PCSE Configuring Access Within a Cloud Solution Environment Practice Test 8 — 15 Questions

Question 1

A security engineer needs to ensure that a specific Compute Engine instance can only be accessed via HTTPS from users authenticated through Cloud Identity. The instance is behind an HTTP(S) load balancer. What should the engineer configure on the load balancer to enforce this access control?

Accepted Answer

Configure IAP on the backend service of the load balancer. Identity-Aware Proxy (IAP) provides zero-trust access control for web applications and can be enabled on a load balancer backend service. It verifies user identity and context before allowing access. Configuring IAP on the backend service of the load balancer restricts access to authenticated users only.

Answer

Set firewall rules to allow only HTTPS traffic from the load balancer's IP ranges

Answer

Enable HTTPS only on the load balancer and use client certificates for authentication

Answer

Configure Cloud Armor with a security policy to require valid JWT tokens

Question 2

Your organization wants to assign a set of permissions to a group of users that allows them to create and delete Compute Engine instances, but not to modify other resources like Cloud Storage buckets. Which type of IAM role should you create?

Accepted Answer

Custom role with only compute.instances.create and compute.instances.delete. Custom IAM roles allow you to curate a specific set of permissions tailored to your needs. Predefined roles like roles/compute.instanceAdmin include broader permissions that may not be desired. Basic roles (Owner, Editor, Viewer) are too broad and should be avoided in production.

Answer

Predefined role (roles/compute.instanceAdmin.v1)

Answer

Basic role (Editor)

Answer

Predefined role (roles/editor)

Question 3

An organization has a Google Cloud organization node with multiple folders for different departments. A deny policy is set at the organization level to block the use of shielded VM constraints. Later, an allow policy at the folder level grants the compute.instances.create permission. A user in that folder tries to create a new VM without shielded VM enabled. What will happen?

Accepted Answer

The VM creation fails because the deny policy at the organization level overrides the folder allow policy. Deny policies override allow policies. Since the deny policy at the organization level blocks shielded VM usage, the allow policy at the folder level cannot override it. The VM creation will fail because the deny policy explicitly denies permissions related to shielded VM constraints.

Answer

The user can create the VM because the folder allow policy grants compute.instances.create

Answer

The VM is created but without shielded VM because the folder policy allows it

Answer

The VM creation succeeds because allow policies take precedence over deny policies

Question 4

A company wants to allow an application running in an on-premises data center to access Google Cloud Storage buckets without storing long-lived service account keys. The on-premises application authenticates using an external identity provider (IdP) that supports OpenID Connect (OIDC). Which Google Cloud feature should they use?

Accepted Answer

Use workload identity federation to exchange OIDC tokens for Google Cloud tokens. Workload identity federation allows the on-premises application to exchange OIDC tokens from the external IdP for short-lived Google Cloud access tokens, eliminating the need to store long-lived service account keys. This directly meets the requirement of accessing Cloud Storage buckets without managing static credentials.

Answer

Use Cloud VPN to connect the on-premises network and access Cloud Storage via private IP

Answer

Configure a VPN between on-premises and Google Cloud and use a Compute Engine instance as a proxy

Answer

Create a service account key and store it securely on-premises

Question 5

You need to grant a security auditor read-only access to all resources in a project, but they must not be able to view data within resources (e.g., table contents). Which predefined IAM role should you grant?

Accepted Answer

roles/viewer. The roles/viewer role provides read-only access to view resource configurations but not data. For example, it allows listing Compute Engine instances but not connecting to them or reading data from BigQuery tables. The Security Reviewer role (roles/iam.securityReviewer) is similar but includes additional permissions; however, the question asks for read-only access without data access, and roles/viewer is the standard read-only role.

Answer

roles/iam.securityReviewer

Answer

roles/owner

Answer

roles/editor

Question 6

A DevOps engineer needs to allow a CI/CD pipeline running in Google Kubernetes Engine (GKE) to push images to a specific Artifact Registry repository. The pipeline uses a Kubernetes service account. What is the best practice to grant this access without creating a JSON key for a Google service account?

Accepted Answer

Use Workload Identity to bind the KSA to a GSA with the Artifact Registry Writer role. Workload Identity for GKE allows you to bind a Kubernetes service account (KSA) to a Google service account (GSA). The KSA can then impersonate the GSA when accessing Google Cloud APIs, eliminating the need for service account keys.

Answer

Use a node pool with a service account that has the required roles

Answer

Grant the GSA the IAM role directly on the namespace using RBAC

Answer

Create a JSON key for the GSA, store it as a Kubernetes secret, and mount it into the pod

Question 7

Your organization uses Cloud Identity with SAML 2.0 federation from an external identity provider (IdP). You need to ensure that only users from a specific group in the IdP can access a critical application behind an HTTPS load balancer. Which combination of steps is required?

Accepted Answer

Enable IAP on the load balancer and grant the roles/iap.httpsResourceAccessor role to the Google group representing the IdP group. To restrict access to a specific group, you must first configure IAP on the backend service, then create an IAP access policy (or IAM binding) that grants the roles/iap.httpsResourceAccessor role to the Google group that corresponds to the IdP group. The IdP group must be synced to Google Cloud via directory sync or SCIM.

Answer

Create a firewall rule that allows traffic only from the IdP's SAML endpoint IP

Answer

Set up a VPN between the IdP and Google Cloud and restrict access to the load balancer via VPC firewall

Answer

Configure Cloud Armor to allow traffic only from the IdP's IP range

Question 8

A company has an organization policy that disables service account key creation (constraints/iam.disableServiceAccountKeyCreation). However, a legacy application requires a service account key to authenticate. What should the engineer do to satisfy this requirement while following best practices?

Accepted Answer

Use workload identity federation to authenticate the legacy application without keys. The best practice is to avoid service account keys entirely. Use workload identity federation if the application runs outside GCP, or use Workload Identity for GKE if it runs in GKE. If the application must use keys, you can request an exception by creating a custom organization policy with a condition or by using the policy simulator to test, but the preferred approach is to eliminate key usage.

Answer

Create a service account key and use it despite the policy, then document the exception

Answer

Create a custom role that includes iam.serviceAccountKeys.create and assign it to the service account

Answer

Remove the organization policy constraint to allow key creation

Question 9

Which of the following is the correct order of the Google Cloud resource hierarchy from highest to lowest?

Accepted Answer

Organization -> Folders -> Projects -> Resources. The Google Cloud resource hierarchy is: Organization -> Folders -> Projects -> Resources. Resources are the lowest level (e.g., Compute Engine instances, Cloud Storage buckets).

Answer

Resources -> Projects -> Folders -> Organization

Answer

Folders -> Organization -> Projects -> Resources

Answer

Organization -> Projects -> Folders -> Resources

Question 10

An organization uses Cloud Directory Sync to synchronize users from on-premises Active Directory to Cloud Identity. After syncing, a user reports they cannot access a Google Cloud project even though they are a member of the correct AD group. The group has been assigned the roles/compute.admin role on the project. What is the most likely cause?

Accepted Answer

The group was not synced as a Google Group; only users were synced. Cloud Directory Sync synchronizes users and groups, but group membership changes may take time to propagate. Additionally, the group must be synced as a Google Group or Cloud Identity group with the proper membership synced. If the group is not recognized in Cloud Identity, the IAM binding will not apply to the users.

Answer

The role was assigned at the organization level instead of the project level

Answer

The user needs to log out and log back in to refresh their session

Answer

The user is not a direct member of the group; they are a nested group member

Question 11

An engineer is configuring Cloud Armor for an HTTP(S) load balancer and needs to allow traffic only from users who have been authenticated by Identity-Aware Proxy (IAP). The backend service already has IAP enabled. What additional configuration is needed to ensure that only authenticated requests reach the backend?

Accepted Answer

No additional configuration is needed; IAP already blocks unauthenticated requests. Option C is correct because when IAP is enabled on a backend service, it intercepts all requests and blocks unauthenticated traffic before it reaches the backend. Cloud Armor operates at the edge, but since IAP already enforces authentication at the application layer, no additional Cloud Armor configuration is required to restrict access to authenticated users. The load balancer forwards only requests that have passed IAP authentication to the backend.

Answer

Configure Cloud Armor to allow only traffic from the IP ranges used by IAP

Answer

Create a Cloud Armor security policy that requires a valid JWT token signed by IAP

Answer

Set a firewall rule on the backend instances to allow traffic only from the load balancer's health check IPs

Question 12

A company wants to enforce that all new projects have a specific set of tags to track cost centers. Which Google Cloud feature should they use?

Accepted Answer

Create an organization policy with a custom constraint to require tags. Organization policies can enforce constraints on resources. However, tags are not enforced by organization policies. Instead, you can use the Resource Manager with organization policies to require tags, but there is no built-in constraint for tags. Alternatively, you can use a custom constraint to require tags. The simplest approach is to use the `constraints/resourcemanager.tags` constraint or a custom constraint. But the question is about enforcing tags; the Organization Policy Service is the tool to set constraints.

Answer

Configure a Cloud Function to delete projects without tags

Answer

Use IAM roles to restrict project creation to users who promise to add tags

Answer

Use Cloud Asset Inventory to monitor tags

Question 13

A security engineer needs to allow a group of external auditors to view all resources in a project but not modify anything. They must also prevent the auditors from viewing sensitive data in BigQuery datasets. Which TWO IAM bindings should the engineer configure? (Choose two.)

Accepted Answer

Grant roles/viewer on the project to the auditors group. To grant read-only access to resources (configurations) without data access, you can grant roles/viewer on the project. However, roles/viewer includes bigquery.tables.getData, which allows reading table data. To prevent that, you must also add a deny policy to block bigquery.tables.getData. Alternatively, you can use a custom role, but the question asks for IAM bindings.

Answer

Grant roles/bigquery.dataViewer on the project to the auditors group

Answer

Grant roles/iam.securityReviewer on the project to the auditors group

Answer

Remove the auditors group from all IAM bindings and grant them roles/browser only

Question 14

A company runs a batch job on Compute Engine that reads data from Cloud Storage and writes results to BigQuery. The Compute Engine instance uses a service account. The job fails with a permission error. Which THREE steps should the engineer take to resolve this? (Choose three.)

Accepted Answer

Grant the service account the roles/bigquery.dataEditor role on the BigQuery dataset. Option A is correct because the service account needs the roles/bigquery.dataEditor role on the BigQuery dataset to write data (insert rows) into BigQuery tables. Without this IAM permission, the job fails with a permission error when attempting to execute INSERT or load jobs against the dataset.

Answer

Grant the service account the roles/iam.serviceAccountUser role on itself

Answer

Enable the Cloud Storage and BigQuery APIs in the project

Question 15

An organization uses Cloud Identity with SAML 2.0 federation. They want to enable single sign-on (SSO) for users accessing Google Cloud Console and also allow access to a custom application behind an HTTPS load balancer using IAP. Which TWO configurations are required? (Choose two.)

Accepted Answer

Enable IAP on the backend service of the HTTPS load balancer. Option D is correct because Identity-Aware Proxy (IAP) must be enabled on the backend service of the HTTPS load balancer to enforce access control based on the user's identity. IAP uses the SAML assertion from Cloud Identity to verify the user's identity and grant access to the custom application, enabling SSO without requiring a VPN or per-user service accounts.

Answer

Deploy a VPN between the IdP and Google Cloud

Answer

Create a service account for each user to access the application

Answer

Create a Cloud Armor security policy to allow only SAML-authenticated requests