PCSE Practice Test 5 — 10 Questions

Question 1

A company is deploying a web application behind an external HTTPS load balancer. They want to protect against common web attacks such as XSS, SQLi, and LFI using preconfigured rules. They also need to allowlist specific IP addresses that belong to partners. Which three Cloud Armor features should they use? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach the Cloud Armor security policy to the backend service or load balancer.. Option A is correct because a Cloud Armor security policy only takes effect once it is attached to the target backend service (or the backend service of the external HTTPS load balancer), which is the enforcement point for the rules. Option B is correct because the OWASP ModSecurity Core Rule Set (CRS) preconfigured WAF rules in Cloud Armor are specifically designed to detect and block common web attacks such as XSS, SQL injection, and local file inclusion without writing rules from scratch. Option E is correct because partner IP allowlisting is implemented with custom Cloud Armor rules using match conditions on source IP ranges (for example, srcIpRanges with an allow action at a suitable priority), which permits only the specified partner addresses. Option C is not correct because IAP controls user authentication/authorization to applications and does not provide WAF protection against XSS, SQLi, or LFI, nor IP allowlisting for partners. Option D is not correct because Cloud CDN only caches content at the edge to improve performance; it does not inspect or block malicious web requests.

Answer

Configure IAP to restrict access to the application.

Answer

Use Cloud CDN to cache static content.

Question 2

Your organization has an IAM policy at the folder level that grants a user the Compute Admin role. A deny policy at the project level denies the same user the compute.instances.create permission. What is the effective access for this user on the project?

Accepted Answer

The user cannot create instances because deny policies override allow policies.. Deny policies always override allow policies. The deny at the project level explicitly denies compute.instances.create, so the user cannot create instances despite the folder-level allow.

Answer

The user can create instances because the allow policy at the folder level takes precedence over the deny policy at the project level.

Answer

The user can create instances because the project-level deny policy only applies to resources within the project, not to permissions inherited from the folder.

Answer

The user can create instances because deny policies only block explicit allows, not inherited ones.

Question 3

A security engineer needs to implement a logging pipeline that sends real-time Cloud Audit Logs to a third-party SIEM. They must ensure that if the SIEM is unavailable, logs are not lost. Which approach should they use?

Accepted Answer

Create a log sink that writes to a Pub/Sub topic, and use a subscription with a dead letter topic.. Using a Pub/Sub subscription with a dead letter topic allows messages to be retried and, if delivery fails persistently, moved to a dead letter topic for later reprocessing. This prevents data loss. Cloud Storage is not real-time; BigQuery is not for streaming to SIEM; Cloud Run without Pub/Sub would miss retries.

Answer

Configure a Cloud Run service to pull logs from Cloud Logging API and forward to SIEM.

Answer

Export logs to Cloud Storage via a sink, and have the SIEM ingest from there.

Answer

Use a log sink to BigQuery and have the SIEM query BigQuery periodically.

Question 4

An organization uses a global HTTPS load balancer with a Google-managed SSL certificate. The certificate was automatically provisioned and renewed. Recently, the certificate renewal failed and the site shows a warning. The load balancer's frontend uses the certificate. What is the most likely cause?

Accepted Answer

The DNS CNAME record for domain validation is misconfigured or missing. Google-managed certificates are provisioned using DNS authorization. If the DNS records are misconfigured (e.g., the CNAME record for domain ownership validation is missing or incorrect), renewal will fail. The load balancer settings themselves are typically fine.

Answer

The load balancer's frontend IP address has changed

Answer

The certificate has reached its maximum validity period

Answer

The load balancer's SSL policy requires a minimum TLS version that the managed certificate does not support

Question 5

A company wants to automatically provision and renew SSL certificates for their HTTPS load balancer. They do not want to manually manage certificate files. Which approach should they use?

Accepted Answer

Create a Google-managed SSL certificate resource.. A Google-managed SSL certificate resource is automatically provisioned, renewed, and rotated by Google Cloud for use with HTTPS load balancers. It eliminates manual certificate file management, matching the requirement for automatic provisioning and renewal without manual intervention.

Answer

Upload a self-managed certificate in PEM format.

Answer

Configure SSL policies to enforce TLS version.

Answer

Use Certificate Manager with a DNS-authorized certificate.

Question 6

A security engineer needs to encrypt data at rest in Cloud Storage using a key that is not managed by Google Cloud. The key must be stored on-premises and provided with each API call for data access. Which encryption approach should be used?

Accepted Answer

Use customer-supplied encryption keys (CSEK) by providing the key in the request headers.. Customer-supplied encryption keys (CSEK) allow you to provide your own AES-256 key with each API call to Cloud Storage. The key is not stored by Google Cloud; it is used only in memory to encrypt/decrypt data and then discarded, meeting the requirement of on-premises key storage and per-API-call key provision.

Answer

Use customer-managed encryption keys (CMEK) with key material imported from an on-premises HSM.

Answer

Use Cloud KMS with a key stored in an on-premises HSM via Cloud External Key Manager.

Answer

Use Google-managed encryption keys with an organizational policy to disable automatic encryption.

Question 7

A healthcare organization is migrating to Google Cloud and needs to store Protected Health Information (PHI) while maintaining HIPAA compliance. They have executed a Business Associate Agreement (BAA) with Google. Which additional step is required to ensure that PHI is properly classified and protected?

Accepted Answer

Use Cloud Data Loss Prevention (DLP) to inspect and classify storage buckets containing PHI.. Cloud DLP is the service designed to inspect, classify, and de-identify sensitive data such as PHI. After signing a BAA, the next step to ensure PHI is properly classified and protected is to use DLP to discover and label PHI in storage buckets, which enables appropriate controls. Audit logs, Cloud Armor, and VPC Service Controls are important but do not fulfill the classification requirement.

Answer

Enable Audit Logs for all services that process PHI.

Answer

Configure Cloud Armor to protect web applications handling PHI.

Answer

Enable VPC Service Controls and restrict access to Cloud Storage buckets containing PHI.

Question 8

A user in a Google Cloud organization wants to create a custom IAM role at the project level. Which permission is required to create custom roles?

Accepted Answer

iam.roles.create. Creating a custom IAM role at the project level requires the iam.roles.create permission, which is included in roles like roles/iam.roleAdmin or roles/iam.organizationRoleAdmin. This permission allows the user to define a new custom role with a specified set of permissions. Without it, the API call to create a role will fail with a PERMISSION_DENIED error.

Answer

resourcemanager.projects.setIamPolicy

Answer

iam.serviceAccounts.create

Answer

iam.roles.update

Question 9

An organization wants to allow only specific trusted IP ranges to access a web application behind a Cloud Load Balancer. Which Cloud Armor feature should be used?

Accepted Answer

Custom rules with source IP allow/deny lists. Cloud Armor custom rules allow you to define source IP allow/deny lists using CIDR ranges, which directly satisfies the requirement to restrict access to specific trusted IP ranges. Preconfigured WAF rules, geolocation, and adaptive protection do not provide granular IP-based allow/deny control.

Answer

Preconfigured rules for OWASP ModSecurity CRS

Answer

Geolocation-based access control

Answer

Adaptive protection

Question 10

A company is using Cloud Armor to protect their HTTP(S) load balancer. They have configured a security policy with a rule to block traffic from a specific IP address (10.0.0.1/32). During testing, they observe that requests from that IP are still reaching the backend. What is the most likely reason?

Accepted Answer

The security policy is not attached to the backend service.. Cloud Armor security policies must be explicitly attached to a backend service to take effect. If the policy is not attached, the rules within it—including the block rule for 10.0.0.1/32—are not evaluated, and traffic flows to the backend as if no policy exists. This is the most common cause when a configured rule appears to be ignored.

Answer

The backend service is configured to bypass Cloud Armor.

Answer

Cloud Armor does not support blocking specific IP addresses.

Answer

The rule has a lower priority than a default allow rule.