PCSE Configuring Access Within a Cloud Solution Environment — 50 Questions

Question 1

A security engineer needs to prevent users from creating service account keys in a Google Cloud project. The solution must be enforceable across all projects in the organization and should not block other IAM operations. Which approach should they use?

Accepted Answer

Use the Organization Policy Service with the constraint constraints/iam.disableServiceAccountKeyCreation.. Organization Policy constraints provide a way to enforce restrictions across the resource hierarchy. The built-in constraint 'constraints/iam.disableServiceAccountKeyCreation' specifically prevents creation of service account keys at the project, folder, or organization level. It does not affect other IAM operations. IAM deny policies can deny specific permissions but are more complex to manage and apply at the org level for this specific use case. Custom roles are not designed for enforcement across projects. The Organization Policy Service is the correct choice for such organization-wide restrictions.

Answer

Use IAM Conditions to restrict service account key creation to only a specific project.

Answer

Create a custom role that excludes the permission iam.serviceAccountKeys.create and assign it to all users.

Answer

Create an IAM deny policy at the organization level to deny the permission iam.serviceAccountKeys.create.

Question 2

An organization uses Active Directory (AD) on-premises and wants to synchronize user accounts and groups to Google Cloud Identity for SSO with SAML 2.0. The AD contains 50,000 users and 10,000 groups. The solution must support automatic provisioning and deprovisioning of users. Which tool should they use?

Accepted Answer

Use Google Cloud Directory Sync (GCDS) to synchronize users and groups from AD to Cloud Identity.. Google Cloud Directory Sync (GCDS) is the official tool for synchronizing users and groups from Active Directory (or LDAP) to Google Cloud Directory. It supports one-way sync, automatic provisioning, and deprovisioning. SAML SSO is configured separately using an IdP like Active Directory Federation Services (AD FS) or third-party. Workload Identity Federation is for external workloads (e.g., AWS, Azure) to access GCP resources, not for user identity synchronization. Cloud Identity API can be used programmatically but is not a ready-to-use sync tool. GCDS is the correct answer.

Answer

Use SAML 2.0 federation with AD FS to synchronize users.

Answer

Use Workload Identity Federation to connect AD to Google Cloud.

Answer

Use the Cloud Identity API to manually create users and groups.

Question 3

A developer wants to grant a Compute Engine instance access to read objects from a Cloud Storage bucket. The instance runs under a service account. What is the best practice for granting this access?

Accepted Answer

Assign the Storage Object Viewer role to the service account attached to the instance.. The best practice is to assign the appropriate IAM role (e.g., Storage Object Viewer) to the service account that the instance is running as. Then, the instance can use the service account's credentials automatically via the metadata server. This avoids the need to manage service account keys. Generating keys is discouraged. Allowing the instance to use the default compute engine service account is common but less secure; a custom service account with minimal permissions is preferred.

Answer

Create an IAM policy on the bucket that grants access to the instance's external IP address.

Answer

Use a signed URL with a long expiration time for the instance.

Answer

Generate a JSON key for the service account, download it to the instance, and use it in application code.

Question 4

A company has multiple Google Cloud projects organized under folders by department. The security team wants to enforce a policy that all Compute Engine instances must use Shielded VM features. They need to prevent non-compliant instances from being created. Which action should be taken to enforce this requirement most effectively?

Accepted Answer

Use the Organization Policy Service with the constraint constraints/compute.requireShieldedVm.. Organization Policy constraints are the correct mechanism to enforce requirements across the resource hierarchy. The built-in constraint 'constraints/compute.requireShieldedVm' ensures that any new Compute Engine instance must have Shielded VM features enabled. This policy can be applied at the organization, folder, or project level. IAM roles or custom roles cannot enforce instance configuration requirements. Service account impersonation is unrelated. Deny policies can deny specific permissions but not enforce Shielded VM settings.

Answer

Create an IAM deny policy at the organization level that denies the compute.instances.create permission unless the Shielded VM flag is set.

Answer

Create a custom role that includes the permission to create instances only with Shielded VM, and assign it to all users.

Answer

Implement a service account that only has permission to create instances and use service account impersonation for all instance creation.

Question 5

What is the purpose of Identity-Aware Proxy (IAP) on Google Cloud?

Accepted Answer

To enforce identity-based access control for web applications and SSH/RDP to VMs without requiring a VPN.. Identity-Aware Proxy (IAP) is a service that provides a zero-trust access control layer for applications and resources. It verifies a user's identity and context before allowing access, enforcing application-level access control. It is not a VPN or firewall; it works at the identity level, not network level. It does not replace Cloud Armor or VPC firewalls but complements them.

Answer

To manage firewall rules for VPC networks.

Answer

To provide a VPN connection between on-premises and Google Cloud.

Answer

To act as a web application firewall (WAF) that blocks SQL injection and XSS attacks.

Question 6

A DevOps team uses GitHub Actions to deploy infrastructure to Google Cloud. They want to avoid storing long-lived service account keys. Which approach should they use to authenticate from GitHub Actions to Google Cloud?

Accepted Answer

Use Workload Identity Federation by configuring a workload identity pool and provider for GitHub.. Workload Identity Federation allows GitHub Actions to exchange GitHub OIDC tokens for Google Cloud service account credentials. This eliminates the need for service account keys. The team must create a workload identity pool and provider in GCP, and configure GitHub Actions to use Google's action with 'workload_identity_provider'. Granting the service account token creator role is not the correct method. Using a Compute Engine instance is not relevant for GitHub Actions.

Answer

Grant the service account token creator role to the GitHub Actions runner.

Answer

Download a JSON service account key and store it as a GitHub secret.

Answer

Create a Compute Engine instance with a service account and run GitHub Actions from there.

Question 7

An organization has set up IAP to protect a web application running on Compute Engine. The application needs to know the authenticated user's email address for logging. How can the application securely obtain this information?

Accepted Answer

Extract the email from the X-Goog-Authenticated-User-Email header after verifying the JWT signed by IAP.. IAP passes the authenticated user's identity to the backend application via signed HTTP headers (X-Goog-Authenticated-User-Email, X-Goog-Authenticated-User-Id). The application should verify the JWT signature of the IAP token (using Google's public keys) to trust these headers. The headers cannot be spoofed if the application verifies the JWT. Using Cloud Logging is not for real-time identity. The metadata server does not provide IAP user identity. The IAP API is for managing IAP configuration, not for retrieving user identity per request.

Answer

Read the user's email from the instance's metadata server.

Answer

Use the Cloud Logging API to query the most recent IAP access logs.

Answer

Call the IAP API to retrieve the user identity.

Question 8

A security engineer wants to ensure that only users from a specific external identity provider (IdP) domain (example.com) can access Google Cloud resources. They have configured SAML SSO with the IdP. However, users from other domains are also able to access resources. What is the most effective way to restrict access to only users from example.com?

Accepted Answer

Set the Organization Policy constraint constraints/iam.allowedPolicyMemberDomains to only allow domain example.com.. The best approach is to use the Organization Policy constraint 'constraints/iam.allowedPolicyMemberDomains' to restrict which external domains can be members of IAM policies. This prevents users from other domains from being granted roles. Simply blocking at the IdP is not effective because users from other domains could be added as members in IAM. IAM Conditions can be used on role bindings to restrict access based on the user's domain, but this requires careful application to all policies. The organization policy provides a global enforcement.

Answer

Use Cloud Identity groups with membership restricted to example.com and grant access to the group only.

Answer

Configure the IdP to only assert users from example.com.

Answer

Use IAM Conditions to restrict access to users with a specific claim (e.g., assertion.primary_email ending with @example.com).

Question 9

A company wants to use Google Cloud resources but does not have a Google Workspace or Cloud Identity account. They want to manage identities for their users without paying for additional licenses. What is the most cost-effective identity solution?

Accepted Answer

Use Cloud Identity Free edition.. Cloud Identity Free edition provides identity management for users who only need to access Google Cloud resources (Compute Engine, Cloud Storage, etc.) without Gmail, Google Drive, or other Google Workspace services. It is free. Cloud Identity Premium includes additional features like device management and security policies but costs money. Google Workspace is a paid suite of productivity apps. The Compute Engine default service account is not for user identities.

Answer

Use the Compute Engine default service account for all users.

Answer

Use Cloud Identity Premium edition.

Answer

Use Google Workspace.

Question 10

A developer needs to create a custom IAM role that allows only a specific set of permissions for managing Cloud SQL instances. The role should be available at the organization level. Which command should they use?

Accepted Answer

gcloud iam roles create ROLE_ID --organization=ORGANIZATION_ID --file=role.yaml. Custom roles can be created at the organization level using the 'gcloud iam roles create' command with the '--organization' flag (or '--org' for short). The role is defined in a YAML file that specifies the permissions. The 'gcloud organizations add-iam-policy-binding' is used to assign roles, not create them. The 'gcloud iam service-accounts create' is for service accounts. The 'gcloud projects add-iam-policy-binding' is for project-level IAM bindings.

Answer

gcloud projects add-iam-policy-binding PROJECT_ID --member=... --role=...

Answer

gcloud iam service-accounts create SA_NAME --display-name=...

Answer

gcloud organizations add-iam-policy-binding ORGANIZATION_ID --member=... --role=...

Question 11

A company has a GKE cluster with a Kubernetes Service Account (KSA) that needs to access Cloud Storage. They want to bind the KSA to a Google Cloud service account (GCP SA) so that pods running under the KSA inherit the GCP SA's permissions. They have enabled Workload Identity on the cluster. What is the correct step to bind the KSA to the GCP SA?

Accepted Answer

Grant the KSA the role iam.workloadIdentityUser on the GCP SA by running: gcloud iam service-accounts add-iam-policy-binding GCP_SA_EMAIL --member=serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME] --role=roles/iam.workloadIdentityUser. The correct binding is to grant the 'iam.workloadIdentityUser' role on the GCP SA to the KSA's identity. The KSA identity is represented in IAM as the principal 'serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]'. This allows the KSA to impersonate the GCP SA. Creating a service account key defeats the purpose of Workload Identity. Adding an annotation to the KSA is necessary but not sufficient; the IAM binding is also required.

Answer

Annotate the KSA with iam.gke.io/gcp-service-account=GCP_SA_EMAIL. No further steps are needed.

Answer

Create a JSON key for the GCP SA and store it as a Kubernetes secret, then mount it into the pods.

Answer

Grant the GCP SA the role roles/iam.serviceAccountUser on the KSA.

Question 12

A security administrator wants to prevent users from disabling Shielded VM on existing Compute Engine instances. Which IAM permission should they deny?

Accepted Answer

compute.instances.updateShieldedVmConfig. The permission compute.instances.updateShieldedVmConfig controls the ability to update the Shielded VM configuration (enable/disable) on an existing instance. Denying this permission will prevent users from changing Shielded VM settings on instances. The permission compute.instances.setMetadata is for metadata changes, compute.instances.update is for general updates, and compute.instances.setMachineResources is for changing machine types.

Answer

compute.instances.setMetadata

Answer

compute.instances.setMachineResources

Answer

compute.instances.update

Question 13

A company uses Google Cloud Directory Sync (GCDS) to synchronize users from an on-premises Active Directory to Cloud Identity. The security team wants to ensure that only synchronized users can access Google Cloud resources. Which TWO actions are part of a secure configuration? (Choose two.)

Accepted Answer

Disable manual user creation in the Cloud Identity admin console.. Correct actions: 1) Disable the creation of manual users in Cloud Identity to ensure all users come from AD only. 2) Restrict the allowed domains for IAM members to the company's domain (e.g., example.com) using Organization Policy constraint 'constraints/iam.allowedPolicyMemberDomains' to prevent external users from being added. Enabling automatic license assignment is not a security measure. Using the default admin account is not recommended. Syncing passwords is not recommended; GCDS does not sync passwords.

Answer

Enable automatic license assignment for all synchronized users.

Answer

Configure GCDS to sync user passwords.

Answer

Create a custom role that allows only synchronized users to access resources.

Question 14

A financial services company is migrating to Google Cloud and needs to enforce strict security controls. They want to ensure that: 1) No service account keys are created. 2) All Compute Engine instances must be created with Shielded VM enabled. 3) Only users from the corporate domain (example.com) can be granted IAM roles. Which THREE Organization Policy constraints must be used? (Choose three.)

Accepted Answer

constraints/iam.allowedPolicyMemberDomains. The three constraints are: constraints/iam.disableServiceAccountKeyCreation (prevents key creation), constraints/compute.requireShieldedVm (requires Shielded VM), and constraints/iam.allowedPolicyMemberDomains (restricts IAM members to specific domains). The other constraints are not relevant: constraints/compute.restrictCloudArmorPolicies is about Cloud Armor policies, and constraints/compute.requireOsLogin is about OS Login.

Answer

constraints/compute.requireOsLogin

Answer

constraints/compute.restrictCloudArmorPolicies

Question 15

A cloud architect is designing a multi-project environment in Google Cloud. They want to ensure that a specific folder-level IAM policy cannot be overridden by project-level policies. Which TWO statements about IAM policy inheritance and deny policies are correct? (Choose two.)

Accepted Answer

If a deny policy denies a permission, an allow policy granting the same permission at a lower level will not be effective.. Correct statements: 1) Organization policies (deny policies) can block permissions even if an allow policy grants them. 2) Deny policies can be applied at any level and override allow policies. The other statements are incorrect: allow policies are hierarchical with additive inheritance, but they cannot be made 'hard' to prevent override; deny policies are the mechanism for that. Project-level allow policies can override folder-level allow policies (inheritance is additive). Deny policies can be applied at the folder level.

Answer

Deny policies can only be applied at the organization level.

Answer

Allow policies at the folder level are inherited by all projects in that folder and cannot be overridden by project-level allow policies.

Answer

Allow policies are evaluated before deny policies.

Question 16

A security engineer wants to ensure that all Compute Engine VMs in an organization use Shielded VM features. The organization uses Cloud Identity as the identity provider. What is the most efficient way to enforce this requirement?

Accepted Answer

Apply the built-in constraint 'constraints/compute.requireShieldedVm' via the Organization Policy Service.. Organization policies can enforce constraints across all projects. The built-in constraint 'constraints/compute.requireShieldedVm' requires all new VMs to have Shielded VM features enabled. This is more efficient than manual audits, scripts, or custom constraints.

Answer

Configure a Cloud Security Command Center (SCC) policy to scan and alert on non-compliant VMs.

Answer

Use an IAM deny policy to prevent users from creating VMs without Shielded VM.

Answer

Create a custom organization policy using the Organization Policy Service.

Question 17

A development team needs to grant a third-party auditor read-only access to a specific project's resources but must not allow the auditor to view any data stored in Cloud Storage buckets. Which IAM approach should be used?

Accepted Answer

Create a custom role that includes only the required read permissions except those for Cloud Storage.. Custom roles allow you to curate a specific set of permissions. You can create a role that includes read permissions for Compute Engine and Cloud SQL but excludes storage.objects.get on Cloud Storage. Predefined roles like Viewer include storage.objects.get, and basic roles are too broad. Condition-based access can be complex and error-prone.

Answer

Assign the predefined roles/viewer role and add a condition to deny access to Cloud Storage.

Answer

Use a deny policy to block access to storage.objects.get for the auditor.

Answer

Assign the basic roles/reader role to the auditor.

Question 18

An organization uses Google Workspace for email and collaboration. They want to allow employees to sign in to a custom web application using their Google Workspace credentials. The application runs on Compute Engine and uses a PostgreSQL database. Which identity solution should they implement?

Accepted Answer

Cloud Identity-Aware Proxy (IAP) with OIDC.. IAP with OIDC is the correct approach. IAP integrates with Google identity (including Google Workspace) and provides authentication and authorization for web applications. OIDC is the protocol used to verify identity. SAML is for SSO but IAP uses OIDC. Firebase Auth is for consumer apps. Cloud Identity-Aware Proxy (IAP) is specifically designed for this use case.

Answer

Workload Identity Federation.

Answer

SAML 2.0 federation with the web app.

Answer

Firebase Authentication with Google provider.

Question 19

A company runs a batch job on Compute Engine that processes sensitive data. The job uses a service account with a JSON key file stored on the VM. A security audit recommends removing long-lived keys. The job must run unattended. What is the best alternative?

Accepted Answer

Create a new service account and attach it to the VM instance; remove the old key.. Using a service account attached to the VM instance is the best practice. Compute Engine automatically obtains short-lived tokens from the metadata server, eliminating the need for keys. Workload Identity Federation is for external workloads. Secret Manager still requires a key to access. Default compute service account is less secure than a custom one.

Answer

Store the service account key in Secret Manager and retrieve it at runtime.

Answer

Use the default compute engine service account instead.

Answer

Use Workload Identity Federation to authenticate the batch job.

Question 20

A company wants to allow an external auditor to view all IAM policies in a project but not modify them. The auditor's Google account is from a different domain. Which IAM role should be assigned?

Accepted Answer

roles/iam.securityReviewer. The roles/iam.securityReviewer role grants permission to view IAM policies and other security settings without write access. roles/viewer does not include iam.roles.list or iam.policies.get. roles/iam.roleViewer only lists roles, not policies. roles/securityAdmin includes write permissions.

Answer

roles/iam.roleViewer

Answer

roles/viewer

Answer

roles/securityAdmin