PCSE Practice Test 49 — 15 Questions

Question 1

A company wants to ensure that all data stored in Cloud Storage buckets is encrypted with customer-managed encryption keys (CMEK) rather than Google-managed keys. They need to enforce this policy across the organization. Which Google Cloud service should they use to define and enforce this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Organization Policy Service with a constraint on Cloud Storage bucket encryption.. Organization Policy Service provides centralized, hierarchical policy enforcement across all projects in an organization. By applying a constraint that requires CMEK for Cloud Storage, the organization ensures that any bucket created without CMEK will be denied. This is the correct tool for enforcing encryption key requirements at scale.

Answer

VPC Service Controls with an access level that requires CMEK.

Answer

Cloud KMS with automatic key rotation enabled for all keys.

Answer

Security Command Center with a custom finding for unencrypted buckets.

Question 2

A financial services company must comply with the Payment Card Industry Data Security Standard (PCI DSS) on Google Cloud. They need to ensure that cardholder data is protected both at rest and in transit. Which two Google Cloud configurations should they implement to meet these requirements? (Choose two.)

Accepted Answer

Enforce TLS 1.2+ for all internal and external communications. To meet PCI DSS for protecting cardholder data, you must encrypt data at rest and in transit. Enabling CMEK gives you control over encryption keys for data at rest, satisfying key management requirements. Enforcing TLS 1.2+ ensures data in transit is encrypted with strong protocols. Together, these address the core encryption requirements for PCI DSS compliance on Google Cloud.

Answer

Store all cardholder data in BigQuery with default encryption

Answer

Configure VPC Service Controls perimeters around cardholder data services

Answer

Use Cloud Armor to block traffic from high-risk countries

Question 3

A security engineer needs to ensure that all traffic between two VPC networks in different projects is encrypted and authenticated. The networks are connected via VPC Network Peering. What should the engineer do?

Accepted Answer

No additional configuration is needed; VPC Network Peering traffic is encrypted and authenticated by Google's infrastructure.. VPC Network Peering traffic traverses Google's private network and is automatically encrypted and authenticated. No additional configuration is needed. This built-in security ensures that data in transit between peered VPCs is protected. The other options either provide no encryption or are not supported.

Answer

Use IPsec tunnels over the peering connection to encrypt traffic.

Answer

Configure a VPN tunnel between the two VPC networks using Cloud VPN.

Answer

Enable VPC Flow Logs on both networks to monitor and encrypt traffic.

Question 4

A company needs to store sensitive configuration data, such as database credentials, in Google Cloud. They require that the data be encrypted at rest and in transit, and that access be auditable. They also want to minimize management overhead. Which Google Cloud service should they use?

Accepted Answer

Secret Manager. Secret Manager is purpose-built for storing and managing secrets. It provides encryption at rest and in transit, audit logging, and automatic rotation, all with minimal management effort. Other services like Cloud Storage or Firestore can store data but lack the specialized features and ease of use for secret management, leading to higher overhead.

Answer

Cloud KMS

Answer

Firestore in Datastore mode

Answer

Cloud Storage with customer-managed encryption keys (CMEK)

Question 5

A media company runs a Shared VPC where the host project contains all subnets and the service projects contain the workloads. A security engineer in a service project needs to create a firewall rule that allows SSH from a bastion subnet in the host project to instances in that service project only. The engineer has the compute.securityAdmin role on the service project. What is the correct approach?

Accepted Answer

Ask a host project administrator with the compute.securityAdmin role to create the firewall rule in the host project, scoped by target tags or service accounts used by the service project instances. In a Shared VPC, the host project owns the VPC network and its firewall rules, so rules must be created there by an identity holding compute.securityAdmin or compute.networkAdmin on the host project. The narrow allow is achieved by specifying the bastion subnet's source range and targeting only the service project instances via network tags or service accounts. Service project roles cannot create host project firewall rules, and broadening the source to the internet is unacceptable.

Answer

Create the firewall rule in the service project, selecting the host project's bastion subnet as the source

Answer

Grant the service project engineer compute.networkAdmin on the host project so they can create the rule themselves

Answer

Create the rule in the host project using a source of 0.0.0.0/0 and rely on IAM to restrict who can actually connect via SSH

Question 6

A security engineer is setting up a VPC network in Google Cloud. The engineer wants to ensure that instances in a private subnet can initiate outbound connections to the internet for software updates, but the instances should not be directly reachable from the internet. Which configuration should the engineer use?

Accepted Answer

Create a Cloud NAT gateway in the VPC and configure the instances without external IP addresses.. Cloud NAT provides outbound internet access for instances without external IP addresses by performing source NAT. This allows instances to initiate connections for updates while remaining unreachable from the internet. Assigning external IPs exposes instances despite firewall rules. Cloud VPN and load balancers do not provide the required outbound NAT functionality.

Answer

Configure an HTTP(S) load balancer with a backend service that includes the instances, and use it for outbound traffic.

Answer

Create a Cloud VPN tunnel to a third-party provider and route all internet traffic through it.

Answer

Assign external IP addresses to the instances and create firewall rules to block all ingress traffic from the internet.

Question 7

A multinational corporation must comply with data residency requirements for several countries. They are using Google Cloud and need to ensure that data for European users stays within the EU, while data for US users stays in the US. They also need to prove compliance to regulators. Which Google Cloud feature should they implement to enforce and monitor data residency at the resource level?

Accepted Answer

Assured Workloads for data residency with compliance monitoring. Assured Workloads is purpose-built for data residency and compliance. By creating a folder with the appropriate control package (e.g., EU_REGIONS_AND_SUPPORT or US_REGIONS_AND_SUPPORT), it enforces that resources are only created in allowed regions and continuously monitors for violations. It also provides a dashboard and audit evidence, making it the right choice for proving compliance to regulators.

Answer

Organization Policy constraints for location restrictions

Answer

VPC Service Controls perimeters with geographic access levels

Answer

Customer-managed encryption keys (CMEK) with Cloud KMS regional keys

Question 8

A security team manages a project containing sensitive Compute Engine instances and Cloud Storage buckets. They need to grant a new data analyst read-only access to only the Cloud Storage buckets in the project, while explicitly preventing any access to Compute Engine resources. The analyst authenticates with a Google Workspace account. Which IAM configuration should the team implement?

Accepted Answer

Grant the analyst the roles/storage.objectViewer role on each specific bucket and do not grant any Compute Engine roles.. The requirement is to grant read-only access to specific Cloud Storage buckets while preventing any Compute Engine access. Assigning roles/storage.objectViewer at the bucket level grants exactly the necessary permissions without broader project access. Because Compute Engine roles are not granted, the analyst cannot interact with instances. This follows least privilege and avoids the complexity of deny policies or overly broad roles.

Answer

Grant the analyst the roles/storage.objectViewer role on the project and create an IAM deny policy that denies compute.instances.get for the analyst.

Answer

Grant the analyst the roles/viewer role on the project and create an IAM deny policy that denies compute.instances.list for the analyst.

Answer

Grant the analyst the roles/storage.admin role on the project and rely on VPC Service Controls to restrict access to Compute Engine resources.

Question 9

A company uses Google Cloud and wants to allow their data scientists to access BigQuery datasets but only from corporate devices that meet specific security requirements (e.g., disk encryption enabled, screen lock enforced). The data scientists authenticate with their Google Workspace accounts. What should the security engineer implement?

Accepted Answer

Configure context-aware access in BeyondCorp Enterprise with an access level that checks device attributes, and apply it to BigQuery.. Context-aware access in BeyondCorp Enterprise enables attribute-based access control using device signals. By creating an access level that requires disk encryption and screen lock, and applying it to BigQuery, the company ensures that only compliant devices can access the datasets. This is the only option that directly evaluates device posture and enforces the specified security requirements.

Answer

Enforce 2-Step Verification for all data scientists and require them to use security keys.

Answer

Create a VPC Service Controls perimeter around the BigQuery datasets and restrict access to only corporate IP addresses.

Answer

Use IAM Conditions to grant the BigQuery Data Viewer role only when the request originates from a corporate IP range.

Question 10

A company uses Cloud Storage to store sensitive documents. They need to ensure that all data is encrypted at rest with keys that are automatically rotated every 180 days and that they can audit key usage. Which Google Cloud service should they use to meet these requirements?

Accepted Answer

Cloud KMS with a symmetric key and a 180-day rotation schedule, and Cloud Audit Logs for key usage. Cloud KMS is the service for managing CMEK for Cloud Storage. Setting a 180-day rotation schedule automates key rotation, and Cloud Audit Logs capture all key operations for auditing. The other options either require manual rotation, lack integrated auditing, or are not designed for CMEK management on Cloud Storage. Thus, Cloud KMS with rotation and audit logging is the correct choice.

Answer

Cloud External Key Manager (Cloud EKM) with a third-party key manager and Cloud Audit Logs

Answer

Customer-supplied encryption keys (CSEK) with manual rotation every 180 days

Answer

Cloud HSM with a 180-day rotation policy and Cloud Logging for audit

Question 11

A financial institution needs to store audit logs in Cloud Storage for 7 years to meet regulatory requirements. They must ensure that the logs cannot be deleted or modified by any user, including administrators, during that period. They also need to be able to prove compliance to auditors. Which Cloud Storage feature should they use?

Accepted Answer

Bucket Lock with a retention policy set to 7 years.. Bucket Lock with a retention policy is the correct feature to enforce immutability for a specified period. Once the retention policy is locked, objects in the bucket cannot be deleted or overwritten until the retention period expires, and the policy cannot be removed or shortened. This meets the requirement that logs cannot be deleted or modified by anyone, including administrators, and provides auditable proof of compliance.

Answer

Object Versioning with a lifecycle rule to delete objects after 7 years.

Answer

Cloud Storage Transfer Service to replicate logs to another bucket in a different region.

Answer

Cloud Storage Bucket IAM policies that deny delete permissions to all users.

Question 12

A company has an organization policy that enforces `constraints/iam.disableServiceAccountKeyCreation` at the organization level. A developer needs to deploy a workload on a Compute Engine instance that requires access to Cloud Storage. They cannot create a service account key. What is the recommended way to grant the instance access to Cloud Storage?

Accepted Answer

Attach a user-managed service account with the necessary IAM roles to the instance.. With service account key creation disabled, the secure and recommended approach is to attach a user-managed service account to the Compute Engine instance. The instance can then use the metadata server to obtain access tokens for the service account, eliminating the need for keys. This method follows least privilege and avoids key management risks.

Answer

Use the Compute Engine default service account with the Editor role.

Answer

Enable Cloud Storage public access and restrict via firewall rules.

Answer

Create a service account key and store it securely on the instance.

Question 13

Your organization wants to monitor and audit all administrative activities across multiple Google Cloud projects. You need to ensure that audit logs are retained for at least 1 year and can be queried easily. What should you do?

Accepted Answer

Create a log sink at the organization level that exports Admin Activity audit logs to a BigQuery dataset.. Admin Activity audit logs capture administrative actions and are enabled by default. To centralize and retain them for a year with easy querying, create an organization-level log sink to BigQuery. BigQuery supports SQL queries and allows setting table expiration to meet retention. Data Access logs are not needed for administrative auditing, and default Logging retention is only 30 days, so exporting is necessary.

Answer

Enable Data Access audit logs for all services and export them to Cloud Storage.

Answer

Use Cloud Logging's default retention of 30 days and rely on the logs being available for 1 year in Logs Explorer.

Answer

Create a log sink at each project level to export logs to a central Cloud Storage bucket, and use Cloud SQL to query the logs.

Question 14

Your organization uses Google Cloud with a folder hierarchy. You need to grant a data engineering team the ability to create and manage Cloud Storage buckets in all current and future projects under the folder 'analytics'. The team should not have any permissions in other folders. What should you do?

Accepted Answer

Grant the roles/storage.admin role to the team's Google Group at the 'analytics' folder level.. IAM policies are hierarchical: a grant at a folder applies to all projects and resources beneath it. Granting roles/storage.admin to the group at the 'analytics' folder gives the team the necessary permissions on all current and future projects in that folder, and no access to other folders. Using a group simplifies management.

Answer

Grant the roles/storage.admin role to each team member individually at the organization level.

Answer

Grant the roles/storage.admin role to the team's Google Group at the organization level, and use an IAM deny policy to block access to other folders.

Answer

Create a custom role with storage.buckets.create and storage.buckets.delete permissions and grant it at the project level for each existing project.

Question 15

A security engineer must allow SSH access to a set of Compute Engine VMs from a fixed set of corporate office public IP addresses. The VMs have no external IP addresses and are in a single VPC network. The engineer wants a reusable, centrally managed rule that is applied to all current and future VMs in the network. What should the engineer do?

Accepted Answer

Create a firewall rule in the VPC network with direction INGRESS, action allow, target tags matching the VMs, source IPv4 ranges set to the office IPs, and protocol tcp:22.. VPC firewall rules are stateful, distributed, and centrally managed at the network level, making them the right tool for granting SSH from known source addresses. An ingress rule with the office CIDR ranges, tcp:22, and target tags applies to all current and future tagged VMs, meeting the reuse requirement. Proxy-based controls such as Cloud Armor do not apply to direct VM SSH traffic.

Answer

Create a VPC firewall rule with direction EGRESS, action allow, destination ranges set to the office IPs, and protocol tcp:22.

Answer

Create a Cloud Armor security policy with an allow rule for the office IPs and attach it to the VPC network.

Answer

Create a hierarchical firewall policy at the organization level with an allow rule for tcp:22 from the office IPs.