PCSE Practice Test 46 — 15 Questions

Question 1

A healthcare company must demonstrate to auditors that access to patient data in Google Cloud is granted only to authorized personnel and that all access is logged. They want to prove that permissions are reviewed quarterly and that no excessive access exists. Which Google Cloud capability should they use to generate evidence of who has access to which resources and how that access is used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Asset Inventory with IAM policy export and Cloud Audit Logs analysis. Cloud Asset Inventory provides a complete, exportable view of IAM policies across all resources, showing exactly who has access. When paired with Cloud Audit Logs, which record all access attempts and changes, you can demonstrate both granted permissions and actual usage. This combination satisfies the need for auditable evidence of authorized access and logging, enabling effective quarterly reviews.

Answer

VPC Service Controls with access levels based on user identity

Answer

Cloud Identity Groups with automatic membership sync from HR systems

Answer

Security Command Center Premium with built-in IAM recommendations

Question 2

A security engineer is configuring firewall rules for a VPC that hosts production workloads. The team wants to reduce the attack surface by ensuring that only explicitly required traffic is allowed, and they want to verify the effective rules after changes. Which two actions should the engineer take? (Choose two.)

Accepted Answer

Use Firewall Rules Logging on the rules that allow traffic, and review the logs to confirm which sources are actually connecting.. Least privilege in VPC firewall design comes from narrow source and target scoping, and verification comes from logging and reviewing actual matches. Together these actions reduce exposure and provide evidence that only required traffic is permitted. Relying on the implied deny, disabling egress rules, or using a single broad rule does not achieve the stated security objective.

Answer

Rely on the implied deny ingress rule to block all traffic that is not explicitly allowed.

Answer

Disable all egress rules and rely on the implied allow egress behavior to permit outbound traffic.

Answer

Create a single rule with a large source range and apply it to all instances to simplify management.

Question 3

A multinational bank must prove that its Google Cloud resources for a regulated trading platform remain in Canadian regions only, and it needs continuous monitoring that alerts when any resource is deployed outside the allowed locations. The team wants a managed Google Cloud capability rather than custom scripts. What should they implement?

Accepted Answer

Create an organization policy with the location restriction constraint (gcp.resourceLocations) set to allow only canadian-locations, and monitor violations through the Organization Policy audit logs.. Organization policy constraints are the managed, preventive mechanism for enforcing resource locations, and the gcp.resourceLocations constraint specifically restricts creation to approved regions. Because enforcement attempts are recorded in audit logs, the bank gains continuous detection of out-of-region attempts without writing custom scripts, combining prevention with the monitoring evidence auditors expect for data residency.

Answer

Apply resource labels indicating the approved region and build log-based alerts on label changes using Cloud Monitoring.

Answer

Use Cloud DNS routing policies to restrict name resolution to Canadian endpoints and alert on resolution failures.

Answer

Deploy VPC Service Controls perimeters around the projects and rely on the perimeter violation dashboards in Cloud Logging.

Question 4

A company has a web application behind an external HTTP(S) load balancer. The security team wants to block traffic from a specific list of IP addresses known to be malicious. They also want to log all requests that match the rule. What should they do?

Accepted Answer

Create a Cloud Armor security policy with a rule that has a deny action for the IP addresses, and attach it to the backend service. Enable logging on the rule.. To block specific IP addresses at the load balancer, a Cloud Armor security policy with a deny rule is needed. Attaching the policy to the backend service enforces it. Enabling logging on the rule ensures all matching requests are logged.

Answer

Configure a Cloud Armor security policy with a rule that has an allow action for the IP addresses, and attach it to the backend service.

Answer

Use Cloud Identity-Aware Proxy (IAP) to restrict access to the application based on IP addresses.

Answer

Create a firewall rule to deny traffic from the IP addresses to the load balancer's IP address.

Question 5

A healthcare analytics company runs workloads on Google Cloud and must demonstrate HIPAA compliance to auditors. The security team needs a Google-provided artifact that documents how Google's infrastructure controls map to HIPAA requirements so they can incorporate it into their own compliance documentation. Which resource should they use?

Accepted Answer

The Google Cloud Compliance Reports Manager, which provides on-demand access to audit reports, certifications, and the HIPAA mapping documentation for Google Cloud services.. Compliance Reports Manager is the designated Google Cloud portal for retrieving third-party audit reports, certifications, and framework mappings such as the HIPAA documentation. Because the healthcare company must show auditors how Google's infrastructure controls correspond to HIPAA requirements, this is the only listed resource that actually contains provider attestation artifacts rather than operational telemetry or design guidance.

Answer

The Cloud Asset Inventory API, which exports a list of all resources and their IAM policies across the organization.

Answer

The Google Cloud Status Dashboard, which publishes incident and outage history for each region and service.

Answer

The Google Cloud Architecture Framework, which describes recommended design pillars for reliability, security, and cost optimization.

Question 6

A retail enterprise is preparing for a SOC 2 Type II audit of its Google Cloud environment. The security team must collect evidence that shows who changed firewall rules and IAM policies, and that shows whether privileged access was reviewed over the audit period. Which two Google Cloud capabilities should they use to gather this evidence? (Choose two.)

Accepted Answer

IAM policy and role usage reports from the Policy Analyzer, reviewed and signed off on a recurring schedule by the security team.. Audit evidence for SOC 2 needs two threads: an immutable record of configuration changes and a documented periodic review of privileged access. Exporting Admin Activity logs to a retention-locked bucket provides the first, capturing the principal and change details for firewall and IAM modifications. Policy Analyzer access queries with scheduled, signed-off reviews provide the second, demonstrating that access was actually evaluated during the audit period.

Answer

Access Transparency logs, which record when Google personnel access customer data or configuration.

Answer

IAM Recommender suggestions applied to service accounts to reduce unused permissions.

Answer

Cloud Monitoring uptime checks on the firewall and IAM endpoints to prove configuration integrity.

Question 7

A software company plans to store EU customer personal data in Cloud Storage and BigQuery under a Data Processing Addendum with Google. The legal team asks the security engineer which Google Cloud commitment guarantees that customer data will not be accessed for advertising purposes and will be handled only per the customer's instructions. What should the engineer cite?

Accepted Answer

The Google Cloud Data Processing and Security Terms, which contractually commit Google to process customer data only per documented instructions and not for advertising.. The Data Processing and Security Terms are incorporated by reference into Google Cloud contracts and set out Google's processor obligations, including acting only on documented customer instructions and not using customer data for advertising. For a DPA-driven question about EU personal data in Cloud Storage and BigQuery, this is the authoritative commitment the security engineer should supply to legal.

Answer

The Google Cloud Privacy Notice, which explains what data Google collects about users of its websites and products.

Answer

The Google Cloud Service Level Agreement, which defines uptime commitments and financial credits for availability shortfalls.

Answer

The Google Cloud Acceptable Use Policy, which lists prohibited activities customers may not perform on the platform.

Question 8

A retail company exposes an internal API on a global external Application Load Balancer. The security team must ensure that only clients presenting a valid client certificate issued by the company's internal CA can reach the backend, while still allowing unauthenticated health checks from Google's load balancer infrastructure. They configure a server TLS policy and a target HTTPS proxy. What must they also configure to enforce mutual TLS correctly?

Accepted Answer

Create a trust store by importing the internal CA certificate into a Certificate Manager trust config, then attach it to the target HTTPS proxy. Enforcing mutual TLS on the global external Application Load Balancer requires two distinct elements: a server TLS policy and target proxy configuration for the server side, and a Certificate Manager trust config that stores the CA certificates used to authenticate clients. Attaching that trust config to the target HTTPS proxy makes the load balancer request and verify client certificates during the handshake. Health checks from Google's infrastructure are handled separately and are not blocked by client certificate validation.

Answer

Enable client certificate validation by setting the proxy's sslPolicy to a policy that includes the client CA in its allowed cipher suites

Answer

Add the internal CA certificate as an additional certificate on the target HTTPS proxy alongside the server certificate

Answer

Configure a backend service with a custom request header containing the client certificate thumbprint, validated by the backend application

Question 9

Your company must comply with the Payment Card Industry Data Security Standard (PCI DSS) for a new e-commerce application on Google Cloud. The security team needs to understand which aspects of PCI DSS compliance are Google's responsibility and which are theirs. According to the Google Cloud shared responsibility model, which of the following is a customer responsibility?

Accepted Answer

Configuration of firewall rules and identity and access management policies for the application.. Under the Google Cloud shared responsibility model, the customer is responsible for security in the cloud, which includes configuring firewall rules and IAM policies. Google is responsible for security of the cloud, covering physical security, hypervisor patching, and network infrastructure. Understanding this division is essential for PCI DSS compliance.

Answer

Patching the hypervisor that runs the Compute Engine virtual machines.

Answer

Physical security of the data centers that host the application.

Answer

Ensuring the physical network is redundant and fault-tolerant.

Question 10

A healthcare company wants to give a partner organization access to a single internal web application hosted on Compute Engine instances in a private subnet with no external IP addresses. The partner has its own Google Cloud project and will connect from its own VPC. The security team wants the connection to stay off the public internet and to avoid exposing the application broadly. Which two configurations should they use? (Choose two.)

Accepted Answer

Publish the application through an internal passthrough Network Load Balancer and create a service attachment referencing that forwarding rule. Private Service Connect provides private, one-directional connectivity from a consumer VPC to a specific published service without traversing the public internet. The producer side requires an internal load balancer forwarding rule referenced by a service attachment, and the consumer side requires an endpoint in the partner's VPC that targets that attachment. This combination exposes only the intended application, avoids external IP addresses, and does not broaden access to other resources as peering or VPN would.

Answer

Configure VPC Network Peering between the healthcare company's VPC and the partner's VPC so the partner can reach the application subnet directly

Answer

Attach an external IP address to the application instances and restrict access with a firewall rule limited to the partner's egress range

Answer

Create a Cloud VPN tunnel between the two VPCs and advertise only the application subnet to the partner

Question 11

A healthcare company stores electronic protected health information (ePHI) in Cloud Storage and BigQuery. During a compliance audit, they must demonstrate that access to ePHI is logged and that any modification to ePHI can be traced. Which Google Cloud feature should they enable to meet this requirement?

Accepted Answer

Cloud Audit Logs with Data Access audit logs enabled for Cloud Storage and BigQuery. Data Access audit logs capture read and write operations on ePHI, providing the necessary audit trail for HIPAA compliance. Other options are security controls but do not fulfill the logging and traceability requirement.

Answer

VPC Service Controls perimeter around the projects containing ePHI

Answer

Customer-managed encryption keys (CMEK) in Cloud KMS for Cloud Storage and BigQuery

Answer

Cloud DLP inspection jobs scheduled to scan for sensitive data

Question 12

A security engineer is configuring a VPC firewall rule to allow traffic from a specific on-premises network to a Compute Engine instance over Cloud VPN. The on-premises network uses a dynamic routing protocol, and the engineer wants to ensure that the firewall rule only allows traffic from the exact on-premises subnet. Which source should the engineer specify in the firewall rule?

Accepted Answer

The on-premises subnet's CIDR range, because Cloud VPN preserves the original source IP addresses.. Cloud VPN does not perform NAT, so packets retain their original on-premises source IP addresses. To allow only traffic from a specific on-premises subnet, the firewall rule must specify that subnet's CIDR range as the source. Using the VPN gateway's IPs or BGP peer IP would not match the actual source and would block legitimate traffic.

Answer

The internal IP address of the Cloud VPN gateway, because the gateway acts as a proxy for on-premises traffic.

Answer

The Cloud VPN gateway's external IP address, because all traffic appears to originate from the VPN gateway.

Answer

The BGP peer IP address of the on-premises router, because BGP next-hop is used as the source for firewall matching.

Question 13

A healthcare analytics company stores patient records in Cloud Storage and BigQuery. A compliance officer requires an automated, recurring scan of these data sources to discover sensitive data such as personally identifiable information (PII) and protected health information (PHI), and to produce findings that can be reviewed for audit. The security team wants minimal operational overhead and no custom code. Which Google Cloud service should they use to meet this requirement?

Accepted Answer

Sensitive Data Protection (Cloud DLP) discovery scans scheduled via the console or API. Recurring sensitive-data discovery across Cloud Storage and BigQuery is a native capability of Sensitive Data Protection. Scheduling scans produces findings that can be retained and reviewed for compliance audits, and the built-in infoType detectors avoid custom code. The other services either aggregate existing findings, require custom pipeline development, or enforce access boundaries rather than inspecting data content.

Answer

Cloud Security Command Center Premium findings export to BigQuery

Answer

Cloud Data Fusion pipeline with a custom regex-based transformation

Answer

VPC Service Controls perimeter with access level restrictions

Question 14

A healthcare company processes protected health information (PHI) on Google Cloud and must comply with HIPAA. They need to ensure that all data at rest in Cloud Storage, BigQuery, and Cloud SQL is encrypted with keys they control, and that key usage is logged for audit. Which combination of Google Cloud services should they implement to meet these requirements?

Accepted Answer

Cloud KMS with customer-managed encryption keys (CMEK) and Cloud Audit Logs for Cloud KMS.. To meet HIPAA requirements for customer-controlled encryption keys and auditable key usage across multiple data services, Cloud KMS with CMEK is the appropriate choice. CMEK integrates with Cloud Storage, BigQuery, and Cloud SQL, and Cloud Audit Logs for Cloud KMS record all key operations. This provides both the control and the audit evidence needed.

Answer

Customer-supplied encryption keys (CSEK) stored in Cloud Storage and Cloud Logging sinks.

Answer

Cloud HSM with automatically generated keys and VPC Service Controls.

Answer

Google-managed encryption keys and Access Transparency logs.

Question 15

A multinational retailer must demonstrate to an auditor that its Google Cloud environment enforces data residency for a regulated workload in a specific jurisdiction. The security team wants Google Cloud to deploy and monitor the workload against a predefined control package aligned to that jurisdiction, including automatic monitoring for compliance violations. Which Google Cloud solution should they use?

Accepted Answer

Assured Workloads with a jurisdiction-specific control package. Assured Workloads is designed for regulated workloads that must meet jurisdiction-specific requirements. Selecting an appropriate control package enforces data residency and personnel access constraints and provides continuous monitoring for violations, giving auditors a clear compliance narrative. Organization Policy, VPC Service Controls, and Cloud Asset Inventory each address narrower concerns and do not by themselves deliver an aligned, monitored control package.

Answer

Cloud Asset Inventory with a custom compliance dashboard

Answer

VPC Service Controls with access levels based on corporate IP ranges

Answer

Organization Policy constraints that restrict resource locations