PCSE Practice Test 43 — 15 Questions

Question 1

A company is implementing a zero-trust network architecture on Google Cloud. They want to ensure that all traffic between their on-premises data center and Google Cloud is encrypted and authenticated. Additionally, they need to support high availability across multiple regions. Which two Google Cloud services should they use? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Interconnect (Dedicated). Cloud VPN provides encrypted tunnels for secure connectivity between on-premises and Google Cloud. Cloud Interconnect (Dedicated) offers dedicated, low-latency, high-availability connections. Combining both allows encryption over Interconnect (via VPN) and supports high availability across multiple regions. Option A is incorrect because Cloud NAT is for outbound-only traffic, not encrypted connectivity. Option B is incorrect because VPC Network Peering connects VPCs within Google Cloud, not to on-premises. Option C is incorrect because Cloud CDN is for content delivery, not network connectivity.

Answer

Cloud NAT

Answer

VPC Network Peering

Answer

Cloud CDN

Question 2

A company uses Cloud Storage buckets to store sensitive data. They want to allow a third-party auditor to list bucket contents but not download the objects. Which IAM role should be assigned?

Accepted Answer

roles/storage.legacyBucketReader. Roles/storage.legacyBucketReader grants permission to list the contents of a bucket (via the storage.buckets.get and storage.objects.list permissions) without allowing object downloads, which require storage.objects.get. This role is specifically designed for scenarios where a user needs to enumerate objects but not read their data, aligning with the auditor's requirement.

Answer

roles/storage.objectAdmin

Answer

roles/storage.objectViewer

Answer

roles/storage.objectCreator

Question 3

A security engineer is reviewing an IAM policy for a Cloud Storage bucket. The engineer wants to ensure that the service account 'sa@project.iam.gserviceaccount.com' can only read objects. What is the current effective permission?

Accepted Answer

The service account has objectViewer access as assigned.. The service account is assigned the objectViewer role, which grants read-only access to objects in the Cloud Storage bucket. Option A is incorrect because objectCreator access is not the default and is not assigned here. Option C is incorrect because the policy is not incomplete; the viewer role is explicitly assigned. Option D is incorrect because objectAdmin access is not granted; the viewer role only allows read actions.

Answer

The service account has objectCreator access by default.

Answer

The service account has no access because the policy is incomplete.

Answer

The service account has objectAdmin access because it is not explicitly denied.

Question 4

Your company runs a data analytics platform on Google Cloud that processes sensitive financial data. Data is ingested from various sources into a Cloud Storage bucket, then processed by Dataflow jobs, and final results are stored in BigQuery. You have implemented the following security controls:
- VPC Service Controls perimeter around the project
- Cloud KMS CMEK for all storage services
- IAM conditions restricting access based on tags
- Cloud Audit Logs enabled for all services

Recently, an auditor discovered that a compromised service account was able to read data from the Cloud Storage bucket even though it was outside the VPC Service Controls perimeter. The auditor reviewed the logs and found that the access came from a Compute Engine instance that was running within the same project. What is the most likely reason the VPC Service Controls perimeter did not block this access?

Accepted Answer

The VPC Service Controls perimeter allows access from resources within the same project, even if they are outside the perimeter.. VPC Service Controls perimeters are designed to prevent data exfiltration by blocking access from networks outside the perimeter, but they explicitly allow access from resources within the same project, even if those resources are not inside the perimeter. In this scenario, the compromised service account was used by a Compute Engine instance running in the same project, so the access was permitted by design. This is a known behavior: VPC Service Controls do not restrict access between resources that share the same Google Cloud project, regardless of whether the requesting resource is inside or outside the perimeter.

Answer

The Cloud KMS key used for encryption was not bound to the perimeter.

Answer

The Cloud Audit Logs were not enabled for the Cloud Storage bucket, so the access was not logged.

Answer

The VPC Service Controls perimeter was not configured to include the Cloud Storage bucket.

Question 5

Which TWO actions help ensure compliance with data residency requirements in Google Cloud? (Choose two.)

Accepted Answer

Configure Organization policy `gcp.resourceLocations` to restrict allowed locations. The `gcp.resourceLocations` Organization policy constraint explicitly defines the set of Google Cloud regions where resources can be created. By configuring this policy, an organization can enforce that all resources are provisioned only in approved geographic locations, directly meeting data residency requirements that mandate data remain within specific jurisdictions.

Answer

Use Cloud CDN to cache content globally

Answer

Enable Cloud Interconnect for dedicated connectivity

Answer

Use Cloud VPN for site-to-site encryption

Question 6

A company is using Cloud Armor to protect their HTTP(S) load balancer. They have configured a security policy with a rule to block traffic from a specific IP address (10.0.0.1/32). During testing, they observe that requests from that IP are still reaching the backend. What is the most likely reason?

Accepted Answer

The security policy is not attached to the backend service.. Cloud Armor security policies must be explicitly attached to a backend service to take effect. If the policy is not attached, the rules within it—including the block rule for 10.0.0.1/32—are not evaluated, and traffic flows to the backend as if no policy exists. This is the most common cause when a configured rule appears to be ignored.

Answer

The backend service is configured to bypass Cloud Armor.

Answer

Cloud Armor does not support blocking specific IP addresses.

Answer

The rule has a lower priority than a default allow rule.

Question 7

A security engineer needs to ensure that sensitive columns in BigQuery are automatically masked for certain users. For example, the email column should show only the domain for users with a specific role. Which two services must be configured together?

Accepted Answer

Data Catalog and BigQuery Data Policy. BigQuery column-level security uses policy tags attached to columns, which are defined in Data Catalog taxonomies. To apply masking, you need to use BigQuery Data Policy (also known as data masking) which uses policy tags to define masking rules. Data Catalog provides the taxonomy for policy tags, while BigQuery Data Policy applies the actual masking. IAM roles for masking are granted via the policy tags.

Answer

Cloud IAM and VPC Service Controls

Answer

Secret Manager and Cloud Functions

Answer

Cloud DLP and Cloud KMS

Question 8

You want to encrypt data in Google Cloud Storage using a key that is managed and stored in a third-party key management system outside of Google Cloud. Which feature should you use?

Accepted Answer

Cloud External Key Manager (Cloud EKM). Cloud EKM allows you to use keys from an external key manager, keeping keys outside Google. Option B (Cloud HSM) stores keys in Google hardware, so it does not meet the requirement. Option C (Default encryption at rest) uses Google-managed keys. Option D (Customer-Supplied Encryption Keys, CSEK) allows you to supply your own keys, but they are stored in Google, not in a third-party KMS. Although CSEK uses customer-supplied keys, the keys are stored inside Google's infrastructure, not in a third-party KMS. Cloud EKM is the only option that keeps keys outside Google Cloud.

Answer

Cloud HSM

Answer

Default encryption at rest

Answer

Customer-Supplied Encryption Keys (CSEK)

Question 9

A company wants to implement automatic de-identification of sensitive data stored in Cloud Storage using Cloud DLP. They need to scan new objects as they are uploaded and apply a transformation to remove credit card numbers. Which three resources must they create? (Choose THREE.)

Accepted Answer

Cloud DLP job that uses the trigger and template. To automatically de-identify sensitive data in Cloud Storage using Cloud DLP, you must create three resources: a Cloud DLP job trigger (C) to initiate the scan when new objects are uploaded, a Cloud DLP de-identification template (E) that specifies the transformation (e.g., removing credit card numbers), and a Cloud DLP job (B) that references both the trigger and the de-identification template. The inspection template (A) is not required because the job can directly specify the infoTypes to inspect in its configuration.

Answer

Cloud DLP inspection template

Answer

Cloud Function to process objects

Question 10

A company needs to enforce data residency in the European Union for all GCP resources. Which TWO actions should they take? (Choose two.)

Accepted Answer

Use Assured Workloads with an EU data boundary. To enforce EU data residency, an organization policy constraint `gcp.resourceLocations` can restrict allowed locations to EU regions. Additionally, Assured Workloads can provide regulatory compliance for EU data boundary. VPC Service Controls prevent data exfiltration but do not enforce residency. Audit Logs and IAM do not restrict locations.

Answer

Create a VPC Service Perimeter that only allows access from EU regions

Answer

Set IAM policies to deny access to non-EU regions

Answer

Enable Cloud Audit Logs to monitor resource creation outside EU

Question 11

A user with this role tries to create a VM instance with a specific machine type and boot disk image. The creation fails due to missing permissions. Which permission is most likely missing?

Accepted Answer

compute.machineTypes.get. When creating a VM instance, the user must have permission to view the machine type definition to verify it exists and is available in the specified zone. The `compute.machineTypes.get` permission is required for this check, and without it, the creation fails even if other permissions are present. This is a prerequisite permission that the Compute Engine API checks before proceeding with instance provisioning.

Answer

compute.networks.use

Answer

compute.images.get

Answer

compute.instances.list

Question 12

An organization wants to enforce that all new Cloud Storage buckets are created with uniform bucket-level access enabled to simplify access control and meet compliance requirements. What Google Cloud service should they use to enforce this?

Accepted Answer

Organization Policies. Organization Policies allow administrators to set constraints on Google Cloud resources at the organization, folder, or project level. The `constraints/storage.uniformBucketLevelAccess` constraint can be applied to enforce that all new Cloud Storage buckets are created with uniform bucket-level access enabled, simplifying access control and meeting compliance requirements.

Answer

VPC Service Controls

Answer

Cloud IAM

Answer

Cloud Armor

Question 13

A company uses Cloud KMS to protect encryption keys for their Cloud SQL databases. They want to rotate keys every 30 days and ensure that old keys are retained for at least 90 days. What is the recommended approach?

Accepted Answer

Use a Cloud KMS key with automatic rotation period of 30 days and disable old key versions after 90 days.. Cloud KMS supports automatic key rotation with a configurable period (e.g., 30 days), which creates new key versions automatically. To meet the 90-day retention requirement, you can disable old key versions after 90 days using the key version lifecycle policy, ensuring they are not used for encryption but remain available for decryption of older data.

Answer

Use a Cloud KMS key with manual rotation every 30 days and keep all key versions indefinitely.

Answer

Use Cloud HSM to generate a key and set key version lifecycle to disable after 90 days.

Answer

Use customer-supplied encryption keys (CSEK) and rotate them manually.

Question 14

A company uses Cloud Functions to process employee data and wants to ensure that personally identifiable information (PII) is redacted from log output. Which approach should they take?

Accepted Answer

Use Cloud DLP API to inspect and redact the log message before writing to Cloud Logging.. The Cloud DLP API can be integrated directly into a Cloud Function to inspect and redact PII from log messages before they are written to Cloud Logging. This ensures that sensitive data never appears in the logs, which is the most secure approach. Using Cloud DLP at the point of log generation prevents any exposure, rather than relying on post-hoc analysis or filtering.

Answer

Use Cloud Audit Logs to capture all access and redact at analysis.

Answer

Create a Logging sink with an exclusion filter to drop logs containing PII.

Answer

Enable VPC Service Controls to prevent PII from leaving the VPC.

Question 15

You are configuring a new VPC network with a private subnet for Compute Engine instances that need to access the internet for updates. Which configuration is the simplest and most secure?

Accepted Answer

Configure Cloud NAT to provide outbound internet access for the instances and create a firewall rule that blocks inbound traffic from the internet.. Cloud NAT allows instances without external IPs to access the internet for outbound connections, while preventing inbound traffic. Option B is correct. Option A is incorrect because a default egress firewall rule that allows all outbound traffic is less secure than using Cloud NAT, which provides controlled outbound access. Option C is incorrect because using a proxy instance adds complexity and a single point of failure. Option D is incorrect because assigning static external IPs to each instance increases the attack surface and is less secure than using Cloud NAT.

Answer

Create a default VPC firewall rule that allows all egress traffic and assign only internal IPs to instances.

Answer

Use a managed instance group with a proxy instance that has an external IP, and route traffic through the proxy.

Answer

Assign static external IP addresses to each instance and configure firewall rules to allow egress.