PCSE Configuring access within a cloud solution environment Practice Test 2 — 15 Questions

Question 1

Refer to the exhibit. A security engineer runs the commands shown. The command 'gcloud compute instances list' fails with a permission denied error. The service account key belongs to a service account with the role 'roles/compute.viewer' on the project. What is the most likely cause?

Accepted Answer

The service account key file is invalid or the service account has been deleted.. The command 'gcloud auth activate-service-account' uses a service account key file to authenticate as that service account. If the key file is invalid (e.g., corrupted, expired, or malformed) or the service account itself has been deleted, authentication will fail, causing subsequent commands like 'gcloud compute instances list' to return a permission denied error even if the service account has the correct role. The error is not about missing permissions on the role, but about the inability to prove identity.

Answer

The role 'roles/compute.viewer' does not include the permission to list instances.

Answer

The command 'gcloud auth activate-service-account' should be 'gcloud auth login' instead.

Answer

The project 'my-project' does not exist or the service account is not in that project.

Question 2

Your company has a hybrid cloud environment with on-premises servers and Google Cloud. You are using Cloud VPN to connect the on-premises network to a VPC in us-central1. The on-premises network uses RFC 1918 addresses (10.0.0.0/8). The VPC has subnets in 10.0.0.0/8 as well, causing IP overlap. To resolve this, you have configured the VPC with a custom IP range of 172.16.0.0/12 and migrated some workloads. However, some legacy on-premises servers still need to access a specific set of Compute Engine VMs in the VPC. The security team requires that only authenticated service accounts from the VPC can access on-premises resources, and that traffic from on-premises to Google Cloud must be limited to specific ports (e.g., 443, 8443). You have set up a Cloud VPN tunnel with route-based VPN. What should you do to enforce these access controls?

Accepted Answer

Create VPC firewall rules that allow ingress from the on-premises IP ranges on ports 443 and 8443 to the target VMs. On the on-premises side, configure firewall rules to allow only traffic from the VPC IP ranges and require that the source VMs present a valid service account token, which can be verified using a proxy or by using Google Cloud's Identity-Aware Proxy (IAP) for TCP forwarding.. Option D is correct because it addresses both requirements: limiting traffic to specific ports (443, 8443) via VPC firewall rules, and enforcing authenticated service account access from the VPC to on-premises resources. Identity-Aware Proxy (IAP) for TCP forwarding allows on-premises servers to verify that source VMs present a valid service account token, ensuring only authenticated VPC workloads can initiate connections. This combination satisfies the security team's need for both port restriction and authentication without relying on IP-based trust alone.

Answer

Use Cloud Armor to create a security policy that filters traffic from on-premises IP ranges on ports 443 and 8443, and attach it to the VPN gateway.

Answer

Assign network tags to the Compute Engine VMs and create a firewall rule that allows traffic from the on-premises IP ranges on ports 443 and 8443 only to VMs with that tag.

Answer

Use Cloud NAT to provide outbound-only access from the VPC, and create firewall rules to block inbound traffic from on-premises.

Question 3

You are a security engineer for a startup that uses Google Workspace and Google Cloud. You have been asked to allow a contractor, who has a Google account (contractor@example.com), to manage Cloud Storage buckets in a specific project. The contractor should not have access to any other resources. You create a custom role with the necessary permissions and grant it to the user at the project level. However, the contractor reports that they cannot see the project in the Cloud Console. What is the most likely reason?

Accepted Answer

The custom role does not include the 'resourcemanager.projects.get' permission, which is required to view the project in the console.. The Cloud Console requires the 'resourcemanager.projects.get' permission to list and display projects. Even though the custom role grants permissions to manage Cloud Storage buckets, without this specific permission, the contractor cannot see the project in the console. Granting the permission at the project level allows the user to view the project in the console while still restricting access to other resources.

Answer

The contractor's Google account is not in the same domain as the Google Cloud organization.

Answer

The contractor needs to sign in using a different authentication method, such as SAML.

Answer

An organization policy denies access to the project for external users.

Question 4

A company uses Cloud Functions with a service account that has the role 'roles/cloudfunctions.invoker' to allow unauthenticated invocation. They want to change this so that only authenticated requests from a specific Cloud Scheduler job can invoke the function. The Cloud Scheduler job runs in the same project and uses a service account with the role 'roles/cloudscheduler.serviceAgent'. The security engineer updates the Cloud Function's ingress settings to 'Allow internal traffic only' and removes the 'allUsers' invoker binding. However, the Cloud Scheduler job now fails with a 403 error. What should the engineer do to fix this?

Accepted Answer

Grant the Cloud Scheduler's service account the role 'roles/cloudfunctions.invoker' on the Cloud Function.. A is correct because the Cloud Scheduler job uses a service account to authenticate its requests. By default, Cloud Scheduler does not automatically have permission to invoke a Cloud Function. Granting the Cloud Scheduler's service account the 'roles/cloudfunctions.invoker' role on the Cloud Function explicitly authorizes that identity to invoke the function, even when the function's ingress is set to 'Allow internal traffic only' and the 'allUsers' binding is removed.

Answer

Add 'allAuthenticatedUsers' as an invoker to the Cloud Function.

Answer

Change the ingress setting to 'Allow all traffic'.

Answer

Set the Cloud Function's ingress setting to 'Allow internal traffic only' and ensure the Cloud Scheduler job's region is the same as the function's region.

Question 5

A company has deployed a multi-region Kubernetes cluster using GKE. The security team wants to ensure that only pods with a specific service account can access a Cloud Storage bucket containing sensitive data. What is the best practice to achieve this?

Accepted Answer

Use Workload Identity to bind the Kubernetes service account to a Google service account with appropriate roles on the bucket.. Workload Identity is the best practice because it allows you to bind a Kubernetes service account (KSA) to a Google service account (GSA) that has been granted specific IAM roles on the Cloud Storage bucket. This eliminates the need to manage and distribute static service account keys, as the pod authenticates directly to Google Cloud APIs using the GSA's identity via a secure token exchange. The GKE node's metadata server is configured to vend tokens for the bound GSA only to pods running with the designated KSA, ensuring that only those pods can access the bucket.

Answer

Store a service account key as a Kubernetes secret and mount it into the pod.

Answer

Create a bucket ACL that grants read access to the GKE node service account.

Answer

Create a PersistentVolume with a GCSFuse bucket and use a pod security policy to restrict access.

Question 6

An organization uses Cloud Run to deploy microservices. They need to restrict access to a specific Cloud Run service to only requests coming from a different Cloud Run service within the same project. The services communicate over HTTP. Which configuration should be used?

Accepted Answer

Configure the Cloud Run service to use 'Internal and Cloud Load Balancing' ingress control and use VPC Service Controls with an access level based on the caller's identity.. Option D is correct because it combines ingress control set to 'Internal and Cloud Load Balancing' with VPC Service Controls, which restricts access to the Cloud Run service to only requests originating from within the specified VPC or from Cloud Load Balancing. By adding an access level based on the caller's identity (the calling service's Google service account), you ensure that only the specific Cloud Run service can invoke the target service, meeting the requirement for service-to-service authentication within the same project.

Answer

Deploy both services in a VPC and use VPC firewall rules to allow traffic only from the caller's internal IP.

Answer

Use Cloud Armor with a rule to allow only requests with a specific header set by the caller.

Answer

Set the Cloud Run service to require authentication and grant the invoker role to the calling service's Google service account.

Question 7

A security engineer needs to grant a data analyst read-only access to a BigQuery dataset containing customer data, but must prevent the analyst from viewing or querying a specific column that contains personally identifiable information (PII). Which approach should the engineer use?

Accepted Answer

Use BigQuery column-level security with a policy tag on the PII column, and assign the analyst a role that denies access to that tag.. Option A is correct because BigQuery column-level security uses policy tags to control access at the column level. By assigning a policy tag to the PII column and then granting the analyst a role that explicitly denies access to that tag (e.g., using a deny role or IAM deny policies), the analyst can query the dataset but will be blocked from viewing or querying the tagged column. This approach directly meets the requirement of read-only access while preventing access to the specific PII column.

Answer

Grant the analyst the roles/bigquery.user role, and use IAM conditions to deny access to the PII column.

Answer

Create a row-level access policy on the table that denies access to rows containing PII.

Answer

Grant the analyst the BigQuery Data Viewer role on the dataset, and create an authorized view that excludes the PII column.

Question 8

Drag and drop the steps to set up Cloud Armor with a WAF rule in the correct order.

Question 9

Drag and drop the steps to set up a Private Google Access for on-premises hosts using Private Service Connect in the correct order.

Question 10

Match each IAM role to its typical use case.

Question 11

Match each Google Cloud logging/monitoring term to its definition.

Question 12

A company uses multiple Google Cloud projects. A service account in Project A needs to read data from a Cloud Storage bucket in Project B. What is the correct way to grant access?

Accepted Answer

Add the service account as a member of the bucket's IAM policy with the Storage Object Viewer role.. Option D is correct because Cloud Storage uses IAM policies at the resource (bucket) level to grant cross-project access. By adding the service account from Project A as a member of the bucket's IAM policy in Project B with the Storage Object Viewer role, you grant the service account read-only access to objects in that bucket without requiring membership in Project B itself. This follows the principle of least privilege and avoids unnecessary project-level permissions.

Answer

Make the bucket publicly accessible and use signed URLs.

Answer

Grant the service account the Project Viewer role on Project B.

Answer

Add the service account as a member of Project B with the Storage Object Viewer role.

Question 13

A user receives a "403 Forbidden" error when trying to access a Compute Engine instance via SSH from the Cloud Console. The user has the Compute Admin role on the project. What is the most likely cause?

Accepted Answer

The user does not have the roles/iap.tunnelResourceAccessor role.. The 403 Forbidden error when using Cloud Console SSH indicates that Identity-Aware Proxy (IAP) TCP forwarding is being used, which requires the roles/iap.tunnelResourceAccessor role. Even with Compute Admin, the user lacks this IAP-specific role, so the request is denied at the IAP layer before reaching the instance.

Answer

The user does not have the compute.instances.setMetadata permission.

Answer

The firewall rules do not allow SSH from the user's IP.

Answer

OS Login is enabled on the instance and the user lacks the osLogin role.

Question 14

An organization wants to allow a group of external auditors read-only access to specific BigQuery datasets in a project, but only during working hours (9 AM to 5 PM). The auditors belong to an external Google Workspace domain. Which IAM configuration should be used?

Accepted Answer

Create a custom role with required permissions on the datasets, grant it to the auditors' group with an IAM condition using request.time between 9 AM and 5 PM.. Option A is correct because IAM conditions allow you to enforce time-based access using the `request.time` attribute, which can restrict access to specific hours. By granting a custom role with read-only permissions on the BigQuery datasets and attaching a condition that `request.time` falls between 9 AM and 5 PM, the auditors from the external Google Workspace domain will only have access during working hours. This approach is native to IAM and does not require external automation or network-level controls.

Answer

Configure a Cloud Scheduler job to add and remove the auditors' group membership at the required times.

Answer

Create an Organization Policy with a time constraint on the datasets.

Answer

Use VPC Service Controls with an access level that allows during working hours.

Question 15

A security team wants to explicitly deny access to a Cloud Storage bucket for all users except the bucket owner. Currently, there are allow policies at the project level granting Storage Object Viewer to all users. What is the most efficient way to implement this?

Accepted Answer

Create an IAM deny policy on the bucket with a deny rule for all principals (principalSet: allUsers) and an exception for the bucket owner.. Option D is correct because Google Cloud IAM deny policies explicitly deny access to resources, overriding any allow policies. By creating a deny rule on the bucket with `principalSet: allUsers` as the denied principal and an exception for the bucket owner, you effectively block all users except the owner, regardless of project-level allow roles. This is the most efficient approach as it does not require modifying existing project-level policies or removing roles.

Answer

Create an Organization Policy that denies access to the bucket for all users except the owner.

Answer

Modify the project-level role to include a condition that only allows the bucket owner.

Answer

Remove the project-level Storage Object Viewer role and grant it only to the bucket owner.