PCSE Practice Test 37 — 15 Questions

Question 1

A security engineer needs to configure Cloud KMS key rotation so that existing ciphertext can still be decrypted with old key versions, but new encryption uses the latest version. Which key management practice meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set a rotation period on the key; Cloud KMS automatically creates new versions while old versions remain available for decryption.. Cloud KMS supports key rotation by creating new key versions while retaining all previous versions. When you set a rotation period, Cloud KMS automatically generates a new version at the specified interval, and the key's primary version (used for new encryption) is updated. Old key versions remain enabled and available for decryption of existing ciphertext, ensuring that data encrypted with older versions can still be decrypted without manual intervention.

Answer

Use a single key and manually update its material every 90 days.

Answer

Create a new key version manually and disable the previous version after a grace period.

Answer

Create a new key every rotation and delete the old key after confirming re-encryption.

Question 2

An organization wants to allow a group of external auditors read-only access to specific BigQuery datasets in a project, but only during working hours (9 AM to 5 PM). The auditors belong to an external Google Workspace domain. Which IAM configuration should be used?

Accepted Answer

Create a custom role with required permissions on the datasets, grant it to the auditors' group with an IAM condition using request.time between 9 AM and 5 PM.. IAM conditions allow you to enforce time-based access using the `request.time` attribute, which can restrict access to specific hours. By granting a custom role with read-only permissions on the BigQuery datasets and attaching a condition that `request.time` falls between 9 AM and 5 PM, the auditors from the external Google Workspace domain will only have access during working hours. This approach is native to IAM and does not require external automation or network-level controls.

Answer

Configure a Cloud Scheduler job to add and remove the auditors' group membership at the required times.

Answer

Create an Organization Policy with a time constraint on the datasets.

Answer

Use VPC Service Controls with an access level that allows during working hours.

Question 3

A startup company has a single Google Cloud project with multiple developers. To simplify identity management, they created a service account for each developer and granted them the roles/editor role on the project. However, the security team is concerned about the over-privileged access. They want to implement a more secure approach while maintaining operational efficiency. The developers need to: create Compute Engine instances, manage Cloud Storage buckets, and deploy App Engine apps. The company has a small team and does not require fine-grained access control per developer. What is the recommended approach to reduce privileges while meeting the developers' needs?

Accepted Answer

Remove the editor role, create a custom role with the required permissions, and assign the custom role to a Google Group containing all developers.. It removes the overly permissive Editor role and replaces it with a custom role containing only the specific permissions needed for Compute Engine, Cloud Storage, and App Engine. Assigning this custom role to a Google Group that contains all developers simplifies identity management and ensures consistent, least-privilege access without per-user assignment overhead.

Answer

Remove the editor role and grant each developer the roles/owner role on the project.

Answer

Remove the editor role and create a custom role with the required permissions, then assign the custom role to each developer individually.

Answer

Remove the editor role and grant each developer the roles/iam.securityReviewer role.

Question 4

A healthcare organization is migrating to Google Cloud and needs to ensure that all data stored in Cloud Storage is encrypted at rest with customer-managed encryption keys (CMEK) to meet HIPAA requirements. The security team wants to centrally manage key rotation and access. Which solution should they implement?

Accepted Answer

Use Cloud Key Management Service (Cloud KMS) with CMEK and enable key rotation.. Cloud KMS with CMEK allows the organization to centrally manage encryption keys, including automated key rotation, while maintaining customer control over the keys used to encrypt Cloud Storage data. This meets HIPAA requirements for encryption at rest with customer-managed keys, as Cloud KMS integrates directly with Cloud Storage to enforce encryption using the specified key.

Answer

Use Cloud Data Loss Prevention (DLP) to de-identify data before storing.

Answer

Use Cloud Hardware Security Module (Cloud HSM) with CMEK.

Answer

Use customer-supplied encryption keys (CSEK) stored in Cloud Storage.

Question 5

A user is unable to SSH into an instance that has the tag 'ssh-access' and an internal IP 10.0.0.2. The user's IP is 198.51.100.1. What is the most likely reason?

Accepted Answer

The user's IP is not in the allowed source range. The firewall rule only allows SSH from the source range 203.0.113.0/24. The user's IP (198.51.100.1) is not in that range, so the connection is denied.

Answer

The instance is not using the correct service account

Answer

The instance does not have an external IP

Answer

The firewall rule is disabled

Question 6

An organization's security policy requires that all audit logs be stored in a separate project for centralized monitoring. Which Google Cloud service should be used to aggregate logs from multiple projects?

Accepted Answer

Cloud Logging with log sinks. Cloud Logging log sinks can be configured to route logs from multiple source projects to a common destination, such as a Cloud Storage bucket or BigQuery dataset, in a separate central project. This meets the requirement of aggregating logs for centralized monitoring. Option A (Cloud Monitoring) is used for metrics, dashboards, and alerting, not log aggregation. Option B (Cloud Audit Logs) refers to the type of logs themselves, not a service for aggregation. Option C (Security Command Center) is for security posture and findings, not log routing.

Answer

Cloud Monitoring

Answer

Cloud Audit Logs

Answer

Security Command Center

Question 7

An organization uses Cloud VPN tunnels to connect multiple VPCs. They need to record all network metadata for compliance audits without affecting throughput. What is the most effective approach?

Accepted Answer

Enable VPC Flow Logs on all subnets and export logs to a centralized BigQuery dataset.. VPC Flow Logs capture metadata of all network flows with minimal performance impact, and exporting to BigQuery enables analysis. Option B is resource-intensive and may impact throughput. Option C only captures VPN tunnel status, not traffic metadata. Option D mirrors traffic, which can be costly and impact performance.

Answer

Install a third-party packet inspection appliance in each VPC.

Answer

Configure Packet Mirroring to mirror all VPN traffic to a collector.

Answer

Use Cloud Logging to capture VPN tunnel logs from Cloud Router.

Question 8

During a security incident, a security engineer needs to revoke a compromised service account's access across all resources immediately. However, the service account has many roles across different projects. What is the most effective immediate step?

Accepted Answer

Disable the service account.. Disabling the service account immediately revokes all access across all projects without removing IAM policies, allowing quick recovery by re-enabling it later. Option A (removing all IAM policies) is time-consuming and can break dependencies. Option C (disabling the key) only prevents key-based authentication but the service account can still be used from VM instances with service accounts attached. Option D (deleting the account) is irreversible and requires recreating and reassigning roles.

Answer

Remove all IAM policies that include the service account.

Answer

Disable the service account key.

Answer

Delete the service account from the project.

Question 9

Refer to the exhibit. A Security Engineer runs the command to grant Alice access to view objects in a Cloud Storage bucket. Later, Alice reports she can no longer access the bucket after January 1, 2024. What is the most likely reason?

Accepted Answer

The IAM condition expired on January 1, 2024, because the timestamp condition prevented access after that date.. The IAM condition attached to the binding includes a timestamp condition that expires on January 1, 2024. When the condition is no longer satisfied, the binding becomes ineffective, and Alice loses access to the bucket. This is a common use of IAM conditions to grant time-limited access.

Answer

Alice does not have the 'storage.objects.get' permission required to view objects.

Answer

The command removed Alice's existing access because it replaced all bindings.

Answer

The command failed to apply because the service account does not have permission to modify IAM policies.

Question 10

A company uses Cloud Identity-Aware Proxy (IAP) to secure access to their web applications. They notice that some users are able to access the application even though they are not in the IAP access policy. What could be the cause?

Accepted Answer

The backend service has an external IP address and firewall rule allowing public access.. If the backend service has an external IP address and a firewall rule allowing public access, users can bypass IAP enforcement entirely. Option A is incorrect because granting the 'roles/iap.httpsResourceAccessor' role at the folder level still requires IAP to be enabled and does not allow unauthorized access. Option B is incorrect because using HTTP instead of HTTPS would cause IAP to fail for all users, not just some. Option C is incorrect because using a service account with the IAP role is a legitimate way to grant access, not an unauthorized bypass.

Answer

The users have been granted the 'roles/iap.httpsResourceAccessor' role at the folder level.

Answer

The load balancer is not using HTTPS.

Answer

The users are using a service account that has the 'roles/iap.httpsResourceAccessor' role.

Question 11

A security engineer wants to ensure that all API calls to Google Cloud services are logged for audit purposes. Which service should they enable?

Accepted Answer

Cloud Audit Logs. Cloud Audit Logs record administrative and data access activities. Other logs serve different purposes.

Answer

VPC Flow Logs

Answer

Cloud NAT Logs

Answer

Firewall Rules Logging

Question 12

A DevOps team wants to automatically scale a managed instance group based on CPU utilization. Which metric should they use in the autoscaler?

Accepted Answer

'compute.googleapis.com/instance/cpu/utilization'. The compute.googleapis.com/instance/cpu/utilization metric measures actual CPU usage, suitable for autoscaling.

Answer

'compute.googleapis.com/instance/cpu/usage_time'

Answer

'compute.googleapis.com/instance/cpu/reserved_cores'

Answer

'agent.googleapis.com/cpu/utilization'

Question 13

A security operations team is using Cloud Audit Logs to investigate a suspicious data export from a Cloud Storage bucket. They need to see which user accessed a specific object and when. Which log type should they examine?

Accepted Answer

Data Access logs. Data Access logs capture all operations that read, write, or delete data in Cloud Storage objects, including who accessed a specific object and when. Admin Activity logs record only configuration changes, not data access events.

Answer

Policy Denied logs

Answer

System Event logs

Answer

Admin Activity logs

Question 14

Which TWO of the following are valid methods to automate responses to Cloud Security Command Center findings?

Accepted Answer

Create a Cloud Function that is triggered by a Pub/Sub topic receiving SCC notifications.. Options A and D are correct. Cloud Functions can subscribe to SCC notifications via Pub/Sub, and Eventarc triggers can react to findings. Option B is incorrect because Cloud Tasks is for task distribution, not direct response. Option C is incorrect because Cloud Run does not directly integrate with SCC. Option E is incorrect because Cloud Scheduler is for scheduled jobs, not event-driven automation.

Answer

Set up Cloud Tasks to process SCC findings and send alerts.

Answer

Configure Cloud Run to directly receive webhooks from SCC.

Answer

Use Cloud Scheduler to periodically query SCC and trigger a Cloud Run service.

Question 15

A Cloud Function is timing out. What is the maximum timeout for a Cloud Function (1st gen)?

Accepted Answer

540 seconds. Cloud Functions (1st gen) have a maximum timeout of 540 seconds.

Answer

60 seconds

Answer

900 seconds

Answer

3600 seconds