PCSE Practice Exam 60 — 20 Questions

Question 1

A company uses multiple Google Cloud projects. A service account in Project A needs to read data from a Cloud Storage bucket in Project B. What is the correct way to grant access?

Accepted Answer

Add the service account as a member of the bucket's IAM policy with the Storage Object Viewer role.. Cloud Storage uses IAM policies at the resource (bucket) level to grant cross-project access. By adding the service account from Project A as a member of the bucket's IAM policy in Project B with the Storage Object Viewer role, you grant the service account read-only access to objects in that bucket without requiring membership in Project B itself. This follows the principle of least privilege and avoids unnecessary project-level permissions.

Answer

Make the bucket publicly accessible and use signed URLs.

Answer

Grant the service account the Project Viewer role on Project B.

Answer

Add the service account as a member of Project B with the Storage Object Viewer role.

Question 2

Which TWO of the following are valid ways to grant cross-project access to a Cloud Storage bucket in Project A from a Compute Engine VM in Project B?

Accepted Answer

Grant the VM's service account (from Project B) the roles/storage.objectViewer role on the bucket in Project A.. Granting the VM's service account the roles/storage.objectViewer role on the bucket in Project A uses IAM-based cross-project access. IAM roles are the recommended method for granting access to resources across projects, as they allow a service account from one project to be granted permissions on resources in another project without needing to share keys or disable uniform bucket-level access.

Answer

Disable uniform bucket-level access on the bucket and add an ACL entry for the VM's service account.

Answer

Grant the VM's user account the roles/storage.objectViewer role on the bucket, and have the VM use gcloud with the user's credentials.

Answer

Provide the bucket's service account key to the VM and have the VM use that key for authentication.

Question 3

A company wants to grant a user the ability to delete a Cloud SQL instance but not be able to modify any other settings. What is the least privileged role?

Accepted Answer

Use a custom role with only cloudsql.instances.delete permission.. The least privileged role that allows deleting a Cloud SQL instance without granting any other permissions is a custom role containing only the `cloudsql.instances.delete` permission. Predefined roles like viewer, editor, or admin include broader permissions that would allow modifying other settings, violating the principle of least privilege.

Answer

roles/cloudsql.viewer

Answer

roles/cloudsql.editor

Answer

roles/cloudsql.admin

Question 4

A security administrator wants to ensure that only requests coming through Identity-Aware Proxy (IAP) can access a backend service running on Compute Engine. Which configuration is required?

Accepted Answer

Set firewall rules to allow only traffic from IAP proxy IP ranges.. Identity-Aware Proxy (IAP) uses a fixed set of Google-owned IP ranges to forward authenticated and authorized requests to backend services. By configuring VPC firewall rules to allow ingress only from these IAP proxy IP ranges, the administrator ensures that any traffic not originating from IAP is blocked, effectively restricting access to IAP-authorized requests only.

Answer

Use a VPN between IAP and backend.

Answer

Configure Cloud Armor to block non-IAP traffic.

Answer

Configure the backend service to require IAP credentials.

Question 5

A company is using Cloud NAT to allow instances in a private subnet to access the internet. They notice that some instances are unable to reach external services. The NAT gateway is configured with a single IP address. Which action would most likely resolve the issue?

Accepted Answer

Increase the number of NAT IPs. The issue is that a single NAT IP address can run out of available ports (each TCP/UDP session consumes a unique source port), causing new connections to fail. Increasing the number of NAT IPs expands the port pool, allowing more concurrent outbound connections. This directly addresses the port exhaustion problem without changing firewall rules or NAT type.

Answer

Change the NAT type to static

Answer

Change the VPC firewall rules to allow egress from the NAT IP

Answer

Enable TCP established connections only

Question 6

Your company is deploying a web application on Google Kubernetes Engine (GKE) with an Internal Load Balancer (ILB) as the ingress. The application must only be accessible from within the same VPC and from an on-premises network connected via Cloud VPN. The on-premises network uses IP range 10.0.0.0/8. You have already created the ILB with a backend service. What is the most secure way to restrict access to the ILB?

Accepted Answer

Configure the backend service's firewall rules to only allow traffic from the ILB's health check ranges and from the VPC and on-premises source ranges. The most secure way to restrict access to an Internal Load Balancer (ILB) is to apply firewall rules directly on the backend service (the instance group or NEG). This ensures that only traffic from the ILB's health check probe ranges (130.211.0.0/22 and 35.191.0.0/16 for GKE) and the allowed source ranges (VPC and on-premises) can reach the backend instances. This approach prevents any traffic from reaching the backend except through the ILB, which is the intended secure design for an internal-only application.

Answer

Configure a VPC firewall rule to deny all ingress traffic to the ILB's forwarding rule IP address, and then create a higher-priority allow rule for the VPC and on-premises ranges

Answer

Use GKE Network Policy to restrict ingress traffic to the application pods from the VPC and on-premises ranges

Answer

Use Cloud Armor to create a security policy that allows traffic only from the VPC and on-premises ranges, and attach it to the ILB

Question 7

A healthcare startup is building a data pipeline on Google Cloud. They receive patient data via a REST API running on Cloud Run. The data includes sensitive health information that must be de-identified before being stored in BigQuery. They plan to use Cloud DLP to inspect and transform the data. However, due to latency requirements, they need to de-identify the data within 5 seconds of receiving the request. They have set up a Cloud DLP job to inspect the data synchronously using the DLP API. During testing, they notice that the de-identification sometimes takes over 10 seconds, causing API timeouts. They want to reduce the latency without compromising security. What should they do?

Accepted Answer

Use Cloud DLP with a content item size limit and stored infoTypes to reduce inspection time.. Cloud DLP synchronous inspection latency is directly proportional to the content size and the number of infoTypes scanned. By limiting the content item size (e.g., to 1 MB) and using stored infoTypes (which are pre-compiled for faster matching), you reduce the inspection time significantly, enabling de-identification within the 5-second window without compromising security.

Answer

Use a Cloud Function to process the data and call the DLP API.

Answer

Instead of using Cloud DLP, use BigQuery column-level security with data masking.

Answer

Configure a Cloud DLP job to run asynchronously and store results in BigQuery, then modified the pipeline to read the de-identified data later.

Question 8

Refer to the exhibit. A security engineer runs the commands shown. The command 'gcloud compute instances list' fails with a permission denied error. The service account key belongs to a service account with the role 'roles/compute.viewer' on the project. What is the most likely cause?

Accepted Answer

The service account key file is invalid or the service account has been deleted.. The command 'gcloud auth activate-service-account' uses a service account key file to authenticate as that service account. If the key file is invalid (e.g., corrupted, expired, or malformed) or the service account itself has been deleted, authentication will fail, causing subsequent commands like 'gcloud compute instances list' to return a permission denied error even if the service account has the correct role. The error is not about missing permissions on the role, but about the inability to prove identity.

Answer

The role 'roles/compute.viewer' does not include the permission to list instances.

Answer

The command 'gcloud auth activate-service-account' should be 'gcloud auth login' instead.

Answer

The project 'my-project' does not exist or the service account is not in that project.

Question 9

A company wants to implement least privilege access for a team that needs to monitor and manage Cloud Run services. Which two IAM roles should be considered? (Choose two.)

Accepted Answer

roles/run.viewer. (roles/run.viewer) is correct because it grants read-only permissions to view Cloud Run services, configurations, and revisions, which is sufficient for monitoring without allowing modifications. Option D (roles/run.developer) is correct because it allows both viewing and managing Cloud Run services (e.g., deploying new revisions, updating configurations) while still restricting access to other GCP resources, aligning with least privilege for a team that needs to both monitor and manage.

Answer

roles/iam.serviceAccountUser

Answer

roles/run.admin

Answer

roles/run.invoker

Question 10

Which THREE components are customer responsibilities under the Google Cloud Shared Responsibility Model for IaaS? (Choose 3.)

Accepted Answer

Security of virtual network controls. Under the IaaS shared responsibility model, the customer is responsible for configuring and managing virtual network controls such as firewalls, route tables, and network ACLs. Google Cloud provides the underlying network infrastructure, but the customer must secure traffic flows and access policies within their VPC.

Answer

Physical security of data centers

Answer

Security of the hypervisor

Question 11

A security team wants to ensure that all service account key creation events in their organization are logged and alerted on. Which logging feature should they use?

Accepted Answer

Enable Admin Activity audit logs for the IAM service.. Admin Activity audit logs capture operations that modify the configuration or metadata of resources, such as creating or deleting service account keys. Since the question asks about logging key creation events, Admin Activity logs are the correct choice because they record all administrative actions, including service account key creation, by default and cannot be disabled. Data Access audit logs, by contrast, track data-level operations like reading or writing data, not administrative changes.

Answer

Enable System Event audit logs for the IAM service.

Answer

Enable Data Access audit logs for the IAM service.

Answer

Enable Access Transparency logs for the IAM service.

Question 12

A multinational organization must ensure that data for European users is stored only within the European Union to comply with GDPR. They use Cloud Storage and BigQuery. Which design should they implement?

Accepted Answer

Set an organization policy with constraints/gcp.resourceLocations to restrict resource creation to EU regions.. The organization policy constraint `gcp/resourceLocations` is the only design that proactively prevents data from being stored outside the EU. By setting this constraint to allow only EU regions (e.g., `europe-west1`, `europe-west4`), any attempt to create a Cloud Storage bucket or BigQuery dataset in a non-EU region will be denied at the API level, ensuring GDPR compliance by design.

Answer

Use Cloud DLP to inspect and tag data for European origin.

Answer

Use VPC Service Controls to create a perimeter around European resources.

Answer

Use Cloud Armor with geo-based access control to restrict access from non-EU locations.

Question 13

A security engineer is investigating a potential data breach in a Google Cloud environment. The engineer suspects that a compromised service account key was used to access Cloud Storage buckets. Which TWO actions should the engineer take immediately to mitigate the risk?

Accepted Answer

Disable the service account. Disabling the service account immediately stops all access using any of its keys, including the compromised one, without deleting the account or its configuration. This is the fastest way to block the attacker while preserving the ability to investigate and re-enable the account later if needed. In Google Cloud, disabling a service account is a reversible action that revokes all authentication and authorization for that identity.

Answer

Revoke all IAM roles granted to the service account

Answer

Rotate the service account key

Answer

Enable Cloud Audit Logs for the service account

Question 14

A security team wants to explicitly deny access to a Cloud Storage bucket for all users except the bucket owner. Currently, there are allow policies at the project level granting Storage Object Viewer to all users. What is the most efficient way to implement this?

Accepted Answer

Create an IAM deny policy on the bucket with a deny rule for all principals (principalSet: allUsers) and an exception for the bucket owner.. Google Cloud IAM deny policies explicitly deny access to resources, overriding any allow policies. By creating a deny rule on the bucket with `principalSet: allUsers` as the denied principal and an exception for the bucket owner, you effectively block all users except the owner, regardless of project-level allow roles. This is the most efficient approach as it does not require modifying existing project-level policies or removing roles.

Answer

Create an Organization Policy that denies access to the bucket for all users except the owner.

Answer

Modify the project-level role to include a condition that only allows the bucket owner.

Answer

Remove the project-level Storage Object Viewer role and grant it only to the bucket owner.

Question 15

A financial services company is deploying a new payment processing system on Google Cloud that must comply with PCI DSS. The system processes credit card data. The security team has implemented encryption at rest and in transit, and uses Private Google Access for VPC communication. During a PCI assessment, the assessor points out that the company is missing a critical control: the need to regularly scan the external IP addresses of the VMs for vulnerabilities. What should the company do to address this requirement?

Accepted Answer

Set up a third-party vulnerability scanner (e.g., Nessus) from the Cloud Marketplace and run scans against external IPs.. PCI DSS Requirement 11.2 mandates that external-facing IP addresses be scanned for vulnerabilities at least quarterly and after any significant change. Deploying a third-party scanner like Nessus from the Cloud Marketplace allows the company to run authenticated or unauthenticated scans against the external IPs of their VMs, meeting the specific requirement. Google Cloud does not provide a native active vulnerability scanning service for external IPs; Security Command Center Premium and Cloud IDS focus on asset discovery and threat detection, not active scanning of external endpoints.

Answer

Use Security Command Center Premium to perform vulnerability scanning.

Answer

Deploy Cloud IDS to perform active vulnerability scanning on external IPs.

Answer

Enable Cloud Armor to block all traffic and thus eliminate the need for scanning.

Question 16

A company is deploying a PCI DSS-compliant application on Google Cloud. They need to ensure that the cardholder data environment (CDE) is isolated and that only authorized services can communicate. Which TWO services should they use? (Choose 2)

Accepted Answer

Cloud Armor. VPC Service Controls create a secure perimeter around the CDE resources, preventing data exfiltration. Cloud Armor provides web application firewall capabilities to protect the application. Cloud NAT is for outbound connectivity, Cloud IDS is for intrusion detection, and Cloud VPN is for site-to-site VPN, not isolation.

Answer

Cloud IDS

Answer

Cloud NAT

Answer

Cloud VPN

Question 17

A healthcare organization stores PHI in BigQuery tables with row-level access policies. They need to ensure that data is automatically de-identified when exported to Cloud Storage for analytics. What is the most scalable solution with minimal manual intervention?

Accepted Answer

Use BigQuery data masking to define de-identification policies, then export the masked data directly.. BigQuery data masking allows you to define column-level de-identification policies that are applied automatically at query time. When you export the masked data directly using an export job, the de-identification is enforced without additional scripting or post-processing, making it the most scalable and low-maintenance solution for PHI protection.

Answer

Set up VPC Service Controls to prevent data exfiltration and rely on access controls.

Answer

Create a scheduled query in BigQuery that exports data using a view with de-identification functions.

Answer

Use Cloud DLP API to scan and de-identify the export file after it is written to Cloud Storage.

Question 18

An organization uses Cloud Identity to manage users and groups. They want to synchronize their existing on-premises Active Directory with Cloud Identity. Which tool should they use?

Accepted Answer

Google Cloud Directory Sync (GCDS). Google Cloud Directory Sync (GCDS) is the correct tool because it is specifically designed to synchronize users, groups, and aliases from an on-premises Active Directory (or LDAP server) into Cloud Identity without requiring federation. GCDS maps AD attributes to Cloud Identity fields and runs on a scheduled basis to keep the cloud directory in sync, making it the appropriate choice for this use case.

Answer

Third-party SAML identity provider

Answer

Identity Platform

Answer

Cloud Workflows

Question 19

A security team wants to automatically detect anomalies in user behavior across Google Workspace and Google Cloud. Which TWO Security Command Center features can help?

Accepted Answer

Event Threat Detection. Event Threat Detection uses machine learning to identify anomalous IAM activity and suspicious behavior in Google Cloud, including patterns that may indicate compromised accounts or malicious activity. Anomaly Detection (Standard tier) uses machine learning to detect anomalies in user and resource activity across both Google Workspace and Google Cloud. Together, they provide coverage for detecting anomalies in user behavior across the organization.

Answer

VM Threat Detection

Answer

Compliance monitoring (Premium tier)

Answer

Security Health Analytics

Question 20

A healthcare organization must ensure that only authorized personnel can access Protected Health Information (PHI) stored in Cloud Storage. They need to enforce encryption at rest and control access based on data classification. Which combination of Google Cloud services should they use?

Accepted Answer

Use customer-managed encryption keys (CMEK) with Cloud KMS and VPC Service Controls.. It combines customer-managed encryption keys (CMEK) with Cloud KMS to enforce encryption at rest using keys controlled by the organization, and VPC Service Controls to restrict data access based on data classification by creating a security perimeter around Cloud Storage. This ensures that only authorized personnel within the defined perimeter can access PHI, meeting both encryption and access control requirements.

Answer

Use customer-supplied encryption keys (CSEK) and Cloud Audit Logs.

Answer

Use Cloud HSM for key management and Cloud DLP to inspect data.

Answer

Enable Access Transparency and use Organization Policies to restrict resource locations.