PCSE Managing operations in a cloud solution environment Practice Test 4 — 15 Questions

Question 1

A company uses Cloud Armor to protect their HTTP(S) load balancer. They want to block requests from a specific geographic region. Which TWO actions should they take? (Choose 2)

Accepted Answer

Create a security policy with a geo-match condition for the region.. Options A and B are correct. To block requests by geography in Cloud Armor, you create a security policy with a geo-match condition (A) and then attach that policy to the backend service (B). Option C is incorrect because the deny rule should have a higher priority (lower number) than the default rule, not lower. Option D is unnecessary. Option E is incorrect because Cloud CDN geo-restrictions affect caching, not request blocking.

Answer

Enable Cloud CDN and set geo-restrictions.

Answer

Configure the load balancer to use a custom header for geo-blocking.

Answer

Add a rule in the security policy with deny action and priority lower than the default.

Question 2

An organization wants to ensure that all service accounts used by Compute Engine instances have the minimal permissions required. Which TWO practices should be implemented? (Choose 2)

Accepted Answer

Create custom service accounts with only the needed roles.. Options B and D are correct. Creating custom service accounts with only the needed roles (B) ensures minimal permissions. Disabling service account key creation (D) reduces the risk of key exposure. Option A is incorrect because the default compute service account often has excessive permissions. Option C is incorrect because Access Transparency is for auditing Google support access. Option E is incorrect because attaching a service account after instance creation is possible but not a best practice for minimal permissions; it should be assigned at creation.

Answer

Attach service accounts to instances using the gcloud compute instances set-service-account command after creation.

Answer

Use the default compute service account and restrict its scopes.

Answer

Use Access Transparency to audit service account usage.

Question 3

Your organization uses Cloud Key Management Service (KMS) to encrypt data at rest. You need to rotate keys automatically every 90 days. Which THREE steps are required? (Choose 3)

Accepted Answer

Re-encrypt any data encrypted with older versions using the new key version.. Options B, C, and E are correct. You need to set a rotation period on the Cloud KMS key (B), enable automatic rotation (C), and re-encrypt any data encrypted with older versions using the new key version (E) to ensure data is protected by the new key. Option A is incorrect because rotation should be automatic. Option D is incorrect because old key versions should not be destroyed immediately; they are needed to decrypt existing data. Option F is unnecessary because automatic rotation is a built-in feature.

Answer

Create a new key version every 90 days manually.

Answer

Ensure the key is destroyed after rotation.

Answer

Use a Cloud Function to trigger rotation.

Question 4

Refer to the exhibit. A VM in the default network with internal IP 10.128.0.5 is unable to reach a VM at 10.0.0.4 over TCP port 22. What is the most likely cause?

Accepted Answer

The deny-all rule has higher priority than default-allow-internal.. Option C is correct. The deny-all rule (priority 2000) has a higher priority (lower number) than the default-allow-internal rule (priority 65534). Since the deny-all rule blocks all TCP traffic from the 10.0.0.0/8 range, it overrides the default-allow-internal rule, blocking SSH traffic from 10.0.0.4 to 10.128.0.5. Option A is incorrect because the deny rule denies traffic from 10.0.0.0/8, not to it. Option B is incorrect because default-allow-internal allows all TCP traffic. Option D is incorrect because default-allow-internal covers SSH; the issue is priority.

Answer

The deny-all rule blocks traffic from 10.0.0.4 to the VM.

Answer

The default-allow-internal rule does not cover port 22.

Answer

There is no rule allowing SSH traffic from 10.0.0.4.

Question 5

Refer to the exhibit. This IAM policy is applied to a Google Cloud Storage bucket. Alice reports she cannot delete objects in the bucket. Bob can delete objects. What is the most likely reason?

Accepted Answer

Alice has only objectViewer role, which does not allow deletion.. Option A is correct. The policy shows Alice has only the roles/storage.objectViewer role, which does not include delete permissions. Bob, although listed in the same binding, must have additional permissions from another policy (e.g., at the project level) that allow him to delete objects. Option B is incorrect because Bob's ability is likely due to inherited permissions, but the exhibit only shows this policy. Option C is irrelevant because the service account does not affect Bob's permissions. Option D is incorrect; etag is used for concurrent modification prevention.

Answer

The service account has objectAdmin role, but Bob is not a member.

Answer

The etag mismatch causes a conflict.

Answer

Bob has a higher role inherited from the project level.

Question 6

Refer to the exhibit. A user tries to create a Compute Engine instance using a custom image from another project. What is the most likely cause of the error?

Accepted Answer

The image family does not exist in the specified project.. Option C is correct. The error message explicitly states that the image family does not exist in the specified project. Option A is possible, but the error specifically says the image family does not exist. Option B would result in a permission denied error, not this error. Option D is incorrect because the project ID is specified in the image path; if it were wrong, the error would indicate an invalid project.

Answer

The user does not have permission to use images from the other project.

Answer

The user specified the wrong project ID.

Answer

The image family name is misspelled.

Question 7

Which service provides a centralized view of all resource configurations and IAM policies across projects?

Accepted Answer

Cloud Asset Inventory. Option B is correct. Cloud Asset Inventory provides a centralized view of all resources and their IAM policies across projects. Option A, Cloud Security Command Center, provides security findings and vulnerabilities, not a full inventory. Option C, Access Transparency, logs Google support access. Option D, Cloud Audit Logs, records API calls but not a static inventory.

Answer

Cloud Security Command Center

Answer

Cloud Audit Logs

Answer

Access Transparency

Question 8

A security engineer needs to ensure that all compute instances are patched with the latest security updates. What is the recommended approach?

Accepted Answer

Use the VM Manager patch deployment feature.. Option D is correct. The VM Manager patch deployment feature within OS Config Management provides a managed, automated patching solution. Option A is not a built-in Google Cloud service. Option B is partially correct, but VM Manager is the specific managed patching service. Option C is less reliable and manual. Option D is the most comprehensive and automated.

Answer

Use OS Config Management with patch compliance reporting.

Answer

Use a configuration management tool like Chef.

Answer

Use Cloud Scheduler to run a script that patches instances.

Question 9

An organization uses Cloud NAT to allow private instances to access the internet. They notice that some connections are failing intermittently. What is a common cause?

Accepted Answer

The NAT IP address is exhausted because too many concurrent connections.. Option D is correct. Cloud NAT has a limit on the number of concurrent connections per NAT IP due to port exhaustion. When many connections are made, ports can be exhausted, causing intermittent failures. Option A is incorrect because Cloud NAT supports UDP. Option B is a potential cause but the specific failure mode is port exhaustion. Option C is unlikely because outbound traffic is typically allowed by default.

Answer

The NAT gateway does not support UDP traffic.

Answer

The VPC firewall rules block outbound traffic.

Answer

The instances are in a different region than the NAT gateway.

Question 10

A junior developer created a service account with the roles/storage.admin role and downloaded a JSON key. What is the best practice to improve security?

Accepted Answer

Delete the key and use workload identity federation.. Option D is correct. The best practice is to delete the key and use workload identity federation, which eliminates the need for long-lived keys. Option A is not directly relevant. Option B is partially true, but rotation alone is not as secure as eliminating the key. Option C is not a standard best practice.

Answer

Rotate the key every 30 days.

Answer

Use a user-managed service account instead.

Answer

Restrict the key's usage with IP allowlists.

Question 11

A company has a multi-project setup with a shared VPC. They want to centrally audit all firewall rule changes. What is the most efficient way?

Accepted Answer

Export Admin Activity audit logs to a centralized project's BigQuery dataset.. Option C is correct. Exporting Admin Activity audit logs to a centralized BigQuery dataset allows querying all firewall rule changes across projects. Option A is incorrect because VPC Flow Logs capture network traffic, not rule changes. Option B is incorrect because Cloud Asset Inventory can track assets but not real-time changes efficiently. Option D is less efficient than a single export to BigQuery.

Answer

Create a log sink in each project that routes firewall-related logs to a Cloud Storage bucket and then aggregate.

Answer

Enable VPC Flow Logs on all subnets.

Answer

Use Cloud Asset Inventory with IAM policy change feed.

Question 12

A security analyst wants to detect when a user creates a Compute Engine instance with a public IP address in a sensitive project. What is the best method?

Accepted Answer

Use Cloud Logging with a log-based metric and alert.. Option D is correct. Using Cloud Logging with a log-based metric and alert on the compute.instances.insert log entry checking for the presence of an external IP provides real-time detection. Option A is incorrect because Data Access logs do not capture admin operations. Option B is incorrect because Cloud Asset Inventory is not real-time. Option C is possible but more complex to set up and maintain.

Answer

Create a Cloud Function that triggers on instance creation events.

Answer

Enable Data Access audit logs and filter for insert calls.

Answer

Use Cloud Asset Inventory to create a feed for instance creation.

Question 13

A company is using Cloud Monitoring to track latency of a microservice. They notice a sudden spike in the 99th percentile latency but no change in request count. What is the most likely cause?

Accepted Answer

A single slow query to a backend database. A single slow query to a backend database can increase p99 latency without affecting request count. Other options would affect availability or count.

Answer

A pod restart in GKE

Answer

A misconfigured health check causing 503s

Answer

A DDoS attack

Question 14

A security engineer wants to ensure that all API calls to Google Cloud services are logged for audit purposes. Which service should they enable?

Accepted Answer

Cloud Audit Logs. Cloud Audit Logs record administrative and data access activities. Other logs serve different purposes.

Answer

VPC Flow Logs

Answer

Cloud NAT Logs

Answer

Firewall Rules Logging

Question 15

Your organization uses Cloud Armor to protect against web attacks. After a change to the security policy, legitimate traffic from certain IPs is being blocked. You need to quickly allow that traffic while preserving the security policy. What should you do?

Accepted Answer

Add a higher priority allow rule for those IPs. Adding a higher priority allow rule for the affected IPs allows the traffic without removing the security policy. Other options either remove protection or are ineffective.

Answer

Remove the offending rule from the security policy

Answer

Enable logging on the security policy

Answer

Set the security policy to preview mode