NAME --display-name=...

Answer

gcloud organizations add-iam-policy-binding ORGANIZATION_ID --member=... --role=...

Question 3

Refer to the exhibit. Based on the exhibit, the corporate security policy requires that all Cloud KMS symmetric keys have automatic rotation enabled. Which statement is true?

Accepted Answer

Only the encryption-key is compliant.. The corporate security policy requires automatic rotation for all Cloud KMS symmetric keys. In the exhibit, the 'encryption-key' has automatic rotation enabled (as indicated by the rotation period being set), while the 'decryption-key' does not have automatic rotation enabled (rotation period is not set or is disabled). Therefore, only the encryption-key is compliant with the policy.

Answer

Both keys are compliant.

Answer

Neither key is compliant.

Answer

Only the decryption-key is compliant.

Question 4

An organization uses VPC Service Controls to protect BigQuery. They want to test a new access level that allows access only from a specific IP range before enforcing it. Which mode should they use?

Accepted Answer

Dry-run mode. Dry-run mode allows testing perimeters without enforcement, logging violations for review.

Answer

Audit mode

Answer

Enforced mode

Answer

Preview mode

Question 5

A company wants to implement least privilege access for a team that needs to monitor and manage Cloud Run services. Which two IAM roles should be considered? (Choose two.)

Accepted Answer

roles/run.viewer. (roles/run.viewer) is correct because it grants read-only permissions to view Cloud Run services, configurations, and revisions, which is sufficient for monitoring without allowing modifications. Option D (roles/run.developer) is correct because it allows both viewing and managing Cloud Run services (e.g., deploying new revisions, updating configurations) while still restricting access to other GCP resources, aligning with least privilege for a team that needs to both monitor and manage.

Answer

roles/iam.serviceAccountUser

Answer

roles/run.admin

Answer

roles/run.invoker

Question 6

A security team wants to explicitly deny access to a Cloud Storage bucket for all users except the bucket owner. Currently, there are allow policies at the project level granting Storage Object Viewer to all users. What is the most efficient way to implement this?

Accepted Answer

Create an IAM deny policy on the bucket with a deny rule for all principals (principalSet: allUsers) and an exception for the bucket owner.. Google Cloud IAM deny policies explicitly deny access to resources, overriding any allow policies. By creating a deny rule on the bucket with `principalSet: allUsers` as the denied principal and an exception for the bucket owner, you effectively block all users except the owner, regardless of project-level allow roles. This is the most efficient approach as it does not require modifying existing project-level policies or removing roles.

Answer

Create an Organization Policy that denies access to the bucket for all users except the owner.

Answer

Modify the project-level role to include a condition that only allows the bucket owner.

Answer

Remove the project-level Storage Object Viewer role and grant it only to the bucket owner.

Question 7

A startup is deploying a containerized application on Google Kubernetes Engine (GKE). The application is stateless and experiences variable traffic patterns, with periodic spikes during promotional events. The startup wants to minimize costs while ensuring the application can handle the variable load without performance degradation. They also prefer to automate scaling as much as possible. Which GKE configuration should they choose?

Accepted Answer

Use a cluster with node auto-provisioning and preemptible nodes.. Node auto-provisioning automatically scales the node pool based on pod resource requests, ensuring the cluster can handle variable traffic spikes without manual intervention. Preemptible nodes are significantly cheaper than regular nodes, reducing costs. This combination meets the startup's requirements for cost minimization and automated scaling. Option A is incorrect because a fixed node pool does not automatically scale to meet variable demand. Option C is incorrect because a single zone may not provide sufficient resources during spikes and regular nodes are more expensive. Option D is incorrect because regional persistent disks are for stateful applications and increase cost.

Answer

Use a cluster with node auto-repair and a fixed node pool.

Answer

Use a cluster with a single zone and regular nodes.

Answer

Use a cluster with regional persistent disks for pods.

Question 8

An organization uses Cloud Identity to manage users and groups. They want to synchronize their existing on-premises Active Directory with Cloud Identity. Which tool should they use?

Accepted Answer

Google Cloud Directory Sync (GCDS). Google Cloud Directory Sync (GCDS) is the correct tool because it is specifically designed to synchronize users, groups, and aliases from an on-premises Active Directory (or LDAP server) into Cloud Identity without requiring federation. GCDS maps AD attributes to Cloud Identity fields and runs on a scheduled basis to keep the cloud directory in sync, making it the appropriate choice for this use case.

Answer

Third-party SAML identity provider

Answer

Identity Platform

Answer

Cloud Workflows

Question 9

A multinational corporation is required to protect sensitive data in BigQuery using column-level encryption. They want to use a customer-managed key stored in Cloud KMS. What is the correct approach?

Accepted Answer

Use Cloud KMS to create an AEAD key and use BigQuery SQL functions to encrypt/decrypt.. BigQuery supports column-level encryption and decryption using AEAD (Authenticated Encryption with Associated Data) keys created in Cloud KMS. The `AEAD.ENCRYPT` and `AEAD.DECRYPT` SQL functions allow you to encrypt specific columns at rest, using a customer-managed key that you control in Cloud KMS, ensuring that only authorized users with access to the key can decrypt the data.

Answer

Use Cloud DLP to de-identify columns in transit.

Answer

Use Cloud HSM to store the key and apply bucket-level encryption.

Answer

Use Customer-Supplied Encryption Keys (CSEK) with BigQuery.

Question 10

A company uses Cloud Audit Logs for compliance. They want to capture all data access events to a Cloud Storage bucket containing sensitive data. What must they enable?

Accepted Answer

Data Access audit logs with a configuration to log all methods. To capture all data access events to a Cloud Storage bucket, including API calls that read or write data, you must enable Data Access audit logs and configure them to log all methods. Admin Activity logs record configuration changes, System Event logs capture Google's internal system events, and Access Transparency logs are for requests from Google personnel. Only Data Access audit logs provide records of user and service account data access, making option D correct.

Answer

System Event audit logs

Answer

Admin Activity audit logs

Answer

Access Transparency logs

Question 11

A company has multiple VPCs in different projects that need to privately connect to a common internal service (e.g., a managed database) running in a central project. They want to expose this service via Private Service Connect. Which type of PSC endpoint should the consumer VPCs create?

Accepted Answer

Consumer endpoint (forwarding rule with PSC backend). Consumers create Private Service Connect endpoints (forwarding rules with PSC backends) to connect to a published service. The producer publishes the service via a service attachment.

Answer

Cloud NAT gateway

Answer

VPN tunnel

Answer

Producer endpoint (service attachment)

Question 12

A security engineer needs to ensure that all Compute Engine instances in an organization are created with specific CMEK (Customer-Managed Encryption Key) for disk encryption. The engineer wants to enforce this at the organization level. Which three actions are required? (Choose three.)

Accepted Answer

Create a Cloud KMS key ring and encryption key.. To enforce CMEK use, you need to create a custom organization policy constraint that requires the CMEK key resource name. Enabling CMEK via CSEK is different. The constraint must be applied at the organization level. The key must be created in Cloud KMS. The compute engine API must be enabled for policy enforcement.

Answer

Enable Customer-Supplied Encryption Keys (CSEK) for all instances.

Answer

Ensure the Compute Engine API is disabled for all projects.

Question 13

A financial institution must meet SOX compliance requirements for audit trail integrity. Which THREE measures should they implement to ensure Cloud Audit Logs are immutable and securely stored?

Accepted Answer

Use customer-managed encryption keys (CMEK) with Cloud KMS for audit logs.. Using customer-managed encryption keys (CMEK) with Cloud KMS ensures that audit logs are encrypted with keys under the customer's control, preventing unauthorized decryption even by Google. This satisfies SOX requirements for data integrity and confidentiality, as the logs cannot be tampered with or accessed without the key.

Answer

Use VPC Service Controls to prevent exfiltration of logs.

Answer

Set up Cloud IAM roles to restrict who can read audit logs.

Question 14

A company uses Google Cloud Directory Sync to synchronize users from an on-premises Active Directory to Cloud Identity. They want to allow federated access from their external identity provider (IdP) that supports SAML 2.0. The IdP should be able to authenticate users from a specific AD domain. What configuration steps are required?

Accepted Answer

Configure the external IdP as a SAML identity provider in Cloud Identity, map the AD domain, and enable user provisioning via SCIM.. For federated access with an external SAML 2.0 IdP, configure the external IdP as a SAML identity provider in Cloud Identity, mapping the appropriate domain.

Answer

Use Workload Identity Federation to map the external IdP to Google Cloud service accounts.

Answer

Set up SAML SSO in Cloud Identity using Google as the IdP, and configure AD to trust Google's SAML response for the domain.

Answer

Create a custom OAuth 2.0 flow in Cloud Identity to integrate with the external IdP.

Question 15

A multinational organization must store customer data only in specific geographic regions to comply with data residency regulations. They use Cloud Spanner for their primary database. What should they do to enforce that data is stored only in approved regions?

Accepted Answer

Apply an organization policy with a constraint that restricts the location of Cloud Spanner resources to approved regions.. Organization policies with resource location constraints allow you to enforce that Cloud Spanner instances are created only in approved geographic regions. This policy is evaluated at resource creation time and prevents the deployment of Spanner instances outside the specified regions, directly addressing data residency compliance requirements.

Answer

Create a Cloud Spanner instance in the desired region and configure a backup in a different region for disaster recovery.

Answer

Configure a VPC Service Controls perimeter to restrict access to Cloud Spanner.

Answer

Use Cloud Spanner with data residency constraints by selecting a multi-region configuration that includes only approved regions.