PCSE Practice Test 45 — 15 Questions

Question 1

A security engineer needs to provide a group of contractors with access to a web application running on a private Compute Engine instance. The contractors connect from various locations on the internet, and the company does not want to expose the application's private IP address or manage a VPN for them. The application uses HTTPS on port 443. What should the engineer implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set up Identity-Aware Proxy (IAP) with a global external Application Load Balancer and grant the contractors the IAP-secured Web App User role.. Identity-Aware Proxy combined with a global external Application Load Balancer provides HTTPS access to private backends without exposing instance IPs or requiring a VPN. Contractors authenticate with their identity, and IAM roles determine authorization. This centralizes access control and eliminates the need to manage network-level connectivity for each contractor.

Answer

Configure an external TCP proxy Network Load Balancer with a backend service pointing to the instance group.

Answer

Use Cloud VPN with a third-party client and provide each contractor with a certificate to connect.

Answer

Assign external IP addresses to the instances and create firewall rules allowing the contractors' IP ranges on port 443.

Question 2

A security engineer needs to allow SSH access to a Compute Engine VM running in a VPC, but only from a specific bastion host in the same VPC. The bastion host has IP address 10.0.1.5. The VM is in subnet 10.0.2.0/24. The engineer wants to minimize the attack surface and ensure that only the bastion can initiate SSH connections to the VM. Which firewall rule should the engineer create?

Accepted Answer

Create an ingress rule with action allow, direction INGRESS, source ranges 10.0.1.5/32, target tags ['vm-ssh'], and protocol tcp:22.. To restrict SSH access to only the bastion host, the firewall rule must specify the bastion's IP address as the source and target the VM using a network tag or service account. The rule should allow only TCP port 22. Using a /32 source range ensures only that single IP can connect, aligning with the principle of least privilege.

Answer

Create an ingress rule with action allow, direction INGRESS, source ranges 10.0.2.0/24, target tags ['vm-ssh'], and protocol tcp:22.

Answer

Create an ingress rule with action allow, direction INGRESS, source ranges 10.0.0.0/16, target tags ['vm-ssh'], and protocol tcp:22.

Answer

Create an ingress rule with action allow, direction INGRESS, source service accounts ['bastion@project.iam.gserviceaccount.com'], target service accounts ['vm@project.iam.gserviceaccount.com'], and protocol tcp:22.

Question 3

A healthcare analytics company must demonstrate to auditors that access to its Cloud Storage buckets containing protected health information (PHI) is limited to authorized personnel and that access is reviewed regularly. They want to automate the collection of evidence showing which IAM principals have access to these buckets and when that access was last used. Which Google Cloud service should they use to generate this compliance evidence?

Accepted Answer

Cloud Asset Inventory with IAM policy export to BigQuery. Cloud Asset Inventory provides a searchable, exportable inventory of IAM policies and resource metadata. Exporting to BigQuery enables scheduled snapshots and SQL-based analysis of who has access to which buckets, directly supporting access reviews and audit evidence. Other services focus on activity logging, threat detection, or perimeter enforcement, not on producing a comprehensive IAM access inventory.

Answer

Cloud Audit Logs with Log Router sinks to Cloud Storage

Answer

Security Command Center with Event Threat Detection

Answer

VPC Service Controls with access levels

Question 4

A security engineer is configuring Cloud Armor security policies for an external HTTP(S) load balancer. They need to protect against application-layer attacks and also ensure that only requests from specific countries are allowed. (Choose two.)

Accepted Answer

Create a Cloud Armor security policy with a rule that uses the preconfigured expression evaluatePreconfiguredWaf('sqli-v33-stable') to block SQL injection attempts.. Cloud Armor preconfigured WAF rules such as sqli-v33-stable protect against SQL injection, and geo-based rules using origin.region_code allow or deny traffic by country. Combining an allow rule for the desired country with a default deny rule and a WAF rule meets both requirements. Adaptive protection and user-agent matching do not provide the needed protections.

Answer

Use Cloud Armor's adaptive protection to automatically enable SQL injection protection and geo-based restrictions.

Answer

Create a Cloud Armor security policy with a rule that uses the expression origin.region_code == 'US' to deny requests from the United States.

Answer

Configure a Cloud Armor security policy with a rule that uses the expression request.headers['user-agent'].contains('sqlmap') to block SQL injection tools.

Question 5

A security engineer needs to inspect outbound traffic from a VPC for intrusion attempts and malware, and to block connections to known malicious destinations. The team wants to use a managed Google Cloud service that can be attached to the VPC and does not require deploying third-party virtual appliances. Which service should the engineer use?

Accepted Answer

Cloud NGFW. Cloud NGFW is the managed next-generation firewall that attaches to a VPC and provides intrusion prevention and threat prevention, allowing the team to inspect egress and block malicious destinations without deploying appliances. Cloud IDS only detects, Cloud Armor protects inbound load-balanced services, and Secure Web Proxy handles explicit proxy policy rather than full network threat inspection.

Answer

Cloud Armor

Answer

Cloud IDS

Answer

Secure Web Proxy

Question 6

A security engineer is configuring Cloud VPN to connect an on-premises network to a Google Cloud VPC. The on-premises VPN gateway supports only IKEv2 and requires a route-based VPN. The engineer must ensure that traffic from on-premises can reach specific VM instances in the VPC, and that the VPN tunnel is highly available. Which configuration should the engineer use?

Accepted Answer

Create an HA VPN with two tunnels, each terminating on a different interface of the HA VPN gateway, and configure BGP on both tunnels.. HA VPN supports IKEv2 and dynamic routing with BGP, and provides high availability when configured with two tunnels on different interfaces. This meets the on-premises gateway's requirement for IKEv2 and route-based VPN, and ensures redundancy. Classic VPN is legacy and does not offer the same level of HA. The correct configuration is HA VPN with two tunnels and BGP.

Answer

Create a Classic VPN with a single tunnel using IKEv2 and dynamic routing (BGP).

Answer

Create an HA VPN with a single tunnel and configure static routing.

Answer

Create a Classic VPN with two tunnels using IKEv1 and policy-based routing.

Question 7

A company runs a web application on Compute Engine behind an external HTTP(S) load balancer. The security team must inspect incoming traffic for known malicious source IPs and rate-limit abusive clients, while keeping the backend VMs hidden from direct internet access. Which combination should the engineer implement?

Accepted Answer

Attach a Cloud Armor security policy to the load balancer's backend service with rules for the malicious IP ranges and a rate-based ban rule, and ensure the backend VMs have no external IP addresses.. Cloud Armor security policies are enforced at external HTTP(S) load balancer backend services, where rules can allow or deny based on source IP and apply rate-based bans to abusive clients. Removing external IPs from the backend VMs ensures traffic can only enter through the load balancer, so the policy is consistently applied and direct internet access to the VMs is blocked.

Answer

Attach a Cloud Armor security policy to the VPC network and add deny rules for the malicious IP ranges.

Answer

Enable Cloud CDN on the backend service and configure a Google Cloud Armor edge security policy on the load balancer's target proxy.

Answer

Create VPC firewall rules that deny traffic from the malicious IP ranges and rely on the load balancer's health checks to rate-limit clients.

Question 8

A company has a VPC with two subnets in different regions. They want to ensure that a specific set of Compute Engine instances can only send traffic to the internet through a Cloud NAT gateway, and that no instance can receive unsolicited inbound traffic from the internet. They have already configured Cloud NAT on a Cloud Router in the region of the instances. Which additional configuration is needed to prevent unsolicited inbound traffic?

Accepted Answer

Ensure that no INGRESS ALLOW firewall rules exist for the instances, relying on the implied deny-all ingress rule.. Cloud NAT provides outbound internet access for instances without external IPs and statefully allows return traffic. Unsolicited inbound traffic is blocked by the implied deny-all ingress rule unless an INGRESS ALLOW rule explicitly permits it. Therefore, ensuring no INGRESS ALLOW rules target the instances is sufficient to prevent unsolicited inbound traffic.

Answer

Assign external IP addresses to the instances and create a firewall rule to block all inbound traffic.

Answer

Configure Cloud NAT to not allow inbound connections by setting the 'inbound' flag to false.

Answer

Create an INGRESS DENY rule with priority 1000 targeting the instances and source 0.0.0.0/0.

Question 9

A company wants to control which Google Cloud services its employees can access from corporate-managed devices on the corporate network. The security team wants to enforce that only approved services are reachable, and they want the policy to apply to all users on the network without installing software on each device. Which Google Cloud feature should they use?

Accepted Answer

Secure Web Proxy with a policy that allows only the approved service domains.. Secure Web Proxy is an explicit forward proxy that enforces egress policy based on destination, so it can restrict users on a network to only approved services. It requires no agent on each device, and policy is centralized. Perimeter, DNS, and load balancer controls address different layers and do not provide the required outbound allowlist.

Answer

VPC Service Controls perimeter around the projects that host the approved services.

Answer

Cloud DNS private zones with conditional forwarding for the approved services.

Answer

Cloud Armor security policy attached to an external HTTP(S) load balancer.

Question 10

A company uses a Shared VPC where the host project contains subnets shared with multiple service projects. A security engineer must ensure that a specific service project's VM instances can only initiate connections to on-premises resources over Cloud VPN, and cannot reach other service projects' VMs. Which configuration should the engineer implement?

Accepted Answer

Create a firewall rule in the host project with an egress allow for the on-premises destination range, and an egress deny for the other service projects' subnet ranges. Apply the rules using target service accounts that correspond to the VMs in the specific service project.. In a Shared VPC, the host project owns the network and firewall rules. To restrict a specific service project's VMs, the engineer must create egress rules in the host project, targeting those VMs via service accounts. An allow rule for the on-premises range and a deny rule for other service projects' subnets ensures the VMs can only reach on-premises. Ingress rules, service project rules, or VPC Service Controls do not achieve this.

Answer

Use VPC Service Controls to create a perimeter around the service project and add an access level that allows only the on-premises IP range, thereby preventing access to other service projects.

Answer

Create a firewall rule in each service project that allows egress to on-premises and denies egress to other service projects' subnets, and apply the rules to all instances in those projects.

Answer

Create a firewall rule in the host project that allows ingress from the on-premises range to the service project's VMs, and a rule that denies ingress from other service projects' subnets.

Question 11

A multinational bank must ensure that its Google Cloud resources for a new trading platform are deployed only in regions within the European Union and that support access is restricted to EU-based Google personnel. They also need to monitor for any configuration drift that could violate these requirements. Which Google Cloud feature should they implement to meet these compliance obligations?

Accepted Answer

Assured Workloads with the EU Regions and Support control package. Assured Workloads is designed to enforce compliance controls for data residency and personnel access. The EU Regions and Support control package restricts resource locations to EU regions and ensures only EU-based Google support personnel can access data. It also provides ongoing monitoring and alerts for policy violations, which is essential for detecting configuration drift and maintaining compliance.

Answer

VPC Service Controls perimeters with access levels

Answer

Organization Policy constraints for location restriction

Answer

Cloud Data Loss Prevention with location-based discovery

Question 12

A security engineer is configuring a VPC Service Controls perimeter to protect a Cloud Storage bucket. The perimeter includes a project that hosts a Compute Engine instance. The instance needs to access the bucket using its service account. The engineer wants to ensure that the instance's requests to the bucket do not leave the perimeter and are not blocked. What should the engineer do?

Accepted Answer

Ensure the instance's service account has the necessary IAM role on the bucket, and that the instance's project is inside the perimeter.. When both the caller and the protected resource are inside the same VPC Service Controls perimeter, the request is considered internal and is allowed as long as the caller has the necessary IAM permissions. Therefore, the engineer must ensure the instance's project is within the perimeter and the service account has the appropriate IAM role on the bucket. No ingress or egress rules are needed for internal access.

Answer

Create an ingress rule in the perimeter to allow the instance's IP address to access the bucket.

Answer

Add the instance's service account to the perimeter's access level with the 'Cloud Storage API' permission.

Answer

Configure the instance to use Private Google Access and add the bucket to the perimeter's egress rule.

Question 13

A security engineer is designing a Shared VPC where a central host project provides subnets to multiple service projects. The requirement is that each service project's VMs can reach only the resources in their own project, and no service project may open firewall rules that affect the host project's network. What should the engineer configure?

Accepted Answer

Use VPC firewall rules with target service accounts combined with IAM and network tags scoped per service project, and do not grant service projects firewall administration on the host project.. Shared VPC centralizes network administration in the host project, so firewall rules must be authored there and scoped using target service accounts or tags. Withholding firewall administration from service projects ensures they cannot change shared network policy, while per-project service accounts let the host team write rules that isolate each service project's workloads from the others.

Answer

Create a separate VPC network in each service project and peer them all to the host project's network with custom route import/export.

Answer

Configure an organization policy constraint to disable firewall rule creation in all service projects.

Answer

Grant each service project's administrators the compute.securityAdmin role on the host project so they can manage firewall rules.

Question 14

Your organization runs a regulated workload on Google Cloud and must demonstrate compliance with ISO/IEC 27001 to an external auditor. The auditor requires an on-demand, point-in-time report showing which controls were in place and how Google Cloud infrastructure was configured during a specific audit period. Which Google Cloud resource should you use to provide this evidence?

Accepted Answer

The Google Cloud compliance reports available through the Compliance Reports Manager in the Google Cloud console.. Compliance Reports Manager is the designated Google Cloud service for accessing Google's own compliance certifications, including ISO/IEC 27001, SOC, and PCI DSS. It provides on-demand, auditor-ready documents that map Google's controls to recognized standards. The other options provide configuration data, security findings, or activity logs, none of which serve as formal attestations of compliance.

Answer

Cloud Asset Inventory with a saved query that exports all asset metadata for the audit period.

Answer

Security Command Center Premium findings filtered to the audit period.

Answer

Cloud Logging audit logs exported to BigQuery for the audit period.

Question 15

A company has a VPC Service Controls perimeter that protects a Cloud Storage bucket. They need to allow a specific on-premises application to access the bucket using a service account, but only when the request originates from a specific corporate IP range. The on-premises application authenticates with a service account key. Which configuration should the security engineer implement?

Accepted Answer

Create an ingress rule in the perimeter that allows the service account and includes the corporate IP range as a source.. VPC Service Controls ingress rules allow external identities to access protected resources. The rule must specify the service account as the identity and include the corporate IP range as a source. This ensures the on-premises application can access the bucket only from the specified network, meeting both identity and location requirements.

Answer

Add the corporate IP range to the bucket's IAM policy as a condition, and grant the service account the Storage Object Viewer role.

Answer

Create an egress rule in the perimeter that allows the service account to access the bucket from the corporate IP range.

Answer

Add an access level that includes the corporate IP range, and add the service account to the perimeter's allowed identities.