PCSE Practice Exam 63 — 20 Questions

Question 1

A large financial institution runs a critical application on Google Kubernetes Engine (GKE) clusters. Their security policy requires that all container images must be scanned for vulnerabilities and must come from a trusted artifact registry. They use Cloud Build to automatically build images from a CI/CD pipeline and push them to Artifact Registry. They want to enforce that only images that have passed vulnerability scanning and are signed can be deployed to the GKE cluster. Currently, they have set up Cloud Build to automatically tag images with a 'latest' tag on successful build, but they need a mechanism to prevent deployment of unsigned or vulnerable images. They also want to audit any attempts to deploy non-compliant images. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Binary Authorization on the GKE cluster, create Attestations for images that pass vulnerability scanning and signing in Cloud Build, and configure admission control to require attestations.. Combining Binary Authorization with Attestations from vulnerability and signing enables enforcement. Option A is incorrect because Cloud Nat is for outbound traffic, not image enforcement. Option B is incorrect because GKE policy does not natively enforce image contracts. Option C is incorrect because IAP is for access, not for image verification.

Answer

Use Cloud NAT to control which images can be pulled by GKE nodes.

Answer

Configure GKE policy to only allow images from a specific Artifact Registry repository and enable vulnerability scanning.

Answer

Use Cloud IAP to block nodes from pulling non-compliant images.

Question 2

A company uses Cloud Functions and wants to ensure that only authorized services can invoke them. The functions are triggered via HTTP. What is the best way to achieve this?

Accepted Answer

Use Cloud Endpoints with API keys and IAM.. Cloud Endpoints can authenticate and authorize requests using API keys and IAM, providing fine-grained access control for HTTP-triggered Cloud Functions. Option A is not suitable because VPC connectors are for internal network access, not for authorization. Option C is insecure as URLs can be guessed or leaked. Option D (Firebase Authentication) is designed for mobile client authentication, not for service-to-service authorization.

Answer

Set a VPC connector and allow only internal traffic.

Answer

Rely on the Cloud Functions URL being unguessable.

Answer

Use Firebase Authentication.

Question 3

Your organization uses Cloud Armor to protect against web attacks. After a change to the security policy, legitimate traffic from certain IPs is being blocked. You need to quickly allow that traffic while preserving the security policy. What should you do?

Accepted Answer

Add a higher priority allow rule for those IPs. Adding a higher priority allow rule for the affected IPs allows the traffic without removing the security policy. Other options either remove protection or are ineffective.

Answer

Remove the offending rule from the security policy

Answer

Enable logging on the security policy

Answer

Set the security policy to preview mode

Question 4

A security engineer is troubleshooting a VPC firewall rule that is not allowing traffic from a specific subnet to a Compute Engine instance. The target tag is set correctly. What is the most likely cause?

Accepted Answer

A deny rule with a higher priority (lower number) exists and blocks the traffic.. If a deny rule with a lower priority number (higher priority) exists, it will take precedence and block traffic despite an allow rule. Option B is incorrect because the instance's internal IP address does not affect the source range check. Option C is incorrect because the problem states the target tag is set correctly. Option D is incorrect because the rule is in the correct network.

Answer

The firewall rule is in the wrong network.

Answer

The instance has an internal IP address that is not within the source range of the rule.

Answer

The firewall rule's target tag is misspelled.

Question 5

A financial services company must retain audit logs for seven years to meet regulatory requirements. They are using Cloud Audit Logs. Which strategy should they implement to ensure logs are not deleted or modified during the retention period?

Accepted Answer

Export logs to Cloud Storage and apply a retention policy that is locked to prevent deletion.. Cloud Storage buckets with a locked retention policy provide immutable storage, preventing any deletion or modification of objects during the retention period. This meets the regulatory requirement for audit logs to be retained for seven years without alteration. Exporting logs to Cloud Storage and locking the retention policy ensures compliance with data retention regulations.

Answer

Export logs to BigQuery and set table expiration to 7 years.

Answer

Export logs to a Pub/Sub topic, then subscribe and store in a custom database.

Answer

Store logs in the default Cloud Logging bucket and set a retention period of 7 years.

Question 6

A DevOps team wants to allow a CI/CD pipeline to deploy to Compute Engine using a service account. What is the best practice for managing service account keys?

Accepted Answer

Use workload identity federation.. Workload identity federation is the best practice because it allows the CI/CD pipeline to impersonate a service account without managing or storing any long-lived service account keys. This eliminates the risk of key leakage and rotation overhead, as authentication is done via an external identity provider (e.g., GitHub Actions, GitLab CI) using OIDC tokens. Google Cloud's workload identity federation supports OIDC (OpenID Connect) and SAML 2.0, enabling secure, keyless access from external workloads.

Answer

Use a service account key distributed to each developer.

Answer

Generate a key and store it in Cloud Secret Manager.

Answer

Use a service account key stored in the source code repository.

Question 7

A security engineer needs to audit all attempts to access a Cloud Storage bucket, including successful and failed attempts. Which logging option should they enable?

Accepted Answer

Cloud Audit Logs with Data Access. Cloud Audit Logs with Data Access logs capture read/write operations on data. Admin Read logs only record configuration changes, not data access. Cloud Monitoring is for metrics, not logs. VPC Flow Logs are for network traffic, not object-level access.

Answer

Cloud Audit Logs with Admin Read

Answer

Cloud Monitoring with uptime checks

Answer

VPC Flow Logs

Question 8

A company needs to meet compliance requirements that mandate they be notified about all actions performed by Google personnel on their data. Which Google Cloud feature should they enable?

Accepted Answer

Access Transparency. Access Transparency logs provide records of actions taken by Google staff on customer data, fulfilling compliance notification requirements. It must be enabled at the organization level.

Answer

Cloud Asset Inventory

Answer

Access Approval

Answer

Cloud Audit Logs for Admin Activities

Question 9

A security engineer is troubleshooting connectivity issues between two Compute Engine instances in the same VPC but in different subnets. Both instances have internal IPs and are in the same region. The firewall rules allow ingress from 10.0.0.0/8. However, traffic is failing. What is the most likely cause?

Accepted Answer

The ingress firewall rule is applied to a network tag that is not assigned to the destination instances.. Firewall rules in Google Cloud VPC are applied to the destination instance based on network tags, not just the subnet or IP range. If the ingress rule allowing traffic from 10.0.0.0/8 is configured with a target tag that is not assigned to the destination Compute Engine instances, the rule will not apply, and traffic will be dropped. This is a common misconfiguration when using tags to selectively apply firewall rules.

Answer

The instances are using external IPs and the source IP is being NATed.

Answer

The VPC has dynamic routing mode set to global, causing routing conflicts.

Answer

There is a firewall rule with a lower priority that denies egress traffic between subnets.

Question 10

Which THREE steps are necessary to ensure that a Google Cloud project complies with FedRAMP Moderate baseline requirements for access control? (Choose three.)

Accepted Answer

Set up session expiration policies that automatically log out inactive users after 15 minutes.. FedRAMP Moderate requires session timeout policies to mitigate the risk of unauthorized access from unattended sessions. Google Cloud IAM session settings allow you to enforce a maximum session duration, and setting it to 15 minutes aligns with the FedRAMP requirement for automatic logout of inactive users. This directly addresses the access control family (AC-12) in the FedRAMP baseline.

Answer

Configure Cloud NAT to allow instances to access the internet without public IPs.

Answer

Implement VPC Service Controls to prevent data exfiltration.

Question 11

A company uses hierarchical firewall policies at the organization level to enforce a baseline deny-all rule. A project administrator wants to create a firewall rule that allows HTTP traffic to a specific VM. Which statement is correct?

Accepted Answer

The project administrator cannot allow HTTP because the hierarchical policy denies all traffic.. Hierarchical firewall policies are inherited and cannot be overridden by lower-level rules. The deny-all rule from the policy takes precedence over any VPC firewall rule that would allow traffic.

Answer

The project administrator can modify the hierarchical policy to allow HTTP.

Answer

The project administrator can create a VPC firewall rule to allow HTTP, and it will work if the policy is not enforced.

Answer

The project administrator can create a VPC firewall rule with higher priority to override the policy.

Question 12

An organization uses Google Workspace for email and collaboration. They want to allow employees to sign in to a custom web application using their Google Workspace credentials. The application runs on Compute Engine and uses a PostgreSQL database. Which identity solution should they implement?

Accepted Answer

Cloud Identity-Aware Proxy (IAP) with OIDC.. IAP with OIDC is the correct approach. IAP integrates with Google identity (including Google Workspace) and provides authentication and authorization for web applications. OIDC is the protocol used to verify identity. SAML is for SSO but IAP uses OIDC. Firebase Auth is for consumer apps. Cloud Identity-Aware Proxy (IAP) is specifically designed for this use case.

Answer

Workload Identity Federation.

Answer

SAML 2.0 federation with the web app.

Answer

Firebase Authentication with Google provider.

Question 13

To comply with regulatory requirements, a company needs to prevent service account keys from being created for all projects. What should they use?

Accepted Answer

Organization policy with a constraint. Organization policies with constraints allow you to enforce restrictions across all projects in an organization. The `constraints/iam.disableServiceAccountKeyCreation` constraint specifically prevents the creation of service account keys, ensuring compliance with regulatory requirements that prohibit long-lived keys. This is a native Google Cloud IAM feature that applies at the organization, folder, or project level.

Answer

VPC Service Controls

Answer

Security Command Center

Answer

IAM conditions

Question 14

A company uses Cloud DLP to inspect BigQuery tables for sensitive data. They want to automatically de-identify the data as it is inserted into a new table using a DLP de-identification template. Which approach should they use?

Accepted Answer

Create a DLP de-identification template and apply it to the BigQuery table using a DLP job.. Cloud DLP can be used to create a de-identification template and then apply it to data in BigQuery via a DLP job or by using the DLP API to transform data on the fly. However, to automatically de-identify data as it is inserted, a common pattern is to use Cloud Functions triggered by BigQuery streaming inserts or scheduled DLP jobs that transform the data and write to a new table.

Answer

Use Cloud Audit Logs to monitor insertions and manually run a DLP transformation.

Answer

Use Cloud DLP inspection job triggers to scan the table and send notifications.

Answer

Use BigQuery column-level security with data masking rules.

Question 15

A company must process credit card transactions on Google Cloud and achieve PCI DSS compliance. They want to minimize the scope of the cardholder data environment (CDE). Which architectural approach should they take?

Accepted Answer

Create a separate VPC for the CDE, and route traffic through a dedicated project with VPC Service Controls and Private Google Access.. Network segmentation is key to minimizing PCI DSS scope. A separate VPC for the CDE, combined with VPC Service Controls, isolates cardholder data.

Answer

Use separate VPCs for the CDE and non-CDE workloads, and connect them using VPC peering with firewall rules to restrict traffic.

Answer

Use a Shared VPC with a dedicated subnet for CDE resources and apply strict firewall rules.

Answer

Place all workloads in a single VPC and use Cloud Armor to protect the CDE.

Question 16

You are a security engineer for a healthcare organization. You need to protect sensitive patient data stored in Cloud Storage. You want to ensure that data is encrypted at rest using a customer-managed key (CMEK) and that access to the key is logged. You also need to prevent data exfiltration by limiting which service accounts can decrypt data. Which TWO steps should you take? (Choose two.)

Accepted Answer

Configure a VPC Service Controls perimeter that includes the Cloud Storage bucket and the KMS key.. VPC Service Controls creates a security perimeter around the Cloud Storage bucket and the KMS key, preventing data exfiltration by blocking unauthorized service accounts from decrypting data outside the perimeter. Option E is correct because creating a Cloud KMS key ring and key, configuring the bucket to use CMEK, and enabling Cloud Audit Logs for the KMS key ensures encryption at rest with a customer-managed key and logs all access to the key, meeting both requirements.

Answer

Use Cloud HSM to create and manage the encryption key, and disable Cloud Audit Logs for the HSM key.

Answer

Enable default encryption (Google-managed key) on the bucket and use Cloud Audit Logs to monitor access.

Answer

Use customer-supplied encryption keys (CSEK) and store the key in Cloud Key Management Service (KMS).

Question 17

An organization wants to enforce that all Compute Engine instances are created with a specific service account that has only the permissions defined by a custom role. Additionally, users must not be able to override this service account. Which two mechanisms should be combined?

Accepted Answer

An Organization Policy with constraint constraints/compute.setServiceAccount and an IAM deny policy to deny the iam.serviceAccounts.actAs permission on other service accounts.. It combines an Organization Policy constraint (`constraints/compute.setServiceAccount`) that prevents users from specifying a different service account when creating Compute Engine instances, with an IAM deny policy that blocks the `iam.serviceAccounts.actAs` permission on all other service accounts. Together, these enforce that only the designated service account can be used, and users cannot override it.

Answer

Use Cloud Audit Logs to monitor and alert on non-compliant instances.

Answer

VPC Service Controls to restrict the service account usage.

Answer

Grant users only the Compute Instance Admin v1 role and remove the actAs permission.

Question 18

Drag and drop the steps to rotate a customer-managed encryption key (CMEK) in Cloud KMS in the correct order.

Accepted Answer

Step 1: Create a new key version, Step 2: Update resources to use the new key version, Step 3: Verify that the new key version is being used, Step 4: Disable/retire the old key version.. Key rotation involves creating a new version, enabling rotation, updating resource associations, verifying, and retiring old keys.

Answer

Step 1: Create a new key version, Step 2: Disable/retire the old key version, Step 3: Update resources to use the new key version, Step 4: Verify that the new key version is being used.

Answer

Step 1: Update resources to use the new key version, Step 2: Create a new key version, Step 3: Verify that the new key version is being used, Step 4: Disable/retire the old key version.

Answer

Step 1: Create a new key version, Step 2: Verify that the new key version is being used, Step 3: Update resources to use the new key version, Step 4: Disable/retire the old key version.

Question 19

A company has a VPC network with a default route to the internet gateway. They want all egress traffic to go through a firewall appliance instead. They create a new route with a next hop to the appliance and a priority of 500. However, traffic is still going through the internet gateway. What is the most likely reason?

Accepted Answer

The new route's destination range is not 0.0.0.0/0. The default route to the internet gateway has a destination of 0.0.0.0/0. For the new route to override it, the new route must also have a destination of 0.0.0.0/0 (or a more specific prefix). If the new route's destination range is not 0.0.0.0/0, it will not match all egress traffic, and the existing default route with a lower priority (higher numerical value) will still be used for traffic that does not match the new route's destination.

Answer

The new route has a higher tag specification that overrides

Answer

The appliance does not have IP forwarding enabled

Answer

The firewall appliance is in a different network

Question 20

A company requires a secure, dedicated connection between their on-premises data center and Google Cloud with bandwidth of 10 Gbps and a 99.99% SLA. Which connectivity option should they use?

Accepted Answer

Use Dedicated Interconnect with two VLAN attachments. Dedicated Interconnect offers 10 Gbps or 100 Gbps connections with a 99.99% SLA when configured with redundant connections (e.g., two VLAN attachments). Option A is wrong because Direct Peering uses public IPs and does not provide an SLA. Option B is wrong because Partner Interconnect, while offering up to 10 Gbps, does not guarantee a 99.99% SLA—it varies by partner. Option C is wrong because Cloud VPN supports lower bandwidth (up to 3 Gbps per tunnel) and does not offer a 99.99% SLA.

Answer

Use Direct Peering

Answer

Use Partner Interconnect with a 10 Gbps connection

Answer

Use Cloud VPN with two tunnels for redundancy