PCSE Practice Test 46 — 15 Questions

Question 1

A security engineer is designing a VPC Service Controls perimeter to protect a project containing sensitive data stored in Cloud Storage and BigQuery. The perimeter currently allows access from an on-premises data center via private connectivity (Cloud Interconnect). The business requires that a third-party SaaS application (outside the perimeter) be able to write data into a specific Cloud Storage bucket. Which action should the engineer take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a service account for the SaaS application, grant it the Storage Object Creator role, and configure an access level that includes the service account. Then, add that access level to the perimeter's ingress policy.. VPC Service Controls perimeters use ingress policies to explicitly allow access from outside the perimeter. By creating a service account for the SaaS application, granting it the Storage Object Creator role, and configuring an access level that includes that service account, the engineer can add the access level to the perimeter's ingress policy. This allows the external SaaS application to write data into the specific Cloud Storage bucket while still blocking all other external access, maintaining the security of the sensitive data.

Answer

Create a service account for the SaaS application and grant it the Storage Object Creator role; then add the service account to the perimeter's allowed identities.

Answer

Create an access level that includes the SaaS application's IP addresses and use that in the perimeter's ingress policy.

Answer

Add the SaaS application's external IP addresses to the perimeter's allowed IP ranges.

Question 2

Which Google Cloud compliance certification requires the customer to sign a Business Associate Agreement (BAA) with Google?

Accepted Answer

HIPAA. HIPAA requires a BAA between a covered entity (or business associate) and Google Cloud before processing Protected Health Information (PHI).

Answer

PCI DSS

Answer

SOC 2

Answer

FedRAMP

Question 3

A company wants to use Cloud Armor to block traffic from specific countries to comply with data sovereignty requirements. They have a global HTTP Load Balancer configured. Where should they configure the Cloud Armor policy?

Accepted Answer

Attach to the backend service of the load balancer.. Cloud Armor policies must be attached to a backend service (or backend bucket) of a global HTTP(S) Load Balancer to filter traffic at the edge. This allows the policy to evaluate incoming requests based on geographic location before they reach the backend, enforcing data sovereignty rules without modifying VPC networking or firewall rules.

Answer

Attach to the VPC network that hosts the load balancer.

Answer

Configure as an Organization Policy constraint.

Answer

Configure as a firewall rule in the VPC network.

Question 4

Your VPC has a default firewall rule that allows SSH (TCP port 22) from all sources. You need to allow HTTP traffic (TCP port 80) only from instances tagged 'web-servers' to the target instances, and block all other inbound traffic including SSH. Which TWO steps should you take?

Accepted Answer

Delete the default-allow-ssh rule.. Deleting the default-allow-ssh rule removes the rule that permits SSH from all sources (0.0.0.0/0), which is necessary to block all inbound SSH traffic as required. Option D is correct because creating a firewall rule with priority 1000 that allows ingress on TCP port 80 from instances tagged 'web-servers' explicitly permits HTTP traffic only from the desired source, and since lower priority numbers are evaluated first, this rule will be applied before any higher-numbered (lower priority) default rules.

Answer

Modify the default-allow-ssh rule to set its source filter to an empty range.

Answer

Create a firewall rule with priority 65535 allowing all traffic from 0.0.0.0/0.

Answer

Create a firewall rule with priority 1000 allowing ingress from instances with tag 'web-servers' on TCP port 443.

Question 5

A company is migrating a legacy on-premises application to Google Compute Engine. The application requires a static IP address for compliance with a regulatory requirement that outbound connections to a partner's IP whitelist must originate from a known, fixed IP. The application will run in a managed instance group (MIG) for high availability. Which of the following solutions meets the compliance requirement?

Accepted Answer

Use Cloud NAT with a static NAT IP address for all egress traffic from the instances.. Cloud NAT with a static NAT IP address provides a fixed source IP for all outbound traffic from instances in the managed instance group (MIG). This meets the compliance requirement for a known, static IP for partner whitelisting. Cloud NAT is designed for outbound connectivity and works seamlessly with MIGs for high availability. Option B is incorrect because a regional external HTTPS load balancer is designed for inbound traffic, not outbound routing; it cannot serve as a forward proxy for egress traffic.

Answer

Configure VPC Service Controls to allow egress only from a specific IP range.

Answer

Use a regional external HTTPS load balancer with a static IP address and configure the MIG to route outbound traffic through the load balancer.

Answer

Assign static external IP addresses to each instance in the MIG and configure the partner firewall accordingly.

Question 6

A healthcare organization is migrating to Google Cloud and needs to achieve HIPAA compliance. Which THREE actions are required to meet HIPAA requirements on GCP? (Choose THREE.)

Accepted Answer

Enable Cloud Audit Logs for all services handling ePHI. Enabling Cloud Audit Logs for all services handling ePHI is a direct requirement under HIPAA's Security Rule (45 CFR § 164.312(b)), which mandates audit controls to record and examine activity in systems that contain or use electronic protected health information. Cloud Audit Logs provide immutable, tamper-evident logs of admin activities, data access, and system events, which are essential for demonstrating compliance during audits or breach investigations. Without these logs, the organization cannot meet the audit control standard for ePHI environments on GCP.

Answer

Enable VPC Flow Logs for all subnets

Answer

Use Cloud NAT for outbound internet access

Question 7

A multinational corporation must comply with GDPR and requires that data stored in BigQuery is physically located in the European Union. They have set up BigQuery datasets in the EU region. However, a compliance audit reveals that some queries may process data in the US region due to BigQuery's multi-region behavior. What should the organization do to ensure data remains in the EU?

Accepted Answer

Create BigQuery datasets in a specific European region (e.g., europe-west1) instead of the EU multi-region.. Creating a BigQuery dataset in a specific European region (e.g., europe-west1) ensures that all data storage and query processing are physically confined to that single region. In contrast, the EU multi-region (EU) is a geographic entity that includes multiple Google Cloud regions within the European Union, and BigQuery may process data in any of those regions, including potentially outside the EU if the multi-region expands. By using a specific regional dataset, the organization guarantees that data never leaves the designated European location, meeting GDPR's data residency requirements.

Answer

Use the EU multi-region dataset and configure VPC Service Controls to restrict access.

Answer

Enable BigQuery CMEK with keys stored in a European Cloud KMS key ring.

Answer

Use BigQuery reservations to guarantee that data processing happens in the EU.

Question 8

A company is implementing a data retention policy for Cloud Storage buckets. They need to ensure that objects cannot be deleted before a specified retention period. Which THREE features can they use? (Choose THREE.)

Accepted Answer

Retention Policy on the bucket.. A is correct because a Retention Policy on a Cloud Storage bucket enforces a minimum retention period for all objects in the bucket. Once set, objects cannot be deleted or overwritten until the retention period expires, directly meeting the requirement to prevent deletion before a specified time.

Answer

Lifecycle rules with a Delete action.

Answer

Object versioning.

Question 9

Which THREE of the following are valid requirements for using VPC Network Peering? (Choose three.)

Accepted Answer

Subnet routes are automatically exchanged between the peered VPCs.. VPC Network Peering automatically exchanges subnet routes between the peered VPCs, enabling private IP connectivity without requiring additional route tables or VPN gateways. This route exchange is implicit once the peering connection is established, provided the networks do not have overlapping CIDR blocks.

Answer

Cloud NAT must be configured in at least one VPC.

Answer

An IAM role with compute.networkAdmin must be granted to all users.

Question 10

Which THREE of the following are required to enable VPC Flow Logs for a subnet? (Choose THREE.)

Accepted Answer

A subnet in the VPC. A subnet in the VPC is required because VPC Flow Logs capture IP traffic metadata at the subnet level. Without a subnet, there is no network segment to monitor, as flow logs are associated with a specific subnet within a VPC.

Answer

A sample rate

Answer

An aggregation interval

Question 11

A company wants to audit all changes to IAM policies in their organization. They need to set up logging to capture these changes. Which TWO steps should they take? (Choose TWO.)

Accepted Answer

Enable Admin Activity audit logs for the organization.. Admin Activity audit logs record operations that modify the configuration or metadata of resources, such as IAM policy changes. Enabling Admin Activity audit logs at the organization level captures these changes across all projects within the organization, providing a centralized audit trail. This is the correct step because IAM policy modifications are classified as admin activity, not system events or data access.

Answer

Enable Admin Activity audit logs for each individual project.

Answer

Enable System Event audit logs for the organization.

Answer

Enable Data Access audit logs for the organization.

Question 12

A security engineer is designing a solution to monitor and detect anomalous IAM role usage across multiple Google Cloud projects. The engineer wants to create a centralized logging solution that captures all IAM policy changes and access attempts. Which THREE services should the engineer use together to achieve this?

Accepted Answer

BigQuery. BigQuery is correct because it serves as the centralized analytics destination for Cloud Audit Logs, enabling the security engineer to run SQL queries across IAM policy changes and access attempts from multiple Google Cloud projects. By exporting audit logs to BigQuery, you can perform complex aggregations and anomaly detection at scale, which is essential for monitoring IAM role usage across a fleet of projects.

Answer

Cloud Monitoring

Answer

Cloud Functions

Question 13

A company wants to grant a third-party auditor read-only access to specific BigQuery datasets in a project. The auditor's identity is managed in their own Google Cloud organization. What is the most secure way to grant access?

Accepted Answer

Create a service account in the company's project, grant it the BigQuery Data Viewer role, and allow the auditor's organization to use that service account via Workload Identity Federation.. It uses Workload Identity Federation to allow the auditor's Google Cloud organization to impersonate a service account in the company's project without sharing a key. This grants read-only access via the BigQuery Data Viewer role while eliminating the risk of long-lived credentials. The auditor's identity is managed externally, and access is granted through a secure, federated trust relationship.

Answer

Share the project's service account key with the auditor so they can impersonate it.

Answer

Use VPC Service Controls to allow access only from the auditor's IP range.

Answer

Create a Google Group and add the auditor's email addresses, then grant the group the BigQuery Data Viewer role.

Question 14

A company uses Cloud Armor security policies to protect their HTTP load balancer. They need to block requests from a specific geographic region (country X) and also limit requests from any IP to 1000 requests per second. They also want to use preconfigured rules for SQL injection prevention. What is the correct way to combine these requirements in a single security policy?

Accepted Answer

Create separate rules: one for geo-blocking with priority 500, one for rate limiting with priority 600, and enable preconfigured SQLi rules at priority 1000. Order them appropriately.. Cloud Armor rules are evaluated in order of priority (lowest number first). Preconfigured rules (like SQLi) have a priority of 1000 by default. Geographic and rate limiting rules can be added with custom priorities. The rule order matters: typically, you want to block/rate-limit before applying WAF rules to reduce processing. However, the question is about combining them correctly: all rule types can coexist in a single policy. The key is that each rule type has its own configuration; you can't set rate limiting in the same rule as geo-blocking; they must be separate rules.

Answer

Create a single custom rule with both geo-blocking and rate limiting conditions using CEL expressions, and enable preconfigured SQLi rules.

Answer

Use Cloud Armor Managed Protection Plus, which automatically includes geo-blocking and rate limiting.

Answer

Enable SQLi preconfigured rules only; geo-blocking and rate limiting are not supported in Cloud Armor.

Question 15

Drag and drop the steps to set up a binary authorization policy for a GKE cluster in the correct order.

Accepted Answer

Create a Container Analysis note, then create an attestor in Binary Authorization, then create a policy that requires attestation, then enable Binary Authorization on the GKE cluster, then deploy a signed image to test.. Binary Authorization requires authority creation, attestor setup, policy creation, cluster enablement, and testing.

Answer

Create a policy that requires attestation, then enable Binary Authorization on the GKE cluster, then create an attestor, then create a Container Analysis note, then deploy a signed image to test.

Answer

Enable Binary Authorization on the GKE cluster, then create a Container Analysis note, then create an attestor, then create a policy, then deploy a signed image to test.

Answer

Create a Container Analysis note, then create a policy, then create an attestor, then enable Binary Authorization on the GKE cluster, then deploy a signed image to test.