PCSE Managing operations in a cloud solution environment Practice Test 7 — 15 Questions

Question 1

A large enterprise has a security command center that uses SIEM to analyze logs. They are migrating to Google Cloud and want to export all Cloud Audit Logs (Admin Activity, Data Access, and System Events) from all projects into a centralized BigQuery dataset for analysis. They also need to ensure logs are available within 5 minutes of being generated. Which sink configuration should they use?

Accepted Answer

Create an aggregated sink at the organization level that includes all projects and uses a BigQuery dataset as destination, with inclusion filters for all audit log types.. Option D is correct because aggregating sinks across all projects into a single BigQuery dataset via inclusion filters is the standard method. Option A is incorrect because sink at project level requires individual setup per project. Option B is incorrect because Logs Router cannot route to SIEM directly. Option C is incorrect because inclusion filters without aggregation would not capture all projects efficiently.

Answer

Create a single aggregated sink at the organization level that uses a Pub/Sub topic as destination, and have a subscriber stream logs into BigQuery.

Answer

Create a sink in each project that exports Audit Logs to a shared BigQuery dataset.

Answer

Enable logging export using Cloud Logging's beta feature to stream logs to an external SIEM via syslog.

Question 2

A company uses a multi-region Cloud Storage bucket for disaster recovery of critical data. They want to prevent accidental deletion of objects by requiring that objects be retained for at least 7 days after creation, and any attempt to delete or overwrite an object during that period must fail. Which configuration meets these requirements?

Accepted Answer

Set a retention policy for 7 days and apply object holds to all objects at upload time.. Option B is correct because retention policies with Object holds ensure minimum retention. Option A is incorrect because bucket lock is for permanent immutability, not flexible retention. Option C is incorrect because versioning alone does not prevent deletion; it allows recovery but does not block deletion. Option D is incorrect because lifecycle management only transitions or deletes based on age, not prevents.

Answer

Enable object versioning and set a lifecycle rule to delete old versions after 7 days.

Answer

Set a bucket lock with a retention policy of 7 days and lock the bucket.

Answer

Use a lifecycle rule to delete objects that are less than 7 days old as a way to block deletion.

Question 3

During a security incident, the forensic team needs to capture the memory and disk state of a compromised Compute Engine VM without shutting it down. The VM is running a critical application and cannot be stopped. What is the best approach to gather forensic data?

Accepted Answer

Use gcloud compute ssh to connect and run a memory capture tool, then create a disk snapshot at the same time.. Option D is correct because Cloud Memorystore is not relevant; the best practice is to use a forensic tool via OS Login or gcloud compute ssh to acquire memory, and create a snapshot after using gcloud compute disks snapshot for disk state. Option A is incorrect because stopping the VM loses memory state. Option B is incorrect because snapshots while running are crash-consistent but memory is not captured. Option C is incorrect because Cloud Memorystore does not handle VM memory.

Answer

Clone the VM and perform forensics on the clone while the original continues running.

Answer

Take a snapshot of the disk while the VM is running, and use Cloud Memorystore to capture memory.

Answer

Stop the VM, take a snapshot of the disk, and then start the VM.

Question 4

Which TWO of the following are valid methods to automate responses to Cloud Security Command Center findings?

Accepted Answer

Create a Cloud Function that is triggered by a Pub/Sub topic receiving SCC notifications.. Options A and D are correct. Cloud Functions can subscribe to SCC notifications via Pub/Sub, and Eventarc triggers can react to findings. Option B is incorrect because Cloud Scheduler is for scheduled jobs. Option C is incorrect because Cloud Run does not directly integrate with SCC. Option E is incorrect because Cloud Tasks is for task distribution, not direct response.

Answer

Set up Cloud Tasks to process SCC findings and send alerts.

Answer

Configure Cloud Run to directly receive webhooks from SCC.

Answer

Use Cloud Scheduler to periodically query SCC and trigger a Cloud Run service.

Question 5

Which THREE of the following are recommended practices for managing secrets in Google Cloud?

Accepted Answer

Enable automatic secret rotation and use short-lived secrets.. Options A, C, and D are correct. Using Secret Manager, IAM binding, and short-lived secrets via Secret Manager with rotation. Option B is incorrect because storing secrets in Cloud Storage even encrypted is less secure than Secret Manager. Option E is incorrect because hardcoding secrets in source code is dangerous.

Answer

Store encrypted secrets in Cloud Storage buckets with uniform bucket-level access.

Answer

Embed secrets as environment variables in source code during deployment.

Question 6

Which TWO of the following are true regarding Cloud Audit Logs?

Accepted Answer

Admin Activity audit logs are enabled by default and cannot be disabled.. Options A and C are correct. Admin Activity audit logs are always enabled by default and cannot be disabled. System Event audit logs are also enabled but capture Google Cloud actions. Option B is incorrect because Data Access logs are disabled by default and need to be enabled. Option D is incorrect because Cloud Audit Logs do NOT include metrics, only logs. Option E is incorrect because all audit logs are retained for 400 days by default.

Answer

Data Access audit logs are enabled by default for all services.

Answer

Cloud Audit Logs are retained indefinitely unless a retention policy is set.

Answer

Cloud Audit Logs include monitoring metrics for log volume.

Question 7

A small startup recently moved their infrastructure to Google Cloud. They have a single project with a few Compute Engine instances running a web application. The security team wants to ensure that all SSH access to the instances is audited and that any failed SSH attempts are alerted in real time. They have enabled OS Login and are using Cloud Identity-Aware Proxy (IAP) for SSH access. However, they are not sure how to capture the audit logs for SSH sessions. What should they do?

Accepted Answer

Enable Data Access audit logs for the IAP service and filter the logs for SSH connection attempts.. Option C is correct because IAP TCP forwarding logs are available as Admin Activity audit logs when IAP is used for SSH. Option A is incorrect because guest attributes are not for audit logs. Option B is incorrect because Cloud Monitoring does not directly log SSH attempts. Option D is incorrect because Serial port access logs are separate and not for IAP.

Answer

Enable Serial Port access logs on the instances to capture SSH sessions.

Answer

Configure Cloud Monitoring to watch for SSH connections via agent metrics.

Answer

Enable guest attributes on the instances to log SSH attempts.

Question 8

A multinational corporation operates multiple Google Cloud projects across several folders. They have a security requirement to enforce that all Cloud Storage buckets are created with uniform bucket-level access enabled and that no bucket has public access. They want to automatically remediate any non-compliant bucket that violates these policies. Currently, they use Organization Policies to enforce uniform bucket-level access, but they still find some buckets with public access due to exceptions. They have Cloud Security Command Center (Cloud SCC) enabled and receive findings about public buckets. The operations team wants to build a solution that automatically disables public access on non-compliant buckets. Which approach should they take?

Accepted Answer

Create a Cloud Security Command Center notification channel for public bucket findings, publish to a Pub/Sub topic, and trigger a Cloud Function that removes public IAM bindings from the bucket.. Option B is correct because using Cloud Functions triggered by Cloud SCC notifications allows real-time remediation. Option A is incorrect because Organization Policies can't automatically fix individual buckets after creation. Option C is incorrect because script runs on schedule, not real-time. Option D is incorrect because Cloud Monitoring alerts are not designed for this automatic remediation.

Answer

Create a new Organization Policy that denies public access to all buckets.

Answer

Configure a Cloud Monitoring alert policy that triggers a webhook to a third-party automation tool.

Answer

Write a script using gsutil and run it daily via Cloud Scheduler to check all buckets and remove public access.

Question 9

A large financial institution runs a critical application on Google Kubernetes Engine (GKE) clusters. Their security policy requires that all container images must be scanned for vulnerabilities and must come from a trusted artifact registry. They use Cloud Build to automatically build images from a CI/CD pipeline and push them to Artifact Registry. They want to enforce that only images that have passed vulnerability scanning and are signed can be deployed to the GKE cluster. Currently, they have set up Cloud Build to automatically tag images with a 'latest' tag on successful build, but they need a mechanism to prevent deployment of unsigned or vulnerable images. They also want to audit any attempts to deploy non-compliant images. What should they do?

Accepted Answer

Enable Binary Authorization on the GKE cluster, create Attestations for images that pass vulnerability scanning and signing in Cloud Build, and configure admission control to require attestations.. Option D is correct because combining Binary Authorization with Attestations from vulnerability and signing enables enforcement. Option A is incorrect because Cloud Nat is for outbound traffic, not image enforcement. Option B is incorrect because GKE policy does not natively enforce image contracts. Option C is incorrect because IAP is for access, not for image verification.

Answer

Use Cloud NAT to control which images can be pulled by GKE nodes.

Answer

Configure GKE policy to only allow images from a specific Artifact Registry repository and enable vulnerability scanning.

Answer

Use Cloud IAP to block nodes from pulling non-compliant images.

Question 10

A company is using Cloud SQL for MySQL in production. They notice that during peak hours, query latency increases significantly. The database is running on a db-n1-standard-2 instance with 100GB SSD. The CPU utilization spikes to 95% during peaks. The application uses connection pooling. Which action should the company take to improve performance while minimizing cost?

Accepted Answer

Add a read replica and redirect read queries to it.. Adding a read replica offloads read queries from the primary instance, reducing CPU load and latency. Option A is incorrect because switching to a highcpu type does not increase CPU count; it rebalances memory. Option B is incorrect because Cloud SQL Proxy provides secure connections, not performance improvement. Option D is incorrect because increasing storage primarily increases IOPS and disk throughput, but CPU is the bottleneck.

Answer

Increase the storage to 200GB to improve IOPS.

Answer

Enable Cloud SQL Proxy to cache connections.

Answer

Increase the number of CPUs by switching to a db-n1-highcpu-2 instance.

Question 11

A company is implementing a zero-trust network architecture on Google Cloud. They want to ensure that all traffic between their on-premises data center and Google Cloud is encrypted and authenticated. Additionally, they need to support high availability across multiple regions. Which two Google Cloud services should they use? (Choose two.)

Accepted Answer

Cloud Interconnect (Dedicated). Cloud VPN provides encrypted tunnels for secure connectivity. Cloud Interconnect (Dedicated) offers dedicated, low-latency, high-availability connections. Combining both provides encryption (via VPN over Interconnect) and HA. Option C is incorrect because Cloud NAT is for outbound traffic only. Option D is incorrect because VPC Network Peering is for connecting VPCs within Google Cloud. Option E is incorrect because Cloud CDN is for content delivery, not network connectivity.

Answer

Cloud NAT

Answer

VPC Network Peering

Answer

Cloud CDN

Question 12

A company uses Cloud Storage buckets to store customer uploads. Recently, a customer reported that a file they uploaded yesterday is missing. The bucket has object versioning enabled. The security team wants to investigate how the file went missing and whether any other files have been affected. The company's compliance requirements mandate that all object deletions must be logged and reviewed. What should the admin do first to investigate the missing file?

Accepted Answer

Check Cloud Logging for storage.googleapis.com/object_delete events.. Checking Cloud Logging for object delete events is the most direct way to determine if the file was deleted and by whom. Option A is incorrect because listing versions would only show if the object exists but not the cause of disappearance. Option C is incorrect because enabling lifecycle management does not help with investigation. Option D is incorrect because access logs are not automatically enabled and would not specifically show delete events.

Answer

Check the access logs in the Storage bucket's logs section.

Answer

Use gsutil ls -a to list all versions of objects in the bucket.

Answer

Enable Object Lifecycle Management to restore deleted objects.

Question 13

A startup is deploying a containerized application on Google Kubernetes Engine (GKE). The application is stateless and experiences variable traffic patterns, with periodic spikes during promotional events. The startup wants to minimize costs while ensuring the application can handle the variable load without performance degradation. They also prefer to automate scaling as much as possible. Which GKE configuration should they choose?

Accepted Answer

Use a cluster with node auto-provisioning and preemptible nodes.. Node auto-provisioning automatically scales the node pool based on pod resource requests, and preemptible nodes significantly reduce cost. This combination handles variable load while being cost-effective. Option B is incorrect because regional persistent disks are for stateful applications and increase cost. Option C is incorrect because a single zone and regular nodes may not handle spikes and can be more expensive. Option D is incorrect because a fixed node pool does not automatically scale to meet variable demand.

Answer

Use a cluster with node auto-repair and a fixed node pool.

Answer

Use a cluster with a single zone and regular nodes.

Answer

Use a cluster with regional persistent disks for pods.

Question 14

A company runs a multi-tier application on Compute Engine behind an external HTTP(S) Load Balancer. The backend consists of a managed instance group for the application tier and a Cloud Storage bucket for static assets. During peak traffic, some users receive HTTP 503 errors. The backend instances are healthy and the load balancer shows no connection errors. The company has already enabled Cloud CDN for the backend bucket. What should they do to resolve the 503 errors?

Accepted Answer

Increase the size of the instance group to handle more requests.. The 503 errors likely indicate that the instance group cannot handle the request volume. Increasing the size of the instance group provides more capacity. Option B is incorrect because CDN is already enabled for static content, and the 503 is likely for dynamic content. Option C is incorrect because connection draining affects instance removal, not capacity. Option D is incorrect because forcing caching of dynamic content may serve stale data or not be allowed.

Answer

Enable Cloud CDN on the backend bucket to cache static content.

Answer

Increase the backend bucket's cache mode to force caching of dynamic content.

Answer

Adjust the load balancer's connection draining timeout.

Question 15

A financial firm uses Cloud Deployment Manager to manage their Google Cloud infrastructure. They have a strict change management policy requiring that all infrastructure changes in the production environment must be reviewed and approved by a senior engineer before being applied. Currently, developers can modify the Deployment Manager configurations directly, leading to unapproved changes. The company wants to enforce this policy without impacting development agility. What should they implement?

Accepted Answer

Use a CI/CD pipeline with Cloud Build and require approval gates.. A CI/CD pipeline with Cloud Build can include manual approval gates that block deployments until approved. This enforces change review while allowing development to proceed. Option A is incorrect because organization policies would block all Deployment Manager usage, including in development. Option C is incorrect because auditing only monitors changes but does not prevent them. Option D is incorrect because snapshots allow rollback but do not prevent unapproved changes.

Answer

Use Deployment Manager snapshots to roll back changes if needed.

Answer

Set up Cloud Audit Logs to monitor changes and alert on unauthorized modifications.

Answer

Use organization policies to restrict access to the Deployment Manager service.