PCSE Practice Test 50 — 15 Questions

Question 1

A company wants to allow an application running on an on-premises server to access Cloud Storage without using long-lived service account keys. The on-premises environment uses Azure Active Directory (Azure AD) as its identity provider. Which GCP feature should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Workload Identity Federation with Azure AD as an identity provider.. Workload Identity Federation supports Azure AD as an external identity provider. The on-premises app can obtain an Azure AD token and exchange it for a GCP service account token, eliminating the need for keys.

Answer

Service Account Key rotation policy.

Answer

Create a custom OAuth 2.0 client ID for the application.

Answer

Use a VPN between on-premises and GCP, and allow the on-premises server to use a metadata server.

Question 2

A developer wants to grant a service account the ability to impersonate another service account in a different project. Which IAM permission is required for the developer to assign?

Accepted Answer

iam.serviceAccounts.actAs. The iam.serviceAccounts.actAs permission on the target service account allows a principal to impersonate that service account. This permission is included in the Service Account User role (roles/iam.serviceAccountUser). The developer needs to grant that role to the source service account (or user) on the target service account.

Answer

iam.serviceAccounts.getAccessToken

Answer

iam.serviceAccounts.create

Answer

iam.serviceAccounts.update

Question 3

A DevOps engineer accidentally assigned the role roles/editor to a service account used by a backend service. This gives the service account excessive permissions. The engineer wants to remove the role from the service account. What is the correct command?

Accepted Answer

gcloud projects remove-iam-policy-binding PROJECT_ID --member serviceAccount:SA_EMAIL --role roles/editor. `gcloud projects remove-iam-policy-binding` is the specific command to remove an IAM role binding from a project-level policy for a given member (service account). The syntax correctly includes the `--member` flag with the `serviceAccount:` prefix and the `--role` flag specifying `roles/editor`, which removes the excessive Editor role from the service account.

Answer

gcloud iam policy-bindings remove --member serviceAccount:SA_EMAIL --role roles/editor

Answer

gcloud iam service-accounts remove-role SA_EMAIL --role roles/editor

Answer

gcloud projects set-iam-policy PROJECT_ID policy.yaml

Question 4

A large enterprise is migrating its on-premises Active Directory to Google Cloud using Managed Microsoft AD (Microsoft AD). They have established a VPN connection between their on-premises network and VPC. The domain controllers are fully synced, and users can authenticate from on-premises. However, applications running on Compute Engine VMs in the same VPC as Managed Microsoft AD are failing to authenticate using LDAP. The VMs are Linux-based and configured to use the Managed Microsoft AD domain for authentication via SSSD. The security team has verified that the firewall rules allow TCP/UDP 389 and 636 from the VMs to the Managed Microsoft AD IP addresses. The VMs can resolve the domain name (corp.example.com) to the correct IP of the Managed Microsoft AD domain controllers. What is the most likely cause of the authentication failure?

Accepted Answer

The VMs do not have the required network tag to allow inbound traffic from Managed Microsoft AD.. Managed Microsoft AD in Google Cloud uses internal VPC IP addresses for its domain controllers. For Linux VMs using SSSD to authenticate via LDAP, the VMs must be able to initiate outbound LDAP traffic to the Managed Microsoft AD IPs, and the Managed Microsoft AD service must be able to respond. However, Managed Microsoft AD enforces network security by requiring that only VMs with a specific network tag (by default 'allow-ad') can receive inbound traffic from the Managed Microsoft AD service. Without this tag on the VMs, the Managed Microsoft AD service will drop its response packets, causing authentication failures even though outbound firewall rules are open. The security team verified firewall rules for outbound traffic but missed this inbound tag requirement.

Answer

The VPN tunnel does not support LDAP traffic.

Answer

The DNS resolution returns the on-premises domain controller IP instead of the Managed Microsoft AD IP.

Answer

The Managed Microsoft AD service account does not have the 'domain controller' IAM role.

Question 5

A company uses VPC Service Controls in dry-run mode to test a new service perimeter that includes BigQuery. They want to monitor any violations without actually blocking access. Where can they view the logs of these dry-run violations?

Accepted Answer

Cloud Logging with the filter `policy_violations`. When VPC Service Controls is in dry-run mode, violations are logged to Cloud Logging but access is not blocked. The logs can be viewed in the Logs Explorer using the filter for VPC Service Controls policy violations.

Answer

Cloud Monitoring dashboards

Answer

VPC Flow Logs

Answer

Access Transparency logs

Question 6

An organization uses Cloud Identity to manage users and groups. They want to enforce that only users from their corporate domain (example.com) can be granted IAM roles on GCP resources. Which organization policy constraint should they use?

Accepted Answer

constraints/iam.allowedPolicyMemberDomains. The constraint 'constraints/iam.allowedPolicyMemberDomains' restricts which domains can be used in IAM policy bindings. By setting it to allow only 'example.com', any binding that includes a user from another domain will be denied.

Answer

constraints/iam.disableServiceAccountKeyCreation

Answer

constraints/compute.restrictCloudArmorPolicies

Answer

constraints/iam.workloadIdentityPoolProviders

Question 7

A company needs to store audit logs for a minimum of 5 years to meet compliance requirements. Cloud Logging retains logs for 30 days by default. Which approach should they take?

Accepted Answer

Create a log sink to export logs to Cloud Storage, and use Object Lifecycle Management to delete objects after 5 years. To retain logs for longer than 30 days, you must create a log sink that exports logs to a destination like Cloud Storage, and then set a retention policy on the bucket. Cloud Storage's Object Lifecycle Management can delete objects after 5 years.

Answer

Store logs in BigQuery and set table expiration to 5 years

Answer

Use Cloud Functions to periodically copy logs to a persistent disk

Answer

Enable the 'Log Retention' setting in Cloud Logging to 5 years

Question 8

Your company has a hybrid cloud environment with on-premises servers and Google Cloud. You are using Cloud VPN to connect the on-premises network to a VPC in us-central1. The on-premises network uses RFC 1918 addresses (10.0.0.0/8). The VPC has subnets in 10.0.0.0/8 as well, causing IP overlap. To resolve this, you have configured the VPC with a custom IP range of 172.16.0.0/12 and migrated some workloads. However, some legacy on-premises servers still need to access a specific set of Compute Engine VMs in the VPC. The security team requires that only authenticated service accounts from the VPC can access on-premises resources, and that traffic from on-premises to Google Cloud must be limited to specific ports (e.g., 443, 8443). You have set up a Cloud VPN tunnel with route-based VPN. What should you do to enforce these access controls?

Accepted Answer

Create VPC firewall rules that allow ingress from the on-premises IP ranges on ports 443 and 8443 to the target VMs. On the on-premises side, configure firewall rules to allow only traffic from the VPC IP ranges and require that the source VMs present a valid service account token, which can be verified using a proxy or by using Google Cloud's Identity-Aware Proxy (IAP) for TCP forwarding.. It addresses both requirements: limiting traffic to specific ports (443, 8443) via VPC firewall rules, and enforcing authenticated service account access from the VPC to on-premises resources. Identity-Aware Proxy (IAP) for TCP forwarding allows on-premises servers to verify that source VMs present a valid service account token, ensuring only authenticated VPC workloads can initiate connections. This combination satisfies the security team's need for both port restriction and authentication without relying on IP-based trust alone.

Answer

Use Cloud Armor to create a security policy that filters traffic from on-premises IP ranges on ports 443 and 8443, and attach it to the VPN gateway.

Answer

Assign network tags to the Compute Engine VMs and create a firewall rule that allows traffic from the on-premises IP ranges on ports 443 and 8443 only to VMs with that tag.

Answer

Use Cloud NAT to provide outbound-only access from the VPC, and create firewall rules to block inbound traffic from on-premises.

Question 9

A data engineer wants to use Cloud DLP to scan a Cloud Storage bucket for personally identifiable information (PII). Which resource should they create to run this scan?

Accepted Answer

Create a DlpJob. Cloud DLP uses 'DlpJob' or 'InspectJob' to scan data. A 'DlpJob' can be created to inspect content in Cloud Storage, BigQuery, or Datastore. A job trigger can schedule scans, but the scan itself is a job. 'DeidentifyTemplate' and 'InspectTemplate' are configuration templates, not the scan execution.

Answer

Create an InspectTemplate

Answer

Create a JobTrigger

Answer

Create a DeidentifyTemplate

Question 10

An organization wants to use Identity-Aware Proxy (IAP) to secure access to a web application running on Compute Engine. They need to ensure that only users with specific email domains can access the application, and also verify that requests are coming from IAP. Which two configurations are required? (Choose two.)

Accepted Answer

Create a firewall rule that allows traffic only from IAP's IP ranges.. To secure access with IAP, you must allow IAP's IP ranges in the firewall (option B) and configure the backend to validate IAP-signed headers (option C). The IAP role is also needed but the question focuses on the two specific configurations for IP and header validation.

Answer

Configure Cloud Armor to block non-IAP traffic.

Answer

Assign the IAP-secured Web App User role to the users.

Answer

Create an organization policy to enforce IAP usage.

Question 11

A company needs to comply with GDPR and must implement data subject access request (DSAR) capabilities. Which TWO Google Cloud services should they use to locate and export personal data across various data stores?

Accepted Answer

BigQuery. BigQuery is correct because it can be used to query and export personal data stored in BigQuery tables via SQL, enabling DSAR compliance by locating and extracting data subject information. Cloud Data Loss Prevention (DLP) is correct because it can inspect and classify personal data across various Google Cloud data stores (including Cloud Storage, BigQuery, and Datastore) and de-identify or export findings, directly supporting DSAR workflows.

Answer

Cloud Key Management Service (KMS)

Answer

Cloud Storage

Answer

VPC Service Controls

Question 12

A large healthcare organization is migrating its on-premises data center to Google Cloud. The organization must comply with HIPAA and has signed a BAA with Google Cloud. They plan to use BigQuery for analytics on PHI data. The security team has enabled encryption at rest with CMEK and has configured VPC Service Controls to prevent data exfiltration. During a penetration test, the testers discovered that they could query the BigQuery dataset using a service account that has BigQuery Data Viewer role from a non-VPC-SC-compliant network. This could allow unauthorized access to PHI data. The team needs to restrict all access to the BigQuery dataset to only originate from within the VPC perimeter defined by VPC Service Controls. What should the team do to enforce this requirement?

Accepted Answer

Enable VPC Service Controls perimeters for the BigQuery API and ensure that the project containing the dataset is in the perimeter, and configure ingress/egress rules to allow only requests from within the perimeter.. VPC Service Controls are specifically designed to create a security perimeter around Google Cloud services like BigQuery, preventing data exfiltration and restricting access to only requests originating from within the defined perimeter. By placing the project containing the BigQuery dataset inside the VPC Service Controls perimeter and configuring ingress/egress rules, the team ensures that even a service account with BigQuery Data Viewer role cannot query the dataset from a non-VPC-SC-compliant network, as the API call is blocked at the Google Cloud edge before it reaches BigQuery.

Answer

Set up Private Google Access for the on-premises network and route all traffic through a VPN tunnel.

Answer

Configure an Organization Policy that restricts BigQuery access to only service accounts with a specific prefix.

Answer

Use Cloud IAP to require users to authenticate before accessing BigQuery.

Question 13

An organization is designing a secure multi-tenant SaaS environment on GKE. They want to isolate tenant workloads using GKE namespaces and IAM. Which two steps should they take? (Choose two.)

Accepted Answer

Use Kubernetes RBAC to restrict access within namespaces.. Kubernetes RBAC is the native mechanism for controlling access to resources within a namespace. By defining Role and RoleBinding objects, you can precisely restrict which tenant users can perform actions (e.g., get, list, create pods) inside their assigned namespace, ensuring logical isolation without requiring separate clusters.

Answer

Enable GKE Dataplane V2 for network isolation.

Answer

Grant cluster-level IAM roles to tenant users.

Answer

Create a separate GKE cluster per tenant.

Question 14

A DevOps engineer wants to allow a CI/CD pipeline running in GitHub Actions to deploy resources to a Google Cloud project without using long-lived service account keys. What should the engineer implement?

Accepted Answer

Configure Workload Identity Federation between GitHub and the service account.. Workload Identity Federation allows GitHub Actions to exchange OpenID Connect (OIDC) tokens for Google Cloud temporary credentials, eliminating the need for long-lived service account keys. This approach follows Google's security best practices by using short-lived, automatically rotated tokens and avoids the risk of key exposure in repository secrets.

Answer

Use a Cloud Functions HTTP trigger called from GitHub Actions.

Answer

Create a service account and distribute its JSON key to the GitHub repository secrets.

Answer

Enable Cloud Build triggers that watch the GitHub repository.

Question 15

A company is deploying a new internal application on Google Cloud. They want to ensure that VM instances in a specific subnet can only communicate with each other and with a load balancer that fronts the application. They also want to allow SSH access from a bastion host. Which TWO firewall rules should they create? (Choose two.)

Accepted Answer

An ingress rule that allows all traffic from the subnet to the instances (target tags or service account). To restrict communication to only internal subnet traffic and the load balancer, you need an ingress rule that allows traffic from the subnet (source) to all instances (target). To allow SSH from the bastion, you need an ingress rule allowing TCP port 22 from the bastion host (using its service account or tags). Egress rules are not needed because the default allow egress is not restrictive; but if you want to block other egress, you would need a deny egress rule, but the question asks for rules to allow, not block.

Answer

An egress rule that blocks all traffic except to the load balancer and subnet

Answer

An egress rule that allows all traffic to the load balancer's frontend IP

Answer

An ingress rule that allows HTTP traffic from the load balancer to the instances