PCSE Configuring Access Within a Cloud Solution Environment Practice Test 3 — 15 Questions

Question 1

Which of the following is true about IAM deny policies?

Accepted Answer

Deny policies take precedence over allow policies.. Deny policies override allow policies. They are evaluated after allow policies, and if a deny matches, the access is denied regardless of allowed roles. They apply to the resource hierarchy as well. Deny policies can be set at the organization, folder, project, or resource level.

Answer

Deny policies can only be applied at the organization level.

Answer

Deny policies are evaluated before allow policies.

Answer

Deny policies can grant permissions.

Question 2

A company uses Cloud Identity to manage users and groups. They want to synchronize users from their on-premises Active Directory to Cloud Identity. Which tool should they use?

Accepted Answer

Google Cloud Directory Sync (GCDS). Google Cloud Directory Sync (GCDS) is the official tool for synchronizing users and groups from Active Directory or LDAP to Cloud Identity. Cloud Identity SDK is not a sync tool. Deployment Manager is for infrastructure. IAM is for access control.

Answer

Identity and Access Management (IAM)

Answer

Cloud Deployment Manager

Answer

Cloud Identity SDK

Question 3

A GKE cluster runs workloads that need to access Cloud Storage. The security team wants to avoid using service account keys and ensure each pod has a unique identity. What is the best practice?

Accepted Answer

Use Workload Identity: create a Kubernetes service account and bind it to a Google service account.. Workload Identity for GKE binds a Kubernetes service account to a Google service account. Pods that use the KSA automatically authenticate as the GSA without keys. This provides fine-grained pod-level identity. Attaching the GSA to the node is coarse-grained. Using the default compute SA is insecure. Creating keys defeats the purpose.

Answer

Create a service account key and mount it as a secret in each pod.

Answer

Use the default compute engine service account for the cluster.

Answer

Attach a Google service account to the GKE node pool.

Question 4

An organization wants to allow users to access a web application running on Compute Engine via HTTPS. The application requires users to authenticate with their corporate credentials (SAML 2.0 IdP). Which Google Cloud service should be used?

Accepted Answer

Identity-Aware Proxy (IAP) with HTTPS. Identity-Aware Proxy (IAP) with HTTPS provides authentication and authorization for web applications. It integrates with external SAML IdPs through Cloud Identity or G Suite. Cloud Load Balancing with SSL does not authenticate. Cloud Armor is for security policies. Cloud NAT is for outbound traffic.

Answer

Cloud NAT

Answer

Cloud Armor

Answer

Cloud Load Balancing with SSL certificates

Question 5

A company wants to enforce that only users from a specific domain (example.com) can be granted IAM roles on any resource in their organization. Which two steps are required? (Choose two.)

Accepted Answer

Configure Cloud Identity or Google Workspace to manage the example.com domain.. Enforcing allowed member domains requires setting the organization policy constraint 'constraints/iam.allowedPolicyMemberDomains' to include example.com. Additionally, configuring Cloud Identity or Google Workspace with the domain is necessary for the constraint to work. IAM deny policies are not used. Custom roles are not required. Cloud Directory Sync is for syncing users, not enforcement.

Answer

Create custom roles that only allow users from example.com.

Answer

Create an IAM deny policy to deny access to users from other domains.

Answer

Use Cloud Directory Sync to sync only example.com users.

Question 6

A security engineer needs to ensure that all Compute Engine instances in an organization are created with specific CMEK (Customer-Managed Encryption Key) for disk encryption. The engineer wants to enforce this at the organization level. Which three actions are required? (Choose three.)

Accepted Answer

Create a Cloud KMS key ring and encryption key.. To enforce CMEK use, you need to create a custom organization policy constraint that requires the CMEK key resource name. Enabling CMEK via CSEK is different. The constraint must be applied at the organization level. The key must be created in Cloud KMS. The compute engine API must be enabled for policy enforcement.

Answer

Enable Customer-Supplied Encryption Keys (CSEK) for all instances.

Answer

Ensure the Compute Engine API is disabled for all projects.

Question 7

A developer wants to allow a CI/CD pipeline running on GitHub Actions to deploy resources to a GCP project without using service account keys. Which two components are needed? (Choose two.)

Accepted Answer

A Workload Identity Pool and Provider configured for GitHub.. Workload Identity Federation allows GitHub Actions to exchange GitHub OIDC tokens for GCP service account impersonation. You need to set up a workload identity pool and provider for GitHub. The GitHub Actions workflow must be configured to use the OIDC token and request impersonation of a service account.

Answer

A Cloud Build trigger to run the workflow.

Answer

A Cloud KMS key to encrypt the workflow.

Answer

A service account JSON key stored as a GitHub secret.

Question 8

A security engineer is configuring access for a new team member who needs to manage Cloud Storage buckets, but should not be able to delete or modify existing objects. Which IAM role should be assigned?

Accepted Answer

Storage Legacy Bucket Writer (roles/storage.legacyBucketWriter). The Storage Legacy Bucket Writer role (roles/storage.legacyBucketWriter) allows a user to list, create, and update buckets, but it does not grant permissions to delete or modify existing objects within those buckets. This role is specifically designed for managing bucket-level metadata while restricting object-level write and delete operations, making it the correct choice for the described requirement.

Answer

Storage Object Viewer (roles/storage.objectViewer)

Answer

Storage Admin (roles/storage.admin)

Answer

Storage Object Admin (roles/storage.objectAdmin)

Question 9

An organization uses Cloud Identity with a third-party IdP via SAML 2.0. A security engineer needs to enforce that all Google Cloud access requires multi-factor authentication (MFA) from the IdP. What is the recommended approach?

Accepted Answer

Require MFA in the third-party IdP before it issues SAML assertions.. The best practice is to configure MFA at the IdP level because the IdP is the authoritative source for authentication. This ensures MFA is enforced before SAML assertion is issued, and it works for all applications relying on that IdP, including Google Cloud. Enforcing MFA on Google Cloud side via IAP or context-aware access is possible but not the recommended primary enforcement for SAML federated users; it should be done at the IdP.

Answer

Create an organization policy constraint requiring the use of security keys for all users.

Answer

Enable MFA enforcement in the Cloud Identity admin console for all users.

Answer

Configure a context-aware access level in Access Context Manager that requires MFA, and apply it to Google Cloud resources.

Question 10

A company has multiple projects under an organization node. A security engineer needs to deny all principals in the organization from creating service account keys, except for a specific project where it must be allowed. Which approach should be used?

Accepted Answer

Create an IAM deny policy at the organization level denying the permission, and create another IAM deny policy at the project level that allows the permission by omitting the deny rule for that project's service accounts.. The correct approach is to use IAM deny policies (v2). Create an organization-level deny policy that denies iam.serviceAccountKeys.create to all principals. Then, create a project-level deny policy that denies the same permission but includes an exception (via exceptionPrincipals) for the project's service accounts. Because deny policies are evaluated hierarchically, the project-level policy with exceptions allows the permission for those specific principals while the organization-level policy denies it for everyone else. This is necessary because the boolean organization policy constraint constraints/iam.disableServiceAccountKeyCreation cannot be overridden or have exceptions. Option C is correct.

Answer

Use a custom organization policy constraint to allow key creation only in the specific project, and deny in all others.

Answer

Create an IAM deny policy at the organization level denying iam.serviceAccountKeys.create, and then create an IAM allow policy at the project level granting the same permission.

Answer

Apply the constraint constraints/iam.disableServiceAccountKeyCreation at the organization level with value True, and then set it to False at the project level.

Question 11

A developer wants to run a containerized application on GKE that needs to read from a Cloud Storage bucket. The developer needs to securely provide credentials. What is the recommended approach?

Accepted Answer

Create a Google service account with necessary permissions, create a Kubernetes service account, and configure Workload Identity to bind them.. The recommended approach is to use Workload Identity to bind a Kubernetes service account to a Google service account. This avoids managing keys and allows fine-grained access. The developer should create a GCP service account with the Storage Object Viewer role, then create a Kubernetes service account, and bind them using Workload Identity. The pod should use the Kubernetes service account.

Answer

Use the default compute engine service account for the GKE nodes.

Answer

Store the service account key in Cloud Secret Manager and retrieve it in the pod at startup.

Answer

Create a service account key, store it as a Kubernetes secret, and mount it in the pod.

Question 12

An organization needs to grant a contractor access to a specific project for 30 days, with the ability to start and stop Compute Engine instances but not delete them. Which IAM role should be used?

Accepted Answer

Compute Instance Admin (v1) (roles/compute.instanceAdmin.v1). The Compute Instance Admin (v1) role (roles/compute.instanceAdmin.v1) allows starting, stopping, and modifying instances, but not deleting them. It is suitable for this scenario. Compute Admin (roles/compute.admin) allows full control including deletion. Compute Viewer (roles/compute.viewer) is read-only. Compute Instance Operator (beta) might exist but not standard.

Answer

Compute Viewer (roles/compute.viewer)

Answer

Compute OS Login (roles/compute.osLogin)

Answer

Compute Admin (roles/compute.admin)

Question 13

A company uses SAML 2.0 federation with an external IdP. Users are synced from Active Directory to Cloud Identity using Google Cloud Directory Sync (GCDS). The security engineer needs to ensure that only users from a specific Active Directory group can access Google Cloud resources. What should be configured?

Accepted Answer

Create a Cloud Identity group that is synced with the AD group via GCDS, and assign IAM roles to that group.. The correct approach is to configure the IdP to only send SAML assertions for users in that specific AD group, and then in Cloud Identity, map that group to a Cloud Identity group or use attribute-based access. Alternatively, use organization policies with constraints/iam.allowedPolicyMemberDomains to restrict members to specific domains. But the question is about user access, not policy binding. The best answer is to create a Cloud Identity group that syncs with the AD group, and grant IAM roles to that group. This ensures only members of the AD group get access.

Answer

Configure the SAML IdP to include a custom attribute indicating group membership, and use attribute-based access control in Google Cloud.

Answer

Use IAP to restrict access based on user identity.

Answer

Configure an organization policy constraint (constraints/iam.allowedPolicyMemberDomains) to restrict IAM policies to the company's domain.

Question 14

An application running on Compute Engine needs to authenticate to Google Cloud APIs. The security engineer wants to avoid managing keys. What is the recommended method?

Accepted Answer

Attach a service account to the VM instance and use the metadata server to obtain tokens.. Use the default compute engine service account or a custom service account attached to the VM instance. The VM automatically obtains tokens via the metadata server, no keys required. This is the recommended approach for workloads on Compute Engine.

Answer

Store the service account key in Cloud Secret Manager and retrieve it at boot.

Answer

Create a service account key and store it in the instance's local disk.

Answer

Use workload identity federation to exchange a JWT from the application.

Question 15

A company needs to allow developers to create and manage custom IAM roles at the project level, but restrict the permissions that can be added to those roles to a predefined list. What should be used?

Accepted Answer

Use a custom organization policy constraint to define the allowed permissions for custom roles.. Custom roles can be defined at the organization or project level. To restrict the permissions that can be included, use an organization policy with a custom constraint that specifies allowed permissions for custom roles. Roles Administrator (roles/iam.roleAdmin) allows managing all roles. Organization policy constraints like constraints/iam.allowedPolicyMemberDomains restrict member domains, not permissions. The correct approach is to create a custom organization policy constraint that limits the permissions that can be added to a custom role.

Answer

Grant the developers the IAM Role Administrator role (roles/iam.roleAdmin) and rely on training to only use allowed permissions.

Answer

Grant the developers the Project IAM Admin role (roles/resourcemanager.projectIamAdmin) and restrict roles via a deny policy.

Answer

Use the constraint constraints/iam.allowedPolicyMemberDomains to restrict the domains of members who can be assigned roles.