PCSE Configuring Access Within a Cloud Solution Environment Practice Test 4 — 15 Questions

Question 1

A security engineer needs to configure Identity-Aware Proxy (IAP) for a web application running on Compute Engine. The goal is to ensure that only authenticated users from the corporate domain can access the application. What is the first step in the configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure OAuth 2.0 consent screen and create credentials.. To configure Identity-Aware Proxy (IAP) for a web application on Compute Engine, the first step is to configure the OAuth 2.0 consent screen and create OAuth credentials. This establishes the authentication mechanism that IAP will use to verify user identity. After this, you can enable IAP on the backend service, create access policies, and assign roles. Attempting to enable IAP before setting up OAuth credentials will result in a configuration error.

Answer

Enable IAP on the backend service of the load balancer.

Answer

Create a firewall rule to allow traffic only from IAP IP ranges.

Answer

Grant the IAP-secured Web App User role to the corporate domain users.

Question 2

A security engineer is configuring access for a service account used by a batch job that runs on Compute Engine. The job needs to read from a BigQuery dataset and write results to Cloud Storage. What is the recommended way to grant these permissions?

Accepted Answer

Create a custom role with bigquery.datasets.get, bigquery.tables.get, bigquery.tables.getData, storage.objects.create, storage.objects.get, and storage.objects.list.. Create a custom role with the required BigQuery and Storage permissions, or use predefined roles: BigQuery Data Viewer (roles/bigquery.dataViewer) and Storage Object Admin (roles/storage.objectAdmin) for write access. The best practice is to use the principle of least privilege: grant only the necessary permissions. Predefined roles are acceptable if they match the needs.

Answer

Use the default compute engine service account and grant it BigQuery Admin (roles/bigquery.admin) and Storage Admin (roles/storage.admin).

Answer

Grant the service account the BigQuery Data Owner role (roles/bigquery.dataOwner) and Storage Admin (roles/storage.admin).

Answer

Grant the service account the BigQuery Data Viewer (roles/bigquery.dataViewer) and Storage Object Viewer (roles/storage.objectViewer).

Question 3

An organization wants to enforce that all new projects automatically have a specific set of IAM roles assigned to a security group. What is the best way to achieve this?

Accepted Answer

Assign the IAM roles to the security group at the organization level.. Use organization policies? No, organization policies enforce constraints on resources, not IAM role bindings. You can use a folder-level IAM policy that applies to all projects in the folder. If all projects are under a folder, assign the roles to the folder. Alternatively, use a custom script via Cloud Asset Inventory or Deployment Manager. The simplest is to assign IAM roles at the organization level, which are inherited by all projects. So assign the security group the necessary roles at the organization node.

Answer

Create an organization policy that requires the roles to be assigned.

Answer

Use a Cloud Function triggered by Cloud Asset Inventory to assign the roles when a new project is created.

Answer

Use a service account with the Security Admin role to periodically scan and update new projects.

Question 4

A company is using GKE with Workload Identity to allow pods to access Google Cloud services. A security engineer needs to restrict a specific pod to only read from a single Cloud Storage bucket. Which THREE steps should be taken? (Choose 3 correct answers)

Accepted Answer

Create a Kubernetes service account (KSA) in the pod's namespace.. Workload Identity requires a Kubernetes Service Account (KSA) to be associated with a pod. The KSA is annotated with the email of a Google Cloud Service Account (GCP SA), and the pod uses the KSA to authenticate. This creates a direct identity binding between the pod and the GCP SA, enabling fine-grained access control.

Answer

Grant the GCP SA roles/storage.objectViewer at the project level.

Answer

Create a custom role with storage.objects.get and storage.objects.list, and assign to the GCP SA.

Question 5

A security engineer wants to ensure that no IAM keys are created for service accounts in a Google Cloud organization. Which organization policy constraint should be applied?

Accepted Answer

constraints/iam.disableServiceAccountKeyCreation. The `constraints/iam.disableServiceAccountKeyCreation` organization policy constraint specifically prevents the creation of IAM keys for service accounts, which is exactly what the security engineer needs to enforce. This constraint, when applied at the organization level, blocks all users from creating or uploading service account keys, ensuring that no long-lived credentials are generated for service accounts.

Answer

constraints/compute.restrictCloudArmorPolicies

Answer

constraints/compute.requireShieldedVm

Answer

constraints/iam.allowedPolicyMemberDomains

Question 6

An organization uses Azure Active Directory as its identity provider. They want to allow employees to access Google Cloud resources using their Azure credentials without provisioning Google Cloud user accounts. Which solution should they implement?

Accepted Answer

Use Workforce Identity Federation to allow Azure AD users to authenticate to GCP.. Workforce Identity Federation allows external identity providers (like Azure AD) to authenticate users via SAML 2.0 or OIDC and map them to Google Cloud resources without provisioning Google user accounts. This is the correct solution for employees using Azure AD credentials.

Answer

Set up SAML 2.0 federation between Azure AD and Google Cloud using Cloud Identity.

Answer

Create Google Cloud user accounts for all employees and assign IAM roles directly.

Answer

Configure Cloud Directory Sync to synchronize Azure AD users to Google Cloud Directory.

Question 7

A developer needs to deploy an application on Compute Engine that reads from a Cloud Storage bucket. The engineer wants to avoid managing service account keys. What is the recommended approach to grant the necessary permissions?

Accepted Answer

Create a custom service account, grant it required roles, and attach it to the Compute Engine instance.. Attaching a custom service account directly to a Compute Engine instance is the recommended approach to avoid managing service account keys. This method uses the instance's metadata to provide credentials via the instance metadata server, eliminating the need to download, store, or rotate JSON key files. The custom service account can be granted only the required roles (e.g., Storage Object Viewer) following the principle of least privilege.

Answer

Create a service account, generate a JSON key, and store it on the instance.

Answer

Use the default Compute Engine service account and grant it the Storage Object Viewer role.

Answer

Use Application Default Credentials (ADC) without a service account.

Question 8

A company has a Google Cloud organization with multiple folders representing departments. The security team wants to enforce that all Compute Engine VMs in the organization must have Shielded VM enabled. Which approach should the team use to enforce this requirement?

Accepted Answer

Apply an organization policy with the constraint constraints/compute.requireShieldedVm at the organization level.. Organization policies with constraints can be applied at the organization level and are inherited by all descendants. The constraint constraints/compute.requireShieldedVm enforces Shielded VM on all new VMs. Deny policies are for IAM permissions, not resource configurations. VPC Service Controls is for data exfiltration prevention.

Answer

Use VPC Service Controls to restrict VM creation.

Answer

Create a deny policy that denies the compute.instances.create permission unless Shielded VM is enabled.

Answer

Configure a custom role that includes the permission to create VMs only if Shielded VM is enabled.

Question 9

A DevOps engineer wants to allow a CI/CD pipeline running in GitHub Actions to deploy resources to a Google Cloud project without using long-lived service account keys. What should the engineer implement?

Accepted Answer

Configure Workload Identity Federation between GitHub and the service account.. Workload Identity Federation allows GitHub Actions to exchange OpenID Connect (OIDC) tokens for Google Cloud temporary credentials, eliminating the need for long-lived service account keys. This approach follows Google's security best practices by using short-lived, automatically rotated tokens and avoids the risk of key exposure in repository secrets.

Answer

Use a Cloud Functions HTTP trigger called from GitHub Actions.

Answer

Create a service account and distribute its JSON key to the GitHub repository secrets.

Answer

Enable Cloud Build triggers that watch the GitHub repository.

Question 10

Which IAM role should be assigned to a user who needs to manage Cloud Storage objects in a specific project, but should not be able to create or delete buckets?

Accepted Answer

roles/storage.objectAdmin. The correct role is roles/storage.objectAdmin. This role grants full control over Cloud Storage objects, including the ability to read, write, update, and delete objects, but it does not allow any operations on buckets (create, delete, or configure). The user needs to manage objects (which includes write and delete operations) but should not be able to create or delete buckets. Storage Object Admin fits this requirement. Option C, roles/storage.objectViewer, only provides read-only access and does not allow management. Option B, roles/storage.admin, provides full control over both buckets and objects, including create and delete permissions. Option A, roles/storage.legacyBucketReader, only allows reading bucket metadata, not objects.

Answer

roles/storage.legacyBucketReader

Answer

roles/storage.admin

Answer

roles/storage.objectViewer

Question 11

An organization uses Cloud Identity with Google Workspace. They want to grant a group of external auditors read-only access to a specific folder in Google Cloud. The auditors have accounts in the organization's Cloud Identity domain. What is the most efficient way to grant this access?

Accepted Answer

Create a Google Group, add auditors to it, and grant the group the Viewer role at the folder level.. The best practice is to create a Google Group (which is a Cloud Identity group) containing the auditors, then grant the group the desired IAM role (e.g., Viewer) at the folder level. This simplifies management.

Answer

Create a custom role and assign it to each auditor.

Answer

Use Cloud Directory Sync to sync auditors from an external identity provider.

Answer

Grant each auditor the Viewer role individually at the folder level.

Question 12

A company has a Kubernetes cluster on GKE that runs a microservice. The microservice needs to read from a Cloud Spanner database. The security team requires that the microservice uses the principle of least privilege and that credentials are never stored as Kubernetes secrets. What is the recommended configuration?

Accepted Answer

Enable Workload Identity, create a Kubernetes service account, and annotate it to map to a Google Cloud service account with the necessary roles.. Using Workload Identity, you bind a Kubernetes service account to a Google Cloud service account that has the necessary Spanner roles. The GKE node's metadata server provides the credentials, and the application uses the Kubernetes service account identity.

Answer

Use the Compute Engine default service account for the node pool.

Answer

Create a Kubernetes secret containing a service account key and mount it into the pod.

Answer

Assign the required IAM roles to the GKE node's default service account and use it from the pod.

Question 13

A company wants to allow users to access an internal web application running on Compute Engine behind a load balancer without requiring a VPN. The solution must authenticate users and enforce access based on user identity and context (e.g., device security). Which Google Cloud service should they use?

Accepted Answer

Identity-Aware Proxy (IAP). Identity-Aware Proxy (IAP) provides zero-trust access control for web applications, authenticating users and enforcing context-aware access policies without requiring VPN. IAP sits in front of the load balancer and verifies identity and context before allowing access.

Answer

Cloud NAT

Answer

Cloud Armor

Answer

VPC Service Controls

Question 14

A project manager needs to create custom IAM roles for a project. At which levels in the resource hierarchy can custom roles be defined?

Accepted Answer

Organization and project levels only. Custom roles can be defined at the organization level or the project level. They cannot be defined at the folder level. Organization-level roles can be used across all folders and projects under that organization.

Answer

All levels: organization, folder, project

Answer

Organization and folder levels only

Answer

Project level only

Question 15

A company has an organization policy that denies the use of certain GCP services unless the project is in a specific folder. The DevOps team wants to create a new project in that folder. However, the project creation fails. What is the most likely cause?

Accepted Answer

The user does not have the resourcemanager.projects.create permission at the folder level.. The most likely cause is that the user lacks the `resourcemanager.projects.create` permission at the folder level. Even if the project is being created in a folder that allows GCP services, the user must have the Project Creator role (or equivalent) granted on that specific folder. Without this permission, the creation request is denied by the Resource Manager, regardless of the folder's capacity or the project name's uniqueness.

Answer

The folder has reached its maximum number of projects.

Answer

The project name is already taken.

Answer

The organization policy prevents any project creation in the organization.