PCSE Configuring access within a cloud solution environment Practice Test 7 — 15 Questions

Question 1

Which TWO of the following are valid ways to grant cross-project access to a Cloud Storage bucket in Project A from a Compute Engine VM in Project B?

Accepted Answer

Grant the VM's service account (from Project B) the roles/storage.objectViewer role on the bucket in Project A.. Option B is correct because granting the VM's service account the roles/storage.objectViewer role on the bucket in Project A uses IAM-based cross-project access. IAM roles are the recommended method for granting access to resources across projects, as they allow a service account from one project to be granted permissions on resources in another project without needing to share keys or disable uniform bucket-level access.

Answer

Disable uniform bucket-level access on the bucket and add an ACL entry for the VM's service account.

Answer

Grant the VM's user account the roles/storage.objectViewer role on the bucket, and have the VM use gcloud with the user's credentials.

Answer

Provide the bucket's service account key to the VM and have the VM use that key for authentication.

Question 2

Which THREE of the following are best practices for managing service accounts in Google Cloud?

Accepted Answer

Use the principle of least privilege when granting roles to service accounts.. Option A is correct because the principle of least privilege is a fundamental security best practice in Google Cloud IAM. Granting only the minimal roles necessary to a service account reduces the attack surface and limits potential damage from compromised credentials. This aligns with Google's recommended approach for managing identities in cloud environments.

Answer

Assign a single service account to all Compute Engine instances for simplicity.

Answer

Add service accounts to a Google Group to manage permissions.

Question 3

Which TWO of the following are true regarding Cloud Identity and Access Management (IAM) conditions?

Accepted Answer

IAM conditions can restrict access based on the current date and time.. Option A is correct because IAM conditions support temporal attributes, including date/time restrictions, using the `request.time` attribute. This allows policies to grant access only during specific hours or days, such as allowing access only during business hours. The condition is expressed using the Common Expression Language (CEL) syntax, e.g., `request.time.getHours("America/New_York") >= 9 && request.time.getHours("America/New_York") <= 17`.

Answer

IAM conditions are supported for all Google Cloud resources.

Answer

IAM conditions can be applied to a role binding that supports all resources.

Answer

IAM conditions can restrict access based on the user's email domain.

Question 4

A small business runs a single Google Cloud project with a few Compute Engine instances. The administrator created a custom IAM role with the permission compute.instances.stop to allow a junior admin to stop instances. However, the junior admin reports that when they try to stop an instance, they get a 403 error. The junior admin has the custom role bound at the project level. What is the most likely cause?

Accepted Answer

The custom role is missing additional permissions required to stop an instance, such as compute.instances.list and compute.zones.get.. D is correct because stopping a Compute Engine instance requires more than just compute.instances.stop; the IAM system also needs permissions to read the instance metadata and zone information. Specifically, the junior admin lacks compute.instances.list and compute.zones.get, which are necessary for the API to resolve the instance resource and validate the request, leading to a 403 error despite having the stop permission.

Answer

The instance is already stopped and they need the compute.instances.start permission.

Answer

The custom role includes compute.instances.stop, which is not a valid permission.

Answer

The junior admin must use the gcloud command with the --account flag to specify a different service account.

Question 5

A large enterprise has multiple Google Cloud organizations due to an acquisition. They want to allow a team in Org A to access a Cloud Spanner database in Org B. The team in Org A uses a service account for their application. They have set up Workload Identity Federation between the two organizations. The service account in Org B has the roles/spanner.databaseUser role on the database. The service account in Org A has been granted the roles/iam.workloadIdentityUser role on the service account in Org B. However, access attempts are failing with a permission denied error. What is the most likely missing configuration?

Accepted Answer

The service account in Org A does not have the roles/iam.serviceAccountTokenCreator role on the service account in Org B.. Option D is correct because the external identity (service account in Org A) must be impersonating the service account in Org B, but the impersonation requires the service account in Org A to have the roles/iam.serviceAccountTokenCreator role on the service account in Org B. Option A is wrong because the roles are correctly assigned. Option B is wrong because the Spanner database does not need the impersonation role. Option C is wrong because the project-level Spanner role would not be the issue.

Answer

The project in Org B has not granted the roles/spanner.databaseUser role at the project level.

Answer

The Spanner database does not have the service account in Org A granted access directly.

Answer

The service account in Org B does not have the roles/iam.workloadIdentityUser role on itself.

Question 6

A company has a Google Cloud organization with several hundred projects. They are using VPC Service Controls to protect sensitive data in BigQuery. They have a service perimeter that includes the projects containing the sensitive datasets. Users in a separate perimeter (perimeter B) need to query a BigQuery dataset in the sensitive perimeter using federated queries from Cloud SQL. The users are authenticated via Cloud Identity and have appropriate IAM roles, but queries are failing. The Cloud SQL instance is in perimeter B. What is the most likely cause?

Accepted Answer

The sensitive perimeter does not have an ingress rule to allow requests from the Cloud SQL service in perimeter B.. VPC Service Controls enforce perimeters that block all data access across perimeter boundaries by default. For a Cloud SQL instance in perimeter B to query BigQuery in the sensitive perimeter via federated queries, the sensitive perimeter must have an ingress rule explicitly allowing requests from the Cloud SQL service (or the VPC network) in perimeter B. Without this ingress rule, the request is denied at the perimeter boundary, regardless of IAM permissions.

Answer

The Cloud SQL instance must be moved into the sensitive perimeter to access BigQuery.

Answer

The users do not have the appropriate IAM role on the BigQuery dataset.

Answer

The BigQuery dataset does not have a corresponding table for export to Cloud SQL.

Question 7

A financial services company is migrating to Google Cloud and needs to enforce strict access controls. They want to ensure that all access to Cloud Storage buckets containing sensitive data is logged and that only authorized IP ranges can write to those buckets. They have set up IAM conditions to allow access only from the corporate IP range. However, they notice that some write operations are not being logged in the Cloud Audit Logs for the bucket. The write operations are coming from a service account that is part of a batch job running on Compute Engine instances within the corporate network. What is the most likely reason for the missing logs?

Accepted Answer

Data Access audit logs for Cloud Storage are not enabled.. Option B is correct because Cloud Audit Logs for Cloud Storage require explicit enabling of Data Access audit logs to capture read, write, and other data-level operations. By default, only Admin Activity audit logs are enabled, which log metadata changes but not data access like object writes. The IAM condition correctly restricts write access to the corporate IP range, but without enabling Data Access audit logs, the write operations from the service account are not recorded.

Answer

The IAM condition is preventing the audit logs from being generated.

Answer

The batch job is using a different service account that does not have permission to write.

Answer

The write operations are not being captured because they are performed by a service account.

Question 8

A startup is using Cloud Functions to process files uploaded to a Cloud Storage bucket. The Cloud Function is triggered by finalize events on the bucket. The developers created a service account for the Cloud Function and granted it the roles/storage.objectViewer role on the bucket. However, the function fails with a permission denied when trying to read the file. The function has the following XML in the event context: 'event_id'. What is the most likely issue?

Accepted Answer

The Cloud Function is using the default App Engine service account instead of the custom service account.. The most likely issue is that the Cloud Function is using the default App Engine service account instead of the custom service account that was granted the roles/storage.objectViewer role. When a Cloud Function is deployed without explicitly specifying a service account, it defaults to the App Engine default service account (project-id@appspot.gserviceaccount.com), which does not have the necessary permissions to read the file. The custom service account with the objectViewer role exists but is not assigned to the function, causing the permission denied error.

Answer

The service account does not exist.

Answer

The bucket is in a different project, and cross-project access is not configured.

Answer

The Cloud Function is not configured to be triggered by the correct event type.

Question 9

A security engineer is configuring service account impersonation for cross-project access. Which two statements about service account impersonation are true? (Choose two.)

Accepted Answer

Impersonation requires the iam.serviceAccounts.getAccessToken permission.. Option C is correct because the iam.serviceAccounts.getAccessToken permission is required to generate an access token for a service account, which is the core mechanism of impersonation. Without this permission, the Security Token Service cannot issue a token on behalf of the service account, making impersonation impossible.

Answer

A user must have the roles/iam.serviceAccountUser role on the service account to impersonate it.

Answer

The Security Token Service (sts.googleapis.com) must be enabled for impersonation.

Answer

Service accounts cannot impersonate other service accounts.

Question 10

A healthcare company's data science team needs to query BigQuery tables containing sensitive patient data. The company policy requires that all queries be logged and audited. The team has been granted the bigquery.user role on the project. However, when attempting to query a specific table in a dataset, they receive the error: "Access Denied: Table X: User does not have permission to query table X." The dataset has a custom IAM role assigned to the team's Google Group. The custom role includes the permissions: bigquery.datasets.get, bigquery.tables.get, bigquery.tables.list, and bigquery.jobs.create. The engineer verifies that the bigquery.user role does include bigquery.jobs.create. The engineer also confirms that the table exists and the dataset is in the same region as the project. What is the most likely cause of the access denied error?

Accepted Answer

The custom role does not include the bigquery.tables.getData permission.. The error 'Access Denied: Table X: User does not have permission to query table X' indicates that the user lacks the permission to read the actual table data. The custom role assigned to the team's Google Group includes bigquery.tables.get (metadata) and bigquery.tables.list, but not bigquery.tables.getData, which is required to read table rows. Without bigquery.tables.getData, even with bigquery.jobs.create and dataset-level metadata permissions, query execution fails because BigQuery enforces data access separately from metadata and job creation.

Answer

The team is not granted the bigquery.jobUser role on the project.

Answer

The team is not granted the bigquery.metadataViewer role on the dataset.

Answer

The dataset is in a different region than the project's default location, causing cross-region access restrictions.

Question 11

A multinational corporation is implementing a least-privilege access model for their CI/CD pipeline using Cloud Build, Artifact Registry, and GKE. The pipeline builds container images, pushes them to Artifact Registry, and deploys them to GKE clusters. The security team wants to ensure that the Cloud Build service account used by the pipeline has only the minimum necessary permissions. The service account currently has: roles/cloudbuild.builds.editor, roles/artifactregistry.writer, and roles/container.developer. After a successful build and push, the deployment step completes without errors, but the newly deployed pods on GKE immediately fail with ImagePullBackOff errors. The error message indicates: "Failed to pull image 'us-central1-docker.pkg.dev/my-project/my-repo/my-image:latest': rpc error: code = PermissionDenied desc = unauthenticated: Request had insufficient authentication scopes." The GKE cluster is a private cluster with Workload Identity enabled. The node pool uses a default Compute Engine service account with only the storage scope. What is the most likely missing permission or configuration that prevents the pods from pulling images?

Accepted Answer

The service account needs roles/iam.serviceAccountUser on the GKE node service account.. Option D is correct because the Cloud Build service account needs the `roles/iam.serviceAccountUser` permission on the GKE node's Compute Engine service account to impersonate it. With Workload Identity enabled, the GKE node's service account (not the Cloud Build service account) is what authenticates to Artifact Registry when pods pull images. Without this delegation, the Cloud Build service account cannot act on behalf of the node's service account, leading to the `PermissionDenied` error.

Answer

The service account needs roles/artifactregistry.reader on the repository.

Answer

The service account needs roles/storage.objectViewer on the bucket where images are cached.

Answer

The service account needs roles/container.clusterAdmin on the cluster.

Question 12

A startup company has a single Google Cloud project with multiple developers. To simplify identity management, they created a service account for each developer and granted them the roles/editor role on the project. However, the security team is concerned about the over-privileged access. They want to implement a more secure approach while maintaining operational efficiency. The developers need to: create Compute Engine instances, manage Cloud Storage buckets, and deploy App Engine apps. The company has a small team and does not require fine-grained access control per developer. What is the recommended approach to reduce privileges while meeting the developers' needs?

Accepted Answer

Remove the editor role, create a custom role with the required permissions, and assign the custom role to a Google Group containing all developers.. Option D is correct because it removes the overly permissive Editor role and replaces it with a custom role containing only the specific permissions needed for Compute Engine, Cloud Storage, and App Engine. Assigning this custom role to a Google Group that contains all developers simplifies identity management and ensures consistent, least-privilege access without per-user assignment overhead.

Answer

Remove the editor role and grant each developer the roles/owner role on the project.

Answer

Remove the editor role and create a custom role with the required permissions, then assign the custom role to each developer individually.

Answer

Remove the editor role and grant each developer the roles/iam.securityReviewer role.

Question 13

A company needs to grant a service account the ability to manage Compute Engine instances (start, stop, create) in a specific set of projects. The administrator wants to follow the principle of least privilege. Which TWO steps should the administrator take? (Choose TWO.)

Accepted Answer

Use IAM Conditions to restrict the service account's access to only the required projects or resources.. Option C is correct because IAM Conditions allow the administrator to restrict the service account's permissions to a specific set of projects or resources, enforcing least privilege by limiting the scope of the granted role. This ensures the service account can only manage Compute Engine instances in the designated projects, not all projects in the folder or organization.

Answer

Grant the predefined roles/compute.viewer role to the service account at the folder level.

Answer

Use Cloud IAP to tunnel into Compute Engine instances to perform management tasks.

Answer

Grant the predefined roles/compute.admin role to the service account at the organization level.

Question 14

Refer to the exhibit. A security engineer reviews the IAM policy for a service account. What is the effect of the condition?

Accepted Answer

The user can only use the service account before December 31, 2025.. Option D is correct because the condition in the IAM policy uses the `request.time` attribute with a date/time comparison operator, which is a supported variable in IAM conditions. The condition `StringEquals` with `request.time` and a specific date (e.g., `2025-12-31T23:59:59Z`) restricts access to only before that timestamp, effectively granting access only until December 31, 2025. This is a common pattern for time-based access control in cloud IAM policies.

Answer

The user can only use the service account when the request originates from a specific IP range.

Answer

The condition has no effect because request.time is not a supported variable in IAM conditions.

Answer

The user can only use the service account when the resource is in a specific region.

Question 15

A company uses a shared VPC with multiple service projects. A security administrator created an organization policy with the constraint 'gcp.resourceLocations' to restrict Cloud SQL instance creation to only the 'us-central1' region. The policy is applied at the organization level. A Cloud SQL administrator is using a service account with the predefined role 'roles/cloudsql.admin' (also granted at the organization level) to create instances. Despite the organization policy, the service account successfully creates a Cloud SQL instance in the 'europe-west1' region. The administrator verifies that the organization policy is active and the constraint is enforced. What is the most likely reason the policy is not preventing the creation?

Accepted Answer

The organization policy is set to 'dry-run' mode, so it logs violations but does not deny the operation.. Option A is correct because the organization policy constraint 'gcp.resourceLocations' can be set to 'dry-run' mode, which logs violations but does not deny the operation. In this scenario, the policy is active and enforced, but if it is in dry-run mode, it will not block the creation of Cloud SQL instances in non-compliant regions. The service account's successful creation in 'europe-west1' indicates that the policy is not actively denying the request, which aligns with dry-run behavior.

Answer

The organization policy is applied at the organization level, but the service account's permissions are also at the organization level, causing an override.

Answer

The service account has the 'Organization Policy Administrator' role, which allows it to bypass constraints.

Answer

The gcp.resourceLocations constraint does not apply to Cloud SQL instances.