PCSE Practice Exam 55 — 20 Questions

Question 1

Refer to the exhibit. A security engineer needs to ensure that all objects uploaded to the bucket are automatically encrypted with the specified KMS key. They also need to preserve older versions of objects. Which statement accurately describes the bucket configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The bucket has default KMS encryption and versioning is enabled.. The question requires both automatic encryption of all uploaded objects using a specified KMS key and preservation of older object versions. Default KMS encryption ensures that any object uploaded without explicit encryption headers is automatically encrypted with the configured KMS key, while enabling versioning allows the bucket to retain noncurrent object versions. Together, these settings meet both requirements.

Answer

The bucket has default KMS encryption but versioning is disabled.

Answer

The bucket uses CSEK and versioning is enabled.

Answer

The bucket uses Google-managed encryption and versioning is disabled.

Question 2

Which Google Cloud service is specifically designed to help customers meet compliance requirements by creating a folder with pre-defined organization policies, resource location restrictions, and access controls?

Accepted Answer

Assured Workloads. Assured Workloads automates the creation of a compliant environment with pre-configured controls.

Answer

VPC Service Controls

Answer

Cloud HSM

Answer

Security Command Center

Question 3

A DevOps team wants to enforce that only container images signed by a specific authority can be deployed in a GKE cluster. They plan to use Binary Authorization. Which configuration is required?

Accepted Answer

Create an attestor, generate a key pair with Cloud KMS, and configure the policy to require at least one attestation from that attestor. Binary Authorization enforces deployment policies. To require signed images, you create an attestor (e.g., using Cloud KMS) and a policy that requires at least one attestation from that attestor. The policy type must be 'Require attestations' (not 'Allow all' or 'Deny all').

Answer

Create an attestor and set the policy to 'Deny all' and then add exceptions for signed images

Answer

Create an attestor and set the policy to 'Allow all' so that signed images are allowed

Answer

Create a vulnerability scan policy in Artifact Registry to block unsigned images

Question 4

A financial services company wants to ensure that Google Cloud staff cannot access their encryption keys or the plaintext data. They must meet regulatory requirements for data sovereignty. Which combination of services should they use?

Accepted Answer

Use Cloud External Key Manager and enable Access Transparency logs.. Cloud External Key Manager (EKM) allows you to manage encryption keys using a supported external key management partner, ensuring that Google Cloud staff cannot access your keys or plaintext data. Enabling Access Transparency logs provides you with logs of Google Cloud staff access to your data, which helps meet regulatory requirements for data sovereignty by giving you visibility into administrative actions.

Answer

Use CMEK with Cloud HSM and disable Access Transparency.

Answer

Use Customer-Supplied Encryption Keys (CSEK) without Access Transparency.

Answer

Use VPC Service Controls and Cloud DLP.

Question 5

A company has set up a VPC Service Controls perimeter that includes Cloud Storage. They want to allow a specific on-premises server to copy data to a Cloud Storage bucket inside the perimeter. The on-premises server uses an external IP address. Which configuration is required?

Accepted Answer

Create an ingress rule in the service perimeter that allows the on-premises IP range. In VPC Service Controls, ingress rules allow traffic from outside the perimeter to access resources inside. To allow an on-premises server with an external IP, an ingress rule from all identities (or the specific identity) using the source IP range of the on-premises server must be configured. This allows the server to cross the perimeter.

Answer

Configure a firewall rule allowing traffic from the on-premises IP to Cloud Storage

Answer

Add the on-premises server's IP to the access level of the perimeter

Answer

Create an egress rule in the service perimeter that allows the on-premises IP range

Question 6

Refer to the exhibit. A security administrator is troubleshooting why a user cannot access a BigQuery dataset. The user analyst@example.com is not a member of data-team@example.com. The user is trying to query a table in the dataset. What is the most likely reason for the denial?

Accepted Answer

The user has the role roles/bigquery.dataViewer, which does not allow querying tables; it only allows viewing dataset metadata.. The role roles/bigquery.dataViewer only grants permission to view dataset metadata (e.g., table names, schema) but does not include the bigquery.tables.getData permission required to actually query table rows. Since the user is not a member of data-team@example.com and has only this role, any query attempt will be denied with an access denied error.

Answer

The user needs to be added as a dataOwner to query tables.

Answer

The dataset policy includes a condition that the user does not satisfy.

Answer

The table itself might have additional restrictions such as row-level security.

Question 7

A company is designing a network architecture for a multi-region application. They want to minimize latency and maximize availability. Which two features should they consider? (Choose two.)

Accepted Answer

Cloud CDN. Cloud CDN (Option B) caches content at Google's globally distributed edge points of presence (PoPs), reducing latency by serving users from the nearest cache instead of the origin. The Global Cloud Load Balancer (Option D) provides a single anycast IP address that routes traffic to the closest healthy backend across multiple regions, maximizing availability through automatic failover and global traffic distribution.

Answer

Cloud NAT

Answer

Cloud Interconnect

Answer

VPC Network Peering

Question 8

A security engineer needs to ensure that all data stored in Cloud Storage buckets and BigQuery tables is encrypted at rest using keys that the organization generates and manages on-premises. The keys must not be stored by Google. Which key management approach should they use?

Accepted Answer

Customer-Supplied Encryption Keys (CSEK). Customer-Supplied Encryption Keys (CSEK) allow customers to provide their own encryption keys with each API call. Google never stores these keys, ensuring the customer retains full control. GMEK and CMEK involve Google storing the keys, and Cloud HSM is a managed service that stores keys, so none meet the 'not stored by Google' requirement.

Answer

Cloud HSM with Customer-Managed Keys

Answer

Customer-Managed Encryption Keys (CMEK) via Cloud KMS

Answer

Google default encryption (GMEK)

Question 9

A company has deployed a web application on Compute Engine instances in a managed instance group behind an internal HTTP(S) load balancer. The application needs to be accessible only from the corporate office, which has a static public IP range of 203.0.113.0/24. The load balancer is in us-central1. What is the most secure way to restrict access?

Accepted Answer

Configure a Cloud VPN tunnel between on-premises and VPC, then create a firewall rule allowing the corporate IP range to the internal load balancer's backend instances.. An internal HTTP(S) load balancer has a private IP address that is only reachable from within the same VPC or via Cloud VPN / Cloud Interconnect. To allow access from a corporate office with a static public IP range, you must establish a Cloud VPN tunnel to extend the VPC network to the on-premises network, then create a firewall rule that permits traffic from the corporate IP range to the internal load balancer's backend instances. This ensures traffic traverses an encrypted tunnel and is subject to VPC firewall controls, providing the most secure and architecturally correct solution.

Answer

Create a VPC firewall rule that allows traffic from 203.0.113.0/24 to the load balancer's forwarding rule IP.

Answer

Assign a public IP to the internal load balancer and restrict access using Google Cloud Armor.

Answer

Use Google Cloud Armor with IP allowlisting on the internal load balancer.

Question 10

An engineer needs to destroy a Cloud KMS key immediately due to a security incident. They disable the key and then schedule destruction. What is the default waiting period before the key is permanently destroyed?

Accepted Answer

24 hours. In Cloud KMS, when you schedule destruction of a key version, there is a default pending destruction grace period of 24 hours. During this time, you can cancel destruction. The key is not immediately destroyed.

Answer

Immediate destruction

Answer

7 days

Answer

30 days

Question 11

Which two best practices for managing secrets in Secret Manager? (Choose two.)

Accepted Answer

Enable automatic replication to multiple regions for high availability.. Secret Manager supports automatic replication across regions, ensuring that secret data remains available even during a regional outage. This is a key best practice for high availability and disaster recovery, as it allows applications to read secrets from the nearest or alternate region without manual intervention.

Answer

Use the Secret Manager API to list all secrets for any user.

Answer

Set a short TTL for secret versions and delete them immediately.

Answer

Store secrets in multiple ConfigMaps for redundancy.

Question 12

A company needs to archive their VPC Flow Logs for 10 years for compliance. They also need to run occasional queries on the logs. What is the most cost-effective approach?

Accepted Answer

Create a log sink to export VPC Flow Logs to Cloud Storage with a retention policy of 10 years and use BigQuery external tables for occasional queries.. Exporting logs to Cloud Storage with a retention policy is the most cost-effective for long-term archival. BigQuery is more expensive for storage but allows queries. Using a log sink with _Default log view includes VPC Flow Logs (if enabled).

Answer

Export VPC Flow Logs to both Cloud Storage and BigQuery simultaneously.

Answer

Create a log sink to export VPC Flow Logs to BigQuery and set a table partition expiration to 10 years.

Answer

Enable VPC Flow Logs and set the log bucket retention to 10 years.

Question 13

A healthcare organization stores Protected Health Information (PHI) in Cloud Storage. They need to de-identify data before sharing it with researchers. Which service should they use?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud Data Loss Prevention (DLP) is the correct service because it is specifically designed to inspect, classify, and de-identify sensitive data such as Protected Health Information (PHI). It uses built-in infoTypes (e.g., US_INDIVIDUAL_HEALTHCARE_NPI) and de-identification techniques like masking, tokenization, and redaction to transform PHI into a de-identified dataset before sharing with researchers, ensuring compliance with HIPAA.

Answer

Cloud Key Management Service (KMS)

Answer

VPC Service Controls

Answer

Cloud IAM

Question 14

A company wants to restrict access to Cloud Storage buckets so that only resources in a specific VPC network can reach them, and data cannot be exfiltrated to other networks. Which Google Cloud service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls allows creating service perimeters that protect Google Cloud services (including Cloud Storage) by restricting access from outside the perimeter. Resources inside the perimeter can access the protected services, but data cannot be exfiltrated to external networks.

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud Armor

Answer

VPC Firewall Rules

Question 15

A security engineer needs to view logs of Google Cloud support engineers accessing their data to meet compliance requirements. Which GCP feature should they enable?

Accepted Answer

Access Transparency. Access Transparency provides near-real-time logs of Google admin access to customer content. It is available for certain services like Compute Engine, Cloud Storage, BigQuery, etc. Audit Logs record actions performed by users in the customer's project, not Google staff. Access Approval is a separate feature that allows customers to approve or deny access requests. VPC Flow Logs record network traffic, not admin access.

Answer

Access Approval

Answer

Audit Logs

Answer

VPC Flow Logs

Question 16

A company uses Cloud SQL for PostgreSQL with CMEK. They need to ensure that the Cloud SQL instance can only be accessed by authorized compute resources that have the correct IAM permissions to decrypt the data. What additional configuration is required to enforce access control?

Accepted Answer

Set up a service account with Cloud KMS CryptoKey Encrypter/Decrypter and attach it to authorized VMs.. Cloud SQL with CMEK requires that any compute resource accessing the instance must have the Cloud KMS CryptoKey Encrypter/Decrypter IAM role on the key. By attaching a service account with this role to authorized VMs, you ensure that only those VMs can decrypt the data at rest, enforcing access control at the IAM level. This directly ties the decryption permission to the compute resource's identity, not just network-level access.

Answer

Enable mutual TLS for all connections to the Cloud SQL instance.

Answer

Use VPC Service Controls to restrict access to the Cloud SQL instance and the key.

Answer

Configure Cloud SQL to use Cloud Armor to whitelist IP addresses.

Question 17

A company stores sensitive customer data in Cloud Storage. They want to ensure that data is encrypted at rest using customer-managed encryption keys (CMEK) and that access to the key is audited. Which approach should they use?

Accepted Answer

Use CMEK with a Cloud KMS key and enable Cloud Audit Logs for the key.. It combines customer-managed encryption keys (CMEK) via Cloud KMS with Cloud Audit Logs enabled on the key itself. This ensures the data is encrypted at rest using a key that the customer controls and rotates, and all operations against that key (e.g., encrypt, decrypt, enable, disable) are logged for auditing. Cloud Audit Logs on the bucket alone would not capture key access events, which is required for full auditability.

Answer

Use Google-managed encryption keys and enable Cloud Audit Logs for the bucket.

Answer

Use CMEK with key material stored in a Cloud Storage bucket.

Answer

Use customer-supplied encryption keys (CSEK) and store the keys in Secret Manager.

Question 18

A financial services company must ensure that all data in Cloud Storage remains within a specific region and that no data can be accessed from outside the corporate network. They also need to allow a partner organization to access a specific bucket. Which THREE Google Cloud services or features should be combined to meet these requirements? (Choose THREE.)

Accepted Answer

Private Service Connect. VPC Service Controls restricts data access to authorized VPCs/environments. Access levels can enforce IP-based restrictions (corporate network). Private Service Connect can allow the partner to access the bucket privately via PSC endpoints without traversing the internet.

Answer

Cloud IDS

Answer

Cloud Armor security policies

Question 19

A company uses Cloud Storage buckets to store customer uploads. Recently, a customer reported that a file they uploaded yesterday is missing. The bucket has object versioning enabled. The security team wants to investigate how the file went missing and whether any other files have been affected. The company's compliance requirements mandate that all object deletions must be logged and reviewed. What should the admin do first to investigate the missing file?

Accepted Answer

Check Cloud Logging for storage.googleapis.com/object_delete events.. Checking Cloud Logging for storage.googleapis.com/object_delete events is the most direct way to determine if the file was deleted and by whom. Option A is incorrect because access logs in the Storage bucket's logs section may not be enabled and do not specifically show delete events. Option B is incorrect because listing versions only shows existing versions but does not reveal who deleted the object. Option C is incorrect because Object Lifecycle Management automates deletion policies but does not assist in investigating past deletions.

Answer

Check the access logs in the Storage bucket's logs section.

Answer

Use gsutil ls -a to list all versions of objects in the bucket.

Answer

Enable Object Lifecycle Management to restore deleted objects.

Question 20

Your organization has a VPC with several subnets and wants to enable Private Google Access for Compute Engine instances in a specific subnet to access Google APIs and services without external IP addresses. What must be configured?

Accepted Answer

Enable Private Google Access on the subnet and ensure that instances have a default route (0.0.0.0/0) with next hop to the default internet gateway.. Private Google Access requires two components: enabling it on the subnet and having a default route (0.0.0.0/0) pointing to the internet gateway. This route allows instances without external IPs to use the VPC's default internet gateway to reach Google APIs via the 199.36.153.4/30 address range, which is advertised by Google's private IP space. Without the default route, traffic from the subnet cannot reach the internet gateway, even with Private Google Access enabled.

Answer

Assign external IPs to the instances and create a firewall rule allowing egress to Google APIs.

Answer

Create a Cloud NAT gateway and enable Private Google Access on the subnet.

Answer

Enable Private Google Access on the subnet only.