PCSE Practice Test 48 — 15 Questions

Question 1

A financial firm uses Cloud Deployment Manager to manage their Google Cloud infrastructure. They have a strict change management policy requiring that all infrastructure changes in the production environment must be reviewed and approved by a senior engineer before being applied. Currently, developers can modify the Deployment Manager configurations directly, leading to unapproved changes. The company wants to enforce this policy without impacting development agility. What should they implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a CI/CD pipeline with Cloud Build and require approval gates.. A CI/CD pipeline with Cloud Build can include manual approval gates that block deployments until approved. This enforces the change review policy while allowing development to proceed in non-production environments. Option A is incorrect because Deployment Manager snapshots allow rollback but do not prevent unapproved changes. Option B is incorrect because Cloud Audit Logs only monitor changes after they occur; they do not block unauthorized modifications. Option C is incorrect because organization policies that restrict access to Deployment Manager would also block legitimate development work, reducing agility. Therefore, a CI/CD pipeline with approval gates is the best solution.

Answer

Use Deployment Manager snapshots to roll back changes if needed.

Answer

Set up Cloud Audit Logs to monitor changes and alert on unauthorized modifications.

Answer

Use organization policies to restrict access to the Deployment Manager service.

Question 2

An organization uses Cloud Run to deploy microservices. Each microservice needs to authenticate to Cloud Pub/Sub topics. The Security Engineer wants to enforce that each service only uses its own service account and cannot impersonate others. The team also wants to rotate credentials automatically. What is the best practice to achieve this?

Accepted Answer

Assign a dedicated service account to each Cloud Run service with the necessary Pub/Sub publisher role.. Cloud Run allows you to assign a dedicated, per-service service account at deployment time. By granting each service account only the Pub/Sub publisher role on its specific topic, you enforce least-privilege access and prevent impersonation. Cloud Run automatically rotates the short-lived tokens associated with these service accounts via the metadata server, eliminating the need for manual key management.

Answer

Configure each Cloud Run service to use the Compute Engine default service account and rely on the metadata server.

Answer

Use Workload Identity Federation to map each service to a Google service account.

Answer

Create a service account key for each service and store it in Cloud Secret Manager.

Question 3

Which TWO options are valid methods to secure data in transit between an on-premises data center and a Google Cloud VPC?

Accepted Answer

Dedicated Interconnect with MACsec. Dedicated Interconnect with MACsec (Media Access Control Security) provides encryption at Layer 2, securing data in transit over the dedicated connection between your on-premises data center and Google Cloud VPC. MACsec uses GCM-AES-128 or GCM-AES-256 encryption to protect all traffic on the link, ensuring confidentiality and integrity without the overhead of IPsec.

Answer

Private Google Access

Answer

VPC Network Peering

Answer

Internal HTTPS Load Balancing

Question 4

A security engineer needs to set up access for a new team that will manage Cloud Storage buckets and objects. Which three IAM roles might be appropriate based on least privilege? (Choose three.)

Accepted Answer

roles/storage.objectAdmin. (roles/storage.objectAdmin) is correct because it grants full control over objects in Cloud Storage buckets, including listing, reading, creating, and deleting objects, but does not allow modifying bucket-level permissions or deleting buckets. This aligns with least privilege for a team that needs to manage objects without full bucket administration.

Answer

roles/storage.legacyBucketOwner

Answer

roles/storage.admin

Question 5

A company has deployed a multi-region Kubernetes cluster using GKE. The security team wants to ensure that only pods with a specific service account can access a Cloud Storage bucket containing sensitive data. What is the best practice to achieve this?

Accepted Answer

Use Workload Identity to bind the Kubernetes service account to a Google service account with appropriate roles on the bucket.. Workload Identity is the best practice because it allows you to bind a Kubernetes service account (KSA) to a Google service account (GSA) that has been granted specific IAM roles on the Cloud Storage bucket. This eliminates the need to manage and distribute static service account keys, as the pod authenticates directly to Google Cloud APIs using the GSA's identity via a secure token exchange. The GKE node's metadata server is configured to vend tokens for the bound GSA only to pods running with the designated KSA, ensuring that only those pods can access the bucket.

Answer

Store a service account key as a Kubernetes secret and mount it into the pod.

Answer

Create a bucket ACL that grants read access to the GKE node service account.

Answer

Create a PersistentVolume with a GCSFuse bucket and use a pod security policy to restrict access.

Question 6

A company assigns roles to Google Groups to simplify management. They have a group called data-engineers@example.com that needs access to BigQuery datasets. Instead of adding each user individually, they want to grant the group roles/bigquery.dataViewer at the project level. After granting the role, a new member added to the group reports they cannot query a dataset. What is the most likely reason?

Accepted Answer

The dataset is in a different project than the one where the role was granted.. IAM roles granted at the project level apply only to resources within that project. If the BigQuery dataset resides in a different project, the group's project-level role does not grant access to that dataset. The user would need either a role granted at the dataset's project level or direct dataset-level permissions.

Answer

The user needs to be added directly to the dataset's access control list.

Answer

The dataset has been configured with private access control that overrides the project-level IAM.

Answer

The group does not have the necessary permissions because BigQuery does not support IAM groups.

Question 7

Which type of Cloud Audit Logs must be explicitly enabled and incur additional cost?

Accepted Answer

Data Access logs. Data Access logs track read and write operations on resources. They are opt-in, cost extra, and have additional retention costs. Admin Activity logs are free and enabled by default. System Event logs are also free. Policy Denied logs are generated automatically when access is denied.

Answer

Admin Activity logs

Answer

System Event logs

Answer

Policy Denied logs

Question 8

A security architect is designing an IAM hierarchy for a large organization. The requirements are: 1) Development projects should inherit a policy that allows Compute Engine access. 2) Production projects should not have Compute Engine access. 3) Audit team must be able to read all resources across all projects. Which three IAM policy placements are correct? (Choose three.)

Accepted Answer

Grant the development team roles/compute.admin at the folder level for the development folder.. Grant the development team roles/compute.admin at the development folder level (A) allows development projects to inherit Compute Engine access. Grant the audit team roles/viewer at the organization level (B) allows them to read all resources across all projects. Placing a deny policy at the production folder level (D) blocks Compute Engine access for production projects. This meets all requirements.

Answer

Grant the production team roles/compute.admin at the folder level for the production folder, then create a deny policy at the org level to block Compute Engine.

Answer

Grant the audit team roles/viewer at each project level.

Question 9

A company has a VPC with subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). They enabled Private Google Access on subnet-a. Instances in subnet-a can access Google APIs and services using private IPs. However, instances in subnet-b cannot reach Google APIs even though subnet-b has a default route to the internet through a NAT gateway. What is the likely cause?

Accepted Answer

Private Google Access is not enabled on subnet-b.. Private Google Access is a per-subnet setting that allows instances with only private IPs to reach Google APIs and services through the VPC's default internet gateway, without needing public IPs or NAT. Since subnet-b does not have Private Google Access enabled, its instances cannot use this feature even though they have a default route to the internet via a NAT gateway; the NAT gateway only provides outbound internet access for public IP destinations, not the private IP ranges used by Google APIs.

Answer

Subnet-b does not have a default route to the internet.

Answer

Cloud NAT is not configured for subnet-b.

Answer

Firewall rules are blocking traffic to googleapis.com.

Question 10

A security engineer needs to ensure that a Compute Engine VM can securely access Cloud Storage buckets without exposing a public IP address. The VM is in a VPC with Private Google Access enabled. What is the recommended approach?

Accepted Answer

No additional configuration is needed; Private Google Access allows access to Cloud Storage from VMs without external IPs.. Private Google Access enables a VM without an external IP address to reach Google APIs and services, including Cloud Storage, using the VPC's internal IP and Google's private network. Since the VM is in a VPC with Private Google Access enabled, it can securely access Cloud Storage buckets without needing a public IP or additional proxy. No further configuration is required because the traffic stays within Google's network and never traverses the public internet.

Answer

Deploy a Squid proxy in the same VPC and configure the VM to use it for all outbound traffic.

Answer

Assign an external IP to the VM and configure a firewall rule to allow egress to 0.0.0.0/0.

Answer

Configure Cloud NAT and ensure the VM has a route to the internet.

Question 11

A company is implementing VPC Service Controls to protect sensitive data in Google Cloud Storage. They want to allow a private on-premises subnet (10.1.0.0/16) to access the storage buckets via a Cloud VPN tunnel, but deny all other on-premises traffic. Which configuration approach meets this requirement with least privilege?

Accepted Answer

Create a bridged access level that includes the private IP range 10.1.0.0/16 and a VPC network condition.. VPC Service Controls use access levels to define which client identities or network sources can access protected services. By creating a bridged access level that includes both the private IP range 10.1.0.0/16 and a VPC network condition (the VPC connected via Cloud VPN), you ensure that only traffic originating from that specific on-premises subnet and arriving through the authorized VPC is allowed, denying all other on-premises traffic by default. This follows the least-privilege principle by not allowing broader IP ranges or relying on implicit denies.

Answer

Create a service perimeter that allows all traffic from on-premises, then an explicit deny rule for other IP ranges.

Answer

Configure Cloud NAT in the on-premises network and allow the NAT IP in an access level.

Answer

Create an access level with the IP range 10.1.0.0/16 and apply it to a service perimeter.

Question 12

A company uses Cloud SQL for PostgreSQL with IAM database authentication. A security engineer needs to grant a user named 'analyst@example.com' the ability to run SELECT queries on the 'orders' table. The user is a member of the group 'analysts@example.com'. What is the correct combination of IAM and database permissions?

Accepted Answer

Grant the group 'analysts@example.com' the role 'roles/cloudsql.instanceUser' on the instance. In the database, create a user 'analyst@example.com' with 'cloudsqllogin' role and grant SELECT on orders to that user.. IAM database authentication requires granting the IAM group the `roles/cloudsql.instanceUser` role on the instance to allow members to connect, and then creating a database user with the same name as the IAM user (not the group) with the `cloudsqllogin` role, which maps the IAM user to the database. Granting SELECT on the `orders` table to that database user then allows the IAM user to query the table.

Answer

Grant the user 'roles/cloudsql.viewer' on the project. In the database, grant SELECT on orders to 'analyst@example.com'.

Answer

Grant the user 'cloudsql.instances.connect' on the instance. In the database, create a user 'analyst@example.com' with 'cloudsqllogin' role and grant SELECT on orders to that user.

Answer

Grant the group 'roles/cloudsql.instanceUser' on the instance. In the database, create a user 'analysts@example.com' (the group) and grant SELECT on orders to that group.

Question 13

For HIPAA compliance, which Google Cloud product provides a business associate agreement (BAA) and a dedicated environment for protected health information?

Accepted Answer

Assured Workloads. Assured Workloads is the correct answer because it enables customers to deploy workloads that must comply with HIPAA by providing a BAA-ready environment with enforced controls, including data residency, encryption, and access restrictions. It creates a dedicated folder with pre-configured security and compliance policies, ensuring that protected health information (PHI) is handled in a Google Cloud environment that meets HIPAA requirements.

Answer

Confidential VMs

Answer

GKE Security Posture

Answer

Cloud Healthcare API

Question 14

A company uses Cloud KMS to protect encryption keys for various applications. They need to ensure that keys are automatically rotated every 90 days and that the rotation does not require re-encrypting all data. Which key type and rotation strategy should they use?

Accepted Answer

Use a symmetric key with automatic rotation period set to 90 days.. Symmetric keys are used for encryption/decryption of data at rest, and Cloud KMS supports automatic key rotation by creating a new key version at a specified interval (e.g., 90 days). Because Cloud KMS uses key versions and the key material is never exposed, existing ciphertext remains decryptable using the old key version, so no re-encryption is required. This meets the requirement for automatic rotation without data re-encryption.

Answer

Use an asymmetric key and set the rotation period to 90 days.

Answer

Use an asymmetric key and manually create a new version every 90 days.

Answer

Use a symmetric key and manually create a new version every 90 days.

Question 15

Which THREE are valid considerations when designing cross-organization access for Cloud Storage? (Choose three.)

Accepted Answer

Uniform bucket-level access disables ACLs, simplifying cross-org access management.. Uniform bucket-level access disables Access Control Lists (ACLs) and relies solely on IAM permissions for bucket access. This eliminates the complexity of managing both ACLs and IAM across organizations, making cross-org access management simpler and more consistent.

Answer

Signed URLs require the requester pays configuration to be enabled.

Answer

VPC Service Controls must be configured to allow cross-org IAM policies.