PCSE Practice Test 9 — 10 Questions

Question 1

Refer to the exhibit. A compliance officer is reviewing an Access Transparency log entry. Which compliance benefit does this log provide?

Accepted Answer

It provides evidence of data access by Google engineers. Access Transparency logs are specifically designed to provide visibility into actions performed by Google personnel (e.g., engineers) on customer data. This log entry shows an operation by a Google support engineer, which directly supports compliance requirements by providing evidence of data access by Google engineers, as required for regulatory audits like SOC 2 or FedRAMP.

Answer

It shows a user accessing a storage object

Answer

It tracks encryption key usage

Answer

It is a Cloud Audit Log for admin activity

Question 2

A company wants to demonstrate to an auditor that all data access requests to a Cloud Storage bucket are logged, but they must exclude a specific service account from logging to reduce noise. What should they do to remain compliant with their audit policy?

Accepted Answer

Enable Data Access audit logs without exempting any service accounts. Enabling Data Access audit logs without exempting any service accounts ensures that all data access requests to the Cloud Storage bucket are logged, meeting the auditor's requirement. Exempting a service account (as in Option A) would violate the policy by excluding its requests from the logs entirely. Cloud Logging exclusion filters (Option D) operate after ingestion and cannot guarantee compliance, as the auditor may require logs to be captured in the first place.

Answer

Enable Data Access audit logs with exempted members set to that service account

Answer

Configure VPC Service Controls to block the service account from accessing the bucket

Answer

Use Cloud Logging exclusion filters to filter out the service account logs after ingestion

Question 3

A company enforces Binary Authorization on a GKE cluster. They want to require that all container images be signed by a specific attestor located in a different project. What must be configured?

Accepted Answer

A policy that requires attestation, an attestor in the same or different project, and a service account on the GKE node with the appropriate IAM permissions to access the attestor.. Binary Authorization allows attestors in different projects. The key requirement is the proper IAM role (roles/binaryauthorization.attestorsVerifier) on the GKE service account.

Answer

A Binary Authorization policy that allows all images, and an attestor with the same name in both projects.

Answer

A Cloud KMS key for the attestor in the same project as the cluster, and a policy that requires attestation.

Answer

A policy that denies all images, and a separate attestor for each project.

Question 4

A company wants to encrypt data at rest in Cloud Storage using a key that they manage and rotate periodically. They also need to ensure that the key material is stored in a FIPS 140-2 Level 3 validated HSM. Which encryption option should they use?

Accepted Answer

Customer-managed encryption keys (CMEK) using Cloud HSM. CMEK with Cloud HSM uses customer-managed keys stored in a FIPS 140-2 Level 3 HSM. GMEK uses Google-managed keys, CSEK requires the customer to supply the key with each API call and Google does not store it, and Cloud HSM alone is not an encryption option; it must be used with CMEK.

Answer

Google-managed encryption keys (GMEK)

Answer

Customer-managed encryption keys (CMEK) using Cloud KMS with software keys

Answer

Customer-supplied encryption keys (CSEK)

Question 5

A user has been granted the role roles/editor on a folder. What is the effective access in the projects within that folder? (Assume no deny policies)

Accepted Answer

Full editor access on all resources in the folder, including projects.. In Google Cloud, IAM roles are inherited from parent resources to child resources. Granting the roles/editor role on a folder automatically applies that role to all projects and resources within the folder, provided there are no deny policies to override it. This means the user has full editor access on all resources in the folder, including the projects themselves and all resources within those projects.

Answer

Editor access on the projects but not on resources within the projects.

Answer

The user must also be granted editor on each project separately.

Answer

Editor access on the folder resource only, not on projects.

Question 6

A company has deployed an internal HTTP Load Balancer (ILB) in us-west1 within a Shared VPC. The host project contains the ILB's forwarding rule and the backend service. The backend instances are Compute Engine VMs running in a service project in us-east1. The health checks for the ILB are consistently failing with 'unhealthy' status. The firewall rules in the host project allow ingress from the Google Cloud health checker ranges (130.211.0.0/22 and 35.191.0.0/16) on TCP port 80 to all VMs in the VPC. The backend VMs are running a web server listening on port 80. What is the most likely cause of the health check failures?

Accepted Answer

The ILB's forwarding rule and backends are in different regions.. The internal HTTP Load Balancer (ILB) in Google Cloud requires that the forwarding rule, backend service, and backend instances all reside in the same region. In this scenario, the ILB is deployed in us-west1, but the backend VMs are in us-east1. Cross-region backends are not supported for ILBs, causing health checks to fail because the load balancer cannot route traffic or verify health across regions.

Answer

The health checker firewall rule is not applied to the service project.

Answer

The backend VMs are not in the same project as the ILB.

Answer

The backend VMs do not have the correct IAM permissions for the ILB.

Question 7

Your organization uses Cloud Armor to protect HTTP Load Balancers. You need to block all incoming requests from a specific geographic region (country code 'XY') while allowing all other traffic. What is the correct configuration?

Accepted Answer

Create a custom rule with expression 'origin.region_code == "XY"' and set action to deny(403). Cloud Armor supports geolocation blocking using custom rules with expressions. The correct approach is to create a security policy rule that matches on the origin country code and sets the action to deny. The precedence (priority) ensures the deny rule is evaluated before the default allow rule.

Answer

Use Cloud IDS to detect and block requests from country XY

Answer

Configure a firewall rule in the VPC to deny ingress from IP ranges associated with country XY

Answer

Add a preconfigured OWASP rule set for geolocation blocking and enable it for country XY

Question 8

A company is implementing data loss prevention (DLP) for BigQuery. Which THREE capabilities are provided by Cloud DLP? (Choose THREE.)

Accepted Answer

Redacting sensitive data in query results.. Cloud DLP can inspect and redact sensitive data directly in BigQuery query results. When you configure a DLP job or use the DLP API with BigQuery, you can specify infoTypes to detect and then redact matching values before returning the results to the user, preventing exposure of sensitive information like credit card numbers or PII.

Answer

Auditing all queries that access sensitive columns.

Answer

Encrypting entire tables with customer-managed keys.

Question 9

A company wants to allow its on-premises applications to access Google Cloud resources using short-lived credentials without storing a service account key file. Which solution should they use?

Accepted Answer

Configure Workload Identity Federation between the on-premises identity provider and Google Cloud.. Workload Identity Federation allows on-premises applications to exchange tokens from an external identity provider (IdP) for short-lived Google Cloud access tokens, eliminating the need to store a service account key file. This solution meets the requirement for short-lived credentials and avoids the security risk of long-lived static keys.

Answer

Set up a Cloud VPN connection and use private IPs to access resources.

Answer

Create a service account and download a JSON key file to the on-premises server.

Answer

Use signed URLs to grant access for each request.

Question 10

Your organization has a security requirement that all traffic to and from Compute Engine instances must be logged and analyzed. You have enabled VPC Flow Logs for all subnets. However, you notice that flow logs are not capturing all traffic between instances in the same subnet. What is the most likely reason?

Accepted Answer

Traffic to the metadata server (169.254.169.254) is not captured by VPC Flow Logs.. VPC Flow Logs do not capture traffic to the metadata server (169.254.169.254) because that traffic is considered internal infrastructure communication and is excluded from flow log collection by design. This is a documented limitation in Google Cloud, and it explains why some traffic between instances in the same subnet—such as metadata queries—is missing from the logs.

Answer

VPC Flow Logs must be enabled on each individual instance, not on subnets.

Answer

VPC Flow Logs only capture traffic that crosses subnet boundaries.

Answer

VPC Flow Logs sample only 1 out of 10 packets by default.