PCSE Practice Test 50 — 15 Questions

Question 1

A healthcare analytics company stores patient records in Cloud Storage. Their compliance team mandates that all objects be encrypted with a Customer-Managed Encryption Key (CMEK) that the company can revoke at any time. They also require that the encryption key be generated and stored in a FIPS 140-2 Level 3 validated HSM. Which approach should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Cloud KMS key ring with protection level HSM in the same region as the bucket, then set the bucket's default KMS key to that key.. The correct approach uses a Cloud KMS HSM-protected key as the bucket's default encryption key. This meets the FIPS 140-2 Level 3 HSM requirement and gives the company control to revoke access by disabling the key version. Google-managed keys lack revocation control, Cloud EKM does not ensure HSM generation, and CSEK lacks integration and audit features.

Answer

Use customer-supplied encryption keys (CSEK) and store the keys in a secure on-premises HSM.

Answer

Enable default encryption with Google-managed keys and enable Cloud External Key Manager (Cloud EKM) for the bucket.

Answer

Create a Cloud KMS key with protection level SOFTWARE and use it as the bucket's default key.

Question 2

A company stores sensitive configuration data in Cloud Storage. They want to ensure that data is encrypted at rest using a key that they manage, and they want to be able to audit all key usage. Which Google Cloud service should they use to manage the encryption keys?

Accepted Answer

Cloud Key Management Service (Cloud KMS). Cloud KMS is the correct service for creating and managing customer-managed encryption keys, including integration with Cloud Storage for encryption at rest. It provides audit logging of key usage, which meets the auditing requirement. Other services like IAM, Cloud DLP, and Secret Manager serve different purposes and do not provide key management for data encryption.

Answer

Secret Manager

Answer

Cloud Data Loss Prevention (Cloud DLP)

Answer

Cloud Identity and Access Management (IAM)

Question 3

A security team needs to monitor for anomalous IAM activity in their Google Cloud organization. They want to detect when a service account key is created outside of normal change windows. Which Google Cloud service should they use to set up an alert?

Accepted Answer

Cloud Monitoring with log-based alerts on Cloud Audit Logs.. Cloud Monitoring log-based alerts are designed to monitor audit logs and trigger notifications based on specific events. By creating an alert policy with a filter for service account key creation, the team can be alerted in near real-time. This is the most direct and appropriate solution.

Answer

Security Command Center with Event Threat Detection.

Answer

VPC Service Controls with access levels.

Answer

Cloud Asset Inventory with a feed to Pub/Sub.

Question 4

A security administrator needs to grant a team of auditors read-only access to all current and future objects in a Cloud Storage bucket named 'audit-logs' in a project. The auditors should not be able to modify or delete any objects. Which IAM role should the administrator grant to the auditors at the bucket level?

Accepted Answer

roles/storage.objectViewer. The auditors require read-only access to all objects in the bucket. The roles/storage.objectViewer role provides exactly that: permissions to list and read objects without any write capabilities. Granting this role at the bucket level ensures that the auditors can access current and future objects while adhering to the principle of least privilege.

Answer

roles/storage.objectAdmin

Answer

roles/storage.bucketViewer

Answer

roles/storage.legacyBucketReader

Question 5

A company uses BigQuery to store customer data and wants to enforce that only users with the role 'data_viewer' can see a specific column containing personally identifiable information, while other columns remain accessible to a broader group. They also need to ensure that the policy is applied consistently even when data is queried through authorized views. Which BigQuery feature should they use?

Accepted Answer

Column-level security using policy tags in Data Catalog.. Column-level security in BigQuery uses policy tags from Data Catalog to control access to specific columns. By assigning a policy tag to the sensitive column and granting the fine-grained reader role to the 'data_viewer' group, you restrict that column while leaving others accessible. This enforcement also applies when the data is queried through authorized views, ensuring consistent protection.

Answer

Row-level security using filter predicates.

Answer

Dataset-level IAM policies that grant the data_viewer role.

Answer

Authorized views that exclude the sensitive column.

Question 6

A security administrator needs to let a support team troubleshoot production VMs without granting them SSH keys or external IP access. The team should connect through Google Cloud's proxy and have their sessions recorded for audit. Which configuration should the administrator implement?

Accepted Answer

Enable Identity-Aware Proxy TCP forwarding for the instances, grant roles/iap.tunnelResourceAccessor on the project, and require OS Login with two-factor authentication.. IAP TCP forwarding provides authenticated, proxied SSH access to instances that have no external IP, and the tunnelResourceAccessor role governs who may open the tunnel. Pairing it with OS Login enforces centralized key and two-factor policy, and IAP activity is logged for audit. Firewall rules can then be limited to the IAP source range.

Answer

Enable Private Google Access on the subnet, grant roles/compute.osAdminLogin to the team, and enable serial console access for troubleshooting.

Answer

Create a firewall rule allowing tcp:22 from 0.0.0.0/0, distribute SSH key pairs to the team, and enable VPC Flow Logs on the subnet.

Answer

Deploy a bastion host with an external IP, restrict SSH to the team's office CIDR, and store the private keys in Secret Manager.

Question 7

A multinational corporation must ensure that its Google Cloud resources for a new application are deployed only in the European Union to comply with GDPR data residency requirements. The security team wants to enforce this automatically and receive alerts if any resource is created outside the allowed regions. Which Google Cloud service should they use?

Accepted Answer

Organization Policy Service with a location restriction constraint.. Organization Policy Service with the location restriction constraint is the most direct way to enforce that resources are only created in allowed EU regions. It applies at the organization, folder, or project level and prevents non-compliant resource creation. While Assured Workloads also supports data residency, it is tailored to specific compliance regimes and may not cover all services as flexibly.

Answer

VPC Service Controls with a perimeter around EU regions.

Answer

Assured Workloads with the EU Regions and Support control package.

Answer

Cloud Asset Inventory with a feed that monitors resource creation events.

Question 8

A security engineer must ensure that a service account used by an application on Compute Engine can only access a specific Cloud Storage bucket named 'prod-data' and no other buckets in the project. The service account currently has the roles/storage.objectViewer role granted at the project level. What should the engineer do to meet this requirement?

Accepted Answer

Remove the project-level roles/storage.objectViewer binding and grant roles/storage.objectViewer on the 'prod-data' bucket to the service account.. To restrict a service account to a specific bucket, you must remove any project-level IAM bindings that grant broader access and instead grant the necessary role directly on the bucket. This ensures the service account can only access resources within that bucket, aligning with least privilege.

Answer

Enable uniform bucket-level access on all buckets and then grant the service account the roles/storage.legacyBucketReader role on 'prod-data'.

Answer

Use a VPC Service Controls perimeter to restrict access to only the 'prod-data' bucket.

Answer

Create a new custom role with storage.objects.get and storage.objects.list permissions and grant it at the project level.

Question 9

A company wants to grant a team of developers the ability to manage Compute Engine instances in a specific project. The developers should be able to create, start, stop, and delete instances, but they should not be able to modify IAM policies or access other services. Which predefined role should be granted at the project level?

Accepted Answer

roles/compute.instanceAdmin.v1. The Compute Instance Admin (v1) role provides the necessary permissions to manage instances without granting IAM modification rights or access to other services. It is a predefined role that aligns with the principle of least privilege for this scenario. Other roles either grant too much access or are read-only.

Answer

roles/compute.admin

Answer

roles/compute.viewer

Answer

roles/editor

Question 10

A financial institution uses Google Cloud and wants to ensure that only service accounts within a specific project can impersonate a critical service account used by a payment processing application. They need to grant the `iam.serviceAccounts.getAccessToken` permission to allow impersonation. Which IAM role should they grant to the authorized service accounts?

Accepted Answer

roles/iam.serviceAccountTokenCreator. To allow a service account to impersonate another service account and obtain an access token, the `iam.serviceAccounts.getAccessToken` permission is required. This permission is included in the Service Account Token Creator role. Granting this role on the target service account to the authorized service accounts enables secure impersonation. Other roles either do not include the necessary permission or are designed for different purposes.

Answer

roles/iam.serviceAccountUser

Answer

roles/iam.workloadIdentityUser

Answer

roles/iam.serviceAccountKeyAdmin

Question 11

A financial services company must log all denied connections to its production VPC, which contains hundreds of VM instances and several firewall rules. The security team needs visibility into which denied flows target which instances, without capturing every allowed flow and generating excessive log volume. What should they do?

Accepted Answer

Enable Firewall Rules Logging on the firewall rules that deny traffic, and view the logs in Cloud Logging. Firewall Rules Logging is the mechanism that records connections matched by a specific firewall rule, including the rule name, the action taken, and the involved instances. Enabling it selectively on the rules that deny traffic produces exactly the denied-flow records needed, with rule-level attribution, while avoiding the cost and volume of logging every allowed connection. VPC Flow Logs and Packet Mirroring capture broader traffic and cannot identify the responsible firewall rule.

Answer

Enable Packet Mirroring on the production VPC to copy all traffic to a collection instance running an IDS

Answer

Enable VPC Flow Logs on every subnet in the production VPC with a sampling rate of 1.0

Answer

Configure a Cloud Logging sink that filters for firewall rule matches and export the results to BigQuery for analysis

Question 12

A company uses Google Cloud Directory Sync (GCDS) to synchronize users from an on-premises LDAP directory to Cloud Identity. They want to ensure that when a user is deleted in the on-premises directory, they immediately lose access to Google Cloud resources. What should they configure?

Accepted Answer

Configure GCDS to delete users in Cloud Identity when they are deleted in the on-premises directory, and schedule synchronization to run frequently.. GCDS can synchronize user deletions from an on-premises LDAP directory to Cloud Identity. By configuring GCDS to delete users and scheduling frequent syncs, the company ensures that when a user is removed on-premises, their Cloud Identity account is deleted promptly, revoking access to Google Cloud resources.

Answer

Enable single sign-on (SSO) with a third-party IdP and configure SAML attribute mapping to include a user status attribute.

Answer

Use the Admin SDK Directory API to programmatically delete users when they are removed from the on-premises directory.

Answer

Set up a Google Group that contains all users and grant access to resources via that group. Remove users from the group when they are deleted on-premises.

Question 13

A company needs to connect its on-premises network to a Google Cloud VPC. The security team requires that traffic be encrypted and that the connection support dynamic routing via BGP. They also want a solution that can be set up quickly without ordering a dedicated physical circuit. What should they use?

Accepted Answer

HA VPN with Cloud Router and two tunnels to the on-premises VPN gateway.. HA VPN uses IPsec over the internet, so no physical circuit is needed, and it can be deployed in minutes. Cloud Router enables BGP for dynamic route exchange. With two tunnels, it provides high availability. This combination satisfies encryption, dynamic routing, and rapid setup without dedicated circuits.

Answer

HA VPN over Cloud Interconnect with a VLAN attachment.

Answer

Partner Interconnect with a 1-Gbps attachment and Cloud Router.

Answer

Dedicated Interconnect with a 10-Gbps circuit and Cloud Router.

Question 14

A company wants to ensure that their security team is alerted when a new project is created in their Google Cloud organization. They need a centralized, low-maintenance solution that requires minimal custom code. What should they do?

Accepted Answer

Create a log-based alert in Cloud Monitoring for the CreateProject method.. Admin Activity audit logs capture project creation. A log-based alert in Cloud Monitoring can trigger on the CreateProject method and notify the security team. This requires no custom code and is centralized. Other options either need custom code or do not provide real-time alerts, making the log-based alert the best choice.

Answer

Set up a Cloud Function triggered by a Pub/Sub topic that receives all audit logs.

Answer

Configure an alerting policy in Cloud Monitoring based on the project count metric.

Answer

Use Cloud Asset Inventory to monitor for new projects and send notifications.

Question 15

Your organization stores large volumes of sensitive data in Cloud Storage. A security policy requires that all data be encrypted with customer-managed encryption keys (CMEK) at rest, and that the keys be automatically rotated every 90 days. You need to enforce this for all new objects written to a specific bucket. What should you do?

Accepted Answer

Configure the bucket's default encryption key to a Cloud KMS key with a 90-day rotation schedule.. The correct answer is to set the bucket's default encryption key to a Cloud KMS key with automatic rotation. This ensures every new object is encrypted with CMEK, and Cloud KMS handles rotation according to the schedule. Other options either do not enforce CMEK for all objects or rely on manual processes that are error-prone.

Answer

Create a Cloud KMS key ring and key, then manually rotate the key every 90 days using a Cloud Scheduler job.

Answer

Enable Customer-Supplied Encryption Keys (CSEK) on the bucket and provide the key in each upload request.

Answer

Use Google-managed encryption keys and enable automatic rotation through Cloud KMS.