PCSE Configuring access within a cloud solution environment Practice Test 5 — 15 Questions

Question 1

A company has deployed a Cloud Run service that needs to access a Cloud SQL database. They have configured a service account for the Cloud Run service and granted it the Cloud SQL Client role. However, the application is receiving 'Permission denied' errors when trying to connect to the database. The database has a private IP and is in a VPC. What is the most likely cause?

Accepted Answer

Cloud Run cannot reach the private IP because it is not connected to the VPC via Serverless VPC Access.. Cloud Run services run in a Google-managed environment that is not automatically connected to a VPC. To reach a Cloud SQL instance with a private IP, the Cloud Run service must use Serverless VPC Access to establish a VPC connector, which enables direct traffic to the private IP. Without this connector, the service cannot route to the private IP, resulting in 'Permission denied' errors even though the IAM permissions are correct.

Answer

The service account lacks the cloudsql.instances.connect permission.

Answer

The service account is not authorized in the Cloud SQL instance's IAM policy.

Answer

The Cloud SQL instance requires a public IP for Cloud Run to connect.

Question 2

An organization wants to enforce that all IAM policy changes in their Google Cloud organization are logged and require approval. Which three Google Cloud capabilities can help achieve this? (Choose THREE.)

Accepted Answer

Organization policies with constraints. Organization policies with constraints (B) allow you to define and enforce guardrails for IAM policy changes, such as using the `iam.policyServiceAccountKeyExpiryHours` constraint to require approval workflows via the Access Approval API. Cloud Asset Inventory with Cloud Pub/Sub notifications (C) can monitor and stream real-time updates to IAM policies, triggering approval processes. Cloud Audit Logs (E) record all IAM policy changes, providing an immutable audit trail that can be used to verify compliance and enforce approval requirements.

Answer

Cloud Run for Anthos

Answer

VPC Service Controls

Question 3

A company wants to provide secure access to an internal web application hosted on Compute Engine without exposing it to the public internet. Which Google Cloud service should they use?

Accepted Answer

Identity-Aware Proxy (IAP). Identity-Aware Proxy (IAP) is the correct choice because it provides a centralized authentication and authorization layer for applications accessed via HTTPS, allowing you to enforce access control policies based on user identity and context without requiring a VPN or public IP exposure. IAP works with Cloud Load Balancing to verify user credentials before allowing traffic to reach the Compute Engine instance, effectively securing the internal web application from the public internet.

Answer

Cloud NAT

Answer

Cloud Storage signed URLs

Answer

Cloud Load Balancing

Question 4

Refer to the exhibit. An organization has the above IAM policy on a project. The user user@example.com is trying to view a list of objects in a bucket from IP address 10.1.1.1. What will be the result?

Accepted Answer

The user can list objects because the condition is satisfied.. Option D is correct because the IAM policy grants the `storage.objects.list` permission to `user@example.com` with a condition that requires the request to come from an IP address within the `10.0.0.0/8` range. Since the user is accessing from `10.1.1.1`, which falls within that CIDR block, the condition evaluates to true, allowing the list operation.

Answer

The user cannot list objects because the condition is evaluated as false.

Answer

The user cannot list objects because IAM conditions do not support IP-based restrictions.

Answer

The user can list objects because they have inherited roles/storage.admin permissions from the admin.

Question 5

A company assigns roles to Google Groups to simplify management. They have a group called data-engineers@example.com that needs access to BigQuery datasets. Instead of adding each user individually, they want to grant the group roles/bigquery.dataViewer at the project level. After granting the role, a new member added to the group reports they cannot query a dataset. What is the most likely reason?

Accepted Answer

The dataset is in a different project than the one where the role was granted.. Option A is correct because IAM roles granted at the project level apply only to resources within that project. If the BigQuery dataset resides in a different project, the group's project-level role does not grant access to that dataset. The user would need either a role granted at the dataset's project level or direct dataset-level permissions.

Answer

The user needs to be added directly to the dataset's access control list.

Answer

The dataset has been configured with private access control that overrides the project-level IAM.

Answer

The group does not have the necessary permissions because BigQuery does not support IAM groups.

Question 6

Which two authentication methods are available for applications to authenticate to Google Cloud APIs without using a service account key? (Choose TWO.)

Accepted Answer

Compute Engine metadata server default service account token. Option B is correct because the Compute Engine metadata server provides a default service account token that applications running on Compute Engine can use to authenticate to Google Cloud APIs without needing to manage a service account key file. This token is automatically obtained from the metadata server at http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token, and it is rotated automatically by Google, eliminating the need for key storage and rotation.

Answer

API key

Answer

OAuth 2.0 client ID

Answer

Service account key

Question 7

A security team wants to audit all actions performed by users on a critical Cloud Storage bucket. They have enabled Data Access audit logs. However, they notice that read requests are not being logged. What should they do to ensure all read requests are logged?

Accepted Answer

Configure bucket-level logging to record all access requests.. Option C is correct because bucket-level logging captures all access requests, including read operations, by recording detailed logs for each request made to the bucket. Data Access audit logs, while enabled, may not log all read requests due to exclusion filters or default configuration limitations, whereas bucket-level logging provides comprehensive access records directly from Cloud Storage.

Answer

Enable Access Transparency logs for the project.

Answer

Assign the Storage Legacy Bucket Reader role to the bucket.

Answer

Enable VPC Flow Logs for the network.

Question 8

An organization uses Cloud Identity to manage users and groups. They want to synchronize their existing on-premises Active Directory with Cloud Identity. Which tool should they use?

Accepted Answer

Google Cloud Directory Sync (GCDS). Google Cloud Directory Sync (GCDS) is the correct tool because it is specifically designed to synchronize users, groups, and aliases from an on-premises Active Directory (or LDAP server) into Cloud Identity without requiring federation. GCDS maps AD attributes to Cloud Identity fields and runs on a scheduled basis to keep the cloud directory in sync, making it the appropriate choice for this use case.

Answer

Third-party SAML identity provider

Answer

Identity Platform

Answer

Cloud Workflows

Question 9

A company wants to grant a support team member the ability to view the IAM policy of a project (who has which roles) without being able to modify it. What is the least privileged predefined role that provides this access?

Accepted Answer

roles/iam.securityReviewer. The roles/iam.securityReviewer role grants read-only access to IAM policies and permissions across the project, including the ability to view who has which roles, without allowing modifications. This is the least privileged predefined role that provides exactly this access, as it is scoped to security-related read operations only.

Answer

roles/viewer

Answer

roles/iam.securityAdmin

Answer

roles/iam.roleViewer

Question 10

A DevOps engineer accidentally assigned the role roles/editor to a service account used by a backend service. This gives the service account excessive permissions. The engineer wants to remove the role from the service account. What is the correct command?

Accepted Answer

gcloud projects remove-iam-policy-binding PROJECT_ID --member serviceAccount:SA_EMAIL --role roles/editor. Option A is correct because `gcloud projects remove-iam-policy-binding` is the specific command to remove an IAM role binding from a project-level policy for a given member (service account). The syntax correctly includes the `--member` flag with the `serviceAccount:` prefix and the `--role` flag specifying `roles/editor`, which removes the excessive Editor role from the service account.

Answer

gcloud iam policy-bindings remove --member serviceAccount:SA_EMAIL --role roles/editor

Answer

gcloud iam service-accounts remove-role SA_EMAIL --role roles/editor

Answer

gcloud projects set-iam-policy PROJECT_ID policy.yaml

Question 11

An administrator wants to enforce that a user can only create virtual machines in a specific subnet of a VPC network. What IAM condition should be added to the compute.instanceAdmin role binding?

Accepted Answer

resource.name == "projects/PROJECT_ID/regions/us-central1/subnetworks/SUBNET". Option A is correct because the IAM condition `resource.name` with the full resource name of the subnet (including the region) is the proper way to restrict virtual machine creation to a specific subnet. The `compute.instanceAdmin` role binding with this condition ensures that the user can only create instances whose subnet matches the specified resource name, enforcing the subnet-level constraint.

Answer

resource.name == "projects/PROJECT_ID/subnetworks/SUBNET"

Answer

api.getAttribute("compute.googleapis.com/zone", "") != "us-central1"

Answer

resource.subnetwork == "projects/PROJECT_ID/subnetworks/SUBNET"

Question 12

A company uses Organization Policies to restrict public IP addresses on Compute Engine instances. An engineer created a new project and cannot launch any instances because the organization policy denies external IPs. However, the engineer needs to launch a bastion host with an external IP. What should they do?

Accepted Answer

Add an exception to the organization policy for the project.. Option A is correct because organization policies can have exceptions per project. Option B is a workaround but not the direct fix. Option C avoids external IP, which may not meet requirements. Option D is too drastic.

Answer

Request that the organization policy be removed at the org level.

Answer

Use a VM with a NAT gateway instead.

Answer

Create a new folder with a different policy and move the project.

Question 13

A company wants to grant a user the ability to delete a Cloud SQL instance but not be able to modify any other settings. What is the least privileged role?

Accepted Answer

Use a custom role with only cloudsql.instances.delete permission.. Option D is correct because the least privileged role that allows deleting a Cloud SQL instance without granting any other permissions is a custom role containing only the `cloudsql.instances.delete` permission. Predefined roles like viewer, editor, or admin include broader permissions that would allow modifying other settings, violating the principle of least privilege.

Answer

roles/cloudsql.viewer

Answer

roles/cloudsql.editor

Answer

roles/cloudsql.admin

Question 14

A company uses Binary Authorization for their GKE clusters. They want to ensure that only images signed by their internal CI/CD system can be deployed. Which IAM role is required for the CI/CD service account to attach attestations?

Accepted Answer

roles/binaryauthorization.attestorsEditor. The correct answer is D because the `roles/binaryauthorization.attestorsEditor` IAM role grants the necessary permissions to create and manage attestations, including the `binaryauthorization.attestors.attest` permission required for a CI/CD service account to attach an attestation to a container image. Without this role, the service account cannot create a signed attestation that Binary Authorization will accept during admission control.

Answer

roles/binaryauthorization.attestorsViewer

Answer

roles/container.developer

Answer

roles/cloudkms.signerVerifier

Question 15

An organization has three projects: dev, staging, prod. They use Cloud Build to deploy code. The Cloud Build service account in the dev project needs to deploy to GKE in the prod project. To allow cross-project deployment, what should the Cloud Build service account be granted in the prod project?

Accepted Answer

roles/container.developer on the prod project.. The Cloud Build service account in the dev project needs to deploy workloads to a GKE cluster in the prod project. The role `roles/container.developer` on the prod project grants the necessary permissions to create, update, and delete pods, deployments, and services within the cluster, which is required for deployment. This role also includes `container.clusters.get` and `container.clusters.update` to interact with the cluster, making it the correct choice for cross-project GKE deployment.

Answer

roles/container.clusterViewer on the prod cluster.

Answer

roles/storage.objectViewer on the prod bucket.

Answer

roles/iam.serviceAccountUser on the GKE node service account in prod.