PCSE Practice Exam 57 — 20 Questions

Question 1

A company is setting up Cloud NAT for a subnet that hosts compute instances. They want to ensure high availability and efficient use of IPs. Which TWO configurations should they apply? (Choose TWO.)

Accepted Answer

Specify at least two NAT IPs, each from different zones for redundancy.. Options C and D provide high availability and efficient IP management. By specifying at least two NAT IPs from different zones (C), you ensure redundancy if one zone fails. By reserving static external IPs (D), you avoid losing IPs when instances are restarted. Option A is inefficient because one NAT gateway per region suffices; zone-level gateways add complexity. Option B disables masquerading, which is not recommended for typical NAT usage. Option E uses dynamic IPs which may change, reducing reliability.

Answer

Create a separate Cloud NAT gateway for each zone in the region.

Answer

Disable IP masquerading to preserve source IPs.

Answer

Use dynamic NAT IPs so that Google-managed allocation is used.

Question 2

An organization wants to ensure that all service accounts used by Compute Engine instances have the minimal permissions required. Which TWO practices should be implemented? (Choose 2)

Accepted Answer

Create custom service accounts with only the needed roles.. Options D and E are correct. Creating custom service accounts with only the needed roles (D) ensures minimal permissions by following the principle of least privilege. Disabling service account key creation (E) reduces the risk of key exposure and is a security best practice. Option A is incorrect because attaching a service account after instance creation is possible but not a best practice for minimal permissions; the service account should be assigned at creation. Option B is incorrect because the default compute service account often has excessive permissions and restricting scopes is not as secure as using a custom service account. Option C is incorrect because Access Transparency is for auditing Google support access, not for managing service account permissions.

Answer

Attach service accounts to instances using the gcloud compute instances set-service-account command after creation.

Answer

Use the default compute service account and restrict its scopes.

Answer

Use Access Transparency to audit service account usage.

Question 3

A healthcare organization uses Cloud DLP to scan a Cloud Storage bucket containing medical records. They want to inspect for sensitive data such as patient names and SSNs, but only on new objects added after a certain date. Which DLP configuration should they use?

Accepted Answer

Use Cloud Functions to trigger DLP inspection on new object creation events. The correct approach is to use Cloud Functions triggered by Cloud Storage object finalize events. When a new object is added, the Cloud Function invokes the Cloud DLP API to inspect only that object. This provides real-time scanning of new data without rescanning the entire bucket. Option D is incorrect because DLP job triggers do not support a `time_filter` parameter to limit scans to objects after a specific date; they scan the entire bucket or a defined subset on a schedule.

Answer

Create a DLP job trigger with a schedule that runs daily and scans the entire bucket

Answer

Use BigQuery to query the bucket and then scan the results with DLP

Answer

Create a DLP job trigger with a schedule and set `cloud_storage_options.time_filter` to scan only objects after a date

Question 4

A security administrator needs to ensure that all service account keys older than 90 days are automatically disabled to reduce the risk of key compromise. Which Google Cloud service should be used to implement this policy?

Accepted Answer

Organization Policy Service. Organization Policy Service allows administrators to set organization-wide policies, such as disabling service account key creation or setting key age constraints. Option A (Cloud Secret Manager) is incorrect because it is used for managing secrets like API keys, not service account keys. Option C (Cloud IAM) is incorrect because while IAM manages service account permissions, it does not provide lifecycle policies for keys. Option D (Cloud Key Management Service) is incorrect because it manages encryption keys, not service account keys.

Answer

Cloud Secret Manager

Answer

Cloud IAM

Answer

Cloud Key Management Service

Question 5

A company uses VPC Service Controls to protect a project containing BigQuery datasets. They have an ingress rule that allows traffic from an on-premises network via a Cloud VPN tunnel. The on-premises IP range is 10.0.0.0/8. However, users on-premises are still getting access denied errors when querying BigQuery. The VPC Service Controls perimeter is in dry-run mode. What is the most likely cause?

Accepted Answer

Cloud VPN is not a supported access method for VPC Service Controls.. In dry-run mode, VPC Service Controls logs violations but does not enforce them, so a missing identity in the ingress rule would not cause access denied errors. The most likely cause is that Cloud VPN is not a supported access method for VPC Service Controls; on-premises traffic via VPN must use a different mechanism such as Private Google Access or Cloud Interconnect. Therefore, even if the ingress rule is correctly configured, the traffic from the VPN tunnel is not recognized by the perimeter, leading to denial.

Answer

The perimeter is in dry-run mode, which blocks all traffic until the rule is finalized.

Answer

The ingress rule does not include the on-premises user identities or service accounts.

Answer

The dry-run mode only applies to egress rules, not ingress.

Question 6

A company wants to use Google Cloud Directory Sync (GCDS) to synchronize users and groups from an on-premises Active Directory to Cloud Identity. Which two prerequisites must be met? (Choose two.)

Accepted Answer

A Cloud Identity or Google Workspace account with super admin privileges.. Google Cloud Directory Sync (GCDS) requires a Cloud Identity or Google Workspace account with super admin privileges (Option C) to authenticate and perform synchronization. Additionally, the GCDS server must have network connectivity to Google servers (Option E) to access the Google API endpoints for directory sync.

Answer

A service account with the Directory Sync role.

Answer

An organization policy that allows directory sync.

Answer

A Compute Engine VM to run the GCDS service.

Question 7

A company uses Cloud Identity with SAML 2.0 federation from an external IdP. They want to enforce that users must be members of a specific group in the IdP to access GCP resources. Which two configurations are necessary? (Choose two.)

Accepted Answer

Create a corresponding group in Cloud Identity and map it to the IdP group.. To enforce group-based access, you need to create a corresponding group in Cloud Identity and map it to the IdP group (option A) so that IAM policies can reference it. You also need the IdP to send group membership in the SAML assertion (option E) so that Cloud Identity can determine which groups the user belongs to and apply the appropriate IAM policies.

Answer

Disable direct user accounts in Cloud Identity.

Answer

Use IAP to enforce group membership.

Answer

Create an organization policy to restrict access to only those users.

Question 8

Refer to the exhibit. A security engineer configured Data Access audit logs for all services. During a compliance audit, the auditor flags this configuration as deficient. What is the most likely reason?

Accepted Answer

The service account is exempted from DATA_READ logs, which may allow unlogged data access. Exempting a service account from DATA_READ logging means data access by that service account is not logged, creating a gap in audit coverage that many compliance frameworks (e.g., PCI DSS) require to be comprehensive.

Answer

The audit config does not include DATA_WRITE logging

Answer

ALL_SERVICES includes unsupported services for data access logs

Answer

The audit config should be applied at the project level, not organization level

Question 9

A company needs to detect and redact sensitive data such as email addresses and phone numbers from documents stored in Cloud Storage. They plan to use Cloud DLP. Which two resources must they create first? (Choose TWO).

Accepted Answer

A de-identification template with a redaction transform (e.g., MaskingConfig). To use Cloud DLP for scanning and redacting, you need two templates: an inspection template that defines what to look for (infoTypes like EMAIL_ADDRESS, PHONE_NUMBER) and a de-identification template that defines how to redact the sensitive data (e.g., using MaskingConfig). Option C is the inspection template, and option B is the de-identification template. You can then create a DLP job that references both templates and targets the Cloud Storage bucket. A job trigger is for scheduled scans, not mandatory for a one-time job. A key ring is not directly needed for DLP.

Answer

A DLP job trigger

Answer

A Cloud KMS key ring

Answer

A BigQuery dataset

Question 10

A company is deploying a new application that must comply with HIPAA. They are using Google Cloud services. Which TWO services are required to be enabled with appropriate configurations to support HIPAA compliance?

Accepted Answer

Cloud Key Management Service (KMS) with customer-managed keys (CMEK). Cloud Key Management Service (KMS) with customer-managed encryption keys (CMEK) is required for HIPAA compliance because it allows the customer to control the encryption keys used to protect protected health information (PHI) at rest. HIPAA mandates that covered entities implement mechanisms to encrypt and decrypt PHI, and using CMEK ensures the customer retains sole control over key material, which is a key requirement for meeting the Security Rule's addressable implementation specification for encryption.

Answer

Cloud Armor

Answer

Cloud Content Delivery Network (CDN)

Answer

Cloud Functions

Question 11

A security engineer receives an alert from Cloud Security Command Center (Cloud SCC) about a resource that is publicly accessible. The engineer identifies that the resource is a Cloud Storage bucket containing sensitive data. After making the bucket private, what is the next best step to prevent recurrence?

Accepted Answer

Create a Cloud Security Command Center notification for public bucket findings and use a Cloud Function to automatically disable public access.. It automates the prevention of future public exposure by using Cloud SCC notifications to trigger a Cloud Function that disables public access. Option A is incorrect because manual checks are not preventive and rely on human action. Option B is incorrect because deleting the bucket causes data loss and does not address the root cause. Option C is incorrect because an organization policy disallowing public access may be too restrictive for legitimate use cases, and it does not provide automated remediation for existing buckets.

Answer

Add a note in the operations runbook to check bucket permissions weekly.

Answer

Delete the bucket and all its contents to avoid future exposure.

Answer

Set an organization policy to disable public access to all Cloud Storage buckets.

Question 12

A security engineer needs to investigate a potential data exfiltration incident in a Google Cloud environment. The engineer has access to Cloud Logging and wants to identify any unusual outbound network traffic from Compute Engine instances. Which log sink filter should the engineer create to capture VPC flow logs for traffic destined to an external IP address not in the internal network ranges?

Accepted Answer

Create a sink with filter: 'resource.type="gce_subnetwork" AND jsonPayload.connection.dest_ip!="10.0.0.0/8" AND jsonPayload.connection.dest_ip!="172.16.0.0/12" AND jsonPayload.connection.dest_ip!="192.168.0.0/16"'. It uses a log sink filter that captures VPC flow logs for traffic destined to external IP addresses by explicitly excluding the private RFC 1918 address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). This filter ensures only outbound traffic to non-internal IPs is captured, which is essential for investigating potential data exfiltration. The filter correctly uses the `resource.type="gce_subnetwork"` to target VPC flow logs from Compute Engine instances.

Answer

Create a sink with filter: 'resource.type="gce_subnetwork" AND jsonPayload.connection.dest_ip="0.0.0.0/0"'

Answer

Create a sink with filter: 'resource.type="gce_subnetwork" AND jsonPayload.reporter="src" AND jsonPayload.connection.dest_ip="0.0.0.0/0"'

Answer

Create a sink with filter: 'compute.googleapis.com/vpc_flows'

Question 13

A company uses Cloud KMS with an HSM key for encryption of sensitive data. The compliance team requires that the key material never leaves the HSM boundary. They plan to use the key for symmetric encryption/decryption. Which key purpose should they specify when creating the key?

Accepted Answer

ENCRYPT_DECRYPT. For symmetric encryption/decryption, the key purpose must be ENCRYPT_DECRYPT. ASYMMETRIC_SIGN and ASYMMETRIC_DECRYPT are for asymmetric keys. MAC is for message authentication codes. Only ENCRYPT_DECRYPT supports symmetric operations.

Answer

ASYMMETRIC_SIGN

Answer

ASYMMETRIC_DECRYPT

Answer

MAC

Question 14

A healthcare company must export Cloud Audit Logs to an external SIEM for HIPAA compliance. The logs must be retained for 7 years and be immutable. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Use a log sink to export logs to a Cloud Storage bucket with a retention policy of 7 years and Object holds enabled.. Cloud Storage buckets support Object holds, which prevent object deletion or modification, ensuring immutability. A retention policy set to 7 years enforces the minimum retention period required by HIPAA. This combination meets compliance needs with minimal operational overhead, as it leverages native GCP features without requiring custom infrastructure or manual management.

Answer

Configure a log sink to send logs to an on-premises syslog server via VPN.

Answer

Create a Pub/Sub sink with a retention policy that delivers logs to a custom application.

Answer

Stream audit logs to BigQuery using a log sink, and set table expiration to 7 years.

Question 15

A multinational corporation is implementing a least-privilege access model for their CI/CD pipeline using Cloud Build, Artifact Registry, and GKE. The pipeline builds container images, pushes them to Artifact Registry, and deploys them to GKE clusters. The security team wants to ensure that the Cloud Build service account used by the pipeline has only the minimum necessary permissions. The service account currently has: roles/cloudbuild.builds.editor, roles/artifactregistry.writer, and roles/container.developer. After a successful build and push, the deployment step completes without errors, but the newly deployed pods on GKE immediately fail with ImagePullBackOff errors. The error message indicates: "Failed to pull image 'us-central1-docker.pkg.dev/my-project/my-repo/my-image:latest': rpc error: code = PermissionDenied desc = unauthenticated: Request had insufficient authentication scopes." The GKE cluster is a private cluster with Workload Identity enabled. The node pool uses a default Compute Engine service account with only the storage scope. What is the most likely missing permission or configuration that prevents the pods from pulling images?

Accepted Answer

The service account needs roles/artifactregistry.reader on the repository.. The ImagePullBackOff error occurs because the GKE node's default Compute Engine service account lacks the necessary authentication scopes and IAM permissions to pull images from Artifact Registry. The node pool uses a service account with only the storage scope, meaning it cannot authenticate to Artifact Registry. Although Workload Identity is enabled, it is not properly configured for the pods; the pods are falling back to the node's service account. To resolve this, the node's service account must be granted `roles/artifactregistry.reader` on the Artifact Registry repository. Alternatively, Workload Identity can be used to bind the pod's Kubernetes service account to a dedicated Google service account with that role. The missing permission is `roles/artifactregistry.reader` on the repository for the node's service account.

Answer

The service account needs roles/storage.objectViewer on the bucket where images are cached.

Answer

The service account needs roles/container.clusterAdmin on the cluster.

Answer

The service account needs roles/iam.serviceAccountUser on the GKE node service account.

Question 16

In the Google Cloud IAM resource hierarchy, which level supports the most granular policy attachment?

Accepted Answer

Resource. Policies can be attached at the organization, folder, project, and resource levels. The most granular is at the resource level, such as a specific Cloud Storage bucket or Compute Engine instance.

Answer

Folder

Answer

Organization

Answer

Project

Question 17

A security engineer reviews the IAM policy for a Cloud Storage bucket as shown in the exhibit. Alice reports that she cannot upload objects to the bucket, while Bob can view objects. What is the most likely issue?

Accepted Answer

The bucket has ACLs that deny Alice upload access.. Cloud Storage buckets can have both IAM policies and Access Control Lists (ACLs) applied. If the bucket's ACL explicitly denies Alice the `WRITER` or `OWNER` permission, she will be unable to upload objects even if her IAM policy grants broader roles. Bob can view objects because his IAM role (e.g., `roles/storage.objectViewer`) is not overridden by a conflicting ACL, or his ACL entry grants `READER` access.

Answer

Alice has the objectViewer role but not the objectAdmin role.

Answer

Alice does not have the storage.buckets.getIamPolicy permission.

Answer

The objectAdmin role does not include the storage.objects.create permission.

Question 18

A financial services company is required to retain audit logs for at least 7 years to comply with PCI-DSS. They have enabled Data Access audit logs for Cloud Audit Logs. However, after 6 months they notice that older logs are being automatically deleted. What is the most likely cause?

Accepted Answer

The default retention period for Cloud Audit Logs is 30 days, and logs are automatically deleted after that.. The default retention period for Cloud Audit Logs is 30 days. After this period, logs are automatically deleted unless a custom retention policy is configured or logs are exported to a long-term storage destination like Cloud Storage. Since the company enabled Data Access audit logs but did not adjust the retention setting, the logs older than 30 days are purged, explaining the 6-month observation.

Answer

The log sink exporting to Cloud Storage has been deleted.

Answer

The log sink filter is incorrectly excluding certain log entries.

Answer

An IAM policy has revoked the Logs Viewer role for the security team.

Question 19

A company uses Cloud Identity to manage users and groups. They want to synchronize users from their on-premises Active Directory to Cloud Identity. Which tool should they use?

Accepted Answer

Google Cloud Directory Sync (GCDS). Google Cloud Directory Sync (GCDS) is the official tool for synchronizing users and groups from Active Directory or LDAP to Cloud Identity. Cloud Identity SDK is not a sync tool. Deployment Manager is for infrastructure. IAM is for access control.

Answer

Identity and Access Management (IAM)

Answer

Cloud Deployment Manager

Answer

Cloud Identity SDK

Question 20

A company wants to allow employees to access a web application running on Google Kubernetes Engine (GKE) using their corporate Active Directory credentials. The application is exposed via an HTTPS load balancer. The Security Engineer needs to integrate identity federation and ensure that only authenticated users can reach the application. Which combination of services should be used?

Accepted Answer

Set up federation between Active Directory and Google Cloud using OIDC, and enable IAP on the load balancer.. It combines OIDC federation between Active Directory and Google Cloud with Identity-Aware Proxy (IAP) on the load balancer. IAP verifies user identity via OIDC tokens issued by the federated identity provider, ensuring only authenticated users can reach the application without exposing it to the public internet.

Answer

Use Cloud Armor to allow only traffic from specific IP ranges and require client certificates.

Answer

Enable IAP and configure it to use Active Directory as an identity provider.

Answer

Configure Cloud Identity as the identity provider and use IAP.