PCSE Practice Exam 54 — 20 Questions

Question 1

A financial services company must store customer transaction records for 7 years to comply with SEC regulations. They currently use Cloud Storage with a lifecycle rule that deletes objects after 365 days. The compliance team needs to ensure that records are immutable and cannot be deleted or modified before the retention period expires. What should the security engineer do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Bucket Lock on the bucket and configure a retention policy of 7 years.. Bucket Lock is the only Google Cloud Storage feature that enforces immutability by preventing object deletion or modification for a specified retention period. By enabling Bucket Lock and configuring a 7-year retention policy, the company ensures compliance with SEC regulations, as objects cannot be deleted or overwritten even by the bucket owner or lifecycle rules. This overrides the existing 365-day lifecycle rule because retention policies take precedence over lifecycle deletion actions.

Answer

Apply a retention policy to each object individually using object holds.

Answer

Use VPC Service Controls to restrict access to the bucket to only authorized compliance personnel.

Answer

Modify the lifecycle rule to delete objects after 2555 days instead of 365 days.

Question 2

Which three actions help protect Cloud KMS key material? (Choose three.)

Accepted Answer

Use VPC Service Controls to restrict access to the key.. B is correct because VPC Service Controls create a security perimeter around Cloud KMS resources, preventing data exfiltration by restricting access to the key material from unauthorized networks or projects. This helps protect the key material even if an attacker gains credentials to the key, as the request must originate from within the allowed VPC scope.

Answer

Store the key in an HSM cluster.

Answer

Assign the Cloud KMS Admin role to all developers.

Question 3

A company processes personal data of European Union residents on GCP. They need to ensure that data processing is limited to specific purposes and that data subjects can exercise their rights (access, rectification, erasure). Which actions should they take to comply with GDPR?

Accepted Answer

Sign a DPA with Google, implement data subject request workflows, and use Cloud DLP to classify personal data.. To comply with GDPR, the company must sign a Data Processing Agreement (DPA) with Google, implement data subject rights (like deletion), and document processing purposes. Encryption is encouraged but not a specific GDPR requirement listed in the options.

Answer

Use Assured Workloads with EU Regions and Support and enable Access Transparency.

Answer

Enable data encryption with CMEK and sign a DPA with Google.

Answer

Enable VPC Service Controls and restrict data access to EU regions.

Question 4

Which TWO of the following are valid methods for sending traffic between VPC networks in Google Cloud? (Choose two.)

Accepted Answer

Cloud VPN (HA VPN gateway). Cloud VPN (HA VPN gateway) is a valid method for sending traffic between VPC networks because it creates an encrypted tunnel over the public internet using IPsec (IKEv2) to connect two VPCs or an on-premises network to a VPC. It supports dynamic routing via BGP, allowing traffic to flow between VPCs when each VPC has a VPN gateway and the appropriate tunnel configurations.

Answer

Firewall rules in each VPC

Answer

Subnet routes

Answer

Cloud NAT

Question 5

You have a Compute Engine VM that hosts a custom application. The VM has a tag 'app-server' and is in a VPC network with the following firewall rules (priority order from lowest to highest):

Rule 1: Priority 1000, direction INGRESS, source 0.0.0.0/0, target tag 'app-server', protocol tcp:80, action allow
Rule 2: Priority 500, direction INGRESS, source 10.0.0.0/8, target tag 'app-server', protocol tcp:80, action deny
Rule 3: Priority 2000, direction INGRESS, source 192.168.0.0/16, target tag 'app-server', protocol tcp:80, action allow

A user from IP 10.0.0.5 tries to access the application on port 80. Will the request be allowed or denied?

Accepted Answer

Denied, because Rule 2 has a lower priority number and explicitly denies traffic from 10.0.0.0/8. Rule 2 has a priority of 500, which is lower (higher priority) than Rule 1 (priority 1000) and Rule 3 (priority 2000). Since the source IP 10.0.0.5 falls within the 10.0.0.0/8 range, Rule 2 matches first and explicitly denies the traffic. In Google Cloud VPC firewall rules, lower priority numbers are evaluated first, and the first matching rule determines the action.

Answer

Denied, because Rule 3 has a higher priority number and denies traffic from 192.168.0.0/16

Answer

Allowed, because Rule 1 has a lower priority number and allows all traffic

Answer

Allowed, because Rule 3 has a higher priority number and allows traffic from 192.168.0.0/16

Question 6

A company uses Cloud Audit Logs for compliance and needs to ensure that logs are not tampered with. Which feature should they enable?

Accepted Answer

Use Cloud Key Management Service to sign audit logs.. Cloud Key Management Service (Cloud KMS) can be used to sign audit logs, providing a cryptographic integrity check that ensures logs have not been tampered with. Signed logs allow verification of their authenticity and detect any unauthorized changes. Option A is wrong because default retention in Cloud Logging does not prevent tampering; it only sets how long logs are kept. Option B is wrong because Access Transparency logs record actions by Google personnel, but they do not directly prevent tampering of Cloud Audit Logs. Option D is wrong because sending logs to multiple destinations increases redundancy but does not protect against tampering.

Answer

Store logs in Cloud Logging with default retention.

Answer

Enable Access Transparency logs for the project.

Answer

Set up multiple log sinks to different destinations.

Question 7

A company uses VPC Service Controls to protect data in BigQuery and Cloud Storage. They need to allow a third-party application running outside the service perimeter to query BigQuery datasets within the perimeter. What should they configure?

Accepted Answer

Grant the third-party project access to the perimeter via an access level.. VPC Service Controls use access levels to define which client identities, IP addresses, or device characteristics are allowed to access protected resources from outside the service perimeter. By configuring an access level that includes the third-party application's project or IP range, the company can grant explicit, policy-based access to BigQuery datasets without removing the perimeter's data exfiltration protections.

Answer

Use private Google Access with a VPC network to allow the third-party.

Answer

Create a service perimeter bridge between the third-party project and the protected project.

Answer

Set up a VPC peering connection between the third-party VPC and the VPC hosting the resources.

Question 8

A company has a Google Cloud organization with several hundred projects. They are using VPC Service Controls to protect sensitive data in BigQuery. They have a service perimeter that includes the projects containing the sensitive datasets. Users in a separate perimeter (perimeter B) need to query a BigQuery dataset in the sensitive perimeter using federated queries from Cloud SQL. The users are authenticated via Cloud Identity and have appropriate IAM roles, but queries are failing. The Cloud SQL instance is in perimeter B. What is the most likely cause?

Accepted Answer

The sensitive perimeter does not have an ingress rule to allow requests from the Cloud SQL service in perimeter B.. VPC Service Controls enforce perimeters that block all data access across perimeter boundaries by default. For a Cloud SQL instance in perimeter B to query BigQuery in the sensitive perimeter via federated queries, the sensitive perimeter must have an ingress rule explicitly allowing requests from the Cloud SQL service (or the VPC network) in perimeter B. Without this ingress rule, the request is denied at the perimeter boundary, regardless of IAM permissions.

Answer

The Cloud SQL instance must be moved into the sensitive perimeter to access BigQuery.

Answer

The users do not have the appropriate IAM role on the BigQuery dataset.

Answer

The BigQuery dataset does not have a corresponding table for export to Cloud SQL.

Question 9

A company connects their on-premises data center to Google Cloud via Dedicated Interconnect. They have two VLAN attachments (VLAN-A and VLAN-B) to a single VPC. They use BGP over the VLAN attachments with Cloud Router. Both VLAN attachments are in the same region. They want to use both links for active-active traffic and have redundancy. Which BGP configuration is correct?

Accepted Answer

Use the same BGP ASN and same MED for both VLAN attachments, and enable ECMP on Cloud Router.. For active-active traffic with two VLAN attachments to the same VPC in the same region, you must use the same BGP ASN on both sessions and enable ECMP (Equal Cost Multi-Path) on Cloud Router. This allows Cloud Router to install multiple equal-cost routes from both BGP sessions, enabling load balancing across both links. Using the same MED value ensures the routes are considered equal, which is required for ECMP to function correctly.

Answer

Use a different BGP ASN for each VLAN attachment.

Answer

Use a single VLAN attachment and rely on link redundancy.

Answer

Set different MED values for each BGP session to load-balance.

Question 10

A company uses a shared VPC with multiple service projects. A security administrator created an organization policy with the constraint 'gcp.resourceLocations' to restrict Cloud SQL instance creation to only the 'us-central1' region. The policy is applied at the organization level. A Cloud SQL administrator is using a service account with the predefined role 'roles/cloudsql.admin' (also granted at the organization level) to create instances. Despite the organization policy, the service account successfully creates a Cloud SQL instance in the 'europe-west1' region. The administrator verifies that the organization policy is active and the constraint is enforced. What is the most likely reason the policy is not preventing the creation?

Accepted Answer

The organization policy is set to 'dry-run' mode, so it logs violations but does not deny the operation.. The organization policy constraint 'gcp.resourceLocations' can be set to 'dry-run' mode, which logs violations but does not deny the operation. In this scenario, the policy is active and enforced, but if it is in dry-run mode, it will not block the creation of Cloud SQL instances in non-compliant regions. The service account's successful creation in 'europe-west1' indicates that the policy is not actively denying the request, which aligns with dry-run behavior.

Answer

The organization policy is applied at the organization level, but the service account's permissions are also at the organization level, causing an override.

Answer

The service account has the 'Organization Policy Administrator' role, which allows it to bypass constraints.

Answer

The gcp.resourceLocations constraint does not apply to Cloud SQL instances.

Question 11

Which Google Cloud service should be used for long-term archival of Audit Logs that must be immutable and stored for 10 years for compliance?

Accepted Answer

Cloud Storage with Archive storage class and retention policy. Cloud Storage with Archive storage class offers the lowest cost for long-term storage, and retention policies enforce immutability.

Answer

Cloud SQL with backups

Answer

BigQuery with time-based partitioning

Answer

Pub/Sub with message retention

Question 12

A company wants to enforce that all Cloud Storage buckets created in their organization have a retention policy for compliance. If a bucket is created without a retention policy, it should be automatically remediated. Which approach should they use?

Accepted Answer

Use an Organization Policy with a constraint to require a retention policy on all buckets and use Cloud Asset Inventory to enforce remediation.. Organization policies with a constraint can enforce that all buckets have a retention policy. However, if a bucket is created without one, Cloud Asset Inventory can detect the violation and trigger a Cloud Function to apply a default retention policy.

Answer

Use Cloud DLP to scan buckets and add retention policies automatically.

Answer

Use Security Command Center to find non-compliant buckets and manually apply retention policies.

Answer

Use Cloud Audit Logs to detect bucket creation and trigger a Cloud Function to set a retention policy.

Question 13

A Cloud Run service is failing to access a secret from Secret Manager. The service account used by Cloud Run has the roles/secretmanager.secretAccessor role. What is the most likely cause of the error?

Accepted Answer

The service account does not have access to the 'latest' version of the secret; it needs explicit version access.. D is correct because Secret Manager requires explicit access to a specific secret version. The `roles/secretmanager.secretAccessor` role grants access to all versions of a secret, but the Cloud Run service must reference a specific version (e.g., 'latest' or a version number) in its configuration. If the service is configured to access the 'latest' version without the `secretmanager.versions.access` permission on that version, access will fail. The error occurs because the service account lacks the necessary permission to access the 'latest' version, even though it has the role.

Answer

VPC Service Controls are blocking access to Secret Manager.

Answer

The service account does not have the iam.serviceAccounts.actAs permission on the Cloud Run service.

Answer

The secret does not exist in the specified project.

Question 14

Which two Cloud Storage encryption options allow the customer to supply or manage the encryption keys? (Choose two.)

Accepted Answer

Customer-Supplied Encryption Keys (CSEK). Customer-Supplied Encryption Keys (CSEK) allow you to supply your own encryption keys for protecting data at rest in Cloud Storage. With CSEK, you provide the key material for each API call, and Google does not store the key on its servers. This option is correct because the customer directly supplies the encryption key.

Answer

Default encryption at rest

Answer

Google-managed encryption keys

Answer

Cloud HSM keys

Question 15

A government agency is migrating to Google Cloud and must comply with FedRAMP requirements. They need to ensure that only FedRAMP authorized Google Cloud services are used in their project. The security team has enabled Organization Policies and created a custom policy to restrict allowed services to a specific list. However, when a developer tries to create a Cloud SQL instance, the operation is denied. The developer receives an error: 'The organization policy constraint compute.restrictNonPdServices is not allowing this resource.' The developer is trying to create a Cloud SQL instance, which is a FedRAMP authorized service. What is the most likely cause of the denial?

Accepted Answer

The organization policy is misconfigured and does not include Cloud SQL in the allowed list.. The error message explicitly references the `compute.restrictNonPdServices` organization policy constraint, which is used to restrict the creation of non-Persistent Disk (PD) services. The developer's attempt to create a Cloud SQL instance is denied because the custom policy's allowed list does not include Cloud SQL, even though it is a FedRAMP authorized service. The policy must be updated to include Cloud SQL in the allowed services list for the operation to succeed.

Answer

Cloud SQL instances require a specific region that is not permitted by the policy.

Answer

The developer does not have the necessary IAM permissions to create Cloud SQL instances.

Answer

The organization policy is blocking all services not in a specific list, and Cloud SQL is not included because it is a data service rather than a compute service.

Question 16

A company handling credit card information must comply with PCI DSS. They use Cloud KMS with CMEK keys stored in a key ring. During a compliance audit, the auditor asks how keys are protected against unauthorized use by Google. What should the company explain?

Accepted Answer

They store keys in Cloud HSM, which ensures keys never leave the HSM and are bound to a specific project. Cloud HSM provides a FIPS 140-2 Level 3 validated hardware security module (HSM) where customer-managed encryption keys (CMEK) are generated and used exclusively within the HSM boundary. The keys never leave the HSM in plaintext, and access is bound to the specific Google Cloud project, ensuring that even Google administrators cannot extract or use the keys outside the authorized project context.

Answer

They use customer-supplied encryption keys (CSEK), so Google never has access to keys

Answer

They use Cloud KMS with CMEK, and the keys are encrypted using Google-managed key encryption keys (KEKs)

Answer

They enabled Access Approval, so Google must obtain approval before accessing keys

Question 17

A company wants to grant a support team member the ability to view the IAM policy of a project (who has which roles) without being able to modify it. What is the least privileged predefined role that provides this access?

Accepted Answer

roles/iam.securityReviewer. The roles/iam.securityReviewer role grants read-only access to IAM policies and permissions across the project, including the ability to view who has which roles, without allowing modifications. This is the least privileged predefined role that provides exactly this access, as it is scoped to security-related read operations only.

Answer

roles/viewer

Answer

roles/iam.securityAdmin

Answer

roles/iam.roleViewer

Question 18

A company uses Access Context Manager to restrict access to Cloud Resources based on device policy. They want to allow access only from devices that are company-managed and have disk encryption enabled. What should they configure?

Accepted Answer

Create an access level with device policy conditions for corporate-owned and disk encryption.. Access Context Manager allows you to create access levels that define device policy conditions, such as requiring devices to be corporate-owned and have disk encryption enabled. These access levels are then applied to the organization's access policies to restrict access to cloud resources based on the device's compliance status.

Answer

Create an IAM condition requiring a specific device tag.

Answer

Use Identity-Aware Proxy with device policy.

Answer

Use VPC Service Controls with a device restriction.

Question 19

An organization wants to use VPC Service Controls to protect BigQuery data. They need to allow a group of data analysts to access BigQuery from outside the perimeter (e.g., from their laptops) while maintaining the perimeter for all other users. Which TWO configurations are necessary?

Accepted Answer

Define an access level that includes the analysts' identities or IPs. To allow specific users to access a service from outside the perimeter, you must create an access level that identifies those users (e.g., by IP range or device) and then create an ingress rule that permits traffic from that access level to BigQuery. The access level can be based on user identity (e.g., via BeyondCorp) or IP ranges.

Answer

Create an egress rule in the service perimeter that allows the analysts to leave the perimeter

Answer

Assign the analysts the roles/bigquery.user role

Answer

Enable dry-run mode on the perimeter

Question 20

A financial services company runs a sensitive application on Google Kubernetes Engine (GKE) with Workload Identity enabled. Security policy requires that only pods with a specific service account can access a Cloud Storage bucket containing customer data. The bucket has uniform bucket-level access enabled. What is the correct combination of IAM bindings to achieve this?

Accepted Answer

Bind the Google service account (linked to the Kubernetes service account via Workload Identity) to the bucket IAM policy with roles/storage.objectViewer. Workload Identity links a Kubernetes service account (KSA) to a Google service account (GSA). When a pod uses that KSA, it authenticates as the linked GSA. Since the bucket has uniform bucket-level access, IAM permissions must be granted directly on the bucket resource, not at the project level. Binding the GSA to the bucket with roles/storage.objectViewer ensures only pods using that specific KSA can read the bucket.

Answer

Add the Google service account as a member of the bucket with roles/storage.objectViewer

Answer

Grant the Google service account roles/storage.objectViewer at the project level

Answer

Bind the Kubernetes service account to the bucket IAM policy with roles/storage.objectViewer