PCSE Practice Exam 56 — 20 Questions

Question 1

What is the purpose of the Cloud DLP InfoType detector CREDIT_CARD_NUMBER?

Accepted Answer

It detects credit card numbers in data during inspection.. Cloud DLP InfoType detectors are used to identify specific types of sensitive data. CREDIT_CARD_NUMBER is a built-in detector that finds credit card numbers in text or files.

Answer

It encrypts credit card numbers automatically.

Answer

It redacts credit card numbers from images.

Answer

It de-identifies credit card numbers using masking.

Question 2

Refer to the exhibit. A security engineer reviews the IAM policy for a service account. What is the effect of the condition?

Accepted Answer

The user can only use the service account before December 31, 2025.. The condition in the IAM policy uses the `request.time` attribute with a date/time comparison operator, which is a supported variable in IAM conditions. The condition `StringEquals` with `request.time` and a specific date (e.g., `2025-12-31T23:59:59Z`) restricts access to only before that timestamp, effectively granting access only until December 31, 2025. This is a common pattern for time-based access control in cloud IAM policies.

Answer

The user can only use the service account when the request originates from a specific IP range.

Answer

The condition has no effect because request.time is not a supported variable in IAM conditions.

Answer

The user can only use the service account when the resource is in a specific region.

Question 3

A development team needs to grant a third-party auditor read-only access to a specific project's resources but must not allow the auditor to view any data stored in Cloud Storage buckets. Which IAM approach should be used?

Accepted Answer

Create a custom role that includes only the required read permissions except those for Cloud Storage.. Custom roles allow you to curate a specific set of permissions. You can create a role that includes read permissions for Compute Engine and Cloud SQL but excludes storage.objects.get on Cloud Storage. Predefined roles like Viewer include storage.objects.get, and basic roles are too broad. Condition-based access can be complex and error-prone.

Answer

Assign the predefined roles/viewer role and add a condition to deny access to Cloud Storage.

Answer

Use a deny policy to block access to storage.objects.get for the auditor.

Answer

Assign the basic roles/reader role to the auditor.

Question 4

A security team needs to apply a set of firewall rules that enforce baseline security for all VPC networks across multiple projects in an organization. These rules must be inherited and cannot be overridden by project-level rules. What should they use?

Accepted Answer

Hierarchical firewall policies. Hierarchical firewall policies can be applied at the organization or folder level and are inherited by all VPC networks in the hierarchy. They cannot be overridden by lower-level firewall rules, making them ideal for baseline security policies. Network firewall policies are applied to a specific VPC network. VPC firewall rules are per project and can be overridden.

Answer

VPC firewall rules

Answer

Network firewall policies

Answer

Cloud Armor security policies

Question 5

A company must comply with PCI DSS requirements that mandate the use of a hardware security module (HSM) for key storage. They plan to use Cloud KMS for key management. Which implementation meets compliance?

Accepted Answer

Create a Cloud HSM key ring and use Cloud KMS with protection level 'HSM'.. PCI DSS requires that cryptographic keys be stored in a hardware security module (HSM) to ensure tamper resistance. Cloud HSM provides a FIPS 140-2 Level 3 validated HSM directly integrated with Cloud KMS, allowing you to create keys with the 'HSM' protection level that are generated and stored within the HSM hardware, meeting compliance without managing external infrastructure.

Answer

Use Cloud External Key Manager (EKM) with an external HSM.

Answer

Use Customer-Supplied Encryption Keys (CSEK) stored in an on-premises HSM.

Answer

Create keys in Cloud KMS using the default software protection level.

Question 6

A company uses Cloud Armor Managed Protection Plus to protect their applications. They want to automatically block IP addresses that are identified as malicious by adaptive protection. How should they configure this?

Accepted Answer

Enable 'auto-deploy' in the adaptive protection configuration.. Cloud Armor adaptive protection uses machine learning to detect DDoS attacks. It can automatically create deny rules for malicious IPs if configured to do so. The setting is in the security policy's adaptive protection configuration.

Answer

Manually review adaptive protection alerts and create deny rules.

Answer

Use the 'rate limiting' rule to block high-traffic IPs.

Answer

Set up a Cloud Function to parse logs and create rules via API.

Question 7

An organization uses VPC Service Controls with a service perimeter that includes Cloud Storage and BigQuery. They need to allow a specific on-premises service account to write data to a Cloud Storage bucket inside the perimeter. The on-premises network connects via Cloud VPN. What must be configured in the perimeter?

Accepted Answer

An ingress rule that specifies the on-premises service account and the Cloud VPN network as sources. To allow an on-premises service account to access resources inside a service perimeter, you need an ingress rule that specifies the source (the on-premises identities and network) and the target resources (the Cloud Storage bucket). The source must include both the identity (service account) and the network (VPC or IP range).

Answer

A VPC firewall rule allowing traffic from the VPN to the Cloud Storage bucket

Answer

An egress rule that allows the service account to exit the perimeter

Answer

An access level that includes the on-premises IP range

Question 8

A company has multiple projects under an organization node. A security engineer needs to deny all principals in the organization from creating service account keys, except for a specific project where it must be allowed. Which approach should be used?

Accepted Answer

Create an IAM deny policy at the organization level denying the permission, and create another IAM deny policy at the project level that allows the permission by omitting the deny rule for that project's service accounts.. The correct approach is to use IAM deny policies (v2). Create an organization-level deny policy that denies iam.serviceAccountKeys.create to all principals. Then, create a project-level deny policy that denies the same permission but includes an exception (via exceptionPrincipals) for the project's service accounts. Because deny policies are evaluated hierarchically, the project-level policy with exceptions allows the permission for those specific principals while the organization-level policy denies it for everyone else. This is necessary because the boolean organization policy constraint constraints/iam.disableServiceAccountKeyCreation cannot be overridden or have exceptions. Option C is correct.

Answer

Use a custom organization policy constraint to allow key creation only in the specific project, and deny in all others.

Answer

Create an IAM deny policy at the organization level denying iam.serviceAccountKeys.create, and then create an IAM allow policy at the project level granting the same permission.

Answer

Apply the constraint constraints/iam.disableServiceAccountKeyCreation at the organization level with value True, and then set it to False at the project level.

Question 9

During an incident response, a security engineer needs to analyze a Pub/Sub message that was produced by a Cloud Function triggered by a SCC finding. The message has been acknowledged and deleted from the subscription. How can the engineer retrieve the message again?

Accepted Answer

Use the 'gcloud pubsub subscriptions seek' command with a snapshot or timestamp to replay the message.. Pub/Sub supports message replay by seeking a snapshot or a timestamp. This allows reprocessing messages that have been acknowledged. There is no 'dead-letter queue' for this scenario. Cloud Logging logs the message payload if configured, but not by default.

Answer

Submit a support ticket to Google to recover the message from internal storage.

Answer

Check the Cloud Function logs to view the message payload.

Answer

Create a new subscription to the same topic and enable 'retain_acked_messages' before the message was published.

Question 10

Which of the following is the correct order of the Google Cloud resource hierarchy from highest to lowest?

Accepted Answer

Organization -> Folders -> Projects -> Resources. The Google Cloud resource hierarchy is: Organization -> Folders -> Projects -> Resources. Resources are the lowest level (e.g., Compute Engine instances, Cloud Storage buckets).

Answer

Resources -> Projects -> Folders -> Organization

Answer

Folders -> Organization -> Projects -> Resources

Answer

Organization -> Projects -> Folders -> Resources

Question 11

A company is designing a PCI DSS-compliant architecture on Google Cloud. They need to ensure that the cardholder data environment (CDE) is isolated from other environments and that all access to the CDE is logged. Which THREE controls should they implement? (Choose three.)

Accepted Answer

Separate VPC networks for the CDE and non-CDE environments.. VPC Service Controls provide a security perimeter around the CDE, preventing data exfiltration. VPC networks provide network isolation. Cloud Audit Logs record all access to resources. Cloud Armor is a WAF for inbound traffic. Cloud NAT provides outbound internet. Cloud KMS manages encryption keys.

Answer

Cloud NAT to allow outbound internet access from the CDE.

Answer

Cloud Armor WAF to protect web applications in the CDE.

Question 12

A company wants to restrict access to a Cloud SQL instance so that only Compute Engine instances in a specific VPC subnet can connect. Which THREE methods can be used to achieve this? (Choose THREE.)

Accepted Answer

Configure authorized networks with the subnet's CIDR range (if using public IP).. Authorized networks allow you to restrict access to a Cloud SQL instance with a public IP by specifying the CIDR range of the subnet. Only traffic originating from IP addresses within that range can connect to the instance, effectively limiting access to Compute Engine instances in that subnet.

Answer

Create a VPC firewall rule that blocks all traffic to the Cloud SQL instance's IP.

Answer

Use VPC Service Controls to limit access to the Cloud SQL instance.

Question 13

A company uses Cloud KMS with a key purpose of ENCRYPT_DECRYPT. They want to rotate the key automatically every 90 days. What must the security engineer configure to achieve this?

Accepted Answer

Set the rotation period on the key to 7776000 seconds. In Cloud KMS, key rotation can be automatic by setting a rotation period on a key. The rotation period is configured in seconds (e.g., 90 days = 7776000 seconds). Manual rotation via the console or API is not automatic. The key purpose does not affect rotation capability; ENCRYPT_DECRYPT supports rotation.

Answer

Use a key with ASYMMETRIC_SIGN purpose

Answer

Set the key version state to 'disabled' after 90 days

Answer

Manually rotate the key every 90 days using gcloud command

Question 14

Match each Google Cloud security tool to its primary purpose.

Accepted Answer

Cloud IAM: Manage access control by defining who has what access to resources.. Cloud IAM controls access, Security Command Center detects threats, and Cloud DLP protects sensitive data. Confusions often arise between these tools due to overlapping security contexts.

Answer

Cloud IAM: Protect applications from DDoS attacks.

Answer

Cloud Security Command Center: Manage access control.

Answer

Cloud DLP: Detect and respond to threats.

Question 15

Match each Cloud KMS key purpose to its description.

Accepted Answer

Symmetric encryption key: Used for encrypting and decrypting data with the same key.. Cloud KMS key purposes include symmetric encryption (same key for encrypt/decrypt), asymmetric signing (private key to sign, public key to verify), and MAC (key for message authentication). Common confusions involve mixing symmetric and asymmetric operations.

Answer

Symmetric encryption key: Used for signing messages with a private key.

Answer

Asymmetric signing key: Used for encrypting data with the same key.

Answer

MAC key: Used for encrypting small amounts of data.

Question 16

Users are reporting 502 Bad Gateway errors when accessing an application behind an external HTTPS Load Balancer. What is the most likely cause?

Accepted Answer

The backend instances are unhealthy or the SSL certificate is invalid. 502 errors typically indicate that the load balancer cannot communicate with the backend, often due to unhealthy instances or SSL certificate issues. Option B is wrong because CDN affects content delivery, not backend connectivity. Option C is wrong because connection limits cause 503 or 429 errors, not 502. Option D is wrong because internal load balancers would not serve HTTPS externally.

Answer

Cloud CDN is not enabled for the load balancer

Answer

The backend instances have reached maximum concurrent connections

Answer

The load balancer is configured as an internal load balancer

Question 17

After deleting a Cloud KMS key version, an engineer receives an error when trying to decrypt data that was encrypted with that key version. The key version was deleted 12 hours ago. What is the most likely cause?

Accepted Answer

The key version was destroyed immediately upon deletion because the grace period is configurable.. When a key version is destroyed before the grace period expires, it is destroyed immediately. The default grace period is 24 hours, but if the key version was deleted (not scheduled for destruction), it may have been destroyed immediately. Cloud KMS does not allow recovery after destruction.

Answer

The key version was automatically rotated and is no longer the primary.

Answer

The key version is disabled and needs to be re-enabled.

Answer

The key version is in a pending destruction state and can be restored within 24 hours.

Question 18

A company is migrating to Google Cloud and needs to comply with the Health Insurance Portability and Accountability Act (HIPAA). They plan to use Cloud SQL for MySQL and Cloud Storage. Which TWO actions must they take to ensure HIPAA compliance?

Accepted Answer

Sign a Business Associate Agreement (BAA) with Google Cloud.. To achieve HIPAA compliance on Google Cloud, the organization must sign a Business Associate Agreement (BAA) with Google, which contractually establishes Google as a business associate. Additionally, encryption at rest must be enabled for Cloud SQL and Cloud Storage to protect protected health information (PHI). Option B is incorrect because disabling automatic backups is not a HIPAA requirement and could compromise data availability. Option D is incorrect because VPC Service Controls help prevent data exfiltration but are not specifically mandated by HIPAA. Option E is incorrect because customer-managed encryption keys (CMEK) are optional; Google's default encryption at rest satisfies HIPAA requirements.

Answer

Disable automatic backups to prevent exposure of protected health information (PHI).

Answer

Implement VPC Service Controls to create a perimeter around the projects.

Answer

Use customer-managed encryption keys (CMEK) for all services.

Question 19

A company uses Organization Policies to restrict public IP addresses on Compute Engine instances. An engineer created a new project and cannot launch any instances because the organization policy denies external IPs. However, the engineer needs to launch a bastion host with an external IP. What should they do?

Accepted Answer

Add an exception to the organization policy for the project.. Organization Policies can have exceptions at the project level, allowing a bastion host with an external IP while still enforcing the policy on other resources. Option A is incorrect because removing the policy at the org level would affect all projects. Option B is incorrect because a NAT gateway does not provide an external IP for inbound connections. Option D is incorrect because moving the project to a different folder with a different policy is more complex and unnecessary when a project-level exception is available.

Answer

Request that the organization policy be removed at the org level.

Answer

Use a VM with a NAT gateway instead.

Answer

Create a new folder with a different policy and move the project.

Question 20

A developer is creating a Cloud Function that needs to access a Cloud SQL database. They have granted the function's service account the Cloud SQL Client role. However, the function still gets permission denied. What is the most likely issue?

Accepted Answer

The Cloud SQL instance is not configured with an authorized network that includes the function's IP range, or the function is not using the Cloud SQL Auth proxy.. The most likely issue is that the Cloud SQL instance is configured with an authorized network that does not include the function's IP range, or the function is not using the Cloud SQL Auth proxy. Cloud Functions do not have static IP addresses by default, so they cannot be added to an authorized network. The recommended approach is to use the Cloud SQL Auth proxy, which handles authentication via IAM (the Cloud SQL Client role) and does not require authorized networks. Without the proxy, the function would need a VPC connector to access the database via private IP. Option A is incorrect because the Cloud SQL Client role is sufficient for the proxy; Cloud SQL Admin is unnecessary. Option C is incorrect because VPN is not required when using the proxy or private IP. Option D is incorrect because Cloud Functions do not need to be in the same region as Cloud SQL; they can connect across regions using the proxy.

Answer

The service account needs the Cloud SQL Admin role instead.

Answer

The function must use a VPN to connect to Cloud SQL.

Answer

The function needs to be in the same region as the Cloud SQL instance.