PCSE Matching — 10 Questions

Question 1

Match each CVE or security concept to its description.

Accepted Answer

CVE-2017-0144: Exploits SMB protocol to allow remote code execution (EternalBlue). Correct matches: CVE-2017-0144 (EternalBlue) exploits SMB; CVE-2021-44228 (Log4Shell) targets Log4j; CVE-2014-0160 (Heartbleed) leaks OpenSSL memory; buffer overflow is a general memory corruption. Distractors swap descriptions between CVEs.

Answer

CVE-2017-0144: Exploits Apache Log4j logging library

Answer

CVE-2021-44228: Leaks memory from OpenSSL

Question 2

Match each encryption scope to its description.

Accepted Answer

Google-managed encryption: Encryption keys are managed entirely by Google.. Correct matches: Google-managed encryption (A) is fully handled by Google; CMEK (B) lets you manage keys via Cloud KMS; CSEK (C) requires you to supply keys. Common confusions involve who manages the keys.

Answer

CMEK: Encryption is done by Google with no user involvement.

Answer

CSEK: Encryption keys are managed by Google.

Answer

Google-managed encryption: You manage your own encryption keys.

Question 3

Match each Google Cloud logging/monitoring term to its definition.

Accepted Answer

Log bucket: A storage location for log entries. Log buckets store logs, log sinks route logs, log-based metrics derive metrics from logs, and log entries are individual records. Common confusions include mixing sinks with metrics and buckets with queries.

Answer

Log bucket: A query to filter log entries

Answer

Log sink: A metric derived from log data

Question 4

Match each IAM role to its typical use case.

Accepted Answer

Viewer: Can view resources but cannot make changes.. Correct matches: Viewer (read-only), Editor (edit but no permissions), Owner (full control). Billing Admin handles billing, Security Admin handles IAM.

Answer

Billing Admin: Can manage IAM permissions.

Answer

Security Admin: Can manage billing accounts and budgets.

Question 5

Match each security command center tier to its capabilities.

Accepted Answer

Standard tier: Basic security scanning and recommendations. Security Command Center has two main tiers: Standard and Premium. Standard provides basic security health and recommendations, while Premium adds advanced threat detection, event-based findings, and more. Common mistakes include swapping the feature sets.

Answer

Standard tier: Advanced threat detection and event-based findings

Answer

Premium tier: Basic security scanning and recommendations

Question 6

Match each access control mechanism to its description.

Accepted Answer

IAM: Defines who can do what on which resources.. IAM manages identities and permissions, VPC Service Controls prevent data exfiltration, and Organization Policies set configuration constraints. Distractors confuse these definitions with each other or with Access Context Manager.

Answer

IAM: Sets constraints on resource configurations.

Answer

VPC Service Controls: Defines access levels based on device attributes.

Question 7

Match each VPC firewall rule component to its definition.

Accepted Answer

Source IP: The IP addresses or CIDR blocks from which traffic originates.. VPC firewall rules consist of components like Source IP (traffic origin), Destination IP (traffic target), Action (allow/deny), and Priority (evaluation order). Common confusions include swapping Source and Destination, or confusing Action with Priority.

Answer

Source IP: The IP addresses to which traffic is directed.

Answer

Priority: Whether to allow or deny matching traffic.

Question 8

Match each Google Cloud security tool to its primary purpose.

Accepted Answer

Cloud IAM: Manage access control by defining who has what access to resources.. Cloud IAM controls access, Security Command Center detects threats, and Cloud DLP protects sensitive data. Confusions often arise between these tools due to overlapping security contexts.

Answer

Cloud IAM: Protect applications from DDoS attacks.

Answer

Cloud Security Command Center: Manage access control.

Answer

Cloud DLP: Detect and respond to threats.

Question 9

Match each Cloud KMS key purpose to its description.

Accepted Answer

Symmetric encryption key: Used for encrypting and decrypting data with the same key.. Cloud KMS key purposes include symmetric encryption (same key for encrypt/decrypt), asymmetric signing (private key to sign, public key to verify), and MAC (key for message authentication). Common confusions involve mixing symmetric and asymmetric operations.

Answer

Symmetric encryption key: Used for signing messages with a private key.

Answer

Asymmetric signing key: Used for encrypting data with the same key.

Answer

MAC key: Used for encrypting small amounts of data.

Question 10

Match each compliance framework to its focus area.

Accepted Answer

SOC 2: Security, availability, processing integrity, confidentiality, and privacy.. SOC 2 addresses security, availability, and privacy; HIPAA protects health information. Common confusions involve mixing FedRAMP with SOC 2 and PCI DSS with HIPAA.

Answer

SOC 2: Cloud security for US federal agencies.

Answer

HIPAA: Credit card data security.