PCSE Configuring Access Within a Cloud Solution Environment Practice Test 8 — 15 Questions

Question 1

A company wants to allow their on-premises Active Directory users to access Google Cloud resources using their existing credentials. They need to synchronize user accounts and groups to Google Cloud Directory and enable federated authentication. Which TWO services should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Directory Sync (CDS). Cloud Directory Sync (CDS) synchronizes users and groups from Active Directory to Google Cloud Directory. SAML 2.0 federation with Google Workspace or Cloud Identity enables SSO using existing AD credentials.

Answer

Workload Identity Federation

Answer

Identity-Aware Proxy

Answer

OAuth 2.0 consent screen

Question 2

A security engineer needs to ensure that service account keys are not used in production workloads. They want to enforce this across the entire organization. Which TWO controls should they implement?

Accepted Answer

Use a custom organization policy constraint to enforce service account key rotation (max age 90 days). The built-in organization policy constraint constraints/iam.disableServiceAccountKeyCreation prevents creation of new keys. A custom organization policy can enforce key rotation and disable use of existing keys older than a certain age.

Answer

Use VPC Service Controls to restrict the IAM API

Answer

Use a deny policy to deny the permission iam.serviceAccountKeys.create

Answer

Use IAM roles to remove the ability to generate keys for all users

Question 3

A company wants to deploy a containerized application on GKE that needs to access Cloud SQL. They want to avoid storing database credentials in the application. Which THREE components should they use?

Accepted Answer

Cloud SQL Auth Proxy (sidecar container). Workload Identity binds a Kubernetes service account to a GCP service account. The Cloud SQL Auth Proxy provides secure access to Cloud SQL using IAM database authentication. IAM database authentication allows the service account to authenticate to Cloud SQL without passwords.

Answer

Cloud SQL private IP

Answer

Service account key stored in a Kubernetes secret

Question 4

A security engineer needs to ensure that a specific Compute Engine instance can only be accessed via HTTPS from users authenticated through Cloud Identity. The instance is behind an HTTP(S) load balancer. What should the engineer configure on the load balancer to enforce this access control?

Accepted Answer

Configure IAP on the backend service of the load balancer. Identity-Aware Proxy (IAP) provides zero-trust access control for web applications and can be enabled on a load balancer backend service. It verifies user identity and context before allowing access. Configuring IAP on the backend service of the load balancer restricts access to authenticated users only.

Answer

Set firewall rules to allow only HTTPS traffic from the load balancer's IP ranges

Answer

Enable HTTPS only on the load balancer and use client certificates for authentication

Answer

Configure Cloud Armor with a security policy to require valid JWT tokens

Question 5

Your organization wants to assign a set of permissions to a group of users that allows them to create and delete Compute Engine instances, but not to modify other resources like Cloud Storage buckets. Which type of IAM role should you create?

Accepted Answer

Custom role with only compute.instances.create and compute.instances.delete. Custom IAM roles allow you to curate a specific set of permissions tailored to your needs. Predefined roles like roles/compute.instanceAdmin include broader permissions that may not be desired. Basic roles (Owner, Editor, Viewer) are too broad and should be avoided in production.

Answer

Predefined role (roles/compute.instanceAdmin.v1)

Answer

Basic role (Editor)

Answer

Predefined role (roles/editor)

Question 6

An organization has a Google Cloud organization node with multiple folders for different departments. A deny policy is set at the organization level to block the use of shielded VM constraints. Later, an allow policy at the folder level grants the compute.instances.create permission. A user in that folder tries to create a new VM without shielded VM enabled. What will happen?

Accepted Answer

The VM creation fails because the deny policy at the organization level overrides the folder allow policy. Deny policies override allow policies. Since the deny policy at the organization level blocks shielded VM usage, the allow policy at the folder level cannot override it. The VM creation will fail because the deny policy explicitly denies permissions related to shielded VM constraints.

Answer

The user can create the VM because the folder allow policy grants compute.instances.create

Answer

The VM is created but without shielded VM because the folder policy allows it

Answer

The VM creation succeeds because allow policies take precedence over deny policies

Question 7

A company wants to allow an application running in an on-premises data center to access Google Cloud Storage buckets without storing long-lived service account keys. The on-premises application authenticates using an external identity provider (IdP) that supports OpenID Connect (OIDC). Which Google Cloud feature should they use?

Accepted Answer

Use workload identity federation to exchange OIDC tokens for Google Cloud tokens. Workload identity federation allows the on-premises application to exchange OIDC tokens from the external IdP for short-lived Google Cloud access tokens, eliminating the need to store long-lived service account keys. This directly meets the requirement of accessing Cloud Storage buckets without managing static credentials.

Answer

Use Cloud VPN to connect the on-premises network and access Cloud Storage via private IP

Answer

Configure a VPN between on-premises and Google Cloud and use a Compute Engine instance as a proxy

Answer

Create a service account key and store it securely on-premises

Question 8

You need to grant a security auditor read-only access to all resources in a project, but they must not be able to view data within resources (e.g., table contents). Which predefined IAM role should you grant?

Accepted Answer

roles/viewer. The roles/viewer role provides read-only access to view resource configurations but not data. For example, it allows listing Compute Engine instances but not connecting to them or reading data from BigQuery tables. The Security Reviewer role (roles/iam.securityReviewer) is similar but includes additional permissions; however, the question asks for read-only access without data access, and roles/viewer is the standard read-only role.

Answer

roles/iam.securityReviewer

Answer

roles/owner

Answer

roles/editor

Question 9

A DevOps engineer needs to allow a CI/CD pipeline running in Google Kubernetes Engine (GKE) to push images to a specific Artifact Registry repository. The pipeline uses a Kubernetes service account. What is the best practice to grant this access without creating a JSON key for a Google service account?

Accepted Answer

Use Workload Identity to bind the KSA to a GSA with the Artifact Registry Writer role. Workload Identity for GKE allows you to bind a Kubernetes service account (KSA) to a Google service account (GSA). The KSA can then impersonate the GSA when accessing Google Cloud APIs, eliminating the need for service account keys.

Answer

Use a node pool with a service account that has the required roles

Answer

Grant the GSA the IAM role directly on the namespace using RBAC

Answer

Create a JSON key for the GSA, store it as a Kubernetes secret, and mount it into the pod

Question 10

Your organization uses Cloud Identity with SAML 2.0 federation from an external identity provider (IdP). You need to ensure that only users from a specific group in the IdP can access a critical application behind an HTTPS load balancer. Which combination of steps is required?

Accepted Answer

Enable IAP on the load balancer and grant the roles/iap.httpsResourceAccessor role to the Google group representing the IdP group. To restrict access to a specific group, you must first configure IAP on the backend service, then create an IAP access policy (or IAM binding) that grants the roles/iap.httpsResourceAccessor role to the Google group that corresponds to the IdP group. The IdP group must be synced to Google Cloud via directory sync or SCIM.

Answer

Create a firewall rule that allows traffic only from the IdP's SAML endpoint IP

Answer

Set up a VPN between the IdP and Google Cloud and restrict access to the load balancer via VPC firewall

Answer

Configure Cloud Armor to allow traffic only from the IdP's IP range

Question 11

A company has an organization policy that disables service account key creation (constraints/iam.disableServiceAccountKeyCreation). However, a legacy application requires a service account key to authenticate. What should the engineer do to satisfy this requirement while following best practices?

Accepted Answer

Use workload identity federation to authenticate the legacy application without keys. The best practice is to avoid service account keys entirely. Use workload identity federation if the application runs outside GCP, or use Workload Identity for GKE if it runs in GKE. If the application must use keys, you can request an exception by creating a custom organization policy with a condition or by using the policy simulator to test, but the preferred approach is to eliminate key usage.

Answer

Create a service account key and use it despite the policy, then document the exception

Answer

Create a custom role that includes iam.serviceAccountKeys.create and assign it to the service account

Answer

Remove the organization policy constraint to allow key creation

Question 12

Which of the following is the correct order of the Google Cloud resource hierarchy from highest to lowest?

Accepted Answer

Organization -> Folders -> Projects -> Resources. The Google Cloud resource hierarchy is: Organization -> Folders -> Projects -> Resources. Resources are the lowest level (e.g., Compute Engine instances, Cloud Storage buckets).

Answer

Resources -> Projects -> Folders -> Organization

Answer

Folders -> Organization -> Projects -> Resources

Answer

Organization -> Projects -> Folders -> Resources

Question 13

An organization uses Cloud Directory Sync to synchronize users from on-premises Active Directory to Cloud Identity. After syncing, a user reports they cannot access a Google Cloud project even though they are a member of the correct AD group. The group has been assigned the roles/compute.admin role on the project. What is the most likely cause?

Accepted Answer

The group was not synced as a Google Group; only users were synced. Cloud Directory Sync synchronizes users and groups, but group membership changes may take time to propagate. Additionally, the group must be synced as a Google Group or Cloud Identity group with the proper membership synced. If the group is not recognized in Cloud Identity, the IAM binding will not apply to the users.

Answer

The role was assigned at the organization level instead of the project level

Answer

The user needs to log out and log back in to refresh their session

Answer

The user is not a direct member of the group; they are a nested group member

Question 14

An engineer is configuring Cloud Armor for an HTTP(S) load balancer and needs to allow traffic only from users who have been authenticated by Identity-Aware Proxy (IAP). The backend service already has IAP enabled. What additional configuration is needed to ensure that only authenticated requests reach the backend?

Accepted Answer

No additional configuration is needed; IAP already blocks unauthenticated requests. When IAP is enabled on a backend service, it intercepts all requests and blocks unauthenticated traffic before it reaches the backend. Cloud Armor operates at the edge, but since IAP already enforces authentication at the application layer, no additional Cloud Armor configuration is required to restrict access to authenticated users. The load balancer forwards only requests that have passed IAP authentication to the backend.

Answer

Configure Cloud Armor to allow only traffic from the IP ranges used by IAP

Answer

Create a Cloud Armor security policy that requires a valid JWT token signed by IAP

Answer

Set a firewall rule on the backend instances to allow traffic only from the load balancer's health check IPs

Question 15

A company wants to enforce that all new projects have a specific set of tags to track cost centers. Which Google Cloud feature should they use?

Accepted Answer

Create an organization policy with a custom constraint to require tags. Organization policies can enforce constraints on resources. However, tags are not enforced by organization policies. Instead, you can use the Resource Manager with organization policies to require tags, but there is no built-in constraint for tags. Alternatively, you can use a custom constraint to require tags. The simplest approach is to use the `constraints/resourcemanager.tags` constraint or a custom constraint. But the question is about enforcing tags; the Organization Policy Service is the tool to set constraints.

Answer

Configure a Cloud Function to delete projects without tags

Answer

Use IAM roles to restrict project creation to users who promise to add tags

Answer

Use Cloud Asset Inventory to monitor tags