PCSE Practice Test 8 — 10 Questions

Question 1

Refer to the exhibit. The security team created this key for encrypting database backups. After an audit, they found that data encrypted before May 1, 2023, cannot be decrypted. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Key version 1 was deleted after the new primary was created.. When a new primary key version is created in Cloud KMS, the old primary key version is not automatically deleted. However, if the old key version (version 1) was manually deleted after promoting version 2 as the primary, any data encrypted with version 1 becomes permanently undecryptable. The audit finding that data encrypted before May 1, 2023 cannot be decrypted directly indicates that the key version used for that encryption (likely version 1) is no longer available, not just disabled or rotated.

Answer

The rotation period is too short, causing old versions to be destroyed.

Answer

The primary key version is disabled.

Answer

The algorithm GOOGLE_SYMMETRIC_ENCRYPTION is not supported by HSM.

Question 2

A security engineer notices that some developers are still uploading their own public SSH keys to Compute Engine instances despite the organization policy above being applied to the folder. What is the most likely reason?

Accepted Answer

The policy disables uploading service account keys, not user SSH keys.. The organization policy described likely restricts the uploading of service account keys, not user SSH keys. The policy in question is typically the 'Disable service account key upload' constraint (iam.disableServiceAccountKeyUpload), which prevents users from creating or uploading external service account keys. It does not affect the ability to add public SSH keys to Compute Engine instances, which is governed by separate metadata-based mechanisms (e.g., oslogin or instance metadata). Therefore, developers can still upload their own SSH keys despite the policy being applied.

Answer

The policy only applies to projects, not folders.

Answer

The policy takes 24 hours to propagate to all projects.

Answer

The policy was applied at the organization level, not the folder level.

Question 3

A healthcare organization must store protected health information (PHI) in Google Cloud and ensure compliance with HIPAA. They need to prevent data from being stored outside the United States. Which Google Cloud product should they use to enforce this requirement?

Accepted Answer

Organization Policy. Organization Policy allows you to define and enforce constraints on Google Cloud resources at the organization, folder, or project level. The `gcp.resourceRestriction` constraint can be used to restrict the location where data can be stored, ensuring PHI remains within the United States to meet HIPAA requirements.

Answer

Cloud Healthcare API

Answer

VPC Service Controls

Answer

Cloud Data Loss Prevention (DLP) API

Question 4

Refer to the exhibit. A developer created the firewall rule to allow HTTPS traffic from the API service account to instances tagged 'api-instances'. However, HTTPS requests from the API server (which runs on an instance with tag 'api-instances' and uses the default compute engine service account) are failing. What is the most likely cause?

Accepted Answer

The source instance is using the default compute engine service account, not the specified api-sa.. The firewall rule explicitly specifies the source as the API service account (api-sa), but the API server is using the default compute engine service account. In Google Cloud, firewall rules that use sourceServiceAccounts match traffic based on the service account attached to the source instance, not the instance's tags or the service account used by the application. Since the source instance's service account does not match the rule's specified service account, the HTTPS traffic is implicitly denied.

Answer

The rule should have a higher priority to override the default implicit deny.

Answer

The direction should be EGRESS because the traffic originates from the API server.

Answer

The rule should use sourceTags instead of sourceServiceAccounts to match the source instance.

Question 5

A financial services company is migrating to Google Cloud and needs to enforce strict security controls. They want to ensure that: 1) No service account keys are created. 2) All Compute Engine instances must be created with Shielded VM enabled. 3) Only users from the corporate domain (example.com) can be granted IAM roles. Which THREE Organization Policy constraints must be used? (Choose three.)

Accepted Answer

constraints/iam.allowedPolicyMemberDomains. The three constraints are: constraints/iam.disableServiceAccountKeyCreation (prevents key creation), constraints/compute.requireShieldedVm (requires Shielded VM), and constraints/iam.allowedPolicyMemberDomains (restricts IAM members to specific domains). The other constraints are not relevant: constraints/compute.restrictCloudArmorPolicies is about Cloud Armor policies, and constraints/compute.requireOsLogin is about OS Login.

Answer

constraints/compute.requireOsLogin

Answer

constraints/compute.restrictCloudArmorPolicies

Question 6

A financial services company must ensure that all data stored in Cloud Storage is encrypted with customer-managed encryption keys (CMEK) that are rotated every 90 days. They have enabled Organization Policy constraints to enforce CMEK. However, some new buckets are still being created without CMEK. What is the most likely cause?

Accepted Answer

The Organization Policy constraint is not applied to the folder that contains the project.. Organization Policy constraints are hierarchical and must be applied at the project, folder, or organization level to take effect. If the constraint is applied only at the organization level but the project resides in a folder that does not inherit the policy (or the constraint is not applied to that folder), the policy will not enforce CMEK on buckets created in that project. This explains why new buckets can still be created without CMEK despite the policy being enabled elsewhere.

Answer

VPC Service Controls are blocking the use of CMEK.

Answer

The buckets are created using a service account that has the CMEK permission but the key ring is not in the same region.

Answer

The buckets are using the Archive storage class, which does not support CMEK.

Question 7

A financial institution is deploying a PCI DSS-compliant web application on Google Cloud. They need to isolate the cardholder data environment (CDE) from other environments and protect the web application against common web attacks. Which combination of services meets these requirements?

Accepted Answer

VPC Service Controls and Cloud Armor. VPC Service Controls create a perimeter around Google Cloud resources to prevent data exfiltration. Cloud Armor is a web application firewall that protects against OWASP Top 10 attacks. Together they isolate the CDE and protect the application. Cloud IDS is for network threat detection, not isolation. Cloud NAT provides outbound internet access, not security. Cloud Load Balancing distributes traffic but does not isolate.

Answer

Cloud NAT and Cloud IDS

Answer

Identity-Aware Proxy (IAP) and Cloud Storage

Answer

Shared VPC and Cloud Load Balancing

Question 8

A company has a global HTTPS load balancer and wants to use a self-managed SSL certificate. They have uploaded the PEM-encoded certificate and private key to the load balancer. However, the certificate is about to expire. What is the correct way to renew it without downtime?

Accepted Answer

Create a new SSL certificate resource with the new certificate and key, then update the target HTTPS proxy to use it. To renew a self-managed certificate, you create a new SSL certificate resource with the updated certificate and key, and then update the load balancer's target HTTPS proxy to use the new certificate. This can be done without downtime by updating the proxy.

Answer

Use gcloud compute ssl-certificates update to replace the certificate

Answer

Update the existing SSL certificate resource with the new certificate and key

Answer

Delete the existing certificate and upload the new one with the same name

Question 9

A company needs to grant developers the ability to deploy applications to App Engine, but they should not be able to modify IAM policies. Which two roles should be assigned to the developers? (Choose two.)

Accepted Answer

roles/appengine.serviceAdmin. The correct roles are App Engine Deployer and App Engine Service Admin. App Engine Admin includes IAM policy modification.

Answer

roles/owner

Answer

roles/appengine.appViewer

Answer

roles/appengine.appAdmin

Question 10

During a security incident, a forensics team needs to capture a disk snapshot of a compromised Compute Engine instance for analysis. They want to ensure the snapshot is consistent and includes data in memory. Which step should be taken before taking the snapshot?

Accepted Answer

Stop the instance before taking the snapshot. For consistent snapshots of a running instance, you should first stop the instance (or at least freeze the filesystem). To capture memory, you would need to use a tool like LiME or dump the memory via a hypervisor; standard disk snapshots do not capture memory. However, the question asks about disk snapshot consistency; the best practice is to stop the instance.

Answer

Take a snapshot while the instance is running; consistency is automatic

Answer

Enable VPC Flow Logs on the network

Answer

Create an image from the disk first