PCSE Configuring Access Within a Cloud Solution Environment Practice Test 2 — 15 Questions

Question 1

A company wants to use Google Cloud resources but does not have a Google Workspace or Cloud Identity account. They want to manage identities for their users without paying for additional licenses. What is the most cost-effective identity solution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Cloud Identity Free edition.. Cloud Identity Free edition provides identity management for users who only need to access Google Cloud resources (Compute Engine, Cloud Storage, etc.) without Gmail, Google Drive, or other Google Workspace services. It is free. Cloud Identity Premium includes additional features like device management and security policies but costs money. Google Workspace is a paid suite of productivity apps. The Compute Engine default service account is not for user identities.

Answer

Use the Compute Engine default service account for all users.

Answer

Use Cloud Identity Premium edition.

Answer

Use Google Workspace.

Question 2

A developer needs to create a custom IAM role that allows only a specific set of permissions for managing Cloud SQL instances. The role should be available at the organization level. Which command should they use?

Accepted Answer

gcloud iam roles create ROLE_ID --organization=ORGANIZATION_ID --file=role.yaml. Custom roles can be created at the organization level using the 'gcloud iam roles create' command with the '--organization' flag (or '--org' for short). The role is defined in a YAML file that specifies the permissions. The 'gcloud organizations add-iam-policy-binding' is used to assign roles, not create them. The 'gcloud iam service-accounts create' is for service accounts. The 'gcloud projects add-iam-policy-binding' is for project-level IAM bindings.

Answer

gcloud projects add-iam-policy-binding PROJECT_ID --member=... --role=...

Answer

gcloud iam service-accounts create SA_NAME --display-name=...

Answer

gcloud organizations add-iam-policy-binding ORGANIZATION_ID --member=... --role=...

Question 3

A company has a GKE cluster with a Kubernetes Service Account (KSA) that needs to access Cloud Storage. They want to bind the KSA to a Google Cloud service account (GCP SA) so that pods running under the KSA inherit the GCP SA's permissions. They have enabled Workload Identity on the cluster. What is the correct step to bind the KSA to the GCP SA?

Accepted Answer

Grant the KSA the role iam.workloadIdentityUser on the GCP SA by running: gcloud iam service-accounts add-iam-policy-binding GCP_SA_EMAIL --member=serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME] --role=roles/iam.workloadIdentityUser. The correct binding is to grant the 'iam.workloadIdentityUser' role on the GCP SA to the KSA's identity. The KSA identity is represented in IAM as the principal 'serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]'. This allows the KSA to impersonate the GCP SA. Creating a service account key defeats the purpose of Workload Identity. Adding an annotation to the KSA is necessary but not sufficient; the IAM binding is also required.

Answer

Annotate the KSA with iam.gke.io/gcp-service-account=GCP_SA_EMAIL. No further steps are needed.

Answer

Create a JSON key for the GCP SA and store it as a Kubernetes secret, then mount it into the pods.

Answer

Grant the GCP SA the role roles/iam.serviceAccountUser on the KSA.

Question 4

A security administrator wants to prevent users from disabling Shielded VM on existing Compute Engine instances. Which IAM permission should they deny?

Accepted Answer

compute.instances.updateShieldedVmConfig. The permission compute.instances.updateShieldedVmConfig controls the ability to update the Shielded VM configuration (enable/disable) on an existing instance. Denying this permission will prevent users from changing Shielded VM settings on instances. The permission compute.instances.setMetadata is for metadata changes, compute.instances.update is for general updates, and compute.instances.setMachineResources is for changing machine types.

Answer

compute.instances.setMetadata

Answer

compute.instances.setMachineResources

Answer

compute.instances.update

Question 5

A company uses Google Cloud Directory Sync (GCDS) to synchronize users from an on-premises Active Directory to Cloud Identity. The security team wants to ensure that only synchronized users can access Google Cloud resources. Which TWO actions are part of a secure configuration? (Choose two.)

Accepted Answer

Disable manual user creation in the Cloud Identity admin console.. Correct actions: 1) Disable the creation of manual users in Cloud Identity to ensure all users come from AD only. 2) Restrict the allowed domains for IAM members to the company's domain (e.g., example.com) using Organization Policy constraint 'constraints/iam.allowedPolicyMemberDomains' to prevent external users from being added. Enabling automatic license assignment is not a security measure. Using the default admin account is not recommended. Syncing passwords is not recommended; GCDS does not sync passwords.

Answer

Enable automatic license assignment for all synchronized users.

Answer

Configure GCDS to sync user passwords.

Answer

Create a custom role that allows only synchronized users to access resources.

Question 6

A financial services company is migrating to Google Cloud and needs to enforce strict security controls. They want to ensure that: 1) No service account keys are created. 2) All Compute Engine instances must be created with Shielded VM enabled. 3) Only users from the corporate domain (example.com) can be granted IAM roles. Which THREE Organization Policy constraints must be used? (Choose three.)

Accepted Answer

constraints/iam.allowedPolicyMemberDomains. The three constraints are: constraints/iam.disableServiceAccountKeyCreation (prevents key creation), constraints/compute.requireShieldedVm (requires Shielded VM), and constraints/iam.allowedPolicyMemberDomains (restricts IAM members to specific domains). The other constraints are not relevant: constraints/compute.restrictCloudArmorPolicies is about Cloud Armor policies, and constraints/compute.requireOsLogin is about OS Login.

Answer

constraints/compute.requireOsLogin

Answer

constraints/compute.restrictCloudArmorPolicies

Question 7

A cloud architect is designing a multi-project environment in Google Cloud. They want to ensure that a specific folder-level IAM policy cannot be overridden by project-level policies. Which TWO statements about IAM policy inheritance and deny policies are correct? (Choose two.)

Accepted Answer

If a deny policy denies a permission, an allow policy granting the same permission at a lower level will not be effective.. Correct statements: 1) Organization policies (deny policies) can block permissions even if an allow policy grants them. 2) Deny policies can be applied at any level and override allow policies. The other statements are incorrect: allow policies are hierarchical with additive inheritance, but they cannot be made 'hard' to prevent override; deny policies are the mechanism for that. Project-level allow policies can override folder-level allow policies (inheritance is additive). Deny policies can be applied at the folder level.

Answer

Deny policies can only be applied at the organization level.

Answer

Allow policies at the folder level are inherited by all projects in that folder and cannot be overridden by project-level allow policies.

Answer

Allow policies are evaluated before deny policies.

Question 8

A security engineer wants to ensure that all Compute Engine VMs in an organization use Shielded VM features. The organization uses Cloud Identity as the identity provider. What is the most efficient way to enforce this requirement?

Accepted Answer

Apply the built-in constraint 'constraints/compute.requireShieldedVm' via the Organization Policy Service.. Organization policies can enforce constraints across all projects. The built-in constraint 'constraints/compute.requireShieldedVm' requires all new VMs to have Shielded VM features enabled. This is more efficient than manual audits, scripts, or custom constraints.

Answer

Configure a Cloud Security Command Center (SCC) policy to scan and alert on non-compliant VMs.

Answer

Use an IAM deny policy to prevent users from creating VMs without Shielded VM.

Answer

Create a custom organization policy using the Organization Policy Service.

Question 9

A development team needs to grant a third-party auditor read-only access to a specific project's resources but must not allow the auditor to view any data stored in Cloud Storage buckets. Which IAM approach should be used?

Accepted Answer

Create a custom role that includes only the required read permissions except those for Cloud Storage.. Custom roles allow you to curate a specific set of permissions. You can create a role that includes read permissions for Compute Engine and Cloud SQL but excludes storage.objects.get on Cloud Storage. Predefined roles like Viewer include storage.objects.get, and basic roles are too broad. Condition-based access can be complex and error-prone.

Answer

Assign the predefined roles/viewer role and add a condition to deny access to Cloud Storage.

Answer

Use a deny policy to block access to storage.objects.get for the auditor.

Answer

Assign the basic roles/reader role to the auditor.

Question 10

An organization uses Google Workspace for email and collaboration. They want to allow employees to sign in to a custom web application using their Google Workspace credentials. The application runs on Compute Engine and uses a PostgreSQL database. Which identity solution should they implement?

Accepted Answer

Cloud Identity-Aware Proxy (IAP) with OIDC.. IAP with OIDC is the correct approach. IAP integrates with Google identity (including Google Workspace) and provides authentication and authorization for web applications. OIDC is the protocol used to verify identity. SAML is for SSO but IAP uses OIDC. Firebase Auth is for consumer apps. Cloud Identity-Aware Proxy (IAP) is specifically designed for this use case.

Answer

Workload Identity Federation.

Answer

SAML 2.0 federation with the web app.

Answer

Firebase Authentication with Google provider.

Question 11

A company runs a batch job on Compute Engine that processes sensitive data. The job uses a service account with a JSON key file stored on the VM. A security audit recommends removing long-lived keys. The job must run unattended. What is the best alternative?

Accepted Answer

Create a new service account and attach it to the VM instance; remove the old key.. Using a service account attached to the VM instance is the best practice. Compute Engine automatically obtains short-lived tokens from the metadata server, eliminating the need for keys. Workload Identity Federation is for external workloads. Secret Manager still requires a key to access. Default compute service account is less secure than a custom one.

Answer

Store the service account key in Secret Manager and retrieve it at runtime.

Answer

Use the default compute engine service account instead.

Answer

Use Workload Identity Federation to authenticate the batch job.

Question 12

A company wants to allow an external auditor to view all IAM policies in a project but not modify them. The auditor's Google account is from a different domain. Which IAM role should be assigned?

Accepted Answer

roles/iam.securityReviewer. The roles/iam.securityReviewer role grants permission to view IAM policies and other security settings without write access. roles/viewer does not include iam.roles.list or iam.policies.get. roles/iam.roleViewer only lists roles, not policies. roles/securityAdmin includes write permissions.

Answer

roles/iam.roleViewer

Answer

roles/viewer

Answer

roles/securityAdmin

Question 13

Which of the following is a key advantage of using Workload Identity Federation over service account keys for authenticating workloads running on AWS?

Accepted Answer

It allows the use of short-lived tokens instead of long-lived keys.. Workload Identity Federation allows workloads to use short-lived tokens from the external identity provider (e.g., AWS STS) to impersonate a Google service account, eliminating the need to manage and rotate long-lived keys. Service account keys are long-lived secrets that can be leaked.

Answer

It eliminates the need to create service accounts.

Answer

It supports MFA for workload authentication.

Answer

It reduces latency compared to using keys.

Question 14

A DevOps engineer needs to create a custom IAM role that allows creating and deleting Compute Engine instances but not stopping or starting them. Which permissions should be included?

Accepted Answer

compute.instances.create and compute.instances.delete. To create and delete instances, the permissions compute.instances.create and compute.instances.delete are required. compute.instances.stop and compute.instances.start are separate permissions for stopping/starting. compute.instances.update is for modifying existing instances.

Answer

compute.instances.start and compute.instances.stop

Answer

compute.instances.create, compute.instances.delete, and compute.instances.update

Answer

compute.instances.create

Question 15

An organization has multiple GCP projects under a folder. They want to prevent all users from creating service account keys in any project under that folder. They also want to allow exceptions for a specific project where key creation is needed. Which approach should they take?

Accepted Answer

Apply the organization policy constraint 'constraints/iam.disableServiceAccountKeyCreation' at the folder level and set an exception for the specific project.. Organization policies can be set at the folder level with an enforce: true condition, and then an exception can be made for a specific project using a conditional policy or by setting a different policy on that project. IAM deny policies cannot disable the API for all users. Custom roles cannot disable key creation globally. Removing roles is impractical.

Answer

Create a custom role that excludes the permission to create keys and assign it to all users.

Answer

Remove the roles/iam.serviceAccountKeyAdmin role from all users.

Answer

Use an IAM deny policy on the folder to deny the permission to create service account keys.