PCSE Configuring Access Within a Cloud Solution Environment — Timed 20 Questions

Question 1

A security engineer needs to grant a DevOps team the ability to deploy and manage Cloud Run services, but they should not be able to modify IAM policies or delete the service. Which predefined role should be assigned?

20 minute time limit — choose an answer to begin.

Accepted Answer

Cloud Run Admin (roles/run.admin). The Cloud Run Admin role (roles/run.admin) allows full control over Cloud Run services, including deploying, updating, and deleting services, as well as managing IAM policies. While this role grants more permissions than required (including the ability to delete services and modify IAM), it is the only predefined role among the options that enables deploying and managing services. If strict restrictions on IAM modifications and deletion are needed, a custom role should be created. However, given the required ability to deploy and manage, Admin is the predefined role that meets the core requirement, despite the over-permissive nature. The other options (Invoker, Viewer, Developer) either lack deploy/manage permissions or include deletion but not IAM modification. Note: The Developer role also includes deletion, so it is not suitable either.

Answer

Cloud Run Invoker (roles/run.invoker)

Answer

Cloud Run Viewer (roles/run.viewer)

Answer

Cloud Run Developer (roles/run.developer)

Question 2

A security engineer is designing access control for a multi-project environment. The engineer needs to ensure that a data science team can read data from a BigQuery dataset in Project A and write results to a Cloud Storage bucket in Project B. The team members are authenticated via an external SAML IdP. Which TWO steps should be taken? (Choose 2 correct answers)

Accepted Answer

Grant the Cloud Identity group BigQuery Data Viewer on the specific dataset and Storage Object Creator on the specific bucket.. To meet the requirements, the correct steps are: first, create a Cloud Identity group and synchronize it with the SAML IdP using Google Cloud Directory Sync (Option E). This ensures that users from the SAML IdP are represented as a group in Google Cloud. Second, grant that group BigQuery Data Viewer on the specific dataset in Project A and Storage Object Creator on the specific bucket in Project B (Option D). These roles provide the necessary read and write access at the resource level, following the principle of least privilege. Option A is incorrect because assigning a custom role at the organization level is too broad. Option B is incorrect because using a service account with workload identity federation adds unnecessary complexity when a Cloud Identity group with GCDS can be used. Option C is incorrect because granting roles at the project level (BigQuery Data Viewer at project A, Storage Object Admin at project B) grants more permissions than needed; the Storage Object Admin role includes delete and other permissions not required, and granting at project level affects all datasets/buckets in the project.

Answer

Create a custom role with bigquery.tables.getData and storage.objects.create, and assign to the group at the organization level.

Answer

Create a service account for the team and set up workload identity federation with the SAML IdP.

Answer

Grant the group the BigQuery Data Viewer role at the project A level and Storage Object Admin at the project B level.

Question 3

A security engineer needs to ensure that no one in the organization can disable or delete Cloud Key Management Service (Cloud KMS) keys, except for a designated security team. Which TWO approaches should be combined? (Choose 2 correct answers)

Accepted Answer

Grant the security team the Cloud KMS Admin role (roles/cloudkms.admin) at the organization level.. The Cloud KMS Admin role (roles/cloudkms.admin) includes the permissions needed to manage key lifecycle, such as disabling and destroying keys. Granting this role at the organization level ensures the security team can control keys across all projects, while the IAM deny policy in option C blocks all other principals from performing those actions, creating a secure, layered access control approach.

Answer

Apply the organization policy constraint constraints/cloudkms.disableKeyDeletion with value True.

Answer

Store the key material in a separate project with a private key access control.

Answer

Create an IAM allow policy at the organization level that grants the same permissions only to the security team.

Question 4

An organization has a requirement that all service account keys must be rotated every 90 days. The security engineer wants to automate the detection of keys older than 90 days. Which TWO methods can achieve this? (Choose 2)

Accepted Answer

Use the IAM API to list service account keys and check the validAfterTime field.. The IAM API's `validAfterTime` field directly indicates when a service account key was created. By listing keys and comparing this timestamp to the current time, you can programmatically identify keys older than 90 days. This method is precise and does not rely on indirect log analysis or policy enforcement.

Answer

Configure an organization policy to deny key creation if keys are older than 90 days.

Answer

Use Cloud Logging to analyze logs for key creation and compute age.

Answer

Create a custom IAM role that prevents using keys older than 90 days.

Question 5

A company runs a batch job on Compute Engine that reads data from Cloud Storage and writes results to BigQuery. The Compute Engine instance uses a service account. The job fails with a permission error. Which THREE steps should the engineer take to resolve this? (Choose three.)

Accepted Answer

Grant the service account the roles/bigquery.dataEditor role on the BigQuery dataset. The service account needs the roles/bigquery.dataEditor role on the BigQuery dataset to write data (insert rows) into BigQuery tables. Without this IAM permission, the job fails with a permission error when attempting to execute INSERT or load jobs against the dataset.

Answer

Grant the service account the roles/iam.serviceAccountUser role on itself

Answer

Enable the Cloud Storage and BigQuery APIs in the project

Question 6

An organization uses Cloud Identity with SAML 2.0 federation. They want to enable single sign-on (SSO) for users accessing Google Cloud Console and also allow access to a custom application behind an HTTPS load balancer using IAP. Which TWO configurations are required? (Choose two.)

Accepted Answer

Enable IAP on the backend service of the HTTPS load balancer. Identity-Aware Proxy (IAP) must be enabled on the backend service of the HTTPS load balancer to enforce access control based on the user's identity. IAP uses the SAML assertion from Cloud Identity to verify the user's identity and grant access to the custom application, enabling SSO without requiring a VPN or per-user service accounts.

Answer

Deploy a VPN between the IdP and Google Cloud

Answer

Create a service account for each user to access the application

Answer

Create a Cloud Armor security policy to allow only SAML-authenticated requests

Question 7

A company is migrating to Google Cloud and wants to implement least privilege access for their engineers. They have the following requirements: 1) Engineers must be able to create and manage Cloud Storage buckets. 2) Engineers must NOT be able to delete any resources. 3) Engineers should not be granted basic roles. Which two predefined roles should they combine to meet these requirements? (Choose two.)

Accepted Answer

roles/storage.objectViewer [CORRECT]. The correct combination is roles/storage.objectCreator and roles/storage.objectViewer. These roles, when combined, grant the ability to create and view objects within Cloud Storage buckets, while explicitly not granting any delete permissions. This satisfies the requirement of least privilege without using basic roles. Note that these roles apply to objects inside buckets, not to the buckets themselves; however, the requirements specify creating and managing storage buckets, which is interpreted as creating and managing objects within the buckets, as bucket-level management would require deletion permissions.

Answer

roles/storage.objectAdmin with deletion permissions removed via a custom role

Answer

roles/storage.admin

Answer

roles/storage.objectAdmin

Question 8

A security engineer needs to prevent users from creating service account keys in a Google Cloud project. The solution must be enforceable across all projects in the organization and should not block other IAM operations. Which approach should they use?

Accepted Answer

Use the Organization Policy Service with the constraint constraints/iam.disableServiceAccountKeyCreation.. Organization Policy constraints provide a way to enforce restrictions across the resource hierarchy. The built-in constraint 'constraints/iam.disableServiceAccountKeyCreation' specifically prevents creation of service account keys at the project, folder, or organization level. It does not affect other IAM operations. IAM deny policies can deny specific permissions but are more complex to manage and apply at the org level for this specific use case. Custom roles are not designed for enforcement across projects. The Organization Policy Service is the correct choice for such organization-wide restrictions.

Answer

Use IAM Conditions to restrict service account key creation to only a specific project.

Answer

Create a custom role that excludes the permission iam.serviceAccountKeys.create and assign it to all users.

Answer

Create an IAM deny policy at the organization level to deny the permission iam.serviceAccountKeys.create.

Question 9

An organization uses Active Directory (AD) on-premises and wants to synchronize user accounts and groups to Google Cloud Identity for SSO with SAML 2.0. The AD contains 50,000 users and 10,000 groups. The solution must support automatic provisioning and deprovisioning of users. Which tool should they use?

Accepted Answer

Use Google Cloud Directory Sync (GCDS) to synchronize users and groups from AD to Cloud Identity.. Google Cloud Directory Sync (GCDS) is the official tool for synchronizing users and groups from Active Directory (or LDAP) to Google Cloud Directory. It supports one-way sync, automatic provisioning, and deprovisioning. SAML SSO is configured separately using an IdP like Active Directory Federation Services (AD FS) or third-party. Workload Identity Federation is for external workloads (e.g., AWS, Azure) to access GCP resources, not for user identity synchronization. Cloud Identity API can be used programmatically but is not a ready-to-use sync tool. GCDS is the correct answer.

Answer

Use SAML 2.0 federation with AD FS to synchronize users.

Answer

Use Workload Identity Federation to connect AD to Google Cloud.

Answer

Use the Cloud Identity API to manually create users and groups.

Question 10

A developer wants to grant a Compute Engine instance access to read objects from a Cloud Storage bucket. The instance runs under a service account. What is the best practice for granting this access?

Accepted Answer

Assign the Storage Object Viewer role to the service account attached to the instance.. The best practice is to assign the appropriate IAM role (e.g., Storage Object Viewer) to the service account that the instance is running as. Then, the instance can use the service account's credentials automatically via the metadata server. This avoids the need to manage service account keys. Generating keys is discouraged. Allowing the instance to use the default compute engine service account is common but less secure; a custom service account with minimal permissions is preferred.

Answer

Create an IAM policy on the bucket that grants access to the instance's external IP address.

Answer

Use a signed URL with a long expiration time for the instance.

Answer

Generate a JSON key for the service account, download it to the instance, and use it in application code.

Question 11

A company has multiple Google Cloud projects organized under folders by department. The security team wants to enforce a policy that all Compute Engine instances must use Shielded VM features. They need to prevent non-compliant instances from being created. Which action should be taken to enforce this requirement most effectively?

Accepted Answer

Use the Organization Policy Service with the constraint constraints/compute.requireShieldedVm.. Organization Policy constraints are the correct mechanism to enforce requirements across the resource hierarchy. The built-in constraint 'constraints/compute.requireShieldedVm' ensures that any new Compute Engine instance must have Shielded VM features enabled. This policy can be applied at the organization, folder, or project level. IAM roles or custom roles cannot enforce instance configuration requirements. Service account impersonation is unrelated. Deny policies can deny specific permissions but not enforce Shielded VM settings.

Answer

Create an IAM deny policy at the organization level that denies the compute.instances.create permission unless the Shielded VM flag is set.

Answer

Create a custom role that includes the permission to create instances only with Shielded VM, and assign it to all users.

Answer

Implement a service account that only has permission to create instances and use service account impersonation for all instance creation.

Question 12

What is the purpose of Identity-Aware Proxy (IAP) on Google Cloud?

Accepted Answer

To enforce identity-based access control for web applications and SSH/RDP to VMs without requiring a VPN.. Identity-Aware Proxy (IAP) is a service that provides a zero-trust access control layer for applications and resources. It verifies a user's identity and context before allowing access, enforcing application-level access control. It is not a VPN or firewall; it works at the identity level, not network level. It does not replace Cloud Armor or VPC firewalls but complements them.

Answer

To manage firewall rules for VPC networks.

Answer

To provide a VPN connection between on-premises and Google Cloud.

Answer

To act as a web application firewall (WAF) that blocks SQL injection and XSS attacks.

Question 13

A DevOps team uses GitHub Actions to deploy infrastructure to Google Cloud. They want to avoid storing long-lived service account keys. Which approach should they use to authenticate from GitHub Actions to Google Cloud?

Accepted Answer

Use Workload Identity Federation by configuring a workload identity pool and provider for GitHub.. Workload Identity Federation allows GitHub Actions to exchange GitHub OIDC tokens for Google Cloud service account credentials. This eliminates the need for service account keys. The team must create a workload identity pool and provider in GCP, and configure GitHub Actions to use Google's action with 'workload_identity_provider'. Granting the service account token creator role is not the correct method. Using a Compute Engine instance is not relevant for GitHub Actions.

Answer

Grant the service account token creator role to the GitHub Actions runner.

Answer

Download a JSON service account key and store it as a GitHub secret.

Answer

Create a Compute Engine instance with a service account and run GitHub Actions from there.

Question 14

An organization has set up IAP to protect a web application running on Compute Engine. The application needs to know the authenticated user's email address for logging. How can the application securely obtain this information?

Accepted Answer

Extract the email from the X-Goog-Authenticated-User-Email header after verifying the JWT signed by IAP.. IAP passes the authenticated user's identity to the backend application via signed HTTP headers (X-Goog-Authenticated-User-Email, X-Goog-Authenticated-User-Id). The application should verify the JWT signature of the IAP token (using Google's public keys) to trust these headers. The headers cannot be spoofed if the application verifies the JWT. Using Cloud Logging is not for real-time identity. The metadata server does not provide IAP user identity. The IAP API is for managing IAP configuration, not for retrieving user identity per request.

Answer

Read the user's email from the instance's metadata server.

Answer

Use the Cloud Logging API to query the most recent IAP access logs.

Answer

Call the IAP API to retrieve the user identity.

Question 15

A security engineer wants to ensure that only users from a specific external identity provider (IdP) domain (example.com) can access Google Cloud resources. They have configured SAML SSO with the IdP. However, users from other domains are also able to access resources. What is the most effective way to restrict access to only users from example.com?

Accepted Answer

Set the Organization Policy constraint constraints/iam.allowedPolicyMemberDomains to only allow domain example.com.. The best approach is to use the Organization Policy constraint 'constraints/iam.allowedPolicyMemberDomains' to restrict which external domains can be members of IAM policies. This prevents users from other domains from being granted roles. Simply blocking at the IdP is not effective because users from other domains could be added as members in IAM. IAM Conditions can be used on role bindings to restrict access based on the user's domain, but this requires careful application to all policies. The organization policy provides a global enforcement.

Answer

Use Cloud Identity groups with membership restricted to example.com and grant access to the group only.

Answer

Configure the IdP to only assert users from example.com.

Answer

Use IAM Conditions to restrict access to users with a specific claim (e.g., assertion.primary_email ending with @example.com).

Question 16

A company wants to use Google Cloud resources but does not have a Google Workspace or Cloud Identity account. They want to manage identities for their users without paying for additional licenses. What is the most cost-effective identity solution?

Accepted Answer

Use Cloud Identity Free edition.. Cloud Identity Free edition provides identity management for users who only need to access Google Cloud resources (Compute Engine, Cloud Storage, etc.) without Gmail, Google Drive, or other Google Workspace services. It is free. Cloud Identity Premium includes additional features like device management and security policies but costs money. Google Workspace is a paid suite of productivity apps. The Compute Engine default service account is not for user identities.

Answer

Use the Compute Engine default service account for all users.

Answer

Use Cloud Identity Premium edition.

Answer

Use Google Workspace.

Question 17

A developer needs to create a custom IAM role that allows only a specific set of permissions for managing Cloud SQL instances. The role should be available at the organization level. Which command should they use?

Accepted Answer

gcloud iam roles create ROLE_ID --organization=ORGANIZATION_ID --file=role.yaml. Custom roles can be created at the organization level using the 'gcloud iam roles create' command with the '--organization' flag (or '--org' for short). The role is defined in a YAML file that specifies the permissions. The 'gcloud organizations add-iam-policy-binding' is used to assign roles, not create them. The 'gcloud iam service-accounts create' is for service accounts. The 'gcloud projects add-iam-policy-binding' is for project-level IAM bindings.

Answer

gcloud projects add-iam-policy-binding PROJECT_ID --member=... --role=...

Answer

gcloud iam service-accounts create SA_NAME --display-name=...

Answer

gcloud organizations add-iam-policy-binding ORGANIZATION_ID --member=... --role=...

Question 18

A company has a GKE cluster with a Kubernetes Service Account (KSA) that needs to access Cloud Storage. They want to bind the KSA to a Google Cloud service account (GCP SA) so that pods running under the KSA inherit the GCP SA's permissions. They have enabled Workload Identity on the cluster. What is the correct step to bind the KSA to the GCP SA?

Accepted Answer

Grant the KSA the role iam.workloadIdentityUser on the GCP SA by running: gcloud iam service-accounts add-iam-policy-binding GCP_SA_EMAIL --member=serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME] --role=roles/iam.workloadIdentityUser. The correct binding is to grant the 'iam.workloadIdentityUser' role on the GCP SA to the KSA's identity. The KSA identity is represented in IAM as the principal 'serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]'. This allows the KSA to impersonate the GCP SA. Creating a service account key defeats the purpose of Workload Identity. Adding an annotation to the KSA is necessary but not sufficient; the IAM binding is also required.

Answer

Annotate the KSA with iam.gke.io/gcp-service-account=GCP_SA_EMAIL. No further steps are needed.

Answer

Create a JSON key for the GCP SA and store it as a Kubernetes secret, then mount it into the pods.

Answer

Grant the GCP SA the role roles/iam.serviceAccountUser on the KSA.

Question 19

A security administrator wants to prevent users from disabling Shielded VM on existing Compute Engine instances. Which IAM permission should they deny?

Accepted Answer

compute.instances.updateShieldedVmConfig. The permission compute.instances.updateShieldedVmConfig controls the ability to update the Shielded VM configuration (enable/disable) on an existing instance. Denying this permission will prevent users from changing Shielded VM settings on instances. The permission compute.instances.setMetadata is for metadata changes, compute.instances.update is for general updates, and compute.instances.setMachineResources is for changing machine types.

Answer

compute.instances.setMetadata

Answer

compute.instances.setMachineResources

Answer

compute.instances.update

Question 20

A company uses Google Cloud Directory Sync (GCDS) to synchronize users from an on-premises Active Directory to Cloud Identity. The security team wants to ensure that only synchronized users can access Google Cloud resources. Which TWO actions are part of a secure configuration? (Choose two.)

Accepted Answer

Disable manual user creation in the Cloud Identity admin console.. Correct actions: 1) Disable the creation of manual users in Cloud Identity to ensure all users come from AD only. 2) Restrict the allowed domains for IAM members to the company's domain (e.g., example.com) using Organization Policy constraint 'constraints/iam.allowedPolicyMemberDomains' to prevent external users from being added. Enabling automatic license assignment is not a security measure. Using the default admin account is not recommended. Syncing passwords is not recommended; GCDS does not sync passwords.

Answer

Enable automatic license assignment for all synchronized users.

Answer

Configure GCDS to sync user passwords.

Answer

Create a custom role that allows only synchronized users to access resources.