PCSE Practice Questions 2 — 50 Questions

Question 1

An incident responder needs to collect forensic evidence from a compromised Compute Engine instance for later analysis. They want to preserve disk state and network logs. Which THREE actions should they take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Export and analyze VPC Flow Logs for the instance's network traffic.. Creating a disk snapshot captures the disk state including deleted files. Analyzing VPC Flow Logs can reveal network connections. Isolating the instance with a firewall rule prevents further damage. Powering off the instance may alter evidence. Deleting the instance loses evidence. Cloning the instance may preserve some state but is not standard forensic practice.

Answer

Delete the instance to stop billing.

Answer

Power off the instance to prevent further compromise.

Question 2

A company is using Security Command Center (SCC) Premium tier and wants to automatically remediate certain high-severity findings. Which two services can be used together to achieve this? (Choose two.)

Accepted Answer

Pub/Sub. SCC findings can be sent to Pub/Sub, which then triggers a Cloud Function (or Cloud Run) that performs automated remediation actions. Cloud Functions can be used for lightweight automation. Cloud Scheduler is for cron jobs, not event-driven. Dataflow is for data processing. IAM is for access control.

Answer

Dataflow

Answer

Cloud Scheduler

Answer

Cloud IAM

Question 3

A DevOps engineer wants to use Cloud Armor to block common web application attacks like SQL injection and cross-site scripting. Which feature should they enable?

Accepted Answer

Preconfigured rules (OWASP CRS). Cloud Armor's preconfigured WAF rules include the OWASP ModSecurity Core Rule Set, which detects SQLi, XSS, and other attacks.

Answer

Rate limiting

Answer

Custom rules with IP allow/deny

Answer

Adaptive Protection

Question 4

A multinational organization uses Chronicle SIEM to aggregate and analyze security logs from multiple GCP projects and on-premises systems. The security team wants to detect a known threat pattern: a user authenticating from an anomalous geographic location followed by a large data egress from a Compute Engine instance within 10 minutes. Which three steps are necessary to create this detection? (Choose three.)

Accepted Answer

Ingest Cloud Audit Logs and VPC Flow Logs into Chronicle via forwarders or native integration. Chronicle uses YARA-L rules to detect patterns across different log sources. UDM normalizes logs into a common schema. The rule can reference events from multiple log types (e.g., authentication logs and network logs) and define temporal relationships.

Answer

Configure a BigQuery export of VPC Flow Logs for long-term analysis

Answer

Enable the Standard tier of Security Command Center to generate finding notifications

Question 5

A gaming company deploys a multiplayer game backend on Google Kubernetes Engine (GKE) with multiple microservices. The operations team needs to collect structured logs from containers, analyze them in real-time for anomalies, and store them for 30 days for compliance. They also need to monitor custom application metrics (e.g., player count per game server). Which three Google Cloud services should they use? (Choose three.)

Accepted Answer

Cloud Logging to collect container logs and store them for 30 days using a log bucket retention policy. Cloud Logging collects and stores logs, Cloud Monitoring collects metrics and supports custom metrics, and Chronicle can analyze logs for anomalies in real-time. BigQuery is for long-term analysis but not real-time anomaly detection.

Answer

BigQuery to store logs for 30 days and run real-time queries

Answer

Cloud SQL to store application metrics

Question 6

Your company needs to implement real-time monitoring of security events from Google Cloud resources. They want to ingest logs into a third-party SIEM system. Which two services should they use together? (Choose two.)

Accepted Answer

Cloud Logging log sink with Pub/Sub destination. Cloud Logging can export logs to Pub/Sub, and a subscriber (SIEM connector) can ingest them. Chronicle is a Google SIEM, but the question asks for third-party SIEM integration.

Answer

Cloud Storage export

Answer

Chronicle SIEM

Answer

BigQuery export

Question 7

An organization needs to centralize audit logs from multiple Google Cloud projects into a BigQuery dataset for long-term analysis. They also want to retain raw logs in Cloud Storage for archival purposes. What is the most efficient way to accomplish this?

Accepted Answer

Create two log sinks: one exporting to BigQuery, one to Cloud Storage, using an aggregated sink at the organization level.. Log sinks can route logs to multiple destinations by creating separate sinks for each destination. One sink can export logs to BigQuery, and another sink can export logs to Cloud Storage. Aggregated sinks at the organization or folder level allow collecting logs from all projects.

Answer

Create a single log sink that exports to both BigQuery and Cloud Storage.

Answer

Enable Data Access logs for all services and configure BigQuery as the default log destination.

Answer

Use Cloud Functions to copy logs from Cloud Logging to BigQuery and Cloud Storage.

Question 8

A security team needs to automatically respond to high-severity vulnerability findings in Security Command Center. They want to trigger a Cloud Function that quarantines the affected VM. What is the recommended way to connect SCC findings to Cloud Functions?

Accepted Answer

Create a SCC notification config that sends findings to a Pub/Sub topic, and set up a Cloud Function to subscribe to that topic.. SCC can publish findings to a Pub/Sub topic via notification configs. Cloud Functions can subscribe to that topic and execute the remediation logic. This is the recommended event-driven architecture.

Answer

Use Cloud Scheduler to poll SCC API every minute and invoke Cloud Function.

Answer

Configure Cloud Logging to capture SCC findings and create a log-based metric with an alert that triggers Cloud Function.

Answer

Export SCC findings to BigQuery and set up a BigQuery scheduled query to trigger Cloud Function.

Question 9

A security engineer needs to ensure that all container images deployed to a GKE cluster are signed by a trusted authority. The organization uses Cloud KMS for key management and wants to enforce the policy at admission time. Which two components are essential to implement this requirement? (Choose two.)

Accepted Answer

Attestor created in Binary Authorization with Cloud KMS key. Binary Authorization requires attestors to verify image signatures and a policy that requires at least one attestation. Attestors use Cloud KMS keys for signing, and the policy is enforced at GKE admission time.

Answer

Cloud Audit Logs enabled for GKE

Answer

Container Analysis vulnerability scanning

Answer

Web Security Scanner configured to scan the GKE cluster

Question 10

A company uses Cloud Audit Logs for compliance. They want to capture all data access events to a Cloud Storage bucket containing sensitive data. What must they enable?

Accepted Answer

Data Access audit logs with a configuration to log all methods. To capture all data access events to a Cloud Storage bucket, including API calls that read or write data, you must enable Data Access audit logs and configure them to log all methods. Admin Activity logs record configuration changes, System Event logs capture Google's internal system events, and Access Transparency logs are for requests from Google personnel. Only Data Access audit logs provide records of user and service account data access, making option D correct.

Answer

System Event audit logs

Answer

Admin Activity audit logs

Answer

Access Transparency logs

Question 11

A company uses Security Command Center (SCC) Premium tier and wants to automatically trigger a Cloud Function to remediate a threat finding. Which approach should they use?

Accepted Answer

Configure SCC to send findings to a Pub/Sub topic, and subscribe a Cloud Function to that topic.. SCC can send real-time notifications via Pub/Sub when findings of certain types or severities are created. A Cloud Function can subscribe to that topic to perform automated remediation. Cloud Scheduler cannot be triggered by events; Cloud Tasks is for asynchronous task execution but not designed for event-driven triggers from SCC; Logs Router exports logs but does not directly trigger Cloud Functions based on findings.

Answer

Use Cloud Tasks to periodically invoke Cloud Functions after reading findings from Security Command Center API.

Answer

Create a Cloud Scheduler job that polls SCC findings periodically and invokes Cloud Functions.

Answer

Export SCC findings to Cloud Storage, and set up a Cloud Function on object finalize.

Question 12

A company has a VPC with a subnet (10.1.0.0/24) in us-central1. They have a Cloud NAT configured for outbound traffic to the internet. They want instances in this subnet to access a third-party API that is only accessible over the internet and requires a specific static source IP for whitelisting. What is the recommended approach?

Accepted Answer

Reserve a static NAT IP in Cloud NAT and whitelist that IP with the third party.. Cloud NAT allows instances without external IPs to initiate outbound connections to the internet. By reserving a static NAT IP address in Cloud NAT, you ensure all outbound traffic from the subnet uses a consistent source IP, which can be whitelisted by the third-party API. This meets the requirement for a static source IP without assigning external IPs to individual instances.

Answer

Assign external IPs to the instances and use network-level access controls.

Answer

Use Private Google Access to route traffic through Google's network.

Answer

Configure a VPC Service Controls perimeter to restrict egress.

Question 13

A GKE cluster has Workload Identity enabled. A Kubernetes service account is bound to a GCP service account named 'sa-gcs'. A pod using the Kubernetes service account fails to list objects in a Cloud Storage bucket. The GCP service account has the Storage Object Viewer role. What is the most likely cause?

Accepted Answer

The Kubernetes service account does not have the iam.workloadIdentityUser role on the GCP service account.. The pod must use the Kubernetes service account, but the GCP service account may not have the required permission (storage.objects.list). However, with Workload Identity, the pod authenticates as the GCP SA. The issue could be that the GCP SA does not have the role on the specific bucket, or the binding is misconfigured. But the most common cause is missing the iam.workloadIdentityUser role on the GCP SA for the Kubernetes service account to impersonate it. Without that, the pod cannot use the GCP SA.

Answer

The pod is using the wrong GCP service account.

Answer

The bucket has uniform bucket-level access disabled.

Answer

The GCP service account lacks the storage.objects.list permission.

Question 14

A security analyst wants to detect when a user creates a Compute Engine instance with a public IP address in a sensitive project. What is the best method?

Accepted Answer

Use Cloud Logging with a log-based metric and alert.. Cloud Logging with a log-based metric and alert enables real-time detection by monitoring compute.instances.insert log entries for external IPs. Option A is incorrect: Cloud Functions can trigger on instance creation but require custom logic and may have latency. Option B is incorrect: Data Access audit logs track data access, not admin operations like instance creation. Option D is incorrect: Cloud Asset Inventory is not real-time and better suited for compliance checks, not immediate alerting.

Answer

Create a Cloud Function that triggers on instance creation events.

Answer

Enable Data Access audit logs and filter for insert calls.

Answer

Use Cloud Asset Inventory to create a feed for instance creation.

Question 15

Match each CVE or security concept to its description.

Accepted Answer

CVE-2017-0144: Exploits SMB protocol to allow remote code execution (EternalBlue). Correct matches: CVE-2017-0144 (EternalBlue) exploits SMB; CVE-2021-44228 (Log4Shell) targets Log4j; CVE-2014-0160 (Heartbleed) leaks OpenSSL memory; buffer overflow is a general memory corruption. Distractors swap descriptions between CVEs.

Answer

CVE-2017-0144: Exploits Apache Log4j logging library

Answer

CVE-2021-44228: Leaks memory from OpenSSL

Question 16

A company subject to GDPR receives a request from a data subject to delete all personal data from BigQuery audit logs. The logs contain query execution details with user identifiers. How can the company comply with the right to erasure (right to be forgotten)?

Accepted Answer

Use the Data Subject Request tool in Google Cloud to request erasure of the specific personal data from audit logs. BigQuery audit logs (Cloud Audit Logs) are immutable and cannot be deleted directly by customers. To comply with erasure requests, the company must use the Data Subject Request tool to request removal, as Google retains logs for 30 days and may need to remove them.

Answer

Create a log sink to export logs to Cloud Storage, then delete the sink and the exported objects

Answer

Delete the entire BigQuery dataset containing the logs

Answer

Use Cloud DLP to redact personally identifiable information from the logs

Question 17

A company is using Cloud SQL for MySQL to store customer data subject to SOX compliance. They need to ensure that all database changes are audited and that logs are immutable. They have enabled audit logs and exported them to a Cloud Storage bucket. However, the auditor discovers that some logs were deleted from the bucket. What is the most likely cause?

Accepted Answer

The Cloud Storage bucket has a lifecycle rule that deletes objects after a set number of days.. Cloud Storage lifecycle rules can automatically delete objects after a specified number of days. If a lifecycle rule is configured on the bucket, it would delete audit logs regardless of the export process, making them unavailable to the auditor. This is the most likely cause of logs being deleted from the bucket, as the other options do not explain actual deletion of already-exported objects.

Answer

The log sink filter is excluding certain events, causing incomplete export.

Answer

The bucket has retention policy enabled, which prevents deletion until the retention period expires.

Answer

The service account used for export does not have the storage.objects.delete permission.

Question 18

An organization needs to store cryptographic keys that must be protected in a FIPS 140-2 Level 3 validated hardware security module (HSM). Which Google Cloud service should they use?

Accepted Answer

Cloud HSM. Cloud HSM provides FIPS 140-2 Level 3 validated HSM for key material. Keys are generated and stored in the HSM.

Answer

Secret Manager

Answer

Cloud KMS with software-backed keys

Answer

Cloud External Key Manager

Question 19

A healthcare organization is migrating applications to Google Cloud and must comply with HIPAA. They plan to store protected health information (PHI) in Cloud Storage and BigQuery. The security engineer needs to ensure that all access to PHI is logged and that the data is encrypted at rest with customer-managed keys. The organization also requires that any audit logs containing PHI are stored in a separate project with restricted access. Which course of action meets all requirements?

Accepted Answer

Enable Data Access audit logs for Cloud Storage and BigQuery, create a sink to route logs to a BigQuery dataset in a separate project, and use CMEK in the data project.. It meets all requirements: Data Access audit logs capture every access to PHI, a sink routes those logs to a BigQuery dataset in a separate project (fulfilling the separate-project storage requirement), and CMEK (customer-managed encryption keys) ensures encryption at rest with keys controlled by the organization. This combination satisfies HIPAA logging, encryption, and restricted-access log storage mandates.

Answer

Enable Data Access audit logs for Cloud Storage and BigQuery, and store logs in the same project. Use CMEK for encryption.

Answer

Use VPC Service Controls to create a perimeter around the project, and enable CMEK for encryption.

Answer

Enable Admin Read audit logs for Cloud Storage and BigQuery, and store logs in a different project. Use CSEK for encryption.

Question 20

A company using Google Cloud wants to conduct a penetration test on their infrastructure. According to Google's acceptable use policy, what must they do before testing?

Accepted Answer

Ensure that the tests do not include Denial of Service (DoS) attacks. Google's policy allows penetration testing on most services without prior approval, as long as the tests are not Denial of Service (DoS) attacks. This applies to common GCP services like Compute Engine, GKE, and Cloud Functions.

Answer

Create a separate VPC network for testing

Answer

Submit a request to Google support for each test

Answer

Enable VPC Flow Logs for monitoring