PCSE Multiple Select — 20 Questions

Question 1

A multinational company is migrating sensitive workloads to Google Cloud and must comply with GDPR data residency requirements. Which TWO actions ensure data remains stored only within the European Union? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Define an Organization Policy with constraints/gcp.resourceLocations to allow resource creation only in EU regions.. The Organization Policy constraint `gcp.resourceLocations` explicitly restricts the Google Cloud regions where resources can be created. By setting this constraint to allow only EU regions (e.g., `europe-west1`, `europe-west4`), you enforce that all new resources are provisioned within the European Union, directly meeting GDPR data residency requirements. This policy is evaluated at resource creation time and prevents any resource from being deployed outside the allowed locations.

Answer

Enable Cloud Audit Logs with export to a BigQuery dataset in the EU region.

Answer

Use Cloud Data Loss Prevention (DLP) to scan for sensitive data and verify it remains in the EU.

Answer

Use Customer-Managed Encryption Keys (CMEK) stored in a Cloud KMS key ring located in the EU.

Question 2

Which TWO practices help implement the principle of least privilege when configuring access to Google Cloud resources? (Choose two.)

Accepted Answer

Create custom roles that include only the specific permissions needed.. Creating custom roles allows you to define a precise set of permissions, ensuring that a principal has only the minimum permissions required to perform their job function. This directly implements the principle of least privilege by avoiding the broad permissions often included in predefined roles.

Answer

Grant roles at the organization level to simplify administration.

Answer

Use a single service account for all Cloud Functions in a project to simplify key management.

Answer

Grant IAM roles directly to individual users for better traceability.

Question 3

Which THREE are best practices for managing encryption keys in Google Cloud?

Accepted Answer

Enable automatic rotation for keys that are used for encryption.. Cloud KMS supports automatic key rotation, which reduces the risk of key compromise by ensuring that encryption keys are periodically replaced without manual intervention. Automatic rotation creates new key versions at a specified interval (e.g., every 90 days) and automatically uses the latest version for encryption, while decryption can still use older versions. This aligns with the security best practice of limiting the amount of data encrypted under a single key version.

Answer

Import key material from on-premises HSMs to avoid vendor lock-in.

Answer

Automatically delete old key versions once they expire.

Question 4

A company is using Assured Workloads with the FEDRAMP_HIGH regime. They need to restrict where resources can be created and monitor for compliance violations. Which TWO settings should they configure? (Choose 2)

Accepted Answer

Resource location restrictions. Option C (Resource location restrictions) is correct because Assured Workloads lets you define the allowed resource locations for a folder, so any attempt to create resources outside the permitted regions is blocked, directly satisfying the requirement to restrict where resources can be created. Option E (Compliance monitoring / drift detection) is correct because Assured Workloads continuously monitors the folder for policy violations and configuration drift against the FEDRAMP_HIGH controls, alerting you to non-compliant changes. Option A (Access Transparency logs) is not one of the two settings that restrict creation locations or detect compliance drift; Access Transparency provides logs of Google personnel access actions and is a separate transparency control. Option B (Data residency controls) is not the correct selection here because Assured Workloads enforces location through resource location restrictions rather than a distinct 'data residency controls' setting. Option D (Google personnel access restrictions) is a personnel/access control (such as Access Approval or support access restrictions) and does not itself restrict resource creation locations or provide drift detection.

Answer

Access Transparency logs

Answer

Data residency controls

Answer

Google personnel access restrictions

Question 5

A multinational organization uses Chronicle SIEM to aggregate and analyze security logs from multiple GCP projects and on-premises systems. The security team wants to detect a known threat pattern: a user authenticating from an anomalous geographic location followed by a large data egress from a Compute Engine instance within 10 minutes. Which three steps are necessary to create this detection? (Choose three.)

Accepted Answer

Ingest Cloud Audit Logs and VPC Flow Logs into Chronicle via forwarders or native integration. Option A is correct because Chronicle detection requires the relevant telemetry in UDM; ingesting Cloud Audit Logs (for authentication events) and VPC Flow Logs (for network egress) via native integration or forwarders provides the raw events the rule will match. Option B is correct because the scenario explicitly includes on-premises systems, so a forwarder must send those authentication logs into Chronicle to correlate them with GCP activity. Option E is correct because YARA-L is Chronicle's detection language, and a rule matching a UDM authentication event with anomalous geo-location followed within 10 minutes by a UDM network event with large bytes out directly implements the described threat pattern. Option C is not needed because BigQuery export is for long-term storage/analysis, not for creating a real-time Chronicle detection. Option D is not needed because Security Command Center findings are a separate GCP security service and do not create the Chronicle YARA-L detection logic.

Answer

Configure a BigQuery export of VPC Flow Logs for long-term analysis

Answer

Enable the Standard tier of Security Command Center to generate finding notifications

Question 6

Which THREE steps are most effective for troubleshooting a VPC firewall rule issue where desired traffic is being blocked?

Accepted Answer

Check firewall rule logs in Cloud Logging. Option B is correct because VPC firewall rule logging in Cloud Logging records allowed and denied connections with details such as the rule name, direction, and source/destination, which directly reveals whether a firewall rule is blocking the traffic. Option C is correct because Google Cloud firewall rules apply to instances based on matching network tags (targetTags), so if the instance's network tags do not match the rule's target tags, the rule will not be enforced as intended and traffic may be blocked by a default or other rule. Option D is correct because VPC Flow Logs capture IP traffic metadata for the subnet or instance, showing whether packets are reaching the VM and helping distinguish a firewall block from a routing or upstream issue. Option A is not relevant because IAM permissions control API-level access to manage resources, not packet filtering for VM traffic. Option E is not the most effective step here because route tables determine path selection, not firewall rule evaluation; while routing issues can cause connectivity failures, they do not explain a firewall rule blocking desired traffic.

Answer

Check IAM permissions for the VM's service account

Answer

Inspect the route tables for the subnet

Question 7

A company is deploying a web application behind an external HTTPS load balancer. They want to protect against common web attacks such as XSS, SQLi, and LFI using preconfigured rules. They also need to allowlist specific IP addresses that belong to partners. Which three Cloud Armor features should they use? (Choose three.)

Accepted Answer

Attach the Cloud Armor security policy to the backend service or load balancer.. Option A is correct because a Cloud Armor security policy only takes effect once it is attached to the target backend service (or the backend service of the external HTTPS load balancer), which is the enforcement point for the rules. Option B is correct because the OWASP ModSecurity Core Rule Set (CRS) preconfigured WAF rules in Cloud Armor are specifically designed to detect and block common web attacks such as XSS, SQL injection, and local file inclusion without writing rules from scratch. Option E is correct because partner IP allowlisting is implemented with custom Cloud Armor rules using match conditions on source IP ranges (for example, srcIpRanges with an allow action at a suitable priority), which permits only the specified partner addresses. Option C is not correct because IAP controls user authentication/authorization to applications and does not provide WAF protection against XSS, SQLi, or LFI, nor IP allowlisting for partners. Option D is not correct because Cloud CDN only caches content at the edge to improve performance; it does not inspect or block malicious web requests.

Answer

Configure IAP to restrict access to the application.

Answer

Use Cloud CDN to cache static content.

Question 8

A company is implementing data loss prevention (DLP) for BigQuery. Which THREE capabilities are provided by Cloud DLP? (Choose THREE.)

Accepted Answer

Redacting sensitive data in query results.. Cloud DLP can inspect and redact sensitive data directly in BigQuery query results. When you configure a DLP job or use the DLP API with BigQuery, you can specify infoTypes to detect and then redact matching values before returning the results to the user, preventing exposure of sensitive information like credit card numbers or PII.

Answer

Auditing all queries that access sensitive columns.

Answer

Encrypting entire tables with customer-managed keys.

Question 9

A security engineer is designing a solution to monitor and detect anomalous IAM role usage across multiple Google Cloud projects. The engineer wants to create a centralized logging solution that captures all IAM policy changes and access attempts. Which THREE services should the engineer use together to achieve this?

Accepted Answer

BigQuery. BigQuery is correct because it serves as the centralized analytics destination for Cloud Audit Logs, enabling the security engineer to run SQL queries across IAM policy changes and access attempts from multiple Google Cloud projects. By exporting audit logs to BigQuery, you can perform complex aggregations and anomaly detection at scale, which is essential for monitoring IAM role usage across a fleet of projects.

Answer

Cloud Monitoring

Answer

Cloud Functions

Question 10

A security team wants to enforce SSL/TLS best practices for their HTTPS load balancer. They need to require TLS 1.2 or higher and restrict ciphers to strong ones only. Which TWO actions should they take? (Choose two.)

Accepted Answer

Attach the SSL policy to the target HTTPS proxy. To enforce TLS version and cipher strength, you create an SSL policy. The policy can set the minimum TLS version to 1.2 and the profile to RESTRICTED (which only allows strong ciphers). Then you attach the policy to the load balancer's target HTTPS proxy.

Answer

Enable Cloud Armor WAF rules

Answer

Set the SSL policy to COMPATIBLE profile

Answer

Use a Google-managed SSL certificate

Question 11

A company wants to implement least privilege for a service account that needs to read objects from a Cloud Storage bucket and publish messages to a Pub/Sub topic. Which TWO IAM roles should be granted to the service account? (Choose TWO)

Accepted Answer

roles/storage.objectViewer. Roles/storage.objectViewer grants read-only access to objects in Cloud Storage buckets, which is the minimum permission needed for the service account to read objects. This role includes permissions like storage.objects.get and storage.objects.list, allowing the service account to retrieve object data without any write or administrative capabilities.

Answer

roles/pubsub.subscriber

Answer

roles/storage.admin

Answer

roles/pubsub.viewer

Question 12

A company is designing a network architecture for a multi-region application. They want to minimize latency and maximize availability. Which two features should they consider? (Choose two.)

Accepted Answer

Cloud CDN. Cloud CDN (B) is correct because it caches content at Google's globally distributed edge points of presence, serving users from the closest edge location and thereby reducing latency for the multi-region application. Global Cloud Load Balancer (D) is correct because a single global anycast IP routes users to the closest healthy backend across regions, providing both low-latency routing and automatic failover that maximizes availability. Cloud NAT (A) only provides outbound internet access for private instances and does not improve latency or availability for a multi-region application. Cloud Interconnect (C) offers dedicated private connectivity between on-premises networks and a VPC, which is not required for a multi-region design and does not by itself reduce end-user latency. VPC Network Peering (E) connects VPC networks for internal traffic but provides no global edge caching or anycast-based global load balancing.

Answer

Cloud NAT

Answer

Cloud Interconnect

Answer

VPC Network Peering

Question 13

An organization wants to enforce that all Compute Engine instances must use a specific service account. Which three steps are necessary? (Choose three.)

Accepted Answer

Grant the service account the needed roles on the project.. The service account must be granted the necessary IAM roles on the project (or specific resources) to perform its intended actions. Without these grants, even if the service account is enforced, it will lack permissions to interact with Compute Engine resources. This step ensures the service account has the required access, such as compute.instanceAdmin or custom roles, to manage instances.

Answer

Create a custom role with compute.instances.create permission.

Answer

Grant the compute.instanceAdmin role to the service account.

Question 14

You are designing VPC firewall rules for a multi-tier application. Which TWO considerations are important when creating firewall rules in terms of security and manageability? (Choose TWO.)

Accepted Answer

Use hierarchical firewall policies to enforce baseline rules across all VPCs in the organization.. Option B is correct because hierarchical firewall policies in Google Cloud are attached at the organization or folder level and are inherited by all VPC networks beneath them, letting you enforce baseline allow/deny rules (such as blocking SSH from 0.0.0.0/0) consistently across every project without duplicating rules per VPC, which greatly improves manageability and security posture. Option C is correct because targeting rules by service account or network tag decouples the rule from static IP ranges, so as instances are created, scaled, or replaced in dynamic environments, the correct rules automatically apply to the right workloads without editing CIDRs. Option A is incorrect because network tags remain a supported and commonly recommended targeting mechanism, and hierarchical policies plus tag governance can manage them at scale. Option D is incorrect because enabling logging on every rule is not a universal best practice; logging all rules can generate significant cost and noise, so logging should be enabled selectively on rules where audit or troubleshooting value justifies it. Option E is incorrect because VPC firewall rules are enforced at the network level and are not scoped by region, so specifying a target region is not a valid consideration.

Answer

Network tags are not recommended for large deployments because they require managing many tags.

Answer

Enable firewall rules logging for all rules to ensure full auditability.

Answer

Always specify the target region for firewall rules to limit the scope.

Question 15

A developer wants to allow a CI/CD pipeline running on GitHub Actions to deploy resources to a GCP project without using service account keys. Which two components are needed? (Choose two.)

Accepted Answer

A Workload Identity Pool and Provider configured for GitHub.. Workload Identity Federation allows GitHub Actions to exchange GitHub OIDC tokens for GCP service account impersonation. You need to set up a workload identity pool and provider for GitHub. The GitHub Actions workflow must be configured to use the OIDC token and request impersonation of a service account.

Answer

A Cloud Build trigger to run the workflow.

Answer

A Cloud KMS key to encrypt the workflow.

Answer

A service account JSON key stored as a GitHub secret.

Question 16

A company wants to encrypt data at rest in Cloud SQL. Which TWO methods are supported? (Choose TWO.)

Accepted Answer

Default encryption at rest with Google-managed keys. Cloud SQL provides default encryption at rest using AES-256 with Google-managed keys, which are automatically generated and rotated by Google. This encryption is transparent to the user and requires no additional configuration, ensuring data is encrypted before being written to disk.

Answer

Cloud HSM hardware security module for encryption

Answer

Cloud Key Management Service (Cloud KMS) as a standalone encryption method

Answer

Client-side encryption before storing data in Cloud SQL

Question 17

A company is subject to ITAR regulations and needs to ensure that all data stored in GCP remains within the United States. They also require FIPS 140-2 Level 3 validation for encryption keys. Which two services should they use together to meet these requirements? (Choose 2)

Accepted Answer

Cloud HSM. Assured Workloads (D) is correct because it is the GCP service designed to enforce data residency and compliance controls, including ITAR and US-only data location restrictions, by applying policy guardrails to a folder or project. Cloud HSM (B) is correct because it provides FIPS 140-2 Level 3 validated hardware security modules for encryption key generation, storage, and cryptographic operations, satisfying the key protection requirement. Used together, Assured Workloads enforces the US data boundary while Cloud HSM supplies the required Level 3 validated key management. Cloud KMS with software keys (A) is not appropriate because software-backed keys only meet FIPS 140-2 Level 1, not Level 3. Cloud DLP (C) is a data discovery and redaction service, not a residency or key-validation control. Secret Manager (E) stores secrets such as API keys and passwords but does not provide FIPS 140-2 Level 3 HSM-backed keys or enforce ITAR data residency.

Answer

Cloud KMS with software keys

Answer

Cloud DLP

Answer

Secret Manager

Question 18

A company wants to implement a vulnerability management program for their Google Cloud environment. They need to scan Compute Engine instances for OS vulnerabilities and container images for known vulnerabilities. Which two services should they use? (Choose two.)

Accepted Answer

VM Manager (OS patch assessment). VM Manager's OS patch assessment (option A) is correct because it evaluates Compute Engine VM instances against OS vulnerability and patch baselines, giving the OS-level vulnerability scanning the company needs. Container Analysis with Artifact Registry vulnerability scanning (option C) is correct because it automatically scans container images stored in Artifact Registry for known OS and language package vulnerabilities, covering the container image requirement. Cloud Security Scanner (option B) is a legacy App Engine/Compute Engine web app scanner for XSS and mixed content, not an OS or container image vulnerability scanner. Binary Authorization (option D) is a deploy-time policy control that enforces attestations on container images, not a vulnerability scanner. Web Security Scanner (option E) scans web applications for common web vulnerabilities, not OS or container image CVEs.

Answer

Cloud Security Scanner

Answer

Binary Authorization

Answer

Web Security Scanner

Question 19

A security team is configuring Cloud Armor to protect a web application. They need to block requests that contain SQL injection patterns, block requests from a known malicious IP list, and limit requests from any single IP to 2000 requests per minute. Which THREE actions must they take? (Choose three.)

Accepted Answer

Create a custom rule with a deny action for the malicious IP list using a CEL expression. To implement these requirements, you need to enable the preconfigured SQL injection rule set, create a custom rule with an IP allow/deny list for the malicious IPs, and create a rate limiting rule. Cloud Armor does not have a built-in list of malicious IPs; you must provide the list. The rate limiting is configured as a separate rule with action 'rateBasedThrottle'.

Answer

Create a single rule that combines SQLi detection, IP blocking, and rate limiting using CEL

Answer

Enable Cloud Armor Managed Protection Plus for automatic IP reputation

Question 20

A company is migrating a PCI DSS-compliant application to GCP. They need to meet encryption requirements for cardholder data. Which TWO options satisfy PCI DSS encryption requirements? (Choose two.)

Accepted Answer

Use Cloud External Key Manager (EKM) with a supported partner.. PCI DSS requires strong encryption; TLS 1.2+ is required for data in transit, and CMEK for data at rest provides customer-managed keys that meet compliance.

Answer

Use SHA-1 for SSL certificates.

Answer

Use default Google encryption keys (Google-managed) for data at rest.

Answer

Use TLS 1.0 for data in transit.