PCSE Configuring Access Within a Cloud Solution Environment Practice Test 6 — 15 Questions

Question 1

An organization wants to grant a team of data analysts the ability to run BigQuery queries and create datasets, but prevent them from deleting datasets or modifying IAM policies. Which predefined IAM role should be assigned?

Accepted Answer

roles/bigquery.dataEditor. The BigQuery Data Editor role (roles/bigquery.dataEditor) allows creating datasets and running queries, but does not allow deleting datasets or modifying permissions. The Viewer role is read-only, Owner allows deletion and IAM changes, and Job User only allows running jobs without dataset creation.

Answer

roles/bigquery.dataOwner

Answer

roles/bigquery.dataViewer

Answer

roles/bigquery.jobUser

Question 2

A company has multiple GCP projects managed under a single organization node. They want to enforce that all Compute Engine VMs are created with Shielded VM features enabled. Which approach should they use?

Accepted Answer

Use the organization policy service with the constraint constraints/compute.requireShieldedVm at the organization level.. Organization policies can enforce constraints across projects. The constraint constraints/compute.requireShieldedVm can be applied at the organization, folder, or project level to require Shielded VM on all new VMs. IAM roles don't enforce configuration, and gcloud commands are manual. Deny policies are for permission denial, not resource configuration.

Answer

Run a gcloud command after each VM creation to enable Shielded VM.

Answer

Apply a deny policy that denies the compute.instances.create permission if Shielded VM is not enabled.

Answer

Create a custom IAM role that includes compute.instances.create permission and assign it to all users.

Question 3

A security team needs to allow a third-party application running on AWS to access a Cloud Storage bucket without using service account keys. The application already uses AWS IAM roles. Which Google Cloud feature should they use?

Accepted Answer

Workload Identity Federation. Workload Identity Federation allows the AWS application to exchange its AWS IAM role credentials for Google Cloud temporary security tokens, enabling access to Cloud Storage without managing or storing service account keys. This is the correct approach because it directly addresses the requirement to avoid service account keys while leveraging the existing AWS IAM identity.

Answer

Secret Manager with a service account key

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud VPN

Question 4

A developer is troubleshooting a Cloud Run service that needs to read from a Cloud Storage bucket. The service runs as the compute engine default service account. The service account has been granted the Storage Object Viewer role at the project level, but the service still gets permission denied errors. What is the most likely cause?

Accepted Answer

The Cloud Run service is using a different service account than the one modified.. Cloud Run uses the runtime service account specified in the revision, not the compute engine default SA. The developer must explicitly set the service account when deploying, and grant it appropriate roles. The compute engine default SA is for Compute Engine VMs, not Cloud Run.

Answer

The bucket uses uniform bucket-level access, which overrides IAM.

Answer

The service account was not granted access to the specific bucket.

Answer

The Cloud Run service requires the Storage Admin role.

Question 5

An organization wants to allow users to authenticate to Google Cloud using their existing Active Directory credentials via SAML 2.0. Which Google Cloud identity service should they configure?

Accepted Answer

Cloud Identity. Cloud Identity or Google Workspace can be configured as a SAML 2.0 service provider (or identity provider) to federate with an external IdP like Active Directory. For SAML 2.0 SSO, Cloud Identity supports integration with external IdPs. Cloud Directory Sync syncs users but doesn't handle SSO. IAP is for access control, not identity federation.

Answer

Workload Identity Federation

Answer

Identity-Aware Proxy

Answer

Cloud Directory Sync

Question 6

A company has a security policy that service account keys should not be created. They want to prevent anyone from creating keys for any service account in the organization. Which organization policy constraint should they use?

Accepted Answer

constraints/iam.disableServiceAccountKeyCreation. Option D is correct because the `constraints/iam.disableServiceAccountKeyCreation` organization policy constraint explicitly prevents the creation of user-managed service account keys across the entire organization. This aligns with the security policy that service account keys should not be created, as it enforces the use of short-lived credentials or workload identity federation instead of long-lived keys.

Answer

Custom constraint with iam.serviceAccountKeys.create

Answer

constraints/iam.allowedPolicyMemberDomains

Answer

constraints/compute.requireShieldedVm

Question 7

A GKE cluster has Workload Identity enabled. A Kubernetes service account is bound to a GCP service account named 'sa-gcs'. A pod using the Kubernetes service account fails to list objects in a Cloud Storage bucket. The GCP service account has the Storage Object Viewer role. What is the most likely cause?

Accepted Answer

The Kubernetes service account does not have the iam.workloadIdentityUser role on the GCP service account.. The pod must use the Kubernetes service account, but the GCP service account may not have the required permission (storage.objects.list). However, with Workload Identity, the pod authenticates as the GCP SA. The issue could be that the GCP SA does not have the role on the specific bucket, or the binding is misconfigured. But the most common cause is missing the iam.workloadIdentityUser role on the GCP SA for the Kubernetes service account to impersonate it. Without that, the pod cannot use the GCP SA.

Answer

The pod is using the wrong GCP service account.

Answer

The bucket has uniform bucket-level access disabled.

Answer

The GCP service account lacks the storage.objects.list permission.

Question 8

An administrator needs to grant a network team the ability to create and manage firewall rules, but not delete VPC networks. Which IAM role should be assigned?

Accepted Answer

roles/compute.securityAdmin. The roles/compute.securityAdmin role grants permissions to create, modify, and delete firewall rules and SSL certificates, but explicitly excludes permissions to delete VPC networks or modify their configurations. This aligns exactly with the requirement to manage firewall rules without being able to delete VPC networks.

Answer

roles/compute.networkAdmin

Answer

roles/compute.viewer

Answer

roles/compute.admin

Question 9

A company wants to grant a group of external auditors read-only access to all resources in a GCP project. The auditors authenticate via a SAML 2.0 identity provider. What is the most secure way to grant access?

Accepted Answer

Create a Cloud Identity group, add the auditors, and assign the Viewer role to the group at the project level.. Cloud Identity groups can be used to manage access. The auditors should be added to a Google Group, and that group is assigned the Viewer role at the project level. This avoids managing individual accounts. IAP is for application access, not project-level. Service accounts are for workloads. Custom roles are not needed for read-only.

Answer

Create a service account for each auditor and assign the Viewer role.

Answer

Use IAP to restrict access to the GCP console.

Answer

Create a custom role with only list permissions and assign to each auditor individually.

Question 10

An organization has a deny policy that denies the compute.instances.create permission for all principals on a folder. A user is granted the Compute Admin role (which includes compute.instances.create) at the project level within that folder. Can the user create Compute Engine instances in that project?

Accepted Answer

No, because deny policies take precedence over allow policies.. Deny policies override allow policies regardless of hierarchy. If a deny policy denies the permission, it cannot be granted by any allow policy. The user will be denied even though they have the role.

Answer

No, because the user is not an organization administrator.

Answer

Yes, if the user also has the Owner role at the project level.

Answer

Yes, because the project-level IAM grant overrides the folder-level deny.

Question 11

A company wants to allow their employees to access an internal web application running on Compute Engine using Identity-Aware Proxy (IAP). They want to ensure that only users from their corporate domain (example.com) can access the app. What is the recommended approach?

Accepted Answer

Create a Cloud Identity group containing all corporate users, and grant the IAP-secured Web App User role to that group.. Option B is correct because Identity-Aware Proxy (IAP) uses Cloud Identity groups to manage access at scale. By creating a group containing all corporate users (e.g., from example.com) and granting the IAP-secured Web App User role to that group, you enforce domain-level access without managing individual users. This approach leverages IAP's integration with Cloud Identity to verify the user's email domain against the group membership, ensuring only example.com users can reach the application.

Answer

Grant the IAP-secured Web App User role to each individual user from the corporate domain.

Answer

Use a custom SAML attribute in the IdP to filter access.

Answer

Configure a firewall rule that allows traffic only from the corporate IP range.

Question 12

A developer wants to grant a service account the ability to impersonate another service account in a different project. Which IAM permission is required for the developer to assign?

Accepted Answer

iam.serviceAccounts.actAs. The iam.serviceAccounts.actAs permission on the target service account allows a principal to impersonate that service account. This permission is included in the Service Account User role (roles/iam.serviceAccountUser). The developer needs to grant that role to the source service account (or user) on the target service account.

Answer

iam.serviceAccounts.getAccessToken

Answer

iam.serviceAccounts.create

Answer

iam.serviceAccounts.update

Question 13

A company wants to enforce that all Compute Engine instances are created with a specific set of tags for compliance. They also want to audit any changes to firewall rules. Which two Google Cloud services or features should they use? (Choose TWO.)

Accepted Answer

Cloud Audit Logs. Organization policies can enforce VM creation with tags via a custom constraint. Cloud Audit Logs can log changes to firewall rules for auditing. IAM is for permissions, not enforcement. Cloud Monitoring is for metrics. Cloud Deployment Manager is for infrastructure deployment but not continuous enforcement.

Answer

Cloud Deployment Manager

Answer

Cloud IAM

Answer

Cloud Monitoring

Question 14

A security administrator needs to grant a team of developers the ability to deploy applications to a GKE cluster, but only to specific namespaces. The developers should not be able to modify cluster-level resources or IAM policies. Which three steps should the administrator take? (Choose THREE.)

Accepted Answer

Create a Kubernetes Role in the namespace with permissions to create and manage pods and services.. Option A is correct because a Kubernetes Role defines permissions within a specific namespace, and granting permissions to create and manage pods and services aligns with the requirement to deploy applications without cluster-level access. This ensures developers can only interact with resources in the designated namespace, adhering to the principle of least privilege.

Answer

Create a ClusterRole and ClusterRoleBinding for the namespace.

Answer

Grant the developers the Kubernetes Engine Cluster Viewer role (roles/container.clusterViewer) at the project level.

Question 15

A company wants to implement a zero-trust access model for SSH access to Compute Engine instances. They need to ensure that only authorized users can connect and that all connections are logged. Which two services should they use? (Choose TWO.)

Accepted Answer

Identity-Aware Proxy (IAP). Identity-Aware Proxy (IAP) allows zero-trust TCP forwarding for SSH and RDP without a bastion host. Cloud Audit Logs record all IAP tunnel connections. Cloud NAT is for outbound internet, Cloud VPN is for network connectivity, and Cloud Shell is a browser-based terminal but does not provide zero-trust access control.

Answer

Cloud NAT

Answer

Cloud Shell

Answer

Cloud VPN