PCSE Configuring Access Within a Cloud Solution Environment — 10 Questions

Question 1

A security engineer needs to prevent users from creating service account keys in a Google Cloud project. The solution must be enforceable across all projects in the organization and should not block other IAM operations. Which approach should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the Organization Policy Service with the constraint constraints/iam.disableServiceAccountKeyCreation.. Organization Policy constraints provide a way to enforce restrictions across the resource hierarchy. The built-in constraint 'constraints/iam.disableServiceAccountKeyCreation' specifically prevents creation of service account keys at the project, folder, or organization level. It does not affect other IAM operations. IAM deny policies can deny specific permissions but are more complex to manage and apply at the org level for this specific use case. Custom roles are not designed for enforcement across projects. The Organization Policy Service is the correct choice for such organization-wide restrictions.

Answer

Use IAM Conditions to restrict service account key creation to only a specific project.

Answer

Create a custom role that excludes the permission iam.serviceAccountKeys.create and assign it to all users.

Answer

Create an IAM deny policy at the organization level to deny the permission iam.serviceAccountKeys.create.

Question 2

A company has multiple Google Cloud projects organized under folders by department. The security team wants to enforce a policy that all Compute Engine instances must use Shielded VM features. They need to prevent non-compliant instances from being created. Which action should be taken to enforce this requirement most effectively?

Accepted Answer

Use the Organization Policy Service with the constraint constraints/compute.requireShieldedVm.. The Organization Policy Service provides a built-in constraint, constraints/compute.requireShieldedVm, that enforces Shielded VM features (Secure Boot, vTPM, Integrity Monitoring) on all new Compute Engine instances across the organization, folder, or project. When this constraint is set to enforce, any attempt to create an instance without the required Shielded VM settings is denied by the API. This is the most effective method because it applies centrally and cannot be bypassed by users with instance creation permissions.

Answer

Create an IAM deny policy at the organization level that denies the compute.instances.create permission unless the Shielded VM flag is set.

Answer

Create a custom role that includes the permission to create instances only with Shielded VM, and assign it to all users.

Answer

Implement a service account that only has permission to create instances and use service account impersonation for all instance creation.

Question 3

An organization has set up IAP to protect a web application running on Compute Engine. The application needs to know the authenticated user's email address for logging. How can the application securely obtain this information?

Accepted Answer

Extract the email from the X-Goog-Authenticated-User-Email header after verifying the JWT signed by IAP.. IAP passes the authenticated user's identity to the backend application via signed HTTP headers (X-Goog-Authenticated-User-Email, X-Goog-Authenticated-User-Id). The application should verify the JWT signature of the IAP token (using Google's public keys) to trust these headers. The headers cannot be spoofed if the application verifies the JWT. Using Cloud Logging is not for real-time identity. The metadata server does not provide IAP user identity. The IAP API is for managing IAP configuration, not for retrieving user identity per request.

Answer

Read the user's email from the instance's metadata server.

Answer

Use the Cloud Logging API to query the most recent IAP access logs.

Answer

Call the IAP API to retrieve the user identity.

Question 4

A security engineer wants to ensure that only users from a specific external identity provider (IdP) domain (example.com) can access Google Cloud resources. They have configured SAML SSO with the IdP. However, users from other domains are also able to access resources. What is the most effective way to restrict access to only users from example.com?

Accepted Answer

Set the Organization Policy constraint constraints/iam.allowedPolicyMemberDomains to only allow domain example.com.. The best approach is to use the Organization Policy constraint 'constraints/iam.allowedPolicyMemberDomains' to restrict which external domains can be members of IAM policies. This prevents users from other domains from being granted roles. Simply blocking at the IdP is not effective because users from other domains could be added as members in IAM. IAM Conditions can be used on role bindings to restrict access based on the user's domain, but this requires careful application to all policies. The organization policy provides a global enforcement.

Answer

Use Cloud Identity groups with membership restricted to example.com and grant access to the group only.

Answer

Configure the IdP to only assert users from example.com.

Answer

Use IAM Conditions to restrict access to users with a specific claim (e.g., assertion.primary_email ending with @example.com).

Question 5

A company has a GKE cluster with a Kubernetes Service Account (KSA) that needs to access Cloud Storage. They want to bind the KSA to a Google Cloud service account (GCP SA) so that pods running under the KSA inherit the GCP SA's permissions. They have enabled Workload Identity on the cluster. What is the correct step to bind the KSA to the GCP SA?

Accepted Answer

Grant the KSA the role iam.workloadIdentityUser on the GCP SA by running: gcloud iam service-accounts add-iam-policy-binding GCP_SA_EMAIL --member=serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME] --role=roles/iam.workloadIdentityUser. The correct binding is to grant the 'iam.workloadIdentityUser' role on the GCP SA to the KSA's identity. The KSA identity is represented in IAM as the principal 'serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]'. This allows the KSA to impersonate the GCP SA. Creating a service account key defeats the purpose of Workload Identity. Adding an annotation to the KSA is necessary but not sufficient; the IAM binding is also required.

Answer

Annotate the KSA with iam.gke.io/gcp-service-account=GCP_SA_EMAIL. No further steps are needed.

Answer

Create a JSON key for the GCP SA and store it as a Kubernetes secret, then mount it into the pods.

Answer

Grant the GCP SA the role roles/iam.serviceAccountUser on the KSA.

Question 6

A company uses Google Cloud Directory Sync (GCDS) to synchronize users from an on-premises Active Directory to Cloud Identity. The security team wants to ensure that only synchronized users can access Google Cloud resources. Which TWO actions are part of a secure configuration? (Choose two.)

Accepted Answer

Disable manual user creation in the Cloud Identity admin console.. Correct actions: 1) Disable the creation of manual users in Cloud Identity to ensure all users come from AD only. 2) Restrict the allowed domains for IAM members to the company's domain (e.g., example.com) using Organization Policy constraint 'constraints/iam.allowedPolicyMemberDomains' to prevent external users from being added. Enabling automatic license assignment is not a security measure. Using the default admin account is not recommended. Syncing passwords is not recommended; GCDS does not sync passwords.

Answer

Enable automatic license assignment for all synchronized users.

Answer

Configure GCDS to sync user passwords.

Answer

Create a custom role that allows only synchronized users to access resources.

Question 7

A cloud architect is designing a multi-project environment in Google Cloud. They want to ensure that a specific folder-level IAM policy cannot be overridden by project-level policies. Which TWO statements about IAM policy inheritance and deny policies are correct? (Choose two.)

Accepted Answer

If a deny policy denies a permission, an allow policy granting the same permission at a lower level will not be effective.. Correct statements: 1) Organization policies (deny policies) can block permissions even if an allow policy grants them. 2) Deny policies can be applied at any level and override allow policies. The other statements are incorrect: allow policies are hierarchical with additive inheritance, but they cannot be made 'hard' to prevent override; deny policies are the mechanism for that. Project-level allow policies can override folder-level allow policies (inheritance is additive). Deny policies can be applied at the folder level.

Answer

Deny policies can only be applied at the organization level.

Answer

Allow policies at the folder level are inherited by all projects in that folder and cannot be overridden by project-level allow policies.

Answer

Allow policies are evaluated before deny policies.

Question 8

A security engineer wants to ensure that all Compute Engine VMs in an organization use Shielded VM features. The organization uses Cloud Identity as the identity provider. What is the most efficient way to enforce this requirement?

Accepted Answer

Apply the built-in constraint 'constraints/compute.requireShieldedVm' via the Organization Policy Service.. Organization policies can enforce constraints across all projects. The built-in constraint 'constraints/compute.requireShieldedVm' requires all new VMs to have Shielded VM features enabled. This is more efficient than manual audits, scripts, or custom constraints.

Answer

Configure a Cloud Security Command Center (SCC) policy to scan and alert on non-compliant VMs.

Answer

Use an IAM deny policy to prevent users from creating VMs without Shielded VM.

Answer

Create a custom organization policy using the Organization Policy Service.

Question 9

A development team needs to grant a third-party auditor read-only access to a specific project's resources but must not allow the auditor to view any data stored in Cloud Storage buckets. Which IAM approach should be used?

Accepted Answer

Create a custom role that includes only the required read permissions except those for Cloud Storage.. A custom IAM role lets the team grant exactly the read permissions the auditor needs on the project while explicitly omitting Cloud Storage permissions, achieving least privilege. This is the only option that both grants project read access and guarantees the auditor cannot view bucket data.

Answer

Assign the predefined roles/viewer role and add a condition to deny access to Cloud Storage.

Answer

Use a deny policy to block access to storage.objects.get for the auditor.

Answer

Assign the basic roles/reader role to the auditor.

Question 10

An organization uses Google Workspace for email and collaboration. They want to allow employees to sign in to a custom web application using their Google Workspace credentials. The application runs on Compute Engine and uses a PostgreSQL database. Which identity solution should they implement?

Accepted Answer

Cloud Identity-Aware Proxy (IAP) with OIDC.. Cloud Identity-Aware Proxy (IAP) with OIDC is correct because IAP can be configured to authenticate users against Google Workspace identities and then pass an OIDC identity token to the backend application. This allows the custom web app running on Compute Engine to trust IAP as the identity provider, so employees sign in with their Google Workspace credentials without the app managing passwords. IAP also enforces access control at the load balancer level, providing a secure and managed authentication layer.

Answer

Workload Identity Federation.

Answer

SAML 2.0 federation with the web app.

Answer

Firebase Authentication with Google provider.