PCSE Practice Exam 59 — 20 Questions

Question 1

A security engineer needs to provide secure SSH access to a Compute Engine instance that has no external IP address. What is the recommended method?

Accepted Answer

Use Identity-Aware Proxy (IAP) TCP forwarding.. Identity-Aware Proxy (IAP) TCP forwarding allows SSH access to instances without external IP addresses. Option A is incorrect because VPC peering connects VPC networks, not provide SSH access. Option B is incorrect because Cloud NAT is for outbound internet access, not inbound SSH. Option C is incorrect because a firewall rule allowing SSH from any IP would still require the instance to have an external IP address.

Answer

Set up VPC peering with the instance's VPC.

Answer

Create a Cloud NAT to allow inbound SSH.

Answer

Add a firewall rule allowing SSH from any IP.

Question 2

Which TWO actions should be taken to ensure that a Google Cloud environment meets PCI-DSS requirements for protecting cardholder data? (Choose two.)

Accepted Answer

Encrypt all transmission of cardholder data using TLS 1.2 or higher.. PCI-DSS Requirement 4 mandates that cardholder data must be encrypted during transmission over open, public networks. TLS 1.2 or higher is the specified protocol, and Google Cloud services such as HTTPS load balancers and Cloud VPN support this encryption natively, ensuring compliance with the transmission security requirement.

Answer

Use IAM roles to restrict access to cardholder data to the minimum necessary.

Answer

Use Cloud Data Loss Prevention to tokenize all credit card numbers before storage.

Answer

Enable automatic DLP inspection triggers for all Cloud Storage buckets.

Question 3

A company is deploying a microservices architecture on Google Kubernetes Engine (GKE). They need to securely store and access database credentials, API keys, and other secrets. They want to avoid storing secrets in plaintext in the container image or Kubernetes manifests. Which solution should they use?

Accepted Answer

Use Secret Manager and mount secrets as volumes using the Secret Manager CSI driver.. Secret Manager provides a centralized, secure, and auditable way to store secrets, and the Secret Manager CSI driver allows pods to mount these secrets as volumes without exposing them in the container image or Kubernetes manifests. This approach ensures secrets are never stored in plaintext on disk or in etcd, and it integrates with GKE's workload identity for fine-grained access control.

Answer

Encrypt secrets with Cloud KMS and store them in a ConfigMap.

Answer

Store secrets in a ConfigMap and mount as environment variables.

Answer

Use Kubernetes native Secrets, committing them to a private repository.

Question 4

An organization uses Cloud DLP to scan a Cloud SQL database for PII. They want to automatically pseudonymize email addresses found in a specific column using a deterministic encryption that can be reversed for authorized users. The key must be stored in Cloud KMS. Which DLP transformation should they configure?

Accepted Answer

CryptoDeterministicConfig with a key from Cloud KMS.. CryptoDeterministicConfig performs deterministic encryption (same plaintext always produces the same ciphertext) using a key from Cloud KMS, which allows pseudonymization that can be reversed by authorized users. This matches the requirement for a reversible, deterministic transformation on email addresses in a Cloud SQL column.

Answer

CryptoHashConfig with a cryptographic key from Cloud KMS.

Answer

CryptoReplaceFfxFpeConfig using a key from Cloud KMS.

Answer

ReplaceWithInfoTypeConfig with a cryptographic key.

Question 5

Refer to the exhibit. A compliance auditor reviews the key configuration and finds a potential issue. What is the most likely compliance impact?

Accepted Answer

The key lacks automatic rotation, which may violate compliance requirements. Many compliance frameworks (e.g., PCI DSS, SOC 2, NIST SP 800-57) require cryptographic keys to be rotated periodically to limit the amount of data encrypted under a single key and reduce the impact of key compromise. In Google Cloud KMS, if automatic rotation is not enabled or configured, the key remains static, which can violate these compliance mandates. The auditor identifies the lack of automatic rotation as a potential non-compliance issue, even if the key is otherwise valid and functional.

Answer

The key is disabled and cannot encrypt data

Answer

The key was created too recently

Answer

The key is not used for the correct purpose

Question 6

Which TWO of the following are valid methods to protect data in transit between on-premises and Google Cloud using Cloud VPN?

Accepted Answer

Use Cloud VPN with IPsec IKEv2.. Cloud VPN supports both IPsec IKEv1 and IKEv2 as valid protocols for establishing secure tunnels between on-premises networks and Google Cloud. IKEv2 offers improved stability and mobility support, but both are explicitly supported by Google Cloud VPN for protecting data in transit.

Answer

Use Cloud VPN with SSL VPN.

Answer

Use Cloud NAT for outbound traffic.

Answer

Use Cloud Interconnect with MACsec.

Question 7

A financial services company must ensure that its Google Cloud environment complies with PCI DSS. The security team needs to implement controls to protect cardholder data. Which TWO measures should they implement? (Choose TWO.)

Accepted Answer

Configure VPC Service Controls to restrict data movement from managed services.. C is correct because VPC Service Controls create a security perimeter around Google Cloud managed services, preventing data exfiltration by restricting data movement from within the perimeter to unauthorized external networks. This is critical for PCI DSS compliance as it helps protect cardholder data from unauthorized access or transfer. E is correct because Customer-Managed Encryption Keys (CMEK) allow the organization to control and manage the encryption keys used to protect data at rest, meeting PCI DSS requirement 3.4 for rendering cardholder data unreadable.

Answer

Enable Data Access audit logs for all Cloud Storage buckets.

Answer

Use Security Command Center to detect misconfigurations.

Answer

Enable Shielded VMs on all Compute Engine instances.

Question 8

A developer accidentally committed a file containing a service account key to a public GitHub repository. Which action should be taken immediately to invalidate the compromised key?

Accepted Answer

Disable the service account key using IAM.. Immediately disabling the service account key using IAM (Identity and Access Management) is the fastest way to revoke the compromised credential's access to Google Cloud resources. Disabling the key prevents any further use of that key for authentication, even if it is still present in the public repository. This action does not affect other keys or the service account itself, allowing the developer to later rotate or delete the key without disrupting existing workloads.

Answer

Delete the service account and create a new one.

Answer

Use Cloud DLP to find and redact the key.

Answer

Rotate the key using Cloud KMS.

Question 9

Your organization uses Shared VPC with a host project and several service projects. You need to ensure that all egress traffic from Compute Engine instances in a service project is routed through a centralized Cloud NAT in the host project. What is the required configuration?

Accepted Answer

Configure a Cloud NAT on the Cloud Router in the host project for the subnet that is shared with the service project. A Cloud NAT configured on the Cloud Router in the host project for the shared subnet allows all Compute Engine instances in service projects attached to that subnet to use the host project's NAT IP for outbound traffic. This is the only way to centralize egress traffic through the host project's Cloud NAT while respecting Shared VPC architecture, as the NAT is tied to the subnet and Cloud Router in the host project.

Answer

Create a firewall rule in the host project that denies all egress traffic except to the Cloud NAT IP

Answer

Set the instances to use a custom route with next-hop as the Cloud NAT IP address

Answer

Configure a Cloud NAT in each service project and associate it with the subnet that the instances use

Question 10

A company has a multi-project setup with a shared VPC. They want to centrally audit all firewall rule changes. What is the most efficient way?

Accepted Answer

Export Admin Activity audit logs to a centralized project's BigQuery dataset.. Admin Activity audit logs record all configuration changes, including firewall rules. By exporting these logs from all projects to a centralized BigQuery dataset, you can efficiently query and analyze all changes across the organization.
Option A: Creating a log sink in each project to route firewall-related logs to Cloud Storage and then aggregate is less efficient because it requires managing multiple sinks and aggregating data manually. Also, log sinks for firewall logs may not capture all rule changes if not configured for appropriate log types.
Option B: VPC Flow Logs capture metadata about network traffic, not firewall rule changes. They are useful for network analysis but not for auditing configuration changes.
Option D: Cloud Asset Inventory with IAM policy change feed tracks IAM policy changes, not firewall rule changes. It is not suitable for auditing firewall rule modifications.
Thus, the most efficient way is to export Admin Activity audit logs to a centralized BigQuery dataset.

Answer

Create a log sink in each project that routes firewall-related logs to a Cloud Storage bucket and then aggregate.

Answer

Enable VPC Flow Logs on all subnets.

Answer

Use Cloud Asset Inventory with IAM policy change feed.

Question 11

A security team uses Security Command Center Premium to detect threats. They want to receive real-time notifications when a finding of type 'Threat' with severity 'CRITICAL' or 'HIGH' is created. Which approach should they use?

Accepted Answer

Create a SCC notification config with a filter for threat type and severity levels, sending to a Pub/Sub topic.. SCC Premium provides built-in Pub/Sub notifications for findings. You can configure notification configs with filters to receive only specific finding types and severities. There is no need to export to BigQuery or use Cloud Functions to poll; the notification config pushes to a Pub/Sub topic.

Answer

Use BigQuery to query SCC findings and schedule a query that pushes results to Pub/Sub.

Answer

Create a log sink to export SCC findings to Pub/Sub and then filter using Cloud Functions.

Answer

Enable Event Threat Detection and configure it to send alerts via email.

Question 12

A company wants to protect its HTTP(S) Load Balancer from common web attacks like SQL injection and cross-site scripting. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is the correct service because it provides web application firewall (WAF) capabilities that can inspect HTTP(S) traffic and filter out common web attacks such as SQL injection and cross-site scripting (XSS). It integrates directly with HTTP(S) Load Balancers to enforce security policies at the edge, blocking malicious requests before they reach backend instances.

Answer

Identity-Aware Proxy (IAP)

Answer

VPC Service Controls

Answer

Cloud CDN

Question 13

A security engineer runs the above query in BigQuery and finds a column containing Social Security Numbers (SSNs). They must ensure that all SSNs in the dataset are automatically encrypted at rest using customer-managed keys (CMEK) and also that future queries do not expose SSNs to users without decryption access. Which approach should they take?

Accepted Answer

Enable CMEK on the dataset, create an authorized view that excludes the sensitive column, and grant view access to users.. Enabling CMEK on the dataset ensures all data, including SSNs, is encrypted at rest with customer-managed keys. Creating an authorized view that excludes the sensitive column and granting view access to users prevents exposure of SSNs in query results while still allowing access to non-sensitive data. This approach meets both the encryption and access control requirements without requiring manual encryption or de-identification.

Answer

Use BigQuery with CMEK on the dataset and create a separate table with encrypted columns.

Answer

Use Cloud DLP to de-identify the data in the table and then restrict access to the de-identified column.

Answer

Use Cloud KMS to encrypt the column values and store the encrypted data in BigQuery.

Question 14

Which TWO of the following are valid reasons to enable VPC Flow Logs? (Choose two.)

Accepted Answer

To perform network forensics after a security incident. VPC Flow Logs capture metadata about IP traffic going to and from network interfaces in a VPC, including source/destination IPs, ports, protocols, and packet/byte counts. This historical data is essential for post-incident network forensics, allowing you to trace the path of malicious traffic, identify compromised hosts, and reconstruct the timeline of an attack. Without flow logs, you would lack the granular traffic records needed for such analysis.

Answer

To log Cloud NAT translations for audit purposes

Answer

To detect and block DDoS attacks at the network layer

Answer

To enforce firewall rules automatically based on traffic patterns

Question 15

A healthcare organization is migrating sensitive patient data to Google Cloud and must comply with HIPAA. They plan to use Cloud SQL for MySQL with CMEK for encryption at rest. The security team is concerned about key management and access logging. Which additional measure should be implemented to meet HIPAA audit requirements?

Accepted Answer

Enable Data Access audit logs for the Cloud SQL instance and Cloud KMS key.. HIPAA audit requirements mandate that access to protected health information (PHI) and the keys protecting it must be logged. Enabling Data Access audit logs on both the Cloud SQL instance and the Cloud KMS key captures read, write, and administrative operations, providing the necessary audit trail for compliance. Without these logs, the organization cannot demonstrate who accessed the data or the encryption keys, which is a core HIPAA requirement.

Answer

Configure VPC Service Controls to restrict access to the Cloud SQL instance.

Answer

Use Cloud DLP to de-identify the data before storing it in Cloud SQL.

Answer

Store the CMEK keys in Cloud HSM to meet FIPS 140-2 Level 3 requirements.

Question 16

A company uses Cloud Armor to protect an external HTTPS load balancer. They want to block requests from a specific IP address range 198.51.100.0/24, but allow all other traffic. After creating a deny rule with the source IP condition, they notice that requests from that range are still reaching the backend. What is the most likely cause?

Accepted Answer

Another rule with a lower priority number that allows all traffic is overriding the deny rule.. In Cloud Armor, rules are evaluated in order of priority, where lower priority numbers indicate higher precedence. If a rule with a lower priority number (e.g., 1000) allows all traffic, it will be evaluated before a deny rule with a higher priority number (e.g., 2000), causing the deny rule to be overridden. This is the most likely reason the specific IP range is still reaching the backend despite the deny rule being created.

Answer

The rule action is set to 'allow' instead of 'deny'.

Answer

Cloud Armor cannot block traffic based on source IP; it only supports geographic and header-based conditions.

Answer

The rule uses the wrong match syntax, such as 'sourceIpRange' instead of 'inIpRange'.

Question 17

A company must ensure that all data stored in Google Cloud remains within specific geographic regions to meet data residency regulations. Which TWO methods enforce data location restrictions? (Choose TWO.)

Accepted Answer

Organization Policy constraints (constraints/gcp.resourceLocations). Organization Policy constraints, specifically `constraints/gcp.resourceLocations`, allow administrators to define a list of allowed geographic locations (e.g., `in:us-central1` or `in:europe-west1`) where Google Cloud resources can be created. This policy is enforced at the project, folder, or organization level, preventing resource creation outside the permitted regions, which directly addresses data residency requirements.

Answer

VPC Service Controls

Answer

Cloud Data Loss Prevention scan

Answer

Cloud Interconnect

Question 18

Your organization has a multi-project environment with centralized logging in a dedicated project (logging-project). All VPC Service Controls perimeters are configured correctly. The security team needs to ensure that all audit logs from all projects are retained for 5 years and cannot be deleted or modified by any project administrator. They also want to restrict access to the logs to only the security team members (who have the 'Security Reviewer' role at the organization level). Currently, each project has its own log sink that exports to a BigQuery dataset in logging-project. The security team notices that some project administrators have inadvertently deleted logs from their project's BigQuery dataset. You need to recommend a solution that prevents log deletion and enforces the retention policy. What should you do?

Accepted Answer

Configure the _Required and _Default log buckets in each project to route logs to a Cloud Storage bucket in logging-project using log sinks. Enable Object Hold and set a retention policy of 5 years on the bucket. Grant the security team the Storage Object Admin role on the bucket.. It uses a Cloud Storage bucket with a retention policy and Object Hold to prevent deletion or modification of logs for 5 years. The retention policy enforces a minimum retention period, and Object Hold prevents object deletion even by project administrators. Log sinks from each project's _Required and _Default log buckets route logs to this bucket, ensuring centralized, immutable storage. Granting the security team Storage Object Admin allows them to manage the bucket while restricting others.

Answer

Configure the log sinks to export logs to a Cloud Storage bucket with a lifecycle rule that deletes objects after 5 years. Set the bucket's IAM policy to deny the storage.objects.delete permission to all users except the security team.

Answer

Create a new BigQuery dataset in logging-project with a table expiration of 5 years and configure the log sinks to export to this dataset. Grant the security team the BigQuery Data Viewer role and revoke all other users' access to the dataset.

Answer

Create a new organization-level log sink that exports logs to a BigQuery dataset in logging-project. Grant the security team the BigQuery Data Owner role on the dataset and remove all other project administrators from the dataset's permissions.

Question 19

An organization needs to enforce a TLS minimum version of 1.2 for all traffic to their HTTPS load balancers. They have multiple load balancers serving different domains. Which Google Cloud feature should they use?

Accepted Answer

Create an SSL policy with TLS 1.2 as the minimum version and attach it to the target HTTPS proxy.. SSL policies allow you to configure the minimum TLS version and cipher suites for HTTPS load balancers. You can create an SSL policy with TLS 1.2 as the minimum and attach it to the target HTTPS proxy of each load balancer.

Answer

Use a global network endpoint group (NEG) with an SSL policy.

Answer

Create a Cloud Armor security policy with a rule to block TLS 1.0 and 1.1.

Answer

Configure the backend instances to reject TLS 1.0 and 1.1 connections.

Question 20

A security team needs to inspect all egress traffic from Compute Engine instances for malware using a third-party security appliance. They want to deploy the appliance in a separate VPC and route all egress traffic through it. Which THREE components are required? (Choose 3)

Accepted Answer

VPC peering between the application VPC and the appliance VPC. Use a custom route to direct default egress traffic to the appliance, which is an internal load balancer (ILB) forwarding to the appliance instances. The appliance must be deployed in a different VPC, and VPC peering or Network Connectivity Center connects the VPCs. However, the simplest is to use an ILB in the same VPC as the instances, but the requirement says separate VPC. So use VPC peering. The three required: custom route for default route (0.0.0.0/0) with next hop to ILB, an internal load balancer forwarding traffic to the appliance, and VPC peering (or VPN) to connect the VPCs. Alternatively, if using the same VPC, peering not needed. But given separate VPC, peering is needed.

Answer

Cloud VPN tunnel between VPCs

Answer

Cloud NAT gateway