PCSE Practice Test 6 — 10 Questions

Question 1

An organization needs to enforce that all new Cloud Storage buckets are created only in the europe-west1 region to meet data residency requirements. Which method should they use?

Accepted Answer

Configure an organization policy with the constraint gcp.resourceLocations to allow only europe-west1.. Organization policies with the `gcp.resourceLocations` constraint allow you to restrict the physical location of resources at the organization, folder, or project level. This is the correct method because it enforces that all new Cloud Storage buckets (and other supported resources) can only be created in the specified region, meeting data residency requirements without relying on IAM conditions or bucket-level policies.

Answer

Assign the roles/storage.admin IAM role with a condition that restricts region.

Answer

Use Assured Workloads to enforce data residency.

Answer

Define a bucket policy that allows only europe-west1.

Question 2

Your organization wants to ensure that no Compute Engine instance can have a public IP address. What is the best way to enforce this policy?

Accepted Answer

Use an Organization Policy with the constraint `compute.vmExternalIpAccess`. The Organization Policy constraint `compute.vmExternalIpAccess` is a native Google Cloud policy that can be applied at the project, folder, or organization level to explicitly deny the assignment of external IP addresses to Compute Engine instances. This policy is enforced at the resource creation time, preventing any instance from being launched with a public IP, and it cannot be overridden by project-level IAM permissions, making it the most direct and effective enforcement mechanism.

Answer

Use Cloud Audit Logs to monitor and alert on instances with public IPs

Answer

Use a firewall rule that blocks traffic from 0.0.0.0/0

Answer

Use a Service Perimeter from VPC Service Controls

Question 3

A company is implementing data loss prevention (DLP) for BigQuery. Which THREE capabilities are provided by Cloud DLP? (Choose THREE.)

Accepted Answer

Redacting sensitive data in query results.. Cloud DLP can inspect and redact sensitive data directly in BigQuery query results. When you configure a DLP job or use the DLP API with BigQuery, you can specify infoTypes to detect and then redact matching values before returning the results to the user, preventing exposure of sensitive information like credit card numbers or PII.

Answer

Auditing all queries that access sensitive columns.

Answer

Encrypting entire tables with customer-managed keys.

Question 4

A security engineer wants to ensure that no IAM keys are created for service accounts in a Google Cloud organization. Which organization policy constraint should be applied?

Accepted Answer

constraints/iam.disableServiceAccountKeyCreation. The `constraints/iam.disableServiceAccountKeyCreation` organization policy constraint specifically prevents the creation of IAM keys for service accounts, which is exactly what the security engineer needs to enforce. This constraint, when applied at the organization level, blocks all users from creating or uploading service account keys, ensuring that no long-lived credentials are generated for service accounts.

Answer

constraints/compute.restrictCloudArmorPolicies

Answer

constraints/compute.requireShieldedVm

Answer

constraints/iam.allowedPolicyMemberDomains

Question 5

A security engineer needs to run a penetration test against their Google Cloud environment. According to Google's Acceptable Use Policy, which of the following is true regarding penetration testing?

Accepted Answer

Penetration testing is allowed without prior approval for most services, but DoS attacks are prohibited.. Google Cloud's Acceptable Use Policy permits customers to perform penetration testing against most of their own Google Cloud resources without prior approval, but explicitly prohibits Denial of Service (DoS) and Distributed Denial of Service (DDoS) testing, as well as testing that could impact other customers or Google's infrastructure. This aligns with the shared responsibility model: customers may test their own deployments but must not attack shared infrastructure.

Answer

Penetration testing is not allowed against any Google Cloud resources.

Answer

Denial of Service (DoS) testing is allowed with prior notification to Google.

Answer

All penetration tests require prior approval from Google Cloud Support.

Question 6

During an incident, a security engineer needs to isolate a compromised Compute Engine instance for forensic analysis without losing evidence. What should they do first?

Accepted Answer

Create a snapshot of the instance's persistent disks.. Creating a snapshot of the instance's persistent disks captures the forensic state of the compromised VM (memory-excluded but disk-resident evidence) before any remediation action alters it. This preserves evidence for later analysis while still allowing the instance to be isolated. It is the correct first step because it is non-destructive and reversible, unlike shutdown or deletion.

Answer

Disconnect the instance from the VPC network.

Answer

Shut down the instance immediately.

Answer

Delete the instance to prevent further damage.

Question 7

A developer needs to deploy a web application on Compute Engine that must access Cloud Storage buckets. The best practice for providing credentials to the VM is to:

Accepted Answer

Create a service account with the required roles and attach it to the Compute Engine instance.. Attaching a user-managed service account directly to the Compute Engine instance is the recommended best practice because the VM then obtains short-lived OAuth 2.0 access tokens automatically from the metadata server (http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token). No long-lived credentials are stored on disk, and access can be revoked centrally by changing IAM roles or detaching the service account. This follows the principle of least privilege and avoids key sprawl.

Answer

Generate a JSON key for a service account and store it on the instance.

Answer

Use the Compute Engine default service account and grant it the required roles.

Answer

Store the user's personal credentials in the instance metadata.

Question 8

A healthcare analytics team stores protected health information (PHI) in Cloud Storage buckets. They need to ensure that PHI is de-identified before it is written to the bucket, and they want to monitor for any accidental uploads of raw PHI. They are using Cloud DLP for inspection and de-identification. Which approach should they implement to meet both requirements?

Accepted Answer

Use Cloud DLP's de-identify API in a Cloud Function that is triggered by Cloud Storage object finalize events, so that each newly uploaded object is inspected and de-identified before being made available, and set up a DLP job to scan the bucket for any raw PHI that might have been missed.. De-identifying data before it is written requires an inline transformation at the time of upload. Cloud DLP's de-identify API can be invoked from a Cloud Function triggered by object finalize events, ensuring each object is processed before it becomes available. A supplementary DLP job scanning the bucket provides detection for any missed raw PHI. The other options either operate after the fact or misuse unrelated features.

Answer

Enable Cloud Storage bucket lock and Object Versioning, and configure a Cloud DLP inspection job to run every hour; if raw PHI is found, restore the previous object version to remove the PHI.

Answer

Configure a Cloud DLP de-identify template and apply it via a Cloud Storage bucket-level DLP job that runs on a schedule to de-identify existing objects, and rely on that job to also prevent future raw PHI uploads.

Answer

Create a Cloud DLP de-identify template and attach it to the bucket using a VPC Service Controls perimeter, which will automatically de-identify data as it is written and block any raw PHI uploads.

Question 9

A security engineer needs to monitor network traffic for potential threats in a VPC. They want to inspect all traffic for malware signatures and alert on high-severity threats. The solution should be natively integrated with GCP. Which service should they use?

Accepted Answer

Cloud IDS. Cloud IDS is Google Cloud's native intrusion detection service that inspects VPC traffic for malware, spyware, and command-and-control signatures, and generates alerts in Security Command Center. It is purpose-built for the requirement to inspect all traffic for malware signatures and alert on high-severity threats with native GCP integration.

Answer

VPC Flow Logs

Answer

Security Command Center

Answer

Cloud Armor

Question 10

A security team wants to block all incoming traffic from a specific country to their web application behind a global HTTPS load balancer. They also need to allow traffic from all other countries. Which Cloud Armor feature should be used?

Accepted Answer

Custom rule with geo-based condition. Cloud Armor custom rules support geo-based conditions using the origin.ip or, more precisely, the 'origin.region_code' expression, which maps to ISO 3166-1 alpha-2 country codes. A custom rule with a geo-based condition and a deny action (priority lower than the allow-all rule) blocks traffic from the specified country while allowing all others. This is the standard Cloud Armor pattern for country-level filtering on a global external HTTPS load balancer.

Answer

Rate limiting

Answer

Preconfigured WAF rules

Answer

Adaptive Protection