PCSE Practice Test 39 — 15 Questions

Question 1

A financial institution must store data in specific EU regions to comply with GDPR. They want to prevent users from creating resources in other regions. Which organization policy should they set?

Accepted Answer

Set the `gcp.resourceLocations` constraint at the organization or folder level. The `gcp.resourceLocations` organization policy constraint is the correct mechanism to restrict where resources can be created in Google Cloud. By setting this list constraint at the organization or folder level, you can specify allowed locations (e.g., EU regions), and any attempt to create a resource outside those regions will be denied. This directly enforces GDPR data residency requirements without relying on IAM roles or service-specific configurations.

Answer

Use IAM roles to restrict Compute Engine instance creation

Answer

Create an Assured Workloads folder with EU data boundary

Answer

Configure Cloud KMS key ring location constraint

Question 2

A security engineer needs to automatically rotate a database password stored in Secret Manager every 60 days. Which approach meets this requirement with minimal operational overhead?

Accepted Answer

Set the rotation period in Secret Manager to 60 days and configure a Pub/Sub topic to trigger a Cloud Function that generates a new password. Secret Manager's rotation feature works by publishing a message to a Pub/Sub topic when the rotation period elapses; the actual password generation and update must be performed by a consumer (typically a Cloud Function or Cloud Run service) that you configure. Option D correctly pairs the 60-day rotation schedule with a Pub/Sub-triggered Cloud Function that generates and writes the new password back to the secret. This is the only option that both schedules rotation and provides the mechanism to actually change the credential, satisfying the requirement with minimal operational overhead since it is fully serverless.

Answer

Set the secret's `next_rotation_time` to 60 days from now; no further action needed

Answer

Enable automatic rotation with a 60-day period in Cloud KMS, which will automatically update the secret

Answer

Use a cron job on Compute Engine to update the secret every 60 days

Question 3

A company has an application running on a Compute Engine VM that needs to call the Cloud Vision API. The security team mandates that no long-lived service account keys be created. They also require that the VM's outbound traffic is not blocked by a firewall rule denying egress to metadata.google.internal. Which approach should the security engineer use?

Accepted Answer

Create a service account, grant it the roles/vision.user role, and attach it to the VM as its service account. Applications on the VM use the metadata server to obtain access tokens automatically.. Attaching a user-managed service account to the VM enables applications to obtain short-lived access tokens from the metadata server, eliminating the need for long-lived keys. Granting the specific role roles/vision.user follows least privilege. The other options either use long-lived keys, rely on the default service account, or use an unsupported authentication method.

Answer

Create a service account, generate a JSON key file, store it on the VM's persistent disk, and set the GOOGLE_APPLICATION_CREDENTIALS environment variable to point to the key file.

Answer

Create a service account and use IAM Conditions to allow access only from the VM's external IP address. The application uses the service account's OAuth 2.0 client ID and secret to authenticate.

Answer

Use the default Compute Engine service account and grant it the roles/vision.user role. Applications will automatically use the default service account's credentials.

Question 4

A security engineer must grant a data-analytics team the ability to run BigQuery jobs in project analytics-prod. The team's members are managed in a Google Group, but several members also need the same capability in project analytics-dev. The engineer wants a single, auditable binding that applies only to BigQuery job execution and nothing else. Which approach should the engineer take?

Accepted Answer

Bind roles/bigquery.jobUser to the Google Group on both projects, and rely on BigQuery dataset-level access controls for data reads.. The team needs only the ability to submit BigQuery jobs in two projects, so a predefined role scoped to job execution is appropriate. Binding the group per project keeps the grant limited to the named projects and keeps membership management centralized in the group. Dataset-level roles remain a separate control plane for data reads, preserving least privilege.

Answer

Bind roles/bigquery.admin to the Google Group on analytics-prod and let the team create a project-level allow policy that delegates to analytics-dev.

Answer

Bind roles/editor to the Google Group on analytics-prod and create a second binding on analytics-dev using roles/editor.

Answer

Bind roles/bigquery.dataViewer to the Google Group at the organization node so the group can run jobs in both projects.

Question 5

A security team wants to enforce that no user in the organization can modify the retention policy on any Cloud Storage bucket, even if they have the storage.buckets.update permission. They need a centralized, organization-wide policy that overrides any allow policies. What should they do?

Accepted Answer

Create an IAM deny policy at the organization level that denies the storage.buckets.update permission on all Cloud Storage buckets.. IAM deny policies are the only mechanism that can explicitly deny a permission and take precedence over allow policies. By applying a deny policy at the organization level for storage.buckets.update on all buckets, the team ensures that even users with that permission via allow policies cannot modify retention policies. This provides a centralized, enforceable control that meets the requirement.

Answer

Use an organization policy constraint to disable the storage.buckets.update permission for all users.

Answer

Assign the Security Reviewer role (roles/iam.securityReviewer) to a group and require all changes to be approved by that group.

Answer

Remove the storage.buckets.update permission from all custom roles and predefined roles that include it.

Question 6

A company uses Google Cloud Directory Sync (GCDS) to synchronize users from an on-premises Active Directory to Cloud Identity. They want to ensure that when an employee is terminated in Active Directory, their Google Cloud access is revoked within 15 minutes. What should they configure?

Accepted Answer

Set the GCDS synchronization schedule to run every 15 minutes and enable 'Suspend user accounts that are not in the LDAP search results'.. GCDS scheduled synchronization with the option to suspend users not present in LDAP ensures that terminated employees are quickly suspended in Cloud Identity. Running the sync every 15 minutes meets the revocation timeline, as suspension immediately invalidates access.

Answer

Use a third-party IdP with SCIM provisioning to automatically deprovision users within 15 minutes.

Answer

Configure SAML SSO with the on-premises AD FS and set the session timeout to 15 minutes.

Answer

Enable Google Cloud's IAM recommender and set it to automatically revoke permissions for inactive users after 15 minutes.

Question 7

A financial services company runs workloads in a Shared VPC host project. A security engineer must let a service account in a service project attach a new VM to a subnet in the host project, but must not allow that service account to modify the subnet or firewall rules. Which combination of grants achieves this?

Accepted Answer

Grant roles/compute.networkUser on the host project subnet and roles/compute.instanceAdmin.v1 on the service project.. In a Shared VPC, network consumption is authorized by roles/compute.networkUser on the host project or a specific subnet, while VM creation is authorized in the service project. Combining the subnet-scoped network role with an instance administration role in the service project satisfies the task without granting subnet or firewall modification rights.

Answer

Grant roles/compute.securityAdmin on the host project and roles/compute.instanceAdmin.v1 on the service project.

Answer

Grant roles/compute.networkAdmin on the host project and roles/compute.viewer on the service project.

Answer

Grant roles/compute.networkUser on the host project and roles/compute.osAdminLogin on the service project.

Question 8

A security team is reviewing IAM policies for a project that hosts a web application on Compute Engine. They want to grant a new service account the ability to write logs to Cloud Logging and publish messages to a Pub/Sub topic. They also want to follow the principle of least privilege. Which two predefined IAM roles should they grant to the service account? (Choose two.)

Accepted Answer

roles/pubsub.publisher. The service account needs to write logs and publish messages. roles/logging.logWriter and roles/pubsub.publisher provide exactly those permissions without granting additional access. Other roles like logging.admin, pubsub.editor, or compute.instanceAdmin.v1 include excessive permissions that are not required, so they should not be granted.

Answer

roles/logging.admin

Answer

roles/compute.instanceAdmin.v1

Answer

roles/pubsub.editor

Question 9

A security engineer needs to grant a service account the ability to read objects from a specific Cloud Storage bucket, but must ensure that the service account cannot delete or overwrite any objects. The service account is used by an application running on Compute Engine. Which IAM role should be granted on the bucket?

Accepted Answer

roles/storage.objectViewer. The Storage Object Viewer role provides read-only access to objects, including the ability to list and get objects, without granting delete or overwrite permissions. This precisely matches the requirement of allowing the service account to read objects from the bucket while preventing any modification. Other roles either grant too much access or lack the necessary read permissions.

Answer

roles/storage.objectCreator

Answer

roles/storage.objectAdmin

Answer

roles/storage.legacyBucketReader

Question 10

A company has an organization policy that requires all service accounts to be created with a specific naming prefix. A security engineer needs to enforce this automatically. What should they do?

Accepted Answer

Create a custom organization policy constraint that validates the service account ID against a regular expression requiring the prefix.. Custom organization policy constraints enable you to enforce specific rules on resource creation using CEL expressions. By defining a constraint that requires the service account ID to match a regex with the prefix, any attempt to create a non-compliant service account is denied. This provides automatic, preventive enforcement at the organization level, which is exactly what the company needs.

Answer

Use IAM Conditions on the iam.serviceAccounts.create permission to require the prefix in the request.

Answer

Set up a Cloud Function triggered by Cloud Audit Logs that deletes any service account that does not have the required prefix.

Answer

Assign the Service Account Admin role only to users who have been trained to follow the naming convention.

Question 11

A platform team is configuring Cloud IAM Conditions to limit when members of a Google Group can act as service accounts. They want the condition to be evaluated reliably and to avoid silently blocking legitimate automation. Which two statements about IAM Conditions are accurate? (Choose two.)

Accepted Answer

Conditions can reference request attributes such as resource.name and resource.type for supported services, and the expression is evaluated at authorization time.. IAM Conditions are CEL expressions evaluated during authorization against request and resource attributes, and they support time-based expiry that disables a binding without removing it. They cannot be attached to basic roles, and a false condition does not create a deny because allow policies remain additive. Organization policy is a distinct control plane.

Answer

Conditions on basic roles such as roles/owner and roles/editor are supported and are the recommended way to time-bound elevated access.

Answer

A binding with a condition that evaluates to false is denied, even if another unconditional binding on the same role would otherwise grant the permission.

Answer

Conditions can be applied to organization policy constraints to restrict which resource names a project may create.

Question 12

A security engineer is configuring IAM policies for a project that hosts sensitive data. They need to ensure that IAM roles are granted according to least privilege and that access is auditable. Which two practices should they follow? (Choose two.)

Accepted Answer

Use predefined roles instead of basic roles like Owner, Editor, Viewer.. To enforce least privilege and maintain auditability, use predefined roles that grant granular permissions instead of basic roles, and enable Cloud Audit Logs to track access. These practices limit permissions to what is necessary and provide visibility into access patterns, enabling detection of over-privileged accounts.

Answer

Grant roles at the project level to simplify management.

Answer

Use service accounts with keys for all applications to ensure consistent access.

Answer

Assign roles to individual users rather than groups for precise control.

Question 13

A security engineer needs to allow a group of data scientists to access BigQuery datasets in a project. The data scientists authenticate with Google Workspace accounts and are members of a Google Group. The engineer wants to grant them the minimum permissions necessary to query data and view dataset metadata, but not to modify or delete datasets. They also want to ensure that if a new data scientist joins the group, they automatically receive access. What should the engineer do?

Accepted Answer

Grant the Google Group the roles/bigquery.dataViewer role on each dataset and the roles/bigquery.jobUser role on the project.. To query data, users need bigquery.jobs.create, provided by roles/bigquery.jobUser. To view data and metadata, they need roles/bigquery.dataViewer on the datasets. This combination grants the least privilege required. Granting to the Google Group ensures automatic access for new members. Other options either lack query permissions or grant excessive modification rights. Thus, the combination of jobUser at project level and dataViewer at dataset level is correct.

Answer

Grant the Google Group the roles/bigquery.dataEditor role on the project.

Answer

Grant the Google Group the roles/bigquery.dataViewer role on the project.

Answer

Grant the Google Group the roles/bigquery.user role on the project.

Question 14

A platform team manages a shared VPC host project. They need to allow a group of network administrators to create and manage firewall rules in the host project, but they must not be able to modify any other network resources. Which IAM role should be granted at the host project level?

Accepted Answer

roles/compute.securityAdmin. The requirement is to allow management of firewall rules only, without the ability to modify other network resources. The Compute Security Admin role provides exactly the permissions needed for firewall rules and no others. Broader roles like Compute Network Admin or Editor would grant excessive permissions, while Instance Admin is unrelated to firewall management.

Answer

roles/compute.instanceAdmin.v1

Answer

roles/editor

Answer

roles/compute.networkAdmin

Question 15

A security administrator is configuring Google Cloud Identity-Aware Proxy (IAP) to protect an internal application running on Compute Engine. They want to ensure that only users from a specific Google Workspace domain and with a specific device posture can access the application. Which two configurations should they implement? (Choose two.)

Accepted Answer

Create an IAM policy on the IAP resource that grants the roles/iap.httpsResourceAccessor role to users in the specified Google Workspace domain.. To allow only users from a specific Google Workspace domain and with a specific device posture to access an IAP-protected application, you must grant the IAP-secured Web App User role to those users and enforce device posture via an Access Context Manager access level applied to the IAP resource. These two configurations together meet both the identity and device requirements.

Answer

Set up a firewall rule to allow traffic only from the corporate network IP ranges.

Answer

Enable Cloud Armor security policy on the backend service to block non-compliant devices.

Answer

Use IAM conditions on the IAP resource to check the device's IP address against a list of corporate IPs.