PCSE Configuring Access Within a Cloud Solution Environment Practice Test 9 — 15 Questions

Question 1

A security engineer needs to allow a group of external auditors to view all resources in a project but not modify anything. They must also prevent the auditors from viewing sensitive data in BigQuery datasets. Which TWO IAM bindings should the engineer configure? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Grant roles/viewer on the project to the auditors group. To grant read-only access to resources (configurations) without data access, you can grant roles/viewer on the project. However, roles/viewer includes bigquery.tables.getData, which allows reading table data. To prevent that, you must also add a deny policy to block bigquery.tables.getData. Alternatively, you can use a custom role, but the question asks for IAM bindings.

Answer

Grant roles/bigquery.dataViewer on the project to the auditors group

Answer

Grant roles/iam.securityReviewer on the project to the auditors group

Answer

Remove the auditors group from all IAM bindings and grant them roles/browser only

Question 2

Your organization has an IAM policy at the folder level that grants a user the Compute Admin role. A deny policy at the project level denies the same user the compute.instances.create permission. What is the effective access for this user on the project?

Accepted Answer

The user cannot create instances because deny policies override allow policies.. Deny policies always override allow policies. The deny at the project level explicitly denies compute.instances.create, so the user cannot create instances despite the folder-level allow.

Answer

The user can create instances because the allow policy at the folder level takes precedence over the deny policy at the project level.

Answer

The user can create instances because the project-level deny policy only applies to resources within the project, not to permissions inherited from the folder.

Answer

The user can create instances because deny policies only block explicit allows, not inherited ones.

Question 3

A security engineer needs to enforce that all Compute Engine VMs in an organization use Shielded VM features. Which approach should they use?

Accepted Answer

Create an organization policy with the constraint constraints/compute.requireShieldedVm set to True.. The organization policy constraint constraints/compute.requireShieldedVm is the correct way to enforce Shielded VM across all VMs.

Answer

Use IAP to enforce Shielded VM on all instances.

Answer

Enable Shielded VM in the project's compute engine settings.

Answer

Configure a firewall rule to block non-Shielded VMs.

Question 4

A company uses Google Cloud Directory Sync to synchronize users from an on-premises Active Directory to Cloud Identity. They want to allow federated access from their external identity provider (IdP) that supports SAML 2.0. The IdP should be able to authenticate users from a specific AD domain. What configuration steps are required?

Accepted Answer

Configure the external IdP as a SAML identity provider in Cloud Identity, map the AD domain, and enable user provisioning via SCIM.. For federated access with an external SAML 2.0 IdP, configure the external IdP as a SAML identity provider in Cloud Identity, mapping the appropriate domain.

Answer

Use Workload Identity Federation to map the external IdP to Google Cloud service accounts.

Answer

Set up SAML SSO in Cloud Identity using Google as the IdP, and configure AD to trust Google's SAML response for the domain.

Answer

Create a custom OAuth 2.0 flow in Cloud Identity to integrate with the external IdP.

Question 5

A DevOps team wants to grant a CI/CD pipeline (running on a Compute Engine VM) the ability to restart Compute Engine instances in a specific project. The VM has a service account attached. What is the best practice to grant this permission?

Accepted Answer

Create a custom role with compute.instances.stop and compute.instances.start permissions, and assign it to the service account at the project level.. The best practice is to create a custom role with only the required permissions (compute.instances.stop and compute.instances.start) and assign it to the service account.

Answer

Generate a service account key and use it in the CI/CD system to authenticate.

Answer

Grant the VM's service account the roles/iam.serviceAccountUser role so it can impersonate another service account that has Compute Admin.

Answer

Grant the service account the Compute Admin role (roles/compute.admin) at the project level.

Question 6

An organization wants to use a third-party identity provider (IdP) that supports OpenID Connect (OIDC) to manage access to Google Cloud resources. They want users to authenticate with the external IdP and access GCP via the Cloud Console and gcloud CLI. Which feature should they use?

Accepted Answer

Cloud Identity with OIDC federation. Cloud Identity supports OIDC federation, allowing users to authenticate with an external OIDC IdP and access GCP.

Answer

Cloud Identity with SAML 2.0 federation

Answer

Service account key authentication

Answer

Workload Identity Federation

Question 7

A security team wants to restrict service account key creation in their organization to prevent key-based authentication. They have set the organization policy constraint constraints/iam.disableServiceAccountKeyCreation to True. However, they need to allow a specific project to continue creating keys for legacy applications. Which two steps are required? (Choose two.)

Accepted Answer

Set a folder-level policy to disable the constraint for the folder containing the project.. Setting a folder-level policy to disable the constraint for the folder containing the project allows the organization policy to remain enforced at the org level while creating an exception for the specific folder and its child projects. Option E is correct because the organization policy supports conditions, enabling you to add an exception for a specific project without removing the constraint from the organization level.

Answer

Remove the constraint from the organization level and apply it to all child projects except the legacy one.

Answer

Use a deny policy to block key creation for all projects except the legacy one.

Answer

Create a custom role with iam.serviceAccountKeys.create permission and assign it to the project.

Question 8

A company wants to implement workload identity federation for a GitHub Actions workflow, allowing it to access Google Cloud resources without using service account keys. Which three steps are required? (Choose three.)

Accepted Answer

Create a service account in GCP and grant it the necessary roles.. To implement workload identity federation for GitHub Actions, you need to: create a service account with necessary roles (C), create a workload identity pool and provider for GitHub (D), and configure the GitHub Actions workflow to authenticate using the provider (E). Option A is incorrect because the role `roles/iam.workloadIdentityUser` is granted on the service account, not on the pool. Option B is incorrect because storing a JSON key defeats the purpose of workload identity federation, which avoids using service account keys.

Answer

Grant the service account the roles/iam.workloadIdentityUser role on the workload identity pool.

Answer

Generate a JSON key for the service account and store it as a GitHub secret.

Question 9

An organization wants to use Identity-Aware Proxy (IAP) to secure access to a web application running on Compute Engine. They need to ensure that only users with specific email domains can access the application, and also verify that requests are coming from IAP. Which two configurations are required? (Choose two.)

Accepted Answer

Create a firewall rule that allows traffic only from IAP's IP ranges.. To secure access with IAP, you must allow IAP's IP ranges in the firewall (option B) and configure the backend to validate IAP-signed headers (option C). The IAP role is also needed but the question focuses on the two specific configurations for IP and header validation.

Answer

Configure Cloud Armor to block non-IAP traffic.

Answer

Assign the IAP-secured Web App User role to the users.

Answer

Create an organization policy to enforce IAP usage.

Question 10

A developer wants to grant a Kubernetes service account in GKE the ability to read objects from a specific Cloud Storage bucket. Which two resources need to be bound together? (Choose two.)

Accepted Answer

The Kubernetes service account. The Kubernetes service account is the identity used by pods running in GKE to authenticate to Google Cloud APIs. Option D is correct because a GCP service account is the IAM identity that must be granted permissions on the Cloud Storage bucket via IAM policies. The two are bound together using workload identity federation, which allows the Kubernetes service account to impersonate the GCP service account.

Answer

The Cloud Storage bucket

Answer

The IAM policy for the bucket

Answer

The GKE cluster

Question 11

A company uses Cloud Identity with SAML 2.0 federation from an external IdP. They want to enforce that users must be members of a specific group in the IdP to access GCP resources. Which two configurations are necessary? (Choose two.)

Accepted Answer

Create a corresponding group in Cloud Identity and map it to the IdP group.. To enforce group-based access, you need to create a corresponding group in Cloud Identity and map it to the IdP group (option A) so that IAM policies can reference it. You also need the IdP to send group membership in the SAML assertion (option E) so that Cloud Identity can determine which groups the user belongs to and apply the appropriate IAM policies.

Answer

Disable direct user accounts in Cloud Identity.

Answer

Use IAP to enforce group membership.

Answer

Create an organization policy to restrict access to only those users.

Question 12

A security architect is designing an IAM hierarchy for a large organization. The requirements are: 1) Development projects should inherit a policy that allows Compute Engine access. 2) Production projects should not have Compute Engine access. 3) Audit team must be able to read all resources across all projects. Which three IAM policy placements are correct? (Choose three.)

Accepted Answer

Grant the development team roles/compute.admin at the folder level for the development folder.. Grant the development team roles/compute.admin at the development folder level (A) allows development projects to inherit Compute Engine access. Grant the audit team roles/viewer at the organization level (B) allows them to read all resources across all projects. Placing a deny policy at the production folder level (D) blocks Compute Engine access for production projects. This meets all requirements.

Answer

Grant the production team roles/compute.admin at the folder level for the production folder, then create a deny policy at the org level to block Compute Engine.

Answer

Grant the audit team roles/viewer at each project level.

Question 13

A company wants to use Google Cloud Directory Sync (GCDS) to synchronize users and groups from an on-premises Active Directory to Cloud Identity. Which two prerequisites must be met? (Choose two.)

Accepted Answer

A Cloud Identity or Google Workspace account with super admin privileges.. Google Cloud Directory Sync (GCDS) requires a Cloud Identity or Google Workspace account with super admin privileges (Option C) to authenticate and perform synchronization. Additionally, the GCDS server must have network connectivity to Google servers (Option E) to access the Google API endpoints for directory sync.

Answer

A service account with the Directory Sync role.

Answer

An organization policy that allows directory sync.

Answer

A Compute Engine VM to run the GCDS service.

Question 14

A company needs to grant developers the ability to deploy applications to App Engine, but they should not be able to modify IAM policies. Which two roles should be assigned to the developers? (Choose two.)

Accepted Answer

roles/appengine.serviceAdmin. The correct roles are App Engine Deployer and App Engine Service Admin. App Engine Admin includes IAM policy modification.

Answer

roles/owner

Answer

roles/appengine.appViewer

Answer

roles/appengine.appAdmin

Question 15

An organization wants to restrict the creation of service accounts to only certain projects. Which two approaches can achieve this? (Choose two.)

Accepted Answer

Create a custom role with iam.serviceAccounts.create permission and assign it to a group, then use IAM conditions to restrict the resource to specific projects.. Two correct approaches: (B) Create a custom role with the iam.serviceAccounts.create permission and assign it to a group with IAM conditions restricting resource to specific projects, and (D) Use an organization policy with constraint constraints/iam.disableServiceAccountCreation set to True at the org level, then create a folder policy to allow creation in specific folders.

Answer

Use a deny policy to block service account creation in all projects except the allowed ones.

Answer

Grant the roles/iam.serviceAccountAdmin role only to users in the allowed projects.

Answer

Create a separate organization for the allowed projects.