PCSE Practice Test 8 — 10 Questions

Question 1

Which Cloud Armor feature uses machine learning to detect and mitigate DDoS attacks?

Accepted Answer

Adaptive Protection. Cloud Armor Adaptive Protection uses ML-based DDoS detection to automatically learn normal traffic patterns and alert or mitigate attacks.

Answer

Preconfigured WAF rules

Answer

Rate limiting

Answer

Custom rules

Question 2

A developer wants to grant a Compute Engine instance access to read objects from a Cloud Storage bucket. The instance runs under a service account. What is the best practice for granting this access?

Accepted Answer

Assign the Storage Object Viewer role to the service account attached to the instance.. The best practice is to assign the appropriate IAM role (e.g., Storage Object Viewer) to the service account that the instance is running as. Then, the instance can use the service account's credentials automatically via the metadata server. This avoids the need to manage service account keys. Generating keys is discouraged. Allowing the instance to use the default compute engine service account is common but less secure; a custom service account with minimal permissions is preferred.

Answer

Create an IAM policy on the bucket that grants access to the instance's external IP address.

Answer

Use a signed URL with a long expiration time for the instance.

Answer

Generate a JSON key for the service account, download it to the instance, and use it in application code.

Question 3

A company uses Google Workspace and wants to allow users to authenticate to a third-party SaaS application using their Google credentials. The SaaS application supports SAML 2.0. What should the administrator configure?

Accepted Answer

SAML 2.0 SSO in Google Admin Console. Google Workspace supports SAML 2.0 federation. The admin would set up a custom SAML app in the Google Admin console, configuring the IdP (Google) and SP (SaaS app) metadata.

Answer

Workload Identity Federation

Answer

Cloud Identity-Aware Proxy (IAP)

Answer

OAuth 2.0 consent screen

Question 4

An organization has multiple VPC networks in different projects. They need to centrally manage firewall rules that apply to all VPCs in the organization and ensure that project owners cannot override them. Which solution should they use?

Accepted Answer

Create a hierarchical firewall policy at the organization level. Hierarchical firewall policies can be applied at the organization or folder level and are inherited by all VPC networks. They cannot be overridden by lower-level firewall rules. This is the correct solution for centralized, unoverrideable rules. Network firewall policies are scoped to a single VPC network.

Answer

Create a network firewall policy and attach it to each VPC network

Answer

Use Cloud Armor security policies with the load balancers

Answer

Use VPC firewall rules with tags applied to all VMs across projects

Question 5

A security team wants to enforce SSL/TLS best practices for their HTTPS load balancer. They need to require TLS 1.2 or higher and restrict ciphers to strong ones only. Which TWO actions should they take? (Choose two.)

Accepted Answer

Attach the SSL policy to the target HTTPS proxy. To enforce TLS version and cipher strength, you create an SSL policy. The policy can set the minimum TLS version to 1.2 and the profile to RESTRICTED (which only allows strong ciphers). Then you attach the policy to the load balancer's target HTTPS proxy.

Answer

Enable Cloud Armor WAF rules

Answer

Set the SSL policy to COMPATIBLE profile

Answer

Use a Google-managed SSL certificate

Question 6

A security engineer needs to block traffic from all IP addresses in a specific geographic region from reaching an HTTPS load-balanced application. The application uses Cloud Load Balancing with an external HTTPS load balancer. Which approach should the engineer use?

Accepted Answer

Create a Cloud Armor security policy with a geo-based deny rule and attach it to the load balancer.. Cloud Armor security policies can be attached to external HTTPS load balancers to filter traffic based on geolocation. The engineer can create a Cloud Armor security policy with a rule that uses the geo-tag to deny traffic from the specified region.

Answer

Create a VPC firewall rule that denies ingress from the region's IP ranges.

Answer

Use Identity-Aware Proxy (IAP) to block access based on the user's location.

Answer

Configure a Cloud CDN policy to block traffic from certain regions.

Question 7

An engineer needs to ensure that only VMs with a specific service account (sa-prod@project.iam.gserviceaccount.com) can access a Cloud Spanner instance. They want to control this at the network level, not using IAM. Which VPC firewall rule configuration should they use?

Accepted Answer

Egress rule with target service account 'sa-prod'. Firewall rules can target service accounts for egress rules. Since the VMs initiate connections to Spanner, an egress rule with target service account is appropriate.

Answer

Egress rule with source service account 'sa-prod'

Answer

Ingress rule with target service account 'sa-prod'

Answer

Ingress rule with source tag 'sa-prod'

Question 8

An organization wants to enforce a security policy that denies all egress traffic to the internet from all projects in the organization, except for traffic from a specific set of VMs tagged with 'allow-egress'. Which approach should be used?

Accepted Answer

Use a hierarchical firewall policy at the organization level with a deny-all egress rule and a higher priority allow rule for the tag.. Hierarchical firewall policies are inherited down the resource hierarchy and can be enforced at the organization or folder level. They cannot be overridden at lower levels, making them suitable for organization-wide baseline rules.

Answer

Create a VPC firewall rule at the organization level to deny all egress, then allow egress for the specific tag.

Answer

Use VPC Service Controls to block egress traffic.

Answer

Configure Cloud Armor with a deny-all egress rule and an exception for the tag.

Question 9

Which Security Command Center (SCC) tier provides built-in compliance monitoring for standards like CIS and PCI DSS?

Accepted Answer

Premium tier. Security Command Center Premium tier includes built-in compliance monitoring and reporting for standards such as CIS Google Cloud Foundations Benchmark, PCI DSS, ISO 27001, and NIST 800-53. The Standard tier provides security posture findings but not the compliance dashboards and standard-specific assessments. Therefore, Premium is the correct answer.

Answer

Neither; compliance monitoring is part of Cloud Audit Logs

Answer

Both Standard and Premium

Answer

Standard tier

Question 10

A security engineer wants to test a web application hosted on Compute Engine for vulnerabilities. According to Google Cloud's Acceptable Use Policy, which of the following is true regarding penetration testing?

Accepted Answer

Penetration testing is allowed without prior approval, but Denial of Service (DoS) testing is prohibited.. Google Cloud's Acceptable Use Policy permits customers to perform penetration testing against their own Google Cloud resources without prior approval, but explicitly prohibits Denial of Service (DoS) and Distributed Denial of Service (DDoS) testing, as well as testing that could impact other customers. This makes option C the accurate statement of policy.

Answer

Penetration testing is allowed only for customers with Enterprise support plans.

Answer

All penetration testing requires prior written approval from Google.

Answer

Testing must be limited to non-production environments only.