PCSE Configuring Access Within a Cloud Solution Environment Practice Test 5 — 15 Questions

Question 1

An organization has multiple GCP projects managed through folders in the resource hierarchy. They want to enforce a policy that prohibits the creation of service account keys across all projects. Which approach should be used?

Accepted Answer

Apply an organization policy with the constraint 'constraints/iam.disableServiceAccountKeyCreation' at the folder level.. Organization policies can be applied at the folder or organization level to enforce constraints across all projects. The constraint 'constraints/iam.disableServiceAccountKeyCreation' specifically disables service account key creation. Applying it at a folder level is the most efficient way to enforce the policy across all projects in that folder.

Answer

Use a deny policy at the project level to deny the 'iam.serviceAccountKeys.create' permission.

Answer

Configure a script that runs daily to delete any service account keys found in projects.

Answer

Create a custom IAM role that denies the permission to create keys and assign it to all users.

Question 2

A security engineer needs to grant a team the ability to impersonate a service account (SA) in project B from a Compute Engine instance in project A. The SA in project B has the required permissions to access Cloud Storage. What IAM configuration is required?

Accepted Answer

Grant the instance's service account the roles/iam.serviceAccountUser role on the SA in project B, and grant the SA in project B roles/storage.objectViewer.. Option A is correct because it combines two necessary steps: first, the instance's service account in project A needs the roles/iam.serviceAccountUser role on the target service account in project B to gain impersonation privileges; second, the target service account in project B must have roles/storage.objectViewer to access Cloud Storage. Without both, the impersonation would either fail (no permission to use the target SA) or the target SA would lack the storage access.

Answer

Grant the instance's service account the roles/iam.serviceAccountTokenCreator role on the SA in project B.

Answer

Create a new service account in project A with the necessary storage permissions and use that.

Answer

Grant the instance's service account the roles/storage.objectViewer role directly.

Question 3

A company uses Active Directory (AD) on-premises and wants to synchronize user accounts to Google Cloud Identity for SSO with SAML 2.0. They require automatic user provisioning and de-provisioning. Which Google Cloud tool should they use?

Accepted Answer

Cloud Directory Sync (CDS). Cloud Directory Sync (CDS) is the tool that synchronizes users from Active Directory or LDAP to Google Cloud Directory. It handles automatic provisioning and de-provisioning based on AD changes. SAML SSO is configured separately, but CDS is for directory sync.

Answer

Cloud Identity Platform

Answer

Google Workspace Admin SDK

Answer

Cloud Identity-Aware Proxy (IAP)

Question 4

A developer is running a batch job on Compute Engine that needs to read data from Cloud Storage. What is the recommended way to authenticate the VM to Cloud Storage without managing keys?

Accepted Answer

Use the Compute Engine default service account and grant it the roles/storage.objectViewer role.. The best practice is to use the Compute Engine default service account and grant it the appropriate Storage roles. This avoids managing keys and uses the VM's identity tied to the service account.

Answer

Create a service account key, download it to the VM, and use it with gcloud auth.

Answer

Add the user's personal credentials to the VM and use them.

Answer

Use Application Default Credentials (ADC) from a service account key stored in Secret Manager.

Question 5

An organization wants to allow an external identity provider (IdP) that supports OpenID Connect (OIDC) to access GCP resources. They want to avoid creating and managing service account keys. What should they use?

Accepted Answer

Configure Workload Identity Federation to allow the external IdP to impersonate a service account.. Workload Identity Federation allows an external identity provider (IdP) that supports OpenID Connect (OIDC) to impersonate a GCP service account without requiring service account keys. This enables the external IdP to obtain short-lived, scoped tokens directly from GCP, eliminating the need to create, store, or rotate long-lived keys.

Answer

Use Cloud Identity Platform to federate the external IdP.

Answer

Create a service account key and share it with the external IdP.

Answer

Use a VPN tunnel to connect the external IdP to GCP and use internal IPs.

Question 6

A Google Kubernetes Engine (GKE) cluster has applications that need to access Cloud Storage. The security team wants to grant fine-grained access per pod. What is the recommended approach?

Accepted Answer

Use Workload Identity: map each Kubernetes service account to a dedicated GCP service account with minimal permissions.. Workload Identity for GKE allows you to bind a Kubernetes service account to a GCP service account. Pods running with that Kubernetes SA can then authenticate as the GCP SA to access GCP resources. This provides pod-level granularity.

Answer

Use node-level service accounts and rely on network policies to restrict pod access.

Answer

Store service account keys as Kubernetes secrets and mount them into pods.

Answer

Create a single GCP service account with Storage permissions, and use it for all pods in the cluster.

Question 7

An organization uses Cloud Identity to manage users and groups. They want to enforce that only users from their corporate domain (example.com) can be granted IAM roles on GCP resources. Which organization policy constraint should they use?

Accepted Answer

constraints/iam.allowedPolicyMemberDomains. The constraint 'constraints/iam.allowedPolicyMemberDomains' restricts which domains can be used in IAM policy bindings. By setting it to allow only 'example.com', any binding that includes a user from another domain will be denied.

Answer

constraints/iam.disableServiceAccountKeyCreation

Answer

constraints/compute.restrictCloudArmorPolicies

Answer

constraints/iam.workloadIdentityPoolProviders

Question 8

What is the purpose of Identity-Aware Proxy (IAP) in Google Cloud?

Accepted Answer

To authenticate users and enforce access policies for applications and VMs based on identity and context.. IAP provides zero-trust access control for web applications and SSH/RDP connections. It verifies user identity and context (device, location) before granting access, without requiring VPNs.

Answer

To manage API keys for services running on Google Cloud.

Answer

To provide network-level firewall rules for HTTP traffic.

Answer

To encrypt data in transit between clients and Google Cloud.

Question 9

An engineer needs to grant a group of external auditors read-only access to all resources in a specific project. The auditors authenticate via an external SAML 2.0 IdP. What is the most secure and efficient way to set this up?

Accepted Answer

Use Cloud Directory Sync to sync the auditors from the external IdP as Google Groups, then grant the group Viewer role.. The correct approach is to create a Google Group and configure SAML SSO for Cloud Identity. Then, grant the Google Group the 'Viewer' role at the project level. The auditors authenticate via SAML and become members of the group, inheriting the permissions.

Answer

Create individual Google accounts for each auditor and assign them the Viewer role.

Answer

Configure IAP with the external IdP and grant access to the project's resources through IAP.

Answer

Create a custom role with read-only permissions and assign it to each auditor individually.

Question 10

A company wants to allow an application running on an on-premises server to access Cloud Storage without using long-lived service account keys. The on-premises environment uses Azure Active Directory (Azure AD) as its identity provider. Which GCP feature should they use?

Accepted Answer

Workload Identity Federation with Azure AD as an identity provider.. Workload Identity Federation supports Azure AD as an external identity provider. The on-premises app can obtain an Azure AD token and exchange it for a GCP service account token, eliminating the need for keys.

Answer

Service Account Key rotation policy.

Answer

Create a custom OAuth 2.0 client ID for the application.

Answer

Use a VPN between on-premises and GCP, and allow the on-premises server to use a metadata server.

Question 11

Which IAM role type is recommended for granting fine-grained permissions to Google Cloud services in production?

Accepted Answer

Predefined roles. Predefined roles are curated by Google and provide granular permissions for specific services. They are designed for production use. Basic roles (Owner/Editor/Viewer) are broad and not recommended. Custom roles can be used if predefined roles are insufficient, but predefined are preferred for simplicity and maintainability.

Answer

Basic roles (Owner, Editor, Viewer)

Answer

Custom roles

Answer

Primitive roles

Question 12

An organization has a folder-level organization policy that enforces 'constraints/compute.requireShieldedVm'. A development team wants to create a test VM that does not use Shielded VM features. What is the correct approach?

Accepted Answer

Override the organization policy at the project level to set the constraint to 'not enforce' for that project.. Organization policies can be overridden at a lower level in the resource hierarchy using policy inheritance rules. The dev team should request an exemption for their project or folder by creating a policy override that sets the constraint to 'not enforce'. This must be done by a user with the appropriate organization policy administrator role.

Answer

Create the VM in a different folder that does not have the policy.

Answer

Use a custom role that bypasses the organization policy.

Answer

Create the VM with Shielded VM disabled; the policy will not apply to test projects.

Question 13

A company uses Active Directory (AD) on-premises and wants to implement SSO for Google Cloud Console access. They want to maintain user lifecycle management (create/disable accounts) from AD. Which TWO components are required?

Accepted Answer

Cloud Directory Sync (CDS). Cloud Directory Sync synchronizes users from AD to Google Cloud Directory. SAML SSO with Cloud Identity allows users to sign in using their AD credentials. Both are needed: CDS for provisioning, SAML for authentication.

Answer

Workload Identity Federation

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud VPN

Question 14

A security administrator needs to deploy a solution that allows a group of developers to access a web application running on Compute Engine behind an internal HTTP load balancer. The solution must enforce access based on user identity and device security status, and must not expose the application to the public internet. Which THREE components are required?

Accepted Answer

Access Context Manager (Access Levels). Identity-Aware Proxy (IAP) provides identity and context-aware access. An internal HTTP load balancer keeps the app private. Context-aware access requires an access level (e.g., based on device policy). IAP uses access levels to enforce security.

Answer

Cloud NAT

Answer

Cloud Armor

Question 15

A company wants to enforce that no service account keys are created for service accounts in a specific project. Additionally, they want to allow only users from their corporate domain (example.com) to be granted IAM roles. Which TWO organization policy constraints should they apply at the project level?

Accepted Answer

constraints/iam.allowedPolicyMemberDomains. The constraint 'constraints/iam.disableServiceAccountKeyCreation' prevents key creation. 'constraints/iam.allowedPolicyMemberDomains' restricts IAM members to specified domains. Both can be applied at the project level.

Answer

constraints/iam.workloadIdentityPoolProviders

Answer

constraints/compute.requireShieldedVm

Answer

constraints/compute.restrictCloudArmorPolicies