PCSE Managing Operations in a Cloud Solution Environment Practice Test 2 — 15 Questions

Question 1

Your organization wants to monitor and audit IAM permission changes in real time. Which type of Cloud Audit Log is enabled by default and cannot be disabled?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs record API calls and administrative actions that modify the configuration or metadata of resources. They are enabled by default and cannot be disabled, making them ideal for monitoring IAM permission changes.

Answer

Data Access audit logs

Answer

System Event audit logs

Answer

Policy Denied audit logs

Question 2

A security engineer wants to export Cloud Audit Logs to a third-party SIEM in real time. Which log sink destination should they configure?

Accepted Answer

Pub/Sub. To export logs in real time, configure a log sink with a Pub/Sub topic as the destination. The SIEM can then subscribe to that topic.

Answer

BigQuery

Answer

Cloud Storage

Answer

Logging bucket

Question 3

An organization uses Security Command Center Premium tier. They want to receive notifications when a finding of type 'Cryptomining' is detected in their Compute Engine instances. What should they configure?

Accepted Answer

Event Threat Detection and a Pub/Sub notification config. Event Threat Detection (Premium) detects cryptomining. You set up a notification config in SCC to send findings of that type to Pub/Sub.

Answer

Container Threat Detection and an email alert

Answer

Security Health Analytics and a Cloud Storage bucket

Answer

Web Security Scanner and a Cloud Function

Question 4

A company enforces Binary Authorization on a GKE cluster. They want to require that all container images be signed by a specific attestor located in a different project. What must be configured?

Accepted Answer

A policy that requires attestation, an attestor in the same or different project, and a service account on the GKE node with the appropriate IAM permissions to access the attestor.. Binary Authorization allows attestors in different projects. The key requirement is the proper IAM role (roles/binaryauthorization.attestorsVerifier) on the GKE service account.

Answer

A Binary Authorization policy that allows all images, and an attestor with the same name in both projects.

Answer

A Cloud KMS key for the attestor in the same project as the cluster, and a policy that requires attestation.

Answer

A policy that denies all images, and a separate attestor for each project.

Question 5

Which Security Command Center tier includes Event Threat Detection and Container Threat Detection?

Accepted Answer

Premium tier. Premium tier adds threat detection services beyond the Standard tier's health analytics and scanner.

Answer

Standard tier

Answer

Basic tier

Answer

Enterprise tier

Question 6

A security team wants to analyze VPC Flow Logs to investigate a potential data exfiltration incident. The logs are currently stored in Cloud Logging. What is the MOST efficient method to query and visualize the network traffic patterns?

Accepted Answer

Use Log Analytics in Cloud Logging with SQL queries. Log Analytics (powered by BigQuery) in Cloud Logging provides SQL-based analysis directly on logs without needing to export.

Answer

Enable VPC Flow Logs on a new VM and capture traffic

Answer

Export logs to Cloud Storage and analyze with a local tool

Answer

Create a log sink to BigQuery and use BigQuery for analysis

Question 7

An organization uses Binary Authorization with multiple attestors. They want to allow a deployment only if at least two attestors have signed the image. Which policy type should be used?

Accepted Answer

Require attestation with a list of attestors and a minimum number of 2. Binary Authorization allows you to define a policy with multiple attestors and set a minimum number of attestations required.

Answer

Allow all images

Answer

Require attestation with a single attestor

Answer

Deny all images

Question 8

A security engineer needs to automatically remediate a high-severity finding in Security Command Center. The remediation involves restarting a Compute Engine instance. What is the recommended approach?

Accepted Answer

Create a Cloud Function triggered by a Pub/Sub notification from SCC, and use the Compute Engine API to restart the instance.. SCC notifications to Pub/Sub and Cloud Functions is the standard pattern for automated remediation.

Answer

Configure a log sink to Cloud Functions and parse logs for the finding.

Answer

Use a Compute Engine startup script to check SCC and restart.

Answer

Use Cloud Scheduler to periodically check SCC and restart instances.

Question 9

Which Google Cloud service should be used for long-term archival of Audit Logs that must be immutable and stored for 10 years for compliance?

Accepted Answer

Cloud Storage with Archive storage class and retention policy. Cloud Storage with Archive storage class offers the lowest cost for long-term storage, and retention policies enforce immutability.

Answer

Cloud SQL with backups

Answer

BigQuery with time-based partitioning

Answer

Pub/Sub with message retention

Question 10

A security analyst wants to search for a specific IAM role change across all projects in the organization. Which tool can query Cloud Audit Logs across projects?

Accepted Answer

Cloud Logging Logs Explorer with a query that includes all projects in the organization. Logs Explorer allows querying logs across projects via resource scope, provided the user has the appropriate permissions.

Answer

Cloud Shell with gcloud logging read

Answer

Activity page in the Cloud Console (Home > Activity)

Answer

Cloud Monitoring dashboard

Question 11

During a forensic investigation, you need to analyze a Compute Engine instance that has been compromised. You want to preserve the disk state for analysis without affecting the running instance. Which action should you take?

Accepted Answer

Create a snapshot of the persistent disk and attach the snapshot to a new instance for analysis.. Creating a snapshot is the non-disruptive, best practice for forensic preservation.

Answer

Delete the instance but keep the disk, then attach the disk to a new instance.

Answer

Stop the instance and create a custom image from the boot disk.

Answer

Use gcloud compute disks export to export the disk to Cloud Storage.

Question 12

An organization wants to use Chronicle for SIEM. They need to ingest logs from an on-premises firewall. Which method should they use?

Accepted Answer

Use a forwarder (e.g., Syslog to UDM) to send logs to Chronicle. Chronicle provides forwarders (e.g., Syslog, Winlogbeat) that parse and send logs to the Chronicle backend.

Answer

Configure a log sink from Cloud Logging to Chronicle

Answer

Export logs to Cloud Storage and have Chronicle import them

Answer

Directly send logs to a Pub/Sub topic that is ingested by Chronicle

Question 13

A security team wants to automatically detect anomalies in user behavior across Google Workspace and Google Cloud. Which TWO Security Command Center features can help?

Accepted Answer

Compliance monitoring (Premium tier). Anomaly Detection (Standard) and Compliance monitoring (Premium) can both identify anomalous behavior patterns in user and resource activity.

Answer

Event Threat Detection

Answer

VM Threat Detection

Answer

Security Health Analytics

Question 14

A company runs containerized applications on GKE and uses Binary Authorization. They want to enforce that only images from a specific Artifact Registry repository can be deployed, and those images must be signed by a trusted attestor. Which THREE configurations are required?

Accepted Answer

Set up a Binary Authorization policy that requires attestation.. The three requirements: a Binary Authorization policy requiring attestation, an attestor (with note), and a policy constraint to restrict allowed registries.

Answer

Configure an Artifact Registry repository with a vulnerability scanning policy.

Answer

Create a Cloud KMS key and an attestor in the same project as the repository.

Question 15

An organization wants to use Web Security Scanner to find vulnerabilities in their web application. Which TWO finding types can Web Security Scanner detect?

Accepted Answer

Cross-site scripting (XSS). Web Security Scanner detects XSS, mixed content, outdated libraries, and other common web vulnerabilities, but not SQL injection or SSRF.

Answer

Insecure deserialization

Answer

Server-side request forgery (SSRF)

Answer

SQL injection