PCSE Practice Test 8 — 10 Questions

Question 1

Refer to the exhibit. A security engineer reviews the IAM policy for a service account. What is the effect of the condition?

Accepted Answer

The user can only use the service account before December 31, 2025.. Option D is correct because the condition in the IAM policy uses the `request.time` attribute with a date/time comparison operator, which is a supported variable in IAM conditions. The condition `StringEquals` with `request.time` and a specific date (e.g., `2025-12-31T23:59:59Z`) restricts access to only before that timestamp, effectively granting access only until December 31, 2025. This is a common pattern for time-based access control in cloud IAM policies.

Answer

The user can only use the service account when the request originates from a specific IP range.

Answer

The condition has no effect because request.time is not a supported variable in IAM conditions.

Answer

The user can only use the service account when the resource is in a specific region.

Question 2

A multinational company is migrating sensitive workloads to Google Cloud and must comply with GDPR data residency requirements. Which TWO actions ensure data remains stored only within the European Union? (Choose TWO.)

Accepted Answer

Define an Organization Policy with constraints/gcp.resourceLocations to allow resource creation only in EU regions.. Option D is correct because the Organization Policy constraint `gcp.resourceLocations` explicitly restricts the Google Cloud regions where resources can be created. By setting this constraint to allow only EU regions (e.g., `europe-west1`, `europe-west4`), you enforce that all new resources are provisioned within the European Union, directly meeting GDPR data residency requirements. This policy is evaluated at resource creation time and prevents any resource from being deployed outside the allowed locations.

Answer

Enable Cloud Audit Logs with export to a BigQuery dataset in the EU region.

Answer

Use Cloud Data Loss Prevention (DLP) to scan for sensitive data and verify it remains in the EU.

Answer

Use Customer-Managed Encryption Keys (CMEK) stored in a Cloud KMS key ring located in the EU.

Question 3

A security auditor needs to review all IAM policy changes made in the last 30 days across multiple projects. The auditor has the Organization Viewer role at the organization level. What is the most efficient way to provide access without giving unnecessary permissions?

Accepted Answer

Grant the auditor the roles/iam.securityReviewer role at the organization level.. Option D is correct because the roles/iam.securityReviewer role at the organization level grants read-only access to all IAM policies and audit logs across all projects in the organization, without granting any write or management permissions. This allows the auditor to review IAM policy changes efficiently without needing per-project assignments.

Answer

Grant the auditor the Logs Viewer role at the organization level to view audit logs of IAM changes.

Answer

The existing Organization Viewer role already provides access to IAM policies across all projects.

Answer

Grant the auditor the Project Viewer role on each project.

Question 4

A multinational organization must store customer data only in specific geographic regions to comply with data residency regulations. They use Cloud Spanner for their primary database. What should they do to enforce that data is stored only in approved regions?

Accepted Answer

Apply an organization policy with a constraint that restricts the location of Cloud Spanner resources to approved regions.. Organization policies with resource location constraints allow you to enforce that Cloud Spanner instances are created only in approved geographic regions. This policy is evaluated at resource creation time and prevents the deployment of Spanner instances outside the specified regions, directly addressing data residency compliance requirements.

Answer

Create a Cloud Spanner instance in the desired region and configure a backup in a different region for disaster recovery.

Answer

Configure a VPC Service Controls perimeter to restrict access to Cloud Spanner.

Answer

Use Cloud Spanner with data residency constraints by selecting a multi-region configuration that includes only approved regions.

Question 5

Which THREE of the following are valid requirements for using VPC Network Peering? (Choose three.)

Accepted Answer

Subnet routes are automatically exchanged between the peered VPCs.. Option B is correct because VPC Network Peering automatically exchanges subnet routes between the peered VPCs, enabling private IP connectivity without requiring additional route tables or VPN gateways. This route exchange is implicit once the peering connection is established, provided the networks do not have overlapping CIDR blocks.

Answer

Cloud NAT must be configured in at least one VPC.

Answer

An IAM role with compute.networkAdmin must be granted to all users.

Question 6

An application needs to authenticate to Google Cloud APIs from an on-premises server. Which approach is recommended for long-lived access?

Accepted Answer

Create a service account key and store it securely on the server.. Option D is correct because service account keys provide a long-lived, static credential that can be securely stored on an on-premises server for authenticating to Google Cloud APIs. Unlike user accounts or OAuth flows, service account keys do not require interactive login or token refresh, making them suitable for automated, long-running workloads.

Answer

Use a user account with OAuth 2.0 tokens.

Answer

Use workload identity federation with an on-premises identity provider.

Answer

Use API keys.

Question 7

Refer to the exhibit. An organization has the above IAM policy on a project. The user user@example.com is trying to view a list of objects in a bucket from IP address 10.1.1.1. What will be the result?

Accepted Answer

The user can list objects because the condition is satisfied.. Option D is correct because the IAM policy grants the `storage.objects.list` permission to `user@example.com` with a condition that requires the request to come from an IP address within the `10.0.0.0/8` range. Since the user is accessing from `10.1.1.1`, which falls within that CIDR block, the condition evaluates to true, allowing the list operation.

Answer

The user cannot list objects because the condition is evaluated as false.

Answer

The user cannot list objects because IAM conditions do not support IP-based restrictions.

Answer

The user can list objects because they have inherited roles/storage.admin permissions from the admin.

Question 8

An organization wants to enforce that all IAM policy changes in their Google Cloud organization are logged and require approval. Which three Google Cloud capabilities can help achieve this? (Choose THREE.)

Accepted Answer

Organization policies with constraints. Organization policies with constraints (B) allow you to define and enforce guardrails for IAM policy changes, such as using the `iam.policyServiceAccountKeyExpiryHours` constraint to require approval workflows via the Access Approval API. Cloud Asset Inventory with Cloud Pub/Sub notifications (C) can monitor and stream real-time updates to IAM policies, triggering approval processes. Cloud Audit Logs (E) record all IAM policy changes, providing an immutable audit trail that can be used to verify compliance and enforce approval requirements.

Answer

Cloud Run for Anthos

Answer

VPC Service Controls

Question 9

A company is moving sensitive data to Google Cloud and must comply with GDPR data minimization principles. They want to ensure that only the minimum necessary data is collected and processed. Which Google Cloud service should they use to automatically identify and redact sensitive data before storage?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud Data Loss Prevention (DLP) is the correct service because it provides native capabilities to inspect, classify, and automatically redact sensitive data (e.g., PII, credit card numbers) before storage, directly supporting GDPR data minimization. It uses built-in infoType detectors and can be integrated with Cloud Storage, BigQuery, and other services to apply de-identification transformations such as masking, tokenization, or deletion at ingestion time.

Answer

Cloud Composer

Answer

Cloud Data Fusion

Answer

Cloud Dataprep

Question 10

A company is migrating a legacy on-premises application to Google Compute Engine. The application requires a static IP address for compliance with a regulatory requirement that outbound connections to a partner's IP whitelist must originate from a known, fixed IP. The application will run in a managed instance group (MIG) for high availability. Which of the following solutions meets the compliance requirement?

Accepted Answer

Use a regional external HTTPS load balancer with a static IP address and configure the MIG to route outbound traffic through the load balancer.. Option B is correct because a regional external HTTPS load balancer with a static IP address can be used as a forward proxy for outbound traffic. By configuring the managed instance group (MIG) to route all egress traffic through the load balancer, all outbound connections will originate from the load balancer's static IP, meeting the compliance requirement for a known, fixed source IP. This approach ensures high availability through the MIG while maintaining a single static IP for partner whitelisting.

Answer

Configure VPC Service Controls to allow egress only from a specific IP range.

Answer

Assign static external IP addresses to each instance in the MIG and configure the partner firewall accordingly.

Answer

Use Cloud NAT with a static NAT IP address for all egress traffic from the instances.

PCSE Practice Test 8 — 10 Questions

Exhibit

PCSE Practice Test 8 — 10 Questions

Exhibit