PCSE Practice Exam 62 — 20 Questions

Question 1

A security team wants to audit all actions performed by users on a critical Cloud Storage bucket. They have enabled Data Access audit logs. However, they notice that read requests are not being logged. What should they do to ensure all read requests are logged?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure bucket-level logging to record all access requests.. Bucket-level logging captures all access requests, including read operations, by recording detailed logs for each request made to the bucket. Data Access audit logs, while enabled, may not log all read requests due to exclusion filters or default configuration limitations, whereas bucket-level logging provides comprehensive access records directly from Cloud Storage.

Answer

Enable Access Transparency logs for the project.

Answer

Assign the Storage Legacy Bucket Reader role to the bucket.

Answer

Enable VPC Flow Logs for the network.

Question 2

A security team wants to analyze VPC Flow Logs to investigate a potential data exfiltration incident. The logs are currently stored in Cloud Logging. What is the MOST efficient method to query and visualize the network traffic patterns?

Accepted Answer

Use Log Analytics in Cloud Logging with SQL queries. Log Analytics (powered by BigQuery) in Cloud Logging provides SQL-based analysis directly on logs without needing to export.

Answer

Enable VPC Flow Logs on a new VM and capture traffic

Answer

Export logs to Cloud Storage and analyze with a local tool

Answer

Create a log sink to BigQuery and use BigQuery for analysis

Question 3

A security team needs to monitor and log all Google Cloud administrator access to customer data stored in Cloud Storage and BigQuery. They want to receive near-real-time alerts when such access occurs. Which two services should they use together? (Choose TWO).

Accepted Answer

Access Transparency. Access Transparency provides logs of Google admin access to customer content. These logs are delivered to the customer's Cloud project. Cloud Audit Logs can be used to route Access Transparency logs to Pub/Sub, and then Cloud Functions can process them for alerts. Cloud Monitoring can create alerting policies based on log metrics. Cloud DLP is for data inspection, not for logging access. Cloud KMS is for key management.

Answer

Cloud DLP

Answer

Cloud KMS

Answer

Cloud Functions

Question 4

A security engineer is designing a data residency strategy for a healthcare organization that must keep all data within the European Union. They plan to use Assured Workloads to meet this requirement. Which THREE additional controls should they implement to further enforce data residency and protect data? (Choose three.)

Accepted Answer

Organization policy constraint gcp.resourceLocations set to allow only European regions.. To enforce data residency, you can use Organization Policy constraints to restrict resource locations, VPC Service Controls to prevent data exfiltration, and Access Transparency to monitor Google personnel access. Cloud HSM is about key storage, not residency; Data Loss Prevention is about data classification, not residency.

Answer

Cloud HSM to store encryption keys.

Answer

Cloud DLP to scan for sensitive data.

Question 5

An organization wants to enforce data loss prevention (DLP) for sensitive data stored in Cloud Storage. Which THREE of the following Google Cloud services can be used together to inspect, classify, and automatically redact sensitive data in Cloud Storage? (Choose three.)

Accepted Answer

Cloud Storage. Cloud Storage is the target data repository where sensitive data resides, making it a necessary component of the DLP workflow. The Cloud Data Loss Prevention (DLP) API inspects and classifies the data, and Cloud Functions can be triggered by Cloud Storage events to automatically redact or transform the sensitive content before it is stored or accessed.

Answer

BigQuery

Answer

Dialogflow CX

Question 6

A company uses Organization Policies to restrict resource locations. They want to allow resources only in 'us-central1' and 'europe-west1'. They also need to allow a specific project to use 'us-east1' for a temporary workload. What is the correct organization policy configuration?

Accepted Answer

Set an organization policy with constraint 'gcp.resourceLocations' and allowed values 'us-central1' and 'europe-west1'. On the specific project, set a policy with allowed values 'us-central1', 'europe-west1', and 'us-east1'.. Organization Policies with the 'gcp.resourceLocations' constraint enforce location restrictions hierarchically. By setting allowed values at the organization level to 'us-central1' and 'europe-west1', all projects inherit these restrictions. Overriding the policy on the specific project by adding 'us-east1' to the allowed list creates a more permissive policy that still respects the organization-level constraints, allowing the temporary workload in 'us-east1'.

Answer

Set an organization policy with constraint 'gcp.resourceLocations' and denied values 'asia-*', 'australia-*', etc. On the specific project, set a policy with allowed values 'us-east1'.

Answer

Set an organization policy with constraint 'gcp.resourceLocations' and allowed values 'us-central1', 'europe-west1'. Use tags to mark the project and create a conditional policy that adds 'us-east1' when the tag is present.

Answer

Set an organization policy with constraint 'gcp.resourceLocations' and allowed values 'us-central1', 'europe-west1'. On the specific project, set a policy with denied values 'us-east1'.

Question 7

A security engineer is reviewing the IAM policy of a Cloud Storage bucket that contains sensitive data. The exhibit shows the current policy. A developer reports that they can read objects in the bucket using service account sa-2, but they cannot delete objects. What is the most likely reason?

Accepted Answer

The service account sa-2 has roles/storage.objectAdmin, which includes delete permissions, but there might be a condition or organization policy preventing deletion. The IAM policy shows that service account sa-2 has the roles/storage.objectAdmin role, which includes the storage.objects.delete permission. However, the presence of a condition or an organization policy (such as a VPC Service Controls perimeter or a boolean constraint) can override this permission, preventing deletion even though the role is assigned. The developer can read objects (permitted by the role) but cannot delete them, indicating that a higher-level policy is blocking the delete action.

Answer

There is an explicit deny on the bucket for sa-2

Answer

The bucket has uniform bucket-level access disabled, so ACLs override IAM

Answer

The service account sa-2 actually has roles/storage.objectViewer, not objectAdmin

Question 8

A multinational organization must store customer data only in specific geographic regions to comply with data residency regulations. They use Cloud Spanner for their primary database. What should they do to enforce that data is stored only in approved regions?

Accepted Answer

Apply an organization policy with a constraint that restricts the location of Cloud Spanner resources to approved regions.. Organization policies with resource location constraints allow you to enforce that Cloud Spanner instances are created only in approved geographic regions. This policy is evaluated at resource creation time and prevents the deployment of Spanner instances outside the specified regions, directly addressing data residency compliance requirements.

Answer

Create a Cloud Spanner instance in the desired region and configure a backup in a different region for disaster recovery.

Answer

Configure a VPC Service Controls perimeter to restrict access to Cloud Spanner.

Answer

Use Cloud Spanner with data residency constraints by selecting a multi-region configuration that includes only approved regions.

Question 9

Which THREE steps are required to implement field-level encryption for sensitive columns in a Cloud SQL for PostgreSQL database using Cloud KMS? (Choose three.)

Accepted Answer

Create a symmetric encryption key in Cloud KMS.. Cloud KMS symmetric encryption keys are used to encrypt data encryption keys (DEKs) that protect the column data. In field-level encryption, the application or database encrypts each column value using a DEK, which is then wrapped (encrypted) by a Cloud KMS key. This ensures the sensitive data is encrypted at the application layer, independent of the underlying storage encryption.

Answer

Configure a Cloud HSM key to generate the data encryption key.

Answer

Enable CMEK on the Cloud SQL instance.

Question 10

A company has a VPC Service Controls perimeter that includes BigQuery and Cloud Storage. They need to allow a specific on-premises application (with a static IP) to access a BigQuery dataset within the perimeter. Which configuration should they use?

Accepted Answer

Add the on-premises IP to an access level and create an ingress rule in the service perimeter.. VPC Service Controls allows ingress rules to permit traffic from specific identities or IP ranges into the perimeter. They need to create an ingress rule that allows the on-premises IP to access BigQuery.

Answer

Create a VPC firewall rule allowing ingress from the on-premises IP to the BigQuery API.

Answer

Exempt the on-premises service account from the perimeter.

Answer

Use Private Google Access from the on-premises network.

Question 11

An organization wants to ensure that all new resources created in Google Cloud are restricted to a specific set of regions to meet data residency requirements. Which policy should they use?

Accepted Answer

Configure the `gcp.resourceLocations` organization policy constraint. The org policy constraint `gcp.resourceLocations` restricts resource creation to the specified locations. This is the correct method to enforce data residency for resources globally.

Answer

Define a service perimeter using VPC Service Controls

Answer

Use IAM conditions to deny access outside approved regions

Answer

Enable Data Residency in Cloud Console settings

Question 12

A company uses Shared VPC in a host project with multiple service projects. The security team wants to ensure that all traffic between service projects is inspected by a third-party firewall appliance deployed in the host project. Which configuration should be implemented?

Accepted Answer

Create a policy-based route in the host project that matches traffic between service project subnets and has a next hop to the firewall appliance's internal IP.. A policy-based route in the host project can match traffic based on source and destination subnets from different service projects and force that traffic to be forwarded to the next-hop IP of the third-party firewall appliance. This ensures all inter-service-project traffic is inspected by the firewall, as the route overrides the default VPC routing behavior within the Shared VPC environment.

Answer

Enable Cloud NAT on each service project and configure a default route to the firewall appliance.

Answer

Set up VPC network peering between service projects and route traffic through the host project via a VPN tunnel.

Answer

Create a firewall rule in the host project that allows traffic between service projects only if the source is the firewall appliance.

Question 13

Match each compliance framework to its focus area.

Accepted Answer

SOC 2: Security, availability, processing integrity, confidentiality, and privacy.. SOC 2 addresses security, availability, and privacy; HIPAA protects health information. Common confusions involve mixing FedRAMP with SOC 2 and PCI DSS with HIPAA.

Answer

SOC 2: Cloud security for US federal agencies.

Answer

HIPAA: Credit card data security.

Question 14

A security engineer is configuring VPC Service Controls to protect a Google Cloud project containing sensitive data. The project contains Compute Engine instances, Cloud Storage buckets, and BigQuery datasets. The perimeter is defined with the project as a protected project. Which TWO actions are valid to restrict data exfiltration while maintaining necessary access?

Accepted Answer

Configure the service perimeter to allow access from the VPC network where the Compute Engine instances reside using private Google access.. VPC Service Controls can allow traffic from a specific VPC network via private Google access, which uses RFC 1918 addresses and does not traverse the public internet. This restricts data exfiltration by ensuring that only resources within the defined VPC can access the protected services, while still allowing legitimate Compute Engine instances to reach Cloud Storage and BigQuery within the perimeter.

Answer

Use VPC Service Controls to block access to the Compute Engine metadata server to prevent credential extraction.

Answer

Create a service perimeter that includes all Google Cloud projects in the organization to simplify management.

Answer

Use VPC Service Controls to restrict access based on network tags on Compute Engine instances.

Question 15

Which GCP service provides managed intrusion detection by analyzing mirrored network traffic and using threat signatures from Palo Alto Networks?

Accepted Answer

Cloud IDS. Cloud IDS is a managed intrusion detection service that uses packet mirroring to inspect traffic and applies Palo Alto Networks threat signatures.

Answer

Security Command Center

Answer

Chronicle

Answer

Cloud Armor

Question 16

A company has a VPC with several subnets. They want to allow HTTP traffic from the internet to a web server in subnet-a, but block all other inbound traffic. What is the simplest firewall rule configuration?

Accepted Answer

Create an ingress rule allowing tcp:80 from 0.0.0.0/0 to instances with the 'web-server' tag. The implied deny all ingress rule blocks other traffic.. It creates an ingress rule that explicitly allows TCP port 80 traffic from any source (0.0.0.0/0) to instances tagged as 'web-server'. In cloud VPC firewalls (e.g., AWS Security Groups or GCP Firewall Rules), the default behavior is an implied deny all ingress traffic; only explicitly allowed traffic is permitted. This configuration satisfies the requirement to allow HTTP from the internet while blocking all other inbound traffic without needing additional rules.

Answer

Create an ingress rule allowing all tcp and udp traffic from 0.0.0.0/0.

Answer

Create an egress rule allowing tcp:80 from the internet to the web server.

Answer

Create an ingress rule allowing tcp:80 from the web server's internal IP range. The implied deny all ingress rule blocks other traffic.

Question 17

Which IAM role should be assigned to a user who needs to manage Cloud Storage objects in a specific project, but should not be able to create or delete buckets?

Accepted Answer

roles/storage.objectAdmin. The correct role is roles/storage.objectAdmin. This role grants full control over Cloud Storage objects, including the ability to read, write, update, and delete objects, but it does not allow any operations on buckets (create, delete, or configure). The user needs to manage objects (which includes write and delete operations) but should not be able to create or delete buckets. Storage Object Admin fits this requirement. Option C, roles/storage.objectViewer, only provides read-only access and does not allow management. Option B, roles/storage.admin, provides full control over both buckets and objects, including create and delete permissions. Option A, roles/storage.legacyBucketReader, only allows reading bucket metadata, not objects.

Answer

roles/storage.legacyBucketReader

Answer

roles/storage.admin

Answer

roles/storage.objectViewer

Question 18

A developer wants to run a containerized application on GKE that needs to read from a Cloud Storage bucket. The developer needs to securely provide credentials. What is the recommended approach?

Accepted Answer

Create a Google service account with necessary permissions, create a Kubernetes service account, and configure Workload Identity to bind them.. The recommended approach is to use Workload Identity to bind a Kubernetes service account to a Google service account. This avoids managing keys and allows fine-grained access. The developer should create a GCP service account with the Storage Object Viewer role, then create a Kubernetes service account, and bind them using Workload Identity. The pod should use the Kubernetes service account.

Answer

Use the default compute engine service account for the GKE nodes.

Answer

Store the service account key in Cloud Secret Manager and retrieve it in the pod at startup.

Answer

Create a service account key, store it as a Kubernetes secret, and mount it in the pod.

Question 19

A financial institution uses Cloud HSM to protect cryptographic keys used for signing sensitive transactions. They want to ensure that keys are never exportable and that key usage is logged. Which key type should they create in Cloud HSM?

Accepted Answer

Purpose: ASYMMETRIC_SIGN with algorithm: RSA_SIGN_PKCS1_2048_SHA256. Cloud HSM supports ASYMMETRIC_SIGN key purpose with RSA_SIGN_PKCS1_2048_SHA256, which creates a non-exportable key pair used for signing. Cloud HSM ensures the private key never leaves the HSM boundary, and all key usage is automatically logged via Cloud Audit Logs, meeting the requirements for non-exportability and logging.

Answer

Purpose: SYMMETRIC_ENCRYPT_DECRYPT with algorithm: GOOGLE_SYMMETRIC_ENCRYPTION

Answer

Purpose: ASYMMETRIC_DECRYPT with algorithm: RSA_DECRYPT_OAEP_2048_SHA256

Answer

Purpose: MAC with algorithm: HMAC_SHA256

Question 20

Refer to the exhibit. A security engineer runs the following IAM policy command for a Cloud Storage bucket. What access does the bindings grant?

Accepted Answer

alice and all users from example.com can view objects; the service account can admin all objects.. The IAM policy bindings grant `roles/storage.objectViewer` to user `alice@example.com` and to all authenticated users from the `example.com` domain (via `domain:example.com`), and `roles/storage.objectAdmin` to a service account. The viewer role allows listing and reading objects, while the admin role allows full control over objects, including creation, deletion, and modification. There is no public access granted because the bindings do not include `allUsers` or `allAuthenticatedUsers`.

Answer

alice can view objects; example.com users can view objects; service account can admin objects.

Answer

alice and example.com domain can view; service account can admin; and the public can view because of domain.

Answer

alice can view; example.com can view; service account can admin; but only if the bucket is public.