PCSE Hard Questions — 25 Difficult Questions

Question 1

An organization is using Assured Workloads to enforce ITAR compliance. They need to ensure that all resources are deployed in specific US regions and that Google personnel access is restricted. They also want to monitor for any configuration changes that violate compliance policies. Which service should they use for monitoring compliance drift?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assured Workloads compliance monitoring. Assured Workloads includes built-in compliance monitoring that continuously evaluates the folder's resources against the selected compliance regime (e.g., ITAR) and surfaces violations such as resources deployed outside approved US regions or configuration drift. This is the native mechanism for monitoring compliance drift within an Assured Workloads environment.

Answer

Cloud Asset Inventory

Answer

Security Command Center

Answer

Cloud Monitoring

Question 2

A multi-national company needs to ensure that customer data stored in BigQuery is encrypted with customer-managed encryption keys (CMEK) and that the keys are rotated every 90 days. Additionally, the company must be able to audit all key usage. Which steps are required to implement this compliance requirement?

Accepted Answer

Create a Cloud KMS key ring with a key using a protection level of software and set a rotation period of 90 days. Then configure BigQuery to use the key and enable Data Access audit logs for Cloud KMS.. It uses a Cloud KMS software-protection-level key with a 90-day rotation period, which meets the CMEK requirement for BigQuery. Enabling Data Access audit logs for Cloud KMS captures all key usage events, satisfying the auditing requirement. Automatic rotation in Cloud KMS handles the 90-day rotation without manual intervention, and BigQuery is configured to use the CMEK key for dataset encryption.

Answer

Create a Cloud External Key Manager (EKM) key and configure BigQuery to use it. The EKM provider handles key rotation.

Answer

Create a Cloud KMS key ring with a key, disable automatic rotation, and use Cloud Functions to rotate the key manually every 90 days. Enable Admin Activity audit logs for Cloud KMS.

Answer

Create a Cloud KMS key ring with a key using a protection level of HSM and set a rotation period of 90 days. Then configure the BigQuery dataset to use this key.

Question 3

Refer to the exhibit. A user jane@example.com receives a 403 Access Denied error when trying to list objects in a Cloud Storage bucket. What is the most likely cause?

Accepted Answer

The IAM condition restricts access to requests originating from the 10.0.0.0/24 IP range. The IAM policy includes a condition that restricts access to requests originating from the 10.0.0.0/24 IP range. If jane@example.com is accessing the bucket from an IP outside this range, the condition fails and access is denied, resulting in a 403 error. Option B is incorrect; the role assigned to Jane includes the storage.objects.list permission, so lack of permission is not the issue. Option C is incorrect; there is no indication that the bucket is in a different project. Option D is incorrect; the policy is restrictive, not permissive, and there is no conflict with other policies.

Answer

Jane does not have the storage.objects.list permission

Answer

The bucket is in a different project

Answer

The IAM policy is too permissive and conflicts with other policies

Question 4

A company uses Access Context Manager to restrict access to Cloud Resources based on device policy. They want to allow access only from devices that are company-managed and have disk encryption enabled. What should they configure?

Accepted Answer

Create an access level with device policy conditions for corporate-owned and disk encryption.. Access Context Manager allows you to create access levels that define device policy conditions, such as requiring devices to be corporate-owned and have disk encryption enabled. These access levels are then applied to the organization's access policies to restrict access to cloud resources based on the device's compliance status.

Answer

Create an IAM condition requiring a specific device tag.

Answer

Use Identity-Aware Proxy with device policy.

Answer

Use VPC Service Controls with a device restriction.

Question 5

Which THREE are best practices for managing encryption keys in Google Cloud?

Accepted Answer

Enable automatic rotation for keys that are used for encryption.. Cloud KMS supports automatic key rotation, which reduces the risk of key compromise by ensuring that encryption keys are periodically replaced without manual intervention. Automatic rotation creates new key versions at a specified interval (e.g., every 90 days) and automatically uses the latest version for encryption, while decryption can still use older versions. This aligns with the security best practice of limiting the amount of data encrypted under a single key version.

Answer

Import key material from on-premises HSMs to avoid vendor lock-in.

Answer

Automatically delete old key versions once they expire.

Question 6

Alice tries to connect to Cloud SQL instance 'prod-instance' using the Cloud SQL Auth proxy. Will she succeed? Why?

Accepted Answer

Yes, because the admin role grants full access, and the condition only applies to the admin role, but the client role is unconditional.. The Cloud SQL Auth proxy uses IAM permissions for authentication and authorization. The `cloudsql.client` role grants the `cloudsql.instances.connect` permission unconditionally, allowing Alice to connect to any instance. The `cloudsql.admin` role's condition restricting access to 'dev' instances only applies to the `cloudsql.instances.update` permission, not to the connect permission, so the client role's unconditional access prevails.

Answer

Yes, because she has the client role with no condition.

Answer

No, because the admin role condition overrides the client role.

Answer

No, because the cloudsql.admin role condition restricts to dev instances only.

Question 7

A security team wants to automatically rotate a database password stored in Secret Manager every 60 days and notify the operations team when a new version is created. Which approach should they use?

Accepted Answer

Set a rotation period on the secret and configure a Pub/Sub topic for notifications; use a Cloud Function to generate new password. Secret Manager supports automatic rotation by setting a rotation period and a rotation schedule, and it can publish rotation notifications to a Pub/Sub topic. A Cloud Function (or Cloud Run) is typically used to generate the new password and add it as a new secret version. This combination provides automated rotation and event-driven notification to the operations team.

Answer

Use Cloud Scheduler to call Secret Manager API to add a new version

Answer

Use Cloud KMS key rotation to rotate the secret

Answer

Manually update the secret every 60 days

Question 8

Refer to the exhibit. The security team created this key for encrypting database backups. After an audit, they found that data encrypted before May 1, 2023, cannot be decrypted. What is the most likely cause?

Accepted Answer

Key version 1 was deleted after the new primary was created.. When a new primary key version is created in Cloud KMS, the old primary key version is not automatically deleted. However, if the old key version (version 1) was manually deleted after promoting version 2 as the primary, any data encrypted with version 1 becomes permanently undecryptable. The audit finding that data encrypted before May 1, 2023 cannot be decrypted directly indicates that the key version used for that encryption (likely version 1) is no longer available, not just disabled or rotated.

Answer

The rotation period is too short, causing old versions to be destroyed.

Answer

The primary key version is disabled.

Answer

The algorithm GOOGLE_SYMMETRIC_ENCRYPTION is not supported by HSM.

Question 9

A security engineer is investigating a compromised Compute Engine VM. They need to take a forensic snapshot of the disk without losing any data, including deleted files, and ensure the snapshot is not tampered with. Which steps should they take?

Accepted Answer

Create a snapshot of the disk while the instance is running, then detach the disk.. Creating a snapshot while the instance is running captures the disk state without requiring a shutdown, preserving volatile data and avoiding service disruption. The snapshot is stored in Cloud Storage with integrity checks and can be used to create a new disk for forensic analysis. Detaching the disk afterward ensures the compromised VM can no longer write to it, preserving the snapshot's evidentiary value.

Answer

Use dd to copy the disk over SSH to a forensic workstation.

Answer

Stop the instance, create a snapshot of the disk, then detach the disk.

Answer

Detach the disk first, then create a snapshot of the detached disk.

Question 10

A company has deployed a Cloud Run service that needs to access a Cloud SQL database. They have configured a service account for the Cloud Run service and granted it the Cloud SQL Client role. However, the application is receiving 'Permission denied' errors when trying to connect to the database. The database has a private IP and is in a VPC. What is the most likely cause?

Accepted Answer

Cloud Run cannot reach the private IP because it is not connected to the VPC via Serverless VPC Access.. Cloud Run services run in a Google-managed environment that is not automatically connected to a VPC. To reach a Cloud SQL instance with a private IP, the Cloud Run service must use Serverless VPC Access to establish a VPC connector, which enables direct traffic to the private IP. Without this connector, the service cannot route to the private IP, resulting in 'Permission denied' errors even though the IAM permissions are correct.

Answer

The service account lacks the cloudsql.instances.connect permission.

Answer

The service account is not authorized in the Cloud SQL instance's IAM policy.

Answer

The Cloud SQL instance requires a public IP for Cloud Run to connect.

Question 11

A company enforces Binary Authorization on a GKE cluster. They want to require that all container images be signed by a specific attestor located in a different project. What must be configured?

Accepted Answer

A policy that requires attestation, an attestor in the same or different project, and a service account on the GKE node with the appropriate IAM permissions to access the attestor.. Binary Authorization allows attestors in different projects. The key requirement is the proper IAM role (roles/binaryauthorization.attestorsVerifier) on the GKE service account.

Answer

A Binary Authorization policy that allows all images, and an attestor with the same name in both projects.

Answer

A Cloud KMS key for the attestor in the same project as the cluster, and a policy that requires attestation.

Answer

A policy that denies all images, and a separate attestor for each project.

Question 12

A multinational organization uses Chronicle SIEM to aggregate and analyze security logs from multiple GCP projects and on-premises systems. The security team wants to detect a known threat pattern: a user authenticating from an anomalous geographic location followed by a large data egress from a Compute Engine instance within 10 minutes. Which three steps are necessary to create this detection? (Choose three.)

Accepted Answer

Ingest Cloud Audit Logs and VPC Flow Logs into Chronicle via forwarders or native integration. Option A is correct because Chronicle detection requires the relevant telemetry in UDM; ingesting Cloud Audit Logs (for authentication events) and VPC Flow Logs (for network egress) via native integration or forwarders provides the raw events the rule will match. Option B is correct because the scenario explicitly includes on-premises systems, so a forwarder must send those authentication logs into Chronicle to correlate them with GCP activity. Option E is correct because YARA-L is Chronicle's detection language, and a rule matching a UDM authentication event with anomalous geo-location followed within 10 minutes by a UDM network event with large bytes out directly implements the described threat pattern. Option C is not needed because BigQuery export is for long-term storage/analysis, not for creating a real-time Chronicle detection. Option D is not needed because Security Command Center findings are a separate GCP security service and do not create the Chronicle YARA-L detection logic.

Answer

Configure a BigQuery export of VPC Flow Logs for long-term analysis

Answer

Enable the Standard tier of Security Command Center to generate finding notifications

Question 13

A security engineer needs to prevent creation of long-lived service account keys across all projects in an organization. The solution should also block any existing keys older than 90 days. Which approach meets these requirements?

Accepted Answer

Use a deny policy to deny the permission iam.serviceAccountKeys.create and another deny policy to deny use of keys older than 90 days.. Deny policies can be used to prevent creation of new service account keys (by denying iam.serviceAccountKeys.create) and to block use of existing keys older than 90 days (by denying permissions like iam.serviceAccountKeys.signBlob with a condition on key age). This directly addresses both requirements: prevention of new long-lived keys and disabling existing keys older than 90 days. Option A only prevents creation of new keys via the built-in constraint but does not affect existing keys; while a custom policy can enforce key rotation on new keys, it cannot block or disable keys that already exist. Option C fails because custom constraints cannot delete existing resources. Option D does not block key creation via all methods and does not address existing keys.

Answer

Use the built-in constraint constraints/iam.disableServiceAccountKeyCreation and write a custom organization policy to enforce key rotation (max age 90 days).

Answer

Use a custom organization policy constraint to disable key creation and another custom constraint to delete keys older than 90 days.

Answer

Use a VPC Service Controls perimeter to block access to the IAM API for creating keys.

Question 14

Which THREE steps are most effective for troubleshooting a VPC firewall rule issue where desired traffic is being blocked?

Accepted Answer

Check firewall rule logs in Cloud Logging. Option B is correct because VPC firewall rule logging in Cloud Logging records allowed and denied connections with details such as the rule name, direction, and source/destination, which directly reveals whether a firewall rule is blocking the traffic. Option C is correct because Google Cloud firewall rules apply to instances based on matching network tags (targetTags), so if the instance's network tags do not match the rule's target tags, the rule will not be enforced as intended and traffic may be blocked by a default or other rule. Option D is correct because VPC Flow Logs capture IP traffic metadata for the subnet or instance, showing whether packets are reaching the VM and helping distinguish a firewall block from a routing or upstream issue. Option A is not relevant because IAM permissions control API-level access to manage resources, not packet filtering for VM traffic. Option E is not the most effective step here because route tables determine path selection, not firewall rule evaluation; while routing issues can cause connectivity failures, they do not explain a firewall rule blocking desired traffic.

Answer

Check IAM permissions for the VM's service account

Answer

Inspect the route tables for the subnet

Question 15

During an incident, a security engineer finds this audit log entry. What action was taken and by whom?

Accepted Answer

A user deleted an instance named 'instance-1'.. The audit log entry shows an action taken on an instance named 'instance-1'. The log entry indicates a delete operation, as evidenced by the method name or action field. Therefore, a user deleted the instance. The correct answer is D.

Answer

A user modified instance 'instance-1'.

Answer

A user created an instance named 'instance-1'.

Answer

A user stopped instance 'instance-1'.

Question 16

A security engineer is configuring VPC Service Controls to protect a Google Cloud project containing sensitive data. The project uses Cloud Storage and BigQuery. The engineer wants to ensure that data cannot be exfiltrated to external IP addresses outside the perimeter, but internal users should still be able to access the data from on-premises via a VPN. Which configuration should be applied?

Accepted Answer

Add the project to a VPC Service Controls perimeter and configure an ingress rule to allow traffic from the on-premises VPN CIDR ranges. VPC Service Controls (VPC-SC) allow you to define a security perimeter around Google Cloud services like Cloud Storage and BigQuery, preventing data exfiltration to external IPs. By adding the project to a perimeter and configuring an ingress rule that permits traffic from the on-premises VPN CIDR ranges, internal users can access the data via VPN while all other external traffic is blocked. This meets the requirement of preventing exfiltration to external IPs while allowing authorized on-premises access.

Answer

Do not use VPC Service Controls; instead, rely on IAM permissions and firewall rules to control access

Answer

Create a separate perimeter that denies all traffic and apply it to the project

Answer

Add the project to a VPC Service Controls perimeter with no additional ingress rules

Question 17

A security auditor needs to review all IAM policy changes made in the last 30 days across multiple projects. The auditor has the Organization Viewer role at the organization level. What is the most efficient way to provide access without giving unnecessary permissions?

Accepted Answer

Grant the auditor the roles/iam.securityReviewer role at the organization level.. The roles/iam.securityReviewer role at the organization level grants read-only access to all IAM policies and audit logs across all projects in the organization, without granting any write or management permissions. This allows the auditor to review IAM policy changes efficiently without needing per-project assignments.

Answer

Grant the auditor the Logs Viewer role at the organization level to view audit logs of IAM changes.

Answer

The existing Organization Viewer role already provides access to IAM policies across all projects.

Answer

Grant the auditor the Project Viewer role on each project.

Question 18

Refer to the exhibit. An organization has the above IAM policy on a project. The user user@example.com is trying to view a list of objects in a bucket from IP address 10.1.1.1. What will be the result?

Accepted Answer

The user can list objects because the condition is satisfied.. The IAM policy grants the `storage.objects.list` permission to `user@example.com` with a condition that requires the request to come from an IP address within the `10.0.0.0/8` range. Since the user is accessing from `10.1.1.1`, which falls within that CIDR block, the condition evaluates to true, allowing the list operation.

Answer

The user cannot list objects because the condition is evaluated as false.

Answer

The user cannot list objects because IAM conditions do not support IP-based restrictions.

Answer

The user can list objects because they have inherited roles/storage.admin permissions from the admin.

Question 19

A security engineer needs to implement a logging pipeline that sends real-time Cloud Audit Logs to a third-party SIEM. They must ensure that if the SIEM is unavailable, logs are not lost. Which approach should they use?

Accepted Answer

Create a log sink that writes to a Pub/Sub topic, and use a subscription with a dead letter topic.. Using a Pub/Sub subscription with a dead letter topic allows messages to be retried and, if delivery fails persistently, moved to a dead letter topic for later reprocessing. This prevents data loss. Cloud Storage is not real-time; BigQuery is not for streaming to SIEM; Cloud Run without Pub/Sub would miss retries.

Answer

Configure a Cloud Run service to pull logs from Cloud Logging API and forward to SIEM.

Answer

Export logs to Cloud Storage via a sink, and have the SIEM ingest from there.

Answer

Use a log sink to BigQuery and have the SIEM query BigQuery periodically.

Question 20

Your company has hundreds of GKE clusters across multiple projects. You need to ensure that all clusters have Container Threat Detection enabled. Which approach is most scalable?

Accepted Answer

Write a script using gcloud container clusters update with --enable-threat-detection flag. SCC Premium includes Container Threat Detection. To enable it across clusters, you can use an organization policy or a custom script. Using Terraform or Config Controller to manage clusters as code is scalable. The most straightforward way: enable SCC Premium at the organization level and then enable Container Threat Detection per cluster via the API or gcloud. A script using gcloud commands can iterate through all clusters.

Answer

Create a new organization policy that enforces Container Threat Detection on all clusters

Answer

Deploy a DaemonSet that enables Container Threat Detection

Answer

Manually enable Container Threat Detection in each cluster via the Cloud Console