PCSE Practice Test 42 — 15 Questions

Question 1

A security engineer at a financial services company needs to ensure that all VPC Flow Logs and Cloud Audit Logs generated in their Google Cloud organization are retained for seven years and are immutable, even if a project owner attempts to delete them. They also need the ability to prove to auditors that the logs have not been altered. Which combination of Google Cloud services should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a log sink to a Cloud Storage bucket with a retention policy and Bucket Lock, and enable Object Versioning.. A log sink to Cloud Storage with a retention policy and Bucket Lock ensures logs are retained for the required period and cannot be deleted or altered. Object Versioning adds protection against overwrites. Other options lack immutability or sufficient retention duration.

Answer

Store logs in a Cloud Storage bucket with a lifecycle rule to move objects to Coldline storage after 30 days and enable uniform bucket-level access.

Answer

Export logs to BigQuery with a dataset default table expiration set to seven years and enable audit logs for data access.

Answer

Use Cloud Logging's default retention of 30 days and create a log-based metric to alert on deletion attempts.

Question 2

A security engineer needs to grant a service account permission to encrypt and decrypt data using a Cloud KMS symmetric key. The service account is used by an application running on Compute Engine. Which IAM role should be granted on the Cloud KMS key?

Accepted Answer

roles/cloudkms.cryptoKeyEncrypterDecrypter. The `roles/cloudkms.cryptoKeyEncrypterDecrypter` role grants the necessary permissions to both encrypt and decrypt data with a Cloud KMS key. It adheres to the principle of least privilege by not granting key management capabilities. This is the standard role for service accounts that need to perform cryptographic operations with a specific key.

Answer

roles/cloudkms.publicKeyViewer

Answer

roles/cloudkms.cryptoKeyEncrypter

Answer

roles/cloudkms.admin

Question 3

Your organization uses Google Cloud and wants to ensure that all VPC network firewall rule changes are logged for later analysis and alerting. You need to enable the appropriate logging and route the logs to a central project for analysis. What should you do?

Accepted Answer

Ensure Admin Activity audit logs are enabled and create a log sink to a central project's BigQuery dataset.. Admin Activity audit logs capture administrative changes such as firewall rule modifications. They are always enabled and cannot be disabled. To centralize these logs for analysis and alerting, you create a log sink that exports them to a destination like BigQuery in a central project. This approach meets the requirement to log and analyze changes without relying on data access logs or flow logs, which serve different purposes.

Answer

Configure Cloud Audit Logs to log all admin activity and set up a Pub/Sub topic to stream logs to a third-party SIEM.

Answer

Enable Data Access audit logs for Compute Engine API and export logs to a central project.

Answer

Enable VPC Flow Logs on all subnets and export logs to a central Cloud Storage bucket.

Question 4

Your organization uses Google Cloud and wants to ensure that all security-related logs, such as Cloud Audit Logs and VPC Flow Logs, are retained for at least 365 days for compliance. Currently, logs are stored in Cloud Logging's default buckets with a 30-day retention period. You need a solution that automatically exports logs to a cost-effective storage service and allows for easy retrieval if needed. What should you do?

Accepted Answer

Create a log sink that exports logs to a Cloud Storage bucket with a 365-day retention policy, and set the bucket's storage class to Coldline.. A log sink to Cloud Storage with a retention policy and Coldline storage class provides a cost-effective, managed solution for long-term log retention. It ensures logs are automatically exported and retained for the required period, and Coldline storage minimizes costs for infrequently accessed data. This approach is scalable and meets compliance needs.

Answer

Use the Cloud Logging API to programmatically download logs and store them in a Cloud Storage bucket with a lifecycle rule to delete after 365 days.

Answer

Create a log sink that exports logs to a BigQuery dataset with a 365-day partition expiration, and use BigQuery's long-term storage pricing.

Answer

Increase the retention period of the default _Default log bucket to 365 days using the gcloud logging buckets update command.

Question 5

Your security team uses Security Command Center (SCC) Premium. You need to automatically remediate a specific misconfiguration: a Cloud Storage bucket that has public access. When SCC detects this finding, you want to automatically remove the public access. What should you do?

Accepted Answer

Create a Cloud Function that is triggered by a Pub/Sub topic. Configure SCC to publish findings to that topic, and filter for the specific finding type. The function then removes the public IAM policy binding.. To automatically remediate a finding from Security Command Center, you can export findings to Pub/Sub and trigger a Cloud Function. The function can inspect the finding and take corrective action, such as removing public IAM bindings from a Cloud Storage bucket. This event-driven approach ensures timely remediation. SCC does not provide built-in auto-remediation, and periodic scans or VPC Service Controls do not meet the requirement for automatic, immediate response to the specific finding.

Answer

Use SCC's built-in auto-remediation feature to automatically remove public access from the bucket.

Answer

Create a Cloud Scheduler job that periodically scans all buckets for public access and removes it using a script.

Answer

Enable VPC Service Controls to prevent public access to Cloud Storage buckets.

Question 6

A security operations team wants to automatically receive a notification whenever a new high-severity vulnerability finding is created in Security Command Center. They need the notification delivered to a Pub/Sub topic that already exists in the same organization. Which configuration should they use?

Accepted Answer

Create a Pub/Sub notification config in Security Command Center that filters on the HIGH severity and publishes to the existing topic.. Security Command Center notification configs are the native way to publish findings that match a filter to a Pub/Sub topic. By specifying severity=HIGH in the filter and selecting the existing topic, the team gets automatic delivery of new high-severity findings. Other approaches either add unnecessary components or do not deliver the finding payload as required.

Answer

Configure a Cloud Monitoring alerting policy based on the security findings metric and send it to the Pub/Sub topic.

Answer

Use a Cloud Function triggered by a Cloud Storage bucket that stores exported findings, and publish to the topic from the function.

Answer

Create a Cloud Logging sink that routes the Security Command Center findings log to the existing Pub/Sub topic.

Question 7

Your organization uses VPC Service Controls to create a service perimeter around a project containing sensitive BigQuery datasets. You need to allow a specific set of data scientists to access the BigQuery data from outside the perimeter. They use a corporate network with a static IP address range. What should you configure to permit this access?

Accepted Answer

Add the data scientists' user accounts to an access level that includes the corporate IP address range, and apply the access level to the service perimeter.. VPC Service Controls access levels are the mechanism to allow access from specific IP ranges or user identities. By creating an access level that includes the corporate IP range and the data scientists' accounts, and applying it to the perimeter, you permit their access while maintaining the perimeter for all other external traffic. This is the correct way to grant exceptions.

Answer

Add the corporate IP range to the organization policy constraint `constraints/gcp.restrictVpcPeering`.

Answer

Grant the data scientists the `roles/bigquery.dataViewer` role on the dataset.

Answer

Create a firewall rule in the VPC that allows traffic from the corporate IP range to the BigQuery API endpoint.

Question 8

Your organization uses Security Command Center (SCC) Premium across 15 Google Cloud projects managed under a single organization node. A security analyst needs to receive near-real-time alerts in a Slack channel whenever a new HIGH severity finding is created. You want a low-maintenance, serverless approach that does not require managing a Compute Engine instance. What should you do?

Accepted Answer

Create a Pub/Sub topic in the security project, configure an SCC notification config filtered to HIGH severity findings to publish to that topic, and deploy a Cloud Run service subscribed to the topic that posts to Slack.. Security Command Center Premium supports notification configs that publish findings to Pub/Sub with filter expressions. Combining that with a serverless consumer such as Cloud Run provides event-driven, near-real-time delivery without managing infrastructure. Polling, flow logs, or batch exports either add latency, miss the finding data entirely, or require more operational overhead than the native notification path.

Answer

Configure a Cloud Logging log sink that exports SCC findings to a Cloud Storage bucket, then run a Cloud Function triggered by object finalization that parses the file and posts to Slack.

Answer

Enable VPC Flow Logs on all subnets and create a log-based alert that triggers a Cloud Monitoring notification channel configured for Slack.

Answer

Schedule a Cloud Scheduler job every 5 minutes that calls the Security Command Center API to list findings and posts new ones to Slack from a Cloud Function.

Question 9

An application running on Compute Engine needs to authenticate to Google Cloud APIs. The security engineer wants to avoid managing keys. What is the recommended method?

Accepted Answer

Attach a service account to the VM instance and use the metadata server to obtain tokens.. Use the default compute engine service account or a custom service account attached to the VM instance. The VM automatically obtains tokens via the metadata server, no keys required. This is the recommended approach for workloads on Compute Engine.

Answer

Store the service account key in Cloud Secret Manager and retrieve it at boot.

Answer

Create a service account key and store it in the instance's local disk.

Answer

Use workload identity federation to exchange a JWT from the application.

Question 10

A security engineer at a financial services company needs to ensure that all VPC Flow Logs and Cloud Audit Logs generated in their Google Cloud organization are retained for seven years and are immutable, even if a project owner attempts to delete them. They also need the ability to prove to auditors that the logs have not been altered. Which combination of Google Cloud services should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a log sink at the organization level that routes Admin Activity logs to a Cloud Storage bucket with a retention policy and Bucket Lock.. An organization-level log sink centralizes log routing and automatically includes all current and future projects, reducing administrative overhead. Routing Admin Activity logs to a Cloud Storage bucket with Bucket Lock ensures they are retained immutably for the required period, satisfying compliance. This combination provides both minimal configuration effort and strong protection against tampering.

Answer

Create a log sink in each project that routes Admin Activity logs to a centralized Cloud Storage bucket with a retention policy.

Answer

Enable Data Access audit logs for all services at the organization level and export them to BigQuery with a custom retention policy.

Answer

Use Cloud Logging's default retention of 30 days and rely on organization policy constraints to prevent log deletion.

Question 11

Your company has a Google Kubernetes Engine (GKE) cluster with Binary Authorization enabled. You want to ensure that only container images that have been attested by a specific attestor can be deployed. You have already created the attestor and the attestation. What should you do next to enforce this?

Accepted Answer

Add the attestor to the Binary Authorization policy with a requirement that the attestation must be present.. Binary Authorization policies are used to enforce deployment rules. To require attestation by a specific attestor, you must add that attestor to the policy and configure the rule to require attestation. This ensures that only images with a valid attestation from that attestor are admitted. Other options either bypass the requirement, use unnecessary custom code, or do not enforce attestation.

Answer

Use Artifact Registry vulnerability scanning to ensure images are safe and then deploy them.

Answer

Enable the Binary Authorization API and set the default rule to allow all images.

Answer

Create a Kubernetes admission controller webhook that validates the attestation before allowing the pod.

Question 12

Your security team needs to ensure that all Google Cloud resources across your organization are compliant with a set of security policies. You want to use Security Command Center (SCC) to detect violations. Which TWO steps should you take to enable SCC to detect policy violations? (Choose two.)

Accepted Answer

Create custom security health analytics modules to define your specific policies.. To detect policy violations with SCC, you must enable SCC Premium at the organization level to gain organization-wide visibility and advanced detectors. Then, you can create custom security health analytics modules to define your specific policies. Other options like VPC Flow Logs, audit logs, or exporting findings do not directly enable detection of policy violations; they serve different purposes in security monitoring and response.

Answer

Configure SCC to export findings to Pub/Sub for further processing.

Answer

Set up Cloud Audit Logs to log all admin activity and data access.

Answer

Enable VPC Flow Logs for all subnets to capture network traffic.

Question 13

Your organization has a requirement to ensure that all Compute Engine instances have the latest security patches applied within 30 days of release. You want to monitor compliance and receive alerts for non-compliant instances. Which Google Cloud service should you use to achieve this with minimal effort?

Accepted Answer

VM Manager with OS Config and the patch compliance dashboard.. VM Manager with OS Config is the recommended service for patch management and compliance. It allows you to set patch policies, automatically apply patches, and monitor compliance through a dashboard. It also integrates with Cloud Monitoring for alerts. This meets the requirement with minimal effort.

Answer

Cloud Asset Inventory with a custom script to check patch levels.

Answer

Security Command Center with the Vulnerability Assessment scanner.

Answer

Cloud Monitoring with custom metrics from the Ops Agent.

Question 14

Your security team uses VPC Service Controls to protect a sensitive project containing BigQuery datasets. An engineer reports that they can still export BigQuery data to a Cloud Storage bucket in a different project that is inside the same perimeter. You need to block this data exfiltration path while still allowing legitimate analytics jobs. Which configuration change should you make?

Accepted Answer

Create an egress rule on the perimeter that denies the BigQuery service from writing to the Cloud Storage service except for the approved destination project.. VPC Service Controls ingress and egress rules control service-to-service traffic within a perimeter. A deny egress rule from BigQuery to Cloud Storage, with an exception for the approved project, prevents unauthorized export destinations while allowing intended analytics. Access levels, Private Google Access, and bucket-level access settings do not restrict in-perimeter service-to-service data movement, so they cannot close this path.

Answer

Add an access level that restricts access to the engineer's corporate IP range and attach it to the perimeter.

Answer

Apply an organization policy constraint constraints/storage.uniformBucketLevelAccess on the destination project.

Answer

Enable Private Google Access on all subnets in the perimeter so that BigQuery traffic stays on Google's network.

Question 15

A security engineer is configuring VPC Service Controls to protect a project that contains sensitive data in Cloud Storage and BigQuery. They need to allow access from a specific set of on-premises IP addresses while blocking access from all other external networks. Which TWO steps should they take to meet this requirement? (Choose two.)

Accepted Answer

Enable VPC Service Controls on the project and add the project to a service perimeter.. VPC Service Controls create a security perimeter around Google Cloud services, and access levels define the conditions under which access is allowed. To permit only specific on-premises IPs, you must create an access level with those CIDR ranges and apply it to the perimeter. You also need to enable VPC Service Controls and add the project to the perimeter. Together, these steps enforce the desired restriction.

Answer

Set up a Cloud VPN tunnel and route all API traffic through it, then rely on the tunnel's encryption to restrict access.

Answer

Use Cloud Identity-Aware Proxy (IAP) to restrict access to the Cloud Storage and BigQuery APIs from the on-premises network.

Answer

Configure VPC firewall rules to allow traffic only from the on-premises IP addresses to the Cloud Storage and BigQuery APIs.