PCSE Managing Operations in a Cloud Solution Environment Practice Test 2 — 15 Questions

Question 1

A security team is setting up Binary Authorization for their GKE clusters. They want to enforce that only images signed by an approved attestor can be deployed. Which TWO of the following are required for this setup?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an attestor in Binary Authorization.. Option A is correct because Binary Authorization requires you to create an attestor, which is the authority that validates attestations and is referenced in the policy to determine which images are allowed. Option E is correct because each attestor must be backed by a cryptographic key pair (typically a Cloud KMS asymmetric signing key) used to sign and verify attestations, so the attestor can authenticate that an approved authority signed the image. Option B is not required because Vulnerability Scanning is a separate Artifact Registry feature for detecting CVEs and plays no role in enforcing signature-based admission. Option C is not required because Binary Authorization is enforced by defining a policy that allows only attested images; the default 'Allow All' policy is replaced by your custom policy rather than being a separate mandatory step. Option D is not required because Container Analysis notes are created automatically when attestations are stored, so you do not need to manually create a note for each image.

Answer

Enable Vulnerability Scanning on Artifact Registry.

Answer

Disable the default 'Allow All' policy.

Answer

Create a Container Analysis note for each image.

Question 2

A company wants to use Cloud Audit Logs to monitor for security incidents. They need to retain logs for 6 months for analysis and then archive them for 5 years. Which TWO steps should they take?

Accepted Answer

Create a log sink to Cloud Storage with the Archive storage class and Bucket Lock retention of 5 years.. Option A is correct because a log sink to Cloud Storage with the Archive storage class provides low-cost long-term archival, and applying Bucket Lock with a 5-year retention policy enforces immutability for the required archive period. Option E is correct because a log sink to BigQuery lets the company analyze logs for the 6-month analysis window, and a table expiration of 6 months automatically removes the data after analysis, matching the stated requirement. Option B is wrong because the default Cloud Logging retention is 30 days (not 400 days), and it does not provide the required 6-month analysis plus 5-year archive lifecycle. Option C is wrong because enabling Data Access logs for all services increases log volume and cost but does not by itself satisfy the retention or archival requirements. Option D is wrong because Pub/Sub is a messaging service and Cloud SQL is a relational database, neither of which is the appropriate destination for cost-effective long-term log archival.

Answer

Rely on the default 400-day retention in Cloud Logging.

Answer

Enable Data Access logs for all services.

Answer

Create a log sink to Pub/Sub and store in Cloud SQL.

Question 3

An organization needs to centralize audit logs from multiple Google Cloud projects into a BigQuery dataset for long-term analysis. They also want to retain raw logs in Cloud Storage for archival purposes. What is the most efficient way to accomplish this?

Accepted Answer

Create two log sinks: one exporting to BigQuery, one to Cloud Storage, using an aggregated sink at the organization level.. An aggregated log sink at the organization level captures logs from all projects in the organization, and you can create two separate sinks — one routing to BigQuery for analysis and one to Cloud Storage for archival. This is the most efficient approach because a single aggregated sink scope avoids per-project sink management, and separate sinks allow independent filtering and destination configuration.

Answer

Create a single log sink that exports to both BigQuery and Cloud Storage.

Answer

Enable Data Access logs for all services and configure BigQuery as the default log destination.

Answer

Use Cloud Functions to copy logs from Cloud Logging to BigQuery and Cloud Storage.

Question 4

A security team uses Security Command Center Premium to detect threats. They want to receive real-time notifications when a finding of type 'Threat' with severity 'CRITICAL' or 'HIGH' is created. Which approach should they use?

Accepted Answer

Create a SCC notification config with a filter for threat type and severity levels, sending to a Pub/Sub topic.. Security Command Center Premium supports notification configs that let you define a filter on finding properties such as category (Threat) and severity (CRITICAL, HIGH) and route matching findings to a Pub/Sub topic in near real time. This is the native, purpose-built mechanism for real-time SCC alerting. The other options add unnecessary layers or miss the real-time requirement.

Answer

Use BigQuery to query SCC findings and schedule a query that pushes results to Pub/Sub.

Answer

Create a log sink to export SCC findings to Pub/Sub and then filter using Cloud Functions.

Answer

Enable Event Threat Detection and configure it to send alerts via email.

Question 5

An organization uses Binary Authorization to enforce that only images signed by an approved attestor are deployed in GKE. They want to allow a specific set of images from a trusted registry to bypass the policy. Which Binary Authorization policy type should they use?

Accepted Answer

Require Attestation. Binary Authorization policy type 'Require Attestation' enforces that only images with valid attestations from approved attestors are deployed. This allows specifying a set of trusted images that have been attested, effectively allowing them to bypass the policy if they meet the attestation requirements. The other policy types do not provide the granular control to allow specific images from a trusted registry while enforcing attestation.

Answer

Deny All

Answer

Allow All

Answer

Allow by Registry

Question 6

Which of the following is a feature available only in Security Command Center Premium tier, not in Standard tier?

Accepted Answer

Event Threat Detection. Event Threat Detection is a Security Command Center Premium-only capability that continuously analyzes Cloud Logging data and other telemetry for threats such as cryptomining, data exfiltration, and IAM abuse. It is not available in the Standard tier, which only provides Security Health Analytics and the Web Security Scanner. This makes Event Threat Detection the correct answer for a Premium-exclusive feature.

Answer

Security Health Analytics

Answer

Anomaly Detection

Answer

Web Security Scanner

Question 7

A security team wants to scan a web application hosted on Compute Engine for vulnerabilities like XSS and outdated libraries. They want the scan to be authenticated to cover areas behind login. Which Google Cloud service and configuration should they use?

Accepted Answer

Web Security Scanner with a managed scan and custom login credentials.. Web Security Scanner (now part of Security Command Center) with a managed scan and custom login credentials is the correct choice because it is Google Cloud's native DAST service that can authenticate to the application to scan areas behind login. Providing custom login credentials lets the scanner reach authenticated pages where XSS and outdated library issues may reside. This directly matches the requirement for authenticated scanning of a Compute Engine-hosted web app.

Answer

VM Manager patch management to check for outdated libraries.

Answer

Cloud Security Scanner with a custom scan configuration including authentication headers.

Answer

Container Analysis with a custom scanning schedule.

Question 8

A company wants to automate patching of operating system vulnerabilities on their Compute Engine instances. They need a solution that supports both Windows and Linux and can schedule patch deployments with rolling updates. Which service should they use?

Accepted Answer

VM Manager. VM Manager is Google Cloud's unified suite for managing Compute Engine VM fleets, and its patch management component (built on OS Config) natively supports both Windows and Linux, allowing scheduled patch jobs with rolling update options (e.g., one zone at a time, batch size limits, and disruption budgets). It is the only option that combines OS patch deployment, cross-platform support, and rolling scheduling in a single managed service.

Answer

OS Config Management

Answer

Cloud Scheduler

Answer

Deployment Manager

Question 9

A security team is designing an incident response workflow for container threats detected by Security Command Center Premium. They want to automatically capture forensic evidence from compromised GKE nodes. Which THREE steps should they include? (Choose THREE.)

Accepted Answer

Export the container image from Artifact Registry for analysis.. Option A is correct because exporting the container image from Artifact Registry preserves the exact image layers and digests that ran on the compromised node, allowing offline malware analysis and comparison against known-good baselines without altering the running workload. Option B is correct because collecting pod and container logs with kubectl logs captures application-level evidence, including stdout/stderr, timestamps, and crash traces, which are essential for reconstructing the attacker's actions inside the container. Option E is correct because taking a snapshot of the node's boot disk preserves the node's filesystem, kernel modules, and runtime state for offline forensic examination, and snapshots are non-destructive and can be restored or mounted in an isolated project. Option C is not appropriate because immediately draining and deleting all pods destroys volatile evidence and disrupts the investigation; containment should be done in a way that preserves artifacts. Option D is not appropriate because deleting the compromised node pool destroys the very evidence needed for root-cause analysis and may tip off the attacker, so the node should be isolated or cordoned rather than deleted.

Answer

Immediately drain and delete all pods on the node.

Answer

Delete the compromised node pool to prevent further damage.

Question 10

A security engineer wants to export all Cloud Audit Logs from a Google Cloud project to a BigQuery dataset for long-term analysis. Which type of log sink should be configured?

Accepted Answer

Create a project-level aggregated sink with destination set to BigQuery dataset. A project-level aggregated sink collects logs from all resources within the project. BigQuery is the appropriate destination for analysis. The sink must include all log types, but Admin Activity logs are enabled by default and cannot be disabled.

Answer

Create a folder-level sink and assign it to the project

Answer

Create an organization-level sink with includeChildren set to true

Answer

Create a sink for each log type individually

Question 11

During a security incident, a forensics team needs to capture a disk snapshot of a compromised Compute Engine instance for analysis. They want to ensure the snapshot is consistent and includes data in memory. Which step should be taken before taking the snapshot?

Accepted Answer

Stop the instance before taking the snapshot. For consistent snapshots of a running instance, you should first stop the instance (or at least freeze the filesystem). To capture memory, you would need to use a tool like LiME or dump the memory via a hypervisor; standard disk snapshots do not capture memory. However, the question asks about disk snapshot consistency; the best practice is to stop the instance.

Answer

Take a snapshot while the instance is running; consistency is automatic

Answer

Enable VPC Flow Logs on the network

Answer

Create an image from the disk first

Question 12

Your organization uses VPC Flow Logs for network forensics. During an incident, you need to analyze traffic to a compromised instance for the last 72 hours. The Flow Logs are stored in Cloud Logging. Which approach allows you to query the logs most efficiently?

Accepted Answer

Use Logs Explorer in Cloud Logging to filter by instance and time range. Logs Explorer in Cloud Logging is the native, purpose-built interface for querying and filtering log entries, including VPC Flow Logs. It allows you to filter by resource (e.g., the compromised instance), time range (last 72 hours), and other fields using the Logging Query Language, all within the console. This is the most efficient approach because it avoids data movement and leverages Cloud Logging's built-in indexing and search capabilities. For ad-hoc forensic analysis, Logs Explorer provides immediate results without additional setup or cost.

Answer

Export logs to BigQuery and run SQL queries

Answer

Use the gcloud logging read command with appropriate filters

Answer

Download logs as CSV from Cloud Storage

Question 13

A developer wants to be notified when a new vulnerability is found in a container image stored in Artifact Registry. Which service should they configure?

Accepted Answer

Container Analysis. Container Analysis is the service that provides vulnerability scanning for container images stored in Artifact Registry. It automatically scans images when they are pushed and provides notifications of vulnerabilities.

Answer

Cloud Security Scanner

Answer

Binary Authorization

Answer

VM Manager

Question 14

Your company has hundreds of GKE clusters across multiple projects. You need to ensure that all clusters have Container Threat Detection enabled. Which approach is most scalable?

Accepted Answer

Write a script using gcloud container clusters update with --enable-threat-detection flag. SCC Premium includes Container Threat Detection. To enable it across clusters, you can use an organization policy or a custom script. Using Terraform or Config Controller to manage clusters as code is scalable. The most straightforward way: enable SCC Premium at the organization level and then enable Container Threat Detection per cluster via the API or gcloud. A script using gcloud commands can iterate through all clusters.

Answer

Create a new organization policy that enforces Container Threat Detection on all clusters

Answer

Deploy a DaemonSet that enables Container Threat Detection

Answer

Manually enable Container Threat Detection in each cluster via the Cloud Console

Question 15

A startup uses Cloud SQL for MySQL and wants to implement automated daily backups with a 7-day retention period. The database is 50 GB and experiences moderate write traffic. The team wants to minimize cost and operational overhead. Which two actions should they take? (Choose two.)

Accepted Answer

Configure point-in-time recovery (PITR) with a 7-day log retention. Option D is correct because Cloud SQL for MySQL natively supports automated backups, and the retention period can be configured up to 365 days, so setting a 7-day retention directly satisfies the daily backup and retention requirement with minimal operational overhead. Option B is correct because enabling point-in-time recovery with 7-day log retention complements automated backups by allowing recovery to any moment within the retention window, which is valuable for a database with moderate write traffic and is managed natively by Cloud SQL. Option A is incorrect because on-demand backups created via gcloud sql backups create are manual and would require external scheduling, adding operational overhead rather than being automated. Option C is incorrect because pg_dump targets PostgreSQL, not MySQL, and running it via cron on a Compute Engine instance adds unnecessary infrastructure and management burden. Option E is incorrect because a custom Cloud Function using mysqldump duplicates functionality already provided by Cloud SQL automated backups and introduces extra cost, code maintenance, and operational complexity.

Answer

Use gcloud sql backups create to take on-demand backups daily

Answer

Set up a cron job on a Compute Engine instance to run pg_dump

Answer

Create a Cloud Function to export the database to Cloud Storage daily using mysqldump