PCSE Practice Test 44 — 15 Questions

Question 1

A security engineer needs to ensure that all outbound traffic from a Compute Engine instance to the internet goes through a specific set of IP addresses for auditing. The instance is in a subnet with no external IP addresses. What should the engineer configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud NAT with a reserved external IP address.. Cloud NAT provides outbound internet access for instances without external IPs. By reserving a static external IP for the NAT gateway, all outbound traffic will originate from that IP, satisfying the auditing requirement. This is a managed service that scales automatically and avoids exposing the instance.

Answer

Assign a static external IP to the instance.

Answer

Enable Private Google Access on the subnet.

Answer

Configure a HTTP(S) proxy on a separate instance and route traffic through it.

Question 2

A company has a VPC Service Controls perimeter that includes Cloud Storage and BigQuery. They need to allow a specific on-premises application to access these services using a dedicated Interconnect connection. The on-premises application uses a service account. What should they configure to allow access while maintaining the perimeter?

Accepted Answer

Create an access level that includes the on-premises network's source IP range, and add it to the perimeter's ingress policy.. VPC Service Controls perimeters restrict access to services based on identity and context. To allow on-premises access, create an access level that includes the on-premises IP range and add it to the perimeter's ingress policy. The service account used by the application must also have IAM permissions. This maintains the perimeter while permitting legitimate traffic.

Answer

Configure a Cloud VPN tunnel and add the tunnel's IP to the perimeter's allowed list.

Answer

Use VPC peering between the on-premises network and the VPC, and add the peering to the perimeter.

Answer

Add the on-premises CIDR range to the perimeter's allowed ingress rules.

Question 3

A healthcare company must ensure that no one can delete or shorten the retention of their Cloud Audit Logs for seven years, even a project owner or a compromised org admin. They have created a user-defined log bucket named 'compliance-logs' with a 2555-day retention period at the organization level. Which additional control provides the strongest guarantee against tampering with the logs?

Accepted Answer

Enable a log bucket lock on 'compliance-logs' after confirming the retention period, so the bucket cannot be deleted and retention cannot be reduced.. A log bucket lock is the native Cloud Logging control that makes the retention period permanent and prevents deletion of the bucket for that duration, independent of any IAM permission. Because the lock cannot be reversed once applied, it provides the strongest guarantee against tampering by even highly privileged principals. Identity-based restrictions and unrelated organization policies reduce risk but do not create an immutability boundary, and migrating to Cloud Storage abandons the log bucket rather than protecting it.

Answer

Export the logs to a Cloud Storage bucket with Object Versioning and a Bucket Lock retention policy, and delete the original log bucket.

Answer

Create an organization policy constraint with compute.trustedImageProjects and apply it to all projects that own the log bucket.

Answer

Assign the roles/logging.admin role only to a small break-glass group and enable MFA for those accounts.

Question 4

A startup's security team wants to be notified within one minute whenever a new Security Command Center finding of severity HIGH or CRITICAL is created in any of their projects. They already use Security Command Center Premium and want the least operational effort. What should they do?

Accepted Answer

Create a Pub/Sub topic, configure a Security Command Center notification config to publish findings to that topic, and subscribe a Cloud Function or email endpoint to the topic.. Security Command Center Premium notification configs push new findings to Pub/Sub, where a subscription can fan out to email, Cloud Functions, or ticketing systems. Filtering on severity HIGH or CRITICAL in the config ensures only relevant findings trigger alerts, and delivery is near-real-time. Polling, detector-only reliance, or BigQuery scheduled queries all add latency or operational burden and do not leverage the built-in push mechanism.

Answer

Schedule a Cloud Scheduler job every five minutes that calls the Security Command Center findings API and emails any new HIGH findings.

Answer

Export Security Command Center findings to BigQuery with a continuous export and create a BigQuery scheduled query that emails results.

Answer

Enable the Event Threat Detection detector and rely on its built-in email notifications to the organization's technical contact.

Question 5

A security engineer must ensure that only the production service account can access a Compute Engine VM's SSH port (22) from a specific subnet, while all other traffic is blocked. The VM's VPC has several subnets and firewall rules. Which approach should the engineer use to meet this requirement with least privilege?

Accepted Answer

Create a firewall rule with direction INGRESS, action allow, source service account set to the production service account, target tags set to the VM's network tag, and protocol/port tcp:22.. The correct answer uses a VPC firewall rule with a service account as the source and a target tag to scope the rule to the specific VM. This enforces least privilege by allowing only the production service account to reach TCP port 22. Other options either broaden access to a subnet or the internet, or use the wrong direction, failing the requirement.

Answer

Create a firewall rule with direction INGRESS, action allow, source ranges set to 0.0.0.0/0, target tags set to the VM's network tag, and protocol/port tcp:22, then rely on OS login to restrict access.

Answer

Create a firewall rule with direction EGRESS, action allow, destination service account set to the production service account, target tags set to the VM's network tag, and protocol/port tcp:22.

Answer

Create a firewall rule with direction INGRESS, action allow, source ranges set to the subnet CIDR, target tags set to the VM's network tag, and protocol/port tcp:22.

Question 6

A company uses Cloud VPN to connect its on-premises network to a Google Cloud VPC. The security team wants to ensure that all traffic from on-premises to Google Cloud is encrypted and that the on-premises router can dynamically learn routes from the VPC. They also want to minimize configuration overhead. Which Cloud VPN configuration should they use?

Accepted Answer

HA VPN with Cloud Router using BGP, with two tunnels to two different Google edge availability domains.. HA VPN with Cloud Router using BGP and two tunnels to two different Google edge availability domains provides encrypted traffic, dynamic route exchange, high availability, and minimal configuration overhead. Classic VPN lacks dynamic routing, and a single tunnel does not provide the required redundancy. Partner Interconnect is not a VPN and does not encrypt traffic by default.

Answer

HA VPN with Cloud Router using BGP, but with only one tunnel to a single Google edge availability domain.

Answer

Partner Interconnect with a 10-Gbps attachment and BGP routing.

Answer

Classic VPN with static routing, using a single tunnel and manually configured routes.

Question 7

A company uses Shared VPC. The host project contains a subnet in us-central1. A service project has a VM that needs to reach an on-premises database via Cloud VPN. The security engineer must ensure that the VM's traffic to the on-premises CIDR is allowed and that return traffic is permitted. Which firewall rule should be created in the host project?

Accepted Answer

An EGRESS rule allowing traffic from the VM's service account to the on-premises CIDR, with target service account set to the VM's service account.. In a Shared VPC, firewall rules are defined in the host project and apply to the shared VPC network. The VM in the service project needs to initiate connections to on-premises, so an egress rule targeting the VM's service account and allowing the on-premises CIDR is required. Because firewall rules are stateful, return traffic is automatically allowed, so no ingress rule is needed.

Answer

An EGRESS rule allowing traffic from the VM's service account to 0.0.0.0/0, with target service account set to the VM's service account.

Answer

An INGRESS rule allowing traffic from the on-premises CIDR to the subnet's primary IP range, with target tags set to the VM's network tag.

Answer

An INGRESS rule allowing traffic from the on-premises CIDR to the VM's service account, with target service account set to the VM's service account.

Question 8

A security engineer is configuring Identity-Aware Proxy (IAP) to protect an internal web application running on a Compute Engine instance group. The application should only be accessible to users in the 'security-team@example.com' Google Group, and only from company-managed devices. The engineer has already set up the IAP-secured resource and granted the group the 'IAP-secured Web App User' role. What additional configuration is required to enforce the device policy?

Accepted Answer

Create an access level in Access Context Manager that requires the device to be company-managed, and apply it to the IAP-secured resource via a context-aware access policy.. To enforce device policy with IAP, you must define an access level in Access Context Manager that includes device conditions (such as company-managed device) and then apply that access level to the IAP-secured resource. IAM roles alone only control user authorization; they do not evaluate device posture. Context-aware access bridges identity and device context.

Answer

Enable Cloud Identity Device Policy and sync device inventory to IAP automatically.

Answer

Configure a VPC firewall rule that allows traffic only from the IP addresses of company-managed devices.

Answer

Add the Google Group to an IAM policy with the 'IAP-secured Web App User' role and enable 'Require device approval' in the IAP settings.

Question 9

A company needs to ensure that all Google Cloud audit logs are immutable and cannot be deleted by any user, including administrators, for a period of 7 years. They want a simple, managed solution. What should they do?

Accepted Answer

Create a log sink to a Cloud Storage bucket, and set a bucket retention policy with a retention period of 7 years and a locked retention policy.. The correct solution is to export audit logs to a Cloud Storage bucket with a locked retention policy of 7 years. This ensures immutability and prevents deletion by any user, including administrators. Other options do not provide the required immutability or retention duration. This is a straightforward use of Cloud Storage retention policies.

Answer

Export logs to Cloud Storage, and use Object Lifecycle Management to move objects to Coldline storage after 30 days, with a 7-year retention.

Answer

Use Cloud Logging's default retention and create an organization policy to prevent log deletion.

Answer

Export logs to BigQuery and set a table expiration of 7 years, and grant no delete permissions to users.

Question 10

A company has a Shared VPC setup where the host project contains a VPC network, and service projects contain VM instances. A security engineer needs to create a firewall rule in the host project that allows SSH access from a specific CIDR range to all VM instances in the service projects. The engineer wants to ensure that the rule applies only to instances with a specific network tag. What should the engineer do?

Accepted Answer

Create the firewall rule in the host project with the target tag and source CIDR range.. In a Shared VPC, the host project owns the VPC network and its firewall rules. Service projects use the network but cannot define their own firewall rules for it. Therefore, the rule must be created in the host project. Using a target tag ensures it applies only to instances with that tag, and the source CIDR range restricts access to the specified range.

Answer

Create the firewall rule in the host project with a source service account and target tag.

Answer

Create the firewall rule in each service project with the target tag and source CIDR range.

Answer

Create the firewall rule in the host project with a target service account instead of a tag.

Question 11

A security engineer is configuring a Shared VPC in Google Cloud. The host project contains a subnet named 'prod-subnet' in us-central1 with secondary ranges for GKE pods and services. A service project needs to deploy a GKE cluster that uses this subnet. The engineer must ensure that the GKE cluster's pods can communicate with each other and with services, but no other service project should be able to use this subnet. What should the engineer do?

Accepted Answer

Grant the service project's GKE service account the 'Compute Network User' role on the specific subnet 'prod-subnet' in the host project.. In a Shared VPC, the host project owns the network, and service projects can use subnets if granted the Compute Network User role on those subnets. To restrict usage to a specific subnet, the role must be granted on that subnet, not the host project. This allows the GKE cluster to use the subnet's primary and secondary ranges while preventing other service projects from using it.

Answer

Share the subnet with the service project by using the 'gcloud compute networks subnets update' command with the --shared flag.

Answer

Grant the service project's GKE service account the 'Compute Network User' role on the host project.

Answer

Create a firewall rule in the host project that allows traffic from the service project's GKE pods to the subnet.

Question 12

A company wants to protect its external HTTP(S) load balancer from volumetric DDoS attacks and application-layer attacks. They need to use Google Cloud's advanced DDoS protection and WAF capabilities. Which service should they enable?

Accepted Answer

Cloud Armor with Managed Protection Plus. Cloud Armor with Managed Protection Plus offers advanced DDoS protection and WAF features specifically for external HTTP(S) load balancers. It includes adaptive protection, which detects and mitigates attacks, and it provides WAF rules for application-layer threats. Other options either lack the necessary security features or are not designed for this purpose. Thus, Cloud Armor with Managed Protection Plus is the correct choice.

Answer

Cloud IDS

Answer

VPC firewall rules with hierarchical policies

Answer

Cloud CDN

Question 13

A security engineer is deploying a three-tier web application in a single Google Cloud VPC. The database tier must accept connections only from the application tier on TCP port 5432, and the application tier must accept HTTPS traffic only from the web tier. No other internal traffic should reach these tiers. The engineer wants the rules to remain effective even if new VM instances are added to each tier. What should the engineer do?

Accepted Answer

Create firewall rules that use target service accounts and source service accounts for each tier.. Firewall rules that reference target service accounts and source service accounts enforce access based on workload identity, so newly created instances using the correct service account are covered automatically. This avoids the operational burden and risk of tag or IP-based rules and directly implements least privilege between the web, application, and database tiers.

Answer

Create a single firewall rule allowing all internal traffic and rely on OS-level iptables for tier isolation.

Answer

Create hierarchical firewall policies at the organization level that allow all ingress on ports 443 and 5432.

Answer

Create firewall rules that use target tags and source IP ranges for each tier's subnet.

Question 14

A security engineer is configuring a Shared VPC in Google Cloud. The host project contains a VPC network with subnets, and several service projects are attached. The engineer needs to allow a specific service project's resources to communicate with on-premises systems over a Cloud VPN tunnel that terminates in the host project. The engineer has already created the VPN tunnel and added the on-premises routes to the host project's VPC. However, resources in the service project cannot reach the on-premises network. What is the most likely cause?

Accepted Answer

The service project's resources are not using the Shared VPC network, and instead are using their own default network.. In a Shared VPC, service project resources must be created in a subnet of the host project's shared VPC. If they are instead using the service project's own default network, they will not have access to the VPN tunnel or the routes in the host project's VPC. The engineer should verify that the service project's instances are configured to use the shared subnet and that firewall rules in the host project allow the necessary traffic.

Answer

The Cloud VPN tunnel is not configured with dynamic routing, so it cannot advertise routes to the service project.

Answer

The firewall rules in the host project do not allow ingress from the on-premises IP range to the service project's resources.

Answer

The service project's resources do not have external IP addresses, so they cannot route traffic to the VPN tunnel.

Question 15

A security engineer needs to allow outbound SSH (TCP port 22) from a subnet's Compute Engine instances to a specific external IP range, while denying all other outbound internet traffic. The VPC has a default route to the default internet gateway. Which firewall rule configuration should the engineer use?

Accepted Answer

Create an egress firewall rule with priority 1000, action allow, destination ranges set to the external IP range, and protocol/port tcp:22. Add a lower-priority (higher number) egress rule with action deny, destination 0.0.0.0/0, and protocol all.. Egress firewall rules govern outbound traffic from VM instances. To permit SSH only to a specific external IP range and block all other outbound traffic, the engineer must create an allow egress rule for TCP 22 to that range with a higher priority, and a deny egress rule for all protocols to 0.0.0.0/0 with a lower priority. Ingress rules and hierarchical policies do not fulfill this specific requirement.

Answer

Create an ingress firewall rule with priority 1000, action allow, source ranges set to the external IP range, and protocol/port tcp:22. Add an ingress rule with action deny, source 0.0.0.0/0, protocol all.

Answer

Create an egress firewall rule with priority 1000, action deny, destination ranges set to the external IP range, and protocol/port tcp:22. Add a higher-priority egress rule with action allow, destination 0.0.0.0/0, protocol all.

Answer

Create a hierarchical firewall policy at the organization level with an egress rule allowing tcp:22 to the external range, and rely on the default VPC firewall rules to deny all other egress traffic.