PCSE Configuring Access Within a Cloud Solution Environment Practice Test 7 — 15 Questions

Question 1

A company wants to enforce that all Compute Engine instances are created with a specific set of tags for compliance. They also want to audit any changes to firewall rules. Which two Google Cloud services or features should they use? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Audit Logs. Organization policies can enforce VM creation with tags via a custom constraint. Cloud Audit Logs can log changes to firewall rules for auditing. IAM is for permissions, not enforcement. Cloud Monitoring is for metrics. Cloud Deployment Manager is for infrastructure deployment but not continuous enforcement.

Answer

Cloud Deployment Manager

Answer

Cloud IAM

Answer

Cloud Monitoring

Question 2

A security administrator needs to grant a team of developers the ability to deploy applications to a GKE cluster, but only to specific namespaces. The developers should not be able to modify cluster-level resources or IAM policies. Which three steps should the administrator take? (Choose THREE.)

Accepted Answer

Create a Kubernetes Role in the namespace with permissions to create and manage pods and services.. A Kubernetes Role defines permissions within a specific namespace, and granting permissions to create and manage pods and services aligns with the requirement to deploy applications without cluster-level access. This ensures developers can only interact with resources in the designated namespace, adhering to the principle of least privilege.

Answer

Create a ClusterRole and ClusterRoleBinding for the namespace.

Answer

Grant the developers the Kubernetes Engine Cluster Viewer role (roles/container.clusterViewer) at the project level.

Question 3

A company wants to implement a zero-trust access model for SSH access to Compute Engine instances. They need to ensure that only authorized users can connect and that all connections are logged. Which two services should they use? (Choose TWO.)

Accepted Answer

Identity-Aware Proxy (IAP). Identity-Aware Proxy (IAP) allows zero-trust TCP forwarding for SSH and RDP without a bastion host. Cloud Audit Logs record all IAP tunnel connections. Cloud NAT is for outbound internet, Cloud VPN is for network connectivity, and Cloud Shell is a browser-based terminal but does not provide zero-trust access control.

Answer

Cloud NAT

Answer

Cloud Shell

Answer

Cloud VPN

Question 4

An organization wants to grant a DevOps team the ability to create and manage service accounts in a specific project, but prevent them from deleting existing service accounts or managing IAM policies. Which IAM role should be assigned to the team?

Accepted Answer

roles/iam.serviceAccountAdmin. The roles/iam.serviceAccountAdmin role grants permissions to create, update, and delete service accounts, but not to manage IAM policies for them. The basic role (Editor) is too permissive, ServiceAccountUser only allows using existing service accounts, and ServiceAccountKeyAdmin focuses on key management.

Answer

roles/iam.serviceAccountUser

Answer

roles/iam.serviceAccountKeyAdmin

Answer

roles/editor

Question 5

A security engineer needs to prevent creation of long-lived service account keys across all projects in an organization. The solution should also block any existing keys older than 90 days. Which approach meets these requirements?

Accepted Answer

Use a deny policy to deny the permission iam.serviceAccountKeys.create and another deny policy to deny use of keys older than 90 days.. Deny policies can be used to prevent creation of new service account keys (by denying iam.serviceAccountKeys.create) and to block use of existing keys older than 90 days (by denying permissions like iam.serviceAccountKeys.signBlob with a condition on key age). This directly addresses both requirements: prevention of new long-lived keys and disabling existing keys older than 90 days. Option A only prevents creation of new keys via the built-in constraint but does not affect existing keys; while a custom policy can enforce key rotation on new keys, it cannot block or disable keys that already exist. Option C fails because custom constraints cannot delete existing resources. Option D does not block key creation via all methods and does not address existing keys.

Answer

Use the built-in constraint constraints/iam.disableServiceAccountKeyCreation and write a custom organization policy to enforce key rotation (max age 90 days).

Answer

Use a custom organization policy constraint to disable key creation and another custom constraint to delete keys older than 90 days.

Answer

Use a VPC Service Controls perimeter to block access to the IAM API for creating keys.

Question 6

A developer needs to deploy a web application on Compute Engine that must access Cloud Storage buckets. The best practice for providing credentials to the VM is to:

Accepted Answer

Create a service account with the required roles and attach it to the Compute Engine instance.. The best practice is to create a service account, assign the appropriate roles to it, and attach it to the Compute Engine instance. This avoids managing static keys and uses the instance's metadata server for automatic credential retrieval.

Answer

Generate a JSON key for a service account and store it on the instance.

Answer

Use the Compute Engine default service account and grant it the required roles.

Answer

Store the user's personal credentials in the instance metadata.

Question 7

A company uses Google Workspace and wants to allow users to authenticate to a third-party SaaS application using their Google credentials. The SaaS application supports SAML 2.0. What should the administrator configure?

Accepted Answer

SAML 2.0 SSO in Google Admin Console. Google Workspace supports SAML 2.0 federation. The admin would set up a custom SAML app in the Google Admin console, configuring the IdP (Google) and SP (SaaS app) metadata.

Answer

Workload Identity Federation

Answer

Cloud Identity-Aware Proxy (IAP)

Answer

OAuth 2.0 consent screen

Question 8

An organization has a deny policy at the folder level that denies the permission resourcemanager.projects.create. A user has an allow policy at the project level granting roles/owner. What is the effective permission for the user to create projects in that project?

Accepted Answer

The user cannot create projects because the deny policy at the folder level explicitly denies the permission.. Deny policies take precedence over allow policies. The folder-level deny policy explicitly denies resourcemanager.projects.create. Even though the user has Owner role at the project level, the explicit deny at the folder level blocks project creation. Option A is correct because the deny policy explicitly denies the permission, which overrides any allow. Option B is incorrect because the deny is not effective simply because it is at a higher level; it is the explicit denial that causes the effect. A higher-level allow could grant permission in the absence of a deny, but here the explicit deny controls.

Answer

The user cannot create projects because the deny policy is at a higher level in the hierarchy.

Answer

The user can create projects because Owner role includes all permissions.

Answer

The user can create projects if the project-level allow is more specific.

Question 9

Which of the following is a benefit of using organization policies over IAM policies for enforcing restrictions on resources?

Accepted Answer

Organization policies can restrict resources even if the user has Owner role.. Organization policies can enforce restrictions on resources regardless of the IAM roles assigned to users. They are applied to resources, not identities, and are evaluated before IAM policies.

Answer

Organization policies can grant permissions to users.

Answer

Organization policies are applied to identities.

Answer

Organization policies are easier to audit than IAM policies.

Question 10

A company wants to provide their employees access to a web application running on Compute Engine without exposing the VM to the public internet. The application uses a custom header to verify the user's identity. Which service should they use?

Accepted Answer

Cloud Identity-Aware Proxy (IAP). Identity-Aware Proxy (IAP) provides zero-trust access to web applications. It can be configured to verify identity and pass signed headers (e.g., X-Goog-Authenticated-User-Email) to the backend, allowing the application to verify the user without public IP exposure.

Answer

Cloud Armor with OAuth

Answer

Cloud Load Balancing with SSL termination

Answer

VPC firewall rules with source IP restrictions

Question 11

An administrator needs to restrict which external identities can be used to access Google Cloud resources. The organization uses SAML federation with an external identity provider. Which organization policy constraint should be used?

Accepted Answer

constraints/iam.allowedPolicyMemberDomains. The constrain constraints/iam.allowedPolicyMemberDomains restricts which domains can be granted IAM roles. By setting this to the domain of the external IdP, the administrator ensures only federated identities from that domain can be used.

Answer

constraints/iam.disableServiceAccountKeyCreation

Answer

constraints/compute.requireShieldedVm

Answer

constraints/iam.disableCrossProjectServiceAccountUsage

Question 12

An organization wants to grant a CI/CD pipeline (running on GitHub Actions) access to deploy resources in a GCP project without storing long-lived service account keys. Which approach is recommended?

Accepted Answer

Use Workload Identity Federation with GitHub as an identity provider.. Workload Identity Federation allows binding an external identity provider (like GitHub Actions) to a GCP service account. The GitHub Actions workflow can exchange a GitHub OIDC token for a GCP access token, no static keys needed.

Answer

Use a service account with the role roles/iam.serviceAccountTokenCreator.

Answer

Create a service account and store the JSON key as a GitHub secret.

Answer

Create a compute instance with a service account and run the pipeline from there.

Question 13

In the Google Cloud IAM resource hierarchy, which level supports the most granular policy attachment?

Accepted Answer

Resource. Policies can be attached at the organization, folder, project, and resource levels. The most granular is at the resource level, such as a specific Cloud Storage bucket or Compute Engine instance.

Answer

Folder

Answer

Organization

Answer

Project

Question 14

A security team wants to enforce that all Compute Engine instances in the organization use Shielded VM features (Secure Boot, vTPM, Integrity Monitoring). What should they configure?

Accepted Answer

The built-in constraint constraints/compute.requireShieldedVm. The organization policy constraint constraints/compute.requireShieldedVm enforces that all new VMs must have Shielded VM enabled. It is a built-in constraint available in the Organization Policy service.

Answer

A custom organization policy with a CEL condition

Answer

An IAM policy that only allows creation of Shielded VMs

Answer

A deny policy that denies the permission compute.instances.create unless Shielded VM is enabled

Question 15

A user in a Google Cloud organization wants to create a custom IAM role at the project level. Which permission is required to create custom roles?

Accepted Answer

iam.roles.create. The permission iam.roles.create is needed to create custom roles. This permission is included in roles like roles/iam.roleAdmin or roles/owner.

Answer

resourcemanager.projects.setIamPolicy

Answer

iam.serviceAccounts.create

Answer

iam.roles.update