PCSE Configuring Access Within a Cloud Solution Environment Practice Test 2 — 15 Questions

Question 1

A security engineer wants to ensure that all Compute Engine VMs in an organization use Shielded VM features. The organization uses Cloud Identity as the identity provider. What is the most efficient way to enforce this requirement?

Accepted Answer

Apply the built-in constraint 'constraints/compute.requireShieldedVm' via the Organization Policy Service.. Organization policies can enforce constraints across all projects. The built-in constraint 'constraints/compute.requireShieldedVm' requires all new VMs to have Shielded VM features enabled. This is more efficient than manual audits, scripts, or custom constraints.

Answer

Configure a Cloud Security Command Center (SCC) policy to scan and alert on non-compliant VMs.

Answer

Use an IAM deny policy to prevent users from creating VMs without Shielded VM.

Answer

Create a custom organization policy using the Organization Policy Service.

Question 2

A development team needs to grant a third-party auditor read-only access to a specific project's resources but must not allow the auditor to view any data stored in Cloud Storage buckets. Which IAM approach should be used?

Accepted Answer

Create a custom role that includes only the required read permissions except those for Cloud Storage.. Custom roles allow you to curate a specific set of permissions. You can create a role that includes read permissions for Compute Engine and Cloud SQL but excludes storage.objects.get on Cloud Storage. Predefined roles like Viewer include storage.objects.get, and basic roles are too broad. Condition-based access can be complex and error-prone.

Answer

Assign the predefined roles/viewer role and add a condition to deny access to Cloud Storage.

Answer

Use a deny policy to block access to storage.objects.get for the auditor.

Answer

Assign the basic roles/reader role to the auditor.

Question 3

An organization uses Google Workspace for email and collaboration. They want to allow employees to sign in to a custom web application using their Google Workspace credentials. The application runs on Compute Engine and uses a PostgreSQL database. Which identity solution should they implement?

Accepted Answer

Cloud Identity-Aware Proxy (IAP) with OIDC.. IAP with OIDC is the correct approach. IAP integrates with Google identity (including Google Workspace) and provides authentication and authorization for web applications. OIDC is the protocol used to verify identity. SAML is for SSO but IAP uses OIDC. Firebase Auth is for consumer apps. Cloud Identity-Aware Proxy (IAP) is specifically designed for this use case.

Answer

Workload Identity Federation.

Answer

SAML 2.0 federation with the web app.

Answer

Firebase Authentication with Google provider.

Question 4

A company runs a batch job on Compute Engine that processes sensitive data. The job uses a service account with a JSON key file stored on the VM. A security audit recommends removing long-lived keys. The job must run unattended. What is the best alternative?

Accepted Answer

Create a new service account and attach it to the VM instance; remove the old key.. Using a service account attached to the VM instance is the best practice. Compute Engine automatically obtains short-lived tokens from the metadata server, eliminating the need for keys. Workload Identity Federation is for external workloads. Secret Manager still requires a key to access. Default compute service account is less secure than a custom one.

Answer

Store the service account key in Secret Manager and retrieve it at runtime.

Answer

Use the default compute engine service account instead.

Answer

Use Workload Identity Federation to authenticate the batch job.

Question 5

A company wants to allow an external auditor to view all IAM policies in a project but not modify them. The auditor's Google account is from a different domain. Which IAM role should be assigned?

Accepted Answer

roles/iam.securityReviewer. The roles/iam.securityReviewer role grants permission to view IAM policies and other security settings without write access. roles/viewer does not include iam.roles.list or iam.policies.get. roles/iam.roleViewer only lists roles, not policies. roles/securityAdmin includes write permissions.

Answer

roles/iam.roleViewer

Answer

roles/viewer

Answer

roles/securityAdmin

Question 6

Which of the following is a key advantage of using Workload Identity Federation over service account keys for authenticating workloads running on AWS?

Accepted Answer

It allows the use of short-lived tokens instead of long-lived keys.. Workload Identity Federation allows workloads to use short-lived tokens from the external identity provider (e.g., AWS STS) to impersonate a Google service account, eliminating the need to manage and rotate long-lived keys. Service account keys are long-lived secrets that can be leaked.

Answer

It eliminates the need to create service accounts.

Answer

It supports MFA for workload authentication.

Answer

It reduces latency compared to using keys.

Question 7

A DevOps engineer needs to create a custom IAM role that allows creating and deleting Compute Engine instances but not stopping or starting them. Which permissions should be included?

Accepted Answer

compute.instances.create and compute.instances.delete. To create and delete instances, the permissions compute.instances.create and compute.instances.delete are required. compute.instances.stop and compute.instances.start are separate permissions for stopping/starting. compute.instances.update is for modifying existing instances.

Answer

compute.instances.start and compute.instances.stop

Answer

compute.instances.create, compute.instances.delete, and compute.instances.update

Answer

compute.instances.create

Question 8

An organization has multiple GCP projects under a folder. They want to prevent all users from creating service account keys in any project under that folder. They also want to allow exceptions for a specific project where key creation is needed. Which approach should they take?

Accepted Answer

Apply the organization policy constraint 'constraints/iam.disableServiceAccountKeyCreation' at the folder level and set an exception for the specific project.. Organization policies can be set at the folder level with an enforce: true condition, and then an exception can be made for a specific project using a conditional policy or by setting a different policy on that project. IAM deny policies cannot disable the API for all users. Custom roles cannot disable key creation globally. Removing roles is impractical.

Answer

Create a custom role that excludes the permission to create keys and assign it to all users.

Answer

Remove the roles/iam.serviceAccountKeyAdmin role from all users.

Answer

Use an IAM deny policy on the folder to deny the permission to create service account keys.

Question 9

Which of the following is true about IAM deny policies?

Accepted Answer

Deny policies take precedence over allow policies.. Deny policies override allow policies. They are evaluated after allow policies, and if a deny matches, the access is denied regardless of allowed roles. They apply to the resource hierarchy as well. Deny policies can be set at the organization, folder, project, or resource level.

Answer

Deny policies can only be applied at the organization level.

Answer

Deny policies are evaluated before allow policies.

Answer

Deny policies can grant permissions.

Question 10

A company uses Cloud Identity to manage users and groups. They want to synchronize users from their on-premises Active Directory to Cloud Identity. Which tool should they use?

Accepted Answer

Google Cloud Directory Sync (GCDS). Google Cloud Directory Sync (GCDS) is the official tool for synchronizing users and groups from Active Directory or LDAP to Cloud Identity. Cloud Identity SDK is not a sync tool. Deployment Manager is for infrastructure. IAM is for access control.

Answer

Identity and Access Management (IAM)

Answer

Cloud Deployment Manager

Answer

Cloud Identity SDK

Question 11

A GKE cluster runs workloads that need to access Cloud Storage. The security team wants to avoid using service account keys and ensure each pod has a unique identity. What is the best practice?

Accepted Answer

Use Workload Identity: create a Kubernetes service account and bind it to a Google service account.. Workload Identity for GKE binds a Kubernetes service account to a Google service account. Pods that use the KSA automatically authenticate as the GSA without keys. This provides fine-grained pod-level identity. Attaching the GSA to the node is coarse-grained. Using the default compute SA is insecure. Creating keys defeats the purpose.

Answer

Create a service account key and mount it as a secret in each pod.

Answer

Use the default compute engine service account for the cluster.

Answer

Attach a Google service account to the GKE node pool.

Question 12

An organization wants to allow users to access a web application running on Compute Engine via HTTPS. The application requires users to authenticate with their corporate credentials (SAML 2.0 IdP). Which Google Cloud service should be used?

Accepted Answer

Identity-Aware Proxy (IAP) with HTTPS. Identity-Aware Proxy (IAP) with HTTPS provides authentication and authorization for web applications. It integrates with external SAML IdPs through Cloud Identity or G Suite. Cloud Load Balancing with SSL does not authenticate. Cloud Armor is for security policies. Cloud NAT is for outbound traffic.

Answer

Cloud NAT

Answer

Cloud Armor

Answer

Cloud Load Balancing with SSL certificates

Question 13

A company wants to enforce that only users from a specific domain (example.com) can be granted IAM roles on any resource in their organization. Which two steps are required? (Choose two.)

Accepted Answer

Configure Cloud Identity or Google Workspace to manage the example.com domain.. Enforcing allowed member domains requires setting the organization policy constraint 'constraints/iam.allowedPolicyMemberDomains' to include example.com. Additionally, configuring Cloud Identity or Google Workspace with the domain is necessary for the constraint to work. IAM deny policies are not used. Custom roles are not required. Cloud Directory Sync is for syncing users, not enforcement.

Answer

Create custom roles that only allow users from example.com.

Answer

Create an IAM deny policy to deny access to users from other domains.

Answer

Use Cloud Directory Sync to sync only example.com users.

Question 14

A security engineer needs to ensure that all Compute Engine instances in an organization are created with specific CMEK (Customer-Managed Encryption Key) for disk encryption. The engineer wants to enforce this at the organization level. Which three actions are required? (Choose three.)

Accepted Answer

Create a Cloud KMS key ring and encryption key.. To enforce CMEK use, you need to create a custom organization policy constraint that requires the CMEK key resource name. Enabling CMEK via CSEK is different. The constraint must be applied at the organization level. The key must be created in Cloud KMS. The compute engine API must be enabled for policy enforcement.

Answer

Enable Customer-Supplied Encryption Keys (CSEK) for all instances.

Answer

Ensure the Compute Engine API is disabled for all projects.

Question 15

A developer wants to allow a CI/CD pipeline running on GitHub Actions to deploy resources to a GCP project without using service account keys. Which two components are needed? (Choose two.)

Accepted Answer

A Workload Identity Pool and Provider configured for GitHub.. Workload Identity Federation allows GitHub Actions to exchange GitHub OIDC tokens for GCP service account impersonation. You need to set up a workload identity pool and provider for GitHub. The GitHub Actions workflow must be configured to use the OIDC token and request impersonation of a service account.

Answer

A Cloud Build trigger to run the workflow.

Answer

A Cloud KMS key to encrypt the workflow.

Answer

A service account JSON key stored as a GitHub secret.