PCSE Configuring access within a cloud solution environment Practice Test 3 — 15 Questions

Question 1

A company has a Google Group called team-a@example.com that contains all developers. The developers need to deploy Cloud Functions. What is the best practice to grant the necessary permissions?

Accepted Answer

Grant the group roles/cloudfunctions.developer on the project.. Option C is correct because granting the IAM role `roles/cloudfunctions.developer` to the Google Group at the project level follows the principle of least privilege and allows all members of the group to deploy Cloud Functions without granting excessive permissions. This approach centralizes permission management via the group, avoiding the need to manage individual user IAM bindings.

Answer

Add each developer's email to the IAM policy with roles/cloudfunctions.developer.

Answer

Grant the group roles/cloudfunctions.developer at the organization level.

Answer

Grant the group roles/cloudfunctions.admin on the project.

Question 2

An organization wants to enforce that all Compute Engine instances are created with a specific service account that has only the permissions defined by a custom role. Additionally, users must not be able to override this service account. Which two mechanisms should be combined?

Accepted Answer

An Organization Policy with constraint constraints/compute.setServiceAccount and an IAM deny policy to deny the iam.serviceAccounts.actAs permission on other service accounts.. Option C is correct because it combines an Organization Policy constraint (`constraints/compute.setServiceAccount`) that prevents users from specifying a different service account when creating Compute Engine instances, with an IAM deny policy that blocks the `iam.serviceAccounts.actAs` permission on all other service accounts. Together, these enforce that only the designated service account can be used, and users cannot override it.

Answer

Use Cloud Audit Logs to monitor and alert on non-compliant instances.

Answer

VPC Service Controls to restrict the service account usage.

Answer

Grant users only the Compute Instance Admin v1 role and remove the actAs permission.

Question 3

A company wants to allow its on-premises applications to access Google Cloud resources using short-lived credentials without storing a service account key file. Which solution should they use?

Accepted Answer

Configure Workload Identity Federation between the on-premises identity provider and Google Cloud.. Workload Identity Federation allows on-premises applications to exchange tokens from an external identity provider (IdP) for short-lived Google Cloud access tokens, eliminating the need to store a service account key file. This solution meets the requirement for short-lived credentials and avoids the security risk of long-lived static keys.

Answer

Set up a Cloud VPN connection and use private IPs to access resources.

Answer

Create a service account and download a JSON key file to the on-premises server.

Answer

Use signed URLs to grant access for each request.

Question 4

A developer is creating a Cloud Function that needs to access a Cloud SQL database. They have granted the function's service account the Cloud SQL Client role. However, the function still gets permission denied. What is the most likely issue?

Accepted Answer

The Cloud SQL instance is not configured with an authorized network that includes the function's IP range, or the function is not using the Cloud SQL Auth proxy.. Option C is correct because Cloud Functions use the Cloud SQL Auth proxy, which requires the service account to have the Cloud SQL Client role, but also the function must be in the same VPC or configured with VPC connector, otherwise it cannot reach the database IP. However, the most common reason is that the function is not using the Cloud SQL Auth proxy or the connection string is incorrect. But given the options, the most likely is that the function is trying to connect via public IP without proper authorized networks. Option A is wrong because the Cloud SQL Client role is sufficient if networking is correct. Option B is wrong because Cloud SQL Admin is unnecessary. Option D is wrong because Cloud SQL does not require VPN if using Cloud SQL Auth proxy.

Answer

The service account needs the Cloud SQL Admin role instead.

Answer

The function must use a VPN to connect to Cloud SQL.

Answer

The function needs to be in the same region as the Cloud SQL instance.

Question 5

A security auditor needs to review all IAM policy changes made in the last 30 days across multiple projects. The auditor has the Organization Viewer role at the organization level. What is the most efficient way to provide access without giving unnecessary permissions?

Accepted Answer

Grant the auditor the roles/iam.securityReviewer role at the organization level.. Option D is correct because the roles/iam.securityReviewer role at the organization level grants read-only access to all IAM policies and audit logs across all projects in the organization, without granting any write or management permissions. This allows the auditor to review IAM policy changes efficiently without needing per-project assignments.

Answer

Grant the auditor the Logs Viewer role at the organization level to view audit logs of IAM changes.

Answer

The existing Organization Viewer role already provides access to IAM policies across all projects.

Answer

Grant the auditor the Project Viewer role on each project.

Question 6

Which TWO practices help implement the principle of least privilege when configuring access to Google Cloud resources? (Choose two.)

Accepted Answer

Create custom roles that include only the specific permissions needed.. Option C is correct because creating custom roles allows you to define a precise set of permissions, ensuring that a principal has only the minimum permissions required to perform their job function. This directly implements the principle of least privilege by avoiding the broad permissions often included in predefined roles.

Answer

Grant roles at the organization level to simplify administration.

Answer

Use a single service account for all Cloud Functions in a project to simplify key management.

Answer

Grant IAM roles directly to individual users for better traceability.

Question 7

Which THREE are valid considerations when designing cross-organization access for Cloud Storage? (Choose three.)

Accepted Answer

Uniform bucket-level access disables ACLs, simplifying cross-org access management.. Uniform bucket-level access disables Access Control Lists (ACLs) and relies solely on IAM permissions for bucket access. This eliminates the complexity of managing both ACLs and IAM across organizations, making cross-org access management simpler and more consistent.

Answer

Signed URLs require the requester pays configuration to be enabled.

Answer

VPC Service Controls must be configured to allow cross-org IAM policies.

Question 8

Which TWO are correct statements about IAM deny policies? (Choose two.)

Accepted Answer

Deny policies support conditions to restrict when the deny applies.. Option B is correct because IAM deny policies support conditions that allow you to specify when the deny should apply, such as based on IP address, date/time, or resource tags. This enables fine-grained control over access restrictions, ensuring that the deny only takes effect under defined circumstances.

Answer

Deny policies are prioritized based on the resource hierarchy (organization highest).

Answer

Deny policies cannot override an allow policy if the member is explicitly granted.

Answer

Deny policies can be applied at any resource level including individual resources.

Question 9

A new employee needs to be able to create and manage Compute Engine instances. Which role should be granted at the project level?

Accepted Answer

roles/compute.instanceAdmin. The roles/compute.instanceAdmin role grants permissions to create, modify, and delete Compute Engine instances, including starting, stopping, and managing disks and snapshots, but does not allow changing project-wide network configurations or granting IAM policies. This is the least-privilege role that meets the requirement to 'create and manage Compute Engine instances' at the project level.

Answer

roles/compute.admin

Answer

roles/compute.networkAdmin

Answer

roles/compute.viewer

Question 10

A company uses Cloud Storage buckets to store sensitive data. They want to allow a third-party auditor to list bucket contents but not download the objects. Which IAM role should be assigned?

Accepted Answer

roles/storage.legacyBucketReader. The correct answer is A because roles/storage.legacyBucketReader grants permission to list the contents of a bucket (via the storage.buckets.get and storage.objects.list permissions) without allowing object downloads, which require storage.objects.get. This role is specifically designed for scenarios where a user needs to enumerate objects but not read their data, aligning with the auditor's requirement.

Answer

roles/storage.objectAdmin

Answer

roles/storage.objectViewer

Answer

roles/storage.objectCreator

Question 11

An organization wants to enforce that all Cloud Storage buckets are created with uniform bucket-level access enabled. Which policy can be used to achieve this?

Accepted Answer

Organization policy with constraint `constraints/storage.uniformBucketLevelAccess`. Option D is correct because the Organization Policy with the constraint `constraints/storage.uniformBucketLevelAccess` is a native Google Cloud policy that can be applied at the organization, folder, or project level to enforce that all new Cloud Storage buckets are created with uniform bucket-level access enabled. This policy prevents the creation of buckets with fine-grained ACLs, ensuring consistent access control across the organization.

Answer

Audit logs to detect non-compliance

Answer

VPC Service Controls perimeter

Answer

IAM custom role with permission to enforce uniform access

Question 12

A user is getting a permission denied error when trying to access a Cloud SQL instance from a Compute Engine VM. The VM's service account has the Cloud SQL Client role. What is the most likely cause?

Accepted Answer

The Cloud SQL API is not enabled for the project.. Even with correct IAM roles, the Cloud SQL API must be enabled for the project. The service account being attached is confirmed by the role assignment, private IP is not required for Client role, and using a proxy is optional but not the cause of permission denied.

Answer

The service account is not attached to the VM.

Answer

The user is not using a Cloud SQL proxy.

Answer

The Cloud SQL instance does not have a private IP.

Question 13

A DevOps team wants to allow a CI/CD pipeline to deploy to Compute Engine using a service account. What is the best practice for managing service account keys?

Accepted Answer

Use workload identity federation.. Workload identity federation is the best practice because it allows the CI/CD pipeline to impersonate a service account without managing or storing any long-lived service account keys. This eliminates the risk of key leakage and rotation overhead, as authentication is done via an external identity provider (e.g., GitHub Actions, GitLab CI) using OIDC tokens. Google Cloud's workload identity federation supports OIDC (OpenID Connect) and SAML 2.0, enabling secure, keyless access from external workloads.

Answer

Use a service account key distributed to each developer.

Answer

Generate a key and store it in Cloud Secret Manager.

Answer

Use a service account key stored in the source code repository.

Question 14

A company uses Access Context Manager to restrict access to Cloud Resources based on device policy. They want to allow access only from devices that are company-managed and have disk encryption enabled. What should they configure?

Accepted Answer

Create an access level with device policy conditions for corporate-owned and disk encryption.. Option C is correct because Access Context Manager allows you to create access levels that define device policy conditions, such as requiring devices to be corporate-owned and have disk encryption enabled. These access levels are then applied to the organization's access policies to restrict access to cloud resources based on the device's compliance status.

Answer

Create an IAM condition requiring a specific device tag.

Answer

Use Identity-Aware Proxy with device policy.

Answer

Use VPC Service Controls with a device restriction.

Question 15

An application needs to authenticate to Google Cloud APIs from an on-premises server. Which approach is recommended for long-lived access?

Accepted Answer

Create a service account key and store it securely on the server.. Option D is correct because service account keys provide a long-lived, static credential that can be securely stored on an on-premises server for authenticating to Google Cloud APIs. Unlike user accounts or OAuth flows, service account keys do not require interactive login or token refresh, making them suitable for automated, long-running workloads.

Answer

Use a user account with OAuth 2.0 tokens.

Answer

Use workload identity federation with an on-premises identity provider.

Answer

Use API keys.