PCSE Practice Test 4 — 10 Questions

Question 1

A company is using Assured Workloads with the FEDRAMP_HIGH regime. They need to restrict where resources can be created and monitor for compliance violations. Which TWO settings should they configure? (Choose 2)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Resource location restrictions. Option C (Resource location restrictions) is correct because Assured Workloads lets you define the allowed resource locations for a folder, so any attempt to create resources outside the permitted regions is blocked, directly satisfying the requirement to restrict where resources can be created. Option E (Compliance monitoring / drift detection) is correct because Assured Workloads continuously monitors the folder for policy violations and configuration drift against the FEDRAMP_HIGH controls, alerting you to non-compliant changes. Option A (Access Transparency logs) is not one of the two settings that restrict creation locations or detect compliance drift; Access Transparency provides logs of Google personnel access actions and is a separate transparency control. Option B (Data residency controls) is not the correct selection here because Assured Workloads enforces location through resource location restrictions rather than a distinct 'data residency controls' setting. Option D (Google personnel access restrictions) is a personnel/access control (such as Access Approval or support access restrictions) and does not itself restrict resource creation locations or provide drift detection.

Answer

Access Transparency logs

Answer

Data residency controls

Answer

Google personnel access restrictions

Question 2

Drag and drop the steps to configure a VPC Service Controls perimeter in the correct order.

Accepted Answer

Set up an access policy, then define access levels, then create the perimeter, then add ingress/egress rules, then enforce and test. VPC Service Controls perimeters are configured by first setting up an access policy, defining access levels, creating the perimeter, adding ingress/egress rules, and finally enforcing and testing.

Answer

Create the perimeter, then set up an access policy, then define access levels, then add ingress/egress rules, then enforce and test

Answer

Define access levels, then create the perimeter, then set up an access policy, then add ingress/egress rules, then enforce and test

Answer

Set up an access policy, then create the perimeter, then define access levels, then add ingress/egress rules, then enforce and test

Question 3

A multinational organization uses Chronicle SIEM to aggregate and analyze security logs from multiple GCP projects and on-premises systems. The security team wants to detect a known threat pattern: a user authenticating from an anomalous geographic location followed by a large data egress from a Compute Engine instance within 10 minutes. Which three steps are necessary to create this detection? (Choose three.)

Accepted Answer

Ingest Cloud Audit Logs and VPC Flow Logs into Chronicle via forwarders or native integration. Option A is correct because Chronicle detection requires the relevant telemetry in UDM; ingesting Cloud Audit Logs (for authentication events) and VPC Flow Logs (for network egress) via native integration or forwarders provides the raw events the rule will match. Option B is correct because the scenario explicitly includes on-premises systems, so a forwarder must send those authentication logs into Chronicle to correlate them with GCP activity. Option E is correct because YARA-L is Chronicle's detection language, and a rule matching a UDM authentication event with anomalous geo-location followed within 10 minutes by a UDM network event with large bytes out directly implements the described threat pattern. Option C is not needed because BigQuery export is for long-term storage/analysis, not for creating a real-time Chronicle detection. Option D is not needed because Security Command Center findings are a separate GCP security service and do not create the Chronicle YARA-L detection logic.

Answer

Configure a BigQuery export of VPC Flow Logs for long-term analysis

Answer

Enable the Standard tier of Security Command Center to generate finding notifications

Question 4

A user has been granted the role roles/editor on a folder. What is the effective access in the projects within that folder? (Assume no deny policies)

Accepted Answer

Full editor access on all resources in the folder, including projects.. In Google Cloud, IAM roles are inherited from parent resources to child resources. Granting the roles/editor role on a folder automatically applies that role to all projects and resources within the folder, provided there are no deny policies to override it. This means the user has full editor access on all resources in the folder, including the projects themselves and all resources within those projects.

Answer

Editor access on the projects but not on resources within the projects.

Answer

The user must also be granted editor on each project separately.

Answer

Editor access on the folder resource only, not on projects.

Question 5

A security engineer needs to ensure that a Compute Engine VM can securely access Cloud Storage buckets without exposing a public IP address. The VM is in a VPC with Private Google Access enabled. What is the recommended approach?

Accepted Answer

No additional configuration is needed; Private Google Access allows access to Cloud Storage from VMs without external IPs.. Private Google Access enables a VM without an external IP address to reach Google APIs and services, including Cloud Storage, using the VPC's internal IP and Google's private network. Since the VM is in a VPC with Private Google Access enabled, it can securely access Cloud Storage buckets without needing a public IP or additional proxy. No further configuration is required because the traffic stays within Google's network and never traverses the public internet.

Answer

Deploy a Squid proxy in the same VPC and configure the VM to use it for all outbound traffic.

Answer

Assign an external IP to the VM and configure a firewall rule to allow egress to 0.0.0.0/0.

Answer

Configure Cloud NAT and ensure the VM has a route to the internet.

Question 6

Which THREE steps are most effective for troubleshooting a VPC firewall rule issue where desired traffic is being blocked?

Accepted Answer

Check firewall rule logs in Cloud Logging. Option B is correct because VPC firewall rule logging in Cloud Logging records allowed and denied connections with details such as the rule name, direction, and source/destination, which directly reveals whether a firewall rule is blocking the traffic. Option C is correct because Google Cloud firewall rules apply to instances based on matching network tags (targetTags), so if the instance's network tags do not match the rule's target tags, the rule will not be enforced as intended and traffic may be blocked by a default or other rule. Option D is correct because VPC Flow Logs capture IP traffic metadata for the subnet or instance, showing whether packets are reaching the VM and helping distinguish a firewall block from a routing or upstream issue. Option A is not relevant because IAM permissions control API-level access to manage resources, not packet filtering for VM traffic. Option E is not the most effective step here because route tables determine path selection, not firewall rule evaluation; while routing issues can cause connectivity failures, they do not explain a firewall rule blocking desired traffic.

Answer

Check IAM permissions for the VM's service account

Answer

Inspect the route tables for the subnet

Question 7

Which Google Cloud service is specifically designed to help customers meet compliance requirements by creating a folder with pre-defined organization policies, resource location restrictions, and access controls?

Accepted Answer

Assured Workloads. Assured Workloads is Google Cloud's purpose-built service for creating folders pre-configured with compliance controls — including organization policies, resource location restrictions, personnel access controls, and encryption requirements — tailored to specific regimes like FedRAMP, IL4, ITAR, CJIS, and HIPAA. It provisions a folder with these guardrails so workloads inherit compliance posture automatically.

Answer

VPC Service Controls

Answer

Cloud HSM

Answer

Security Command Center

Question 8

A security engineer is configuring VPC Service Controls to protect a Google Cloud project containing sensitive data. The project uses Cloud Storage and BigQuery. The engineer wants to ensure that data cannot be exfiltrated to external IP addresses outside the perimeter, but internal users should still be able to access the data from on-premises via a VPN. Which configuration should be applied?

Accepted Answer

Add the project to a VPC Service Controls perimeter and configure an ingress rule to allow traffic from the on-premises VPN CIDR ranges. VPC Service Controls (VPC-SC) allow you to define a security perimeter around Google Cloud services like Cloud Storage and BigQuery, preventing data exfiltration to external IPs. By adding the project to a perimeter and configuring an ingress rule that permits traffic from the on-premises VPN CIDR ranges, internal users can access the data via VPN while all other external traffic is blocked. This meets the requirement of preventing exfiltration to external IPs while allowing authorized on-premises access.

Answer

Do not use VPC Service Controls; instead, rely on IAM permissions and firewall rules to control access

Answer

Create a separate perimeter that denies all traffic and apply it to the project

Answer

Add the project to a VPC Service Controls perimeter with no additional ingress rules

Question 9

An organization wants to enforce that all new Cloud Storage buckets are created with uniform bucket-level access enabled to simplify access control and meet compliance requirements. What Google Cloud service should they use to enforce this?

Accepted Answer

Organization Policies. Organization Policies allow administrators to set constraints on Google Cloud resources at the organization, folder, or project level. The `constraints/storage.uniformBucketLevelAccess` constraint can be applied to enforce that all new Cloud Storage buckets are created with uniform bucket-level access enabled, simplifying access control and meeting compliance requirements.

Answer

VPC Service Controls

Answer

Cloud IAM

Answer

Cloud Armor

Question 10

A company uses Cloud Data Loss Prevention (DLP) to inspect sensitive data in Cloud Storage. They want to automatically redact credit card numbers found in text files before the files are accessed by downstream applications. Which DLP method should be used?

Accepted Answer

Use the DLP API's `content.deidentify` method with a `PrimitiveTransformation` of `replaceWithInfoType`.. The DLP API's `content.deidentify` method with a `PrimitiveTransformation` of `replaceWithInfoType` is designed to automatically replace sensitive data (like credit card numbers) with their corresponding info type labels (e.g., `[CREDIT_CARD_NUMBER]`) in text files. This method operates on content in memory or from Cloud Storage, enabling automated redaction before downstream access, without requiring a separate job or manual intervention.

Answer

Create a DLP job that uses the InspectJobConfig with a redact transformation.

Answer

Use Cloud DLP's inspect-only functionality and manually redact.

Answer

Set up a DLP inspection scan on the bucket with a `CryptoReplaceFfxFpe` transformation.