PCSE Practice Test 39 — 15 Questions

Question 1

A company uses Cloud Armor to protect their HTTP(S) load balancer. They want to block requests from a specific geographic region. Which TWO actions should they take? (Choose 2)

Accepted Answer

Create a security policy with a geo-match condition for the region.. To block requests by geography in Cloud Armor, you create a security policy with a geo-match condition (A) and then attach that policy to the backend service (C), not to the load balancer itself. Option B is incorrect because Cloud CDN geo-restrictions affect caching, not request blocking. Option D is unnecessary; custom headers are not used for geo-blocking. Option E is incorrect because the deny rule should have a higher priority (lower number) than the default rule, not lower.

Answer

Enable Cloud CDN and set geo-restrictions.

Answer

Configure the load balancer to use a custom header for geo-blocking.

Answer

Add a rule in the security policy with deny action and priority lower than the default.

Question 2

A security team needs to enforce that only requests originating from a corporate IP range (203.0.113.0/24) can access a Cloud Storage bucket containing sensitive data. They have created a custom IAM role with storage.objects.get permission and attached a condition that requires the request to have a specific IP address. However, some legitimate users outside the IP range are unable to access the data. What is the most likely cause?

Accepted Answer

The IAM condition evaluates after authentication, and users are already authenticated; the condition is not restricting based on source IP correctly because the condition is on the user's identity, not the request's source IP.. IAM conditions on a custom role binding are evaluated after the user is authenticated and are based on the user's identity attributes (such as the user's email or group membership). To restrict access based on the request's originating IP address, the condition must reference the attribute `request.source.ip`. If the condition instead checks an identity attribute (e.g., `resource.name` or `request.auth`), it will not enforce the IP restriction. As a result, legitimate users outside the corporate IP range are blocked because the condition evaluates something about their identity that they do not satisfy, rather than checking their IP address.

Answer

Users must use a VPN to be assigned a corporate IP, but some are not connected.

Answer

The condition uses the attribute 'request.network' instead of 'source.ip'.

Answer

The bucket ACL is set to deny all access by default.

Question 3

A company uses Assured Workloads to meet FedRAMP High compliance in the US. They need to ensure that data cannot be moved outside the US region. Which control should they use?

Accepted Answer

Configure an organization policy with gcp.resourceLocations as part of the Assured Workloads configuration.. Assured Workloads enforces compliance boundaries through organization policies, and the `gcp.resourceLocations` constraint specifically restricts where Google Cloud resources can be created. By configuring this policy as part of the Assured Workloads configuration, you ensure that all resources are provisioned only within the US region, preventing data from being stored or processed outside that boundary. This directly meets the FedRAMP High requirement to keep data within the US.

Answer

Use VPC Service Controls to prevent data exfiltration.

Answer

Set IAM conditions on all resources to allow only US regions.

Answer

Use Cloud DLP to scan and block data leaving the US.

Question 4

Which THREE Google Cloud services can encrypt data at rest?

Accepted Answer

Cloud Storage. Cloud Storage encrypts data at rest by default using server-side encryption (SSE) with either Google-managed keys or customer-managed keys via Cloud KMS. This ensures that all objects stored in buckets are encrypted before being written to disk, protecting data from unauthorized access at the storage layer.

Answer

Cloud CDN

Answer

Cloud Functions

Question 5

A user is unable to create a Compute Engine instance using a custom image from a family. What is the missing permission?

Accepted Answer

compute.images.use on the image family. To create a Compute Engine instance using a custom image from a family, the user needs the `compute.images.use` permission on the image family (or the specific image). This permission allows the user to use the image as a boot disk for new instances. Without it, the instance creation fails even if the user has `compute.instances.create` on the project.

Answer

compute.disks.create on the project

Answer

compute.instances.create on the project

Answer

compute.images.get on the image family

Question 6

A security engineer needs to ensure that all Compute Engine instances in an organization are created with specific CMEK (Customer-Managed Encryption Key) for disk encryption. The engineer wants to enforce this at the organization level. Which three actions are required? (Choose three.)

Accepted Answer

Create a Cloud KMS key ring and encryption key.. To enforce CMEK use, you need to create a custom organization policy constraint that requires the CMEK key resource name. Enabling CMEK via CSEK is different. The constraint must be applied at the organization level. The key must be created in Cloud KMS. The compute engine API must be enabled for policy enforcement.

Answer

Enable Customer-Supplied Encryption Keys (CSEK) for all instances.

Answer

Ensure the Compute Engine API is disabled for all projects.

Question 7

An organization needs to audit when Google administrators access their customer content stored in GCP. Which service provides near-real-time logs of such access?

Accepted Answer

Access Transparency. Access Transparency provides near-real-time logs when Google staff access customer content, offering visibility into administrative actions.

Answer

VPC Flow Logs

Answer

Cloud Monitoring

Answer

Cloud Audit Logs

Question 8

Which TWO actions should a security engineer take to protect sensitive data in Cloud Storage buckets from accidental public exposure? (Choose two.)

Accepted Answer

Set the organization policy constraint 'iam.disableBucketPolicyOnlyGrantedByDefault' to enforce uniform bucket-level access across the organization.. Setting the organization policy constraint 'iam.disableBucketPolicyOnlyGrantedByDefault' enforces uniform bucket-level access across the organization, preventing the use of fine-grained ACLs that can accidentally expose data. This policy ensures that all new buckets default to IAM-based access control, reducing the risk of misconfigured public ACLs.

Answer

Use Cloud Data Loss Prevention (DLP) to scan buckets for public access.

Answer

Configure VPC Service Controls to restrict access to the buckets from within the VPC.

Answer

Enable bucket lock on all buckets to prevent deletion of objects.

Question 9

Refer to the exhibit. An auditor notices this log entry. Which of the following is true about this event?

Accepted Answer

The service account has the Cloud KMS CryptoKey Decrypter role.. The log entry indicates a successful decryption operation ("decrypt" action with a success status). For a service account to successfully decrypt data using Cloud KMS, it must have the Cloud KMS CryptoKey Decrypter role (roles/cloudkms.cryptoKeyDecrypter) on the key. The log shows the caller is a service account, and the operation succeeded, confirming it has the necessary permissions. Option B correctly identifies this.

Answer

The decryption operation was performed on a key version that is disabled.

Answer

The decryption operation failed due to insufficient permissions.

Answer

The service account used is impersonating a user to decrypt data.

Question 10

A security engineer needs to grant a team the ability to impersonate a service account (SA) in project B from a Compute Engine instance in project A. The SA in project B has the required permissions to access Cloud Storage. What IAM configuration is required?

Accepted Answer

Grant the instance's service account the roles/iam.serviceAccountUser role on the SA in project B, and grant the SA in project B roles/storage.objectViewer.. It combines two necessary steps: first, the instance's service account in project A needs the roles/iam.serviceAccountUser role on the target service account in project B to gain impersonation privileges; second, the target service account in project B must have roles/storage.objectViewer to access Cloud Storage. Without both, the impersonation would either fail (no permission to use the target SA) or the target SA would lack the storage access.

Answer

Grant the instance's service account the roles/iam.serviceAccountTokenCreator role on the SA in project B.

Answer

Create a new service account in project A with the necessary storage permissions and use that.

Answer

Grant the instance's service account the roles/storage.objectViewer role directly.

Question 11

A company uses BigQuery to store sensitive customer data. They want to restrict access to certain columns (e.g., email and SSN) so that only authorized users see the actual values, while other users see a masked version. Which approach should they use?

Accepted Answer

Use BigQuery column-level security with policy tags and data masking rules.. BigQuery column-level security using policy tags and data masking rules allows you to define fine-grained access controls and masking policies on specific columns. This is the recommended approach for column-level access and masking in BigQuery.

Answer

Create separate views for different user groups, each with different column projections.

Answer

Use Cloud Storage signed URLs to grant time-limited access to the data.

Answer

Use Cloud DLP to scan BigQuery tables and create de-identification jobs that permanently mask the data in the table.

Question 12

A company uses Cloud DLP to inspect data in Cloud Storage and BigQuery for sensitive information such as credit card numbers and social security numbers. They want to de-identify the data using format-preserving encryption (FPE) so that the masked data retains the same format (e.g., a 16-digit number still looks like a credit card number). Which two configurations should they use? (Choose TWO).

Accepted Answer

A cryptographic key in Cloud KMS to be used with the FPE transform. CryptoReplaceFfxFpeConfig performs format-preserving encryption (FPE) based on the FFX mode. It can preserve the format of credit card numbers. The transform must be configured with a cryptographic key from Cloud KMS to ensure the encryption is secure. BucketingConfig replaces values with a bucket label, not FPE. MaskingConfig replaces characters with a mask character. DateShiftConfig shifts dates by a random number of days.

Answer

A de-identification template with BucketingConfig

Answer

A de-identification template with DateShiftConfig

Answer

A de-identification template with MaskingConfig

Question 13

A company wants to automatically provision and renew SSL certificates for their HTTPS load balancer. They do not want to manually manage certificate files. Which approach should they use?

Accepted Answer

Create a Google-managed SSL certificate resource.. Google-managed SSL certificates are automatically provisioned, renewed, and managed by Google for load balancers. No manual file uploads are needed.

Answer

Upload a self-managed certificate in PEM format.

Answer

Configure SSL policies to enforce TLS version.

Answer

Use Certificate Manager with a DNS-authorized certificate.

Question 14

An organization uses Azure Active Directory as its identity provider. They want to allow employees to access Google Cloud resources using their Azure credentials without provisioning Google Cloud user accounts. Which solution should they implement?

Accepted Answer

Use Workforce Identity Federation to allow Azure AD users to authenticate to GCP.. Workforce Identity Federation allows external identity providers (like Azure AD) to authenticate users via SAML 2.0 or OIDC and map them to Google Cloud resources without provisioning Google user accounts. This is the correct solution for employees using Azure AD credentials.

Answer

Set up SAML 2.0 federation between Azure AD and Google Cloud using Cloud Identity.

Answer

Create Google Cloud user accounts for all employees and assign IAM roles directly.

Answer

Configure Cloud Directory Sync to synchronize Azure AD users to Google Cloud Directory.

Question 15

An engineer has enabled Private Google Access on the subnet. However, instances in the subnet cannot access Google APIs (e.g., storage.googleapis.com) using their internal IPs. What is the most likely issue?

Accepted Answer

The domain needs to be added to a DNS zone. Private Google Access allows instances without public IPs to reach Google APIs and services using their internal IPs, but it requires that the DNS resolution for the API domain (e.g., storage.googleapis.com) resolves to the private IP range used by Google's Private Access (199.36.153.8/30). If the domain is not added to a private DNS zone (e.g., googleapis.com) in the VPC, DNS will resolve to public IPs, causing connectivity failure. Option B correctly identifies this missing DNS configuration as the most likely issue.

Answer

The instances need a public IP

Answer

Private Google Access requires a VPC connector

Answer

The instances have no route to the default internet gateway