PCSE Practice Test 41 — 15 Questions

Question 1

A financial institution must store data in specific EU regions to comply with GDPR. They want to prevent users from creating resources in other regions. Which organization policy should they set?

Accepted Answer

Set the `gcp.resourceLocations` constraint at the organization or folder level. The `gcp.resourceLocations` organization policy constraint is the correct mechanism to restrict where resources can be created in Google Cloud. By setting this list constraint at the organization or folder level, you can specify allowed locations (e.g., EU regions), and any attempt to create a resource outside those regions will be denied. This directly enforces GDPR data residency requirements without relying on IAM roles or service-specific configurations.

Answer

Use IAM roles to restrict Compute Engine instance creation

Answer

Create an Assured Workloads folder with EU data boundary

Answer

Configure Cloud KMS key ring location constraint

Question 2

A Security Engineer is designing access controls for a multi-cloud environment where workloads on Google Cloud need to access on-premises databases. The company wants to use long-lived credentials. Which TWO options are valid approaches? (Choose TWO.)

Accepted Answer

Create an OAuth 2.0 client ID for an installed application and use offline access to obtain refresh tokens.. OAuth 2.0 client IDs for installed applications can be configured for offline access, which returns refresh tokens. These refresh tokens are long-lived (typically do not expire unless revoked) and can be used by on-premises applications to obtain new access tokens for accessing Google Cloud APIs without user interaction. This meets the requirement for long-lived credentials in a multi-cloud environment.

Answer

Set up a Cloud VPN tunnel and use private IP addresses to access Google Cloud services.

Answer

Create a service account and use its key to generate short-lived tokens.

Answer

Use Workload Identity Federation to exchange on-premises credentials for Google Cloud tokens.

Question 3

A user should be able to download and delete objects in a specific Cloud Storage bucket. Which two permissions are required in a custom role? (Choose two.)

Accepted Answer

storage.objects.delete. To download an object, the user needs `storage.objects.get` permission, which allows reading the object's data and metadata from the bucket. To delete an object, the user needs `storage.objects.delete` permission, which authorizes the removal of the object from the bucket. These two permissions are the minimum required for download and delete operations on objects within a specific Cloud Storage bucket.

Answer

storage.buckets.list

Answer

storage.buckets.get

Answer

storage.objects.list

Question 4

An organization wants to restrict the creation of service accounts to only certain projects. Which two approaches can achieve this? (Choose two.)

Accepted Answer

Create a custom role with iam.serviceAccounts.create permission and assign it to a group, then use IAM conditions to restrict the resource to specific projects.. Two correct approaches: (B) Create a custom role with the iam.serviceAccounts.create permission and assign it to a group with IAM conditions restricting resource to specific projects, and (D) Use an organization policy with constraint constraints/iam.disableServiceAccountCreation set to True at the org level, then create a folder policy to allow creation in specific folders.

Answer

Use a deny policy to block service account creation in all projects except the allowed ones.

Answer

Grant the roles/iam.serviceAccountAdmin role only to users in the allowed projects.

Answer

Create a separate organization for the allowed projects.

Question 5

A company wants to implement workload identity federation for a GitHub Actions workflow, allowing it to access Google Cloud resources without using service account keys. Which three steps are required? (Choose three.)

Accepted Answer

Create a service account in GCP and grant it the necessary roles.. To implement workload identity federation for GitHub Actions, you need to: create a service account with necessary roles (C), create a workload identity pool and provider for GitHub (D), and configure the GitHub Actions workflow to authenticate using the provider (E). Option A is incorrect because the role `roles/iam.workloadIdentityUser` is granted on the service account, not on the pool. Option B is incorrect because storing a JSON key defeats the purpose of workload identity federation, which avoids using service account keys.

Answer

Grant the service account the roles/iam.workloadIdentityUser role on the workload identity pool.

Answer

Generate a JSON key for the service account and store it as a GitHub secret.

Question 6

A financial institution wants to encrypt data in Cloud Storage using keys that they rotate monthly through Cloud KMS. Which key management option should they use?

Accepted Answer

Customer-Managed Encryption Keys (CMEK). CMEK allows customers to manage and rotate keys in Cloud KMS. Option B (Google-managed encryption keys) does not allow customer rotation. Option C (Default encryption at rest) uses Google-managed keys and cannot be rotated by customers. Option D (CSEK) requires customer-supplied keys per request and does not support rotation.

Answer

Google-managed encryption keys

Answer

Default encryption at rest

Answer

Customer-Supplied Encryption Keys (CSEK)

Question 7

A company uses Cloud Armor to protect their HTTP Load Balancer. They want to block requests from a specific IP range during a DDoS attack. What is the most efficient way to implement this?

Accepted Answer

Update the existing security policy by adding a deny rule for the IP range with priority 1000.. Updating the existing Cloud Armor security policy with a deny rule for the specific IP range is the most efficient method during an active DDoS attack. It allows for immediate blocking without the need to create a new policy or modify attachments. Option A is less efficient as it requires creating a new security policy and attaching it to the backend service, which takes more time and configuration. Option B is incorrect because firewall rules operate at the network layer and cannot block HTTP-level requests handled by the load balancer. Option C is incorrect because Cloud CDN does not provide IP blocking capabilities; it is used for caching content at the edge.

Answer

Create a new Cloud Armor security policy and attach it to the backend service.

Answer

Modify the load balancer's firewall rule to deny traffic from that IP range.

Answer

Use Cloud CDN to cache responses and block the IP at the edge.

Question 8

An organization needs to enforce that all new Cloud Storage buckets are created only in the europe-west1 region to meet data residency requirements. Which method should they use?

Accepted Answer

Configure an organization policy with the constraint gcp.resourceLocations to allow only europe-west1.. Organization policies with the `gcp.resourceLocations` constraint allow you to restrict the physical location of resources at the organization, folder, or project level. This is the correct method because it enforces that all new Cloud Storage buckets (and other supported resources) can only be created in the specified region, meeting data residency requirements without relying on IAM conditions or bucket-level policies.

Answer

Assign the roles/storage.admin IAM role with a condition that restricts region.

Answer

Use Assured Workloads to enforce data residency.

Answer

Define a bucket policy that allows only europe-west1.

Question 9

A healthcare organization ingests patient data into Cloud Storage and then processes it with Dataflow. They need to de-identify sensitive fields like Social Security numbers before storing in BigQuery. Which approach should they use?

Accepted Answer

Use Cloud DLP to inspect and transform the data, then store the de-identified results in BigQuery.. Cloud DLP inspection and transformation jobs can be integrated with BigQuery and Dataflow to de-identify sensitive data before loading into BigQuery. Option A is wrong because BigQuery column-level security with data masking only masks at query time, not at rest. Option B is wrong because writing custom Dataflow transformations is more error-prone, harder to maintain, and reinvents what Cloud DLP already provides. Option D is wrong because Cloud Data Catalog only catalogs metadata but does not transform the data.

Answer

Use BigQuery column-level security with data masking.

Answer

Write custom Dataflow transformations using a Java SDK to redact SSNs.

Answer

Use Cloud Data Catalog to tag sensitive columns and rely on access control.

Question 10

A security engineer needs to restrict outbound traffic from a VPC to only allow specific external IP ranges. Which three components must be configured? (Choose three.)

Accepted Answer

Cloud NAT. To restrict outbound traffic to specific external IP ranges, you need egress firewall rules (E) to define allowed destinations. If instances have no public IPs, you need Cloud NAT (A) to provide outbound internet access while hiding private IPs. To enforce granular filtering or logging, traffic can be routed through a firewall appliance via custom routes (C). Private Google Access (B) is for reaching Google APIs without public IPs, not for restricting external ranges. Firewall rules on instance OS (D) are not a VPC-level component and are not required for this scenario.

Answer

Private Google Access

Answer

Firewall rules on the instance OS

Question 11

A company is implementing GDPR compliance and wants to ensure that personal data is pseudonymized in BigQuery. They plan to use Cloud DLP to tokenize data before loading. Which approach should they take to minimize changes to existing SQL queries?

Accepted Answer

Use Cloud DLP integration with BigQuery via SQL functions like `DLP_TOKENIZE`.. BigQuery has built-in functions like `DLP_TOKENIZE` that can be used in SQL queries to tokenize data on the fly without changing the schema. This allows pseudonymization while preserving the ability to query. Pre-processing with Dataflow would change the way data is stored and require modifications to queries. Using Cloud Functions adds complexity. Cloud KMS does not tokenize.

Answer

Use Cloud Dataflow to tokenize the data during ingestion into BigQuery.

Answer

Use Cloud KMS to encrypt the data at rest.

Answer

Use Cloud Functions to tokenize data after loading into BigQuery.

Question 12

A security engineer is responding to a data breach where an attacker exfiltrated data from a Cloud Storage bucket. Which TWO steps should the engineer take to contain the breach and preserve evidence? (Choose TWO.)

Accepted Answer

Disable the bucket's public access.. Disables public access to stop further exfiltration. Option E creates a forensic copy of the data before any changes. Option B removes policies but may disrupt analysis; option D enables logging after the fact, so it won't capture past events; option C deletes the bucket and destroys evidence.

Answer

Remove the bucket's IAM policies.

Answer

Delete the bucket to prevent further exfiltration.

Answer

Enable Cloud Audit Logs for data access.

Question 13

A company is experiencing high latency on their HTTPS Load Balancer. Which action is most likely to resolve the issue?

Accepted Answer

Verify that the backend instances pass health checks. If backend instances fail health checks, the load balancer will stop sending traffic to them, potentially causing traffic to be routed to fewer healthy instances, leading to increased latency. Verifying health checks is the first step in diagnosing latency issues. Option A is wrong because increasing machine type may improve performance but does not address the root cause if instances are unhealthy. Option C is wrong because SSL policy changes affect encryption protocols, not latency. Option D is wrong while adding more instances can distribute load, it does not solve latency caused by unhealthy backends.

Answer

Increase the machine type of the backend instances

Answer

Modify the SSL policy for the load balancer

Answer

Add more backend instances in additional zones

Question 14

A security engineer needs to audit all administrative actions performed by Google support engineers on their GCP project. Which service provides near-real-time logs of such access?

Accepted Answer

Access Transparency. Access Transparency provides logs when Google personnel access customer content (e.g., support cases, internal troubleshooting). These logs are near-real-time and can be viewed in Cloud Logging. Audit Logs (Cloud Audit Logs) record user API calls, not Google admin access.

Answer

Cloud Audit Logs

Answer

Cloud DLP

Answer

VPC Flow Logs

Question 15

A company is using Cloud SQL for MySQL in production. They notice that during peak hours, query latency increases significantly. The database is running on a db-n1-standard-2 instance with 100GB SSD. The CPU utilization spikes to 95% during peaks. The application uses connection pooling. Which action should the company take to improve performance while minimizing cost?

Accepted Answer

Add a read replica and redirect read queries to it.. Adding a read replica offloads read queries from the primary instance, reducing CPU load and latency, which is the most cost-effective solution. Option A is incorrect because increasing storage improves IOPS but CPU remains the bottleneck. Option C is incorrect because Cloud SQL Proxy provides secure connections, not performance improvement. Option D is incorrect because switching to a highcpu type does not increase CPU count (both have 2 vCPUs) and reduces memory, potentially causing memory pressure.

Answer

Increase the storage to 200GB to improve IOPS.

Answer

Enable Cloud SQL Proxy to cache connections.

Answer

Increase the number of CPUs by switching to a db-n1-highcpu-2 instance.