PCSE Practice Test 48 — 15 Questions

Question 1

A security operations team needs to monitor for IAM policy changes across all projects in their Google Cloud organization. They want to be alerted within minutes when a user is granted the Owner role on any project. They have enabled Cloud Audit Logs for all services and want to use a native Google Cloud service that can aggregate and filter logs across the organization. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a log sink at the organization level that filters for IAM policy changes and routes to a Pub/Sub topic, then trigger an alert via a Cloud Function.. The correct approach uses an organization-level log sink to aggregate audit logs from all projects. Filtering for IAM policy changes and routing to Pub/Sub enables immediate processing and alerting. This leverages native Google Cloud services to achieve centralized, near-real-time detection of privileged role assignments.

Answer

Enable VPC Flow Logs on all subnets and export to Cloud Monitoring for alerting on IAM changes.

Answer

Use Cloud Asset Inventory to export IAM policies to BigQuery and set up a scheduled query to detect changes.

Answer

Configure Cloud IDS to monitor for IAM policy changes and create alerts.

Question 2

A security engineer is configuring IAM conditions to restrict access to a Cloud Storage bucket. The engineer wants to allow users to read objects only if the request originates from a specific VPC network and only during business hours. Which two condition attributes should the engineer use? (Choose two.)

Accepted Answer

request.time. To restrict by VPC network, you use the custom attribute api.getAttribute('compute.googleapis.com/VpcNetwork', ''). To restrict by time, you use request.time with appropriate comparisons. These two attributes together enforce the network and time conditions. Other attributes like resource.name or resource.type do not provide the needed context.

Answer

resource.type

Answer

request.auth.access_levels

Answer

resource.name

Question 3

An organization uses Assured Workloads for Google Cloud to meet FedRAMP compliance. They have enabled Access Transparency logs. During an audit, they need to provide evidence that Google personnel access was logged and reviewed. What is the primary benefit of using Access Transparency?

Accepted Answer

It provides logs detailing the actions of Google personnel when accessing customer data.. Access Transparency is the correct answer because it generates audit logs that record when Google personnel access customer data, including the action taken, the reason, and the identity of the Google staff member, which is exactly the evidence needed for FedRAMP audits. It does not block access, encrypt data, or restrict data movement; those are handled by other controls such as Access Approval, CMEK/Cloud EKM, and VPC Service Controls. Therefore, option A is the only one that matches the stated audit requirement.

Answer

It blocks all Google personnel access to customer data.

Answer

It encrypts data with customer-managed keys.

Answer

It prevents data from being moved outside the organization's VPC.

Question 4

A financial institution is subject to GDPR and requires encryption at rest for all data in Cloud Storage. They want to use CMEK but also need to log all key access events. Which combination of services meets both requirements with least effort?

Accepted Answer

Use CMEK with Cloud KMS and enable Cloud Audit Logs with Data Access audit logs for Cloud KMS.. CMEK in Cloud KMS provides customer-managed encryption keys for Cloud Storage, and enabling Data Access audit logs for Cloud KMS records every key operation, including Encrypt/Decrypt and key access events, satisfying both encryption-at-rest and key-access logging requirements with minimal configuration. Option A does not meet the CMEK requirement for Cloud Storage and Cloud HSM audit logging alone would not cover Cloud Storage data encryption. Option B enables CMEK but does not log key access events, since key rotation is unrelated to audit logging. Option C uses CSEK, which is customer-supplied rather than customer-managed and does not integrate with Cloud KMS audit logging for key access.

Answer

Use Cloud HSM to protect keys, and enable Cloud Audit Logs for Cloud HSM.

Answer

Use CMEK with Cloud KMS and set key rotation every 30 days.

Answer

Use CSEK (customer-supplied encryption keys) and enable Cloud Audit Logs for all services.

Question 5

A company uses Google Cloud and wants to ensure that users can only access Compute Engine instances if they have a valid justification and are approved by a manager. They want to implement just-in-time (JIT) access with approval workflows. Which Google Cloud service should they use?

Accepted Answer

Privileged Access Manager (PAM).. Privileged Access Manager is specifically built for just-in-time access with approval workflows. It enables users to request temporary elevation with justification, and approvers can grant or deny the request. This aligns with the requirement to have manager approval and justification before accessing Compute Engine instances.

Answer

Identity-Aware Proxy (IAP) with context-aware access levels.

Answer

Cloud IAM Conditions with time-based constraints.

Answer

Access Context Manager.

Question 6

A company needs to store database connection strings and API keys for its applications running on Compute Engine. The security team requires that these secrets be encrypted at rest, automatically rotated, and accessible only to specific service accounts. Which Google Cloud service should they use?

Accepted Answer

Secret Manager. Secret Manager is the dedicated Google Cloud service for storing and managing secrets. It encrypts secrets at rest, supports automatic rotation through integration with Cloud Functions and Pub/Sub, and uses IAM for access control. Cloud KMS is for keys, Cloud Storage lacks secret management features, and Firestore is a database, so Secret Manager is the correct choice.

Answer

Cloud KMS

Answer

Firestore

Answer

Cloud Storage with CMEK

Question 7

A small startup uses Google Cloud and wants to monitor for suspicious activity in their single project. They have limited security expertise and want a managed service that provides built-in detectors for threats like compromised credentials and malware. They also want to receive email alerts for high-severity findings. What should they do?

Accepted Answer

Enable Security Command Center Premium tier and create a notification config to send high-severity findings to an email address.. Security Command Center Premium provides built-in threat detection for compromised credentials, malware, and other threats without requiring additional infrastructure. It supports notification configurations that can send high-severity findings to email, meeting the startup's need for a managed service with alerting. This is the simplest and most effective solution.

Answer

Use Cloud IDS to detect threats and configure alerting through Cloud Monitoring.

Answer

Deploy a third-party SIEM and integrate it with Cloud Logging to detect threats.

Answer

Enable Security Command Center Standard tier and configure email notifications for all findings.

Question 8

A company is preparing for a SOC 2 audit and needs to demonstrate that changes to production Google Cloud resources are tracked and approved. They want to ensure that all modifications to IAM policies, firewall rules, and Cloud Storage buckets are logged and that the logs cannot be altered. Which Google Cloud service should they use to collect and retain these logs immutably?

Accepted Answer

Cloud Logging with log buckets and retention locks. Cloud Logging automatically records Admin Activity logs for all resource changes. By routing these logs to a dedicated log bucket and applying a retention lock, you ensure the logs are immutable for a specified period. This meets SOC 2 requirements for tracking changes and preserving tamper-proof audit trails. The retention lock prevents even project owners from deleting the logs prematurely.

Answer

Cloud Monitoring dashboards with alerting on configuration changes

Answer

Security Command Center findings exported to BigQuery

Answer

Cloud Audit Logs exported to Cloud Storage with Object Lifecycle Management

Question 9

A company runs a Shared VPC host project with several service projects. Security requires that all egress traffic from service project workloads to external IP addresses be inspected by a centralized third-party appliance before leaving the VPC. The appliance is deployed in the host project and must see traffic from all service projects. Which approach should the security engineer use?

Accepted Answer

Use Policy-based routes in the host project to send traffic from service project subnets to the appliance's next-hop instance.. Policy-based routes in the Shared VPC host project can match traffic by source or destination and set an instance as the next hop, which centralizes egress inspection through the appliance. This works across all service projects because they share the host project's VPC network, and it avoids duplicating configuration or relying on passive logging.

Answer

Deploy Cloud NAT in each service project and configure logging to send traffic to the appliance for analysis.

Answer

Configure a VPC firewall egress rule in each service project that redirects traffic to the appliance's internal IP address.

Answer

Create a custom static route in each service project with the appliance as the next hop and a default destination.

Question 10

A security engineer is configuring IAM policies for a project that contains sensitive data. The engineer needs to ensure that a specific group of users cannot access Cloud Storage objects in the project, even if they are granted a role that would otherwise allow it. The engineer wants to use an IAM deny policy to enforce this restriction. Which of the following is true about the scope of an IAM deny policy?

Accepted Answer

A deny policy can be attached to a project, folder, or organization, and also to individual resources that support deny policies, such as Cloud Storage buckets.. Deny policies in Google Cloud can be attached at various levels of the resource hierarchy, including organization, folder, and project, as well as to individual supported resources like Cloud Storage buckets. They are not restricted to only the organization level or only individual resources. This flexibility allows administrators to enforce denials at the appropriate scope for their security needs.

Answer

A deny policy can be attached only at the organization level and applies to all projects and folders within the organization.

Answer

A deny policy can be attached to a service account but not to a user or group.

Answer

A deny policy can be attached only to individual resources, such as a Cloud Storage bucket, and not to projects or folders.

Question 11

A security engineer is configuring Identity-Aware Proxy (IAP) to protect an internal web application running on Compute Engine. The engineer wants to grant access to a group of employees. Which two steps are required to allow the employees to access the application through IAP? (Choose two.)

Accepted Answer

Create a firewall rule that allows ingress traffic from the IP range 35.235.240.0/20 to the application's instances.. To allow employees to access an IAP-protected application, you must grant them the roles/iap.httpsResourceAccessor role on the IAP resource, and you must ensure that a firewall rule allows traffic from the IAP IP range 35.235.240.0/20 to the application instances. These two steps are essential: the IAM role authorizes the users, and the firewall rule permits the IAP proxy to reach the backend.

Answer

Assign the employees the roles/compute.networkUser role on the project.

Answer

Configure the application's backend service to use HTTP/2 instead of HTTP/1.1.

Answer

Enable Cloud CDN on the backend service to cache content for IAP users.

Question 12

A security team wants to detect and respond to suspicious network traffic in near real-time across multiple VPC networks. They need to capture packet-level data for forensic analysis without impacting performance. Which Google Cloud service should they use?

Accepted Answer

Packet Mirroring. Packet Mirroring captures full packet data from selected instances and forwards it to a collector, enabling deep forensic analysis. VPC Flow Logs and Firewall Rules Logging only provide metadata, and Cloud IDS is for threat detection without raw packets. Therefore, Packet Mirroring is the correct choice for packet-level capture across multiple VPC networks.

Answer

Cloud IDS

Answer

VPC Flow Logs

Answer

Firewall Rules Logging

Question 13

A healthcare analytics team stores patient records in Cloud Storage. They need to grant an external research partner read access to only specific objects that contain aggregated, de-identified data, while ensuring the partner cannot list or discover any other objects in the bucket. The partner has their own Google Cloud identity. What should the security engineer do?

Accepted Answer

Grant the partner roles/storage.objectViewer on each specific object using object-level IAM, and do not grant any bucket-level role.. Granting roles/storage.objectViewer at the object level provides read access to specific objects without granting bucket-level list permission, so the partner cannot enumerate other objects. Bucket-level roles that include storage.objects.list allow discovery of all object names, which violates the requirement. Object-level IAM is the only option that satisfies both the read access and the non-discovery constraints.

Answer

Grant the partner roles/storage.legacyBucketReader on the bucket and rely on object ACLs to limit visibility.

Answer

Grant the partner roles/storage.objectViewer on the bucket and use IAM Conditions to restrict access to objects with a specific prefix.

Answer

Grant the partner roles/storage.objectAdmin on the bucket and use VPC Service Controls to restrict access to the bucket.

Question 14

A healthcare organization uses Google Cloud and must comply with HIPAA. They need to ensure that all access to patient data stored in Cloud Storage is logged and that any unauthorized access attempts are detected in near real-time. They also want to minimize false positives. Which approach should they take?

Accepted Answer

Enable Data Access audit logs for Cloud Storage, and use Security Command Center Premium to detect anomalous access patterns.. Data Access audit logs for Cloud Storage record all object access. Security Command Center Premium provides near real-time threat detection, including anomalous access patterns, which helps detect unauthorized attempts with fewer false positives. This combination meets HIPAA logging and detection requirements.

Answer

Use Cloud Audit Logs with a log sink to BigQuery, and create a scheduled query to detect unauthorized access.

Answer

Enable Cloud Armor on the Cloud Storage bucket, and configure rules to block unauthorized IP addresses.

Answer

Enable VPC Flow Logs for the VPC containing the Cloud Storage bucket, and use Cloud Monitoring to alert on unusual traffic.

Question 15

A company needs to store database credentials for its application in Google Cloud. The credentials must be encrypted at rest, accessible only to the application's service account, and automatically rotated every 60 days. Which Google Cloud service should they use?

Accepted Answer

Secret Manager with a secret containing the credentials, IAM policy granting access to the service account, and a rotation schedule configured.. Secret Manager is designed for storing, accessing, and rotating secrets. It encrypts secrets at rest, integrates with IAM for access control, and supports rotation schedules that can trigger automated rotation. This directly addresses the need for secure storage, restricted access, and automatic rotation of database credentials.

Answer

Cloud SQL with a built-in secrets table, and use IAM database authentication.

Answer

Cloud Storage with a bucket containing a text file with the credentials, and enable Object Lifecycle Management to rotate the file.

Answer

Cloud KMS with a key ring and key, and store the credentials as an encrypted blob in Cloud Storage.