PCSE Practice Exam 58 — 20 Questions

Question 1

A financial institution is required to use customer-managed encryption keys (CMEK) for all data at rest in Google Cloud. They need to prevent key deletion by anyone except a specific IAM role. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable destroy protection on the key ring. Enabling destroy protection on the key ring prevents any Cloud KMS key within that key ring from being destroyed, regardless of IAM permissions. This is a key ring-level setting that overrides IAM roles, ensuring that only a specific IAM role (e.g., cloudkms.admin) can disable destroy protection and then delete keys, meeting the requirement to restrict key deletion to a specific role.

Answer

Use Organization Policies with a constraint to restrict key destruction

Answer

Assign the cloudkms.admin role only to a security team

Answer

Enable key rotation on the Cloud KMS key

Question 2

Which TWO configurations are required to use Customer-Managed Encryption Keys (CMEK) with Cloud Storage to meet a compliance requirement that keys must be rotated every 30 days? (Choose two.)

Accepted Answer

Create a Cloud KMS key ring and key with a rotation period of 30 days.. Cloud KMS allows you to set a rotation period on a key, and when you use a CMEK with Cloud Storage, the key is used to encrypt the data encryption keys (DEKs). Setting a rotation period of 30 days ensures that the key material is automatically rotated every 30 days, meeting the compliance requirement. Option E is correct because the Cloud Storage service account must be granted the Cloud KMS CryptoKey Encrypter/Decrypter role to be authorized to use the CMEK for encrypting and decrypting objects.

Answer

Set a key destruction policy to prevent accidental deletion of the key.

Answer

Use Cloud External Key Manager (EKM) to manage the key externally.

Answer

Use a Cloud HSM key with protection level HSM to meet key storage requirements.

Question 3

Which TWO techniques can be used to secure a Cloud Storage bucket containing sensitive data? (Choose 2.)

Accepted Answer

Enable uniform bucket-level access. Uniform bucket-level access simplifies permissions, and VPC Service Controls restrict access to the bucket from specific networks.

Answer

Set a retention policy

Answer

Use a Customer-managed encryption key (CMEK)

Answer

Enable object versioning

Question 4

A security engineer notices that a service account has been assigned the roles/iam.serviceAccountUser role at the project level. What actions can a user with this role perform?

Accepted Answer

Impersonate the service account to access resources.. The roles/iam.serviceAccountUser role allows a user to impersonate a service account (via gcloud or API) and use its permissions to access resources. It does not allow creating, deleting, or viewing keys of service accounts. This aligns with the requirement that the team should not be able to delete the service, as the role lacks deletion permissions.

Answer

Create new service accounts in the project.

Answer

Delete the service account.

Answer

View the service account's keys.

Question 5

An organization has a deny policy at the folder level that denies the permission resourcemanager.projects.create. A user has an allow policy at the project level granting roles/owner. What is the effective permission for the user to create projects in that project?

Accepted Answer

The user cannot create projects because the deny policy at the folder level explicitly denies the permission.. Deny policies take precedence over allow policies. The folder-level deny policy explicitly denies resourcemanager.projects.create. Even though the user has Owner role at the project level, the explicit deny at the folder level blocks project creation. Option A is correct because the deny policy explicitly denies the permission, which overrides any allow. Option B is incorrect because the deny is not effective simply because it is at a higher level; it is the explicit denial that causes the effect. A higher-level allow could grant permission in the absence of a deny, but here the explicit deny controls.

Answer

The user cannot create projects because the deny policy is at a higher level in the hierarchy.

Answer

The user can create projects because Owner role includes all permissions.

Answer

The user can create projects if the project-level allow is more specific.

Question 6

Your organization requires that all egress traffic from a VPC network be inspected by a third-party security appliance before leaving the network. The appliance is deployed in a separate VPC. What is the most scalable and maintainable way to route traffic through the appliance?

Accepted Answer

Deploy the appliance in a separate VPC and create a route with next hop as the appliance's internal IP, and tag the VMs that need inspection.. It uses a route with a next hop of the appliance's internal IP, combined with VM tags to selectively route egress traffic through the appliance. This approach is scalable and maintainable as it avoids complex peering or interconnect setups, and tags allow granular control without modifying routes for every VM.

Answer

Use Cloud Interconnect to connect the two VPCs and configure BGP to advertise a default route from the appliance VPC.

Answer

Use Private Google Access to route traffic through the appliance.

Answer

Deploy the appliance in a separate VPC and use VPC Network Peering with route export/import to redirect traffic.

Question 7

A healthcare organization needs to redact Social Security Numbers (SSNs) from patient records stored in Cloud Storage before sharing them with a research partner. They plan to use Cloud DLP. Which TWO actions should they take to configure the DLP job correctly? (Choose two.)

Accepted Answer

Apply a de-identification template that uses the 'redact' transformation on the identified SSNs.. Cloud DLP de-identification templates allow you to specify a 'redact' transformation that completely removes or replaces the matched sensitive data, such as SSNs, from the content. This ensures that the output files shared with the research partner contain no trace of the original SSNs, meeting the redaction requirement.

Answer

Configure Access Transparency logs to track who accesses the objects.

Answer

Encrypt the objects with a CMEK key before running the DLP inspection.

Answer

Enable VPC Service Controls to prevent unauthorized access to the bucket.

Question 8

A company is using GKE with Workload Identity to allow pods to access Google Cloud services. A security engineer needs to restrict a specific pod to only read from a single Cloud Storage bucket. Which THREE steps should be taken? (Choose 3 correct answers)

Accepted Answer

Create a Kubernetes service account (KSA) in the pod's namespace.. Workload Identity requires a Kubernetes Service Account (KSA) to be associated with a pod. The KSA is annotated with the email of a Google Cloud Service Account (GCP SA), and the pod uses the KSA to authenticate. This creates a direct identity binding between the pod and the GCP SA, enabling fine-grained access control.

Answer

Grant the GCP SA roles/storage.objectViewer at the project level.

Answer

Create a custom role with storage.objects.get and storage.objects.list, and assign to the GCP SA.

Question 9

A company has a single Google Cloud project with multiple VPC networks. They need to comply with PCI DSS requirement 1.3.2, which restricts inbound and outbound traffic to only what is necessary. They have a web application running on Compute Engine instances in a VPC with a public subnet and a private subnet. The web servers in the public subnet need to communicate with database servers in the private subnet. Currently, the security engineer has configured firewall rules to allow HTTP/HTTPS traffic from the internet to the web servers, and allow all traffic from the public subnet to the private subnet. The auditor flags that the rule allowing all traffic from the public subnet to the private subnet is too permissive. What should the security engineer do to meet the requirement while maintaining functionality?

Accepted Answer

Create a new firewall rule that allows TCP traffic on port 3306 (MySQL) from the web servers' service accounts to the database servers' IP ranges.. It implements a least-privilege firewall rule that restricts traffic to only the necessary MySQL port (3306) and uses service accounts as the source identity, which aligns with PCI DSS requirement 1.3.2. By specifying the web servers' service accounts as the source and the database servers' IP ranges as the destination, the rule ensures only authorized web server instances can initiate database connections, rather than allowing all traffic from the entire public subnet. This maintains the required functionality while eliminating the overly permissive 'allow all' rule.

Answer

Use VPC Service Controls to restrict access to the database instances.

Answer

Remove the firewall rule allowing all traffic from the public subnet to the private subnet, and rely on the default allow internal rule.

Answer

Change the existing rule to allow traffic only on ports 3306 and 443 from the public subnet to the private subnet.

Question 10

A company wants to allow their employees to access an internal web application running on Compute Engine using Identity-Aware Proxy (IAP). They want to ensure that only users from their corporate domain (example.com) can access the app. What is the recommended approach?

Accepted Answer

Create a Cloud Identity group containing all corporate users, and grant the IAP-secured Web App User role to that group.. Identity-Aware Proxy (IAP) uses Cloud Identity groups to manage access at scale. By creating a group containing all corporate users (e.g., from example.com) and granting the IAP-secured Web App User role to that group, you enforce domain-level access without managing individual users. This approach leverages IAP's integration with Cloud Identity to verify the user's email domain against the group membership, ensuring only example.com users can reach the application.

Answer

Grant the IAP-secured Web App User role to each individual user from the corporate domain.

Answer

Use a custom SAML attribute in the IdP to filter access.

Answer

Configure a firewall rule that allows traffic only from the corporate IP range.

Question 11

A large enterprise has multiple Google Cloud organizations due to an acquisition. They want to allow a team in Org A to access a Cloud Spanner database in Org B. The team in Org A uses a service account for their application. They have set up Workload Identity Federation between the two organizations. The service account in Org B has the roles/spanner.databaseUser role on the database. The service account in Org A has been granted the roles/iam.workloadIdentityUser role on the service account in Org B. However, access attempts are failing with a permission denied error. What is the most likely missing configuration?

Accepted Answer

The service account in Org A does not have the roles/iam.serviceAccountTokenCreator role on the service account in Org B.. The external identity (service account in Org A) must be impersonating the service account in Org B, but the impersonation requires the service account in Org A to have the roles/iam.serviceAccountTokenCreator role on the service account in Org B. Option A is wrong because the roles are correctly assigned. Option B is wrong because the Spanner database does not need the impersonation role. Option C is wrong because the project-level Spanner role would not be the issue.

Answer

The project in Org B has not granted the roles/spanner.databaseUser role at the project level.

Answer

The Spanner database does not have the service account in Org A granted access directly.

Answer

The service account in Org B does not have the roles/iam.workloadIdentityUser role on itself.

Question 12

A company is using VPC Service Controls to protect their Google Cloud Storage buckets. They want to allow a specific instance to access a bucket from within a VPC. What networking configuration is required?

Accepted Answer

Private Google Access must be enabled on the subnet. VPC Service Controls require Private Google Access to be enabled on the subnet so that the instance can access Google APIs using its internal IP address.

Answer

The instance must have a public IP

Answer

A VPC peering connection to Google services

Answer

A Cloud NAT gateway

Question 13

A DevOps team wants to grant a contractor temporary access to a specific Cloud Storage bucket for 30 days. The contractor has a Google account (example@gmail.com). The bucket contains sensitive data, and the access should be as restrictive as possible. What is the recommended way to grant this access?

Accepted Answer

Add the contractor's email to the bucket-level IAM policy with the 'Storage Object Viewer' role.. Bucket-level IAM policies allow you to grant granular, time-bound access to a specific bucket without affecting other resources in the project. By adding the contractor's email (example@gmail.com) to the bucket-level IAM policy with the 'Storage Object Viewer' role, you restrict access to only that bucket and only to read objects, which is the most restrictive approach for a 30-day temporary access requirement.

Answer

Create a bucket ACL granting the contractor READ access.

Answer

Add the contractor's email to the project-level IAM policy with the 'Storage Object Viewer' role.

Answer

Generate a signed URL for the contractor to access the bucket objects.

Question 14

A security engineer is investigating a potential data exfiltration incident. They suspect that a compromised VM is sending sensitive data to an external IP. Which three data sources should they examine to trace the exfiltration? (Choose three.)

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture network metadata, DNS queries can show domain lookups, and Cloud Audit Logs (Data Access) can log data access events. Cloud NAT logs show outbound connections but are not as detailed for exfiltration. Compute Engine serial port output shows console logs but not network traffic.

Answer

Cloud NAT logs

Answer

Compute Engine serial port output

Question 15

An administrator needs to grant a network team the ability to create and manage firewall rules, but not delete VPC networks. Which IAM role should be assigned?

Accepted Answer

roles/compute.securityAdmin. The roles/compute.securityAdmin role grants permissions to create, modify, and delete firewall rules and SSL certificates, but explicitly excludes permissions to delete VPC networks or modify their configurations. This aligns exactly with the requirement to manage firewall rules without being able to delete VPC networks.

Answer

roles/compute.networkAdmin

Answer

roles/compute.viewer

Answer

roles/compute.admin

Question 16

An organization wants to enforce that all IAM policy changes in their Google Cloud organization are logged and require approval. Which three Google Cloud capabilities can help achieve this? (Choose THREE.)

Accepted Answer

Organization policies with constraints. Organization policies with constraints (B) allow you to define and enforce guardrails for IAM policy changes, such as restricting which principals can modify policies or requiring specific conditions to be met before changes take effect. This helps enforce approval workflows and compliance. Cloud Asset Inventory with Cloud Pub/Sub notifications (C) can monitor and stream real-time updates to IAM policies, triggering approval processes. Cloud Audit Logs (E) record all IAM policy changes, providing an immutable audit trail that can be used to verify compliance and enforce approval requirements.

Answer

Cloud Run for Anthos

Answer

VPC Service Controls

Question 17

A company wants to allow a third-party auditor to view their organization's IAM policies and logs but not make any changes. Which two predefined roles should be granted? (Choose two.)

Accepted Answer

roles/iam.securityReviewer. Options A and D are correct. roles/iam.securityReviewer grants read access to IAM policies, and roles/logging.viewer grants read access to logs. Option B (roles/iam.securityAdmin) includes write permissions, which is excessive for a read-only auditor. Option C (roles/monitoring.viewer) provides read access to monitoring data but not logs. Option E (roles/iam.roleViewer) only allows viewing custom roles, not IAM policies or logs.

Answer

roles/iam.securityAdmin

Answer

roles/monitoring.viewer

Answer

roles/iam.roleViewer

Question 18

A security administrator needs to audit all changes to IAM policies across the organization. They want to detect when a policy binding is added that grants a sensitive role to a user outside the organization. What is the most efficient method?

Accepted Answer

Create a log sink to export Admin Activity audit logs to BigQuery and run queries for setIamPolicy events.. Admin Activity audit logs capture all setIamPolicy calls, and exporting them to BigQuery allows for powerful querying to detect specific changes. Option A is incorrect because Cloud Asset Inventory can monitor policy changes but setting up feeds and triggers is more complex and not the most efficient method for this specific use case. Option C is incorrect because Data Access audit logs are for data access, not admin changes. Option D is incorrect because VPC Service Controls are for perimeter security, not auditing.

Answer

Use Cloud Asset Inventory to monitor IAM policy changes and trigger Cloud Functions.

Answer

Enable Data Access audit logs for all services and filter for policy changes.

Answer

Set up VPC Service Controls to prevent external access.

Question 19

A company is using Cloud SQL with a private IP address in the same VPC as their Compute Engine web application server. The server can reach the Cloud SQL instance's IP address via ping, but the application is failing to connect with a permission error. The VPC firewall rules include the default allow internal rule. What is the most likely cause?

Accepted Answer

The Compute Engine server's service account does not have the Cloud SQL Client IAM role.. The default allow internal rule permits all protocols and ports, so network connectivity is fine. The permission error indicates insufficient IAM permissions. The Cloud SQL Client role is required for connecting to Cloud SQL instances via private IP.

Answer

The Cloud SQL instance's private IP address is not assigned to the correct subnetwork.

Answer

The firewall rules need an explicit allow rule for TCP port 3306 for the server's IP range.

Answer

The Cloud SQL instance requires the public IP address to be enabled for the application to connect.

Question 20

A security team wants to mirror all traffic from a critical VM to a network intrusion detection system (NIDS) appliance running in the same VPC. They need to ensure that the NIDS receives both ingress and egress traffic, and that the original traffic is not impacted. Which solution should they implement?

Accepted Answer

Create a packet mirroring policy that mirrors traffic from the VM to the NIDS instance.. Packet Mirroring (also known as VPC Packet Mirroring) is the correct solution because it copies all ingress and egress traffic from the VM's network interface (vNIC) to the NIDS instance without affecting the original traffic flow. This is achieved by creating a packet mirroring policy that forwards a copy of the packets to the NIDS, ensuring the VM's performance and connectivity remain unchanged.

Answer

Apply a network tag to the VM and create a firewall rule to copy traffic to the NIDS.

Answer

Configure the VM to use the NIDS as a proxy for all traffic.

Answer

Enable VPC Flow Logs on the VM's subnet and forward logs to the NIDS.