PCSE Practice Test 9 — 10 Questions

Question 1

A security engineer runs the command in the exhibit. The command fails with an error: 'Permission denied: cryptoKeyVersions.encrypt'. What is the most likely cause?

Accepted Answer

The user does not have the cloudkms.cryptoKeyVersions.encrypt permission on the key.. The error message 'Permission denied: cryptoKeyVersions.encrypt' explicitly indicates that the user lacks the cloudkms.cryptoKeyVersions.encrypt permission on the specific key version. In Google Cloud KMS, encrypt operations require the cloudkms.cryptoKeyVersions.encrypt permission (or a broader role like roles/cloudkms.cryptoKeyEncrypter) on the key resource. The command itself is syntactically correct, so the failure is due to insufficient IAM permissions, not resource existence or location.

Answer

The key ring 'my-keyring' does not exist.

Answer

The key ring location is incorrect.

Answer

The user does not have the cloudkms.cryptoKeyVersions.decrypt permission.

Question 2

A company uses Cloud Armor to protect a web application. They want to block requests that contain SQL injection patterns based on the OWASP ModSecurity Core Rule Set. Which preconfigured rule set should they enable?

Accepted Answer

OWASP ModSecurity CRS. Google Cloud Armor provides a preconfigured WAF rule set called 'OWASP ModSecurity Core Rule Set' (CRS) that includes rules to detect and block SQL injection, cross-site scripting, and other OWASP Top 10 attacks. Enabling this rule set applies the ModSecurity CRS signatures to incoming requests, satisfying the requirement to block SQL injection patterns based on OWASP CRS.

Answer

Custom rules using CEL expression

Answer

Google Cloud Armor Managed Rules (SQL Injection)

Answer

Rate limiting rules

Question 3

A company wants to implement least privilege for a service account that needs to read objects from a Cloud Storage bucket and publish messages to a Pub/Sub topic. Which TWO IAM roles should be granted to the service account? (Choose TWO)

Accepted Answer

roles/storage.objectViewer. Roles/storage.objectViewer grants read-only access to objects in Cloud Storage buckets, which is the minimum permission needed for the service account to read objects. This role includes permissions like storage.objects.get and storage.objects.list, allowing the service account to retrieve object data without any write or administrative capabilities.

Answer

roles/pubsub.subscriber

Answer

roles/storage.admin

Answer

roles/pubsub.viewer

Question 4

A company wants to enforce that no Compute Engine firewall rule in any project under an organization can have a source range of 0.0.0.0/0 for RDP (port 3389). Which approach should be used?

Accepted Answer

Apply a hierarchical firewall policy at the organization level that denies ingress on port 3389 from 0.0.0.0/0.. Hierarchical firewall policies are attached at the organization or folder level and are evaluated before VPC firewall rules, allowing centralized enforcement across all projects. A deny rule for ingress TCP/3389 from 0.0.0.0/0 at the org level ensures no project can override it with a lower-priority allow. This is the only option that provides organization-wide, non-bypassable enforcement.

Answer

Create a Cloud IDS rule to block RDP traffic.

Answer

Create a VPC firewall rule with priority 0 to deny RDP from 0.0.0.0/0 in each project.

Answer

Use organization policy with constraint `compute.skipDefaultNetworkCreation` set to true.

Question 5

A security engineer wants to enable Access Transparency for their organization. After enabling it in the Admin Console, they notice that some access logs are missing. What is the most likely reason?

Accepted Answer

The service being accessed does not support Access Transparency.. Access Transparency logs are generated only for Google personnel actions on supported services. If some logs are missing after organization-level enablement, the most likely cause is that the service being accessed does not support Access Transparency. Enablement at the organization level does not extend coverage to unsupported services.

Answer

Access Transparency only logs access by Google personnel, not by third-party vendors.

Answer

Access Transparency must be enabled for each individual project, not just the organization.

Answer

The IAM policy for the organization does not grant the required permissions.

Question 6

A data engineer wants to classify columns in BigQuery containing sensitive data like email addresses and apply data masking so that users see only masked values (e.g., 'j***@example.com'). Which feature should they use?

Accepted Answer

BigQuery column-level security with policy tags and data masking rules. BigQuery column-level security with policy tags and data masking rules allows classification of sensitive columns (e.g., email) and application of masking policies so users see masked values like 'j***@example.com'. Policy tags are managed via Data Catalog, and masking rules are applied to the tag. This is the native, centralized feature for dynamic data masking.

Answer

Cloud DLP inspection jobs

Answer

Cloud IAM roles for BigQuery

Answer

View with SQL masking

Question 7

A company wants to encrypt data at rest in Cloud Storage using a key that they manage and rotate periodically. They also need to ensure that the key material is stored in a FIPS 140-2 Level 3 validated HSM. Which encryption option should they use?

Accepted Answer

Customer-managed encryption keys (CMEK) using Cloud HSM. CMEK with Cloud HSM uses customer-managed keys stored in a FIPS 140-2 Level 3 HSM. GMEK uses Google-managed keys, CSEK requires the customer to supply the key with each API call and Google does not store it, and Cloud HSM alone is not an encryption option; it must be used with CMEK.

Answer

Google-managed encryption keys (GMEK)

Answer

Customer-managed encryption keys (CMEK) using Cloud KMS with software keys

Answer

Customer-supplied encryption keys (CSEK)

Question 8

Which Security Command Center tier provides Event Threat Detection and Container Threat Detection?

Accepted Answer

Premium tier. These threat detection services are available only in the Premium tier of Security Command Center. The Standard tier includes Security Health Analytics, Web Security Scanner, and Anomaly Detection. Compliance monitoring is also Premium-only.

Answer

Both tiers

Answer

Standard tier

Answer

Neither tier, they are separate services

Question 9

You are designing a network for a multi-tier application. The web tier must be accessible from the internet, while the application tier should only be accessible from the web tier. The database tier should only be accessible from the application tier. All tiers are in the same VPC. Which combination of firewall rules meets these requirements?

Accepted Answer

Create an ingress rule allowing traffic from 0.0.0.0/0 to instances with tag 'web', an ingress rule allowing traffic from instances with tag 'web' to instances with tag 'app', and an ingress rule allowing traffic from instances with tag 'app' to instances with tag 'db'.. It uses VPC firewall tags to enforce least-privilege network segmentation: the web tier is exposed to the internet (0.0.0.0/0), the app tier only accepts traffic from web-tagged instances, and the database tier only accepts traffic from app-tagged instances. This matches the multi-tier access requirements without exposing internal tiers to the internet or to each other unnecessarily. Option B is incorrect because while firewall rules in Google Cloud support source service accounts, they cannot be used to allow traffic from the internet, as internet traffic does not have a service account. The web tier's internet access requirement breaks the service account approach.

Answer

Create an ingress rule allowing traffic from the web tier subnet to the application tier subnet, and an ingress rule allowing traffic from the application tier subnet to database tier subnet.

Answer

Assign each tier a unique service account and create ingress rules allowing traffic from the appropriate service accounts.

Answer

Create a single ingress rule that allows all traffic within the VPC network and a separate rule to allow internet traffic to web tier.

Question 10

A company wants to use Cloud Armor to block traffic from specific countries to comply with data sovereignty requirements. They have a global HTTP Load Balancer configured. Where should they configure the Cloud Armor policy?

Accepted Answer

Attach to the backend service of the load balancer.. Cloud Armor policies must be attached to a backend service (or backend bucket) of a global HTTP(S) Load Balancer to filter traffic at the edge. This allows the policy to evaluate incoming requests based on geographic location before they reach the backend, enforcing data sovereignty rules without modifying VPC networking or firewall rules.

Answer

Attach to the VPC network that hosts the load balancer.

Answer

Configure as an Organization Policy constraint.

Answer

Configure as a firewall rule in the VPC network.