PCSE Practice Exam 53 — 20 Questions

Question 1

A company wants to provide private connectivity from its VPC to Google APIs (e.g., Cloud Storage, BigQuery) without using public IPs or NAT. The solution must also support on-premises connectivity via Cloud VPN. Which service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Private Service Connect. Private Service Connect enables private connectivity to Google APIs via internal IPs. It supports both VPC and on-premises (via Cloud VPN or Interconnect) access to Google APIs without traversing the internet.

Answer

Private Google Access

Answer

Cloud NAT

Answer

Cloud VPN

Question 2

A company uses Cloud KMS with automatic rotation enabled for a symmetric key. The rotation period is set to 90 days. After 90 days, a new key version is created. The compliance team asks: what happens to data encrypted with the old key version?

Accepted Answer

The old key version remains available for decryption of existing data.. When a key is rotated, a new version is created. Data encrypted with the old version can still be decrypted because the old version remains available for decryption. The key material is not destroyed unless manually deleted. Automatic rotation does not re-encrypt existing data.

Answer

The old key version is immediately disabled, and all data must be re-encrypted.

Answer

Data encrypted with the old key is automatically re-encrypted with the new key.

Answer

The old key version is deleted after the rotation period.

Question 3

An engineer needs to schedule automatic rotation of a symmetric key in Cloud KMS every 30 days. The key is currently enabled. What should they do?

Accepted Answer

Set the rotation period on the key via 'gcloud kms keys update'. Cloud KMS supports automatic rotation by setting a rotation period on the key. The key must have purpose ENCRYPT_DECRYPT (symmetric). The rotation period can be set in seconds (e.g., 2592000 for 30 days). Manual rotation is also possible but not automatic.

Answer

Automatic rotation is not supported for symmetric keys

Answer

Set a rotation period via 'gcloud kms keyrings create'

Answer

Manually create a new key version every 30 days using 'gcloud kms keys versions create'

Question 4

A company using Cloud KMS wants to automatically rotate a symmetric encryption key every 90 days. What is the correct way to configure this?

Accepted Answer

Set the rotation period on the cryptographic key to 90 days. Cloud KMS supports automatic rotation by setting a rotation period on the key. The key's primary version will be rotated automatically at the specified interval.

Answer

Set the key purpose to ASYMMETRIC_SIGN for automatic rotation

Answer

Set the rotation period to 90 days when creating the key ring

Answer

Use Cloud Scheduler to call `cloudkms.rotateKey` every 90 days

Question 5

What is the purpose of Cloud HSM?

Accepted Answer

To provide FIPS 140-2 Level 3 validated hardware security for key material. Cloud HSM is a managed hardware security module (HSM) service that provides FIPS 140-2 Level 3 validated security for cryptographic keys. It allows you to generate, store, and manage keys in a tamper-resistant hardware device.

Answer

To manage secrets such as API keys and passwords

Answer

To automatically rotate encryption keys

Answer

To encrypt data at rest using Google-managed keys

Question 6

A company wants to use Cloud KMS to encrypt data in Cloud Storage with a key that is automatically rotated every 30 days. They also want to ensure that the key material is stored in a HSM. Which TWO resources must they create? (Choose two.)

Accepted Answer

A Cloud HSM key ring. To use CMEK with Cloud HSM, the engineer needs to create a Cloud HSM key ring (which is a resource that groups keys) and a cryptographic key with protection level HSM. The key ring is created first, then the key is created within it. The other options: a key ring with software protection level would not use HSM; a Cloud KMS key is created within a key ring, so both are needed.

Answer

A key with purpose EXTERNAL

Answer

A key ring with protection level software

Answer

A Cloud HSM cluster

Question 7

A security team wants to automatically rotate a database password stored in Secret Manager every 60 days and notify the operations team when a new version is created. Which approach should they use?

Accepted Answer

Set a rotation period on the secret and configure a Pub/Sub topic for notifications; use a Cloud Function to generate new password. Secret Manager supports automatic rotation with a Pub/Sub topic. You can set a rotation period (e.g., 60 days) and a Pub/Sub topic for notifications. A Cloud Function can listen to the topic and update the password. Secret Manager can also call a user-provided Cloud Function to generate the new secret version.

Answer

Use Cloud Scheduler to call Secret Manager API to add a new version

Answer

Use Cloud KMS key rotation to rotate the secret

Answer

Manually update the secret every 60 days

Question 8

A company is using Cloud Armor with adaptive protection enabled. They notice that adaptive protection has generated a rule that is blocking some legitimate traffic. What should they do to minimize false positives while still benefiting from adaptive protection?

Accepted Answer

Add a higher-priority allow rule for the legitimate traffic. Adaptive protection works by learning traffic patterns and generating rules. The best practice is to initially set the adaptive protection rule to 'throttle' or 'log' mode (or use a low priority) to monitor its impact. Alternatively, you can override the rule with a higher-priority allow rule for known good traffic. The recommended approach is to use the rule in preview or monitoring mode before enforcing.

Answer

Disable adaptive protection immediately

Answer

Increase the sensitivity threshold of adaptive protection

Answer

Change the adaptive protection rule action to 'throttle'

Question 9

A security engineer wants to export all Cloud Audit Logs from a Google Cloud project to a BigQuery dataset for long-term analysis. Which type of log sink should be configured?

Accepted Answer

Create a project-level aggregated sink with destination set to BigQuery dataset. A project-level aggregated sink collects logs from all resources within the project. BigQuery is the appropriate destination for analysis. The sink must include all log types, but Admin Activity logs are enabled by default and cannot be disabled.

Answer

Create a folder-level sink and assign it to the project

Answer

Create an organization-level sink with includeChildren set to true

Answer

Create a sink for each log type individually

Question 10

A security team needs to detect anomalous outbound traffic from Compute Engine instances. They want to enable logging and analyze the data. Which three steps should they take? (Choose three.)

Accepted Answer

Enable VPC Flow Logs on the subnets where the instances are located.. To detect anomalous outbound traffic, you need to enable VPC Flow Logs (which log outbound traffic), export them to BigQuery for analysis (using a log sink), and query the data. Cloud NAT is for outbound connectivity with NAT, but not logging. Packet Mirroring copies traffic but is not necessary for flow logs. Firewall Rules logging logs firewall hits, not all outbound traffic.

Answer

Enable Cloud NAT logging to capture outbound traffic.

Answer

Enable Packet Mirroring to duplicate all outbound packets.

Question 11

A security team is designing an incident response workflow for container threats detected by Security Command Center Premium. They want to automatically capture forensic evidence from compromised GKE nodes. Which THREE steps should they include? (Choose THREE.)

Accepted Answer

Export the container image from Artifact Registry for analysis.. When a container threat is detected, the team should capture evidence by taking snapshots of persistent disks, collecting pod logs from the node, and exporting container logs. Deleting the cluster or creating a new node pool would destroy evidence.

Answer

Immediately drain and delete all pods on the node.

Answer

Delete the compromised node pool to prevent further damage.

Question 12

A DevOps team is implementing Binary Authorization for a GKE cluster. They want to ensure that only container images signed by a specific attestor can be deployed. They have created the attestor and configured Cloud KMS for signing. Which additional step is required to enforce the policy?

Accepted Answer

Create a Binary Authorization policy that requires at least one attestation and attach it to the GKE cluster.. Binary Authorization requires a policy to enforce attestation. The policy must be set to 'Require Attestations' and attached to the GKE cluster (via a policy binding). Creating the attestor alone is insufficient. The policy can be set at project level.

Answer

Enable the 'gke-binary-authorization' feature flag on the cluster and update the kubeconfig.

Answer

Create a policy that allows all images and then override it with an admission webhook.

Answer

Configure the container registry to block unsigned images by setting a repository-level policy.

Question 13

A security engineer is designing data protection for Cloud Storage. Which TWO methods can be used to enforce encryption at rest for objects? (Choose TWO.)

Accepted Answer

Setting a bucket-level default encryption with a CMEK key.. Setting a bucket-level default encryption with a CMEK (Customer-Managed Encryption Key) ensures that all new objects written to the bucket are encrypted at rest using a key managed by the customer in Cloud KMS. This enforces encryption at rest at the bucket level, meeting the requirement.

Answer

Enabling VPC Service Controls.

Answer

Applying a retention policy.

Answer

Using a bucket policy that requires the x-goog-encryption header for uploads.

Question 14

A financial institution must store audit logs for 7 years to comply with PCI DSS requirements. By default, Cloud Audit Logs are retained for 30 days. What is the most cost-effective way to retain audit logs for 7 years?

Accepted Answer

Configure a log sink to export logs to Cloud Storage with a retention policy set to 7 years using Object Lifecycle Management.. To retain audit logs beyond Cloud Logging's 365-day max, export to Cloud Storage using a log sink and use Object Lifecycle Management to set a retention policy.

Answer

Use Assured Workloads to automatically extend audit log retention to 7 years.

Answer

Create a log bucket with a retention period of 7 years using Log Analytics.

Answer

Increase the retention period for Cloud Audit Logs in the Logs Router to 7 years.

Question 15

A company is required to perform penetration testing on their Google Cloud infrastructure. According to Google Cloud's policy, which statement is true regarding penetration testing?

Accepted Answer

No prior approval is needed for testing most services, but denial-of-service (DoS) attacks are not permitted.. Google Cloud's Acceptable Use Policy permits penetration testing on most services without prior approval, but DoS attacks are forbidden.

Answer

Customers must use Google's own penetration testing tools, such as Web Security Scanner.

Answer

Prior approval from Google is required for all penetration testing activities.

Answer

Penetration testing is prohibited on Google Cloud unless it is conducted by a certified third party.

Question 16

A company is designing a PCI DSS-compliant environment on Google Cloud. They need to isolate the cardholder data environment (CDE) and log all access to it. Which THREE actions should they take? (Choose 3)

Accepted Answer

Place all CDE resources in a dedicated VPC.. Network segmentation (dedicated VPC), data exfiltration prevention (VPC Service Controls), and logging (Data Access audit logs) are key PCI DSS requirements for the CDE.

Answer

Use Cloud Load Balancing with SSL policies to enforce TLS 1.3.

Answer

Deploy Cloud Armor WAF to protect web applications in the CDE.

Question 17

A financial services company must comply with PCI DSS requirements for encryption key management. They want to use Google-managed keys with automatic rotation. Which key management solution should they choose?

Accepted Answer

Cloud KMS with CMEK (Customer-Managed Encryption Keys). (Cloud KMS with CMEK) is correct because it allows the company to use Google-managed keys with automatic rotation while retaining control over the key material. CMEK keys are created and managed in Cloud KMS, but the actual cryptographic operations are performed by Google's key management infrastructure, and automatic rotation can be configured (e.g., every 90 days) to meet PCI DSS rotation requirements. This provides a balance between compliance control and operational simplicity.

Answer

Customer-supplied encryption keys (CSEK)

Answer

Google-managed encryption keys (default)

Answer

Cloud HSM

Question 18

A financial services company uses Cloud Storage to store sensitive customer data. They want to encrypt this data at rest using customer-managed encryption keys (CMEK) and automate key rotation every 90 days. Which approach should they take?

Accepted Answer

Create a Cloud KMS key ring and a key with rotation period 90 days. Use the key as CMEK for the Cloud Storage bucket.. Cloud KMS allows you to create a key ring and a key with a defined rotation period of 90 days, which can then be used as a customer-managed encryption key (CMEK) for a Cloud Storage bucket. This satisfies the requirement for customer-controlled key management and automated rotation without custom code.

Answer

Rely on Google-managed encryption keys (default Cloud Storage encryption) and enable key rotation logs for auditing.

Answer

Configure Cloud External Key Manager (EKM) to manage the encryption key externally and have Cloud Storage use it via CMEK integration.

Answer

Use customer-supplied encryption keys (CSEK) and implement a custom Cloud Function to rotate keys every 90 days.

Question 19

A company needs to ensure that all data stored in Cloud Storage is encrypted using a key that is rotated every 30 days. Which encryption option should they choose to meet this requirement with automated rotation?

Accepted Answer

Customer-Managed Encryption Key (CMEK) using Cloud KMS. Customer-Managed Encryption Keys (CMEK) with Cloud KMS allow you to control and rotate encryption keys on a schedule. Cloud KMS supports automatic key rotation with a configurable rotation period (e.g., every 30 days), meeting the requirement without manual intervention.

Answer

Cloud External Key Manager (EKM)

Answer

Google-managed encryption keys

Answer

Customer-Supplied Encryption Key (CSEK)

Question 20

A company uses Shared VPC with host project and service projects. They want to ensure that only specific service projects can create firewall rules in the host project's network. What is the correct IAM configuration?

Accepted Answer

Grant the Compute Security Admin role to the service project's service accounts in the host project.. In a Shared VPC setup, the host project owns the network, and service projects connect to it. To allow a service project to create firewall rules in the host project's network, you must grant the Compute Security Admin role (which includes compute.firewalls.create) to the service project's service accounts at the host project level. This grants the necessary permissions on the host project's resources without giving broader network administration rights.

Answer

Grant the Compute Security Admin role to the service project's compute service account in the service project.

Answer

Grant the Compute Network Admin role to the service project's service accounts in the host project.

Answer

Create a custom role with compute.firewalls.create and grant it to the host project's compute service account.