PCSE Practice Test 38 — 15 Questions

Question 1

An administrator wants to enforce that a user can only create virtual machines in a specific subnet of a VPC network. What IAM condition should be added to the compute.instanceAdmin role binding?

Accepted Answer

resource.name == "projects/PROJECT_ID/regions/us-central1/subnetworks/SUBNET". The IAM condition `resource.name` with the full resource name of the subnet (including the region) is the proper way to restrict virtual machine creation to a specific subnet. The `compute.instanceAdmin` role binding with this condition ensures that the user can only create instances whose subnet matches the specified resource name, enforcing the subnet-level constraint.

Answer

resource.name == "projects/PROJECT_ID/subnetworks/SUBNET"

Answer

api.getAttribute("compute.googleapis.com/zone", "") != "us-central1"

Answer

resource.subnetwork == "projects/PROJECT_ID/subnetworks/SUBNET"

Question 2

Your organization has a VPC with several subnets hosting Compute Engine instances. You need to allow SSH access (port 22) to instances in the 'management' subnet from the internet, but only from the office's static IP range (203.0.113.0/24). All other ingress traffic to that subnet should be blocked. Which firewall rule configuration should you create?

Accepted Answer

Create an ingress rule with target tag 'management', source IP range 203.0.113.0/24, protocol tcp:22, action allow. It creates an ingress firewall rule that explicitly allows TCP port 22 traffic from the office's static IP range (203.0.113.0/24) to instances tagged 'management'. In Google Cloud VPC firewall rules, the default action is to deny all ingress traffic unless an allow rule matches, so this single allow rule satisfies the requirement: only SSH from the office IP range is permitted, and all other ingress is implicitly blocked.

Answer

Create an ingress rule with target tag 'management', source IP range 0.0.0.0/0, protocol tcp:22, action allow

Answer

Create an ingress rule with target tag 'management', source IP range 203.0.113.0/24, protocol tcp:22, action deny

Answer

Create an ingress rule with target tag 'management', source IP range 203.0.113.0/24, protocol all, action allow

Question 3

A company has a VPC with a subnet (10.1.0.0/24) in us-central1. They have a Cloud NAT configured for outbound traffic to the internet. They want instances in this subnet to access a third-party API that is only accessible over the internet and requires a specific static source IP for whitelisting. What is the recommended approach?

Accepted Answer

Reserve a static NAT IP in Cloud NAT and whitelist that IP with the third party.. Cloud NAT allows instances without external IPs to initiate outbound connections to the internet. By reserving a static NAT IP address in Cloud NAT, you ensure all outbound traffic from the subnet uses a consistent source IP, which can be whitelisted by the third-party API. This meets the requirement for a static source IP without assigning external IPs to individual instances.

Answer

Assign external IPs to the instances and use network-level access controls.

Answer

Use Private Google Access to route traffic through Google's network.

Answer

Configure a VPC Service Controls perimeter to restrict egress.

Question 4

Refer to the exhibit. A compliance officer is reviewing an Access Transparency log entry. Which compliance benefit does this log provide?

Accepted Answer

It provides evidence of data access by Google engineers. Access Transparency logs are specifically designed to provide visibility into actions performed by Google personnel (e.g., engineers) on customer data. This log entry shows an operation by a Google support engineer, which directly supports compliance requirements by providing evidence of data access by Google engineers, as required for regulatory audits like SOC 2 or FedRAMP.

Answer

It shows a user accessing a storage object

Answer

It tracks encryption key usage

Answer

It is a Cloud Audit Log for admin activity

Question 5

A security administrator wants to ensure that only requests coming through Identity-Aware Proxy (IAP) can access a backend service running on Compute Engine. Which configuration is required?

Accepted Answer

Set firewall rules to allow only traffic from IAP proxy IP ranges.. Identity-Aware Proxy (IAP) uses a fixed set of Google-owned IP ranges to forward authenticated and authorized requests to backend services. By configuring VPC firewall rules to allow ingress only from these IAP proxy IP ranges, the administrator ensures that any traffic not originating from IAP is blocked, effectively restricting access to IAP-authorized requests only.

Answer

Use a VPN between IAP and backend.

Answer

Configure Cloud Armor to block non-IAP traffic.

Answer

Configure the backend service to require IAP credentials.

Question 6

A company has a compliance policy requiring that all data at rest in Cloud Storage be encrypted with a Cloud KMS key that is rotated every 90 days. The company uses CMEK with automatic key rotation enabled. An auditor discovers that some older objects in a bucket were created with a previous key version that has since been disabled. The compliance team requires that all objects be re-encrypted with the current key version. The bucket does not have object versioning enabled. What should the security engineer do to remediate this issue?

Accepted Answer

Use the 'gsutil rewrite -k' command to re-encrypt the objects with the current key version.. The 'gsutil rewrite -k' command re-encrypts existing objects in Cloud Storage with the current Cloud KMS key version, without requiring object versioning or re-uploading. This directly addresses the compliance requirement to re-encrypt all objects with the current key version, even though the old key version is disabled.

Answer

Re-enable the disabled key version in Cloud KMS so that objects can be read with the old key.

Answer

Enable object versioning on the bucket and delete the non-compliant object versions.

Answer

Create a new bucket with default encryption set to the current key and copy objects to it.

Question 7

A healthcare organization is required to protect Protected Health Information (PHI) stored in Cloud Storage. They want to automatically detect and redact PHI before storing it. Which Google Cloud service should they use?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud Data Loss Prevention (DLP) is Google Cloud's purpose-built service for discovering, classifying, and de-identifying sensitive data such as PHI. It provides infoType detectors (e.g., US_HEALTHCARE_NPI, PERSON_NAME) and transformation methods like redaction, masking, tokenization, and format-preserving encryption. DLP integrates natively with Cloud Storage via inspection and de-identification templates, so PHI can be detected and redacted automatically before or during storage.

Answer

Cloud Armor

Answer

VPC Service Controls

Answer

Security Command Center

Question 8

A financial services company is deploying a new payment processing system on Google Cloud that must comply with PCI DSS. The system processes credit card data. The security team has implemented encryption at rest and in transit, and uses Private Google Access for VPC communication. During a PCI assessment, the assessor points out that the company is missing a critical control: the need to regularly scan the external IP addresses of the VMs for vulnerabilities. What should the company do to address this requirement?

Accepted Answer

Set up a third-party vulnerability scanner (e.g., Nessus) from the Cloud Marketplace and run scans against external IPs.. PCI DSS Requirement 11.2 mandates that external-facing IP addresses be scanned for vulnerabilities at least quarterly and after any significant change. Deploying a third-party scanner like Nessus from the Cloud Marketplace allows the company to run authenticated or unauthenticated scans against the external IPs of their VMs, meeting the specific requirement. Google Cloud does not provide a native active vulnerability scanning service for external IPs; Security Command Center Premium and Cloud IDS focus on asset discovery and threat detection, not active scanning of external endpoints.

Answer

Use Security Command Center Premium to perform vulnerability scanning.

Answer

Deploy Cloud IDS to perform active vulnerability scanning on external IPs.

Answer

Enable Cloud Armor to block all traffic and thus eliminate the need for scanning.

Question 9

An organization has hundreds of Google Cloud projects and wants to enforce a uniform firewall rule that blocks outbound traffic to known malicious IP addresses. They want to centrally manage this rule without manually applying it to each VPC. What should they do?

Accepted Answer

Create a hierarchical firewall rule at the organization or folder level.. Hierarchical firewall rules in Google Cloud are defined at the organization or folder level and are inherited by all projects and VPCs beneath them. This allows a single rule to block outbound traffic to known malicious IPs across hundreds of projects without manual per-VPC configuration. Therefore, creating a hierarchical firewall rule at the organization or folder level is correct.

Answer

Use Organization Policies to block the IP addresses.

Answer

Create a global VPC firewall rule in each project using Deployment Manager.

Answer

Use Shared VPC and configure firewall rules in the host project.

Question 10

An engineer needs to schedule automatic rotation of a symmetric key in Cloud KMS every 30 days. The key is currently enabled. What should they do?

Accepted Answer

Set the rotation period on the key via 'gcloud kms keys update'. To schedule automatic rotation of an existing symmetric key in Cloud KMS, you set the rotation period on the key using 'gcloud kms keys update' with the --rotation-period flag. This configures the key to automatically create a new key version at the specified interval (e.g., 30 days).

Answer

Automatic rotation is not supported for symmetric keys

Answer

Set a rotation period via 'gcloud kms keyrings create'

Answer

Manually create a new key version every 30 days using 'gcloud kms keys versions create'

Question 11

Which TWO of the following are valid methods to automate responses to Cloud Security Command Center findings?

Accepted Answer

Create a Cloud Function that is triggered by a Pub/Sub topic receiving SCC notifications.. Option A is correct because Security Command Center can publish findings to a Pub/Sub topic, and a Cloud Function can be configured with a Pub/Sub trigger to execute automated remediation logic whenever a notification arrives. Option D is correct because Eventarc supports Security Command Center as an event source and can route those events to trigger Cloud Run jobs (or services), enabling event-driven automation of responses to findings. Option B is not a valid SCC automation method because Cloud Tasks is a task-queue service for dispatching HTTP/App Engine tasks, not an SCC findings event source or processor. Option C is incorrect because SCC does not send webhooks directly to Cloud Run; findings are delivered via Pub/Sub or Eventarc, not a native webhook push. Option E is not the intended event-driven approach since Cloud Scheduler only performs periodic polling and does not react to SCC findings in real time.

Answer

Set up Cloud Tasks to process SCC findings and send alerts.

Answer

Configure Cloud Run to directly receive webhooks from SCC.

Answer

Use Cloud Scheduler to periodically query SCC and trigger a Cloud Run service.

Question 12

A large healthcare organization is migrating its on-premises data center to Google Cloud. The organization must comply with HIPAA and has signed a BAA with Google Cloud. They plan to use BigQuery for analytics on PHI data. The security team has enabled encryption at rest with CMEK and has configured VPC Service Controls to prevent data exfiltration. During a penetration test, the testers discovered that they could query the BigQuery dataset using a service account that has BigQuery Data Viewer role from a non-VPC-SC-compliant network. This could allow unauthorized access to PHI data. The team needs to restrict all access to the BigQuery dataset to only originate from within the VPC perimeter defined by VPC Service Controls. What should the team do to enforce this requirement?

Accepted Answer

Enable VPC Service Controls perimeters for the BigQuery API and ensure that the project containing the dataset is in the perimeter, and configure ingress/egress rules to allow only requests from within the perimeter.. VPC Service Controls are specifically designed to create a security perimeter around Google Cloud services like BigQuery, preventing data exfiltration and restricting access to only requests originating from within the defined perimeter. By placing the project containing the BigQuery dataset inside the VPC Service Controls perimeter and configuring ingress/egress rules, the team ensures that even a service account with BigQuery Data Viewer role cannot query the dataset from a non-VPC-SC-compliant network, as the API call is blocked at the Google Cloud edge before it reaches BigQuery.

Answer

Set up Private Google Access for the on-premises network and route all traffic through a VPN tunnel.

Answer

Configure an Organization Policy that restricts BigQuery access to only service accounts with a specific prefix.

Answer

Use Cloud IAP to require users to authenticate before accessing BigQuery.

Question 13

A company wants to use Cloud KMS to protect sensitive data. They have a requirement that the key material must be stored in a FIPS 140-2 Level 3 validated HSM. They also need to be able to create and use asymmetric keys for signing. Which two steps should they take? (Choose TWO).

Accepted Answer

Create a key ring in Cloud KMS.. Option B is correct because every Cloud KMS key must reside in a key ring, which is the top-level logical grouping resource that must be created first in a given location before any keys can be created. Option E is correct because the requirement for FIPS 140-2 Level 3 validated HSM-backed key material is satisfied by setting the key's protection level to HSM, and the requirement to create and use asymmetric keys for signing is satisfied by setting the key purpose to ASYMMETRIC_SIGN (which yields asymmetric signing key versions). Option A is wrong because a protection level of software stores key material in software rather than in a validated HSM, failing the FIPS 140-2 Level 3 requirement. Option C is wrong because a symmetric key cannot perform asymmetric signing operations, so it fails the signing requirement. Option D is wrong because key rotation is configured on individual keys (via rotation schedules), not on the key ring, and rotation does not address the HSM or asymmetric-signing requirements.

Answer

Set the protection level of the key to software.

Answer

Create a symmetric key with protection level HSM.

Answer

Enable key rotation on the key ring.

Question 14

Which TWO of the following are valid methods for sending traffic between VPC networks in Google Cloud? (Choose two.)

Accepted Answer

Cloud VPN (HA VPN gateway). Cloud VPN (HA VPN gateway) (C) is correct because it connects two VPC networks over an encrypted IPSec tunnel across the public internet, allowing traffic to flow between them; HA VPN provides a 99.99% SLA with two interfaces and two external IP addresses. VPC Network Peering (E) is correct because it directly connects two VPC networks (in the same or different projects/organizations) using internal IP addresses, with no gateway or public internet involved, and routes are exchanged automatically via peering. Firewall rules (A) only control allowed ingress/egress traffic within or to a VPC; they do not themselves establish connectivity between separate VPC networks. Subnet routes (B) are system-generated routes that enable traffic within a VPC's subnets, not between distinct VPC networks. Cloud NAT (D) provides outbound internet access for instances without external IPs; it does not connect VPC networks to each other.

Answer

Firewall rules in each VPC

Answer

Subnet routes

Answer

Cloud NAT

Question 15

A multi-national corporation must prevent data exfiltration from a project containing PII for GDPR compliance. They want to restrict access to only allow data transfer within the organization. Which Google Cloud service meets this requirement?

Accepted Answer

Create a VPC Service Control perimeter that includes the project and restricts access to other perimeters.. VPC Service Controls allow you to define perimeters that protect the resources and data of Google Cloud services. By creating a perimeter that includes the project containing PII, you can restrict data transfer to only within the organization, preventing exfiltration to external networks or unauthorized identities, which directly meets GDPR compliance requirements.

Answer

Use firewall rules to block all egress traffic except to approved IP ranges.

Answer

Set IAM policies to deny the storage.objectViewer role to non-compliant users.

Answer

Configure Cloud NAT for the VPC to route traffic through a single IP.