PCSE Configuring Access Within a Cloud Solution Environment Practice Test 6 — 15 Questions

Question 1

A company uses Active Directory (AD) on-premises and wants to implement SSO for Google Cloud Console access. They want to maintain user lifecycle management (create/disable accounts) from AD. Which TWO components are required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Directory Sync (CDS). Cloud Directory Sync synchronizes users from AD to Google Cloud Directory. SAML SSO with Cloud Identity allows users to sign in using their AD credentials. Both are needed: CDS for provisioning, SAML for authentication.

Answer

Workload Identity Federation

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud VPN

Question 2

A security administrator needs to deploy a solution that allows a group of developers to access a web application running on Compute Engine behind an internal HTTP load balancer. The solution must enforce access based on user identity and device security status, and must not expose the application to the public internet. Which THREE components are required?

Accepted Answer

Access Context Manager (Access Levels). Identity-Aware Proxy (IAP) provides identity and context-aware access. An internal HTTP load balancer keeps the app private. Context-aware access requires an access level (e.g., based on device policy). IAP uses access levels to enforce security.

Answer

Cloud NAT

Answer

Cloud Armor

Question 3

A company wants to enforce that no service account keys are created for service accounts in a specific project. Additionally, they want to allow only users from their corporate domain (example.com) to be granted IAM roles. Which TWO organization policy constraints should they apply at the project level?

Accepted Answer

constraints/iam.allowedPolicyMemberDomains. The constraint 'constraints/iam.disableServiceAccountKeyCreation' prevents key creation. 'constraints/iam.allowedPolicyMemberDomains' restricts IAM members to specified domains. Both can be applied at the project level.

Answer

constraints/iam.workloadIdentityPoolProviders

Answer

constraints/compute.requireShieldedVm

Answer

constraints/compute.restrictCloudArmorPolicies

Question 4

An organization wants to grant a team of data analysts the ability to run BigQuery queries and create datasets, but prevent them from deleting datasets or modifying IAM policies. Which predefined IAM role should be assigned?

Accepted Answer

roles/bigquery.dataEditor. The BigQuery Data Editor role (roles/bigquery.dataEditor) allows creating datasets and running queries, but does not allow deleting datasets or modifying permissions. The Viewer role is read-only, Owner allows deletion and IAM changes, and Job User only allows running jobs without dataset creation.

Answer

roles/bigquery.dataOwner

Answer

roles/bigquery.dataViewer

Answer

roles/bigquery.jobUser

Question 5

A company has multiple GCP projects managed under a single organization node. They want to enforce that all Compute Engine VMs are created with Shielded VM features enabled. Which approach should they use?

Accepted Answer

Use the organization policy service with the constraint constraints/compute.requireShieldedVm at the organization level.. Organization policies can enforce constraints across projects. The constraint constraints/compute.requireShieldedVm can be applied at the organization, folder, or project level to require Shielded VM on all new VMs. IAM roles don't enforce configuration, and gcloud commands are manual. Deny policies are for permission denial, not resource configuration.

Answer

Run a gcloud command after each VM creation to enable Shielded VM.

Answer

Apply a deny policy that denies the compute.instances.create permission if Shielded VM is not enabled.

Answer

Create a custom IAM role that includes compute.instances.create permission and assign it to all users.

Question 6

A security team needs to allow a third-party application running on AWS to access a Cloud Storage bucket without using service account keys. The application already uses AWS IAM roles. Which Google Cloud feature should they use?

Accepted Answer

Workload Identity Federation. Workload Identity Federation allows the AWS application to exchange its AWS IAM role credentials for Google Cloud temporary security tokens, enabling access to Cloud Storage without managing or storing service account keys. This is the correct approach because it directly addresses the requirement to avoid service account keys while leveraging the existing AWS IAM identity.

Answer

Secret Manager with a service account key

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud VPN

Question 7

A developer is troubleshooting a Cloud Run service that needs to read from a Cloud Storage bucket. The service runs as the compute engine default service account. The service account has been granted the Storage Object Viewer role at the project level, but the service still gets permission denied errors. What is the most likely cause?

Accepted Answer

The Cloud Run service is using a different service account than the one modified.. Cloud Run uses the runtime service account specified in the revision, not the compute engine default SA. The developer must explicitly set the service account when deploying, and grant it appropriate roles. The compute engine default SA is for Compute Engine VMs, not Cloud Run.

Answer

The bucket uses uniform bucket-level access, which overrides IAM.

Answer

The service account was not granted access to the specific bucket.

Answer

The Cloud Run service requires the Storage Admin role.

Question 8

An organization wants to allow users to authenticate to Google Cloud using their existing Active Directory credentials via SAML 2.0. Which Google Cloud identity service should they configure?

Accepted Answer

Cloud Identity. Cloud Identity or Google Workspace can be configured as a SAML 2.0 service provider (or identity provider) to federate with an external IdP like Active Directory. For SAML 2.0 SSO, Cloud Identity supports integration with external IdPs. Cloud Directory Sync syncs users but doesn't handle SSO. IAP is for access control, not identity federation.

Answer

Workload Identity Federation

Answer

Identity-Aware Proxy

Answer

Cloud Directory Sync

Question 9

A company has a security policy that service account keys should not be created. They want to prevent anyone from creating keys for any service account in the organization. Which organization policy constraint should they use?

Accepted Answer

constraints/iam.disableServiceAccountKeyCreation. The `constraints/iam.disableServiceAccountKeyCreation` organization policy constraint explicitly prevents the creation of user-managed service account keys across the entire organization. This aligns with the security policy that service account keys should not be created, as it enforces the use of short-lived credentials or workload identity federation instead of long-lived keys.

Answer

Custom constraint with iam.serviceAccountKeys.create

Answer

constraints/iam.allowedPolicyMemberDomains

Answer

constraints/compute.requireShieldedVm

Question 10

A GKE cluster has Workload Identity enabled. A Kubernetes service account is bound to a GCP service account named 'sa-gcs'. A pod using the Kubernetes service account fails to list objects in a Cloud Storage bucket. The GCP service account has the Storage Object Viewer role. What is the most likely cause?

Accepted Answer

The Kubernetes service account does not have the iam.workloadIdentityUser role on the GCP service account.. The pod must use the Kubernetes service account, but the GCP service account may not have the required permission (storage.objects.list). However, with Workload Identity, the pod authenticates as the GCP SA. The issue could be that the GCP SA does not have the role on the specific bucket, or the binding is misconfigured. But the most common cause is missing the iam.workloadIdentityUser role on the GCP SA for the Kubernetes service account to impersonate it. Without that, the pod cannot use the GCP SA.

Answer

The pod is using the wrong GCP service account.

Answer

The bucket has uniform bucket-level access disabled.

Answer

The GCP service account lacks the storage.objects.list permission.

Question 11

An administrator needs to grant a network team the ability to create and manage firewall rules, but not delete VPC networks. Which IAM role should be assigned?

Accepted Answer

roles/compute.securityAdmin. The roles/compute.securityAdmin role grants permissions to create, modify, and delete firewall rules and SSL certificates, but explicitly excludes permissions to delete VPC networks or modify their configurations. This aligns exactly with the requirement to manage firewall rules without being able to delete VPC networks.

Answer

roles/compute.networkAdmin

Answer

roles/compute.viewer

Answer

roles/compute.admin

Question 12

A company wants to grant a group of external auditors read-only access to all resources in a GCP project. The auditors authenticate via a SAML 2.0 identity provider. What is the most secure way to grant access?

Accepted Answer

Create a Cloud Identity group, add the auditors, and assign the Viewer role to the group at the project level.. Cloud Identity groups can be used to manage access. The auditors should be added to a Google Group, and that group is assigned the Viewer role at the project level. This avoids managing individual accounts. IAP is for application access, not project-level. Service accounts are for workloads. Custom roles are not needed for read-only.

Answer

Create a service account for each auditor and assign the Viewer role.

Answer

Use IAP to restrict access to the GCP console.

Answer

Create a custom role with only list permissions and assign to each auditor individually.

Question 13

An organization has a deny policy that denies the compute.instances.create permission for all principals on a folder. A user is granted the Compute Admin role (which includes compute.instances.create) at the project level within that folder. Can the user create Compute Engine instances in that project?

Accepted Answer

No, because deny policies take precedence over allow policies.. Deny policies override allow policies regardless of hierarchy. If a deny policy denies the permission, it cannot be granted by any allow policy. The user will be denied even though they have the role.

Answer

No, because the user is not an organization administrator.

Answer

Yes, if the user also has the Owner role at the project level.

Answer

Yes, because the project-level IAM grant overrides the folder-level deny.

Question 14

A company wants to allow their employees to access an internal web application running on Compute Engine using Identity-Aware Proxy (IAP). They want to ensure that only users from their corporate domain (example.com) can access the app. What is the recommended approach?

Accepted Answer

Create a Cloud Identity group containing all corporate users, and grant the IAP-secured Web App User role to that group.. Identity-Aware Proxy (IAP) uses Cloud Identity groups to manage access at scale. By creating a group containing all corporate users (e.g., from example.com) and granting the IAP-secured Web App User role to that group, you enforce domain-level access without managing individual users. This approach leverages IAP's integration with Cloud Identity to verify the user's email domain against the group membership, ensuring only example.com users can reach the application.

Answer

Grant the IAP-secured Web App User role to each individual user from the corporate domain.

Answer

Use a custom SAML attribute in the IdP to filter access.

Answer

Configure a firewall rule that allows traffic only from the corporate IP range.

Question 15

A developer wants to grant a service account the ability to impersonate another service account in a different project. Which IAM permission is required for the developer to assign?

Accepted Answer

iam.serviceAccounts.actAs. The iam.serviceAccounts.actAs permission on the target service account allows a principal to impersonate that service account. This permission is included in the Service Account User role (roles/iam.serviceAccountUser). The developer needs to grant that role to the source service account (or user) on the target service account.

Answer

iam.serviceAccounts.getAccessToken

Answer

iam.serviceAccounts.create

Answer

iam.serviceAccounts.update