PCSE Practice Test 7 — 10 Questions

Question 1

A company uses Security Command Center (SCC) Premium tier and wants to automatically trigger a Cloud Function to remediate a threat finding. Which approach should they use?

Accepted Answer

Configure SCC to send findings to a Pub/Sub topic, and subscribe a Cloud Function to that topic.. SCC can send real-time notifications via Pub/Sub when findings of certain types or severities are created. A Cloud Function can subscribe to that topic to perform automated remediation. Cloud Scheduler cannot be triggered by events; Cloud Tasks is for asynchronous task execution but not designed for event-driven triggers from SCC; Logs Router exports logs but does not directly trigger Cloud Functions based on findings.

Answer

Use Cloud Tasks to periodically invoke Cloud Functions after reading findings from Security Command Center API.

Answer

Create a Cloud Scheduler job that polls SCC findings periodically and invokes Cloud Functions.

Answer

Export SCC findings to Cloud Storage, and set up a Cloud Function on object finalize.

Question 2

A company has a VPC with a subnet (10.1.0.0/24) in us-central1. They have a Cloud NAT configured for outbound traffic to the internet. They want instances in this subnet to access a third-party API that is only accessible over the internet and requires a specific static source IP for whitelisting. What is the recommended approach?

Accepted Answer

Reserve a static NAT IP in Cloud NAT and whitelist that IP with the third party.. Cloud NAT allows instances without external IPs to initiate outbound connections to the internet. By reserving a static NAT IP address in Cloud NAT, you ensure all outbound traffic from the subnet uses a consistent source IP, which can be whitelisted by the third-party API. This meets the requirement for a static source IP without assigning external IPs to individual instances.

Answer

Assign external IPs to the instances and use network-level access controls.

Answer

Use Private Google Access to route traffic through Google's network.

Answer

Configure a VPC Service Controls perimeter to restrict egress.

Question 3

A GKE cluster has Workload Identity enabled. A Kubernetes service account is bound to a GCP service account named 'sa-gcs'. A pod using the Kubernetes service account fails to list objects in a Cloud Storage bucket. The GCP service account has the Storage Object Viewer role. What is the most likely cause?

Accepted Answer

The Kubernetes service account does not have the iam.workloadIdentityUser role on the GCP service account.. The pod must use the Kubernetes service account, but the GCP service account may not have the required permission (storage.objects.list). However, with Workload Identity, the pod authenticates as the GCP SA. The issue could be that the GCP SA does not have the role on the specific bucket, or the binding is misconfigured. But the most common cause is missing the iam.workloadIdentityUser role on the GCP SA for the Kubernetes service account to impersonate it. Without that, the pod cannot use the GCP SA.

Answer

The pod is using the wrong GCP service account.

Answer

The bucket has uniform bucket-level access disabled.

Answer

The GCP service account lacks the storage.objects.list permission.

Question 4

A security analyst wants to detect when a user creates a Compute Engine instance with a public IP address in a sensitive project. What is the best method?

Accepted Answer

Use Cloud Logging with a log-based metric and alert.. Cloud Logging with a log-based metric and alert enables real-time detection by monitoring compute.instances.insert log entries for external IPs. Option A is incorrect: Cloud Functions can trigger on instance creation but require custom logic and may have latency. Option B is incorrect: Data Access audit logs track data access, not admin operations like instance creation. Option D is incorrect: Cloud Asset Inventory is not real-time and better suited for compliance checks, not immediate alerting.

Answer

Create a Cloud Function that triggers on instance creation events.

Answer

Enable Data Access audit logs and filter for insert calls.

Answer

Use Cloud Asset Inventory to create a feed for instance creation.

Question 5

Match each CVE or security concept to its description.

Accepted Answer

CVE-2017-0144: Exploits SMB protocol to allow remote code execution (EternalBlue). Correct matches: CVE-2017-0144 (EternalBlue) exploits SMB; CVE-2021-44228 (Log4Shell) targets Log4j; CVE-2014-0160 (Heartbleed) leaks OpenSSL memory; buffer overflow is a general memory corruption. Distractors swap descriptions between CVEs.

Answer

CVE-2017-0144: Exploits Apache Log4j logging library

Answer

CVE-2021-44228: Leaks memory from OpenSSL

Question 6

A company subject to GDPR receives a request from a data subject to delete all personal data from BigQuery audit logs. The logs contain query execution details with user identifiers. How can the company comply with the right to erasure (right to be forgotten)?

Accepted Answer

Use the Data Subject Request tool in Google Cloud to request erasure of the specific personal data from audit logs. BigQuery audit logs (Cloud Audit Logs) are immutable and cannot be deleted directly by customers. To comply with erasure requests, the company must use the Data Subject Request tool to request removal, as Google retains logs for 30 days and may need to remove them.

Answer

Create a log sink to export logs to Cloud Storage, then delete the sink and the exported objects

Answer

Delete the entire BigQuery dataset containing the logs

Answer

Use Cloud DLP to redact personally identifiable information from the logs

Question 7

A company is using Cloud SQL for MySQL to store customer data subject to SOX compliance. They need to ensure that all database changes are audited and that logs are immutable. They have enabled audit logs and exported them to a Cloud Storage bucket. However, the auditor discovers that some logs were deleted from the bucket. What is the most likely cause?

Accepted Answer

The Cloud Storage bucket has a lifecycle rule that deletes objects after a set number of days.. Cloud Storage lifecycle rules can automatically delete objects after a specified number of days. If a lifecycle rule is configured on the bucket, it would delete audit logs regardless of the export process, making them unavailable to the auditor. This is the most likely cause of logs being deleted from the bucket, as the other options do not explain actual deletion of already-exported objects.

Answer

The log sink filter is excluding certain events, causing incomplete export.

Answer

The bucket has retention policy enabled, which prevents deletion until the retention period expires.

Answer

The service account used for export does not have the storage.objects.delete permission.

Question 8

An organization needs to store cryptographic keys that must be protected in a FIPS 140-2 Level 3 validated hardware security module (HSM). Which Google Cloud service should they use?

Accepted Answer

Cloud HSM. Cloud HSM provides FIPS 140-2 Level 3 validated HSM for key material. Keys are generated and stored in the HSM.

Answer

Secret Manager

Answer

Cloud KMS with software-backed keys

Answer

Cloud External Key Manager

Question 9

A healthcare organization is migrating applications to Google Cloud and must comply with HIPAA. They plan to store protected health information (PHI) in Cloud Storage and BigQuery. The security engineer needs to ensure that all access to PHI is logged and that the data is encrypted at rest with customer-managed keys. The organization also requires that any audit logs containing PHI are stored in a separate project with restricted access. Which course of action meets all requirements?

Accepted Answer

Enable Data Access audit logs for Cloud Storage and BigQuery, create a sink to route logs to a BigQuery dataset in a separate project, and use CMEK in the data project.. It meets all requirements: Data Access audit logs capture every access to PHI, a sink routes those logs to a BigQuery dataset in a separate project (fulfilling the separate-project storage requirement), and CMEK (customer-managed encryption keys) ensures encryption at rest with keys controlled by the organization. This combination satisfies HIPAA logging, encryption, and restricted-access log storage mandates.

Answer

Enable Data Access audit logs for Cloud Storage and BigQuery, and store logs in the same project. Use CMEK for encryption.

Answer

Use VPC Service Controls to create a perimeter around the project, and enable CMEK for encryption.

Answer

Enable Admin Read audit logs for Cloud Storage and BigQuery, and store logs in a different project. Use CSEK for encryption.

Question 10

A company using Google Cloud wants to conduct a penetration test on their infrastructure. According to Google's acceptable use policy, what must they do before testing?

Accepted Answer

Ensure that the tests do not include Denial of Service (DoS) attacks. Google's policy allows penetration testing on most services without prior approval, as long as the tests are not Denial of Service (DoS) attacks. This applies to common GCP services like Compute Engine, GKE, and Cloud Functions.

Answer

Create a separate VPC network for testing

Answer

Submit a request to Google support for each test

Answer

Enable VPC Flow Logs for monitoring