PCSE Configuring Access Within a Cloud Solution Environment Practice Test 3 — 15 Questions

Question 1

A security engineer is configuring access for a new team member who needs to manage Cloud Storage buckets, but should not be able to delete or modify existing objects. Which IAM role should be assigned?

Accepted Answer

Storage Legacy Bucket Writer (roles/storage.legacyBucketWriter). The Storage Legacy Bucket Writer role (roles/storage.legacyBucketWriter) allows a user to list, create, and update buckets, but it does not grant permissions to delete or modify existing objects within those buckets. This role is specifically designed for managing bucket-level metadata while restricting object-level write and delete operations, making it the correct choice for the described requirement.

Answer

Storage Object Viewer (roles/storage.objectViewer)

Answer

Storage Admin (roles/storage.admin)

Answer

Storage Object Admin (roles/storage.objectAdmin)

Question 2

An organization uses Cloud Identity with a third-party IdP via SAML 2.0. A security engineer needs to enforce that all Google Cloud access requires multi-factor authentication (MFA) from the IdP. What is the recommended approach?

Accepted Answer

Require MFA in the third-party IdP before it issues SAML assertions.. The best practice is to configure MFA at the IdP level because the IdP is the authoritative source for authentication. This ensures MFA is enforced before SAML assertion is issued, and it works for all applications relying on that IdP, including Google Cloud. Enforcing MFA on Google Cloud side via IAP or context-aware access is possible but not the recommended primary enforcement for SAML federated users; it should be done at the IdP.

Answer

Create an organization policy constraint requiring the use of security keys for all users.

Answer

Enable MFA enforcement in the Cloud Identity admin console for all users.

Answer

Configure a context-aware access level in Access Context Manager that requires MFA, and apply it to Google Cloud resources.

Question 3

A company has multiple projects under an organization node. A security engineer needs to deny all principals in the organization from creating service account keys, except for a specific project where it must be allowed. Which approach should be used?

Accepted Answer

Create an IAM deny policy at the organization level denying the permission, and create another IAM deny policy at the project level that allows the permission by omitting the deny rule for that project's service accounts.. Use an organization-level deny policy with the constraint constraints/iam.disableServiceAccountKeyCreation set to deny, and then a project-level allow policy override. However, deny policies override allow policies by default. To allow in a specific project, you can use a project-level deny policy that allows (i.e., not deny) or use an organization policy with an exception using the 'grantedValues' or 'allowedValues'? Actually, the constraint is a boolean constraint; you cannot have exceptions. The correct approach is to use a deny policy at the organization level that denies the iam.serviceAccountKeys.create permission, and then create a deny policy at the project level that allows that permission (i.e., not deny). But deny policies are evaluated together; the most specific policy wins? Actually, deny policies are hierarchical and deny is deny; you cannot allow via deny. The proper way is to use an organization policy (constraint) that disables key creation, and then use a policy exception at the folder or project level using the 'allowedValues' or 'deniedValues'? For boolean constraints, you cannot set exceptions; you have to use a different constraint. The correct answer is to use an organization policy with constraints/iam.disableServiceAccountKeyCreation set to 'True' at the org, and then create a custom constraint at the project level that allows? No, custom constraints don't override boolean constraints. The recommended approach is to use a deny policy (v2) at the organization level that denies the permission, and then create a deny policy at the project level that allows the permission by not denying it. But deny policies are hierarchical; the most specific (project-level) deny policy can allow if it doesn't include the deny rule? Actually, deny policies can include 'denial_condition' and 'exception_principals'. You can set an exception for the specific project's service accounts. The correct answer: Use an organization policy with constraints/iam.disableServiceAccountKeyCreation = True, then create a project-level policy that overrides it? But boolean constraints don't support override. The correct approach is to use a deny policy with an exception for the project. So I'll go with option D.

Answer

Use a custom organization policy constraint to allow key creation only in the specific project, and deny in all others.

Answer

Create an IAM deny policy at the organization level denying iam.serviceAccountKeys.create, and then create an IAM allow policy at the project level granting the same permission.

Answer

Apply the constraint constraints/iam.disableServiceAccountKeyCreation at the organization level with value True, and then set it to False at the project level.

Question 4

A developer wants to run a containerized application on GKE that needs to read from a Cloud Storage bucket. The developer needs to securely provide credentials. What is the recommended approach?

Accepted Answer

Create a Google service account with necessary permissions, create a Kubernetes service account, and configure Workload Identity to bind them.. The recommended approach is to use Workload Identity to bind a Kubernetes service account to a Google service account. This avoids managing keys and allows fine-grained access. The developer should create a GCP service account with the Storage Object Viewer role, then create a Kubernetes service account, and bind them using Workload Identity. The pod should use the Kubernetes service account.

Answer

Use the default compute engine service account for the GKE nodes.

Answer

Store the service account key in Cloud Secret Manager and retrieve it in the pod at startup.

Answer

Create a service account key, store it as a Kubernetes secret, and mount it in the pod.

Question 5

An organization needs to grant a contractor access to a specific project for 30 days, with the ability to start and stop Compute Engine instances but not delete them. Which IAM role should be used?

Accepted Answer

Compute Instance Admin (v1) (roles/compute.instanceAdmin.v1). The Compute Instance Admin (v1) role (roles/compute.instanceAdmin.v1) allows starting, stopping, and modifying instances, but not deleting them. It is suitable for this scenario. Compute Admin (roles/compute.admin) allows full control including deletion. Compute Viewer (roles/compute.viewer) is read-only. Compute Instance Operator (beta) might exist but not standard.

Answer

Compute Viewer (roles/compute.viewer)

Answer

Compute OS Login (roles/compute.osLogin)

Answer

Compute Admin (roles/compute.admin)

Question 6

A company uses SAML 2.0 federation with an external IdP. Users are synced from Active Directory to Cloud Identity using Google Cloud Directory Sync (GCDS). The security engineer needs to ensure that only users from a specific Active Directory group can access Google Cloud resources. What should be configured?

Accepted Answer

Create a Cloud Identity group that is synced with the AD group via GCDS, and assign IAM roles to that group.. The correct approach is to configure the IdP to only send SAML assertions for users in that specific AD group, and then in Cloud Identity, map that group to a Cloud Identity group or use attribute-based access. Alternatively, use organization policies with constraints/iam.allowedPolicyMemberDomains to restrict members to specific domains. But the question is about user access, not policy binding. The best answer is to create a Cloud Identity group that syncs with the AD group, and grant IAM roles to that group. This ensures only members of the AD group get access.

Answer

Configure the SAML IdP to include a custom attribute indicating group membership, and use attribute-based access control in Google Cloud.

Answer

Use IAP to restrict access based on user identity.

Answer

Configure an organization policy constraint (constraints/iam.allowedPolicyMemberDomains) to restrict IAM policies to the company's domain.

Question 7

A security engineer needs to grant a DevOps team the ability to deploy and manage Cloud Run services, but they should not be able to modify IAM policies or delete the service. Which predefined role should be assigned?

Accepted Answer

Cloud Run Developer (roles/run.developer). Cloud Run Developer (roles/run.developer) allows creating, updating, and deleting Cloud Run services, but not modifying IAM policies. Cloud Run Admin (roles/run.admin) allows full control including IAM. Cloud Run Viewer (roles/run.viewer) is read-only. Cloud Run Invoker (roles/run.invoker) only allows invoking services.

Answer

Cloud Run Invoker (roles/run.invoker)

Answer

Cloud Run Admin (roles/run.admin)

Answer

Cloud Run Viewer (roles/run.viewer)

Question 8

An application running on Compute Engine needs to authenticate to Google Cloud APIs. The security engineer wants to avoid managing keys. What is the recommended method?

Accepted Answer

Attach a service account to the VM instance and use the metadata server to obtain tokens.. Use the default compute engine service account or a custom service account attached to the VM instance. The VM automatically obtains tokens via the metadata server, no keys required. This is the recommended approach for workloads on Compute Engine.

Answer

Store the service account key in Cloud Secret Manager and retrieve it at boot.

Answer

Create a service account key and store it in the instance's local disk.

Answer

Use workload identity federation to exchange a JWT from the application.

Question 9

A company needs to allow developers to create and manage custom IAM roles at the project level, but restrict the permissions that can be added to those roles to a predefined list. What should be used?

Accepted Answer

Use a custom organization policy constraint to define the allowed permissions for custom roles.. Custom roles can be defined at the organization or project level. To restrict the permissions that can be included, use an organization policy with a custom constraint that specifies allowed permissions for custom roles. Roles Administrator (roles/iam.roleAdmin) allows managing all roles. Organization policy constraints like constraints/iam.allowedPolicyMemberDomains restrict member domains, not permissions. The correct approach is to create a custom organization policy constraint that limits the permissions that can be added to a custom role.

Answer

Grant the developers the IAM Role Administrator role (roles/iam.roleAdmin) and rely on training to only use allowed permissions.

Answer

Grant the developers the Project IAM Admin role (roles/resourcemanager.projectIamAdmin) and restrict roles via a deny policy.

Answer

Use the constraint constraints/iam.allowedPolicyMemberDomains to restrict the domains of members who can be assigned roles.

Question 10

A security engineer needs to configure Identity-Aware Proxy (IAP) for a web application running on Compute Engine. The goal is to ensure that only authenticated users from the corporate domain can access the application. What is the first step in the configuration?

Accepted Answer

Enable IAP on the backend service of the load balancer.. The first step is to enable IAP on the backend service or resource. Then configure OAuth consent screen, create an IAP access policy, and assign IAP-secured Web App User role to users. The correct order is to enable IAP first.

Answer

Configure OAuth 2.0 consent screen and create credentials.

Answer

Create a firewall rule to allow traffic only from IAP IP ranges.

Answer

Grant the IAP-secured Web App User role to the corporate domain users.

Question 11

A security engineer is configuring access for a service account used by a batch job that runs on Compute Engine. The job needs to read from a BigQuery dataset and write results to Cloud Storage. What is the recommended way to grant these permissions?

Accepted Answer

Create a custom role with bigquery.datasets.get, bigquery.tables.get, bigquery.tables.getData, storage.objects.create, storage.objects.get, and storage.objects.list.. Create a custom role with the required BigQuery and Storage permissions, or use predefined roles: BigQuery Data Viewer (roles/bigquery.dataViewer) and Storage Object Admin (roles/storage.objectAdmin) for write access. The best practice is to use the principle of least privilege: grant only the necessary permissions. Predefined roles are acceptable if they match the needs.

Answer

Use the default compute engine service account and grant it BigQuery Admin (roles/bigquery.admin) and Storage Admin (roles/storage.admin).

Answer

Grant the service account the BigQuery Data Owner role (roles/bigquery.dataOwner) and Storage Admin (roles/storage.admin).

Answer

Grant the service account the BigQuery Data Viewer (roles/bigquery.dataViewer) and Storage Object Viewer (roles/storage.objectViewer).

Question 12

An organization wants to enforce that all new projects automatically have a specific set of IAM roles assigned to a security group. What is the best way to achieve this?

Accepted Answer

Assign the IAM roles to the security group at the organization level.. Use organization policies? No, organization policies enforce constraints on resources, not IAM role bindings. You can use a folder-level IAM policy that applies to all projects in the folder. If all projects are under a folder, assign the roles to the folder. Alternatively, use a custom script via Cloud Asset Inventory or Deployment Manager. The simplest is to assign IAM roles at the organization level, which are inherited by all projects. So assign the security group the necessary roles at the organization node.

Answer

Create an organization policy that requires the roles to be assigned.

Answer

Use a Cloud Function triggered by Cloud Asset Inventory to assign the roles when a new project is created.

Answer

Use a service account with the Security Admin role to periodically scan and update new projects.

Question 13

A security engineer is designing access control for a multi-project environment. The engineer needs to ensure that a data science team can read data from a BigQuery dataset in Project A and write results to a Cloud Storage bucket in Project B. The team members are authenticated via an external SAML IdP. Which TWO steps should be taken? (Choose 2 correct answers)

Accepted Answer

Grant the Cloud Identity group BigQuery Data Viewer on the specific dataset and Storage Object Creator on the specific bucket.. Option A: Create a Cloud Identity group for the data science team, sync it with the SAML IdP, and grant the group appropriate IAM roles. This ensures users from the IdP are mapped to a group that can be used in IAM. Option D: Grant the Cloud Identity group BigQuery Data Viewer on the dataset in Project A and Storage Object Creator on the bucket in Project B. This provides the required read and write access. Option B (granting at project level) might be too broad. Option C (separate service accounts) is more complex and not necessary. Option E (cross-project service account) is not required.

Answer

Create a custom role with bigquery.tables.getData and storage.objects.create, and assign to the group at the organization level.

Answer

Create a service account for the team and set up workload identity federation with the SAML IdP.

Answer

Grant the group the BigQuery Data Viewer role at the project A level and Storage Object Admin at the project B level.

Question 14

A company is using GKE with Workload Identity to allow pods to access Google Cloud services. A security engineer needs to restrict a specific pod to only read from a single Cloud Storage bucket. Which THREE steps should be taken? (Choose 3 correct answers)

Accepted Answer

Create a Kubernetes service account (KSA) in the pod's namespace.. Option A is correct because Workload Identity requires a Kubernetes Service Account (KSA) to be associated with a pod. The KSA is annotated with the email of a Google Cloud Service Account (GCP SA), and the pod uses the KSA to authenticate. This creates a direct identity binding between the pod and the GCP SA, enabling fine-grained access control.

Answer

Grant the GCP SA roles/storage.objectViewer at the project level.

Answer

Create a custom role with storage.objects.get and storage.objects.list, and assign to the GCP SA.

Question 15

A security engineer needs to ensure that no one in the organization can disable or delete Cloud Key Management Service (Cloud KMS) keys, except for a designated security team. Which TWO approaches should be combined? (Choose 2 correct answers)

Accepted Answer

Grant the security team the Cloud KMS Admin role (roles/cloudkms.admin) at the organization level.. Option B is correct because the Cloud KMS Admin role (roles/cloudkms.admin) includes the permissions needed to manage key lifecycle, such as disabling and destroying keys. Granting this role at the organization level ensures the security team can control keys across all projects, while the IAM deny policy in option C blocks all other principals from performing those actions, creating a secure, layered access control approach.

Answer

Apply the organization policy constraint constraints/cloudkms.disableKeyDeletion with value True.

Answer

Store the key material in a separate project with a private key access control.

Answer

Create an IAM allow policy at the organization level that grants the same permissions only to the security team.