PCSE Configuring Access Within a Cloud Solution Environment Practice Test 7 — 15 Questions

Question 1

An organization wants to grant a DevOps team the ability to create and manage service accounts in a specific project, but prevent them from deleting existing service accounts or managing IAM policies. Which IAM role should be assigned to the team?

Accepted Answer

roles/iam.serviceAccountAdmin. The roles/iam.serviceAccountAdmin role grants permissions to create, update, and delete service accounts, but not to manage IAM policies for them. The basic role (Editor) is too permissive, ServiceAccountUser only allows using existing service accounts, and ServiceAccountKeyAdmin focuses on key management.

Answer

roles/iam.serviceAccountUser

Answer

roles/iam.serviceAccountKeyAdmin

Answer

roles/editor

Question 2

A security engineer needs to prevent creation of long-lived service account keys across all projects in an organization. The solution should also block any existing keys older than 90 days. Which approach meets these requirements?

Accepted Answer

Use the built-in constraint constraints/iam.disableServiceAccountKeyCreation and write a custom organization policy to enforce key rotation (max age 90 days).. Option A is correct because the built-in constraint `constraints/iam.disableServiceAccountKeyCreation` prevents the creation of new long-lived keys, and a custom organization policy with a condition like `resource.serviceAccountKey.expireTime < duration(90d)` enforces automatic rotation, effectively blocking keys older than 90 days. This combination directly addresses both requirements without manual intervention or deletion.

Answer

Use a deny policy to deny the permission iam.serviceAccountKeys.create and another deny policy to deny use of keys older than 90 days.

Answer

Use a custom organization policy constraint to disable key creation and another custom constraint to delete keys older than 90 days.

Answer

Use a VPC Service Controls perimeter to block access to the IAM API for creating keys.

Question 3

A developer needs to deploy a web application on Compute Engine that must access Cloud Storage buckets. The best practice for providing credentials to the VM is to:

Accepted Answer

Create a service account with the required roles and attach it to the Compute Engine instance.. The best practice is to create a service account, assign the appropriate roles to it, and attach it to the Compute Engine instance. This avoids managing static keys and uses the instance's metadata server for automatic credential retrieval.

Answer

Generate a JSON key for a service account and store it on the instance.

Answer

Use the Compute Engine default service account and grant it the required roles.

Answer

Store the user's personal credentials in the instance metadata.

Question 4

A company uses Google Workspace and wants to allow users to authenticate to a third-party SaaS application using their Google credentials. The SaaS application supports SAML 2.0. What should the administrator configure?

Accepted Answer

SAML 2.0 SSO in Google Admin Console. Google Workspace supports SAML 2.0 federation. The admin would set up a custom SAML app in the Google Admin console, configuring the IdP (Google) and SP (SaaS app) metadata.

Answer

Workload Identity Federation

Answer

Cloud Identity-Aware Proxy (IAP)

Answer

OAuth 2.0 consent screen

Question 5

An organization has a deny policy at the folder level that denies the permission resourcemanager.projects.create. A user has an allow policy at the project level granting roles/owner. What is the effective permission for the user to create projects in that project?

Accepted Answer

The user cannot create projects because the deny policy at the folder level explicitly denies the permission.. Deny policies take precedence over allow policies. Even though the user has Owner role at the project level, the folder-level deny policy blocks project creation. Deny policies are evaluated before allow policies and, if matched, the permission is denied.

Answer

The user can create projects because Owner role includes all permissions.

Answer

The user can create projects if the project-level allow is more specific.

Question 6

Which of the following is a benefit of using organization policies over IAM policies for enforcing restrictions on resources?

Accepted Answer

Organization policies can restrict resources even if the user has Owner role.. Organization policies can enforce restrictions on resources regardless of the IAM roles assigned to users. They are applied to resources, not identities, and are evaluated before IAM policies.

Answer

Organization policies can grant permissions to users.

Answer

Organization policies are applied to identities.

Answer

Organization policies are easier to audit than IAM policies.

Question 7

A company wants to provide their employees access to a web application running on Compute Engine without exposing the VM to the public internet. The application uses a custom header to verify the user's identity. Which service should they use?

Accepted Answer

Cloud Identity-Aware Proxy (IAP). Identity-Aware Proxy (IAP) provides zero-trust access to web applications. It can be configured to verify identity and pass signed headers (e.g., X-Goog-Authenticated-User-Email) to the backend, allowing the application to verify the user without public IP exposure.

Answer

Cloud Armor with OAuth

Answer

Cloud Load Balancing with SSL termination

Answer

VPC firewall rules with source IP restrictions

Question 8

An administrator needs to restrict which external identities can be used to access Google Cloud resources. The organization uses SAML federation with an external identity provider. Which organization policy constraint should be used?

Accepted Answer

constraints/iam.allowedPolicyMemberDomains. The constrain constraints/iam.allowedPolicyMemberDomains restricts which domains can be granted IAM roles. By setting this to the domain of the external IdP, the administrator ensures only federated identities from that domain can be used.

Answer

constraints/iam.disableServiceAccountKeyCreation

Answer

constraints/compute.requireShieldedVm

Answer

constraints/iam.disableCrossProjectServiceAccountUsage

Question 9

An organization wants to grant a CI/CD pipeline (running on GitHub Actions) access to deploy resources in a GCP project without storing long-lived service account keys. Which approach is recommended?

Accepted Answer

Use Workload Identity Federation with GitHub as an identity provider.. Workload Identity Federation allows binding an external identity provider (like GitHub Actions) to a GCP service account. The GitHub Actions workflow can exchange a GitHub OIDC token for a GCP access token, no static keys needed.

Answer

Use a service account with the role roles/iam.serviceAccountTokenCreator.

Answer

Create a service account and store the JSON key as a GitHub secret.

Answer

Create a compute instance with a service account and run the pipeline from there.

Question 10

In the Google Cloud IAM resource hierarchy, which level supports the most granular policy attachment?

Accepted Answer

Resource. Policies can be attached at the organization, folder, project, and resource levels. The most granular is at the resource level, such as a specific Cloud Storage bucket or Compute Engine instance.

Answer

Folder

Answer

Organization

Answer

Project

Question 11

A security team wants to enforce that all Compute Engine instances in the organization use Shielded VM features (Secure Boot, vTPM, Integrity Monitoring). What should they configure?

Accepted Answer

The built-in constraint constraints/compute.requireShieldedVm. The organization policy constraint constraints/compute.requireShieldedVm enforces that all new VMs must have Shielded VM enabled. It is a built-in constraint available in the Organization Policy service.

Answer

A custom organization policy with a CEL condition

Answer

An IAM policy that only allows creation of Shielded VMs

Answer

A deny policy that denies the permission compute.instances.create unless Shielded VM is enabled

Question 12

A user in a Google Cloud organization wants to create a custom IAM role at the project level. Which permission is required to create custom roles?

Accepted Answer

iam.roles.create. The permission iam.roles.create is needed to create custom roles. This permission is included in roles like roles/iam.roleAdmin or roles/owner.

Answer

resourcemanager.projects.setIamPolicy

Answer

iam.serviceAccounts.create

Answer

iam.roles.update

Question 13

A company wants to allow their on-premises Active Directory users to access Google Cloud resources using their existing credentials. They need to synchronize user accounts and groups to Google Cloud Directory and enable federated authentication. Which TWO services should they use?

Accepted Answer

Cloud Directory Sync (CDS). Cloud Directory Sync (CDS) synchronizes users and groups from Active Directory to Google Cloud Directory. SAML 2.0 federation with Google Workspace or Cloud Identity enables SSO using existing AD credentials.

Answer

Workload Identity Federation

Answer

Identity-Aware Proxy

Answer

OAuth 2.0 consent screen

Question 14

A security engineer needs to ensure that service account keys are not used in production workloads. They want to enforce this across the entire organization. Which TWO controls should they implement?

Accepted Answer

Use a custom organization policy constraint to enforce service account key rotation (max age 90 days). The built-in organization policy constraint constraints/iam.disableServiceAccountKeyCreation prevents creation of new keys. A custom organization policy can enforce key rotation and disable use of existing keys older than a certain age.

Answer

Use VPC Service Controls to restrict the IAM API

Answer

Use a deny policy to deny the permission iam.serviceAccountKeys.create

Answer

Use IAM roles to remove the ability to generate keys for all users

Question 15

A company wants to deploy a containerized application on GKE that needs to access Cloud SQL. They want to avoid storing database credentials in the application. Which THREE components should they use?

Accepted Answer

Cloud SQL Auth Proxy (sidecar container). Workload Identity binds a Kubernetes service account to a GCP service account. The Cloud SQL Auth Proxy provides secure access to Cloud SQL using IAM database authentication. IAM database authentication allows the service account to authenticate to Cloud SQL without passwords.

Answer

Cloud SQL private IP

Answer

Service account key stored in a Kubernetes secret