PCSE Practice Test 44 — 15 Questions

Question 1

A company uses Cloud SQL for MySQL and needs to automate the rotation of database user passwords every 30 days. They want to store the passwords in Secret Manager and have the application retrieve them at runtime. The application runs on Compute Engine. What is the most secure way to allow the Compute Engine instances to access the secrets?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach a service account to the Compute Engine instances with the role roles/secretmanager.secretAccessor, and grant that service account access to the specific secret versions.. It follows the principle of least privilege by attaching a service account with the roles/secretmanager.secretAccessor role directly to the Compute Engine instances and granting that service account access only to the specific secret versions needed. This ensures that the instances can authenticate via the default service account metadata server (using OAuth 2.0 tokens) without exposing any long-lived credentials, and the access is scoped to exactly the secrets required for password rotation.

Answer

Grant the roles/secretmanager.secretAccessor role to all service accounts in the project.

Answer

Create a service account key for a dedicated service account, download it to the instance, and use it to access the secret.

Answer

Store the password in instance metadata and have the application read it from the metadata server.

Question 2

A company wants to automate patching of operating system vulnerabilities on their Compute Engine instances. They need a solution that supports both Windows and Linux and can schedule patch deployments with rolling updates. Which service should they use?

Accepted Answer

VM Manager. VM Manager is the OS management service that includes patch management. It supports both Windows and Linux, allows scheduling, and can perform rolling updates. OS Config Management and Cloud Scheduler are not patch management solutions.

Answer

OS Config Management

Answer

Cloud Scheduler

Answer

Deployment Manager

Question 3

A security engineer wants to monitor all actions that create or modify resources in a Google Cloud project. Which type of audit log is enabled by default and cannot be disabled?

Accepted Answer

Admin Activity logs. Admin Activity logs record all API calls that modify configuration or metadata. They are enabled by default and cannot be disabled. Data Access logs are opt-in, System Event logs are enabled by default but cannot be disabled either, and Policy Denied logs are generated when access is denied by IAM policies.

Answer

Policy Denied logs

Answer

Data Access logs

Answer

System Event logs

Question 4

A developer wants to be notified when a new vulnerability is found in a container image stored in Artifact Registry. Which service should they configure?

Accepted Answer

Container Analysis. Artifact Registry integrates with Container Analysis to scan images for vulnerabilities. Notifications can be sent via Pub/Sub when new vulnerabilities are discovered.

Answer

Cloud Security Scanner

Answer

Binary Authorization

Answer

VM Manager

Question 5

Your organization uses VM Manager for patch management. You need to configure patch deployments to run weekly on all Windows VMs. Which two resources must be configured? (Choose two.)

Accepted Answer

Create a patch deployment with a weekly schedule. VM Manager uses patch deployments and patch jobs. You create a patch deployment with a schedule (weekly) and target VMs (e.g., by OS type). You also need to configure a maintenance window or use a rolling update.

Answer

Enable VPC Flow Logs on the VMs

Answer

Create a patch job manually each week

Answer

Install the OS Config agent on all VMs

Question 6

A startup uses Cloud SQL for MySQL and wants to implement automated daily backups with a 7-day retention period. The database is 50 GB and experiences moderate write traffic. The team wants to minimize cost and operational overhead. Which two actions should they take? (Choose two.)

Accepted Answer

Configure point-in-time recovery (PITR) with a 7-day log retention. Cloud SQL provides built-in automated backups. Configuring them through the UI or CLI is straightforward and cost-effective. The default backup window can be customized, and retention is set per backup configuration.

Answer

Use gcloud sql backups create to take on-demand backups daily

Answer

Set up a cron job on a Compute Engine instance to run pg_dump

Answer

Create a Cloud Function to export the database to Cloud Storage daily using mysqldump

Question 7

A company is using Forseti for compliance automation. They need to ensure that all Cloud Storage buckets are encrypted with CMEK and that buckets without CMEK are flagged. Which Forseti scanner should they use?

Accepted Answer

Location scanner. The Location scanner in Forseti is designed to audit resources based on their location or configuration settings, including encryption status. For Cloud Storage buckets, it can check whether CMEK is enabled by evaluating the bucket's encryption configuration against a policy, flagging any that lack CMEK. This makes it the correct scanner for ensuring CMEK compliance.

Answer

IAM scanner

Answer

Resource scanner

Answer

Bucket ACL scanner

Question 8

A company runs a multi-tier application on Compute Engine behind an external HTTP(S) Load Balancer. The backend consists of a managed instance group for the application tier and a Cloud Storage bucket for static assets. During peak traffic, some users receive HTTP 503 errors. The backend instances are healthy and the load balancer shows no connection errors. The company has already enabled Cloud CDN for the backend bucket. What should they do to resolve the 503 errors?

Accepted Answer

Increase the size of the instance group to handle more requests.. The 503 errors likely indicate that the instance group cannot handle the request volume. Increasing the size of the instance group provides more capacity. Option B is incorrect because CDN is already enabled for static content, and the 503 errors are likely for dynamic content. Option C is incorrect because forcing caching of dynamic content may serve stale data or not be allowed. Option D is incorrect because connection draining affects instance removal, not capacity.

Answer

Enable Cloud CDN on the backend bucket to cache static content.

Answer

Increase the backend bucket's cache mode to force caching of dynamic content.

Answer

Adjust the load balancer's connection draining timeout.

Question 9

Match each IAM role to its typical use case.

Accepted Answer

Viewer: Can view resources but cannot make changes.. Correct matches: Viewer (read-only), Editor (edit but no permissions), Owner (full control). Billing Admin handles billing, Security Admin handles IAM.

Answer

Billing Admin: Can manage IAM permissions.

Answer

Security Admin: Can manage billing accounts and budgets.

Question 10

A company needs to grant a service account the ability to manage Compute Engine instances (start, stop, create) in a specific set of projects. The administrator wants to follow the principle of least privilege. Which TWO steps should the administrator take? (Choose TWO.)

Accepted Answer

Use IAM Conditions to restrict the service account's access to only the required projects or resources.. IAM Conditions allow the administrator to restrict the service account's permissions to a specific set of projects or resources, enforcing least privilege by limiting the scope of the granted role. This ensures the service account can only manage Compute Engine instances in the designated projects, not all projects in the folder or organization.

Answer

Grant the predefined roles/compute.viewer role to the service account at the folder level.

Answer

Use Cloud IAP to tunnel into Compute Engine instances to perform management tasks.

Answer

Grant the predefined roles/compute.admin role to the service account at the organization level.

Question 11

A company runs a GKE cluster in a private cluster mode (no public endpoint) in a custom VPC. The cluster nodes are in a subnet that uses a secondary IP range for pods. The company needs the pods to access an on-premises service over a Cloud VPN connection that terminates in a different region. The on-premises service IP range is 10.100.0.0/16. The VPC has a route for 10.100.0.0/16 pointing to the VPN gateway. However, pods cannot reach the on-premises service. The GKE cluster is configured with a Cloud NAT for outbound internet access. The pod IP range is 10.200.0.0/16. Which step is required to allow pod traffic to reach the on-premises network?

Accepted Answer

Add a static route in the VPC for the pod IP range (10.200.0.0/16) with next hop set to the VPN gateway.. The VPC has a route for the on-premises range (10.100.0.0/16) pointing to the VPN gateway, but the GKE cluster's pod IP range (10.200.0.0/16) is not part of the VPC's primary or secondary subnet ranges. By default, GKE pods use IP addresses from a secondary IP range that is not automatically advertised over Cloud VPN. Adding a static route in the VPC for 10.200.0.0/16 with next hop set to the VPN gateway ensures that traffic from pods to the on-premises network is forwarded through the VPN tunnel, allowing the on-premises routers to learn the pod subnet and route return traffic back.

Answer

Configure Cloud NAT to also translate pod IPs to the node IPs for on-premises traffic.

Answer

Disable IP masquerade in the GKE cluster to use pod IPs directly.

Answer

Create a firewall rule allowing traffic from the pod IP range to the on-premises IP range.

Question 12

A company wants to allow users from a specific on-premises IP range to access a service deployed on Google Cloud, but only if the user's device is compliant with corporate security policies (e.g., has antivirus enabled). Which combination of services can achieve this?

Accepted Answer

VPC Service Controls with an access level that includes IP and device conditions. VPC Service Controls access levels can combine IP-based conditions with device-based conditions (e.g., using BeyondCorp Enterprise). This allows restricting access to a service perimeter based on both the user's IP and device compliance.

Answer

Firewall rules with source ranges and service accounts

Answer

Cloud Armor with geo-based access control

Answer

Cloud IDS with threat detection

Question 13

A company wants to expose an internal web service running on a private GKE cluster to other services within the same VPC network using a private IP address. They do not want to use a public load balancer. Which Google Cloud service should they use?

Accepted Answer

Internal load balancer. To expose a GKE service within the same VPC using a private IP, an Internal load balancer (ILB) is the appropriate choice. It provides a private IP address accessible from within the VPC, without a public endpoint. Private Service Connect is designed for publishing services to other VPCs or on-premises, not for same-VPC exposure.

Answer

Cloud NAT

Answer

Private Service Connect

Answer

Cloud VPN

Question 14

A company has a VPC with several subnets. They want to restrict traffic between instances in the same subnet using firewall rules while allowing traffic from a specific load balancer health check range. What is the best approach?

Accepted Answer

Create a firewall rule that allows only health check traffic and deny all other ingress by default using implied deny.. GCP VPC firewall rules have an implied deny at the end; therefore, allowing only the health check traffic and relying on the implied deny for all other ingress is the simplest and most secure approach. Option A is incorrect because using explicit deny rules can lead to complexity and potential misconfigurations; the implied deny already blocks unwanted traffic. Option B is incorrect because hierarchical firewall policies are designed for organization-level enforcement, not for restricting traffic within a specific subnet. Option C is incorrect because target tags help apply rules to specific instances but do not automatically restrict internal subnet traffic; you still need to configure rules to deny or allow based on the health check source.

Answer

Create an ingress firewall rule denying all traffic from the subnet CIDR, then create a higher priority rule allowing traffic from the health check range.

Answer

Use hierarchical firewall policies to enforce the rule at the organization level.

Answer

Use VPC firewall rules with target tags to apply rules only to instances that need health checks.

Question 15

An administrator wants to enforce that a user can only create virtual machines in a specific subnet of a VPC network. What IAM condition should be added to the compute.instanceAdmin role binding?

Accepted Answer

resource.name == "projects/PROJECT_ID/regions/us-central1/subnetworks/SUBNET". The IAM condition `resource.name` with the full resource name of the subnet (including the region) is the proper way to restrict virtual machine creation to a specific subnet. The `compute.instanceAdmin` role binding with this condition ensures that the user can only create instances whose subnet matches the specified resource name, enforcing the subnet-level constraint.

Answer

resource.name == "projects/PROJECT_ID/subnetworks/SUBNET"

Answer

api.getAttribute("compute.googleapis.com/zone", "") != "us-central1"

Answer

resource.subnetwork == "projects/PROJECT_ID/subnetworks/SUBNET"