PCSE Practice Test 40 — 15 Questions

Question 1

A security engineer wants to ensure that no IAM keys are created for service accounts in a Google Cloud organization. Which organization policy constraint should be applied?

Accepted Answer

constraints/iam.disableServiceAccountKeyCreation. The `constraints/iam.disableServiceAccountKeyCreation` organization policy constraint specifically prevents the creation of IAM keys for service accounts, which is exactly what the security engineer needs to enforce. This constraint, when applied at the organization level, blocks all users from creating or uploading service account keys, ensuring that no long-lived credentials are generated for service accounts.

Answer

constraints/compute.restrictCloudArmorPolicies

Answer

constraints/compute.requireShieldedVm

Answer

constraints/iam.allowedPolicyMemberDomains

Question 2

A small startup recently moved their infrastructure to Google Cloud. They have a single project with a few Compute Engine instances running a web application. The security team wants to ensure that all SSH access to the instances is audited and that any failed SSH attempts are alerted in real time. They have enabled OS Login and are using Cloud Identity-Aware Proxy (IAP) for SSH access. However, they are not sure how to capture the audit logs for SSH sessions. What should they do?

Accepted Answer

Enable Data Access audit logs for the IAP service and filter the logs for SSH connection attempts.. IAP TCP forwarding logs are available as Admin Activity audit logs, which can be used to audit SSH connections. Failed SSH attempts can be monitored in real time by setting up log-based alerts on these logs. Option B is incorrect because serial port access logs record output to the serial console, not SSH sessions over IAP. Option C is incorrect because Cloud Monitoring agent metrics are for system metrics, not SSH audit logs. Option D is incorrect because guest attributes are metadata key-value pairs, not for logging SSH attempts.

Answer

Enable Serial Port access logs on the instances to capture SSH sessions.

Answer

Configure Cloud Monitoring to watch for SSH connections via agent metrics.

Answer

Enable guest attributes on the instances to log SSH attempts.

Question 3

A multinational corporation operates multiple Google Cloud projects across several folders. They have a security requirement to enforce that all Cloud Storage buckets are created with uniform bucket-level access enabled and that no bucket has public access. They want to automatically remediate any non-compliant bucket that violates these policies. Currently, they use Organization Policies to enforce uniform bucket-level access, but they still find some buckets with public access due to exceptions. They have Cloud Security Command Center (Cloud SCC) enabled and receive findings about public buckets. The operations team wants to build a solution that automatically disables public access on non-compliant buckets. Which approach should they take?

Accepted Answer

Create a Cloud Security Command Center notification channel for public bucket findings, publish to a Pub/Sub topic, and trigger a Cloud Function that removes public IAM bindings from the bucket.. Cloud Security Command Center can send notifications for public bucket findings to a Pub/Sub topic, which triggers a Cloud Function that automatically removes public IAM bindings from the bucket in real time. Option A is incorrect because Organization Policies can deny public access but cannot retroactively fix buckets already created with exceptions; they apply at resource creation time. Option B is incorrect because Cloud Monitoring alerts are designed for monitoring metrics and logs, not for directly triggering remediation workflows like Cloud Functions. Option D is incorrect because running a scheduled script via Cloud Scheduler is not real-time and may leave buckets exposed between runs.

Answer

Create a new Organization Policy that denies public access to all buckets.

Answer

Configure a Cloud Monitoring alert policy that triggers a webhook to a third-party automation tool.

Answer

Write a script using gsutil and run it daily via Cloud Scheduler to check all buckets and remove public access.

Question 4

Refer to the exhibit. An engineer wants to allow inbound SSH (tcp:22) to a VM with network tag 'ssh-access' in the 'default' VPC. Which firewall rule should they create?

Accepted Answer

Create a new ingress rule allowing tcp:22 from 0.0.0.0/0 to instances with tag 'ssh-access' with priority 1000.. It creates a new ingress firewall rule that explicitly allows inbound TCP port 22 traffic from any source (0.0.0.0/0) only to VM instances that have the network tag 'ssh-access'. In Google Cloud VPC, firewall rules are stateful and apply at the instance level based on target tags; a priority of 1000 ensures this rule is evaluated appropriately relative to higher-priority (lower number) deny rules. This approach preserves the default-allow-ssh rule for other instances while granting SSH access specifically to tagged VMs.

Answer

Remove the 'default-allow-ssh' rule and create a new rule with no target tags.

Answer

Create a new egress rule allowing tcp:22 from instances with tag 'ssh-access' to 0.0.0.0/0.

Answer

Modify the existing 'default-allow-ssh' rule to add a target tag 'ssh-access'.

Question 5

A startup is deploying a containerized application on Google Kubernetes Engine (GKE). The application is stateless and experiences variable traffic patterns, with periodic spikes during promotional events. The startup wants to minimize costs while ensuring the application can handle the variable load without performance degradation. They also prefer to automate scaling as much as possible. Which GKE configuration should they choose?

Accepted Answer

Use a cluster with node auto-provisioning and preemptible nodes.. Node auto-provisioning automatically scales the node pool based on pod resource requests, ensuring the cluster can handle variable traffic spikes without manual intervention. Preemptible nodes are significantly cheaper than regular nodes, reducing costs. This combination meets the startup's requirements for cost minimization and automated scaling. Option A is incorrect because a fixed node pool does not automatically scale to meet variable demand. Option C is incorrect because a single zone may not provide sufficient resources during spikes and regular nodes are more expensive. Option D is incorrect because regional persistent disks are for stateful applications and increase cost.

Answer

Use a cluster with node auto-repair and a fixed node pool.

Answer

Use a cluster with a single zone and regular nodes.

Answer

Use a cluster with regional persistent disks for pods.

Question 6

A company wants to implement least privilege for a service account that needs to read objects from a Cloud Storage bucket and publish messages to a Pub/Sub topic. Which TWO IAM roles should be granted to the service account? (Choose TWO)

Accepted Answer

roles/storage.objectViewer. Roles/storage.objectViewer grants read-only access to objects in Cloud Storage buckets, which is the minimum permission needed for the service account to read objects. This role includes permissions like storage.objects.get and storage.objects.list, allowing the service account to retrieve object data without any write or administrative capabilities.

Answer

roles/pubsub.subscriber

Answer

roles/storage.admin

Answer

roles/pubsub.viewer

Question 7

Refer to the exhibit. A security engineer reviews this IAM policy. Which compliance requirement does this policy help satisfy?

Accepted Answer

Data residency by limiting access to European regions. The IAM policy includes a `Condition` block using `resource.location` to explicitly deny access to any Google Cloud region outside of the specified European regions (europe-west1, europe-west4, etc.). This enforces data residency by ensuring that API calls that would create or modify resources are restricted to approved geographic boundaries, helping satisfy compliance requirements such as GDPR or local data sovereignty laws.

Answer

Key rotation schedule for encryption keys

Answer

Audit logging of data access

Answer

Encryption of data at rest

Question 8

A security team needs to detect and respond to a potential data exfiltration via VPC Flow Logs. They want to identify traffic to known malicious IP addresses in real-time. Which architecture should they use?

Accepted Answer

Create a log sink to send VPC Flow Logs to Pub/Sub, trigger a Cloud Function that checks IP addresses against a threat list and sends alerts.. VPC Flow Logs can be streamed via a log sink to Pub/Sub, then processed by Cloud Functions to compare against a threat feed. BigQuery is for analysis, not real-time. Dataflow could be used but is more complex. Cloud NAT is unrelated.

Answer

Enable VPC Flow Logs and use Dataflow to stream logs to a third-party SIEM.

Answer

Use Cloud NAT to block traffic to malicious IPs based on a predefined list.

Answer

Export VPC Flow Logs to BigQuery and schedule a query every minute to check for matches.

Question 9

A gaming company must comply with the Children's Online Privacy Protection Act (COPPA). They use BigQuery to store user data, including age. They want to automatically classify and restrict access to data of users under 13. Which approach should they take?

Accepted Answer

Use DLP API to inspect BigQuery tables and apply de-identification or restriction policies.. The DLP API can inspect BigQuery tables for sensitive data (like age) and apply de-identification techniques such as masking or tokenization, or set access restrictions based on classification. Option A is wrong because Data Catalog tags only provide metadata, not enforcement; IAM cannot dynamically filter rows based on tag values. Option B is wrong because Cloud Storage is not suitable for structured querying of user data and uniform bucket-level access does not allow row-level filtering. Option D is wrong because VPC Service Controls restrict network-level access but do not inspect data content or enforce row-level restrictions.

Answer

Create a Cloud Data Catalog tag template for age and assign tags to columns, then use IAM to restrict access based on tags.

Answer

Store user data in Cloud Storage with uniform bucket-level access and use IAM to restrict access based on age.

Answer

Use VPC Service Controls to limit access to the BigQuery dataset from only approved IP ranges.

Question 10

A development team uses Cloud Secret Manager to store database credentials for an application running on Compute Engine. The application reads the secret using the Secret Manager API. After the team rotates the secret by adding a new version and setting it as the latest, the application continues to use the old secret version and fails to authenticate. The application is configured to fetch the secret with version 'latest' at startup. The team checks that the Compute Engine service account has the roles/secretmanager.secretAccessor role on the secret. What is the most likely cause of the issue?

Accepted Answer

Enable the new secret version by setting its state to 'enabled' via the Cloud Console, gcloud, or API.. When a new secret version is added via Cloud Secret Manager, it is created in the 'disabled' state by default. Even if it is set as the 'latest' version, the application cannot access it until the version is explicitly enabled. The application fetches the secret using the 'latest' label, which points to the disabled version, causing authentication failure. Enabling the new version resolves the issue.

Answer

Grant the service account the roles/secretmanager.secretAccessor at the project level instead of on the secret resource.

Answer

Update the application to use the specific version ID of the new secret instead of the 'latest' label.

Answer

Add an IAM condition on the secret that restricts access to only the latest version.

Question 11

Refer to the exhibit. A security engineer has created this IAM policy for a Cloud KMS key. The service account my-sa is used by a Compute Engine VM to encrypt data before storing it in Cloud Storage. User alice needs to decrypt the data for analysis. Which statement is true?

Accepted Answer

The service account can encrypt but cannot decrypt.. The IAM policy grants the service account my-sa the Cloud KMS CryptoKey Encrypter role, which allows it to encrypt but not decrypt. User alice is granted the Cloud KMS CryptoKey Decrypter role, which allows her to decrypt but not encrypt. Therefore, the service account can only encrypt, and user alice can only decrypt, making option C correct.

Answer

User alice can both encrypt and decrypt.

Answer

User alice needs the Cloud KMS CryptoKeyEncrypter role to encrypt.

Answer

The service account can both encrypt and decrypt.

Question 12

A healthcare company stores patient data in BigQuery and needs to mask sensitive columns like SSN and email for analysts who do not need to see the actual values. They want to apply consistent masking across queries without modifying the underlying data. Which feature should they use?

Accepted Answer

BigQuery Data Policy with data masking rules. BigQuery Data Policy with data masking rules allows you to define column-level masking policies that automatically redact sensitive data (e.g., SSN, email) in query results based on the user's role, without altering the underlying table. This meets the requirement for consistent masking across all queries without modifying the source data.

Answer

IAM conditions on tables

Answer

Authorized views with row-level security

Answer

Cloud DLP de-identification transforms on export

Question 13

A company has a Cloud Storage bucket containing CSV files with sensitive data. They want to use Cloud DLP to scan the files for personally identifiable information (PII) and automatically redact (replace) any detected credit card numbers before the data is used by downstream analytics. What type of job should they create?

Accepted Answer

De-identification job using a masking transform for credit card numbers.. Cloud DLP's de-identification jobs are designed to automatically transform sensitive data, such as redacting credit card numbers using a masking transform. This job type directly applies the redaction to the CSV files in Cloud Storage without requiring external triggers or custom functions, making it the most efficient and native solution for automated redaction before downstream analytics.

Answer

Inspection job with a Cloud Data Loss Prevention API to call a Cloud Function.

Answer

De-identification job with a bucketing transform.

Answer

Inspection job with a Cloud Pub/Sub notification to trigger a Cloud Function that redacts the data.

Question 14

An organization uses BigQuery with column-level security. They have a column containing social security numbers (SSNs) that should only be visible to users with the 'PII_Viewer' role. How should they configure this?

Accepted Answer

Create a policy tag on the column and bind it to the role.. BigQuery column-level security uses policy tags to restrict access to sensitive columns. By creating a policy tag on the SSN column and binding it to the 'PII_Viewer' role, only users with that role can see the data; others see NULL or are denied access. This is the native, recommended approach for column-level access control in BigQuery.

Answer

Encrypt the column with CMEK and give decrypt permission only to PII_Viewer.

Answer

Use authorized views to filter the column.

Answer

Use BigQuery row-level access policies.

Question 15

An organization wants to allow only specific trusted IP ranges to access a web application behind a Cloud Load Balancer. Which Cloud Armor feature should be used?

Accepted Answer

Custom rules with source IP allow/deny lists. Cloud Armor allows IP allow/deny lists using custom rules. Use a security policy with a rule that allows traffic from specified IP ranges and denies all other traffic.

Answer

Preconfigured rules for OWASP ModSecurity CRS

Answer

Geolocation-based access control

Answer

Adaptive protection