PCSE Practice Exam 51 — 20 Questions

Question 1

An engineer needs to allow HTTP traffic from instances tagged 'web-server' to instances tagged 'app-server' on port 8080 within the same VPC. Which firewall rule should be created?

Accepted Answer

Ingress rule for 'app-server' with source tag 'web-server' allowing tcp:8080. Create an ingress rule targeting 'app-server' that allows tcp:8080 from source tag 'web-server'. Tags are used for both source and target to control traffic between instance groups.

Answer

Egress rule from 'web-server' to 'app-server' allowing tcp:8080

Answer

Ingress rule for 'web-server' with source tag 'app-server' allowing tcp:8080

Answer

Egress rule for 'app-server' with destination tag 'web-server' allowing tcp:8080

Question 2

An engineer needs to allow a specific service account from another project to access a Cloud Storage bucket in the current project. The engineer wants to use the principle of least privilege. Which IAM role should be granted directly on the bucket to the service account?

Accepted Answer

roles/storage.objectViewer on the bucket. Grant the predefined role `roles/storage.objectViewer` to the service account. This role provides read-only access to objects in the bucket.

Answer

roles/storage.legacyBucketReader on the bucket

Answer

roles/storage.objectAdmin on the bucket

Answer

roles/storage.admin on the project

Question 3

An organization has a hierarchical firewall policy at the organization level that denies all ingress traffic from the internet. A project team needs to allow HTTP traffic from the internet to a specific VM. How should they achieve this?

Accepted Answer

Create a project-level hierarchical firewall policy with a rule allowing HTTP from 0.0.0.0/0 and a lower priority number than the org-level deny. Hierarchical firewall policies cannot be overridden at lower levels; they are always evaluated first. Since the org-level policy denies all internet ingress, the only way to allow HTTP is to create a hierarchical policy at a lower level (folder or project) that allows it, but those are also part of the hierarchy and are evaluated after org-level. Actually, hierarchical policies can be overridden by a lower-level policy with a higher priority, but the org-level policy has no higher priority? In GCP, hierarchical firewall policies are evaluated in order of precedence: organization > folder > project. A policy at a lower level can override a higher-level policy if it has a higher priority (lower number) and is an allow rule. So the project team can create a project-level hierarchical policy with a higher priority (e.g., 100) allowing HTTP from 0.0.0.0/0, which will override the org-level deny (priority 1000).

Answer

Add a VPC firewall rule allowing HTTP from 0.0.0.0/0

Answer

Remove the VM from the organization hierarchy

Answer

Use Cloud Armor to allow the traffic

Question 4

A company wants to enforce that all VPC firewall rules in an organization must be centrally managed and cannot be overridden by lower-level projects. Which approach should they use?

Accepted Answer

Use a hierarchical firewall policy at the organization node. Hierarchical firewall policies are applied at the organization, folder, or project level and are inherited downward. They can be set to have higher priority than network firewall rules, and lower-level rules cannot override them if the policy is set accordingly.

Answer

Create network firewall rules at the organization level

Answer

Configure VPC Service Controls with a perimeter

Answer

Enable Organizational Policy constraints

Question 5

A company's security policy requires that all traffic to a Google Cloud load balancer use TLS 1.2 or higher and only accept strong ciphers. They want to enforce this using a Google Cloud resource. Which resource should they configure?

Accepted Answer

SSL policy. SSL policies on HTTPS load balancers allow you to specify the minimum TLS version and cipher profile (e.g., RESTRICTED for strong ciphers). This enforces encryption requirements at the load balancer level.

Answer

Cloud Armor security policy

Answer

Network firewall rule

Answer

SSL certificate

Question 6

You are designing a VPC Service Controls perimeter to protect a project containing BigQuery datasets accessible from a data analytics VPC. You need to allow a specific set of on-premises users (identified by IP range 203.0.113.0/24) to query BigQuery from outside the perimeter, but block all other external access. What is the correct configuration?

Accepted Answer

Create a service perimeter with restricted services, create an access level with IP condition 203.0.113.0/24, and add an ingress rule that allows access from the access level to all identities. VPC Service Controls uses access levels for IP-based restrictions. To allow external access from a specific IP range, you create an access level that includes that IP range, then define an ingress rule in the service perimeter that grants access to that access level. Dry-run mode is for testing, not production enforcement.

Answer

Remove the on-premises IP range from the project's allowed external IPs list in the VPC Service Controls configuration

Answer

Create a service perimeter in dry-run mode, then configure a firewall rule in the on-premises VPC to allow egress to BigQuery

Answer

Create a service perimeter with restricted services including BigQuery. Add an ingress rule that allows access from the identity group containing the on-premises users, with source IP range 203.0.113.0/24 in the access level

Question 7

A security engineer needs to allow HTTP (port 80) traffic from all VMs in the production environment to a specific set of VMs running a web server. The web server VMs are identified by a service account 'web-sa@...'. Which firewall rule configuration should the engineer create?

Accepted Answer

Ingress rule: source = 0.0.0.0/0, targetServiceAccounts = ['web-sa@...'], allow tcp:80. Using a service account as the target (serviceAccount = web-sa@...) is the recommended approach for security, as it is more dynamic and less error-prone than using network tags. The rule allows ingress traffic from any source (0.0.0.0/0) on TCP port 80 to VMs with that service account.

Answer

Egress rule: destination = 0.0.0.0/0, targetServiceAccounts = ['web-sa@...'], allow tcp:80

Answer

Ingress rule: source = 0.0.0.0/0, targetTags = ['web-server'], deny tcp:80

Answer

Ingress rule: source = 0.0.0.0/0, targetTags = ['web-server'], allow tcp:80

Question 8

You manage a Google Cloud environment using shared VPC with multiple service projects. You need to enforce consistent firewall rules across all projects in the organization, ensuring that certain security rules cannot be overridden by project administrators. Which TWO steps should you take? (Choose 2)

Accepted Answer

Attach the hierarchical firewall policy to the organization node or to the folder containing all projects. Hierarchical firewall policies are inherited down the resource hierarchy and cannot be overridden by lower-level policies. Global network firewall policies can be applied at the VPC level but can be overridden by lower priority rules. The correct approach is to use a hierarchical firewall policy at the organization level, which enforces rules that cannot be overridden.

Answer

Create a global network firewall policy and attach it to each service project's VPC

Answer

Use VPC Service Controls to enforce firewall rules across projects

Answer

Attach the hierarchical firewall policy to the shared VPC host project

Question 9

A company is using Cloud Run for a containerized application. They notice increased latency during peak hours. The operations team wants to identify the root cause. Which two steps should they take?

Accepted Answer

Enable Cloud Logging and use Logs Explorer to query request latency for each endpoint.. Cloud Logging with Logs Explorer allows the operations team to query and analyze request latency per endpoint, which is essential for identifying which specific endpoints contribute to increased latency during peak hours. This granular visibility into request-level performance helps pinpoint the root cause of latency issues in a Cloud Run service.

Answer

Implement Cloud Armor security policies to protect against DDoS attacks.

Answer

Set up a Cloud Monitoring dashboard to visualize CPU utilization for the Cloud Run service.

Answer

Enable VPC Flow Logs to analyze network traffic to and from the Cloud Run service.

Question 10

Refer to the exhibit. A security engineer sees this configuration for a Cloud Storage bucket. What does this indicate about the encryption of objects in this bucket?

Accepted Answer

Objects are encrypted with a customer-managed key (CMEK) from Cloud KMS.. The exhibit shows `kmsKeyName` set to a Cloud KMS key resource name (e.g., `projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY_NAME`). This indicates the bucket is configured with a customer-managed encryption key (CMEK) from Cloud Key Management Service (Cloud KMS), meaning Google uses the specified key to encrypt/decrypt objects, and the customer controls key rotation and access via IAM.

Answer

Objects are encrypted with Google-managed keys, and the key name is the default.

Answer

Objects are encrypted with a customer-supplied key (CSEK).

Answer

Objects are encrypted with an external key from an on-premises HSM.

Question 11

A company uses Cloud Identity-Aware Proxy (IAP) to secure access to an internal web application hosted on Compute Engine. After a recent security audit, the team wants to ensure that only users with specific attributes can access the app, such as belonging to the 'engineering' group and having a verified corporate email. What is the best approach to enforce this requirement?

Accepted Answer

Configure IAP with access levels that require the user to be in the 'engineering' group and have a verified email.. Cloud IAP integrates with Identity-Aware Proxy access levels, which allow you to enforce attribute-based access control (ABAC) using Google Cloud's context-aware access features. By configuring an access level that requires the user to belong to the 'engineering' group (via Cloud Identity or G Suite group membership) and have a verified corporate email (e.g., using the `email_verified` attribute from the identity provider), you can precisely restrict access to the Compute Engine web application without modifying the application code.

Answer

Use VPC Service Controls to restrict access based on user attributes.

Answer

Disable OAuth and use a custom JWT with group membership claims.

Answer

Set up an HTTP load balancer with a custom header that passes group membership from the identity provider.

Question 12

Your organization wants to monitor and audit IAM permission changes in real time. Which type of Cloud Audit Log is enabled by default and cannot be disabled?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs record API calls and administrative actions that modify the configuration or metadata of resources. They are enabled by default and cannot be disabled, making them ideal for monitoring IAM permission changes.

Answer

Data Access audit logs

Answer

System Event audit logs

Answer

Policy Denied audit logs

Question 13

Match each security command center tier to its capabilities.

Accepted Answer

Standard tier: Basic security scanning and recommendations. Security Command Center has two main tiers: Standard and Premium. Standard provides basic security health and recommendations, while Premium adds advanced threat detection, event-based findings, and more. Common mistakes include swapping the feature sets.

Answer

Standard tier: Advanced threat detection and event-based findings

Answer

Premium tier: Basic security scanning and recommendations

Question 14

A large enterprise runs analytics workloads on BigQuery containing sensitive financial data. They have implemented VPC Service Controls (VPC SC) to create a perimeter around the BigQuery dataset, allowing access only from a specific VPC network. Despite this, security auditors discovered that data was accessed from an IP address outside the perimeter. After investigation, they found the access originated from a user's personal laptop using the Google Cloud Console. The company's security policy requires that sensitive data can only be accessed from corporate-managed devices. What should they do to prevent this type of access?

Accepted Answer

Add a context-aware access level to the VPC Service perimeter that requires a corporate device policy (e.g., OS version, disk encryption).. VPC Service Controls can integrate with Access Context Manager to enforce context-aware access levels. By adding a level that requires a corporate device policy (e.g., verified OS version, disk encryption status), access from unmanaged personal laptops is blocked at the perimeter boundary, even if the user is authenticated. This directly addresses the security policy requirement that sensitive data must only be accessible from corporate-managed devices.

Answer

Enable Cloud Data Loss Prevention (DLP) to automatically redact sensitive data before it is displayed in the console.

Answer

Reconfigure the VPC Service perimeter to use a more restrictive set of allowed IP ranges.

Answer

Activate Access Transparency logs and create a log-based alert to notify security of anomalous access.

Question 15

A security engineer is configuring access for a new team member who needs to manage Cloud Storage buckets, but should not be able to delete or modify existing objects. Which IAM role should be assigned?

Accepted Answer

Storage Legacy Bucket Writer (roles/storage.legacyBucketWriter). The Storage Legacy Bucket Writer role (roles/storage.legacyBucketWriter) allows a user to list, create, and update buckets, but it does not grant permissions to delete or modify existing objects within those buckets. This role is specifically designed for managing bucket-level metadata while restricting object-level write and delete operations, making it the correct choice for the described requirement.

Answer

Storage Object Viewer (roles/storage.objectViewer)

Answer

Storage Admin (roles/storage.admin)

Answer

Storage Object Admin (roles/storage.objectAdmin)

Question 16

Match each access control mechanism to its description.

Accepted Answer

IAM: Defines who can do what on which resources.. IAM manages identities and permissions, VPC Service Controls prevent data exfiltration, and Organization Policies set configuration constraints. Distractors confuse these definitions with each other or with Access Context Manager.

Answer

IAM: Sets constraints on resource configurations.

Answer

VPC Service Controls: Defines access levels based on device attributes.

Question 17

Match each VPC firewall rule component to its definition.

Accepted Answer

Source IP: The IP addresses or CIDR blocks from which traffic originates.. VPC firewall rules consist of components like Source IP (traffic origin), Destination IP (traffic target), Action (allow/deny), and Priority (evaluation order). Common confusions include swapping Source and Destination, or confusing Action with Priority.

Answer

Source IP: The IP addresses to which traffic is directed.

Answer

Priority: Whether to allow or deny matching traffic.

Question 18

A security administrator needs to grant a team of developers the ability to deploy applications to a GKE cluster, but only to specific namespaces. The developers should not be able to modify cluster-level resources or IAM policies. Which three steps should the administrator take? (Choose THREE.)

Accepted Answer

Create a Kubernetes Role in the namespace with permissions to create and manage pods and services.. A Kubernetes Role defines permissions within a specific namespace, and granting permissions to create and manage pods and services aligns with the requirement to deploy applications without cluster-level access. This ensures developers can only interact with resources in the designated namespace, adhering to the principle of least privilege.

Answer

Create a ClusterRole and ClusterRoleBinding for the namespace.

Answer

Grant the developers the Kubernetes Engine Cluster Viewer role (roles/container.clusterViewer) at the project level.

Question 19

A company has a Google Group called team-a@example.com that contains all developers. The developers need to deploy Cloud Functions. What is the best practice to grant the necessary permissions?

Accepted Answer

Grant the group roles/cloudfunctions.developer on the project.. Granting the IAM role `roles/cloudfunctions.developer` to the Google Group at the project level follows the principle of least privilege and allows all members of the group to deploy Cloud Functions without granting excessive permissions. This approach centralizes permission management via the group, avoiding the need to manage individual user IAM bindings.

Answer

Add each developer's email to the IAM policy with roles/cloudfunctions.developer.

Answer

Grant the group roles/cloudfunctions.developer at the organization level.

Answer

Grant the group roles/cloudfunctions.admin on the project.

Question 20

A company runs a critical application on Compute Engine instances in a managed instance group (MIG) behind an external TCP/UDP Network Load Balancer. The security team requires that all traffic to the instances be inspected by a third-party next-generation firewall (NGFW) that is not yet deployed. Which architecture should the security engineer implement to meet the requirement with minimal disruption to traffic?

Accepted Answer

Deploy the NGFW as a Compute Engine instance in a separate instance group, and configure the load balancer to forward traffic to that instance group, which then forwards to the MIG.. It inserts the NGFW as a middlebox in the traffic path without changing the existing load balancer or instance group configuration. The external TCP/UDP Network Load Balancer forwards traffic to the NGFW instance group, which then inspects and forwards packets to the backend MIG. This preserves the original client IP via proxy protocol or encapsulation, meets the security requirement, and minimizes disruption by avoiding reconfiguration of the existing MIG or load balancer type.

Answer

Change the load balancer type to Internal TCP/UDP Load Balancer and route traffic through the NGFW.

Answer

Replace the Network Load Balancer with a proxy-based load balancer that can integrate with the NGFW via Traffic Director.

Answer

Use Cloud NAT and route all egress traffic through the NGFW.