PCSE Managing Operations in a Cloud Solution Environment — 40 Questions

Question 1

A security team wants to analyze VPC Flow Logs for potential data exfiltration. They need a solution that allows querying with SQL and requires minimal setup. Which approach should they take?

Accepted Answer

Export VPC Flow Logs to BigQuery via a log sink, then run SQL queries.. VPC Flow Logs can be exported to BigQuery via a logs sink, which enables SQL analysis. BigQuery is the best option because it supports standard SQL and requires no management. Chronicle is a SIEM with its own query language (YARA-L) and requires ingestion configuration; Cloud Logging has limited query power compared to BigQuery; Cloud SQL would require additional ingestion logic.

Answer

Ingest VPC Flow Logs into Chronicle and use YARA-L rules.

Answer

Stream VPC Flow Logs to Cloud SQL using a custom pipeline.

Answer

Export VPC Flow Logs to Cloud Logging and use Log Analytics with SQL.

Question 2

A security engineer needs to ensure that all Google Cloud API calls in the organization are logged and retained for 7 years for compliance. Admin Activity logs are enabled by default but retention is limited. Which combination of actions should the engineer take?

Accepted Answer

Create a log sink with _Required log view filter to export Admin Activity logs to Cloud Storage with a retention policy of 7 years.. Admin Activity logs are enabled by default but cannot be retained beyond the default period (400 days for audit logs). To retain for 7 years, you must use a log sink to export them to Cloud Storage (which can be configured with retention policies). BigQuery is for analysis, not archival. The default retention cannot be changed.

Answer

Create a log sink to export Admin Activity logs to BigQuery and set the table expiration to 7 years.

Answer

Enable Data Access logs for all services and set a custom retention period of 7 years on the log bucket.

Answer

Enable the 'Admin Activity logs' retention to 7 years in the Logging settings.

Question 3

A company wants to receive real-time notifications when Security Command Center (SCC) detects a high-severity vulnerability in their Google Cloud projects. They need to integrate with their existing SIEM. Which approach should they use?

Accepted Answer

Create a Pub/Sub notification config in SCC for the desired finding types and have the SIEM subscribe to the Pub/Sub topic.. SCC findings can be exported to Pub/Sub for real-time integration. The SIEM can subscribe to the Pub/Sub topic. Cloud Logging can also be used but SCC does not directly write findings to Logging. Cloud Functions alone would require Pub/Sub as trigger.

Answer

Use the SCC API to poll for new findings every minute and push them to the SIEM via a custom script.

Answer

Enable Event Threat Detection in SCC Premium tier and configure it to stream findings to Cloud Logging via a log sink.

Answer

Configure SCC to send findings to Cloud Logging and set up a log-based metric that triggers a Cloud Function to send to the SIEM.

Question 4

A DevOps team is implementing Binary Authorization for a GKE cluster. They want to ensure that only container images signed by a specific attestor can be deployed. They have created the attestor and configured Cloud KMS for signing. Which additional step is required to enforce the policy?

Accepted Answer

Create a Binary Authorization policy that requires at least one attestation and attach it to the GKE cluster.. Binary Authorization requires a policy to enforce attestation. The policy must be set to 'Require Attestations' and attached to the GKE cluster (via a policy binding). Creating the attestor alone is insufficient. The policy can be set at project level.

Answer

Enable the 'gke-binary-authorization' feature flag on the cluster and update the kubeconfig.

Answer

Create a policy that allows all images and then override it with an admission webhook.

Answer

Configure the container registry to block unsigned images by setting a repository-level policy.

Question 5

A security analyst needs to investigate a potential breach in a Compute Engine instance. They want to create an offline forensic copy of the disk without affecting the running instance. Which action should they take?

Accepted Answer

Stop the instance and create a snapshot of the boot disk.. Creating a snapshot is the correct method to create a point-in-time copy of a persistent disk for forensic analysis. The snapshot can be used to create a new disk for analysis. Stopping or creating an image modifies the instance state or does not preserve all data.

Answer

Create an image from the disk while the instance is running.

Answer

Use the gcloud compute disks copy command to replicate the disk.

Answer

Attach a new blank disk to the instance and use dd to clone the data.

Question 6

A company is using Security Command Center (SCC) Standard tier and wants to detect threats like crypto mining attacks and anomalous IAM activity in their GCP environment. Which built-in service should they enable?

Accepted Answer

Event Threat Detection. Event Threat Detection is a premium tier service that detects threats such as crypto mining and suspicious IAM activity. Security Health Analytics is misconfigurations. Web Security Scanner is for web apps. VM Threat Detection is also premium but for VMs.

Answer

Security Health Analytics

Answer

Web Security Scanner

Answer

VM Threat Detection

Question 7

An organization uses Chronicle SIEM to ingest logs from multiple GCP projects and on-premises firewalls. They need to write a detection rule that triggers when an IP address makes more than 100 failed login attempts across different GCP projects within 10 minutes. Which Chronicle feature should they use?

Accepted Answer

YARA-L detection rule. YARA-L is the detection language for Chronicle. It allows multi-event correlation across data sources, including timestamps and grouping by source IP. UDM is the data model. Dashboards are visual. Reference lists are for static data.

Answer

Dashboard and alerting

Answer

Reference list

Answer

Unified Data Model (UDM)

Question 8

A company wants to scan all container images stored in Artifact Registry for vulnerabilities before deployment. Which Google Cloud service should they use?

Accepted Answer

Container Analysis. Container Analysis (now part of Artifact Registry) provides vulnerability scanning for images. Binary Authorization enforces policies. Security Command Center aggregates findings. Cloud Build is for building images.

Answer

Binary Authorization

Answer

Cloud Build

Answer

Security Command Center

Question 9

A security team needs to detect and respond to a potential data exfiltration via VPC Flow Logs. They want to identify traffic to known malicious IP addresses in real-time. Which architecture should they use?

Accepted Answer

Create a log sink to send VPC Flow Logs to Pub/Sub, trigger a Cloud Function that checks IP addresses against a threat list and sends alerts.. VPC Flow Logs can be streamed via a log sink to Pub/Sub, then processed by Cloud Functions to compare against a threat feed. BigQuery is for analysis, not real-time. Dataflow could be used but is more complex. Cloud NAT is unrelated.

Answer

Enable VPC Flow Logs and use Dataflow to stream logs to a third-party SIEM.

Answer

Use Cloud NAT to block traffic to malicious IPs based on a predefined list.

Answer

Export VPC Flow Logs to BigQuery and schedule a query every minute to check for matches.

Question 10

A company wants to enforce that all GKE clusters in their organization use Binary Authorization with a specific attestor. They have multiple projects and want to set this policy centrally. Which approach should they use?

Accepted Answer

Use the organization policy service to set a constraint that requires Binary Authorization enforcement across all projects.. Organization policies can enforce constraints at the organization, folder, or project level. The Binary Authorization policy can be set at the organization level using a constraint, but the specific attestor configuration is done via the Binary Authorization API per project. However, to enforce the use of Binary Authorization, you can use an organization policy constraint 'constraints/gcp.restrictBinaryAuthorizationPolicy'.

Answer

Create a Binary Authorization policy in each project and use a script to apply it.

Answer

Create a shared VPC and enable Binary Authorization on the host project.

Answer

Use Deployment Manager to deploy Binary Authorization configuration to all projects.

Question 11

Which Security Command Center (SCC) tier provides built-in compliance monitoring for standards like CIS and PCI DSS?

Accepted Answer

Premium tier. Compliance monitoring is a feature of SCC Premium tier. Standard tier includes Security Health Analytics but not compliance monitoring. Event Threat Detection is also Premium.

Answer

Neither; compliance monitoring is part of Cloud Audit Logs

Answer

Both Standard and Premium

Answer

Standard tier

Question 12

A company needs to archive their VPC Flow Logs for 10 years for compliance. They also need to run occasional queries on the logs. What is the most cost-effective approach?

Accepted Answer

Create a log sink to export VPC Flow Logs to Cloud Storage with a retention policy of 10 years and use BigQuery external tables for occasional queries.. Exporting logs to Cloud Storage with a retention policy is the most cost-effective for long-term archival. BigQuery is more expensive for storage but allows queries. Using a log sink with _Default log view includes VPC Flow Logs (if enabled).

Answer

Export VPC Flow Logs to both Cloud Storage and BigQuery simultaneously.

Answer

Create a log sink to export VPC Flow Logs to BigQuery and set a table partition expiration to 10 years.

Answer

Enable VPC Flow Logs and set the log bucket retention to 10 years.

Question 13

During an incident response, a security engineer needs to analyze a Pub/Sub message that was produced by a Cloud Function triggered by a SCC finding. The message has been acknowledged and deleted from the subscription. How can the engineer retrieve the message again?

Accepted Answer

Use the 'gcloud pubsub subscriptions seek' command with a snapshot or timestamp to replay the message.. Pub/Sub supports message replay by seeking a snapshot or a timestamp. This allows reprocessing messages that have been acknowledged. There is no 'dead-letter queue' for this scenario. Cloud Logging logs the message payload if configured, but not by default.

Answer

Submit a support ticket to Google to recover the message from internal storage.

Answer

Check the Cloud Function logs to view the message payload.

Answer

Create a new subscription to the same topic and enable 'retain_acked_messages' before the message was published.

Question 14

A company is using Security Command Center (SCC) Premium tier and wants to automatically remediate certain high-severity findings. Which two services can be used together to achieve this? (Choose two.)

Accepted Answer

Pub/Sub. SCC findings can be sent to Pub/Sub, which then triggers a Cloud Function (or Cloud Run) that performs automated remediation actions. Cloud Functions can be used for lightweight automation. Cloud Scheduler is for cron jobs, not event-driven. Dataflow is for data processing. IAM is for access control.

Answer

Dataflow

Answer

Cloud Scheduler

Answer

Cloud IAM

Question 15

A security team needs to detect anomalous outbound traffic from Compute Engine instances. They want to enable logging and analyze the data. Which three steps should they take? (Choose three.)

Accepted Answer

Enable VPC Flow Logs on the subnets where the instances are located.. To detect anomalous outbound traffic, you need to enable VPC Flow Logs (which log outbound traffic), export them to BigQuery for analysis (using a log sink), and query the data. Cloud NAT is for outbound connectivity with NAT, but not logging. Packet Mirroring copies traffic but is not necessary for flow logs. Firewall Rules logging logs firewall hits, not all outbound traffic.

Answer

Enable Cloud NAT logging to capture outbound traffic.

Answer

Enable Packet Mirroring to duplicate all outbound packets.

Question 16

A company wants to implement a vulnerability management program for their Google Cloud environment. They need to scan Compute Engine instances for OS vulnerabilities and container images for known vulnerabilities. Which two services should they use? (Choose two.)

Accepted Answer

VM Manager (OS patch assessment). VM Manager patch management can assess and patch OS vulnerabilities on Compute Engine instances. Container Analysis (Artifact Registry) scans container images for vulnerabilities. Web Security Scanner is for web apps. Binary Authorization is for attestation. Cloud Security Scanner does not exist.

Answer

Cloud Security Scanner

Answer

Binary Authorization

Answer

Web Security Scanner

Question 17

Your organization wants to monitor and audit IAM permission changes in real time. Which type of Cloud Audit Log is enabled by default and cannot be disabled?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs record API calls and administrative actions that modify the configuration or metadata of resources. They are enabled by default and cannot be disabled, making them ideal for monitoring IAM permission changes.

Answer

Data Access audit logs

Answer

System Event audit logs

Answer

Policy Denied audit logs

Question 18

A security engineer wants to export Cloud Audit Logs to a third-party SIEM in real time. Which log sink destination should they configure?

Accepted Answer

Pub/Sub. To export logs in real time, configure a log sink with a Pub/Sub topic as the destination. The SIEM can then subscribe to that topic.

Answer

BigQuery

Answer

Cloud Storage

Answer

Logging bucket

Question 19

An organization uses Security Command Center Premium tier. They want to receive notifications when a finding of type 'Cryptomining' is detected in their Compute Engine instances. What should they configure?

Accepted Answer

Event Threat Detection and a Pub/Sub notification config. Event Threat Detection (Premium) detects cryptomining. You set up a notification config in SCC to send findings of that type to Pub/Sub.

Answer

Container Threat Detection and an email alert

Answer

Security Health Analytics and a Cloud Storage bucket

Answer

Web Security Scanner and a Cloud Function

Question 20

A company enforces Binary Authorization on a GKE cluster. They want to require that all container images be signed by a specific attestor located in a different project. What must be configured?

Accepted Answer

A policy that requires attestation, an attestor in the same or different project, and a service account on the GKE node with the appropriate IAM permissions to access the attestor.. Binary Authorization allows attestors in different projects. The key requirement is the proper IAM role (roles/binaryauthorization.attestorsVerifier) on the GKE service account.

Answer

A Binary Authorization policy that allows all images, and an attestor with the same name in both projects.

Answer

A Cloud KMS key for the attestor in the same project as the cluster, and a policy that requires attestation.

Answer

A policy that denies all images, and a separate attestor for each project.