PCSE Practice Exam 52 — 20 Questions

Question 1

An organization is configuring a Cloud Storage bucket for a regulated workload. The bucket configuration shown in the exhibit was applied. Which compliance requirement is this configuration primarily designed to address?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data retention and immutability.. The bucket configuration includes object versioning enabled and a retention policy with a retention period. This combination ensures that objects cannot be deleted or overwritten before the retention period expires, addressing data retention and immutability requirements. This is a common compliance need for regulated workloads where data must be preserved in its original state for a defined duration.

Answer

Encryption at rest using customer-managed encryption keys (CMEK).

Answer

Access transparency for data access.

Answer

Data residency within a specific geographic region.

Question 2

A company must implement a data retention policy that prevents any modification or deletion of stored log files for 5 years. Which Cloud Storage feature should they use?

Accepted Answer

Bucket locking with a retention policy. Bucket locking with a retention policy allows you to set a WORM (Write Once, Read Many) policy on a bucket, preventing object deletion or modification for a specified duration. This is the correct feature for implementing a 5-year data retention policy that prevents any modification or deletion. Object Retention Lock is an AWS S3 feature, not a GCP feature, so option D is incorrect.

Answer

Lifecycle management rules

Answer

Object versioning

Answer

Object Retention Lock

Question 3

A company needs to meet a regulatory requirement that cryptographic keys for data at rest in Google Cloud must be managed in an on-premises HSM and never leave the HSM. Google Cloud services should be able to use those keys for encryption/decryption. Which solution should they implement?

Accepted Answer

Use Cloud External Key Manager (EKM) to connect to the on-premises HSM.. Cloud External Key Manager (EKM) allows you to use keys managed in a supported external key management system, such as an on-premises HSM, for Google Cloud services. The keys are used by Google Cloud for encryption and decryption but never leave the external HSM, satisfying the regulatory requirement that keys must remain on-premises.

Answer

Use Cloud HSM to protect keys imported from on-premises HSM.

Answer

Use Cloud KMS with automatic key rotation and store key versions on-premises.

Answer

Use customer-supplied encryption keys (CSEK) for each service.

Question 4

A company uses Binary Authorization for their GKE clusters. They want to ensure that only images signed by their internal CI/CD system can be deployed. Which IAM role is required for the CI/CD service account to attach attestations?

Accepted Answer

roles/binaryauthorization.attestorsEditor. The `roles/binaryauthorization.attestorsEditor` IAM role grants the necessary permissions to create and manage attestations, including the `binaryauthorization.attestors.attest` permission required for a CI/CD service account to attach an attestation to a container image. Without this role, the service account cannot create a signed attestation that Binary Authorization will accept during admission control.

Answer

roles/binaryauthorization.attestorsViewer

Answer

roles/container.developer

Answer

roles/cloudkms.signerVerifier

Question 5

A company wants to use Google Cloud resources but does not have a Google Workspace or Cloud Identity account. They want to manage identities for their users without paying for additional licenses. What is the most cost-effective identity solution?

Accepted Answer

Use Cloud Identity Free edition.. Cloud Identity Free edition provides identity management for users who only need to access Google Cloud resources (Compute Engine, Cloud Storage, etc.) without Gmail, Google Drive, or other Google Workspace services. It is free. Cloud Identity Premium includes additional features like device management and security policies but costs money. Google Workspace is a paid suite of productivity apps. The Compute Engine default service account is not for user identities.

Answer

Use the Compute Engine default service account for all users.

Answer

Use Cloud Identity Premium edition.

Answer

Use Google Workspace.

Question 6

An organization has multiple GCP projects under a folder. They want to prevent all users from creating service account keys in any project under that folder. They also want to allow exceptions for a specific project where key creation is needed. Which approach should they take?

Accepted Answer

Apply the organization policy constraint 'constraints/iam.disableServiceAccountKeyCreation' at the folder level and set an exception for the specific project.. Organization policies can be set at the folder level with an enforce: true condition, and then an exception can be made for a specific project using a conditional policy or by setting a different policy on that project. IAM deny policies cannot disable the API for all users. Custom roles cannot disable key creation globally. Removing roles is impractical.

Answer

Create a custom role that excludes the permission to create keys and assign it to all users.

Answer

Remove the roles/iam.serviceAccountKeyAdmin role from all users.

Answer

Use an IAM deny policy on the folder to deny the permission to create service account keys.

Question 7

An organization has a deny policy that denies the compute.instances.create permission for all principals on a folder. A user is granted the Compute Admin role (which includes compute.instances.create) at the project level within that folder. Can the user create Compute Engine instances in that project?

Accepted Answer

No, because deny policies take precedence over allow policies.. Deny policies override allow policies regardless of hierarchy. If a deny policy denies the permission, it cannot be granted by any allow policy. The user will be denied even though they have the role.

Answer

No, because the user is not an organization administrator.

Answer

Yes, if the user also has the Owner role at the project level.

Answer

Yes, because the project-level IAM grant overrides the folder-level deny.

Question 8

A company wants to allow their on-premises Active Directory users to access Google Cloud resources using their existing credentials. They need to synchronize user accounts and groups to Google Cloud Directory and enable federated authentication. Which TWO services should they use?

Accepted Answer

Cloud Directory Sync (CDS). Cloud Directory Sync (CDS) synchronizes users and groups from Active Directory to Google Cloud Directory. SAML 2.0 federation with Google Workspace or Cloud Identity enables SSO using existing AD credentials.

Answer

Workload Identity Federation

Answer

Identity-Aware Proxy

Answer

OAuth 2.0 consent screen

Question 9

An administrator needs to restrict which external identities can be used to access Google Cloud resources. The organization uses SAML federation with an external identity provider. Which organization policy constraint should be used?

Accepted Answer

constraints/iam.allowedPolicyMemberDomains. The constrain constraints/iam.allowedPolicyMemberDomains restricts which domains can be granted IAM roles. By setting this to the domain of the external IdP, the administrator ensures only federated identities from that domain can be used.

Answer

constraints/iam.disableServiceAccountKeyCreation

Answer

constraints/compute.requireShieldedVm

Answer

constraints/iam.disableCrossProjectServiceAccountUsage

Question 10

A financial institution needs to comply with GDPR data subject rights. They must ensure that personal data in BigQuery can be anonymized for analytics while still allowing joins on pseudonymized identifiers. Which THREE services or features should they consider? (Choose 3)

Accepted Answer

Cloud Dataflow. Cloud DLP can be used to pseudonymize data (e.g., tokenize). BigQuery's SQL functions like `DLP_TOKENIZE` allow on-the-fly pseudonymization. Cloud Dataflow can be used to pre-process data. Cloud KMS encrypts but does not pseudonymize. Cloud Functions can be used but is less integrated. Cloud Storage is for storage, not processing.

Answer

Cloud Functions

Answer

Cloud KMS

Question 11

A developer wants to grant a Kubernetes service account in GKE the ability to read objects from a specific Cloud Storage bucket. Which two resources need to be bound together? (Choose two.)

Accepted Answer

The Kubernetes service account. The Kubernetes service account is the identity used by pods running in GKE to authenticate to Google Cloud APIs. Option D is correct because a GCP service account is the IAM identity that must be granted permissions on the Cloud Storage bucket via IAM policies. The two are bound together using workload identity federation, which allows the Kubernetes service account to impersonate the GCP service account.

Answer

The Cloud Storage bucket

Answer

The IAM policy for the bucket

Answer

The GKE cluster

Question 12

A web application behind an HTTPS load balancer is experiencing a high volume of malicious requests with SQL injection patterns. The security team wants to block these requests with minimal latency impact. Which Cloud Armor feature should they use?

Accepted Answer

Preconfigured WAF rules (OWASP ModSecurity CRS). Cloud Armor provides preconfigured WAF rules, including the OWASP ModSecurity Core Rule Set (CRS), which includes SQL injection detection rules. Enabling this set blocks SQL injection attempts.

Answer

Rate limiting per IP

Answer

Custom rules with CEL expressions

Answer

Adaptive Protection

Question 13

A security engineer needs to restrict access to Cloud Storage buckets so that only resources in a specific VPC can reach the Google APIs. Which Google Cloud service should be used?

Accepted Answer

VPC Service Controls. VPC Service Controls allows you to define a service perimeter that restricts access to Google Cloud APIs (like Cloud Storage) to only resources from authorized VPCs, preventing data exfiltration.

Answer

Firewall Rules

Answer

Identity-Aware Proxy

Answer

Cloud Armor

Question 14

Refer to the exhibit. A security engineer runs the following command to check encryption settings on a Cloud Storage bucket. What does the output indicate about encryption?

Accepted Answer

The bucket uses a customer-managed encryption key (CMEK).. The output shows `default_kms_key_name` is set to a Cloud KMS key resource name (e.g., `projects//locations//keyRings//cryptoKeys/`), which indicates the bucket uses a customer-managed encryption key (CMEK). CMEK allows you to control and manage the key via Cloud KMS, while Google manages the underlying encryption operations.

Answer

The bucket uses customer-supplied encryption keys (CSEK).

Answer

The bucket has no default encryption.

Answer

The bucket uses Google-managed encryption keys.

Question 15

An organization needs to restrict access to Cloud Storage buckets so that only requests from a specific range of IP addresses (e.g., corporate VPN) are allowed. They also want to block all other IPs. Which combination of services should they use?

Accepted Answer

VPC Service Controls with an IP-based access level. VPC Service Controls create a service perimeter that, combined with an access level based on IP addresses, can restrict access to Google Cloud services such as Cloud Storage to only those IPs. The access level defines the allowed IP ranges.

Answer

IAM conditions with source IP

Answer

Firewall rules with source IP

Answer

Cloud Armor with IP allow list

Question 16

Which feature of Cloud Armor uses machine learning to detect and block distributed denial-of-service (DDoS) attacks?

Accepted Answer

Adaptive Protection. Cloud Armor Adaptive Protection uses ML to model normal traffic and detect anomalous patterns indicative of DDoS attacks.

Answer

Security policies

Answer

Rate limiting

Answer

Preconfigured WAF rules

Question 17

A company wants to use Cloud Armor Managed Protection Plus to protect their HTTP(S) load balancer from DDoS attacks. They need to automatically block traffic from IP addresses that exhibit anomalous behavior based on machine learning. Which Cloud Armor feature should they enable?

Accepted Answer

Adaptive Protection. Adaptive Protection uses ML to detect anomalous traffic and suggests rules to block it. Managed Protection Plus includes adaptive protection.

Answer

Custom rules with CEL

Answer

Pre-configured WAF rules

Answer

Rate limiting

Question 18

A company wants internal VMs to access Google APIs (e.g., Cloud Storage, BigQuery) without traversing the internet. What is the simplest configuration?

Accepted Answer

Enable Private Google Access on the subnet where the VMs reside.. Private Google Access enables VMs with only internal IPs to reach Google APIs via the Google Cloud private network, without needing external IPs or internet access.

Answer

Assign external IPs to all VMs and use VPC firewall rules to restrict egress.

Answer

Use Cloud NAT to route traffic to Google APIs.

Answer

Set up Private Service Connect to googleapis.com.

Question 19

A security engineer wants to restrict access to a Cloud Storage bucket so that only requests originating from within a specific VPC network can access the bucket. Which Google Cloud service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls allow you to define a service perimeter that restricts access to Google Cloud services (including Cloud Storage) based on the originating VPC network and identity.

Answer

Identity-Aware Proxy (IAP)

Answer

Firewall rules

Answer

Cloud Armor

Question 20

A security engineer needs to configure firewall rules to allow traffic from a set of compute instances to a set of backend instances. The engineer wants to use a method that is more secure and scalable than using network tags. Which approach should they use?

Accepted Answer

Use firewall rules with source service accounts and target service accounts. Service accounts as firewall rule targets are preferred over network tags because they are immutable, tied to the identity of the instance, and reduce dependency on tag management. This approach is more secure and scalable.

Answer

Use hierarchical firewall policies

Answer

Use firewall rules with source tags and target tags

Answer

Use network firewall policies