PCSE Practice Test 47 — 15 Questions

Question 1

A security engineer is troubleshooting an issue where a Compute Engine VM cannot connect to a Cloud SQL instance that has a private IP address. Both resources are in the same VPC network. The VM's firewall rules allow egress to any destination, and the Cloud SQL instance's authorized networks include the VPC network. What is the most likely cause of the connection failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VPC network does not have a private services access connection (VPC peering) to the Service Networking API.. Cloud SQL instances with private IP addresses require a private services access connection (VPC peering) between the VPC network and the Service Networking API's managed tenant project. Without this VPC peering, the VM cannot route traffic to the Cloud SQL instance's private IP, even if both are in the same VPC network. Option C directly identifies this missing prerequisite.

Answer

Private Google Access is not enabled on the subnet.

Answer

The VM's firewall rules block traffic to the Cloud SQL IP range.

Answer

The Cloud SQL instance requires the Cloud SQL Auth proxy to be installed on the VM.

Question 2

An organization wants to encrypt data at rest using customer-managed keys on Compute Engine persistent disks. They need to provide the key material with each API call, and Google should never store the key. Which encryption approach should they use?

Accepted Answer

Customer-supplied encryption keys (CSEK). Customer-Supplied Encryption Keys (CSEK) allow the customer to provide their own encryption keys, which are used to encrypt data at rest. The keys are provided with each API call and are not stored by Google. CMEK uses Cloud KMS where Google stores the key material (encrypted by HSM). GMEK is Google-managed. Cloud HSM is a service for managing keys but still stores them.

Answer

Cloud HSM

Answer

Google-managed encryption keys (GMEK)

Answer

Customer-managed encryption keys (CMEK)

Question 3

Your company is deploying a multi-tier application in a single VPC with two subnets: web (10.0.1.0/24) and db (10.0.2.0/24). The web instances need to connect to a private Cloud SQL instance (MySQL) that is provisioned in a service project. The Cloud SQL instance has a private IP address 10.0.3.5 assigned using private services access. You have established VPC peering between your VPC and the service producer VPC (the Google-managed VPC hosting Cloud SQL). You verified that the peering connection is in 'ACTIVE' state. The web instances can reach internet sites, but connections to the Cloud SQL instance (using the MySQL client) are timing out. The db instances do not need to connect to Cloud SQL. What is the most likely cause and recommended solution?

Accepted Answer

Configure the VPC peering connection to export custom routes from your VPC to the service producer VPC.. The web instances are timing out when connecting to the Cloud SQL private IP (10.0.3.5) because the VPC peering connection is not exporting custom routes from your VPC to the service producer VPC. By default, VPC peering does not export custom routes (including the subnet routes for 10.0.1.0/24 and 10.0.2.0/24) unless explicitly configured. Without these routes, the Cloud SQL instance cannot send response traffic back to the web instances, causing the TCP handshake to fail (SYN sent, SYN-ACK never received). Enabling 'Export custom routes' on the peering connection from your VPC to the service producer VPC resolves this by advertising your subnet routes to the Cloud SQL host VPC.

Answer

Re-create the VPC peering connection because it might be misconfigured.

Answer

Change the Cloud SQL instance to use a public IP and allowlist your web subnet.

Answer

Set up Cloud NAT for the web subnet to enable outbound connections.

Question 4

An engineer notices that traffic on port 80 is not reaching instances with the tag 'http-server'. The instances have external IPs and are in the default VPC. What could be the reason?

Accepted Answer

A deny rule with a lower priority number (higher priority) exists and blocks the traffic.. A deny rule with a lower priority number (higher priority) will override the allow rule for port 80, blocking traffic. Option A is incorrect because sourceRanges refers to allowed source IPs, not the instance's public IP. Option B is incorrect because if the targetTags are not applied, the rule would not affect those instances, but the issue is specifically about traffic not reaching instances with the tag 'http-server', implying the allow rule exists but is overridden. Option D is incorrect because direction should be INGRESS for incoming traffic, not EGRESS.

Answer

The sourceRanges does not include the instance's public IP.

Answer

The targetTags are not applied to the instances.

Answer

The direction should be EGRESS.

Question 5

An organization wants to enforce that all Compute Engine instances must use a specific service account. Which three steps are necessary? (Choose three.)

Accepted Answer

Grant the service account the needed roles on the project.. The service account must be granted the necessary IAM roles on the project (or specific resources) to perform its intended actions. Without these grants, even if the service account is enforced, it will lack permissions to interact with Compute Engine resources. This step ensures the service account has the required access, such as compute.instanceAdmin or custom roles, to manage instances.

Answer

Create a custom role with compute.instances.create permission.

Answer

Grant the compute.instanceAdmin role to the service account.

Question 6

A company notices that some Compute Engine instances are making unexpected outbound connections to suspicious IP addresses. They want to investigate the traffic patterns and identify the source of these connections. Which tool should they use?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about network traffic to and from Compute Engine instances, including source/destination IPs, ports, and protocols. By analyzing these logs, the company can identify the specific instances making unexpected outbound connections to suspicious IP addresses, enabling investigation of traffic patterns.

Answer

Cloud Armor

Answer

Cloud IAM

Answer

Firewall Rules Insights

Question 7

A security engineer needs to automatically rotate a database password stored in Secret Manager every 60 days. Which approach meets this requirement with minimal operational overhead?

Accepted Answer

Set the rotation period in Secret Manager to 60 days and configure a Pub/Sub topic to trigger a Cloud Function that generates a new password. Secret Manager supports automatic rotation with a specified rotation period and Pub/Sub notifications. A Cloud Function can listen for the notification and generate a new password, updating the secret version.

Answer

Set the secret's `next_rotation_time` to 60 days from now; no further action needed

Answer

Enable automatic rotation with a 60-day period in Cloud KMS, which will automatically update the secret

Answer

Use a cron job on Compute Engine to update the secret every 60 days

Question 8

A financial services company needs to inspect all inbound and outbound packets from a subnet containing highly sensitive data for compliance. They have enabled VPC Flow Logs on that subnet, which record metadata such as source and destination IP, ports, and protocol. However, the security team requires the actual packet payload to perform deep packet inspection (DPI) for malicious patterns. They want to capture the packets without disrupting network traffic. Which additional configuration should be implemented to meet this requirement?

Accepted Answer

Enable Packet Mirroring on a Compute Engine instance in the subnet to mirror all packets to a collector instance.. Packet Mirroring clones all packets (including payload) from a source instance in the subnet and forwards them to a collector instance for deep packet inspection, without disrupting the original traffic flow. VPC Flow Logs only capture metadata (headers, timestamps) and cannot include payload content, making Packet Mirroring the only solution that meets the requirement for actual packet payload capture.

Answer

Configure Cloud Armor to log all HTTP requests with full request body.

Answer

Enable VPC Flow Logs with metadata capture set to 'include payload'.

Answer

Enable Cloud NAT logging to capture all outbound traffic payloads.

Question 9

Your company, a global e-commerce platform, must comply with the PCI DSS requirement to secure cardholder data. You have a multi-cloud environment with workloads on Google Cloud and AWS. The Google Cloud environment consists of Compute Engine instances that process credit card transactions, and a Cloud SQL for MySQL database that stores encrypted cardholder data. The security team requires that only specific service accounts can connect to the database, and all connections must be encrypted. Additionally, you need to ensure that the database is not publicly accessible and that all access is logged. You have configured the Cloud SQL instance with a private IP and enabled SSL/TLS. However, a recent audit revealed that a Compute Engine instance with a public IP and no service account was able to connect to the database and execute queries. The instance was not authorized in the Cloud SQL authorized networks. What is the most likely cause of this security gap, and what should you do to prevent it?

Accepted Answer

The instance was in the same VPC and used the default Compute Engine service account with cloudsql.client role. You should disable the default service account and use a custom service account with the least privilege.. The Compute Engine instance was in the same VPC as the Cloud SQL instance (private IP), and it used the default Compute Engine service account, which had the cloudsql.client role. This allowed the instance to connect via the Cloud SQL Proxy or directly using the private IP without being listed in authorized networks, as VPC internal connectivity bypasses authorized networks. The fix is to disable the default service account and assign a custom service account with only the necessary permissions, ensuring least privilege and preventing unauthorized access.

Answer

The instance bypassed SSL enforcement because the database was configured to accept non-encrypted connections. You should enable the 'require SSL' flag.

Answer

The instance used the Cloud SQL Proxy, which bypasses network controls. You should remove the proxy and require direct connections over private IP.

Answer

VPC Service Controls were not configured to block the connection. You should create a service perimeter to prevent data exfiltration.

Question 10

A security engineer needs to automatically remediate a high-severity finding in Security Command Center. The remediation involves restarting a Compute Engine instance. What is the recommended approach?

Accepted Answer

Create a Cloud Function triggered by a Pub/Sub notification from SCC, and use the Compute Engine API to restart the instance.. SCC notifications to Pub/Sub and Cloud Functions is the standard pattern for automated remediation.

Answer

Configure a log sink to Cloud Functions and parse logs for the finding.

Answer

Use a Compute Engine startup script to check SCC and restart.

Answer

Use Cloud Scheduler to periodically check SCC and restart instances.

Question 11

You are a security engineer for a company that runs a critical application on Google Cloud. You need to implement defense in depth for network security. Which TWO of the following are effective network security controls that you should implement?

Accepted Answer

VPC firewall rules to restrict traffic between subnets. VPC firewall rules (B) are a fundamental network security control that allow you to restrict traffic between subnets based on source/destination IP ranges, protocols, and ports. This implements network segmentation and micro-segmentation, which is a core principle of defense in depth. Cloud Armor (E) provides Web Application Firewall (WAF) capabilities and DDoS protection at the edge of Google's network, filtering malicious traffic before it reaches your VMs or load balancers.

Answer

OS-level host-based firewalls on each VM

Answer

IAM roles to control who can create Compute Engine instances

Answer

Workload Identity Federation to allow workloads to authenticate to Google APIs

Question 12

A company has configured a HA VPN between Google Cloud and an on-premises data center using two tunnels with separate Cloud Routers and BGP sessions in active/active mode. Each Cloud Router is configured to learn routes from the on-premises side and advertise VPC subnets. Recently, one of the tunnels experienced a physical link failure and went down. The security team notices that the remaining tunnel is still up and passing traffic, but some routes that were learned via the failed tunnel are no longer present in the routing table of that Cloud Router. The on-premises administrator confirms that the routes are still being advertised from the local router. What is the impact on traffic to the on-premises network?

Accepted Answer

Traffic destined to subnets only reachable via the failed tunnel will be dropped.. In an active/active HA VPN with separate Cloud Routers and BGP sessions, each Cloud Router maintains its own independent routing table. When a tunnel fails, the BGP session associated with that Cloud Router goes down, causing all routes learned via that session to be withdrawn. Even though the on-premises router continues to advertise the routes, the Cloud Router that lost its BGP session will no longer have those routes in its routing table. Traffic destined to subnets that were only reachable through the failed tunnel will be dropped because the remaining Cloud Router does not have a route for those subnets.

Answer

The failed tunnel will automatically be restored by BGP when the link comes back.

Answer

The Cloud Router will initiate a failover to a secondary BGP session.

Answer

All traffic will continue to flow through the remaining tunnel without any disruption.

Question 13

A company in the EU is moving to Google Cloud and must comply with GDPR data residency requirements. They have users across multiple EU countries and want to ensure that personal data remains within the European Economic Area (EEA). They plan to use Cloud Storage, BigQuery, and Compute Engine. The security administrator sets organization policies to restrict resource locations to europe-west1, europe-west3, and europe-west4. After deploying applications, the compliance team finds that some data is stored in a Cloud Storage bucket in us-central1. Investigation shows that the bucket was created by a developer who manually chose the region. The organization policy seems to have been bypassed. The administrator confirms the policy is active and applied to the project. What is the most likely cause?

Accepted Answer

The organization policy was set at the folder level, and the project where the bucket was created is not a child of that folder.. Organization policies in Google Cloud are hierarchical and apply only to resources within the scope of the node (organization, folder, or project) where they are set. If the policy is set at a folder level, it does not affect projects that are not children of that folder. In this scenario, the bucket was created in a project outside the folder hierarchy where the policy was applied, so the policy was not enforced on that project, allowing the developer to choose us-central1.

Answer

The policy only applies to Compute Engine resources, not Cloud Storage.

Answer

The developer has the orgpolicy.policyCreator role, which allows them to bypass the policy.

Answer

The policy was set to allowlist mode, and us-central1 is in the allowlist.

Question 14

A healthcare company stores de-identified patient data in BigQuery for analytics. They must comply with HIPAA and ensure that re-identification is not possible. They also need to be able to join data on a per-patient basis for longitudinal studies. Which TWO strategies should they implement? (Choose 2)

Accepted Answer

Use Cloud DLP to mask patient identifiers consistently across all tables.. Tokenization or consistent masking allows longitudinal joins while de-identifying data. Other methods either risk re-identification or break join capability.

Answer

Apply differential privacy to all queries using the Differential Privacy library in BigQuery.

Answer

Enable BigQuery column-level security to restrict access to identifiers.

Answer

Store patient identifiers in a separate, access-controlled dataset and join using SQL.

Question 15

A company is using Cloud Data Loss Prevention (DLP) to inspect and de-identify sensitive data in Cloud Storage. They want to classify data using infoTypes and apply de-identification techniques. Which TWO actions should they take?

Accepted Answer

Use the DLP API to inspect the storage for sensitive data.. The DLP API's `inspect` method is the primary mechanism to scan Cloud Storage objects for sensitive data patterns defined by infoTypes. Option C is correct because after inspection, de-identification transformations like masking or tokenization are applied via the DLP API's `deidentify` method to redact or replace sensitive content. Together, these two actions form the standard workflow for classifying and protecting data in Cloud Storage using Cloud DLP.

Answer

Create custom infoTypes for all sensitive data.

Answer

Store de-identification templates in Cloud KMS.

Answer

Use VPC Service Controls to restrict access to the data.