PCSE Managing operations in a cloud solution environment Practice Test 2 — 15 Questions

Question 1

An organization wants to enforce data loss prevention (DLP) for sensitive data stored in Cloud Storage. Which THREE of the following Google Cloud services can be used together to inspect, classify, and automatically redact sensitive data in Cloud Storage? (Choose three.)

Accepted Answer

Cloud Storage. Cloud Storage is the target data repository where sensitive data resides, making it a necessary component of the DLP workflow. The Cloud Data Loss Prevention (DLP) API inspects and classifies the data, and Cloud Functions can be triggered by Cloud Storage events to automatically redact or transform the sensitive content before it is stored or accessed.

Answer

BigQuery

Answer

Dialogflow CX

Question 2

Refer to the exhibit. A security engineer runs the command to view recent decrypt operations on a Cloud KMS key. The output shows a successful decryption. However, the engineer is concerned about the exposure of the plaintext. Based on the log entry, what is the most accurate statement regarding the visibility of the decrypted plaintext?

Accepted Answer

The plaintext field is redacted by Cloud KMS, and the actual plaintext is not visible in the log entry.. Option C is correct because Cloud KMS automatically redacts the plaintext field in Cloud Audit Logs for decrypt operations. The log entry shows a successful decryption, but the actual decrypted data is never written to the logs; instead, the plaintext field is replaced with a redacted marker (e.g., `[REDACTED]`). This is a security feature to prevent sensitive data from being exposed in audit logs, even to users with access to view them.

Answer

The plaintext field is not present in the log because the service does not log it.

Answer

The plaintext field contains the base64-encoded ciphertext, and the engineer needs to decode it.

Answer

The plaintext field contains the actual decrypted data in plaintext, and the engineer should restrict access to the logs.

Question 3

A security engineer is troubleshooting an issue where a Compute Engine VM cannot connect to a Cloud SQL instance that has a private IP address. Both resources are in the same VPC network. The VM's firewall rules allow egress to any destination, and the Cloud SQL instance's authorized networks include the VPC network. What is the most likely cause of the connection failure?

Accepted Answer

The VPC network does not have a private services access connection (VPC peering) to the Service Networking API.. Cloud SQL instances with private IP addresses require a private services access connection (VPC peering) between the VPC network and the Service Networking API's managed tenant project. Without this VPC peering, the VM cannot route traffic to the Cloud SQL instance's private IP, even if both are in the same VPC network. Option C directly identifies this missing prerequisite.

Answer

Private Google Access is not enabled on the subnet.

Answer

The VM's firewall rules block traffic to the Cloud SQL IP range.

Answer

The Cloud SQL instance requires the Cloud SQL Auth proxy to be installed on the VM.

Question 4

A company is using Cloud Armor to protect their HTTP(S) load balancer. They have configured a security policy with a rule to block traffic from a specific IP address (10.0.0.1/32). During testing, they observe that requests from that IP are still reaching the backend. What is the most likely reason?

Accepted Answer

The security policy is not attached to the backend service.. Cloud Armor security policies must be explicitly attached to a backend service to take effect. If the policy is not attached, the rules within it—including the block rule for 10.0.0.1/32—are not evaluated, and traffic flows to the backend as if no policy exists. This is the most common cause when a configured rule appears to be ignored.

Answer

The backend service is configured to bypass Cloud Armor.

Answer

Cloud Armor does not support blocking specific IP addresses.

Answer

The rule has a lower priority than a default allow rule.

Question 5

A financial services company runs a PCI DSS-compliant workload on Google Cloud. They use a service account with roles/container.clusterAdmin to manage a GKE cluster. The security team has enabled Binary Authorization with a policy that requires all container images to be signed by a trusted authority. Recently, a developer reported that a new deployment failed with the error: 'Image verification failed: no signature found for digest sha256:abc...'. The image is stored in Artifact Registry and the developer built it using Cloud Build with a trigger that automatically signs images using Cloud KMS. The Cloud Build service account has roles/cloudkms.signerVerifier and roles/binaryauthorization.attestorsViewer. The Binary Authorization policy is configured to require at least one attestation from the trusted attestor. What is the most likely reason for the failure?

Accepted Answer

The Cloud Build service account lacks the roles/binaryauthorization.attestorsEditor role.. The Cloud Build service account has roles/cloudkms.signerVerifier and roles/binaryauthorization.attestorsViewer, which allow it to sign images and view attestors, but it lacks the roles/binaryauthorization.attestorsEditor role. Without this role, the service account cannot create or manage attestations in Binary Authorization, so even though the image is signed, no attestation is recorded, causing the policy to fail with 'no signature found'.

Answer

The container image is stored in a different registry that is not supported by Binary Authorization.

Answer

The GKE cluster's node service account does not have permission to verify attestations.

Answer

The Binary Authorization policy requires an attestation from a different attestor that is not configured.

Question 6

A large enterprise is migrating its on-premises Active Directory to Google Cloud using Managed Microsoft AD (Microsoft AD). They have established a VPN connection between their on-premises network and VPC. The domain controllers are fully synced, and users can authenticate from on-premises. However, applications running on Compute Engine VMs in the same VPC as Managed Microsoft AD are failing to authenticate using LDAP. The VMs are Linux-based and configured to use the Managed Microsoft AD domain for authentication via SSSD. The security team has verified that the firewall rules allow TCP/UDP 389 and 636 from the VMs to the Managed Microsoft AD IP addresses. The VMs can resolve the domain name (corp.example.com) to the correct IP of the Managed Microsoft AD domain controllers. What is the most likely cause of the authentication failure?

Accepted Answer

The VMs do not have the required network tag to allow inbound traffic from Managed Microsoft AD.. Managed Microsoft AD in Google Cloud uses internal VPC IP addresses for its domain controllers. For Linux VMs using SSSD to authenticate via LDAP, the VMs must be able to initiate outbound LDAP traffic to the Managed Microsoft AD IPs, and the Managed Microsoft AD service must be able to respond. However, Managed Microsoft AD enforces network security by requiring that only VMs with a specific network tag (by default 'allow-ad') can receive inbound traffic from the Managed Microsoft AD service. Without this tag on the VMs, the Managed Microsoft AD service will drop its response packets, causing authentication failures even though outbound firewall rules are open. The security team verified firewall rules for outbound traffic but missed this inbound tag requirement.

Answer

The VPN tunnel does not support LDAP traffic.

Answer

The DNS resolution returns the on-premises domain controller IP instead of the Managed Microsoft AD IP.

Answer

The Managed Microsoft AD service account does not have the 'domain controller' IAM role.

Question 7

A security engineer is investigating an incident where an attacker gained access to a Compute Engine instance's serial console logs, which contained sensitive data. Which TWO actions should the engineer take to prevent this type of exposure in the future? (Choose TWO.)

Accepted Answer

Enable Private Google Access on the VPC subnet to restrict serial console log access to internal IPs only.. Option B is correct because enabling Private Google Access on the VPC subnet ensures that serial console logs are accessed only via internal IP addresses, preventing exposure over the public internet. This restricts access to the serial console logs to resources within the VPC or connected networks, reducing the attack surface for data exfiltration.

Answer

Use Cloud NAT for outbound traffic to anonymize instance IP addresses in serial console logs.

Answer

Remove the roles/iam.serviceAccountUser role from all users to prevent them from accessing serial console.

Answer

Enable OS Login for the project to enforce SSH key management and prevent serial console access.

Question 8

Your organization has a multi-project environment with centralized logging in a dedicated project (logging-project). All VPC Service Controls perimeters are configured correctly. The security team needs to ensure that all audit logs from all projects are retained for 5 years and cannot be deleted or modified by any project administrator. They also want to restrict access to the logs to only the security team members (who have the 'Security Reviewer' role at the organization level). Currently, each project has its own log sink that exports to a BigQuery dataset in logging-project. The security team notices that some project administrators have inadvertently deleted logs from their project's BigQuery dataset. You need to recommend a solution that prevents log deletion and enforces the retention policy. What should you do?

Accepted Answer

Configure the _Required and _Default log buckets in each project to route logs to a Cloud Storage bucket in logging-project using log sinks. Enable Object Hold and set a retention policy of 5 years on the bucket. Grant the security team the Storage Object Admin role on the bucket.. Option D is correct because it uses a Cloud Storage bucket with a retention policy and Object Hold to prevent deletion or modification of logs for 5 years. The retention policy enforces a minimum retention period, and Object Hold prevents object deletion even by project administrators. Log sinks from each project's _Required and _Default log buckets route logs to this bucket, ensuring centralized, immutable storage. Granting the security team Storage Object Admin allows them to manage the bucket while restricting others.

Answer

Configure the log sinks to export logs to a Cloud Storage bucket with a lifecycle rule that deletes objects after 5 years. Set the bucket's IAM policy to deny the storage.objects.delete permission to all users except the security team.

Answer

Create a new BigQuery dataset in logging-project with a table expiration of 5 years and configure the log sinks to export to this dataset. Grant the security team the BigQuery Data Viewer role and revoke all other users' access to the dataset.

Answer

Create a new organization-level log sink that exports logs to a BigQuery dataset in logging-project. Grant the security team the BigQuery Data Owner role on the dataset and remove all other project administrators from the dataset's permissions.

Question 9

Drag and drop the steps to set up a Cloud VPN with a static route in the correct order.

Question 10

Drag and drop the steps to set up a binary authorization policy for a GKE cluster in the correct order.

Question 11

Match each VPC firewall rule component to its definition.

Question 12

Match each security command center tier to its capabilities.

Question 13

A security engineer is troubleshooting a VPC firewall rule that is not allowing traffic from a specific subnet to a Compute Engine instance. The target tag is set correctly. What is the most likely cause?

Accepted Answer

A deny rule with a higher priority (lower number) exists and blocks the traffic.. Option A is correct because if a deny rule with a lower priority number (higher priority) exists, it will take precedence and block traffic despite an allow rule. Option B is incorrect because the instance's internal IP address does not affect the source range check. Option C is incorrect because the problem states the target tag is set correctly. Option D is incorrect because the rule is in the correct network.

Answer

The firewall rule is in the wrong network.

Answer

The instance has an internal IP address that is not within the source range of the rule.

Answer

The firewall rule's target tag is misspelled.

Question 14

A company uses Cloud Armor to protect their HTTP Load Balancer. They want to block requests from a specific IP range during a DDoS attack. What is the most efficient way to implement this?

Accepted Answer

Update the existing security policy by adding a deny rule for the IP range with priority 1000.. Option B is correct because updating the existing security policy by adding a deny rule is the quickest and most efficient way to block the IP range during an active attack. Option A is less efficient as it requires creating a new policy and reconfiguring the attachment. Option C is incorrect because firewall rules operate at the network layer and cannot block HTTP-level requests. Option D is incorrect because Cloud CDN does not provide IP blocking capabilities.

Answer

Create a new Cloud Armor security policy and attach it to the backend service.

Answer

Modify the load balancer's firewall rule to deny traffic from that IP range.

Answer

Use Cloud CDN to cache responses and block the IP at the edge.

Question 15

An organization's security policy requires that all audit logs be stored in a separate project for centralized monitoring. Which Google Cloud service should be used to aggregate logs from multiple projects?

Accepted Answer

Cloud Logging with log sinks. Option C is correct because Cloud Logging log sinks can be configured to route logs from multiple projects to a common destination like a Cloud Storage bucket or BigQuery dataset in a separate project. Option A is for metrics and alerting, not log aggregation. Option B is a type of log, not a service. Option D is for security findings and compliance, not log aggregation.

Answer

Cloud Monitoring

Answer

Cloud Audit Logs

Answer

Security Command Center