PCSE Practice Test 47 — 15 Questions

Question 1

A security engineer needs to allow HTTP traffic from the internet to a web server hosted on a Compute Engine instance. The instance is in a VPC network with a default deny ingress rule. The engineer wants to minimize the attack surface. What should the engineer do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an ingress firewall rule allowing TCP port 80 from 0.0.0.0/0 to the instance's network tag.. To allow HTTP traffic from the internet to a specific web server while minimizing the attack surface, create an ingress firewall rule that allows TCP port 80 from 0.0.0.0/0 to the instance's network tag. This targets only the intended instance and leaves the default deny rule for other traffic. Allowing all ports or applying to all instances would be overly permissive.

Answer

Create an ingress firewall rule allowing TCP port 80 from 0.0.0.0/0 to all instances in the VPC.

Answer

Create an ingress firewall rule allowing all TCP ports from 0.0.0.0/0 to the instance's network tag.

Answer

Create an ingress firewall rule allowing TCP port 80 from the instance's subnet CIDR range to the instance's network tag.

Question 2

A financial services firm is preparing for a compliance audit of its Google Cloud environment. The auditor asks for evidence that access to sensitive production projects is governed and that administrative actions are traceable. The security team needs to produce configuration and activity evidence from Google Cloud. (Choose two.)

Accepted Answer

Cloud Audit Logs Admin Activity entries showing IAM policy changes and resource configuration events. Cloud Audit Logs Admin Activity entries provide an immutable, retained record of administrative and configuration changes, while Cloud Asset Inventory exports capture the effective IAM bindings on projects and folders. Together they demonstrate both the current access configuration and the history of who changed it, which is exactly the evidence an auditor requests for access governance and traceability.

Answer

Security Command Center Premium vulnerability findings for Compute Engine instances

Answer

Cloud Monitoring uptime check history for production services

Answer

VPC Flow Logs showing accepted and rejected connections to production subnets

Question 3

A startup must satisfy a compliance requirement to prove that its production data stored in Cloud Storage has not been altered or deleted by an insider or a compromised account. The security team wants a control that prevents any user, including project owners, from deleting or modifying objects for a defined period, and that provides an audit trail of the retention. Which Cloud Storage feature should they enable?

Accepted Answer

Bucket Lock with a retention policy. Bucket Lock with a retention policy enforces write-once-read-many behavior for a defined period and, once locked, the policy cannot be removed or shortened. This prevents deletion or modification even by highly privileged users, and the policy itself serves as auditable evidence. Object Versioning, uniform bucket-level access, and signed URLs all manage access or recovery but none guarantees immutability.

Answer

Signed URLs with short expiration times

Answer

Uniform bucket-level access

Answer

Object Versioning on the bucket

Question 4

A healthcare company must prove to regulators that protected health information stored in Cloud Storage is encrypted with keys it controls and that key usage is independently auditable. The security team wants to rotate keys on a defined schedule without re-encrypting existing objects and must be able to revoke access instantly if a key is compromised. Which configuration should they implement?

Accepted Answer

Customer-managed encryption keys in Cloud KMS with a rotation schedule and key version destruction. Customer-managed encryption keys in Cloud KMS satisfy all three regulatory demands: customer control of key material, scheduled rotation without re-encrypting existing objects, and instant revocation by disabling or destroying a key version. Cloud Storage uses envelope encryption, so rotating the KMS key only affects future data encryption key wrapping; existing objects remain decryptable through their original key versions until those versions are destroyed.

Answer

Google-managed encryption keys with Bucket Lock retention

Answer

Cloud HSM keys stored in a hardware security module with envelope encryption disabled

Answer

Customer-supplied encryption keys passed in each request with `x-goog-encryption-key`

Question 5

A company is deploying a workload that handles Controlled Unclassified Information (CUI) and must comply with DFARS 252.204-7012. They need to ensure that all data remains within the United States and that only U.S. persons can access it. They also need to generate compliance reports for auditors. Which Google Cloud service should they use?

Accepted Answer

Assured Workloads for DFARS with the 'DFARS' control package.. Assured Workloads with the DFARS control package is purpose-built to meet DFARS 252.204-7012 requirements. It enforces data residency in US regions, restricts access to U.S. persons, and provides compliance monitoring and reporting. This directly addresses the need to handle CUI in accordance with DFARS, including personnel and location controls, and to generate audit reports.

Answer

VPC Service Controls with a perimeter that includes all projects and restricts access to US IP addresses.

Answer

Assured Workloads for FedRAMP Moderate with the 'US Regions and Support' control package.

Answer

Cloud Identity-Aware Proxy (IAP) with access restricted to users in the United States.

Question 6

A company is preparing for a SOC 2 Type II audit. They need to demonstrate that access to their Google Cloud environment is controlled and monitored. Which two Google Cloud features should they implement to meet the access control and monitoring requirements? (Choose two.)

Accepted Answer

Cloud Identity and Access Management (IAM) with predefined roles and least privilege.. Cloud IAM with least privilege ensures that access to resources is restricted and managed, which is core to SOC 2 access control. Cloud Audit Logs provide the necessary monitoring by recording all administrative and data access activities, creating an audit trail. Together, they address the requirements to control and monitor access, and they can be integrated with other tools for reporting.

Answer

Identity-Aware Proxy (IAP) to control access to applications based on user identity and context.

Answer

Cloud DLP to discover and classify sensitive data across the environment.

Answer

VPC Service Controls with a perimeter around all projects to prevent data exfiltration.

Question 7

A multinational bank operates in several countries and must keep certain customer data within specific jurisdictions while still allowing a global security team to monitor for threats. The security team needs to detect anomalous access attempts across all regions without moving or replicating the regulated data outside its approved location. Which approach best satisfies both the data residency requirement and the global monitoring need?

Accepted Answer

Use Assured Workloads with a data residency control package and route security findings to a centralized Security Command Center. Assured Workloads with a data residency control package restricts where resources can be created and limits Google personnel access to approved regions, enforcing the residency obligation. Security Command Center centralizes findings and threat detection across projects, so the global security team gains visibility without relocating regulated data. Metadata and findings can cross borders; the regulated content itself stays in its jurisdiction.

Answer

Store regulated data in Cloud Storage with CMEK keys per region and grant the global team viewer access

Answer

Enable VPC Service Controls perimeters around each region and export raw packet captures to a central project

Answer

Replicate all regulated datasets into a central multi-region bucket and monitor from there

Question 8

A security engineer needs to implement hierarchical firewall policies to enforce a rule that denies all egress traffic to a specific CIDR range (203.0.113.0/24) for all projects under a folder. The rule must be inherited by all projects and cannot be overridden. Which configuration should the engineer use?

Accepted Answer

Create a hierarchical firewall policy at the folder level with a deny egress rule for 203.0.113.0/24 and set the policy to be enforced.. Hierarchical firewall policies are evaluated before VPC firewall rules and can be enforced to prevent override. Placing the policy at the folder level ensures it applies to all projects under that folder. Setting it to enforced makes it non-overridable. The other options either apply at the wrong scope, require manual per-project rules, or allow override.

Answer

Create a VPC firewall rule in each project under the folder to deny egress to 203.0.113.0/24.

Answer

Create a hierarchical firewall policy at the folder level with a deny egress rule for 203.0.113.0/24 and set the policy to be allowed to be overridden.

Answer

Create a hierarchical firewall policy at the organization level with a deny egress rule for 203.0.113.0/24 and set the policy to be enforced.

Question 9

A security engineer needs to allow SSH access to a group of Compute Engine VMs from a specific corporate IP range. The VMs are in a VPC network with a firewall rule that denies all ingress by default. Which firewall rule should the engineer create?

Accepted Answer

An ingress rule with action allow, target as the network tag of the VMs, source as the corporate IP range, and protocol/port as tcp:22.. To allow SSH from a specific corporate IP range to a subset of VMs, create an ingress allow rule targeting those VMs by network tag or service account, with source as the corporate CIDR and protocol/port as tcp:22. This is the least privilege approach. The other options either target too broadly, use egress instead of ingress, or deny access.

Answer

An egress rule with action allow, target as the network tag of the VMs, destination as the corporate IP range, and protocol/port as tcp:22.

Answer

An ingress rule with action allow, target as all instances in the network, source as the corporate IP range, and protocol/port as tcp:22.

Answer

An ingress rule with action deny, target as all instances, source as 0.0.0.0/0, and protocol/port as tcp:22.

Question 10

Which two statements correctly describe Cloud KMS key versions? (Choose TWO.)

Accepted Answer

Key versions are immutable once created.. Option A is correct because Cloud KMS key versions are immutable: once a version is created, its key material cannot be changed or regenerated in place; any new key material requires creating a new key version. Option D is correct because a key version can be disabled, which immediately prevents it from being used for cryptographic operations while preserving the key material and version state for possible re-enabling. Option B is wrong because automatic rotation in Cloud KMS works by creating a new key version on a schedule, not by rotating the existing version without creating a new one. Option C is wrong because key version destruction is not immediate: it enters a scheduled-destruction state with a configurable delay (default 30 days) before permanent destruction. Option E is wrong because purpose is a property of the CryptoKey, not of individual key versions, so all versions of a key share the same purpose.

Answer

Key versions can be rotated automatically without creating a new version.

Answer

The destruction of a key version is immediate upon request.

Answer

Each key version can have a different purpose.

Question 11

A company has a Google Cloud organization with several folders and projects. The security team wants to ensure that a specific user cannot create any new projects within the organization, even if they are granted roles that normally allow project creation. What should the team do?

Accepted Answer

Create an IAM deny policy at the organization level that denies the resourcemanager.projects.create permission for the user.. To ensure a user cannot create projects regardless of their other roles, an IAM deny policy at the organization level is the correct tool. Deny policies are evaluated after allow policies and can block specific permissions. Denying resourcemanager.projects.create for the user overrides any allow policies that would otherwise permit project creation. Other methods like removing roles or adding viewer roles do not provide a guarantee against other permissive grants.

Answer

Remove the roles/resourcemanager.projectCreator role from the user at the organization level.

Answer

Apply an organization policy constraint constraints/compute.restrictXpnProjectLienRemoval to prevent project creation.

Answer

Grant the user the roles/viewer role at the organization level to override any project creation permissions.

Question 12

A company needs to meet SOC 2 requirements for change management. They want to log all changes to IAM policies in their Google Cloud organization. What should they do?

Accepted Answer

Use Admin Activity audit logs, which are enabled by default.. Admin Activity audit logs, which are enabled by default. Admin Activity audit logs record all API calls that modify configuration or metadata, including IAM policy changes (e.g., SetIamPolicy), and they are always enabled and cannot be disabled, so they satisfy SOC 2 change-management logging without extra configuration. Option A is insufficient because Cloud Asset Inventory scans are periodic snapshots, not a continuous audit trail of every change. Option B only notifies on changes rather than providing the required immutable log record, and Option C is unnecessary since Data Access audit logs capture reads/writes of data, not administrative IAM policy modifications.

Answer

Use Cloud Asset Inventory to scan for changes daily.

Answer

Configure a Cloud Monitoring alert for IAM policy changes.

Answer

Enable Data Access audit logs for all services.

Question 13

A healthcare company stores patient records in Cloud Storage. They must ensure that data is encrypted at rest with keys they fully control, and that keys are automatically rotated every 90 days. They also need to be able to immediately revoke access to the data by disabling the key. Which approach should they use?

Accepted Answer

Use Customer-Managed Encryption Keys (CMEK) in Cloud KMS with a 90-day rotation schedule and the ability to disable the key.. Customer-Managed Encryption Keys (CMEK) in Cloud KMS give the organization full control over key material, including the ability to set a 90-day rotation schedule and disable the key to revoke access immediately. This aligns with data protection requirements for healthcare data, ensuring encryption at rest with customer-controlled keys.

Answer

Use Customer-Supplied Encryption Keys (CSEK) and rotate them manually every 90 days.

Answer

Use Google-managed encryption keys (GMEK) with default Cloud Storage encryption.

Answer

Use Cloud HSM with a key ring and set the rotation period to 90 days.

Question 14

A security engineer needs to monitor for anomalous IAM activity in a Google Cloud organization. They want to detect when a service account key is created for a highly privileged service account and alert the security team in near real-time. They also want to minimize false positives. Which approach should they use?

Accepted Answer

Configure a log sink to Pub/Sub with a filter for the CreateServiceAccountKey method and the specific service account, then trigger a Cloud Function to send an alert.. A log sink to Pub/Sub with a precise filter on the method and service account enables near real-time, targeted alerting. This minimizes false positives by only triggering on the specified high-privilege service account. Cloud Functions can then send alerts.

Answer

Create a log-based metric for the CreateServiceAccountKey method and set up an alerting policy in Cloud Monitoring.

Answer

Enable Security Command Center Premium and rely on its built-in IAM anomaly detection.

Answer

Use Cloud Audit Logs to export all Admin Activity logs to BigQuery and run a scheduled query to find key creations.

Question 15

A company needs to allow its on-premises data center to reach internal Compute Engine instances over a private connection. They have set up Cloud Interconnect and want to ensure that traffic from the on-premises CIDR 10.10.0.0/16 can reach VMs in a subnet 10.0.1.0/24 on TCP port 443, but no other on-premises traffic should be allowed. They also want to avoid exposing the VMs to the internet. What should they do?

Accepted Answer

Create an ingress firewall rule allowing tcp:443 from 10.10.0.0/16 to the VMs, and ensure the VMs have no external IP addresses.. The requirement is to allow only 10.10.0.0/16 to reach VMs on TCP 443 privately and avoid internet exposure. An ingress firewall rule scoped to that CIDR and port, combined with no external IPs, achieves this. The implied deny-all blocks other sources. Cloud Interconnect provides private routing, but firewall rules enforce the source restriction.

Answer

Create an egress firewall rule allowing tcp:443 to 10.10.0.0/16, and assign external IP addresses to the VMs for management.

Answer

Create an ingress firewall rule allowing tcp:443 from 0.0.0.0/0 to the VMs, and rely on Cloud Interconnect routing to restrict access to on-premises only.

Answer

Create a VPC firewall rule with direction INGRESS, action ALLOW, source 10.10.0.0/16, target tag 'web', protocol tcp:443, and assign public IP addresses to the VMs so that on-premises can reach them over the internet.