PCSE Practice Test 38 — 15 Questions

Question 1

A company is using Cloud Composer (Airflow) to orchestrate data pipelines. A DAG is failing with a 'Task received SIGTERM' error. What is the most likely cause?

Accepted Answer

The task exceeded its execution timeout. SIGTERM is sent when a task exceeds its execution timeout. Other causes produce different signals.

Answer

The worker node was preempted

Answer

The task ran out of memory

Answer

The Airflow scheduler crashed

Question 2

Which TWO actions should you take to reduce the attack surface of a Compute Engine VM? (Choose 2.)

Accepted Answer

Remove public IP addresses. Removing public IP and enabling Secure Boot reduce exposure. vTPM and other options do not directly reduce attack surface.

Answer

Enable Instance Termination Action

Answer

Use preemptible VMs

Answer

Enable Virtual Trusted Platform Module (vTPM)

Question 3

A company uses Cloud Monitoring to track latency on their Compute Engine instances. They notice a spike in latency every day at 2:00 PM. The operations team wants to automate the creation of a support ticket when this spike occurs. What should they do?

Accepted Answer

Create a Cloud Monitoring alert that sends a notification to a Pub/Sub topic, which triggers a Cloud Function that creates a ticket.. Cloud Monitoring alerts can be configured to send notifications to a Pub/Sub topic when a metric threshold is breached. A Cloud Function subscribed to that topic can then create a support ticket automatically, enabling real-time incident response. Option B is incorrect because a Cloud Function running every minute to check latency would be inefficient and not directly triggered by the metric alert. Option C is incorrect because Cloud Tasks is designed for asynchronous task execution, not for monitoring metrics or alerting. Option D is incorrect because Cloud Scheduler runs jobs on a fixed schedule, not based on real-time metric spikes.

Answer

Create a Cloud Function that runs every minute to check latency and create a ticket.

Answer

Configure Cloud Tasks to periodically query the latency metric and create a ticket.

Answer

Use Cloud Scheduler to run a job that checks latency every hour and creates a ticket if spike is detected.

Question 4

Which THREE of the following are recommended practices for managing secrets in Google Cloud?

Accepted Answer

Enable automatic secret rotation and use short-lived secrets.. Options A, B, and E are correct. A is correct because automatic rotation and short-lived secrets limit exposure. B is correct because Cloud Secret Manager is the recommended service for storing and accessing secrets programmatically. E is correct because granting access using IAM roles (e.g., Secret Manager Secret Accessor) follows the principle of least privilege. Option C is incorrect because storing secrets in Cloud Storage, even encrypted, is less secure than using Secret Manager, which is purpose-built for secret management. Option D is incorrect because embedding secrets as environment variables in source code is a security risk and not a recommended practice.

Answer

Store encrypted secrets in Cloud Storage buckets with uniform bucket-level access.

Answer

Embed secrets as environment variables in source code during deployment.

Question 5

A company is using Cloud Monitoring to track latency of a microservice. They notice a sudden spike in the 99th percentile latency but no change in request count. What is the most likely cause?

Accepted Answer

A single slow query to a backend database. A single slow query to a backend database can increase p99 latency without affecting request count. Other options would affect availability or count.

Answer

A pod restart in GKE

Answer

A misconfigured health check causing 503s

Answer

A DDoS attack

Question 6

Your organization uses Cloud CDN to distribute static content. Recently, users in a specific geographic region are experiencing high latency. What is the most likely cause?

Accepted Answer

There is no CDN edge node in that region. If there is no CDN edge node in that region, traffic must travel directly to the origin, increasing latency.

Answer

The CDN cache has been purged for that region

Answer

The origin server is unhealthy

Answer

The DNS resolution is failing for that region

Question 7

A junior developer created a service account with the roles/storage.admin role and downloaded a JSON key. What is the best practice to improve security?

Accepted Answer

Delete the key and use workload identity federation.. The best practice is to delete the long-lived JSON key and use workload identity federation, which allows resources to assume a service account identity without a key. This eliminates the risk of key leakage or compromise. Option A is correct. Option D (IP allowlists) adds some protection but does not remove the vulnerability of the key itself. Option B (rotation) reduces the exposure window but still uses keys. Option C (user-managed service account) is not relevant.

Answer

Rotate the key every 30 days.

Answer

Use a user-managed service account instead.

Answer

Restrict the key's usage with IP allowlists.

Question 8

Which TWO are benefits of using Cloud Armor with a global external HTTPS Load Balancer?

Accepted Answer

DDoS protection at the edge. Options D and E are correct. Cloud Armor provides DDoS protection at the edge and Web Application Firewall (WAF) rules to filter malicious traffic. Option A (automatic content caching) is a feature of Cloud CDN, not Cloud Armor. Option B (traffic management based on latency) is handled by the load balancer or Cloud CDN, not Cloud Armor. Option C (built-in load balancing) is the function of the load balancer itself, not Cloud Armor.

Answer

Automatic content caching

Answer

Traffic management based on latency

Answer

Built-in load balancing

Question 9

A DevOps team wants to centralize logging and monitoring for a GKE cluster that runs hundreds of microservices. They need to view logs, metrics, and traces in a single dashboard. Which approach should they use?

Accepted Answer

Enable Cloud Logging and Cloud Monitoring for the GKE cluster. Cloud Logging and Cloud Monitoring natively integrate with GKE to provide logs, metrics, and traces in a unified dashboard without additional setup. Option A uses outdated service names (Stackdriver) and the question expects current terminology. Option B involves third-party tools like Splunk or Elastic, which add complexity and lack native GKE integration. Option C (Prometheus and Grafana) requires manual configuration and is not a native Google Cloud solution, making it less suitable for a centralized, fully-managed approach.

Answer

Use Stackdriver Logging and Stackdriver Monitoring

Answer

Use a third-party SIEM tool like Splunk or Elastic

Answer

Deploy Prometheus and Grafana on the cluster

Question 10

Which TWO Google Cloud services are serverless compute platforms that let you run code without managing servers?

Accepted Answer

Cloud Run. Options A and D are correct. Cloud Run and Cloud Functions are serverless compute services that abstract server management. Option B (Compute Engine) is IaaS. Option C (Google Kubernetes Engine) is container orchestration. Option E (App Engine) is also serverless but the question asks for TWO; the most commonly cited serverless compute options are Cloud Functions and Cloud Run.

Answer

Compute Engine

Answer

Google Kubernetes Engine (GKE)

Answer

App Engine

Question 11

A company needs to comply with GDPR requirements for data subject rights. They must be able to provide data subjects with access to their personal data and rectify inaccuracies. Which TWO Google Cloud services can assist with these requirements? (Choose two.)

Accepted Answer

Cloud Data Loss Prevention (Cloud DLP). Cloud DLP can be used to locate and classify personal data across Google Cloud services, helping to fulfill data subject access requests. BigQuery can be used to query and analyze data, allowing retrieval of personal data for access requests. Cloud Audit Logs track access but do not provide data. Cloud Storage is a storage service but does not directly assist with access/rectification. Cloud KMS is for key management.

Answer

Cloud Key Management Service (Cloud KMS)

Answer

Cloud Audit Logs

Answer

Cloud Storage

Question 12

A security team wants to restrict service account key creation in their organization to prevent key-based authentication. They have set the organization policy constraint constraints/iam.disableServiceAccountKeyCreation to True. However, they need to allow a specific project to continue creating keys for legacy applications. Which two steps are required? (Choose two.)

Accepted Answer

Set a folder-level policy to disable the constraint for the folder containing the project.. Setting a folder-level policy to disable the constraint for the folder containing the project allows the organization policy to remain enforced at the org level while creating an exception for the specific folder and its child projects. Option E is correct because the organization policy supports conditions, enabling you to add an exception for a specific project without removing the constraint from the organization level.

Answer

Remove the constraint from the organization level and apply it to all child projects except the legacy one.

Answer

Use a deny policy to block key creation for all projects except the legacy one.

Answer

Create a custom role with iam.serviceAccountKeys.create permission and assign it to the project.

Question 13

A security engineer is configuring VPC Service Controls to protect a service perimeter. Which TWO conditions must be met for a request to be allowed across the perimeter? (Choose TWO.)

Accepted Answer

The request includes a valid access context manager access level.. The correct answers are D and E. A request is allowed across a VPC Service Perimeter if it originates from a project within the perimeter (E) and includes a valid Access Context Manager access level (D). These two conditions are required. Other conditions like allowed domains, IP ranges, or service accounts are not standalone requirements; they are part of access levels or identity-based controls.

Answer

The request is made by an identity that belongs to an allowed domain.

Answer

The request comes from an allowed IP range.

Answer

The request is made by a service account that has been granted access.

Question 14

A GKE cluster runs workloads that need to access Cloud Storage. The security team wants to avoid using service account keys and ensure each pod has a unique identity. What is the best practice?

Accepted Answer

Use Workload Identity: create a Kubernetes service account and bind it to a Google service account.. Workload Identity for GKE binds a Kubernetes service account to a Google service account. Pods that use the KSA automatically authenticate as the GSA without keys. This provides fine-grained pod-level identity. Attaching the GSA to the node is coarse-grained. Using the default compute SA is insecure. Creating keys defeats the purpose.

Answer

Create a service account key and mount it as a secret in each pod.

Answer

Use the default compute engine service account for the cluster.

Answer

Attach a Google service account to the GKE node pool.

Question 15

A security engineer notices that a service account has been granted the 'roles/editor' role on a project. According to least privilege, what is the best course of action?

Accepted Answer

Create a custom role with only the necessary permissions and reassign it to the service account.. Creating a custom role with only the necessary permissions and reassigning it to the service adheres to the principle of least privilege, minimizing permissions while maintaining functionality. Option B is unnecessary as the existing service account can be reused with a custom role. Option C may be too restrictive and could break functionality. Option D does not change permissions; VPC Service Controls restrict network access, not permissions.

Answer

Remove the service account and create a new one with a custom role containing only required permissions.

Answer

Change the role to 'roles/viewer' to be more restrictive.

Answer

Keep the role but add an access boundary using VPC Service Controls.