PCSE Configuring access within a cloud solution environment Practice Test 1 — 15 Questions

Question 1

A company is designing a CI/CD pipeline using Cloud Build. Security requirements mandate that the pipeline deploy only to projects that have been explicitly authorized. The security team wants to use a service account that can be assumed by Cloud Build to perform deployments, and they want to restrict which projects can be deployed to using organization policies. Which approach should they take?

Answer

Use the organization policy constraint 'constraints/iam.serviceAccountKeyExpiryHours' to force key rotation.

Answer

Use the organization policy constraint 'constraints/iam.allowedPolicyMemberDomains' and set it to only allow the service account's domain.

Answer

Use the organization policy constraint 'constraints/compute.restrictCrossProjectNw' to limit network access.

Answer

Use the organization policy constraint 'constraints/iam.workloadIdentityPoolProviders' to restrict which workload identity pools can be used.

Question 2

A company uses Cloud Identity-Aware Proxy (IAP) to secure access to an internal web application hosted on Compute Engine. After a recent security audit, the team wants to ensure that only users with specific attributes can access the app, such as belonging to the 'engineering' group and having a verified corporate email. What is the best approach to enforce this requirement?

Accepted Answer

Configure IAP with access levels that require the user to be in the 'engineering' group and have a verified email.. Option D is correct because Cloud IAP integrates with Identity-Aware Proxy access levels, which allow you to enforce attribute-based access control (ABAC) using Google Cloud's context-aware access features. By configuring an access level that requires the user to belong to the 'engineering' group (via Cloud Identity or G Suite group membership) and have a verified corporate email (e.g., using the `email_verified` attribute from the identity provider), you can precisely restrict access to the Compute Engine web application without modifying the application code.

Answer

Use VPC Service Controls to restrict access based on user attributes.

Answer

Disable OAuth and use a custom JWT with group membership claims.

Answer

Set up an HTTP load balancer with a custom header that passes group membership from the identity provider.

Question 3

A financial services company is migrating its on-premises application to Google Cloud. The application needs to access a Cloud SQL instance and a Cloud Storage bucket. Security requirements mandate that the application must use short-lived credentials and avoid storing long-lived service account keys. The application runs on Compute Engine. What should the Security Engineer do to meet these requirements?

Accepted Answer

Attach a service account to the Compute Engine instance with appropriate roles for Cloud SQL and Cloud Storage.. Option C is correct because attaching a service account directly to a Compute Engine instance allows the application to automatically obtain short-lived access tokens from the instance metadata server (http://169.254.169.254) for accessing Cloud SQL and Cloud Storage. This approach eliminates the need to store long-lived service account keys, meeting the security requirement for short-lived credentials.

Answer

Create a service account and use Workload Identity Federation to impersonate it.

Answer

Use Cloud Key Management Service to generate and rotate keys for the service account.

Answer

Create a service account key and store it in Cloud Secret Manager.

Question 4

A DevOps team wants to grant a contractor temporary access to a specific Cloud Storage bucket for 30 days. The contractor has a Google account (example@gmail.com). The bucket contains sensitive data, and the access should be as restrictive as possible. What is the recommended way to grant this access?

Accepted Answer

Add the contractor's email to the bucket-level IAM policy with the 'Storage Object Viewer' role.. Option C is correct because bucket-level IAM policies allow you to grant granular, time-bound access to a specific bucket without affecting other resources in the project. By adding the contractor's email (example@gmail.com) to the bucket-level IAM policy with the 'Storage Object Viewer' role, you restrict access to only that bucket and only to read objects, which is the most restrictive approach for a 30-day temporary access requirement.

Answer

Create a bucket ACL granting the contractor READ access.

Answer

Add the contractor's email to the project-level IAM policy with the 'Storage Object Viewer' role.

Answer

Generate a signed URL for the contractor to access the bucket objects.

Question 5

An organization uses Cloud Run to deploy microservices. Each microservice needs to authenticate to Cloud Pub/Sub topics. The Security Engineer wants to enforce that each service only uses its own service account and cannot impersonate others. The team also wants to rotate credentials automatically. What is the best practice to achieve this?

Accepted Answer

Assign a dedicated service account to each Cloud Run service with the necessary Pub/Sub publisher role.. Option A is correct because Cloud Run allows you to assign a dedicated, per-service service account at deployment time. By granting each service account only the Pub/Sub publisher role on its specific topic, you enforce least-privilege access and prevent impersonation. Cloud Run automatically rotates the short-lived tokens associated with these service accounts via the metadata server, eliminating the need for manual key management.

Answer

Configure each Cloud Run service to use the Compute Engine default service account and rely on the metadata server.

Answer

Use Workload Identity Federation to map each service to a Google service account.

Answer

Create a service account key for each service and store it in Cloud Secret Manager.

Question 6

A company wants to allow employees to access a web application running on Google Kubernetes Engine (GKE) using their corporate Active Directory credentials. The application is exposed via an HTTPS load balancer. The Security Engineer needs to integrate identity federation and ensure that only authenticated users can reach the application. Which combination of services should be used?

Accepted Answer

Set up federation between Active Directory and Google Cloud using OIDC, and enable IAP on the load balancer.. Option B is correct because it combines OIDC federation between Active Directory and Google Cloud with Identity-Aware Proxy (IAP) on the load balancer. IAP verifies user identity via OIDC tokens issued by the federated identity provider, ensuring only authenticated users can reach the application without exposing it to the public internet.

Answer

Use Cloud Armor to allow only traffic from specific IP ranges and require client certificates.

Answer

Enable IAP and configure it to use Active Directory as an identity provider.

Answer

Configure Cloud Identity as the identity provider and use IAP.

Question 7

A Security Engineer is designing access controls for a multi-cloud environment where workloads on Google Cloud need to access on-premises databases. The company wants to use long-lived credentials. Which TWO options are valid approaches? (Choose TWO.)

Accepted Answer

Create an OAuth 2.0 client ID for an installed application and use offline access to obtain refresh tokens.. Option A is correct because OAuth 2.0 client IDs for installed applications can be configured for offline access, which returns refresh tokens. These refresh tokens are long-lived (typically do not expire unless revoked) and can be used by on-premises applications to obtain new access tokens for accessing Google Cloud APIs without user interaction. This meets the requirement for long-lived credentials in a multi-cloud environment.

Answer

Set up a Cloud VPN tunnel and use private IP addresses to access Google Cloud services.

Answer

Create a service account and use its key to generate short-lived tokens.

Answer

Use Workload Identity Federation to exchange on-premises credentials for Google Cloud tokens.

Question 8

A company wants to enforce that all access to Cloud Storage buckets in a project is encrypted with Customer-Managed Encryption Keys (CMEK). The Security Engineer needs to configure the organization policy to meet this requirement. Which THREE steps should be taken? (Choose THREE.)

Accepted Answer

Create an organization policy with the constraint 'constraints/storage.requireCustomerManagedEncryption'.. Option A is correct because the `constraints/storage.requireCustomerManagedEncryption` organization policy constraint enforces that all Cloud Storage buckets in the project must use CMEK. When this constraint is applied, any attempt to create a bucket without specifying a CMEK key is denied, ensuring compliance with the encryption requirement.

Answer

Grant the 'cloudkms.cryptoKeyEncrypterDecrypter' role to the Cloud Storage service account.

Answer

Disable the 'storage.objects.setIamPolicy' permission for all users except the key administrators.

Question 9

Refer to the exhibit. A Security Engineer runs the command to grant Alice access to view objects in a Cloud Storage bucket. Later, Alice reports she can no longer access the bucket after January 1, 2024. What is the most likely reason?

Accepted Answer

The IAM condition expired on January 1, 2024, because the timestamp condition prevented access after that date.. Option D is correct because the IAM condition attached to the binding includes a timestamp condition that expires on January 1, 2024. When the condition is no longer satisfied, the binding becomes ineffective, and Alice loses access to the bucket. This is a common use of IAM conditions to grant time-limited access.

Answer

Alice does not have the 'storage.objects.get' permission required to view objects.

Answer

The command removed Alice's existing access because it replaced all bindings.

Answer

The command failed to apply because the service account does not have permission to modify IAM policies.

Question 10

Refer to the exhibit. A Security Engineer is reviewing the IAM policy for a project. An administrator reports that a user named admin@example.com cannot create firewall rules, even though the command should allow it. According to the policy, what is the most likely reason?

Accepted Answer

The user has the 'compute.networkAdmin' role, which does not include permission to create firewall rules.. Option C is correct because the 'compute.networkAdmin' role in Google Cloud IAM does not include the 'compute.firewalls.create' permission required to create firewall rules. The user has this role, which grants permissions to manage network resources like subnets and routes, but firewall rule creation is a security function that requires the 'compute.securityAdmin' role.

Answer

The security-team group has the 'compute.securityAdmin' role, but the user is not in that group.

Answer

The user has the 'compute.instanceAdmin.v1' role, which conflicts with network admin permissions.

Answer

The IAM policy has an invalid etag, causing the policy to be rejected.

Question 11

A company uses Cloud SQL for PostgreSQL with IAM database authentication. A security engineer needs to grant a user named 'analyst@example.com' the ability to run SELECT queries on the 'orders' table. The user is a member of the group 'analysts@example.com'. What is the correct combination of IAM and database permissions?

Accepted Answer

Grant the group 'analysts@example.com' the role 'roles/cloudsql.instanceUser' on the instance. In the database, create a user 'analyst@example.com' with 'cloudsqllogin' role and grant SELECT on orders to that user.. Option D is correct because IAM database authentication requires granting the IAM group the `roles/cloudsql.instanceUser` role on the instance to allow members to connect, and then creating a database user with the same name as the IAM user (not the group) with the `cloudsqllogin` role, which maps the IAM user to the database. Granting SELECT on the `orders` table to that database user then allows the IAM user to query the table.

Answer

Grant the user 'roles/cloudsql.viewer' on the project. In the database, grant SELECT on orders to 'analyst@example.com'.

Answer

Grant the user 'cloudsql.instances.connect' on the instance. In the database, create a user 'analyst@example.com' with 'cloudsqllogin' role and grant SELECT on orders to that user.

Answer

Grant the group 'roles/cloudsql.instanceUser' on the instance. In the database, create a user 'analysts@example.com' (the group) and grant SELECT on orders to that group.

Question 12

A security engineer needs to ensure that a Compute Engine VM can securely access Cloud Storage buckets without exposing a public IP address. The VM is in a VPC with Private Google Access enabled. What is the recommended approach?

Accepted Answer

No additional configuration is needed; Private Google Access allows access to Cloud Storage from VMs without external IPs.. Private Google Access enables a VM without an external IP address to reach Google APIs and services, including Cloud Storage, using the VPC's internal IP and Google's private network. Since the VM is in a VPC with Private Google Access enabled, it can securely access Cloud Storage buckets without needing a public IP or additional proxy. No further configuration is required because the traffic stays within Google's network and never traverses the public internet.

Answer

Deploy a Squid proxy in the same VPC and configure the VM to use it for all outbound traffic.

Answer

Assign an external IP to the VM and configure a firewall rule to allow egress to 0.0.0.0/0.

Answer

Configure Cloud NAT and ensure the VM has a route to the internet.

Question 13

A company uses Organization Policies to restrict resource locations. They want to allow resources only in 'us-central1' and 'europe-west1'. They also need to allow a specific project to use 'us-east1' for a temporary workload. What is the correct organization policy configuration?

Accepted Answer

Set an organization policy with constraint 'gcp.resourceLocations' and allowed values 'us-central1' and 'europe-west1'. On the specific project, set a policy with allowed values 'us-central1', 'europe-west1', and 'us-east1'.. Option A is correct because Organization Policies with the 'gcp.resourceLocations' constraint enforce location restrictions hierarchically. By setting allowed values at the organization level to 'us-central1' and 'europe-west1', all projects inherit these restrictions. Overriding the policy on the specific project by adding 'us-east1' to the allowed list creates a more permissive policy that still respects the organization-level constraints, allowing the temporary workload in 'us-east1'.

Answer

Set an organization policy with constraint 'gcp.resourceLocations' and denied values 'asia-*', 'australia-*', etc. On the specific project, set a policy with allowed values 'us-east1'.

Answer

Set an organization policy with constraint 'gcp.resourceLocations' and allowed values 'us-central1', 'europe-west1'. Use tags to mark the project and create a conditional policy that adds 'us-east1' when the tag is present.

Answer

Set an organization policy with constraint 'gcp.resourceLocations' and allowed values 'us-central1', 'europe-west1'. On the specific project, set a policy with denied values 'us-east1'.

Question 14

A company wants to implement least privilege for a service account that needs to read objects from a Cloud Storage bucket and publish messages to a Pub/Sub topic. Which TWO IAM roles should be granted to the service account? (Choose TWO)

Accepted Answer

roles/storage.objectViewer. Option A is correct because roles/storage.objectViewer grants read-only access to objects in Cloud Storage buckets, which is the minimum permission needed for the service account to read objects. This role includes permissions like storage.objects.get and storage.objects.list, allowing the service account to retrieve object data without any write or administrative capabilities.

Answer

roles/pubsub.subscriber

Answer

roles/storage.admin

Answer

roles/pubsub.viewer

Question 15

A security team is designing access controls for a multi-tenant SaaS application on Google Kubernetes Engine (GKE). Each tenant has a separate namespace. They want to ensure that a DevOps team can manage deployments across all namespaces, but cannot modify secrets in the 'tenant-alpha' namespace. Which THREE Kubernetes RBAC resources should be created? (Choose THREE)

Accepted Answer

A RoleBinding in namespace 'tenant-alpha' that binds the ClusterRole to the DevOps team.. Option A is correct because a RoleBinding in the 'tenant-alpha' namespace can bind a ClusterRole (which is a cluster-scoped resource) to the DevOps team, granting them the permissions defined in that ClusterRole within that specific namespace. Since the ClusterRole in option D explicitly excludes secrets, this RoleBinding ensures the DevOps team can manage deployments across all namespaces (via a ClusterRoleBinding) but cannot modify secrets in 'tenant-alpha'.

Answer

A ClusterRole that grants permissions to manage secrets across all namespaces.

Answer

A RoleBinding in namespace 'tenant-alpha' that binds a Role granting secret modification to the DevOps team.