PCSE Practice Test 43 — 15 Questions

Question 1

A security engineer is configuring a Shared VPC in Google Cloud. The host project contains a subnet named 'prod-subnet' (10.0.1.0/24) in us-central1. A service project has a Compute Engine instance that must communicate with an on-premises database at 192.168.100.0/24 over a Cloud VPN tunnel. The engineer needs to ensure that return traffic from the on-premises database is routed back to the service project instance. What should the engineer do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom static route in the host project with next hop the VPN tunnel and destination 192.168.100.0/24.. In a Shared VPC, the host project owns the VPC network, including subnets, firewall rules, and routes. Service projects use these resources but cannot define their own routes for the shared network. Therefore, to route traffic to on-premises via Cloud VPN, the route must be created in the host project. This ensures proper forward and return traffic paths.

Answer

Create a custom static route in the service project with next hop the VPN tunnel.

Answer

Enable IP forwarding on the service project instance and add a route in the service project.

Answer

Configure a policy-based route in the service project to direct traffic to the VPN tunnel.

Question 2

A security team wants to reduce the risk of compromised service account keys in their Google Cloud organization. They have many workloads running on Compute Engine and GKE that currently use exported JSON keys stored on disk. Which TWO changes should they make to eliminate long-lived credentials while preserving functionality? (Choose two.)

Accepted Answer

Attach user-managed service accounts to Compute Engine instances so applications obtain short-lived tokens from the metadata server.. Eliminating long-lived credentials requires replacing static keys with short-lived tokens. On Compute Engine, attaching a service account lets the metadata server issue tokens. On GKE, Workload Identity Federation maps Kubernetes service accounts to IAM service accounts and issues short-lived tokens. Guardrails, rotation, and secure storage reduce but do not remove the underlying long-lived credential risk.

Answer

Store service account keys in Secret Manager and mount them into containers at runtime.

Answer

Rotate all service account keys every 90 days using Cloud Scheduler and the IAM API.

Answer

Enable organization policy constraints/iam.disableServiceAccountKeyCreation to prevent new keys from being created.

Question 3

An organization uses Cloud IDS in a Shared VPC environment to inspect traffic between the host project and service projects. A security engineer notices that no alerts are appearing for traffic between two service projects. The Cloud IDS endpoint was created in the host project with a packet mirroring policy targeting the host project's subnets. What is the most likely cause?

Accepted Answer

Cloud IDS only inspects traffic that traverses the host project's subnets where packet mirroring is configured, so east-west traffic between service project subnets that bypasses those subnets is not mirrored.. Cloud IDS relies on packet mirroring policies that target specific subnets or instances. In a Shared VPC, an endpoint in the host project only receives mirrored traffic from the resources named in those policies. East-west traffic between service project subnets that is not covered by the mirroring scope is invisible to Cloud IDS, so no alerts are produced until the policy is extended to those subnets or instances.

Answer

The firewall rules between the two service projects are allowing the traffic, so Cloud IDS suppresses alerts for allowed flows.

Answer

Cloud IDS does not support Shared VPC and therefore cannot inspect any traffic in this environment.

Answer

Cloud IDS requires that the endpoint be created in each service project rather than the host project, so no traffic is inspected until endpoints exist in the service projects.

Question 4

A security team needs to ensure that when a Google Cloud service account key is created in any project within the organization, an alert is generated and the key is automatically disabled within 5 minutes. They want a centralized, automated response. What should they do?

Accepted Answer

Create a Cloud Logging log-based alert on the `google.iam.admin.v1.CreateServiceAccountKey` method, and use a Cloud Function triggered by Pub/Sub to disable the key.. The correct solution uses a log-based alert on the service account key creation method, which captures the event in near real-time. The alert publishes to Pub/Sub, triggering a Cloud Function that disables the key via the IAM API. This meets the 5-minute requirement and provides centralized, automated remediation across all projects in the organization. Other options either do not automate disabling, prevent creation entirely, or rely on slower polling.

Answer

Configure an Organization Policy constraint `iam.disableServiceAccountKeyCreation` to prevent the creation of service account keys entirely.

Answer

Use Security Command Center Premium to detect the key creation finding, and create a Security Command Center notification that sends an email to the security team.

Answer

Set up a Cloud Scheduler job that runs every 5 minutes to list all service account keys and disable any newly created ones using the gcloud CLI.

Question 5

A security team is using Cloud Audit Logs to investigate an incident. They need to determine which user deleted a specific Compute Engine instance. The instance was deleted within the last 30 days. Which log type should they query to find this information?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs capture all API calls that modify resource configurations, including the deletion of a Compute Engine instance. They are enabled by default and retained for 400 days, covering the 30-day window. Therefore, querying these logs will reveal the identity of the user who performed the deletion.

Answer

Data Access audit logs

Answer

System Event audit logs

Answer

Policy Denied audit logs

Question 6

A company wants to detect and respond to suspicious network activity in their Google Cloud environment. They need to capture VPC Flow Logs, analyze them for anomalies, and trigger automated responses. They want to minimize operational overhead. What should they do?

Accepted Answer

Enable VPC Flow Logs, export to Pub/Sub, and use a Dataflow job to analyze the logs in real-time, then trigger Cloud Functions for remediation.. The correct approach leverages VPC Flow Logs exported to Pub/Sub, with Dataflow for real-time stream processing to detect anomalies. Dataflow can apply custom logic, and then trigger Cloud Functions for automated remediation. This uses fully managed services, reducing operational overhead, and provides both detection and response. Other options either lack automation, use non-real-time analysis, or rely on tools that do not provide the required flow log analysis and response.

Answer

Use Cloud IDS to monitor traffic, and configure it to automatically block malicious IPs by updating firewall rules.

Answer

Enable VPC Flow Logs, export to BigQuery, and use a scheduled query to detect anomalies, then use a Cloud Function to respond.

Answer

Enable VPC Flow Logs on all subnets, export logs to Cloud Logging, create log-based metrics for specific patterns, and use Alerting policies to notify.

Question 7

A security engineer is configuring a VPC Service Controls perimeter to protect a sensitive BigQuery dataset. They need to allow a specific on-premises application to access the dataset using a VPN connection. The on-premises application uses a service account to authenticate. What should they do to allow this access while keeping the perimeter secure?

Accepted Answer

Create an access level that includes the on-premises IP range and the service account's identity, then add it to the perimeter.. To grant on-premises access to a protected BigQuery dataset, you must create an access level that combines the on-premises IP range and the service account. This access level is then added to the perimeter. This ensures that only requests originating from that network and using that service account are permitted, while all other access is denied. This approach maintains the security posture of the perimeter.

Answer

Configure a private Google access route from the on-premises network to the BigQuery API and add the service account to the perimeter's allowed identities.

Answer

Add the on-premises network's IP range to the perimeter's allowed list using an access level.

Answer

Disable VPC Service Controls for the BigQuery API and rely on IAM permissions for access control.

Question 8

A company is deploying a web application on Compute Engine instances behind an external HTTP(S) load balancer. They want to protect the application from common web attacks such as SQL injection and cross-site scripting, and also mitigate denial-of-service attacks. They need to implement a solution that allows granular control based on request attributes. Which two Google Cloud services should they use? (Choose two.)

Accepted Answer

Google Cloud Armor Adaptive Protection to detect and mitigate application-layer DDoS attacks.. Cloud Armor security policies with preconfigured WAF rules protect against SQL injection and XSS, while Adaptive Protection adds machine learning-based DDoS mitigation. Together, they provide the required application-layer security and granular control. VPC firewall rules, IAP, and Cloud CDN do not offer the necessary WAF or DDoS capabilities for this scenario.

Answer

Cloud Identity-Aware Proxy (IAP) to enforce access control.

Answer

VPC firewall rules to block malicious IP addresses.

Answer

Cloud CDN to cache content and absorb attack traffic.

Question 9

A company needs to grant a security analyst read-only access to all Security Command Center findings across their organization. The analyst should not be able to modify findings or access other resources. Which IAM role should be granted?

Accepted Answer

Security Center Findings Viewer (roles/securitycenter.findingsViewer). The Security Center Findings Viewer role is specifically designed for read-only access to findings. It allows the analyst to view all findings across the organization without the ability to modify them or access unrelated resources. This aligns with the principle of least privilege, making it the correct choice.

Answer

Security Reviewer (roles/iam.securityReviewer)

Answer

Security Center Findings Editor (roles/securitycenter.findingsEditor)

Answer

Security Center Admin (roles/securitycenter.admin)

Question 10

A company is deploying a VPC Service Controls perimeter to protect sensitive data in BigQuery and Cloud Storage. They need to allow a specific on-premises application to access these services through a Cloud VPN tunnel. The application runs on a server with IP 198.51.100.10. Which two configurations are required to permit this access while maintaining the perimeter? (Choose two.)

Accepted Answer

Add an ingress rule to the perimeter that allows the on-premises IP range to access BigQuery and Cloud Storage.. To allow an on-premises application through a VPC Service Controls perimeter, you must define an access level with the on-premises IP range and add an ingress rule that permits that access level to reach the protected services. These two configurations work together to authorize the specific external source while keeping the perimeter intact.

Answer

Set up a Cloud NAT gateway to translate the on-premises IP to a private IP.

Answer

Enable Private Google Access on the subnet used by the Cloud VPN tunnel.

Answer

Configure a VPC firewall rule to allow traffic from 198.51.100.0/24 to the Google APIs.

Question 11

A security operations team is building a centralized logging architecture. They want to export audit logs from all projects in the organization to a single destination for long-term retention and analysis, and they need to ensure that log data cannot be modified or deleted by project-level administrators. Which two actions should they take? (Choose two.)

Accepted Answer

Apply a retention lock or Bucket Lock on the destination Cloud Storage bucket to enforce a retention policy.. An organization-level log sink aggregates audit logs from every project into one destination, eliminating per-project configuration drift. Bucket Lock on the destination Cloud Storage bucket makes the retention policy permanent so that even project owners cannot delete or alter exported log objects before the retention period ends. Together these provide centralized, tamper-resistant log retention for the security operations team.

Answer

Grant the roles/logging.admin role to the security operations team at the organization level.

Answer

Create per-project log sinks in each of the organization's projects and route them to the same destination.

Answer

Enable Data Access audit logs for all services at the organization level.

Question 12

A security team wants to ensure that all Compute Engine instances in their organization have the latest OS patches applied. They want to automate the process and receive reports on compliance status. They also want to minimize the risk of patches breaking applications. What should they do?

Accepted Answer

Use the OS Config patch management feature to create patch jobs with a rollout plan that includes a canary stage and automatic pause if failures occur.. OS Config patch management provides automated patching with rollout plans that can include canary stages and failure thresholds. It also offers compliance reporting. This satisfies the need for automation, risk mitigation, and visibility into patch status across the organization.

Answer

Configure a cron job on each instance that runs apt-get update && apt-get upgrade nightly.

Answer

Use Deployment Manager to update instance templates with a new image that includes patches, then perform a rolling update.

Answer

Enable automatic OS updates in the instance metadata and set a maintenance window.

Question 13

A security analyst needs to review all administrative activity performed on Compute Engine resources in a Google Cloud project over the last 30 days. The project has default audit log configuration. Which log should the analyst query?

Accepted Answer

Admin Activity audit logs in Cloud Logging.. Admin Activity audit logs are always enabled, retained for 400 days by default, and capture every API call that modifies resource configuration or metadata. Compute Engine instance creation, deletion, and metadata changes all appear there with caller identity and request details. Querying these logs in Cloud Logging gives the analyst the complete administrative history for the last 30 days without any additional enablement.

Answer

Data Access audit logs in Cloud Logging.

Answer

Cloud NAT logging for the project.

Answer

VPC Flow Logs for the project's subnets.

Question 14

Your security team wants to detect when a service account key is created for any project in the organization and immediately disable that key. You need a solution that reacts in near real time and requires the least custom code. Which approach should you take?

Accepted Answer

Create a Cloud Logging log sink with a filter for the CreateServiceAccountKey method, route it to Pub/Sub, and attach a Cloud Function that calls the IAM API to disable the key.. A log sink filtered on the CreateServiceAccountKey method delivers matching Admin Activity audit entries to Pub/Sub, where a Cloud Function can parse the new key's resource name and call the IAM API to disable it. This combines Google Cloud's native log routing with a minimal function, achieving near-real-time automated remediation without building a custom pipeline or relying on human response.

Answer

Create a log-based alerting policy in Cloud Monitoring on the audit log metric for google.iam.admin.v1.CreateServiceAccountKey, with a notification channel to the security team.

Answer

Configure an IAM deny policy on the organization that denies iam.serviceAccountKeys.create for all principals.

Answer

Enable Organization Policy constraints/iam.disableServiceAccountKeyCreation at the organization node.

Question 15

A security engineer manages a Shared VPC in Google Cloud. A team in a service project runs a three-tier web application on Compute Engine. The security team requires that instances in the web tier can receive HTTP/HTTPS traffic from the internet, but the database tier must only accept connections from the web tier on TCP port 5432. All instances are in the same Shared VPC network, and each tier is identified by a network tag. Which configuration should the engineer implement to meet these requirements?

Accepted Answer

Create two ingress firewall rules: one allowing tcp:80,443 from 0.0.0.0/0 to the web tier tag, and one allowing tcp:5432 from the web tier tag to the database tier tag. No egress rules are needed.. VPC firewall rules are stateful, so return traffic for allowed connections is automatically permitted. To let the web tier receive internet traffic, an ingress rule allowing tcp:80,443 from 0.0.0.0/0 to the web tier tag is needed. To restrict database access, an ingress rule allowing tcp:5432 only from the web tier tag to the database tier tag is needed. Egress rules are unnecessary because the database tier does not initiate outbound connections.

Answer

Create two egress firewall rules: one allowing tcp:80,443 from the web tier tag to 0.0.0.0/0, and one allowing tcp:5432 from the database tier tag to the web tier tag. No ingress rules are needed.

Answer

Create a hierarchical firewall policy at the organization level that allows tcp:80,443 and tcp:5432, and apply it to the Shared VPC host project. Use IAM to restrict which service accounts can connect to the database.

Answer

Create a single ingress firewall rule allowing tcp:80,443,5432 from 0.0.0.0/0 to all instances in the Shared VPC, and rely on network tags to limit access.