PCSE Practice Test 42 — 15 Questions

Question 1

A global company must store customer data in a specific geographic region to comply with data residency regulations. The database needs strong transactional consistency and low-latency reads worldwide. Which database solution should they choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Cloud Spanner with a multi-region configuration that includes the required region. Cloud Spanner is the ideal choice because it provides strong transactional consistency, horizontal scaling, and multi-region configurations that can include the required geographic region for data residency, while also offering low-latency reads globally through its global distribution. Option B (BigQuery) is for analytics, not transactional workloads. Option C (Cloud SQL with cross-region replication) does not provide the same level of consistency and scalability as Cloud Spanner, and replication may have latency. Option D (Firestore) in multi-region mode offers eventual consistency for some operations, not strong consistency.

Answer

Use BigQuery with a multi-region dataset

Answer

Use Cloud SQL with cross-region replication

Answer

Use Firestore in multi-region mode

Question 2

Refer to the exhibit. A Cloud Run service fails to start and shows the above error. What is the most likely cause?

Accepted Answer

The application is configured to listen on a different port than the one specified by PORT. The error explicitly states the container is not listening on the port defined by PORT. Cloud Run expects the container to bind to the port specified in the PORT env var (default 8080). Option A is wrong; insufficient memory causes different errors. Option B is wrong; the error is about listening, not the variable missing. Option D is wrong; concurrent requests are runtime limits, not startup issues.

Answer

The container requires more memory than allocated

Answer

The PORT environment variable is not defined in the container

Answer

The number of concurrent requests exceeds the container's limit

Question 3

A financial institution is deploying a PCI DSS-compliant cardholder data environment (CDE) on Google Cloud. They need to segment the CDE from other environments and restrict data egress from the CDE. Which two services should they use together? (Choose the best combination.)

Accepted Answer

VPCs and VPC Service Controls. For PCI DSS network segmentation, VPCs provide network isolation, and VPC Service Controls enforce perimeter security by preventing data egress from the CDE to unauthorized destinations. Cloud NAT provides outbound internet access but does not restrict egress. Cloud Armor is a WAF for inbound traffic. Cloud VPN connects on-premises but does not segment.

Answer

Cloud VPN and VPC Service Controls

Answer

VPCs and Cloud NAT

Answer

VPC Service Controls and Cloud Armor

Question 4

A security engineer is configuring Cloud Armor to protect a global external HTTP(S) Load Balancer. Which TWO of the following are valid Cloud Armor security policies? (Choose two.)

Accepted Answer

Preconfigured OWASP Top 10 rules. Cloud Armor includes preconfigured rules that map directly to the OWASP Top 10 web application vulnerabilities, such as SQL injection and cross-site scripting (XSS). These rules are managed by Google and automatically updated to protect against the latest attack patterns, making them a valid security policy for a global external HTTP(S) Load Balancer.

Answer

Web Security Scanner scan rule

Answer

Signed URL policy

Answer

Preconfigured Identity-Aware Proxy (IAP) rule

Question 5

Which THREE of the following are best practices for managing service accounts in Google Cloud?

Accepted Answer

Use the principle of least privilege when granting roles to service accounts.. The principle of least privilege is a fundamental security best practice in Google Cloud IAM. Granting only the minimal roles necessary to a service account reduces the attack surface and limits potential damage from compromised credentials. This aligns with Google's recommended approach for managing identities in cloud environments.

Answer

Assign a single service account to all Compute Engine instances for simplicity.

Answer

Add service accounts to a Google Group to manage permissions.

Question 6

Which TWO of the following are true regarding Cloud Audit Logs?

Accepted Answer

Admin Activity audit logs are enabled by default and cannot be disabled.. Options B and E are correct. Admin Activity audit logs are enabled by default and cannot be disabled. System Event audit logs are also enabled by default and record non-human administrative actions. Option A is incorrect because Data Access audit logs are disabled by default and must be explicitly enabled. Option C is incorrect because Cloud Audit Logs have a default retention period of 400 days, not indefinite. Option D is incorrect because Cloud Audit Logs provide logs, not monitoring metrics for log volume.

Answer

Data Access audit logs are enabled by default for all services.

Answer

Cloud Audit Logs are retained indefinitely unless a retention policy is set.

Answer

Cloud Audit Logs include monitoring metrics for log volume.

Question 7

During a security incident, the forensic team needs to capture the memory and disk state of a compromised Compute Engine VM without shutting it down. The VM is running a critical application and cannot be stopped. What is the best approach to gather forensic data?

Accepted Answer

Use gcloud compute ssh to connect and run a memory capture tool, then create a disk snapshot at the same time.. It allows both memory and disk acquisition without stopping the VM. Using gcloud compute ssh, the forensic team can connect to the VM and run a memory capture tool (e.g., LiME or fmem) to acquire the volatile memory contents. Simultaneously, creating a disk snapshot using gcloud compute disks snapshot captures the persistent disk state, which is crash-consistent but sufficient for forensic analysis. This approach preserves the integrity of the evidence without interrupting the critical application. Option A (cloning) does not capture memory. Option C incorrectly suggests Cloud Memorystore for memory capture, which is not applicable. Option D stops the VM, losing memory state.

Answer

Clone the VM and perform forensics on the clone while the original continues running.

Answer

Take a snapshot of the disk while the VM is running, and use Cloud Memorystore to capture memory.

Answer

Stop the VM, take a snapshot of the disk, and then start the VM.

Question 8

Refer to the exhibit. This IAM policy is applied to a Google Cloud Storage bucket. Alice reports she cannot delete objects in the bucket. Bob can delete objects. What is the most likely reason?

Accepted Answer

Alice has only objectViewer role, which does not allow deletion.. The exhibit shows that Alice has only the roles/storage.objectViewer role, which does not include delete permissions. Bob, although listed in the same binding, must have additional permissions from another policy (e.g., at the project level) that allow him to delete objects. Option A is incorrect because the service account does not affect Bob's permissions. Option B is incorrect; etag is used for concurrent modification prevention, not for permission conflicts. Option C is incorrect because Bob's ability is likely due to inherited permissions, but the exhibit only shows this policy.

Answer

The service account has objectAdmin role, but Bob is not a member.

Answer

The etag mismatch causes a conflict.

Answer

Bob has a higher role inherited from the project level.

Question 9

Refer to the exhibit. A VM in the default network with internal IP 10.128.0.5 is unable to reach a VM at 10.0.0.4 over TCP port 22. What is the most likely cause?

Accepted Answer

The deny-all rule has higher priority than default-allow-internal.. The deny-all rule (priority 2000) has a higher priority (lower number) than the default-allow-internal rule (priority 65534). Since the deny-all rule blocks all TCP traffic from the 10.0.0.0/8 range, it overrides the default-allow-internal rule, blocking SSH traffic from 10.0.0.4 to 10.128.0.5. Option A is incorrect because the deny rule blocks traffic from 10.0.0.0/8, which includes 10.0.0.4, so it does block traffic, but the most likely cause is the priority ordering. Option C is incorrect because the default-allow-internal rule covers all TCP ports, including port 22. Option D is incorrect because there is a rule (default-allow-internal) that allows SSH traffic, but the deny-all rule takes precedence due to higher priority.

Answer

The deny-all rule blocks traffic from 10.0.0.4 to the VM.

Answer

The default-allow-internal rule does not cover port 22.

Answer

There is no rule allowing SSH traffic from 10.0.0.4.

Question 10

A security team needs to centrally manage secrets for multiple Google Cloud projects. Which solution should they use?

Accepted Answer

Use Secret Manager. Secret Manager provides a centralized and secure solution for storing and managing secrets across multiple Google Cloud projects. It supports automatic versioning, fine-grained access control, and secret rotation. Option A is wrong because hardcoding secrets in application code is insecure and makes management difficult. Option B is wrong because Cloud Key Management Service (Cloud KMS) is designed for managing encryption keys, not secrets; although it can encrypt secrets, it does not provide native secret storage or versioning. Option D is wrong because storing secrets in encrypted Cloud Storage buckets lacks built-in secret management features, such as version history, expiration, and audit logging, and requires additional tooling to manage access.

Answer

Hardcode secrets in application code and use IAM with access scopes

Answer

Use Cloud Key Management Service (Cloud KMS) to store and manage secrets

Answer

Store secrets in encrypted Cloud Storage buckets

Question 11

Refer to the exhibit. A developer working from a workstation with IP 203.0.113.5 cannot SSH to a VM in the my-vpc network. Which firewall rule is most likely blocking the connection?

Accepted Answer

deny-ssh-all. The deny-ssh-all rule has a priority of 200 (higher priority than the allow rules at 500 and 1000) and blocks SSH from all IPs. The order in GCP is based on priority (lower number = higher priority), so the deny overrides the allows. The allow-ssh-from-bastion only permits SSH from 10.0.1.2, not the developer's IP.

Answer

allow-ssh-from-bastion

Answer

default-allow-http

Answer

default-allow-ssh

Question 12

Refer to the exhibit. A user tries to create a Compute Engine instance using a custom image from another project. What is the most likely cause of the error?

Accepted Answer

The image family does not exist in the specified project.. The error message explicitly states that the image family does not exist in the specified project. Option A would result in a permission denied error, not this error. Option C is incorrect because if the project ID were wrong, the error would indicate an invalid project. Option D is incorrect because the error specifically mentions the image family, not a misspelling.

Answer

The user does not have permission to use images from the other project.

Answer

The user specified the wrong project ID.

Answer

The image family name is misspelled.

Question 13

A security engineer needs to ensure that all compute instances are patched with the latest security updates. What is the recommended approach?

Accepted Answer

Use the VM Manager patch deployment feature.. The VM Manager patch deployment feature is the recommended approach for automated patching of Compute Engine instances in Google Cloud. It provides a managed, scalable solution for applying OS updates and ensuring compliance.

Answer

Use OS Config Management with patch compliance reporting.

Answer

Use a configuration management tool like Chef.

Answer

Use Cloud Scheduler to run a script that patches instances.

Question 14

Your company runs a production application on Google Kubernetes Engine (GKE) with a Regional cluster. The application uses a custom domain with TLS certificates that are stored as Kubernetes secrets and mounted into the ingress. The certificates expire every 90 days and are currently renewed manually by a DevOps engineer. Last week, the certificate expired, causing an outage until it was renewed. Management requires an automated solution to renew certificates before expiration. The team wants to minimize changes to the existing architecture and avoid additional costs. What should you do?

Accepted Answer

Deploy cert-manager on the GKE cluster and configure it with an Issuer or ClusterIssuer to automatically obtain and renew certificates from Let's Encrypt.. Cert-manager is a native Kubernetes add-on that automates the lifecycle of TLS certificates from public CAs like Let's Encrypt. It integrates directly with GKE Ingress and can handle ACME HTTP-01 or DNS-01 challenges without altering the existing architecture or incurring additional cloud costs, as it runs within the cluster.

Answer

Configure Cloud Load Balancing with a Google-managed SSL certificate and update the DNS to point to the load balancer IP.

Answer

Set up Cloud DNS to automatically respond to ACME HTTP-01 challenges and configure the ingress to use certificates from a public CA.

Answer

Store the certificate and private key in Cloud Secret Manager and configure the ingress to reference the secrets via the Secret Manager CSI driver.

Question 15

An organization has hundreds of Google Cloud projects and wants to enforce a uniform firewall rule that blocks outbound traffic to known malicious IP addresses. They want to centrally manage this rule without manually applying it to each VPC. What should they do?

Accepted Answer

Create a hierarchical firewall rule at the organization or folder level.. Hierarchical firewall rules can be applied at the organization or folder level and are inherited by all VPC networks in the projects under that node, enabling centralized enforcement without manual per-project configuration. Option B is incorrect because Organization Policies are used for constraints like resource locations, not for firewall rules. Option C is incorrect because global VPC firewall rules must still be applied to each VPC network individually. Option D is incorrect because Shared VPC only affects projects that use the shared VPC, not all projects.

Answer

Use Organization Policies to block the IP addresses.

Answer

Create a global VPC firewall rule in each project using Deployment Manager.

Answer

Use Shared VPC and configure firewall rules in the host project.