PCSE Practice Test 5 — 10 Questions

Question 1

A company has an on-premises data center connected to Google Cloud via a Dedicated Interconnect. They want to allow instances in a VPC (10.0.0.0/8) to access Google APIs (e.g., Cloud Storage) without traversing the public internet. They also want to ensure that traffic from on-premises to Google APIs uses the same private path. Which configuration is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Private Google Access on the VPC subnet and advertise the default route (0.0.0.0/0) from on-premises with a specific route for Google APIs (199.36.153.4/30) pointing to the interconnect.. It enables Private Google Access on the VPC subnet, which allows instances with private IPs to reach Google APIs without public internet. Additionally, advertising a default route (0.0.0.0/0) from on-premises via the Dedicated Interconnect ensures that on-premises traffic to Google APIs also uses the private path, while the specific route for Google APIs (199.36.153.4/30) overrides the default to direct API traffic through the interconnect, avoiding asymmetric routing.

Answer

Set up Cloud VPN and use Private Google Access on the VPC.

Answer

Apply VPC Service Controls and enable Private Google Access on the subnet.

Answer

Configure Cloud NAT on the VPC and on-premises route via the interconnect.

Question 2

A company wants to use a Google-managed SSL certificate for their external HTTPS load balancer. Which step is required to provision the certificate?

Accepted Answer

Create a DNS record for the domain that resolves to the load balancer's IP address.. Google-managed SSL certificates require domain ownership verification. You must create a DNS record (CNAME or A record) that points to the load balancer's IP address or a specific verification record. The certificate is automatically provisioned and renewed.

Answer

Install the certificate on each backend instance.

Answer

Submit a Certificate Signing Request (CSR) to Google.

Answer

Upload the private key and certificate in PEM format.

Question 3

Drag and drop the steps to set up a Cloud VPN with a static route in the correct order.

Accepted Answer

Step 1: Create Cloud VPN gateway, Step 2: Create Cloud Router, Step 3: Create VPN tunnel, Step 4: Add static route, Step 5: Test connectivity. Cloud VPN setup requires gateway creation, Cloud Router, tunnel configuration, route addition, and connectivity testing.

Answer

Step 1: Create Cloud Router, Step 2: Create Cloud VPN gateway, Step 3: Create VPN tunnel, Step 4: Add static route, Step 5: Test connectivity

Answer

Step 1: Create Cloud VPN gateway, Step 2: Create VPN tunnel, Step 3: Create Cloud Router, Step 4: Add static route, Step 5: Test connectivity

Answer

Step 1: Create Cloud VPN gateway, Step 2: Create Cloud Router, Step 3: Add static route, Step 4: Create VPN tunnel, Step 5: Test connectivity

Question 4

A security engineer is investigating a compromised Compute Engine VM. They need to take a forensic snapshot of the disk without losing any data, including deleted files, and ensure the snapshot is not tampered with. Which steps should they take?

Accepted Answer

Create a snapshot of the disk while the instance is running, then detach the disk.. The correct approach is to first create a snapshot of the disk for forensic analysis, which captures the disk state including deleted files (unless overwritten). Then detach the disk from the instance to prevent further changes. Creating a snapshot after detaching would lose the current state. Powering off the instance may alter data. Using dd over SSH may change file access times.

Answer

Use dd to copy the disk over SSH to a forensic workstation.

Answer

Stop the instance, create a snapshot of the disk, then detach the disk.

Answer

Detach the disk first, then create a snapshot of the detached disk.

Question 5

A security team wants to ensure that a Cloud KMS key is rotated automatically every 30 days and that previous key versions are available for decryption for at least 6 months. Which THREE steps should they take? (Choose three.)

Accepted Answer

Ensure that the key's destruction policy does not automatically destroy versions before 6 months. To meet the requirements: 1) Set rotation period to 30 days on the key; 2) Do not destroy old key versions until after 6 months; 3) The default destruction policy does not automatically destroy old versions, so they remain available. Setting a primary version is not required for rotation, and disabling rotation is contrary.

Answer

Manually rotate the key every 30 days using a Cloud Function

Answer

Configure the key's `next_rotation_time` to start rotation immediately

Question 6

An organization needs to scan container images stored in Artifact Registry for vulnerabilities before deployment. They want to use a managed service that integrates with their CI/CD pipeline. Which Google Cloud service should they use?

Accepted Answer

Container Analysis. Artifact Registry integrates with Container Analysis (also known as Artifact Analysis) to automatically scan images for vulnerabilities. This is a managed service that works out-of-the-box for images stored in Artifact Registry. Web Security Scanner is for web applications, VM Manager patch management is for VM patches, and Cloud Security Scanner is not a real service.

Answer

Web Security Scanner

Answer

Cloud Security Scanner

Answer

VM Manager patch management

Question 7

Which of the following is a feature available only in Security Command Center Premium tier, not in Standard tier?

Accepted Answer

Event Threat Detection. Event Threat Detection is a Premium-only feature. Security Health Analytics, Web Security Scanner, and Anomaly Detection are available in both tiers.

Answer

Security Health Analytics

Answer

Anomaly Detection

Answer

Web Security Scanner

Question 8

An organization uses Binary Authorization with a GKE cluster that enforces attestation. A developer builds a container and pushes it to Artifact Registry. The image must be signed before it can be deployed. Which steps are required to allow this image to run on the cluster?

Accepted Answer

Sign the image using Cloud KMS and an attestor, then create a signed attestation in Container Analysis, and deploy the image.. Binary Authorization requires a signed attestation from a trusted attestor, stored in Cloud KMS. The image must be signed using a private key associated with the attestor, and the attestation is typically stored as a note in Container Analysis. Simply having a vulnerability scan or pushing without signing will not satisfy the policy.

Answer

Push the image to Artifact Registry and allow the Binary Authorization policy to automatically sign it.

Answer

Configure the cluster to allow all images by setting the policy to 'Allow All' for the developer's namespace.

Answer

Use the Binary Authorization API to create an attestation by specifying the image URL and the attestor, then deploy.

Question 9

Which Google Cloud SIEM solution ingests logs from various sources, normalizes them into the Unified Data Model (UDM), and allows detection using YARA-L rules?

Accepted Answer

Chronicle. Chronicle is Google Cloud's SIEM solution that ingests logs, normalizes them into UDM, and enables detection rules with YARA-L. Security Command Center is a security posture management tool, not a SIEM. Cloud Logging is for log storage and analysis, not SIEM. BigQuery is a data warehouse.

Answer

Cloud Logging

Answer

BigQuery

Answer

Security Command Center

Question 10

An organization wants to use Security Command Center to detect misconfigurations in their Google Cloud resources. They need a service that can automatically check for common security issues like open firewall ports and IAM policy violations. Which SCC feature should they enable?

Accepted Answer

Security Health Analytics. Security Health Analytics (SHA) is the SCC built-in scanner that checks for misconfigurations such as open firewall ports, overly permissive IAM roles, and other security best practices. Web Security Scanner targets web app vulnerabilities. Event Threat Detection is for threat detection. Anomaly Detection identifies unusual behavior.

Answer

Anomaly Detection

Answer

Event Threat Detection

Answer

Web Security Scanner