PCSE Hard Questions — 25 Difficult Questions

Question 1

A multi-national company needs to ensure that customer data stored in BigQuery is encrypted with customer-managed encryption keys (CMEK) and that the keys are rotated every 90 days. Additionally, the company must be able to audit all key usage. Which steps are required to implement this compliance requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Cloud KMS key ring with a key using a protection level of software and set a rotation period of 90 days. Then configure BigQuery to use the key and enable Data Access audit logs for Cloud KMS.. It uses a Cloud KMS software-protection-level key with a 90-day rotation period, which meets the CMEK requirement for BigQuery. Enabling Data Access audit logs for Cloud KMS captures all key usage events, satisfying the auditing requirement. Automatic rotation in Cloud KMS handles the 90-day rotation without manual intervention, and BigQuery is configured to use the CMEK key for dataset encryption.

Answer

Create a Cloud External Key Manager (EKM) key and configure BigQuery to use it. The EKM provider handles key rotation.

Answer

Create a Cloud KMS key ring with a key, disable automatic rotation, and use Cloud Functions to rotate the key manually every 90 days. Enable Admin Activity audit logs for Cloud KMS.

Answer

Create a Cloud KMS key ring with a key using a protection level of HSM and set a rotation period of 90 days. Then configure the BigQuery dataset to use this key.

Question 2

A security team has a Cloud KMS key used for encrypting Cloud Storage objects. They need to ensure that when the key is rotated, old data remains decryptable without manual re-encryption. They also want to minimize the number of key versions. Which approach should they take?

Accepted Answer

Use automatic rotation and keep one previous key version indefinitely.. Cloud KMS supports automatic key rotation while retaining previous key versions indefinitely. When a key is rotated, new data is encrypted with the latest version, but old data remains decryptable using the previous key version that is kept. This satisfies the requirement of minimizing manual intervention and key version count, as only one previous version is retained.

Answer

Use automatic rotation and disable previous key versions after 30 days.

Answer

Use manual rotation and delete old key versions after confirmation that all data has been re-encrypted.

Answer

Use symmetric key with purpose SYMMETRIC_ENCRYPT_DECRYPT and set rotation period to 0 (never).

Question 3

A security engineer is configuring VPC Service Controls to protect a Google Cloud project containing sensitive data. The project uses Cloud Storage and BigQuery. The engineer wants to ensure that data cannot be exfiltrated to external IP addresses outside the perimeter, but internal users should still be able to access the data from on-premises via a VPN. Which configuration should be applied?

Accepted Answer

Add the project to a VPC Service Controls perimeter and configure an ingress rule to allow traffic from the on-premises VPN CIDR ranges. VPC Service Controls (VPC-SC) allow you to define a security perimeter around Google Cloud services like Cloud Storage and BigQuery, preventing data exfiltration to external IPs. By adding the project to a perimeter and configuring an ingress rule that permits traffic from the on-premises VPN CIDR ranges, internal users can access the data via VPN while all other external traffic is blocked. This meets the requirement of preventing exfiltration to external IPs while allowing authorized on-premises access.

Answer

Do not use VPC Service Controls; instead, rely on IAM permissions and firewall rules to control access

Answer

Create a separate perimeter that denies all traffic and apply it to the project

Answer

Add the project to a VPC Service Controls perimeter with no additional ingress rules

Question 4

An engineer is configuring Cloud Armor for an HTTP(S) load balancer and needs to allow traffic only from users who have been authenticated by Identity-Aware Proxy (IAP). The backend service already has IAP enabled. What additional configuration is needed to ensure that only authenticated requests reach the backend?

Accepted Answer

No additional configuration is needed; IAP already blocks unauthenticated requests. When IAP is enabled on a backend service, it intercepts all requests and blocks unauthenticated traffic before it reaches the backend. Cloud Armor operates at the edge, but since IAP already enforces authentication at the application layer, no additional Cloud Armor configuration is required to restrict access to authenticated users. The load balancer forwards only requests that have passed IAP authentication to the backend.

Answer

Configure Cloud Armor to allow only traffic from the IP ranges used by IAP

Answer

Create a Cloud Armor security policy that requires a valid JWT token signed by IAP

Answer

Set a firewall rule on the backend instances to allow traffic only from the load balancer's health check IPs

Question 5

A company has a Cloud Storage bucket containing sensitive data. They want to ensure that only users with specific IAM roles can access the bucket, and that access is logged for audit purposes. They also want to prevent public access. Which configuration steps should they take?

Accepted Answer

Enable uniform bucket-level access, set IAM policies, and enable Cloud Audit Logs.. Enabling uniform bucket-level access disables ACLs, forcing all access decisions to be made by IAM policies alone, which simplifies permission management and prevents public access. Setting IAM policies ensures only users with specific roles can access the bucket, and enabling Cloud Audit Logs captures all access requests for audit purposes. This combination meets all requirements: no public access, role-based access control, and logging.

Answer

Use IAM roles only and enable Cloud Audit Logs, but keep ACLs enabled.

Answer

Use VPC Service Controls and enable Cloud Audit Logs.

Answer

Enable fine-grained access using ACLs and enable Cloud Audit Logs.

Question 6

An organization has a requirement that all service account keys must be rotated every 90 days. The security engineer wants to automate the detection of keys older than 90 days. Which TWO methods can achieve this? (Choose 2)

Accepted Answer

Use the IAM API to list service account keys and check the validAfterTime field.. The IAM API's `validAfterTime` field directly indicates when a service account key was created. By listing keys and comparing this timestamp to the current time, you can programmatically identify keys older than 90 days. This method is precise and does not rely on indirect log analysis or policy enforcement.

Answer

Configure an organization policy to deny key creation if keys are older than 90 days.

Answer

Use Cloud Logging to analyze logs for key creation and compute age.

Answer

Create a custom IAM role that prevents using keys older than 90 days.

Question 7

A financial services company runs a PCI DSS-compliant workload on Google Cloud. They use a service account with roles/container.clusterAdmin to manage a GKE cluster. The security team has enabled Binary Authorization with a policy that requires all container images to be signed by a trusted authority. Recently, a developer reported that a new deployment failed with the error: 'Image verification failed: no signature found for digest sha256:abc...'. The image is stored in Artifact Registry and the developer built it using Cloud Build with a trigger that automatically signs images using Cloud KMS. The Cloud Build service account has roles/cloudkms.signerVerifier and roles/binaryauthorization.attestorsViewer. The Binary Authorization policy is configured to require at least one attestation from the trusted attestor. What is the most likely reason for the failure?

Accepted Answer

The Cloud Build service account lacks the roles/binaryauthorization.attestorsEditor role.. The Cloud Build service account has roles/cloudkms.signerVerifier and roles/binaryauthorization.attestorsViewer, which allow it to sign images and view attestors, but it lacks the roles/binaryauthorization.attestorsEditor role. Without this role, the service account cannot create or manage attestations in Binary Authorization, so even though the image is signed, no attestation is recorded, causing the policy to fail with 'no signature found'.

Answer

The container image is stored in a different registry that is not supported by Binary Authorization.

Answer

The GKE cluster's node service account does not have permission to verify attestations.

Answer

The Binary Authorization policy requires an attestation from a different attestor that is not configured.

Question 8

A company uses multiple GCP projects and wants to allow a service account from Project A to initiate Dataflow jobs in Project B. The service account in Project A has the Dataflow Developer role at the organization level. However, it fails with permission denied when trying to submit a job to Project B. What is the most likely issue?

Accepted Answer

The service account needs the Service Account User role on the Dataflow service account in Project B.. The service account from Project A has the Dataflow Developer role at the organization level, which grants permissions to create Dataflow jobs, but it still needs the Service Account User role (roles/iam.serviceAccountUser) on the Dataflow service account in Project B. When a Dataflow job is submitted, the job runs as a service account in the target project (Project B), and the caller must have the iam.serviceAccounts.actAs permission on that service account. Without this role, the API call fails with a permission denied error even though the Dataflow Developer role is present.

Answer

The organization policy restricts cross-project access.

Answer

The service account does not have permission to create Dataflow jobs in Project B because it is not a member of Project B.

Answer

The Dataflow API is not enabled in Project B.

Question 9

Which THREE components are required to configure VPC Flow Logs for a Compute Engine instance?

Accepted Answer

Enable VPC Flow Logs on the subnet. VPC Flow Logs capture network traffic metadata at the subnet level. Enabling flow logs on the subnet (A) is the primary configuration step that activates logging for all VM instances within that subnet. The VM's service account must have the compute.instances.get permission (B) to allow the flow log agent to retrieve instance metadata required for log entries. A VM with a network interface in the subnet (D) is necessary because flow logs are generated per network interface; without a VM in the subnet, there is no traffic to log.

Answer

A log sink to export logs to BigQuery

Answer

A metadata server to store logs

Question 10

A Cloud Function that processes financial data is timing out after 60 seconds. The function performs complex calculations and cannot be decomposed further. What is the best solution?

Accepted Answer

Increase the Cloud Functions timeout to 120 seconds and optimize the code. Cloud Functions provides a configurable timeout, and the maximum timeout for HTTP functions is 60 minutes, so increasing the timeout to 120 seconds is feasible. Additionally, optimizing the code can reduce execution time. Option A is wrong because migrating to Cloud Run adds complexity and does not necessarily resolve a timeout caused by slow code; Cloud Run also has a default timeout of 60 minutes, so it may not be better than simply increasing Cloud Functions timeout. Option B is wrong because changing the programming language does not inherently reduce execution time; performance depends on the logic and algorithms. Option C is wrong because increasing memory may slightly improve CPU performance but does not extend the timeout limit; the function still times out at 60 seconds if it is not completed.

Answer

Migrate the function to Cloud Run with a longer timeout

Answer

Change the Cloud Functions runtime from Node.js to Python

Answer

Increase the allocated memory for the function

Question 11

Which THREE are best practices for managing encryption keys in Google Cloud?

Accepted Answer

Enable automatic rotation for keys that are used for encryption.. Cloud KMS supports automatic key rotation, which reduces the risk of key compromise by ensuring that encryption keys are periodically replaced without manual intervention. Automatic rotation creates new key versions at a specified interval (e.g., every 90 days) and automatically uses the latest version for encryption, while decryption can still use older versions. This aligns with the security best practice of limiting the amount of data encrypted under a single key version.

Answer

Import key material from on-premises HSMs to avoid vendor lock-in.

Answer

Automatically delete old key versions once they expire.

Question 12

A company has multiple Google Cloud projects organized under folders by department. The security team wants to enforce a policy that all Compute Engine instances must use Shielded VM features. They need to prevent non-compliant instances from being created. Which action should be taken to enforce this requirement most effectively?

Accepted Answer

Use the Organization Policy Service with the constraint constraints/compute.requireShieldedVm.. Organization Policy constraints are the correct mechanism to enforce requirements across the resource hierarchy. The built-in constraint 'constraints/compute.requireShieldedVm' ensures that any new Compute Engine instance must have Shielded VM features enabled. This policy can be applied at the organization, folder, or project level. IAM roles or custom roles cannot enforce instance configuration requirements. Service account impersonation is unrelated. Deny policies can deny specific permissions but not enforce Shielded VM settings.

Answer

Create an IAM deny policy at the organization level that denies the compute.instances.create permission unless the Shielded VM flag is set.

Answer

Create a custom role that includes the permission to create instances only with Shielded VM, and assign it to all users.

Answer

Implement a service account that only has permission to create instances and use service account impersonation for all instance creation.

Question 13

Alice tries to connect to Cloud SQL instance 'prod-instance' using the Cloud SQL Auth proxy. Will she succeed? Why?

Accepted Answer

Yes, because the admin role grants full access, and the condition only applies to the admin role, but the client role is unconditional.. The Cloud SQL Auth proxy uses IAM permissions for authentication and authorization. The `cloudsql.client` role grants the `cloudsql.instances.connect` permission unconditionally, allowing Alice to connect to any instance. The `cloudsql.admin` role's condition restricting access to 'dev' instances only applies to the `cloudsql.instances.update` permission, not to the connect permission, so the client role's unconditional access prevails.

Answer

Yes, because she has the client role with no condition.

Answer

No, because the admin role condition overrides the client role.

Answer

No, because the cloudsql.admin role condition restricts to dev instances only.

Question 14

During a security incident, a forensic investigator needs to analyze a compromised Compute Engine instance without affecting the live environment. The instance has persistent disks with critical data. What is the best first step to preserve evidence?

Accepted Answer

Create a snapshot of the persistent disks.. Creating a snapshot of the persistent disks preserves a point-in-time copy without affecting the running instance. The snapshot can then be used to create a new disk attached to a forensic VM for analysis. Disk cloning requires stopping the instance.

Answer

Clone the instance to a new VM.

Answer

Export the disk image to Cloud Storage.

Answer

Enable VPC Flow Logs for the instance's network.

Question 15

A company is using a Shared VPC in Google Cloud with multiple service projects. The security team wants to restrict egress traffic from a specific service project to only allowed external IP addresses. The network project hosts the VPC. What is the best approach?

Accepted Answer

Create a firewall rule in the host project that denies egress to all destinations except the allowed IPs, and apply it to the service project's VMs via service accounts.. In a Shared VPC, firewall rules are defined in the host project and apply to VM instances in service projects. Option D correctly creates a deny-all egress rule in the host project, then uses a higher-priority allow rule for specific external IPs, scoped to service accounts of the target VMs. This ensures egress traffic from the specific service project is restricted at the VPC firewall level, which is the only effective way to control outbound traffic in a Shared VPC architecture.

Answer

Use Private Google Access to restrict egress.

Answer

Use VPC Service Controls to restrict egress.

Answer

Create a firewall rule in the service project's VPC that denies egress.

Question 16

An organization stores sensitive customer data in BigQuery tables. They need to enforce column-level security such that users in the 'support' group see a masked version of email addresses (e.g., j***@example.com), while managers see the full email. Which approach should they use?

Accepted Answer

Apply a BigQuery data masking policy using policy tags on the email column.. BigQuery column-level security with policy tags and data masking rules can achieve this. Data masking policies can be applied to policy tags to mask data based on user access. Using views or separate tables is less maintainable, and Cloud DLP is for batch scanning/de-identification, not real-time masking.

Answer

Create a view that applies masking functions and grant access to the view.

Answer

Use Cloud DLP to scan and de-identify the data in place.

Answer

Create separate tables for each role and populate them with appropriate data.

Question 17

A company has an on-premises data center connected to Google Cloud via a Dedicated Interconnect. They want to allow instances in a VPC (10.0.0.0/8) to access Google APIs (e.g., Cloud Storage) without traversing the public internet. They also want to ensure that traffic from on-premises to Google APIs uses the same private path. Which configuration is required?

Accepted Answer

Enable Private Google Access on the VPC subnet and advertise the default route (0.0.0.0/0) from on-premises with a specific route for Google APIs (199.36.153.4/30) pointing to the interconnect.. It enables Private Google Access on the VPC subnet, which allows instances with private IPs to reach Google APIs without public internet. Additionally, advertising a default route (0.0.0.0/0) from on-premises via the Dedicated Interconnect ensures that on-premises traffic to Google APIs also uses the private path, while the specific route for Google APIs (199.36.153.4/30) overrides the default to direct API traffic through the interconnect, avoiding asymmetric routing.

Answer

Set up Cloud VPN and use Private Google Access on the VPC.

Answer

Apply VPC Service Controls and enable Private Google Access on the subnet.

Answer

Configure Cloud NAT on the VPC and on-premises route via the interconnect.

Question 18

A security engineer is investigating a compromised Compute Engine VM. They need to take a forensic snapshot of the disk without losing any data, including deleted files, and ensure the snapshot is not tampered with. Which steps should they take?

Accepted Answer

Create a snapshot of the disk while the instance is running, then detach the disk.. The correct approach is to first create a snapshot of the disk for forensic analysis, which captures the disk state including deleted files (unless overwritten). Then detach the disk from the instance to prevent further changes. Creating a snapshot after detaching would lose the current state. Powering off the instance may alter data. Using dd over SSH may change file access times.

Answer

Use dd to copy the disk over SSH to a forensic workstation.

Answer

Stop the instance, create a snapshot of the disk, then detach the disk.

Answer

Detach the disk first, then create a snapshot of the detached disk.

Question 19

A security team wants to ensure that a Cloud KMS key is rotated automatically every 30 days and that previous key versions are available for decryption for at least 6 months. Which THREE steps should they take? (Choose three.)

Accepted Answer

Ensure that the key's destruction policy does not automatically destroy versions before 6 months. To meet the requirements: 1) Set rotation period to 30 days on the key; 2) Do not destroy old key versions until after 6 months; 3) The default destruction policy does not automatically destroy old versions, so they remain available. Setting a primary version is not required for rotation, and disabling rotation is contrary.

Answer

Manually rotate the key every 30 days using a Cloud Function

Answer

Configure the key's `next_rotation_time` to start rotation immediately

Question 20

An organization uses Binary Authorization with a GKE cluster that enforces attestation. A developer builds a container and pushes it to Artifact Registry. The image must be signed before it can be deployed. Which steps are required to allow this image to run on the cluster?

Accepted Answer

Sign the image using Cloud KMS and an attestor, then create a signed attestation in Container Analysis, and deploy the image.. Binary Authorization requires a signed attestation from a trusted attestor, stored in Cloud KMS. The image must be signed using a private key associated with the attestor, and the attestation is typically stored as a note in Container Analysis. Simply having a vulnerability scan or pushing without signing will not satisfy the policy.

Answer

Push the image to Artifact Registry and allow the Binary Authorization policy to automatically sign it.

Answer

Configure the cluster to allow all images by setting the policy to 'Allow All' for the developer's namespace.

Answer

Use the Binary Authorization API to create an attestation by specifying the image URL and the attestor, then deploy.