PCSE Practice Test 45 — 15 Questions

Question 1

During an incident, a security engineer needs to isolate a compromised Compute Engine instance for forensic analysis without losing evidence. What should they do first?

Accepted Answer

Create a snapshot of the instance's persistent disks.. Creating a snapshot of the persistent disks preserves the disk state for forensic analysis without altering the instance. This captures all data, including evidence, before any other actions. Option A (disconnecting from VPC) may cause loss of volatile data and is not the first step. Option B (shutting down) could modify disk state or trigger cleanup processes, potentially destroying evidence. Option C (deleting) obviously destroys evidence and is counterproductive.

Answer

Disconnect the instance from the VPC network.

Answer

Shut down the instance immediately.

Answer

Delete the instance to prevent further damage.

Question 2

Which service provides a centralized view of all resource configurations and IAM policies across projects?

Accepted Answer

Cloud Asset Inventory. Cloud Asset Inventory provides a centralized view of all resources and their IAM policies across projects. Option A, Cloud Security Command Center, provides security findings and vulnerabilities, not a full inventory. Option C, Cloud Audit Logs, records API activity but not a static inventory. Option D, Access Transparency, logs Google personnel access.

Answer

Cloud Security Command Center

Answer

Cloud Audit Logs

Answer

Access Transparency

Question 3

A company has an organization policy that denies the use of certain GCP services unless the project is in a specific folder. The DevOps team wants to create a new project in that folder. However, the project creation fails. What is the most likely cause?

Accepted Answer

The user does not have the resourcemanager.projects.create permission at the folder level.. The most likely cause is that the user lacks the `resourcemanager.projects.create` permission at the folder level. Even if the project is being created in a folder that allows GCP services, the user must have the Project Creator role (or equivalent) granted on that specific folder. Without this permission, the creation request is denied by the Resource Manager, regardless of the folder's capacity or the project name's uniqueness.

Answer

The folder has reached its maximum number of projects.

Answer

The project name is already taken.

Answer

The organization policy prevents any project creation in the organization.

Question 4

A financial services company is migrating its on-premises application to Google Cloud. The application needs to access a Cloud SQL instance and a Cloud Storage bucket. Security requirements mandate that the application must use short-lived credentials and avoid storing long-lived service account keys. The application runs on Compute Engine. What should the Security Engineer do to meet these requirements?

Accepted Answer

Attach a service account to the Compute Engine instance with appropriate roles for Cloud SQL and Cloud Storage.. Attaching a service account directly to a Compute Engine instance allows the application to automatically obtain short-lived access tokens from the instance metadata server (http://169.254.169.254) for accessing Cloud SQL and Cloud Storage. This approach eliminates the need to store long-lived service account keys, meeting the security requirement for short-lived credentials.

Answer

Create a service account and use Workload Identity Federation to impersonate it.

Answer

Use Cloud Key Management Service to generate and rotate keys for the service account.

Answer

Create a service account key and store it in Cloud Secret Manager.

Question 5

A company wants to allow an application running in an on-premises data center to access Google Cloud Storage buckets without storing long-lived service account keys. The on-premises application authenticates using an external identity provider (IdP) that supports OpenID Connect (OIDC). Which Google Cloud feature should they use?

Accepted Answer

Use workload identity federation to exchange OIDC tokens for Google Cloud tokens. Workload identity federation allows the on-premises application to exchange OIDC tokens from the external IdP for short-lived Google Cloud access tokens, eliminating the need to store long-lived service account keys. This directly meets the requirement of accessing Cloud Storage buckets without managing static credentials.

Answer

Use Cloud VPN to connect the on-premises network and access Cloud Storage via private IP

Answer

Configure a VPN between on-premises and Google Cloud and use a Compute Engine instance as a proxy

Answer

Create a service account key and store it securely on-premises

Question 6

A company has a security policy that service account keys should not be created. They want to prevent anyone from creating keys for any service account in the organization. Which organization policy constraint should they use?

Accepted Answer

constraints/iam.disableServiceAccountKeyCreation. The `constraints/iam.disableServiceAccountKeyCreation` organization policy constraint explicitly prevents the creation of user-managed service account keys across the entire organization. This aligns with the security policy that service account keys should not be created, as it enforces the use of short-lived credentials or workload identity federation instead of long-lived keys.

Answer

Custom constraint with iam.serviceAccountKeys.create

Answer

constraints/iam.allowedPolicyMemberDomains

Answer

constraints/compute.requireShieldedVm

Question 7

Drag and drop the steps to configure a Cloud NAT for private VM instances in the correct order.

Accepted Answer

Create Cloud Router, then create NAT gateway, then assign NAT to subnets, then configure private VMs, then test connectivity.. Cloud NAT requires a Cloud Router, NAT gateway creation, subnet assignment, private VM configuration, and testing.

Answer

Create NAT gateway, then create Cloud Router, then assign NAT to subnets, then configure private VMs, then test connectivity.

Answer

Create Cloud Router, then assign NAT to subnets, then create NAT gateway, then configure private VMs, then test connectivity.

Answer

Configure private VMs, then create Cloud Router, then create NAT gateway, then assign NAT to subnets, then test connectivity.

Question 8

You are designing network security for a multi-region GKE cluster with Pods that need to communicate across regions over a private network. The cluster uses VPC-native mode. Which Google Cloud networking feature should you use to ensure low-latency and secure inter-region Pod-to-Pod communication without traversing the public internet?

Accepted Answer

Cloud Interconnect. In a VPC-native GKE cluster, inter-region Pod-to-Pod communication automatically uses Google's internal backbone, requiring no additional networking feature. None of the provided options (Cloud VPN, Private Service Connect, VPC Flow Logs, Cloud Interconnect) are designed for this purpose; Cloud Interconnect is for hybrid connectivity, Cloud VPN traverses the public internet, Private Service Connect is for accessing Google services, and VPC Flow Logs is for monitoring. Therefore, no provided option is correct.

Answer

Cloud VPN with dynamic routing

Answer

Private Service Connect

Answer

VPC Flow Logs

Question 9

A Dataflow job launched by service account 'my-sa@...' fails with permission denied. The audit log shows the above entry. What missing role is causing the failure?

Accepted Answer

roles/iam.serviceAccountUser on the worker service account. When a Dataflow job fails with permission denied and the audit log shows the entry, the missing role is typically roles/iam.serviceAccountUser on the worker service account. This role is required because the Dataflow service (or the service account launching the job) must be able to impersonate the worker service account to execute the pipeline's tasks. Without this role, the job cannot assume the identity of the worker service account, leading to the permission denied error.

Answer

roles/iam.workloadIdentityUser on the worker service account

Answer

roles/iam.serviceAccountAdmin on the worker service account

Answer

roles/iam.serviceAccountTokenCreator on the worker service account

Question 10

A company wants to use Cloud KMS to protect sensitive data. They have a requirement that the key material must be stored in a FIPS 140-2 Level 3 validated HSM. They also need to be able to create and use asymmetric keys for signing. Which two steps should they take? (Choose TWO).

Accepted Answer

Create a key ring in Cloud KMS.. Cloud HSM provides FIPS 140-2 Level 3 validated HSM for key material. Creating a key ring and setting the protection level to HSM ensures keys are generated in the HSM. Asymmetric signing keys can be created in Cloud HSM with purpose ASYMMETRIC_SIGN. Setting protection level to software would not meet the HSM requirement. Using symmetric keys only would not support signing. Creating a key ring in Cloud KMS is a prerequisite, but protection level must be HSM.

Answer

Set the protection level of the key to software.

Answer

Create a symmetric key with protection level HSM.

Answer

Enable key rotation on the key ring.

Question 11

Alice has the role roles/storage.objectAdmin on the bucket my-bucket via the IAM policy shown. She is unable to access the object gs://my-bucket/reports/data.csv. What is the most likely reason?

Accepted Answer

The condition restricts access to objects with a prefix 'uploads/', and the requested object is under 'reports/'.. The IAM policy condition uses the `resource.name.startsWith('my-bucket/uploads/')` condition key, which restricts the `storage.objects.get` permission to objects whose name starts with `uploads/`. The requested object `gs://my-bucket/reports/data.csv` is under the `reports/` prefix, so the condition evaluates to false, denying access. This is the most likely reason Alice cannot access the object.

Answer

The bucket has a retention policy that prevents access to objects older than a certain period.

Answer

The condition uses the wrong resource attribute; it should be resource.name.startsWith('my-bucket/uploads/').

Answer

Alice does not have the storage.objects.get permission on the bucket.

Question 12

An organization wants to implement a zero-trust network security model for their Google Cloud environment. Which TWO practices should they adopt? (Choose TWO.)

Accepted Answer

Implement VPC Service Controls to create perimeters around sensitive APIs.. Using service account targets for firewall rules aligns with identity-based security (zero-trust). VPC Service Controls restrict access to APIs based on identity and context, reducing reliance on network perimeter.

Answer

Enable Private Google Access for all subnets.

Answer

Use network tags to group VMs for firewall rules.

Answer

Allow all outbound traffic and rely on intrusion detection.

Question 13

A developer needs to allow a specific Compute Engine instance to communicate with a Cloud SQL database instance. Both are in the same project but different VPC networks. What is the simplest secure method?

Accepted Answer

Use VPC peering between the two networks. VPC peering is the simplest secure method to allow communication between two VPC networks in the same project. It establishes a private RFC 1918 connection using internal IPs, avoiding the public internet. Firewall rules alone cannot bridge separate VPCs, and Cloud SQL Proxy is unnecessary overhead for internal connectivity.

Answer

Create a firewall rule allowing traffic between networks

Answer

Use Cloud SQL Proxy on the instance

Answer

Grant the instance's service account access to Cloud SQL

Question 14

A company is implementing confidential VMs with Shielded VM and data encryption. Which two actions must be taken to ensure data protection for confidential compute workloads?

Accepted Answer

Use vTPM for key management.. VTPM (virtual Trusted Platform Module) provides hardware-based key management for confidential VMs, enabling secure generation, storage, and attestation of encryption keys used for memory encryption and disk encryption. This ensures that only authorized code can access the keys, protecting data at rest and in use.

Answer

Use customer-managed encryption keys (CMEK) for persistent disk encryption.

Answer

Use a Confidential VM instance with an N2D machine series.

Answer

Use Cloud HSM to protect the encryption keys for the encrypted memory.

Question 15

An organization uses Binary Authorization to enforce that only images signed by an approved attestor are deployed in GKE. They want to allow a specific set of images from a trusted registry to bypass the policy. Which Binary Authorization policy type should they use?

Accepted Answer

Require Attestation. Binary Authorization supports policy types like 'Require Attestation', 'Allow All', and 'Deny All'. To allow specific images while requiring attestation for others, they would use 'Require Attestation' with an exception list. There is no 'Allow by Registry' built-in type.

Answer

Deny All

Answer

Allow All

Answer

Allow by Registry