PCSE Practice Test 7 — 10 Questions

Question 1

A company's security policy requires that all traffic to a Google Cloud load balancer use TLS 1.2 or higher and only accept strong ciphers. They want to enforce this using a Google Cloud resource. Which resource should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SSL policy. SSL policies on HTTPS load balancers allow you to specify the minimum TLS version and cipher profile (e.g., RESTRICTED for strong ciphers). This enforces encryption requirements at the load balancer level.

Answer

Cloud Armor security policy

Answer

Network firewall rule

Answer

SSL certificate

Question 2

A company is migrating its on-premises Microsoft Active Directory to Google Cloud using Managed Microsoft AD (Microsoft AD). They need to ensure that users can authenticate to Compute Engine Windows instances using their on-premises credentials without additional user setup. What is the most secure and scalable approach?

Accepted Answer

Create a two-way trust between the Managed Microsoft AD domain and the on-premises AD domain.. Establishing a two-way trust between Managed Microsoft AD and the on-premises AD domain allows users to authenticate to Compute Engine Windows instances using their existing on-premises credentials without any additional user setup. This trust enables Kerberos authentication to flow seamlessly across the two domains, ensuring that on-premises users can access cloud resources securely and scalably without duplicating identities or credentials.

Answer

Configure the Windows instances to join the on-premises AD domain directly via VPN.

Answer

Synchronize on-premises users to Managed Microsoft AD using Google Cloud Directory Sync (GCDS).

Answer

Store on-premises user credentials in Cloud KMS and use a custom authentication script.

Question 3

A company stores sensitive customer data in Cloud Storage. They want to ensure that data is encrypted at rest using customer-managed encryption keys (CMEK) and that access to the key is audited. Which approach should they use?

Accepted Answer

Use CMEK with a Cloud KMS key and enable Cloud Audit Logs for the key.. It combines customer-managed encryption keys (CMEK) via Cloud KMS with Cloud Audit Logs enabled on the key itself. This ensures the data is encrypted at rest using a key that the customer controls and rotates, and all operations against that key (e.g., encrypt, decrypt, enable, disable) are logged for auditing. Cloud Audit Logs on the bucket alone would not capture key access events, which is required for full auditability.

Answer

Use Google-managed encryption keys and enable Cloud Audit Logs for the bucket.

Answer

Use CMEK with key material stored in a Cloud Storage bucket.

Answer

Use customer-supplied encryption keys (CSEK) and store the keys in Secret Manager.

Question 4

A financial services company needs to inspect all inbound and outbound packets from a subnet containing highly sensitive data for compliance. They have enabled VPC Flow Logs on that subnet, which record metadata such as source and destination IP, ports, and protocol. However, the security team requires the actual packet payload to perform deep packet inspection (DPI) for malicious patterns. They want to capture the packets without disrupting network traffic. Which additional configuration should be implemented to meet this requirement?

Accepted Answer

Enable Packet Mirroring on a Compute Engine instance in the subnet to mirror all packets to a collector instance.. Packet Mirroring clones all packets (including payload) from a source instance in the subnet and forwards them to a collector instance for deep packet inspection, without disrupting the original traffic flow. VPC Flow Logs only capture metadata (headers, timestamps) and cannot include payload content, making Packet Mirroring the only solution that meets the requirement for actual packet payload capture.

Answer

Configure Cloud Armor to log all HTTP requests with full request body.

Answer

Enable VPC Flow Logs with metadata capture set to 'include payload'.

Answer

Enable Cloud NAT logging to capture all outbound traffic payloads.

Question 5

An organization has a deny policy at the folder level that denies the permission resourcemanager.projects.create. A user has an allow policy at the project level granting roles/owner. What is the effective permission for the user to create projects in that project?

Accepted Answer

The user cannot create projects because the deny policy at the folder level explicitly denies the permission.. In Google Cloud IAM, deny policies always override allow policies regardless of where they sit in the resource hierarchy. A deny policy at the folder level that denies resourcemanager.projects.create will block the permission even though the user has roles/owner at the project level, because deny takes precedence over allow.

Answer

The user cannot create projects because the deny policy is at a higher level in the hierarchy.

Answer

The user can create projects because Owner role includes all permissions.

Answer

The user can create projects if the project-level allow is more specific.

Question 6

A healthcare organization is migrating to Google Cloud and needs to store Protected Health Information (PHI) in Cloud Storage. They have signed a Business Associate Agreement (BAA) with Google. Which additional step is REQUIRED to ensure HIPAA compliance for the data stored?

Accepted Answer

No additional action is required; Cloud Storage is HIPAA-eligible and encrypts data at rest by default.. Cloud Storage is a HIPAA-eligible service under Google Cloud's BAA, and it encrypts all data at rest by default using AES-256. Once a BAA is in place, no additional configuration is strictly required to store PHI in Cloud Storage from a HIPAA compliance standpoint — encryption at rest and in transit is automatic. Organizations may choose CMEK or other controls for policy reasons, but they are not required for HIPAA eligibility.

Answer

Use Customer-Managed Encryption Keys (CMEK) for the bucket.

Answer

Configure the bucket to be in a VPC with no public access.

Answer

Enable Object Versioning on the bucket.

Question 7

A security team needs to apply a set of firewall rules that enforce baseline security for all VPC networks across multiple projects in an organization. These rules must be inherited and cannot be overridden by project-level rules. What should they use?

Accepted Answer

Hierarchical firewall policies. Hierarchical firewall policies can be applied at the organization or folder level and are inherited by all VPC networks in the hierarchy. They cannot be overridden by lower-level firewall rules, making them ideal for baseline security policies. Network firewall policies are applied to a specific VPC network. VPC firewall rules are per project and can be overridden.

Answer

VPC firewall rules

Answer

Network firewall policies

Answer

Cloud Armor security policies

Question 8

A financial services company uses BigQuery for analytics and needs to implement column-level security such that users with the role 'data_scientist' can see the last four digits of credit card numbers, while the full number is visible only to 'data_owner'. What approach should they use?

Accepted Answer

Use a policy tag with a data masking rule that masks the full number except last four digits, and grant UNMASKED access to data_owner and MASKED access to data_scientist.. BigQuery's policy tags with data masking rules allow you to define column-level masking policies. By creating a masking rule that reveals only the last four digits of the credit card number, you can grant the `data_scientist` role MASKED access (which applies the mask) and the `data_owner` role UNMASKED access (which bypasses the mask). This approach enforces column-level security without duplicating data or using row-level filters.

Answer

Set an IAM condition on the table that filters the column based on the user's role.

Answer

Use row-level security to restrict rows based on role.

Answer

Create two separate BigQuery tables (one with masked data, one with full data) and grant access based on role.

Question 9

A security engineer is designing a solution to monitor and detect anomalous IAM role usage across multiple Google Cloud projects. The engineer wants to create a centralized logging solution that captures all IAM policy changes and access attempts. Which THREE services should the engineer use together to achieve this?

Accepted Answer

BigQuery. BigQuery is correct because it serves as the centralized analytics destination for Cloud Audit Logs, enabling the security engineer to run SQL queries across IAM policy changes and access attempts from multiple Google Cloud projects. By exporting audit logs to BigQuery, you can perform complex aggregations and anomaly detection at scale, which is essential for monitoring IAM role usage across a fleet of projects.

Answer

Cloud Monitoring

Answer

Cloud Functions

Question 10

A company uses Cloud KMS with automatic rotation enabled for a symmetric key. The rotation period is set to 90 days. After 90 days, a new key version is created. The compliance team asks: what happens to data encrypted with the old key version?

Accepted Answer

The old key version remains available for decryption of existing data.. When Cloud KMS rotates a symmetric key, it creates a new key version but does not delete or disable the old version. The old key version remains enabled and available for decryption, so data encrypted with it can still be decrypted. New encryptions use the new primary version, but existing ciphertext is unaffected.

Answer

The old key version is immediately disabled, and all data must be re-encrypted.

Answer

Data encrypted with the old key is automatically re-encrypted with the new key.

Answer

The old key version is deleted after the rotation period.