PCSE Configuring Access Within a Cloud Solution Environment Practice Test 5 — 15 Questions

Question 1

A security engineer notices that a service account has been assigned the roles/iam.serviceAccountUser role at the project level. What actions can a user with this role perform?

Accepted Answer

Impersonate the service account to access resources.. The roles/iam.serviceAccountUser role allows a user to impersonate a service account (via gcloud or API) and use its permissions to access resources. It does not allow creating, deleting, or viewing keys of service accounts. This aligns with the requirement that the team should not be able to delete the service, as the role lacks deletion permissions.

Answer

Create new service accounts in the project.

Answer

Delete the service account.

Answer

View the service account's keys.

Question 2

A company has multiple Google Cloud projects under an organization. They want to ensure that only service accounts from their own Cloud Identity domain (example.com) can be used in IAM policies. Which TWO steps should they take? (Choose 2)

Accepted Answer

Remove any IAM policies that include members from other domains.. The organization policy constraint constraints/iam.allowedPolicyMemberDomains restricts member domains in IAM policies. Setting it to ['example.com'] ensures only principals from that domain can be added. Additionally, removing other domains from existing policies is necessary to enforce the constraint.

Answer

Configure VPC Service Controls to restrict access.

Answer

Use Cloud Identity to block external users.

Answer

Create a deny policy that denies the resourcemanager.projects.setIamPolicy permission for non-example.com users.

Question 3

A company wants to implement single sign-on (SSO) for its employees to access the Google Cloud Console using their existing corporate credentials from an on-premises Active Directory. Which THREE components are required? (Choose 3)

Accepted Answer

Cloud Directory Sync to synchronize user and group objects from Active Directory to Google Cloud Directory.. SAML 2.0 federation requires a SAML Identity Provider (AD FS or similar) to authenticate users, Cloud Identity or Google Workspace as the identity platform to configure the SAML trust, and Cloud Directory Sync to synchronize users from AD to Google Cloud Directory so that users exist in Google's directory for IAM binding.

Answer

Workload Identity Federation to map AD users to service accounts.

Answer

A VPN connection between the on-premises network and Google Cloud.

Question 4

An organization has multiple GCP projects managed through folders in the resource hierarchy. They want to enforce a policy that prohibits the creation of service account keys across all projects. Which approach should be used?

Accepted Answer

Apply an organization policy with the constraint 'constraints/iam.disableServiceAccountKeyCreation' at the folder level.. Organization policies can be applied at the folder or organization level to enforce constraints across all projects. The constraint 'constraints/iam.disableServiceAccountKeyCreation' specifically disables service account key creation. Applying it at a folder level is the most efficient way to enforce the policy across all projects in that folder.

Answer

Use a deny policy at the project level to deny the 'iam.serviceAccountKeys.create' permission.

Answer

Configure a script that runs daily to delete any service account keys found in projects.

Answer

Create a custom IAM role that denies the permission to create keys and assign it to all users.

Question 5

A security engineer needs to grant a team the ability to impersonate a service account (SA) in project B from a Compute Engine instance in project A. The SA in project B has the required permissions to access Cloud Storage. What IAM configuration is required?

Accepted Answer

Grant the instance's service account the roles/iam.serviceAccountUser role on the SA in project B, and grant the SA in project B roles/storage.objectViewer.. It combines two necessary steps: first, the instance's service account in project A needs the roles/iam.serviceAccountUser role on the target service account in project B to gain impersonation privileges; second, the target service account in project B must have roles/storage.objectViewer to access Cloud Storage. Without both, the impersonation would either fail (no permission to use the target SA) or the target SA would lack the storage access.

Answer

Grant the instance's service account the roles/iam.serviceAccountTokenCreator role on the SA in project B.

Answer

Create a new service account in project A with the necessary storage permissions and use that.

Answer

Grant the instance's service account the roles/storage.objectViewer role directly.

Question 6

A company uses Active Directory (AD) on-premises and wants to synchronize user accounts to Google Cloud Identity for SSO with SAML 2.0. They require automatic user provisioning and de-provisioning. Which Google Cloud tool should they use?

Accepted Answer

Cloud Directory Sync (CDS). Cloud Directory Sync (CDS) is the tool that synchronizes users from Active Directory or LDAP to Google Cloud Directory. It handles automatic provisioning and de-provisioning based on AD changes. SAML SSO is configured separately, but CDS is for directory sync.

Answer

Cloud Identity Platform

Answer

Google Workspace Admin SDK

Answer

Cloud Identity-Aware Proxy (IAP)

Question 7

A developer is running a batch job on Compute Engine that needs to read data from Cloud Storage. What is the recommended way to authenticate the VM to Cloud Storage without managing keys?

Accepted Answer

Use the Compute Engine default service account and grant it the roles/storage.objectViewer role.. The best practice is to use the Compute Engine default service account and grant it the appropriate Storage roles. This avoids managing keys and uses the VM's identity tied to the service account.

Answer

Create a service account key, download it to the VM, and use it with gcloud auth.

Answer

Add the user's personal credentials to the VM and use them.

Answer

Use Application Default Credentials (ADC) from a service account key stored in Secret Manager.

Question 8

An organization wants to allow an external identity provider (IdP) that supports OpenID Connect (OIDC) to access GCP resources. They want to avoid creating and managing service account keys. What should they use?

Accepted Answer

Configure Workload Identity Federation to allow the external IdP to impersonate a service account.. Workload Identity Federation allows an external identity provider (IdP) that supports OpenID Connect (OIDC) to impersonate a GCP service account without requiring service account keys. This enables the external IdP to obtain short-lived, scoped tokens directly from GCP, eliminating the need to create, store, or rotate long-lived keys.

Answer

Use Cloud Identity Platform to federate the external IdP.

Answer

Create a service account key and share it with the external IdP.

Answer

Use a VPN tunnel to connect the external IdP to GCP and use internal IPs.

Question 9

A Google Kubernetes Engine (GKE) cluster has applications that need to access Cloud Storage. The security team wants to grant fine-grained access per pod. What is the recommended approach?

Accepted Answer

Use Workload Identity: map each Kubernetes service account to a dedicated GCP service account with minimal permissions.. Workload Identity for GKE allows you to bind a Kubernetes service account to a GCP service account. Pods running with that Kubernetes SA can then authenticate as the GCP SA to access GCP resources. This provides pod-level granularity.

Answer

Use node-level service accounts and rely on network policies to restrict pod access.

Answer

Store service account keys as Kubernetes secrets and mount them into pods.

Answer

Create a single GCP service account with Storage permissions, and use it for all pods in the cluster.

Question 10

An organization uses Cloud Identity to manage users and groups. They want to enforce that only users from their corporate domain (example.com) can be granted IAM roles on GCP resources. Which organization policy constraint should they use?

Accepted Answer

constraints/iam.allowedPolicyMemberDomains. The constraint 'constraints/iam.allowedPolicyMemberDomains' restricts which domains can be used in IAM policy bindings. By setting it to allow only 'example.com', any binding that includes a user from another domain will be denied.

Answer

constraints/iam.disableServiceAccountKeyCreation

Answer

constraints/compute.restrictCloudArmorPolicies

Answer

constraints/iam.workloadIdentityPoolProviders

Question 11

What is the purpose of Identity-Aware Proxy (IAP) in Google Cloud?

Accepted Answer

To authenticate users and enforce access policies for applications and VMs based on identity and context.. IAP provides zero-trust access control for web applications and SSH/RDP connections. It verifies user identity and context (device, location) before granting access, without requiring VPNs.

Answer

To manage API keys for services running on Google Cloud.

Answer

To provide network-level firewall rules for HTTP traffic.

Answer

To encrypt data in transit between clients and Google Cloud.

Question 12

An engineer needs to grant a group of external auditors read-only access to all resources in a specific project. The auditors authenticate via an external SAML 2.0 IdP. What is the most secure and efficient way to set this up?

Accepted Answer

Use Cloud Directory Sync to sync the auditors from the external IdP as Google Groups, then grant the group Viewer role.. The correct approach is to create a Google Group and configure SAML SSO for Cloud Identity. Then, grant the Google Group the 'Viewer' role at the project level. The auditors authenticate via SAML and become members of the group, inheriting the permissions.

Answer

Create individual Google accounts for each auditor and assign them the Viewer role.

Answer

Configure IAP with the external IdP and grant access to the project's resources through IAP.

Answer

Create a custom role with read-only permissions and assign it to each auditor individually.

Question 13

A company wants to allow an application running on an on-premises server to access Cloud Storage without using long-lived service account keys. The on-premises environment uses Azure Active Directory (Azure AD) as its identity provider. Which GCP feature should they use?

Accepted Answer

Workload Identity Federation with Azure AD as an identity provider.. Workload Identity Federation supports Azure AD as an external identity provider. The on-premises app can obtain an Azure AD token and exchange it for a GCP service account token, eliminating the need for keys.

Answer

Service Account Key rotation policy.

Answer

Create a custom OAuth 2.0 client ID for the application.

Answer

Use a VPN between on-premises and GCP, and allow the on-premises server to use a metadata server.

Question 14

Which IAM role type is recommended for granting fine-grained permissions to Google Cloud services in production?

Accepted Answer

Predefined roles. Predefined roles are curated by Google and provide granular permissions for specific services. They are designed for production use. Basic roles (Owner/Editor/Viewer) are broad and not recommended. Custom roles can be used if predefined roles are insufficient, but predefined are preferred for simplicity and maintainability.

Answer

Basic roles (Owner, Editor, Viewer)

Answer

Custom roles

Answer

Primitive roles

Question 15

An organization has a folder-level organization policy that enforces 'constraints/compute.requireShieldedVm'. A development team wants to create a test VM that does not use Shielded VM features. What is the correct approach?

Accepted Answer

Override the organization policy at the project level to set the constraint to 'not enforce' for that project.. Organization policies can be overridden at a lower level in the resource hierarchy using policy inheritance rules. The dev team should request an exemption for their project or folder by creating a policy override that sets the constraint to 'not enforce'. This must be done by a user with the appropriate organization policy administrator role.

Answer

Create the VM in a different folder that does not have the policy.

Answer

Use a custom role that bypasses the organization policy.

Answer

Create the VM with Shielded VM disabled; the policy will not apply to test projects.