PCSE Practice Test 6 — 10 Questions

Question 1

An incident responder needs to collect forensic evidence from a compromised Compute Engine instance for later analysis. They want to preserve disk state and network logs. Which THREE actions should they take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Export and analyze VPC Flow Logs for the instance's network traffic.. Creating a disk snapshot captures the disk state including deleted files. Analyzing VPC Flow Logs can reveal network connections. Isolating the instance with a firewall rule prevents further damage. Powering off the instance may alter evidence. Deleting the instance loses evidence. Cloning the instance may preserve some state but is not standard forensic practice.

Answer

Delete the instance to stop billing.

Answer

Power off the instance to prevent further compromise.

Question 2

A company is using Security Command Center (SCC) Premium tier and wants to automatically remediate certain high-severity findings. Which two services can be used together to achieve this? (Choose two.)

Accepted Answer

Pub/Sub. SCC findings can be sent to Pub/Sub, which then triggers a Cloud Function (or Cloud Run) that performs automated remediation actions. Cloud Functions can be used for lightweight automation. Cloud Scheduler is for cron jobs, not event-driven. Dataflow is for data processing. IAM is for access control.

Answer

Dataflow

Answer

Cloud Scheduler

Answer

Cloud IAM

Question 3

A DevOps engineer wants to use Cloud Armor to block common web application attacks like SQL injection and cross-site scripting. Which feature should they enable?

Accepted Answer

Preconfigured rules (OWASP CRS). Cloud Armor's preconfigured WAF rules include the OWASP ModSecurity Core Rule Set, which detects SQLi, XSS, and other attacks.

Answer

Rate limiting

Answer

Custom rules with IP allow/deny

Answer

Adaptive Protection

Question 4

A multinational organization uses Chronicle SIEM to aggregate and analyze security logs from multiple GCP projects and on-premises systems. The security team wants to detect a known threat pattern: a user authenticating from an anomalous geographic location followed by a large data egress from a Compute Engine instance within 10 minutes. Which three steps are necessary to create this detection? (Choose three.)

Accepted Answer

Ingest Cloud Audit Logs and VPC Flow Logs into Chronicle via forwarders or native integration. Chronicle uses YARA-L rules to detect patterns across different log sources. UDM normalizes logs into a common schema. The rule can reference events from multiple log types (e.g., authentication logs and network logs) and define temporal relationships.

Answer

Configure a BigQuery export of VPC Flow Logs for long-term analysis

Answer

Enable the Standard tier of Security Command Center to generate finding notifications

Question 5

A gaming company deploys a multiplayer game backend on Google Kubernetes Engine (GKE) with multiple microservices. The operations team needs to collect structured logs from containers, analyze them in real-time for anomalies, and store them for 30 days for compliance. They also need to monitor custom application metrics (e.g., player count per game server). Which three Google Cloud services should they use? (Choose three.)

Accepted Answer

Cloud Logging to collect container logs and store them for 30 days using a log bucket retention policy. Cloud Logging collects and stores logs, Cloud Monitoring collects metrics and supports custom metrics, and Chronicle can analyze logs for anomalies in real-time. BigQuery is for long-term analysis but not real-time anomaly detection.

Answer

BigQuery to store logs for 30 days and run real-time queries

Answer

Cloud SQL to store application metrics

Question 6

Your company needs to implement real-time monitoring of security events from Google Cloud resources. They want to ingest logs into a third-party SIEM system. Which two services should they use together? (Choose two.)

Accepted Answer

Cloud Logging log sink with Pub/Sub destination. Cloud Logging can export logs to Pub/Sub, and a subscriber (SIEM connector) can ingest them. Chronicle is a Google SIEM, but the question asks for third-party SIEM integration.

Answer

Cloud Storage export

Answer

Chronicle SIEM

Answer

BigQuery export

Question 7

An organization needs to centralize audit logs from multiple Google Cloud projects into a BigQuery dataset for long-term analysis. They also want to retain raw logs in Cloud Storage for archival purposes. What is the most efficient way to accomplish this?

Accepted Answer

Create two log sinks: one exporting to BigQuery, one to Cloud Storage, using an aggregated sink at the organization level.. Log sinks can route logs to multiple destinations by creating separate sinks for each destination. One sink can export logs to BigQuery, and another sink can export logs to Cloud Storage. Aggregated sinks at the organization or folder level allow collecting logs from all projects.

Answer

Create a single log sink that exports to both BigQuery and Cloud Storage.

Answer

Enable Data Access logs for all services and configure BigQuery as the default log destination.

Answer

Use Cloud Functions to copy logs from Cloud Logging to BigQuery and Cloud Storage.

Question 8

A security team needs to automatically respond to high-severity vulnerability findings in Security Command Center. They want to trigger a Cloud Function that quarantines the affected VM. What is the recommended way to connect SCC findings to Cloud Functions?

Accepted Answer

Create a SCC notification config that sends findings to a Pub/Sub topic, and set up a Cloud Function to subscribe to that topic.. SCC can publish findings to a Pub/Sub topic via notification configs. Cloud Functions can subscribe to that topic and execute the remediation logic. This is the recommended event-driven architecture.

Answer

Use Cloud Scheduler to poll SCC API every minute and invoke Cloud Function.

Answer

Configure Cloud Logging to capture SCC findings and create a log-based metric with an alert that triggers Cloud Function.

Answer

Export SCC findings to BigQuery and set up a BigQuery scheduled query to trigger Cloud Function.

Question 9

A security engineer needs to ensure that all container images deployed to a GKE cluster are signed by a trusted authority. The organization uses Cloud KMS for key management and wants to enforce the policy at admission time. Which two components are essential to implement this requirement? (Choose two.)

Accepted Answer

Attestor created in Binary Authorization with Cloud KMS key. Binary Authorization requires attestors to verify image signatures and a policy that requires at least one attestation. Attestors use Cloud KMS keys for signing, and the policy is enforced at GKE admission time.

Answer

Cloud Audit Logs enabled for GKE

Answer

Container Analysis vulnerability scanning

Answer

Web Security Scanner configured to scan the GKE cluster

Question 10

A company uses Cloud Audit Logs for compliance. They want to capture all data access events to a Cloud Storage bucket containing sensitive data. What must they enable?

Accepted Answer

Data Access audit logs with a configuration to log all methods. To capture all data access events to a Cloud Storage bucket, including API calls that read or write data, you must enable Data Access audit logs and configure them to log all methods. Admin Activity logs record configuration changes, System Event logs capture Google's internal system events, and Access Transparency logs are for requests from Google personnel. Only Data Access audit logs provide records of user and service account data access, making option D correct.

Answer

System Event audit logs

Answer

Admin Activity audit logs

Answer

Access Transparency logs