PCSE Practice Exam 51 — 20 Questions

Question 1

A security engineer needs to ensure that data stored in Cloud Storage is encrypted with a customer-supplied encryption key (CSEK) that is never stored in Google Cloud. They want to use the JSON API to upload objects. Which of the following is required to use CSEK with the JSON API?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Provide the encryption key in the request using the x-goog-encryption-algorithm header set to AES256 and include the key in the x-goog-encryption-key header, base64-encoded, along with its SHA256 hash in x-goog-encryption-key-sha256.. CSEK with the JSON API requires the client to send the encryption algorithm, the base64-encoded key, and the key's SHA256 hash in specific HTTP headers. These headers are x-goog-encryption-algorithm, x-goog-encryption-key, and x-goog-encryption-key-sha256. The key is never stored in Google Cloud; it is used only in memory during the request. This satisfies the requirement that the key is customer-supplied and not persisted by Google.

Answer

Use the gcloud storage cp command with the --encryption-key flag, which automatically generates the necessary headers for the JSON API.

Answer

Provide the encryption key in the request body as a JSON field named encryptionKey, and set the Content-Type header to application/json.

Answer

Enable CSEK on the bucket by setting the default encryption key to a customer-supplied key using the gcloud storage buckets update command with the --default-encryption-key flag.

Question 2

An organization uses Google Cloud and wants to enforce that all access to BigQuery datasets must be approved by a manager. The security team wants to implement a just-in-time (JIT) access solution that grants temporary permissions. They also want to log all access attempts. Which combination of Google Cloud services should they use?

Accepted Answer

Privileged Access Manager (PAM) for just-in-time access with approval workflows, and Cloud Audit Logs for logging.. Privileged Access Manager (PAM) provides just-in-time access with approval workflows, allowing managers to approve temporary elevation. Cloud Audit Logs capture all access attempts and approvals. This integrated solution meets the requirements for manager-approved JIT access and comprehensive logging.

Answer

Cloud IAM Conditions with a custom role that expires, and Cloud Audit Logs.

Answer

Organization Policy constraints to restrict BigQuery access, and Cloud Logging sinks to export logs.

Answer

Cloud Identity-Aware Proxy (IAP) with context-aware access, and VPC Service Controls.

Question 3

An organization uses Cloud Identity to manage users and groups. They want to enforce that only users from their corporate domain (example.com) can be granted IAM roles on GCP resources. Which organization policy constraint should they use?

Accepted Answer

constraints/iam.allowedPolicyMemberDomains. The organization policy constraint constraints/iam.allowedPolicyMemberDomains restricts which identity domains can be granted IAM roles on resources in the organization. By setting it to allow only example.com, any attempt to bind an IAM role to a user or group outside that domain is denied. This directly enforces the requirement that only corporate-domain identities receive GCP permissions.

Answer

constraints/iam.disableServiceAccountKeyCreation

Answer

constraints/compute.restrictCloudArmorPolicies

Answer

constraints/iam.workloadIdentityPoolProviders

Question 4

A security engineer needs to ensure that data stored in a Cloud SQL for MySQL instance is encrypted at rest with a key that the company can rotate and disable independently of Google. What should they do?

Accepted Answer

Enable CMEK for the Cloud SQL instance by specifying a Cloud KMS key.. CMEK with Cloud KMS allows the company to manage the encryption key for Cloud SQL, including rotation and disabling, independently of Google. Google-managed keys do not offer this control. Application-level encryption does not control at-rest encryption of the database. Cloud EKM is not the standard method for Cloud SQL.

Answer

Use Cloud External Key Manager (Cloud EKM) to store keys outside Google Cloud.

Answer

Use Cloud SQL's built-in encryption with Google-managed keys.

Answer

Encrypt the data at the application level before inserting it into Cloud SQL.

Question 5

A company's security team wants to inspect all egress traffic from their Google Cloud VPC to the internet for malware and data exfiltration. They need to ensure that traffic from a specific subnet is first inspected by a third-party firewall appliance deployed on a Compute Engine instance before it reaches the internet. The solution must be centrally managed and support high availability. What should they configure?

Accepted Answer

Configure a custom static route with the appliance's internal IP as the next hop for the default route, and create a firewall rule to allow traffic to the appliance.. To force egress traffic through a third-party firewall appliance, you must use a custom static route with the appliance's internal IP as the next hop. This ensures all traffic destined for the internet is sent to the appliance first. A firewall rule is also needed to allow traffic to reach the appliance. This approach provides centralized inspection and can be made highly available by using an internal load balancer as the next hop.

Answer

Use Cloud NAT with a custom NAT configuration to redirect traffic to the appliance.

Answer

Create a VPC firewall rule that redirects traffic to the appliance using a next-hop IP address.

Answer

Enable VPC Flow Logs and configure an alerting policy to trigger the appliance when malicious traffic is detected.

Question 6

A healthcare analytics company stores patient records in Cloud Storage buckets and BigQuery datasets. Compliance requires that all data be encrypted with customer-managed encryption keys (CMEK) that the company controls, and that key usage be auditable. The security team wants to ensure that any new object or table created without a CMEK is automatically encrypted with a default CMEK. What should they do?

Accepted Answer

Set a default Cloud KMS key for each bucket and dataset by configuring the default encryption key in the bucket's properties and the dataset's default encryption configuration.. Setting a default Cloud KMS key on a Cloud Storage bucket and on a BigQuery dataset ensures that any new object or table is automatically encrypted with that CMEK. This meets the requirement for customer-managed keys and provides auditability through Cloud KMS audit logs. Other options either enforce policies without setting a default key, rotate keys without applying them, or require per-request key management.

Answer

Use Customer-Supplied Encryption Keys (CSEK) by providing the same AES-256 key in every upload request and BigQuery load job.

Answer

Create a Cloud KMS key ring in the same region as the data and enable automatic rotation every 90 days; new resources will automatically use this key.

Answer

Configure a Cloud KMS key as the default encryption key at the project level using the organization policy constraint constraints/gcp.restrictNonCmekServices.

Question 7

A company uses Cloud DLP to inspect a Cloud Storage bucket containing JSON files for sensitive data. They want to redact all email addresses and phone numbers found in the files, replacing them with the string '[REDACTED]', and then write the de-identified files to a new bucket. Which Cloud DLP configuration should they use?

Accepted Answer

Use a de-identify template with a replace transform for each infoType, and run a DLP job with a Cloud Storage source and destination.. A de-identify template with replace transforms allows specifying a replacement string for each infoType, and a DLP job can process Cloud Storage files and output to a new bucket. Inspect templates only detect, and other transforms like tokenization or bucketing produce different outputs that do not meet the requirement.

Answer

Use an inspect template to find the infoTypes, then manually redact the files using a script.

Answer

Use a de-identify template with a bucketing transform for each infoType.

Answer

Use a de-identify template with a crypto-based tokenization transform for each infoType.

Question 8

Your organization runs a production Google Kubernetes Engine (GKE) cluster. A security analyst reports that the PodSecurityPolicy `restricted` is not being enforced, allowing pods to run as root. You need to determine which GKE cluster configuration is responsible. Which of the following should you check first?

Accepted Answer

Whether the GKE cluster has `--enable-pod-security-policy` set to true.. PodSecurityPolicy enforcement in GKE is controlled by the `--enable-pod-security-policy` flag at cluster creation. If this flag is not set, the PodSecurityPolicy admission controller is disabled, and policies such as `restricted` are not enforced. Therefore, checking this flag is the correct first step to diagnose the issue.

Answer

Whether the cluster has `--enable-binary-authorization` set to true.

Answer

Whether the cluster has `--enable-network-policy` set to true.

Answer

Whether the cluster's nodes are using Container-Optimized OS (COS).

Question 9

A security engineer needs to ensure that data stored in Cloud Storage is encrypted with a customer-supplied encryption key (CSEK) that is never stored in Google Cloud. They want to use the JSON API to upload objects. Which of the following is required to use CSEK with the JSON API?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VPC Flow Logs on the subnets.. VPC Flow Logs provide detailed records of network flows within a subnet, including source and destination IPs, ports, and protocol. Enabling them on both subnets ensures all traffic between them is logged. Other options like Cloud Audit Logs, Firewall Rules Logging, and Packet Mirroring do not provide comprehensive subnet-level traffic logging for auditing.

Answer

Cloud Audit Logs for the VPC network.

Answer

Firewall Rules Logging on the applicable firewall rules.

Answer

Packet Mirroring on the instances in both subnets.

Question 10

A company uses Google Cloud and wants to allow their data scientists to access BigQuery datasets only from corporate-owned devices. They use BeyondCorp Enterprise and have device posture information available. What should they configure to enforce this access control?

Accepted Answer

Configure an access level in Access Context Manager that requires device compliance, and apply it to a VPC Service Controls perimeter around the BigQuery project.. Access Context Manager access levels can include device posture attributes from BeyondCorp Enterprise, such as whether a device is compliant or encrypted. By creating an access level that requires device compliance and applying it to a VPC Service Controls perimeter around the BigQuery project, access is restricted to requests from compliant devices. This enforces the corporate-owned device requirement.

Answer

Create an IAM condition on the BigQuery dataset that checks for the device's compliance status using the device's certificate.

Answer

Use Identity-Aware Proxy (IAP) to protect BigQuery, and configure IAP to require device approval.

Answer

Set up a firewall rule in the VPC that allows traffic only from corporate IP ranges, and require data scientists to connect via VPN.

Question 11

A security engineer needs to allow SSH access to a Compute Engine instance from a specific on-premises IP range (203.0.113.0/24) only when the user's device is compliant with corporate policy. The company uses BeyondCorp Enterprise and has an Identity-Aware Proxy (IAP) setup. The engineer wants to enforce device compliance without exposing the instance to the internet. What should the engineer do?

Accepted Answer

Configure IAP TCP forwarding for SSH, and create a firewall rule allowing SSH from the IAP IP range 35.235.240.0/20. Then, set up an access level in BeyondCorp Enterprise requiring device compliance and apply it to the IAP-protected resource.. IAP TCP forwarding enables secure SSH access without public IPs. Firewall rules restrict traffic to IAP's IP range. BeyondCorp Enterprise access levels enforce context-aware policies, including device compliance. By applying an access level that requires device compliance and optionally restricts source IP to the on-premises range, the engineer ensures only compliant devices can connect via IAP.

Answer

Create a firewall rule allowing SSH from 203.0.113.0/24 and enable OS Login with two-factor authentication.

Answer

Use Cloud VPN to connect the on-premises network to the VPC, and create a firewall rule allowing SSH from 203.0.113.0/24. Then, enable VPC Service Controls to enforce device compliance.

Answer

Deploy a bastion host with a public IP, restrict SSH to the bastion's IP, and use Cloud Identity-Aware Proxy to authenticate users. Configure the bastion to check device compliance via a startup script.

Question 12

A cloud security engineer needs to grant a service account the ability to publish messages to a Cloud Pub/Sub topic. The service account is used by an application running on Compute Engine. Following the principle of least privilege, which IAM role should be granted?

Accepted Answer

roles/pubsub.publisher. The principle of least privilege requires granting only the permissions needed. For publishing to a Pub/Sub topic, roles/pubsub.publisher is the minimal predefined role that provides the required permission without extra privileges.

Answer

roles/pubsub.editor

Answer

roles/pubsub.subscriber

Answer

roles/pubsub.admin

Question 13

A security engineer needs to grant a service account the ability to read objects from a specific Cloud Storage bucket. The service account is used by a Compute Engine instance in the same project. The engineer wants to follow the principle of least privilege and avoid granting permissions to other buckets. What should the engineer do?

Accepted Answer

Grant the service account the roles/storage.objectViewer role on the specific bucket.. The principle of least privilege requires granting only the necessary permissions to the specific resource. roles/storage.objectViewer on the specific bucket provides read-only access to objects within that bucket only. Granting the role at the project level would allow access to all buckets, while roles/storage.admin grants excessive control. roles/storage.legacyBucketReader does not allow reading object data. The bucket-level objectViewer role is the correct choice.

Answer

Grant the service account the roles/storage.admin role on the specific bucket.

Answer

Grant the service account the roles/storage.legacyBucketReader role on the project.

Answer

Grant the service account the roles/storage.objectViewer role on the project.

Question 14

A multinational corporation must comply with the EU General Data Protection Regulation (GDPR) and ensure that personal data of EU residents is not transferred outside the EU. They are using BigQuery for analytics and want to enforce that all datasets containing personal data are created only in EU regions. Which Google Cloud feature should they use to meet this requirement?

Accepted Answer

Organization Policy constraints with the 'constraints/gcp.resourceLocations' constraint set to EU regions.. The organization policy constraint 'constraints/gcp.resourceLocations' is designed to restrict resource creation to specific locations. By applying it at the organization or folder level and setting allowed locations to EU regions, you ensure that any attempt to create a BigQuery dataset outside those regions is denied. This provides a preventive control that enforces data residency for GDPR compliance.

Answer

BigQuery data location settings at the dataset level, configured manually by data engineers.

Answer

Cloud DLP with a job trigger that scans BigQuery datasets and de-identifies data that leaves the EU.

Answer

VPC Service Controls with a perimeter that includes BigQuery and restricts data access to EU regions.

Question 15

A security engineer is configuring a Cloud KMS key ring for a new application that processes highly sensitive data. The application requires that cryptographic keys be protected by hardware security modules that meet FIPS 140-2 Level 3, and that the keys be automatically rotated every 90 days. The engineer wants to minimize operational overhead. What should they do?

Accepted Answer

Create a key with protection level HSM and set the rotation period to 90 days.. The scenario requires FIPS 140-2 Level 3 hardware protection and automatic 90-day rotation with minimal operational overhead. Cloud KMS keys with protection level HSM meet the hardware requirement, and setting the rotation period to 90 days enables automatic generation of new key versions, satisfying both needs without manual intervention.

Answer

Create a key with protection level HSM and manually rotate the key every 90 days using a script.

Answer

Create an external key with Cloud EKM and rely on the external key manager for rotation.

Answer

Create a software key with protection level SOFTWARE and set the rotation period to 90 days.

Question 16

A security engineer needs to ensure that data stored in Cloud Storage is encrypted with a customer-supplied encryption key (CSEK) that is never stored in Google Cloud. They want to use the JSON API to upload objects. Which of the following is required to use CSEK with the JSON API?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom route with the appliance as the next hop for 0.0.0.0/0, remove external IPs from the VMs, and configure the appliance to forward permitted traffic, using Private Google Access for the Google API bypass.. Steering egress through an appliance requires the VMs to route outbound traffic via a next-hop appliance, which works reliably only when external IPs are removed so the default route is used. Pointing the 0.0.0.0/0 route at the appliance sends traffic through it for inspection, while Private Google Access provides the intended bypass for Google APIs without exposing the VMs to the internet.

Answer

Deploy a Cloud NAT gateway and configure the appliance to receive mirrored traffic from the NAT gateway.

Answer

Enable VPC Flow Logs on all subnets and create log-based alerts for egress to unknown destinations.

Answer

Configure a VPC firewall rule that redirects egress traffic to the appliance using target service accounts.

Question 17

Your security team must ensure that a Cloud Storage bucket containing regulated customer data is encrypted with a customer-managed encryption key (CMEK) stored in Cloud KMS, and that the key is automatically rotated every 90 days. You have created a key ring and a symmetric key in Cloud KMS. Which configuration step is required to meet the automatic rotation requirement?

Accepted Answer

Set the rotation schedule on the Cloud KMS key to 90 days.. Cloud KMS symmetric keys support a configurable rotation schedule. Setting the rotation period to 90 days ensures Cloud KMS automatically creates a new primary key version every 90 days, satisfying the automatic rotation requirement. The bucket's CMEK reference remains the same key resource, and new data is encrypted with the latest version. No custom scheduling or manual key provisioning is needed.

Answer

Use a customer-supplied encryption key (CSEK) and rotate it manually every 90 days.

Answer

Enable automatic rotation on the Cloud Storage bucket's default encryption key.

Answer

Create a Cloud Scheduler job that calls the Cloud KMS API to rotate the key every 90 days.

Question 18

A company uses Shared VPC. The host project contains a subnet with secondary IP ranges for GKE pods and services. A security engineer must ensure that pods in the service project can only reach a specific on-premises CIDR through a Cloud VPN tunnel, and that all other egress is blocked. What should they do?

Accepted Answer

Create a VPC firewall egress rule in the host project that allows traffic from the pod secondary range to the on-premises CIDR, and a lower-priority deny-all egress rule.. Firewall rules in a Shared VPC must be created in the host project, and they can use the pod secondary range as a source. By allowing only the on-premises CIDR and adding a lower-priority deny-all egress rule, you restrict pod egress as required. Service projects cannot manage these rules, and Cloud Router or VPC Service Controls do not provide the needed egress filtering.

Answer

Configure a Cloud Router custom route advertisement that only advertises the on-premises CIDR to the pods, and rely on the default deny egress rule.

Answer

Use VPC Service Controls to create a perimeter around the GKE cluster and add an access level for the on-premises CIDR.

Answer

Create a VPC firewall egress rule in each service project that allows traffic from the pod secondary range to the on-premises CIDR, and a deny-all egress rule.

Question 19

A security engineer must ensure that all egress traffic from a Compute Engine instance is inspected by a third-party firewall appliance before reaching the internet, and that the instance cannot bypass the appliance. The instance and appliance are in the same VPC. What should they configure?

Accepted Answer

Create a custom static route with the appliance as the next hop for 0.0.0.0/0, and remove or lower the priority of the default internet gateway route.. Forcing egress through a third-party appliance requires a custom static route for 0.0.0.0/0 with the appliance as the next hop, and ensuring the default internet gateway route is not used. This prevents bypass because the VPC route table determines the path. Firewall rules and Private Google Access do not redirect traffic, and changing the instance default gateway is ineffective.

Answer

Enable Private Google Access on the subnet and configure the appliance as a proxy for all egress.

Answer

Set the instance's default gateway to the appliance's IP address and disable the instance's external IP.

Answer

Use a VPC firewall rule to redirect traffic to the appliance using a target service account.

Question 20

A security engineer is designing an access control strategy for a Google Cloud organization that uses Cloud Identity. The organization wants to ensure that only users who are members of a specific Google Group can access a sensitive project. The engineer plans to use IAM policies and groups. Which two steps should the engineer take to meet this requirement? (Choose two.)

Accepted Answer

Create a Google Group and add the authorized users as members.. To restrict access to a specific Google Group, you create the group and add authorized users as members. Then you grant the group an appropriate IAM role on the project. This ensures that only group members have access, and access is automatically managed through group membership. Using least privilege, choose a predefined role that matches the necessary permissions.

Answer

Set an organization policy to allow access only from the group's email domain.

Answer

Grant the Google Group the roles/owner role on the sensitive project.

Answer

Use IAM Conditions to grant access only if the user is in the Google Group.