PCSE Practice Exam 61 — 20 Questions

Question 1

A company wants to use Chronicle to ingest logs from their on-premises firewalls into Google Cloud. They need to normalize logs into a common schema for analysis. Which Chronicle capability should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Unified Data Model (UDM). Chronicle uses the Unified Data Model (UDM) to normalize logs from various sources into a common schema. Log forwarders can collect and send logs to Chronicle, but UDM is the normalization engine. YARA-L rules are for detection, not normalization. The dashboard is for visualization.

Answer

Log forwarders

Answer

YARA-L rules

Answer

Chronicle dashboards

Question 2

A security engineer needs to store database credentials and API keys securely in GCP. The solution must support automatic rotation of secrets at a defined schedule and trigger a Cloud Function after each rotation to update dependent applications. Which service should they use?

Accepted Answer

Secret Manager. Secret Manager supports versioning, IAM access, and automatic rotation with Pub/Sub notifications. Cloud Functions can subscribe to the Pub/Sub topic to perform post-rotation tasks. Cloud KMS manages keys, not secrets. Cloud DLP is for data loss prevention. Cloud Storage is not designed for secret management with rotation.

Answer

Cloud KMS

Answer

Cloud DLP

Answer

Cloud Storage

Question 3

A company has multiple VPCs in different projects that need to privately connect to a common internal service (e.g., a managed database) running in a central project. They want to expose this service via Private Service Connect. Which type of PSC endpoint should the consumer VPCs create?

Accepted Answer

Consumer endpoint (forwarding rule with PSC backend). Consumers create Private Service Connect endpoints (forwarding rules with PSC backends) to connect to a published service. The producer publishes the service via a service attachment.

Answer

Cloud NAT gateway

Answer

VPN tunnel

Answer

Producer endpoint (service attachment)

Question 4

A security engineer is designing a logging and monitoring strategy to meet compliance requirements. Which THREE services should be integrated to ensure log data is tamper-proof and available for analysis? (Choose THREE.)

Accepted Answer

Cloud Logging. Options A, B, and E are correct. Cloud Logging (A) ingests logs, Cloud Storage with Object Lock (E) provides immutability to prevent tampering, and BigQuery (B) allows querying and analysis. Option C (Cloud Audit Logs) is a type of log, not a service. Option D (Security Command Center) is for security findings and vulnerability management, not for log management or analysis.

Answer

Cloud Audit Logs

Answer

Security Command Center

Question 5

A company uses Cloud DLP to inspect BigQuery tables for sensitive data. They want to automatically de-identify the data before loading it into another BigQuery dataset for analysis. Which THREE components must be configured? (Choose three.)

Accepted Answer

A DLP job trigger. To automatically de-identify data from BigQuery, a DLP job must be configured with a de-identification template. The inspection template identifies sensitive info types. The job can write results to a new BigQuery table. A job trigger schedules the job.

Answer

A Cloud KMS key for encryption of the output

Answer

A BigQuery authorized view

Question 6

A security engineer accidentally deleted a Cloud KMS key version. The key version is in the state DESTROY_SCHEDULED. How long does the engineer have to cancel the destruction before the key material is permanently destroyed?

Accepted Answer

24 hours. When a key version is scheduled for destruction, it enters a pending destruction grace period. The default grace period is 24 hours, during which the destruction can be canceled. After that, the key material is destroyed and unrecoverable.

Answer

30 days

Answer

Immediate destruction, no grace period

Answer

7 days

Question 7

Refer to the exhibit. A user jane@example.com receives a 403 Access Denied error when trying to list objects in a Cloud Storage bucket. What is the most likely cause?

Accepted Answer

The IAM condition restricts access to requests originating from the 10.0.0.0/24 IP range. The IAM policy includes a condition that restricts access to requests originating from the 10.0.0.0/24 IP range. If jane@example.com is accessing the bucket from an IP outside this range, the condition fails and access is denied, resulting in a 403 error. Option B is incorrect; the role assigned to Jane includes the storage.objects.list permission, so lack of permission is not the issue. Option C is incorrect; there is no indication that the bucket is in a different project. Option D is incorrect; the policy is restrictive, not permissive, and there is no conflict with other policies.

Answer

Jane does not have the storage.objects.list permission

Answer

The bucket is in a different project

Answer

The IAM policy is too permissive and conflicts with other policies

Question 8

An organization wants to prevent data exfiltration from a Google Cloud project by restricting the copying of data from Cloud Storage to external IPs. Which Google Cloud service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls (C) is correct because it allows you to define security perimeters around Google Cloud services like Cloud Storage, preventing data exfiltration by blocking access from external IPs. By creating a service perimeter, you can enforce that data can only be accessed from within a specified VPC network or on-premises network via Private Google Access, effectively restricting copying to external IP addresses.

Answer

Cloud Armor

Answer

IAM

Answer

Cloud Data Loss Prevention (DLP)

Question 9

A global e-commerce company uses Google Cloud to host its platform. They store customer payment data in Cloud SQL and use Cloud Storage for backups. Currently, they rely on Google-managed encryption keys. A new compliance requirement mandates that all encryption keys must be stored in a hardware security module (HSM) and rotated every 30 days. Additionally, they need to retain backup data for 7 years, during which the keys used to encrypt the backups must be available for decryption. They have created a Cloud HSM key ring and a key with a rotation period of 2592000 seconds (30 days). After configuring Cloud SQL and Cloud Storage to use the Cloud HSM key, they notice that backups older than 30 days cannot be decrypted. The company's security engineer verified that the key versions are still present. What is the most likely cause and how should it be resolved?

Accepted Answer

The automatic backups in Cloud SQL are encrypted with the primary key version at backup time, but the backup restore functionality does not automatically use the latest key version. Update the backup configuration to use the current primary key version for decryption.. Cloud SQL backups are encrypted with the primary key version at the time of backup creation. When restoring a backup, Cloud SQL does not automatically use the latest key version; it attempts to decrypt using the key version that was primary at backup time. Since the key is rotated every 30 days, backups older than 30 days were encrypted with a previous primary key version. Even though the key versions are still present in Cloud HSM, the backup restore operation fails because it does not automatically reference the correct historical key version. The fix is to explicitly update the backup configuration to point to the current primary key version, which allows Cloud SQL to locate and use the appropriate key version for decryption.

Answer

The key material was imported incorrectly. Delete the key ring and recreate it using an external HSM.

Answer

The rotation period of 30 days is too short for key retention. Disable automatic rotation and use manual key rotation every 30 days while retaining all versions.

Answer

Cloud Storage does not support Cloud HSM keys for object encryption. Switch to customer-supplied encryption keys (CSEK).

Question 10

Which THREE are capabilities of Assured Workloads? (Choose three.)

Accepted Answer

Location-based access controls through VPC Service Controls. Assured Workloads is a Google Cloud service that helps customers meet compliance requirements (e.g., FedRAMP, PCI DSS) by enforcing a set of security and data residency controls. Option A is correct because VPC Service Controls can be used to create a perimeter around the workload, restricting data access based on location (e.g., only allowing access from within a specific VPC or IP range), which is a key capability for compliance. Option D is correct because Access Transparency logs provide detailed logs of actions taken by Google personnel on customer data, which is critical for audit and compliance. Option E is correct because Customer-Managed Encryption Keys (CMEK) allow customers to control the encryption keys used to protect their data, a fundamental requirement for many compliance frameworks.

Answer

Cloud Shell for browser-based terminal access

Answer

Cloud Interconnect for dedicated connectivity

Question 11

A company runs a GKE cluster with multiple node pools, including one pool of confidential VMs. The security team wants to ensure that only traffic from the internal VPC (10.0.0.0/8) can reach the nodes' metadata server. Which configuration should be applied?

Accepted Answer

Create a firewall rule that allows outbound traffic from nodes to 169.254.169.254 only from the internal VPC range, and deny all other outbound to that IP.. The metadata server for GKE nodes is accessible at the link-local IP 169.254.169.254. To restrict access to this server to traffic originating only from the internal VPC range (10.0.0.0/8), you must create a firewall rule that allows outbound traffic from the nodes to 169.254.169.254 only from that range, and then deny all other outbound traffic to that IP. This ensures that only workloads within the internal VPC can query instance metadata, preventing external or unauthorized pods from accessing sensitive metadata.

Answer

Configure Private Google Access on the subnets.

Answer

Enable IAP TCP forwarding on the cluster.

Answer

Apply a VPC Service Controls perimeter to the GKE cluster.

Question 12

An organization needs to store API keys and database credentials in a central, auditable service with versioning and IAM access control. Which GCP service should they use?

Accepted Answer

Secret Manager. Secret Manager is purpose-built for storing secrets like API keys, certificates, and database passwords. It provides versioning, IAM policies (e.g., secretmanager.versions.access), and automatic rotation with Pub/Sub notifications.

Answer

Cloud HSM

Answer

Cloud DLP

Answer

Cloud KMS

Question 13

A security team is designing access controls for a multi-tenant SaaS application on Google Kubernetes Engine (GKE). Each tenant has a separate namespace. They want to ensure that a DevOps team can manage deployments across all namespaces, but cannot modify secrets in the 'tenant-alpha' namespace. Which THREE Kubernetes RBAC resources should be created? (Choose THREE)

Accepted Answer

A RoleBinding in namespace 'tenant-alpha' that binds the ClusterRole to the DevOps team.. Creates a ClusterRole (option D) that grants permissions to manage deployments, services, and ingresses across all namespaces but does not include secrets. Option A creates a RoleBinding in the 'tenant-alpha' namespace that binds this ClusterRole to the DevOps team, granting them those permissions within that namespace only. To extend the same permissions to all other namespaces, a ClusterRoleBinding (not listed among the options) binding the same ClusterRole to the DevOps team at cluster scope must also be created. Without it, the DevOps team cannot manage deployments outside 'tenant-alpha'. Option E creates a Role in 'tenant-alpha' that grants modify permissions on secrets, bound to a separate group of tenant administrators via its own RoleBinding. The combination of A, D, and E is the best selection from the given choices, but note that it does not fully meet the requirement unless an additional ClusterRoleBinding is created.

Answer

A ClusterRole that grants permissions to manage secrets across all namespaces.

Answer

A RoleBinding in namespace 'tenant-alpha' that binds a Role granting secret modification to the DevOps team.

Question 14

A company uses BigQuery to store sensitive data and wants to implement data masking using policy tags. They have three user groups: data_engineers (full access), data_analysts (masked PII), and data_scientists (masked financial data). Which THREE steps should they take?

Accepted Answer

Publish the taxonomy to make the policy tags available for use.. After creating a taxonomy with policy tags in Cloud Data Catalog, you must publish the taxonomy to make those policy tags available for use in BigQuery. Publishing associates the taxonomy with the project and allows BigQuery to enforce data masking rules based on the policy tags applied to columns.

Answer

Apply only one policy tag per column.

Answer

Enable Cloud Audit Logs to track policy tag usage.

Question 15

A security administrator wants to receive near-real-time logs whenever a Google Cloud support engineer accesses their customer content. Which GCP service provides this capability?

Accepted Answer

Access Transparency. Access Transparency provides near-real-time logs of actions taken by Google personnel when accessing customer content. It is part of the Assured Workloads offering and can be enabled for supported services.

Answer

Cloud Audit Logs (Admin Activity)

Answer

Cloud Security Command Center

Answer

Cloud Audit Logs (Data Access)

Question 16

A new employee needs to be able to create and manage Compute Engine instances. Which role should be granted at the project level?

Accepted Answer

roles/compute.instanceAdmin. The roles/compute.instanceAdmin role grants permissions to create, modify, and delete Compute Engine instances, including starting, stopping, and managing disks and snapshots, but does not allow changing project-wide network configurations or granting IAM policies. This is the least-privilege role that meets the requirement to 'create and manage Compute Engine instances' at the project level.

Answer

roles/compute.admin

Answer

roles/compute.networkAdmin

Answer

roles/compute.viewer

Question 17

A company wants to use service account keys for an on-premises application that needs to authenticate to Google Cloud APIs. Which two practices should they follow to minimize security risks? (Choose TWO.)

Accepted Answer

Enable automatic key generation and disable any unused keys.. Enabling automatic key generation ensures that keys are created with strong cryptographic standards and that unused keys are promptly disabled, reducing the attack surface. This practice aligns with Google Cloud's recommendation to minimize the number of active keys and to avoid manual key management errors.

Answer

Allow end users to download and use service account keys directly.

Answer

Store the service account key in the application's source code for easy access.

Answer

Use a single service account key for all environments to simplify management.

Question 18

A financial institution must meet SOX compliance requirements for audit trail integrity. Which THREE measures should they implement to ensure Cloud Audit Logs are immutable and securely stored?

Accepted Answer

Use customer-managed encryption keys (CMEK) with Cloud KMS for audit logs.. Using customer-managed encryption keys (CMEK) with Cloud KMS ensures that audit logs are encrypted with keys under the customer's control, preventing unauthorized decryption even by Google. This satisfies SOX requirements for data integrity and confidentiality, as the logs cannot be tampered with or accessed without the key.

Answer

Use VPC Service Controls to prevent exfiltration of logs.

Answer

Set up Cloud IAM roles to restrict who can read audit logs.

Question 19

A security engineer wants to ensure that only users from a specific external identity provider (IdP) domain (example.com) can access Google Cloud resources. They have configured SAML SSO with the IdP. However, users from other domains are also able to access resources. What is the most effective way to restrict access to only users from example.com?

Accepted Answer

Set the Organization Policy constraint constraints/iam.allowedPolicyMemberDomains to only allow domain example.com.. The best approach is to use the Organization Policy constraint 'constraints/iam.allowedPolicyMemberDomains' to restrict which external domains can be members of IAM policies. This prevents users from other domains from being granted roles. Simply blocking at the IdP is not effective because users from other domains could be added as members in IAM. IAM Conditions can be used on role bindings to restrict access based on the user's domain, but this requires careful application to all policies. The organization policy provides a global enforcement.

Answer

Use Cloud Identity groups with membership restricted to example.com and grant access to the group only.

Answer

Configure the IdP to only assert users from example.com.

Answer

Use IAM Conditions to restrict access to users with a specific claim (e.g., assertion.primary_email ending with @example.com).

Question 20

Refer to the exhibit. A Security Engineer is reviewing the IAM policy for a project. An administrator reports that a user named admin@example.com cannot create firewall rules, even though the command should allow it. According to the policy, what is the most likely reason?

Accepted Answer

The user has the 'compute.networkAdmin' role, which does not include permission to create firewall rules.. The 'compute.networkAdmin' role in Google Cloud IAM does not include the 'compute.firewalls.create' permission required to create firewall rules. The user has this role, which grants permissions to manage network resources like subnets and routes, but firewall rule creation is a security function that requires the 'compute.securityAdmin' role.

Answer

The security-team group has the 'compute.securityAdmin' role, but the user is not in that group.

Answer

The user has the 'compute.instanceAdmin.v1' role, which conflicts with network admin permissions.

Answer

The IAM policy has an invalid etag, causing the policy to be rejected.