PCSE Managing Operations in a Cloud Solution Environment — 10 Questions

Question 1

A security engineer needs to ensure that all Google Cloud API calls in the organization are logged and retained for 7 years for compliance. Admin Activity logs are enabled by default but retention is limited. Which combination of actions should the engineer take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a log sink with _Required log view filter to export Admin Activity logs to Cloud Storage with a retention policy of 7 years.. Admin Activity logs are enabled by default and are part of the _Required log view, which cannot be modified or deleted. To retain them for 7 years, the engineer must export them via a log sink to a destination like Cloud Storage, where a custom retention policy can be applied. Option A correctly uses the _Required filter to capture Admin Activity logs and exports them to Cloud Storage with a 7-year retention policy, satisfying compliance requirements.

Answer

Create a log sink to export Admin Activity logs to BigQuery and set the table expiration to 7 years.

Answer

Enable Data Access logs for all services and set a custom retention period of 7 years on the log bucket.

Answer

Enable the 'Admin Activity logs' retention to 7 years in the Logging settings.

Question 2

A security analyst needs to investigate a potential breach in a Compute Engine instance. They want to create an offline forensic copy of the disk without affecting the running instance. Which action should they take?

Accepted Answer

Stop the instance and create a snapshot of the boot disk.. Stopping the instance and creating a snapshot of the boot disk produces a consistent, point-in-time copy suitable for forensic analysis without altering the running system. A stopped instance ensures no writes occur during snapshot creation, preserving evidence integrity.

Answer

Create an image from the disk while the instance is running.

Answer

Use the gcloud compute disks copy command to replicate the disk.

Answer

Attach a new blank disk to the instance and use dd to clone the data.

Question 3

A security team needs to detect and respond to a potential data exfiltration via VPC Flow Logs. They want to identify traffic to known malicious IP addresses in real-time. Which architecture should they use?

Accepted Answer

Create a log sink to send VPC Flow Logs to Pub/Sub, trigger a Cloud Function that checks IP addresses against a threat list and sends alerts.. VPC Flow Logs can be streamed via a log sink to Pub/Sub, then processed by Cloud Functions to compare against a threat feed. BigQuery is for analysis, not real-time. Dataflow could be used but is more complex. Cloud NAT is unrelated.

Answer

Enable VPC Flow Logs and use Dataflow to stream logs to a third-party SIEM.

Answer

Use Cloud NAT to block traffic to malicious IPs based on a predefined list.

Answer

Export VPC Flow Logs to BigQuery and schedule a query every minute to check for matches.

Question 4

A company wants to enforce that all GKE clusters in their organization use Binary Authorization with a specific attestor. They have multiple projects and want to set this policy centrally. Which approach should they use?

Accepted Answer

Use the organization policy service to set a constraint that requires Binary Authorization enforcement across all projects.. Organization policies can enforce constraints at the organization, folder, or project level. The Binary Authorization policy can be set at the organization level using a constraint, but the specific attestor configuration is done via the Binary Authorization API per project. However, to enforce the use of Binary Authorization, you can use an organization policy constraint 'constraints/gcp.restrictBinaryAuthorizationPolicy'.

Answer

Create a Binary Authorization policy in each project and use a script to apply it.

Answer

Create a shared VPC and enable Binary Authorization on the host project.

Answer

Use Deployment Manager to deploy Binary Authorization configuration to all projects.

Question 5

A company needs to archive their VPC Flow Logs for 10 years for compliance. They also need to run occasional queries on the logs. What is the most cost-effective approach?

Accepted Answer

Create a log sink to export VPC Flow Logs to Cloud Storage with a retention policy of 10 years and use BigQuery external tables for occasional queries.. Exporting VPC Flow Logs to Cloud Storage with a 10-year retention policy is cost-effective for long-term archival. Using BigQuery external tables allows querying the logs without ingesting them into BigQuery, avoiding storage costs in BigQuery. This approach meets both compliance and occasional query needs cost-effectively.

Answer

Export VPC Flow Logs to both Cloud Storage and BigQuery simultaneously.

Answer

Create a log sink to export VPC Flow Logs to BigQuery and set a table partition expiration to 10 years.

Answer

Enable VPC Flow Logs and set the log bucket retention to 10 years.

Question 6

During an incident response, a security engineer needs to analyze a Pub/Sub message that was produced by a Cloud Function triggered by a SCC finding. The message has been acknowledged and deleted from the subscription. How can the engineer retrieve the message again?

Accepted Answer

Use the 'gcloud pubsub subscriptions seek' command with a snapshot or timestamp to replay the message.. Pub/Sub supports message replay via the gcloud pubsub subscriptions seek command, which can rewind a subscription to a snapshot or a timestamp, causing previously acknowledged messages to be redelivered. Since the message was acked and deleted, seeking to a timestamp before the ack (or to a snapshot taken before) will replay it, making option D correct.

Answer

Submit a support ticket to Google to recover the message from internal storage.

Answer

Check the Cloud Function logs to view the message payload.

Answer

Create a new subscription to the same topic and enable 'retain_acked_messages' before the message was published.

Question 7

A company enforces Binary Authorization on a GKE cluster. They want to require that all container images be signed by a specific attestor located in a different project. What must be configured?

Accepted Answer

A policy that requires attestation, an attestor in the same or different project, and a service account on the GKE node with the appropriate IAM permissions to access the attestor.. Binary Authorization allows attestors in different projects. The key requirement is the proper IAM role (roles/binaryauthorization.attestorsVerifier) on the GKE service account.

Answer

A Binary Authorization policy that allows all images, and an attestor with the same name in both projects.

Answer

A Cloud KMS key for the attestor in the same project as the cluster, and a policy that requires attestation.

Answer

A policy that denies all images, and a separate attestor for each project.

Question 8

A security team wants to analyze VPC Flow Logs to investigate a potential data exfiltration incident. The logs are currently stored in Cloud Logging. What is the MOST efficient method to query and visualize the network traffic patterns?

Accepted Answer

Use Log Analytics in Cloud Logging with SQL queries. Log Analytics (powered by BigQuery) in Cloud Logging provides SQL-based analysis directly on logs without needing to export.

Answer

Enable VPC Flow Logs on a new VM and capture traffic

Answer

Export logs to Cloud Storage and analyze with a local tool

Answer

Create a log sink to BigQuery and use BigQuery for analysis

Question 9

A security analyst wants to search for a specific IAM role change across all projects in the organization. Which tool can query Cloud Audit Logs across projects?

Accepted Answer

Cloud Logging Logs Explorer with a query that includes all projects in the organization. Cloud Logging Logs Explorer supports queries scoped to an organization, folder, or project, allowing a single query to search audit logs across all projects in the organization. This is the native, scalable way to find an IAM role change anywhere in the org. The other options are either project-scoped or not designed for cross-project log queries.

Answer

Cloud Shell with gcloud logging read

Answer

Activity page in the Cloud Console (Home > Activity)

Answer

Cloud Monitoring dashboard

Question 10

During a forensic investigation, you need to analyze a Compute Engine instance that has been compromised. You want to preserve the disk state for analysis without affecting the running instance. Which action should you take?

Accepted Answer

Create a snapshot of the persistent disk and attach the snapshot to a new instance for analysis.. Creating a snapshot of the persistent disk captures the point-in-time state of the disk without modifying or stopping the running instance, preserving evidence integrity. The snapshot can then be used to create a new persistent disk attached to a separate analysis instance, allowing forensic examination in an isolated environment while the original instance continues running untouched.

Answer

Delete the instance but keep the disk, then attach the disk to a new instance.

Answer

Stop the instance and create a custom image from the boot disk.

Answer

Use gcloud compute disks export to export the disk to Cloud Storage.