PCSE Practice Test 49 — 15 Questions

Question 1

An organization uses Cloud DLP to inspect BigQuery tables for sensitive data. They want to automatically remove credit card numbers before the data is accessed by analysts but still allow the raw data for auditing purposes. Which DLP technique should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

De-identification transform with redact. The 'De-identification transform with redact' completely removes sensitive data (like credit card numbers) from the output, ensuring analysts never see the raw values while the original data remains intact in the source BigQuery table for auditing. This aligns with the requirement to automatically strip sensitive content before access, without altering the stored data.

Answer

De-identification transform with masking

Answer

Re-identification transform with tokenization

Answer

De-identification transform with replacement

Question 2

A security engineer needs to protect sensitive data in BigQuery. The data includes columns with personally identifiable information (PII). They want to automatically mask PII data for users with the role 'analyst' but allow full access for 'admin' users. Which approach should they use?

Accepted Answer

Apply policy tags with data masking policies to PII columns and assign the tag to the analyst role.. BigQuery's policy tags with data masking policies allow you to automatically mask sensitive columns (e.g., PII) at query time based on the user's role. You assign a masking policy to the policy tag, then attach that tag to the PII columns. By granting the 'analyst' role access to the tag with the masking rule applied, analysts see masked data, while 'admin' users (who have higher-level IAM permissions) see the full data without additional configuration.

Answer

Use VPC Service Controls to restrict access to the dataset.

Answer

Create authorized views that exclude PII columns for the analyst role.

Answer

Use column-level access control via IAM roles to deny access to PII columns for analysts.

Question 3

A security engineer needs to ensure that all customer data stored in Cloud Storage is encrypted at rest using keys that the organization manages and rotates themselves. Which encryption option should they use?

Accepted Answer

Customer-managed encryption keys (CMEK) using Cloud KMS. Customer-managed encryption keys (CMEK) using Cloud KMS is the correct choice because it allows the organization to create, manage, and rotate their own encryption keys for Cloud Storage data at rest, while still leveraging Google's infrastructure for encryption. CMEK uses Cloud KMS to wrap the data encryption keys (DEKs) with a customer-managed key encryption key (KEK), ensuring the organization retains control over key lifecycle operations such as rotation, disabling, and destruction, meeting the requirement for self-managed key rotation.

Answer

Customer-supplied encryption keys (CSEK)

Answer

Google-managed encryption (GMEK)

Answer

Cloud HSM

Question 4

A company wants to use Cloud KMS with a key that is protected by a Hardware Security Module (HSM) and meets FIPS 140-2 Level 3. Which key type should they create in Cloud KMS?

Accepted Answer

HSM key with any purpose. Cloud KMS offers HSM keys that are generated and protected within an FIPS 140-2 Level 3 certified HSM. When a company requires FIPS 140-2 Level 3 compliance, the only key type that meets this requirement is an HSM key, regardless of its purpose (e.g., symmetric encryption, asymmetric signing). Software keys, even with any purpose, only meet FIPS 140-2 Level 1.

Answer

External key stored in Cloud HSM

Answer

Software key with ASYMMETRIC_SIGN purpose

Answer

Software key with ENCRYPT_DECRYPT purpose

Question 5

A security team needs to allow a third-party application running on AWS to access a Cloud Storage bucket without using service account keys. The application already uses AWS IAM roles. Which Google Cloud feature should they use?

Accepted Answer

Workload Identity Federation. Workload Identity Federation allows the AWS application to exchange its AWS IAM role credentials for Google Cloud temporary security tokens, enabling access to Cloud Storage without managing or storing service account keys. This is the correct approach because it directly addresses the requirement to avoid service account keys while leveraging the existing AWS IAM identity.

Answer

Secret Manager with a service account key

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud VPN

Question 6

A government agency requires FedRAMP High compliance for their Google Cloud deployment. Which service should they use to create a compliant environment with pre-configured controls?

Accepted Answer

Assured Workloads. Assured Workloads is the correct service because it enables customers to create a Google Cloud environment that is pre-configured to meet specific compliance requirements, including FedRAMP High. It automatically applies a set of controls (e.g., data residency, encryption key management, and access restrictions) based on the chosen compliance regime, reducing the manual effort needed to achieve and maintain certification.

Answer

Cloud HSM

Answer

VPC Service Controls

Answer

Security Command Center

Question 7

A company wants to allow a Compute Engine VM to access a Cloud SQL instance without exposing the SQL instance to the internet. The VM is in the same VPC but different subnet. Which configuration is required?

Accepted Answer

Create a private IP for the Cloud SQL instance using Private Services Access, grant the VM's service account the Cloud SQL Client role, and ensure the VM is in the same VPC.. Cloud SQL requires a private services access connection and the VM must have the cloudsql.client role to connect. Option A is wrong because the Cloud SQL Proxy can be used but requires a public IP if not within the VPC. Option B is wrong because VPC peering alone does not grant IAM permissions. Option D is wrong because a firewall rule is not sufficient without IAM.

Answer

Use the Cloud SQL Proxy on the VM and a public IP for the Cloud SQL instance.

Answer

Configure VPC peering between the VM's subnet and the Cloud SQL instance's VPC.

Answer

Add a firewall rule allowing ingress from the VM's IP to the Cloud SQL instance's internal IP.

Question 8

A security team is setting up Binary Authorization for their GKE clusters. They want to enforce that only images signed by an approved attestor can be deployed. Which TWO of the following are required for this setup?

Accepted Answer

Create an attestor in Binary Authorization.. Binary Authorization requires creating an attestor and associating it with a Cloud KMS key pair for signing verification. The attestor's public key must be added to the Binary Authorization policy. A Container Analysis note is used to store attestations, but it is not a separate requirement for the policy itself; it is used when creating attestations. Disabling vulnerability scanning is not required.

Answer

Enable Vulnerability Scanning on Artifact Registry.

Answer

Disable the default 'Allow All' policy.

Answer

Create a Container Analysis note for each image.

Question 9

Which TWO of the following are true regarding Cloud Identity and Access Management (IAM) conditions?

Accepted Answer

IAM conditions can restrict access based on the current date and time.. IAM conditions support temporal attributes, including date/time restrictions, using the `request.time` attribute. This allows policies to grant access only during specific hours or days, such as allowing access only during business hours. The condition is expressed using the Common Expression Language (CEL) syntax, e.g., `request.time.getHours("America/New_York") >= 9 && request.time.getHours("America/New_York") <= 17`.

Answer

IAM conditions are supported for all Google Cloud resources.

Answer

IAM conditions can be applied to a role binding that supports all resources.

Answer

IAM conditions can restrict access based on the user's email domain.

Question 10

A security engineer is troubleshooting access to a Cloud Storage bucket. The bucket has uniform bucket-level access enabled. The engineer's user account has the roles/storage.objectViewer role at the project level, but they get a 403 error when trying to download an object. What is the most likely cause?

Accepted Answer

There is a deny rule in an Organization Policy or an IAM deny policy that blocks the user.. Uniform bucket-level access disables ACLs, so access is governed solely by IAM and organization policies. A deny rule in an Organization Policy or an IAM deny policy explicitly overrides any allow permissions, causing a 403 error even if the user has the roles/storage.objectViewer role at the project level. This is the most likely cause given that the user already has the necessary IAM role.

Answer

The bucket has ACLs that override the IAM role.

Answer

The user does not have the storage.objects.get permission.

Answer

The user's project-level role does not apply to this specific bucket.

Question 11

A company wants to monitor for suspicious login attempts across all their Google Cloud projects. They want to send a real-time Slack notification when a login fails from an IP address outside their corporate CIDR range. What is the most efficient way to achieve this?

Accepted Answer

Export Admin Activity audit logs to a Pub/Sub topic via a sink, and use a Cloud Function that subscribes to the topic to filter and post to Slack.. Admin Activity audit logs capture login events (e.g., failed logins). By creating a log sink that exports these logs to a Pub/Sub topic, you can stream them in real-time. A Cloud Function subscribed to that topic can filter for failed logins from outside the corporate CIDR and post a notification to Slack via a webhook. This approach provides real-time alerting with minimal latency and cost.

Option A is incorrect because Cloud Monitoring alert policies can use log-based metrics, but they cannot directly check for failed logins in logs; you would need to create a log-based metric first, which adds complexity and may not support the IP range filter efficiently.

Option B is incorrect because Cloud Scheduler runs on a schedule (e.g., hourly), which would not provide real-time notifications.

Option D is incorrect because Cloud Audit Logs alone cannot directly forward logs to Slack; you need an intermediary such as Pub/Sub and a Cloud Function.

Answer

Create a Cloud Monitoring alert policy that checks for failed logins in logs and sends a notification to Slack via webhook.

Answer

Use Cloud Scheduler to run a batch job every hour that queries logs and sends a summary to Slack.

Answer

Enable Cloud Audit Logs and configure a log router to forward logs directly to Slack.

Question 12

An organization wants to allow an external identity provider (IdP) that supports OpenID Connect (OIDC) to access GCP resources. They want to avoid creating and managing service account keys. What should they use?

Accepted Answer

Configure Workload Identity Federation to allow the external IdP to impersonate a service account.. Workload Identity Federation allows an external identity provider (IdP) that supports OpenID Connect (OIDC) to impersonate a GCP service account without requiring service account keys. This enables the external IdP to obtain short-lived, scoped tokens directly from GCP, eliminating the need to create, store, or rotate long-lived keys.

Answer

Use Cloud Identity Platform to federate the external IdP.

Answer

Create a service account key and share it with the external IdP.

Answer

Use a VPN tunnel to connect the external IdP to GCP and use internal IPs.

Question 13

A security engineer needs to monitor network traffic for potential threats in a VPC. They want to inspect all traffic for malware signatures and alert on high-severity threats. The solution should be natively integrated with GCP. Which service should they use?

Accepted Answer

Cloud IDS. Cloud IDS (Intrusion Detection System) is a managed service that uses Palo Alto Networks threat detection to inspect traffic for malware and other threats. It integrates with packet mirroring in GCP.

Answer

VPC Flow Logs

Answer

Security Command Center

Answer

Cloud Armor

Question 14

Which Google Cloud audit log captures administrator activity and is enabled by default?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs (option D) are enabled by default in Google Cloud and capture all administrator actions that modify the configuration or metadata of resources, such as creating a VM or changing IAM policies. These logs are essential for compliance and security auditing because they record 'who did what, where, and when' for management activities, and they cannot be disabled.

Answer

Policy Denied audit logs

Answer

System Event audit logs

Answer

Data Access audit logs

Question 15

Refer to the exhibit. A Terraform configuration applies an IAM binding with a condition. After applying this configuration, a member of the group data-scientists@example.com tries to query a BigQuery dataset on July 1, 2025. What will be the result?

Accepted Answer

Access is denied because the condition is no longer satisfied.. The IAM binding includes a condition that restricts access based on a date/time attribute. On July 1, 2025, the condition is no longer satisfied (e.g., the condition might require the request to occur before a specific date, such as before June 30, 2025). When the condition evaluates to false, the IAM binding does not grant access, even though the binding itself exists and the user is a member of the group.

Answer

Access is denied because the condition is invalid after the date.

Answer

Access is granted because the IAM binding exists.

Answer

Access is granted and the condition is ignored after the date.