PCSE Managing Operations in a Cloud Solution Environment Practice Test 3 — 15 Questions

Question 1

An organization wants to use Web Security Scanner to find vulnerabilities in their web application. Which TWO finding types can Web Security Scanner detect?

Accepted Answer

Cross-site scripting (XSS). Web Security Scanner detects XSS, mixed content, outdated libraries, and other common web vulnerabilities, but not SQL injection or SSRF.

Answer

Insecure deserialization

Answer

Server-side request forgery (SSRF)

Answer

SQL injection

Question 2

A security engineer wants to review all IAM permission changes made in the last 30 days. Which type of Cloud Audit Log should they query?

Accepted Answer

Admin Activity logs. Admin Activity logs contain all API calls that modify configurations or metadata, such as IAM policy changes. They are enabled by default and retained for 400 days. Data Access logs would capture read events but not permission changes, System Event logs are for GCP infrastructure actions, and Policy Denied logs record denied requests.

Answer

Data Access logs

Answer

System Event logs

Answer

Policy Denied logs

Question 3

A company uses Security Command Center (SCC) Premium tier and wants to automatically trigger a Cloud Function to remediate a threat finding. Which approach should they use?

Accepted Answer

Configure SCC to send findings to a Pub/Sub topic, and subscribe a Cloud Function to that topic.. SCC can send real-time notifications via Pub/Sub when findings of certain types or severities are created. A Cloud Function can subscribe to that topic to perform automated remediation. Cloud Scheduler cannot be triggered by events; Cloud Tasks is for asynchronous task execution but not designed for event-driven triggers from SCC; Logs Router exports logs but does not directly trigger Cloud Functions based on findings.

Answer

Use Cloud Tasks to periodically invoke Cloud Functions after reading findings from Security Command Center API.

Answer

Create a Cloud Scheduler job that polls SCC findings periodically and invokes Cloud Functions.

Answer

Export SCC findings to Cloud Storage, and set up a Cloud Function on object finalize.

Question 4

A security engineer needs to archive Cloud Audit Logs for regulatory compliance for 7 years. The logs should be immutable and cost-effective. Which solution should they choose?

Accepted Answer

Export logs to Cloud Storage using a sink, and enable Bucket Lock with retention policy.. Cloud Storage with the Archive storage class and retention policy using Bucket Lock provides immutable, low-cost storage for long-term archival. Logging exports can be configured via a sink to write logs to a bucket with these settings. BigQuery is not suitable for long-term archival due to cost; Pub/Sub is for streaming; Cloud Spanner is transactional and expensive.

Answer

Export logs to Pub/Sub and store them in a Cloud Spanner table with 7-year TTL.

Answer

Export logs to BigQuery and set a 7-year table expiration.

Answer

Use the default log retention of 400 days and copy logs to a persistent disk snapshot.

Question 5

Which Security Command Center tier provides Event Threat Detection and Container Threat Detection?

Accepted Answer

Premium tier. These threat detection services are available only in the Premium tier of Security Command Center. The Standard tier includes Security Health Analytics, Web Security Scanner, and Anomaly Detection. Compliance monitoring is also Premium-only.

Answer

Both tiers

Answer

Standard tier

Answer

Neither tier, they are separate services

Question 6

An organization uses Binary Authorization with a GKE cluster that enforces attestation. A developer builds a container and pushes it to Artifact Registry. The image must be signed before it can be deployed. Which steps are required to allow this image to run on the cluster?

Accepted Answer

Sign the image using Cloud KMS and an attestor, then create a signed attestation in Container Analysis, and deploy the image.. Binary Authorization requires a signed attestation from a trusted attestor, stored in Cloud KMS. The image must be signed using a private key associated with the attestor, and the attestation is typically stored as a note in Container Analysis. Simply having a vulnerability scan or pushing without signing will not satisfy the policy.

Answer

Push the image to Artifact Registry and allow the Binary Authorization policy to automatically sign it.

Answer

Configure the cluster to allow all images by setting the policy to 'Allow All' for the developer's namespace.

Answer

Use the Binary Authorization API to create an attestation by specifying the image URL and the attestor, then deploy.

Question 7

An organization needs to scan container images stored in Artifact Registry for vulnerabilities before deployment. They want to use a managed service that integrates with their CI/CD pipeline. Which Google Cloud service should they use?

Accepted Answer

Container Analysis. Artifact Registry integrates with Container Analysis (also known as Artifact Analysis) to automatically scan images for vulnerabilities. This is a managed service that works out-of-the-box for images stored in Artifact Registry. Web Security Scanner is for web applications, VM Manager patch management is for VM patches, and Cloud Security Scanner is not a real service.

Answer

Web Security Scanner

Answer

Cloud Security Scanner

Answer

VM Manager patch management

Question 8

A security engineer is investigating a compromised Compute Engine VM. They need to take a forensic snapshot of the disk without losing any data, including deleted files, and ensure the snapshot is not tampered with. Which steps should they take?

Accepted Answer

Create a snapshot of the disk while the instance is running, then detach the disk.. The correct approach is to first create a snapshot of the disk for forensic analysis, which captures the disk state including deleted files (unless overwritten). Then detach the disk from the instance to prevent further changes. Creating a snapshot after detaching would lose the current state. Powering off the instance may alter data. Using dd over SSH may change file access times.

Answer

Use dd to copy the disk over SSH to a forensic workstation.

Answer

Stop the instance, create a snapshot of the disk, then detach the disk.

Answer

Detach the disk first, then create a snapshot of the detached disk.

Question 9

A company wants to use Chronicle to ingest logs from their on-premises firewalls into Google Cloud. They need to normalize logs into a common schema for analysis. Which Chronicle capability should they use?

Accepted Answer

Unified Data Model (UDM). Chronicle uses the Unified Data Model (UDM) to normalize logs from various sources into a common schema. Log forwarders can collect and send logs to Chronicle, but UDM is the normalization engine. YARA-L rules are for detection, not normalization. The dashboard is for visualization.

Answer

Log forwarders

Answer

YARA-L rules

Answer

Chronicle dashboards

Question 10

Which type of Cloud Audit Logs must be explicitly enabled and incur additional cost?

Accepted Answer

Data Access logs. Data Access logs track read and write operations on resources. They are opt-in, cost extra, and have additional retention costs. Admin Activity logs are free and enabled by default. System Event logs are also free. Policy Denied logs are generated automatically when access is denied.

Answer

Admin Activity logs

Answer

System Event logs

Answer

Policy Denied logs

Question 11

A security engineer needs to implement a logging pipeline that sends real-time Cloud Audit Logs to a third-party SIEM. They must ensure that if the SIEM is unavailable, logs are not lost. Which approach should they use?

Accepted Answer

Create a log sink that writes to a Pub/Sub topic, and use a subscription with a dead letter topic.. Using a Pub/Sub subscription with a dead letter topic allows messages to be retried and, if delivery fails persistently, moved to a dead letter topic for later reprocessing. This prevents data loss. Cloud Storage is not real-time; BigQuery is not for streaming to SIEM; Cloud Run without Pub/Sub would miss retries.

Answer

Configure a Cloud Run service to pull logs from Cloud Logging API and forward to SIEM.

Answer

Export logs to Cloud Storage via a sink, and have the SIEM ingest from there.

Answer

Use a log sink to BigQuery and have the SIEM query BigQuery periodically.

Question 12

An organization wants to use Security Command Center to detect misconfigurations in their Google Cloud resources. They need a service that can automatically check for common security issues like open firewall ports and IAM policy violations. Which SCC feature should they enable?

Accepted Answer

Security Health Analytics. Security Health Analytics (SHA) is the SCC built-in scanner that checks for misconfigurations such as open firewall ports, overly permissive IAM roles, and other security best practices. Web Security Scanner targets web app vulnerabilities. Event Threat Detection is for threat detection. Anomaly Detection identifies unusual behavior.

Answer

Anomaly Detection

Answer

Event Threat Detection

Answer

Web Security Scanner

Question 13

A security team is setting up Binary Authorization for their GKE clusters. They want to enforce that only images signed by an approved attestor can be deployed. Which TWO of the following are required for this setup?

Accepted Answer

Create an attestor in Binary Authorization.. Binary Authorization requires creating an attestor and associating it with a Cloud KMS key pair for signing verification. The attestor's public key must be added to the Binary Authorization policy. A Container Analysis note is used to store attestations, but it is not a separate requirement for the policy itself; it is used when creating attestations. Disabling vulnerability scanning is not required.

Answer

Enable Vulnerability Scanning on Artifact Registry.

Answer

Disable the default 'Allow All' policy.

Answer

Create a Container Analysis note for each image.

Question 14

An incident responder needs to collect forensic evidence from a compromised Compute Engine instance for later analysis. They want to preserve disk state and network logs. Which THREE actions should they take?

Accepted Answer

Export and analyze VPC Flow Logs for the instance's network traffic.. Creating a disk snapshot captures the disk state including deleted files. Analyzing VPC Flow Logs can reveal network connections. Isolating the instance with a firewall rule prevents further damage. Powering off the instance may alter evidence. Deleting the instance loses evidence. Cloning the instance may preserve some state but is not standard forensic practice.

Answer

Delete the instance to stop billing.

Answer

Power off the instance to prevent further compromise.

Question 15

A company wants to use Cloud Audit Logs to monitor for security incidents. They need to retain logs for 6 months for analysis and then archive them for 5 years. Which TWO steps should they take?

Accepted Answer

Create a log sink to Cloud Storage with the Archive storage class and Bucket Lock retention of 5 years.. Create a log sink to BigQuery for short-term analysis (6 months) with a table expiration. Create another sink to Cloud Storage with an archive class and a retention policy for long-term archival. A single sink cannot do both. Pub/Sub is not archival. Default retention is only 400 days.

Answer

Rely on the default 400-day retention in Cloud Logging.

Answer

Enable Data Access logs for all services.

Answer

Create a log sink to Pub/Sub and store in Cloud SQL.