PCSE Configuring access within a cloud solution environment Practice Test 4 — 15 Questions

Question 1

A security administrator wants to ensure that only requests coming through Identity-Aware Proxy (IAP) can access a backend service running on Compute Engine. Which configuration is required?

Accepted Answer

Set firewall rules to allow only traffic from IAP proxy IP ranges.. Option D is correct because Identity-Aware Proxy (IAP) uses a fixed set of Google-owned IP ranges to forward authenticated and authorized requests to backend services. By configuring VPC firewall rules to allow ingress only from these IAP proxy IP ranges, the administrator ensures that any traffic not originating from IAP is blocked, effectively restricting access to IAP-authorized requests only.

Answer

Use a VPN between IAP and backend.

Answer

Configure Cloud Armor to block non-IAP traffic.

Answer

Configure the backend service to require IAP credentials.

Question 2

A company uses multiple GCP projects and wants to allow a service account from Project A to initiate Dataflow jobs in Project B. The service account in Project A has the Dataflow Developer role at the organization level. However, it fails with permission denied when trying to submit a job to Project B. What is the most likely issue?

Accepted Answer

The service account needs the Service Account User role on the Dataflow service account in Project B.. The service account from Project A has the Dataflow Developer role at the organization level, which grants permissions to create Dataflow jobs, but it still needs the Service Account User role (roles/iam.serviceAccountUser) on the Dataflow service account in Project B. When a Dataflow job is submitted, the job runs as a service account in the target project (Project B), and the caller must have the iam.serviceAccounts.actAs permission on that service account. Without this role, the API call fails with a permission denied error even though the Dataflow Developer role is present.

Answer

The organization policy restricts cross-project access.

Answer

The service account does not have permission to create Dataflow jobs in Project B because it is not a member of Project B.

Answer

The Dataflow API is not enabled in Project B.

Question 3

A company wants to implement least privilege access for a team that needs to monitor and manage Cloud Run services. Which two IAM roles should be considered? (Choose two.)

Accepted Answer

roles/run.viewer. Option C (roles/run.viewer) is correct because it grants read-only permissions to view Cloud Run services, configurations, and revisions, which is sufficient for monitoring without allowing modifications. Option D (roles/run.developer) is correct because it allows both viewing and managing Cloud Run services (e.g., deploying new revisions, updating configurations) while still restricting access to other GCP resources, aligning with least privilege for a team that needs to both monitor and manage.

Answer

roles/iam.serviceAccountUser

Answer

roles/run.admin

Answer

roles/run.invoker

Question 4

An organization is designing a secure multi-tenant SaaS environment on GKE. They want to isolate tenant workloads using GKE namespaces and IAM. Which two steps should they take? (Choose two.)

Accepted Answer

Use Kubernetes RBAC to restrict access within namespaces.. Option C is correct because Kubernetes RBAC is the native mechanism for controlling access to resources within a namespace. By defining Role and RoleBinding objects, you can precisely restrict which tenant users can perform actions (e.g., get, list, create pods) inside their assigned namespace, ensuring logical isolation without requiring separate clusters.

Answer

Enable GKE Dataplane V2 for network isolation.

Answer

Grant cluster-level IAM roles to tenant users.

Answer

Create a separate GKE cluster per tenant.

Question 5

A security engineer needs to set up access for a new team that will manage Cloud Storage buckets and objects. Which three IAM roles might be appropriate based on least privilege? (Choose three.)

Accepted Answer

roles/storage.objectAdmin. Option A (roles/storage.objectAdmin) is correct because it grants full control over objects in Cloud Storage buckets, including listing, reading, creating, and deleting objects, but does not allow modifying bucket-level permissions or deleting buckets. This aligns with least privilege for a team that needs to manage objects without full bucket administration.

Answer

roles/storage.legacyBucketOwner

Answer

roles/storage.admin

Question 6

A security engineer created the following IAM policy for a service account. The service account reports that it cannot access objects in bucket 'my-bucket'. What is the most likely cause?

Accepted Answer

The condition uses 'projects/my-project' but resource.name uses the numeric project ID.. The condition in the policy uses `resource.name.startsWith('projects/my-project')`, but the `resource.name` attribute for Google Cloud Storage objects uses the numeric project ID (e.g., `projects/123456789`), not the project name. This causes the condition to never evaluate to true, effectively denying all access to the bucket's objects. Option D correctly identifies this mismatch as the root cause.

Answer

The condition is too restrictive and blocks all objects.

Answer

The service account lacks the storage.buckets.get permission.

Answer

The role is missing storage.objects.list permission.

Question 7

A Dataflow job launched by service account 'my-sa@...' fails with permission denied. The audit log shows the above entry. What missing role is causing the failure?

Accepted Answer

roles/iam.serviceAccountUser on the worker service account. When a Dataflow job fails with permission denied and the audit log shows the entry, the missing role is typically roles/iam.serviceAccountUser on the worker service account. This role is required because the Dataflow service (or the service account launching the job) must be able to impersonate the worker service account to execute the pipeline's tasks. Without this role, the job cannot assume the identity of the worker service account, leading to the permission denied error.

Answer

roles/iam.workloadIdentityUser on the worker service account

Answer

roles/iam.serviceAccountAdmin on the worker service account

Answer

roles/iam.serviceAccountTokenCreator on the worker service account

Question 8

A user is unable to create a Compute Engine instance using a custom image from a family. What is the missing permission?

Accepted Answer

compute.images.use on the image family. To create a Compute Engine instance using a custom image from a family, the user needs the `compute.images.use` permission on the image family (or the specific image). This permission allows the user to use the image as a boot disk for new instances. Without it, the instance creation fails even if the user has `compute.instances.create` on the project.

Answer

compute.disks.create on the project

Answer

compute.instances.create on the project

Answer

compute.images.get on the image family

Question 9

A company has two Google Cloud projects: Project A (production) and Project B (development). They want to allow a service account in Project B to list Compute Engine instances in Project A. What is the most secure way to grant this access?

Accepted Answer

Add the service account as a member in Project A's IAM policy with the roles/compute.viewer role.. Option B is correct because it uses IAM to grant the service account from Project B the roles/compute.viewer role on Project A, which allows it to list Compute Engine instances without sharing keys or granting excessive permissions. This follows the principle of least privilege and avoids the security risks of key management.

Answer

Create a new service account in Project A, generate a key, and share it with the application in Project B.

Answer

Make the service account a project owner of Project A.

Answer

Export the service account key from Project B and use it in an application in Project A.

Question 10

A security team needs to enforce that only requests originating from a corporate IP range (203.0.113.0/24) can access a Cloud Storage bucket containing sensitive data. They have created a custom IAM role with storage.objects.get permission and attached a condition that requires the request to have a specific IP address. However, some legitimate users outside the IP range are unable to access the data. What is the most likely cause?

Accepted Answer

The IAM condition evaluates after authentication, and users are already authenticated; the condition is not restricting based on source IP correctly because the condition is on the user's identity, not the request's source IP.. Option D is correct because IAM conditions on a custom role are evaluated after the user is authenticated and authorized by IAM. The condition attribute 'source.ip' is used to restrict access based on the request's originating IP address, but if the condition is incorrectly applied to the user's identity (e.g., using a condition that checks the user's IP at the time of policy evaluation rather than the request's source IP), it may not enforce the intended restriction. In this scenario, the condition is likely misconfigured to evaluate the user's identity attributes rather than the request's source IP, allowing authenticated users from any IP to access the bucket, while legitimate users outside the corporate IP range are blocked because the condition does not correctly filter based on the request's source IP.

Answer

Users must use a VPN to be assigned a corporate IP, but some are not connected.

Answer

The condition uses the attribute 'request.network' instead of 'source.ip'.

Answer

The bucket ACL is set to deny all access by default.

Question 11

A developer needs to create and manage Compute Engine instances in a project. They require the ability to start, stop, and view instances, but should not be able to delete or modify network configurations. Which predefined role should be assigned?

Accepted Answer

roles/compute.instanceAdmin.v1. Option D is correct because the `roles/compute.instanceAdmin.v1` role grants permissions to start, stop, and view Compute Engine instances, but explicitly excludes permissions to delete instances or modify network configurations. This predefined role is designed for users who need operational control over instances without full administrative access.

Answer

roles/compute.viewer

Answer

roles/iam.serviceAccountUser

Answer

roles/compute.admin

Question 12

Refer to the exhibit. The output shows that Alice has the following IAM policy binding: 
{
  "role": "roles/storage.objectAdmin",
  "members": ["user:alice@example.com"],
  "condition": {
    "title": "storage_access_condition",
    "expression": "request.time < timestamp('2024-12-31T23:59:59Z') && source.ip in ['203.0.113.0/24']"
  }
}
Alice is currently working from an IP address 198.51.100.10, and the date is 2025-01-01. What is the result when Alice tries to upload an object to a bucket in this project?

Accepted Answer

Access is denied because both the time and IP conditions are not satisfied.. Alice's IAM policy binding includes a condition that requires both the request time to be before 2024-12-31T23:59:59Z and the source IP to be within 203.0.113.0/24. Since the current date is 2025-01-01, the time condition fails, and her IP address 198.51.100.10 is not in the allowed range. With a condition that uses AND logic, both subconditions must be true for access to be granted; because neither is satisfied, access is denied.

Answer

Access is denied because the role does not include storage.objects.create permission.

Answer

Access is granted because the condition is not evaluated for uploads.

Answer

Access is granted because the IP condition is satisfied.

Question 13

A company wants to use service account keys for an on-premises application that needs to authenticate to Google Cloud APIs. Which two practices should they follow to minimize security risks? (Choose TWO.)

Accepted Answer

Enable automatic key generation and disable any unused keys.. Option B is correct because enabling automatic key generation ensures that keys are created with strong cryptographic standards and that unused keys are promptly disabled, reducing the attack surface. This practice aligns with Google Cloud's recommendation to minimize the number of active keys and to avoid manual key management errors.

Answer

Allow end users to download and use service account keys directly.

Answer

Store the service account key in the application's source code for easy access.

Answer

Use a single service account key for all environments to simplify management.

Question 14

A company has an on-premises Active Directory and wants to allow on-premises users to access Google Cloud resources using their existing credentials without synchronizing passwords to Google Cloud. Which identity federation solution should they use?

Accepted Answer

Workload Identity Federation. Workload Identity Federation allows on-premises users to authenticate to Google Cloud using their existing Active Directory credentials without synchronizing passwords. It uses a federated identity model where the on-premises identity provider (IdP) issues tokens that are exchanged for Google Cloud short-lived credentials via the Security Token Service (STS), enabling access to Google Cloud resources while keeping passwords on-premises.

Answer

Service Account Key Exchange

Answer

Cloud Identity

Answer

Identity Platform

Question 15

Refer to the exhibit. A Terraform configuration applies an IAM binding with a condition. After applying this configuration, a member of the group data-scientists@example.com tries to query a BigQuery dataset on July 1, 2025. What will be the result?

Accepted Answer

Access is denied because the condition is no longer satisfied.. The correct answer is A because the IAM binding includes a condition that restricts access based on a date/time attribute. On July 1, 2025, the condition is no longer satisfied (e.g., the condition might require the request to occur before a specific date, such as before June 30, 2025). When the condition evaluates to false, the IAM binding does not grant access, even though the binding itself exists and the user is a member of the group.

Answer

Access is denied because the condition is invalid after the date.

Answer

Access is granted because the IAM binding exists.

Answer

Access is granted and the condition is ignored after the date.