PCSE Managing Operations in a Cloud Solution Environment Practice Test 3 — 15 Questions

Question 1

A gaming company deploys a multiplayer game backend on Google Kubernetes Engine (GKE) with multiple microservices. The operations team needs to collect structured logs from containers, analyze them in real-time for anomalies, and store them for 30 days for compliance. They also need to monitor custom application metrics (e.g., player count per game server). Which three Google Cloud services should they use? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Logging to collect container logs and store them for 30 days using a log bucket retention policy. Option A is correct because Cloud Logging is the native GKE logging service that automatically collects container stdout/stderr logs, and its log buckets support configurable retention policies (e.g., 30 days) to satisfy compliance requirements. Option B is correct because Chronicle (Google Security Operations) can ingest logs from Cloud Logging and apply anomaly detection rules, providing the real-time anomaly analysis the operations team needs. Option E is correct because Cloud Monitoring collects custom application metrics (such as player count per game server) via the Monitoring API and supports dashboards and alerting. Option C is not appropriate because BigQuery is an analytics warehouse, not a log retention or real-time anomaly detection service, and its default storage is not designed for 30-day log compliance retention. Option D is incorrect because Cloud SQL is a relational database for application data, not a metrics store; custom metrics belong in Cloud Monitoring.

Answer

BigQuery to store logs for 30 days and run real-time queries

Answer

Cloud SQL to store application metrics

Question 2

Your organization uses Google Cloud and requires that all administrative activities in production projects be monitored in near real-time. You need to detect and respond to suspicious IAM policy changes within minutes. You have set up Cloud Logging and want to create an alert that triggers when a specific IAM role is granted. What should you do?

Accepted Answer

Create a log sink to Pub/Sub with a filter for the specific IAM role grant, and use a Cloud Function to process messages and send alerts.. Using a log sink to Pub/Sub with a precise filter allows routing only the logs of interest. A Cloud Function can process these messages in near real-time and send alerts, meeting the requirement for specific and timely detection.

Answer

Use Cloud Asset Inventory to monitor IAM policy changes and set up a feed to Pub/Sub for alerts.

Answer

Create a log-based metric that filters for SetIamPolicy method calls and configure an alerting policy in Cloud Monitoring to notify when the metric exceeds a threshold of 0.

Answer

Enable Data Access audit logs for IAM and use Logging's built-in alerting to notify on any IAM changes.

Question 3

A security team needs to ensure that all administrative activities performed by any user in their Google Cloud organization are logged and retained for at least one year. They have enabled Cloud Audit Logs at the organization level. Which action should they take to meet the retention requirement?

Accepted Answer

Configure a log sink to export Admin Activity logs to a Cloud Storage bucket with a retention policy set to 365 days.. To meet a one-year retention requirement for Admin Activity logs, the most direct and reliable method is to export them to a Cloud Storage bucket with a retention policy. Cloud Storage offers immutable retention and is designed for long-term archival. The default log bucket retention for Admin Activity logs is 400 days, but it can be changed by users with permissions, so an explicit export ensures compliance. Other options either do not store the logs or cannot enforce the retention period.

Answer

Use the gcloud logging sinks create command to export logs to a Pub/Sub topic and then to a Cloud Function that writes them to BigQuery.

Answer

Create a log-based metric for Admin Activity logs and set an alerting policy to notify when logs are older than 365 days.

Answer

Modify the default retention period of the _Default log bucket to 365 days.

Question 4

A security team needs to monitor for anomalous IAM activity across their Google Cloud organization. They want to detect when a service account key is created outside of normal change windows, and they need to be alerted in near real-time. They also want to minimize false positives by correlating multiple events. Which approach should they take?

Accepted Answer

Use Cloud Logging to export audit logs to Pub/Sub, then process with Cloud Functions to correlate events and trigger alerts.. Streaming audit logs to Pub/Sub and processing with Cloud Functions enables near real-time detection and custom correlation logic. This approach allows the team to define specific conditions, such as service account key creation outside change windows, and correlate multiple events to reduce false positives. It is more flexible and timely than batch queries or standard log-based alerts.

Answer

Use Security Command Center Premium with Event Threat Detection, which includes anomaly detection for IAM activity.

Answer

Use Cloud Logging log-based alerts on the activity log for service account key creation, and filter by time of day.

Answer

Export audit logs to BigQuery and use scheduled queries to detect service account key creation, then send alerts via Pub/Sub.

Question 5

A security engineer is configuring VPC Service Controls to protect a project containing sensitive data. They want to ensure that only requests from authorized networks can access the Cloud Storage API. They have created a service perimeter and added the project. Which additional step is required to enforce this restriction?

Accepted Answer

Add the authorized networks to the perimeter's ingress policies with the appropriate source CIDR ranges.. VPC Service Controls perimeters restrict access to services by default. To allow access from specific networks, you must configure ingress policies that define the allowed sources, such as CIDR ranges, and the identities or services that can be accessed. This is the only way to selectively permit external access while maintaining the perimeter's protective boundary. Other options do not directly influence VPC Service Controls enforcement.

Answer

Enable Private Google Access on the subnet used by the authorized networks.

Answer

Create a firewall rule that allows traffic from the authorized networks to the Cloud Storage API endpoint.

Answer

Add the authorized networks to the project's VPC Service Controls access policy as trusted networks.

Question 6

A security operations team uses Security Command Center (SCC) Premium. They want to automatically remediate a specific high-severity finding: 'Open SSH port' on Compute Engine instances. The remediation should remove the offending firewall rule and notify the security team via email. They want to minimize custom code. Which Google Cloud service should they use to orchestrate this workflow?

Accepted Answer

Security Command Center's integration with Cloud Functions via Pub/Sub and predefined remediation templates. SCC Premium integrates with Pub/Sub to stream findings. Google offers predefined Cloud Functions for automated remediation of common issues like open SSH ports. This reduces custom development and accelerates response. Other options require more custom code or lack native remediation capabilities.

Answer

Cloud Workflows and Cloud Functions

Answer

Cloud Asset Inventory feeds and Cloud Functions

Answer

Security Command Center's built-in remediation and Cloud Pub/Sub

Question 7

A security engineer needs to ensure that all IAM policy changes and service account key creations across a Google Cloud organization are recorded and retained for 400 days. The organization has already enabled Data Access audit logs for all services. Which configuration should the engineer verify to meet the retention requirement?

Accepted Answer

The default _Default log bucket retention period is set to 400 days.. Admin Activity audit logs, which include IAM policy changes and service account key creations, are stored in the _Default log bucket. By default, this bucket retains logs for 30 days. To meet the 400-day retention requirement, the engineer must extend the retention period of the _Default bucket. Other options involve additional configurations or incorrect buckets. Therefore, checking the _Default bucket's retention is the correct action.

Answer

A user-defined log bucket with a 400-day retention period is created and a sink routes all logs to it.

Answer

The audit logs are exported to Cloud Storage with a 400-day lifecycle policy.

Answer

The _Required log bucket retention period is set to 400 days.

Question 8

Your company has a Google Cloud organization with many projects. A security analyst needs to review all administrative activities across all projects for the past 30 days. The organization has enabled Data Access audit logs for all services. However, the analyst reports that they cannot see logs from some projects. What is the most likely reason?

Accepted Answer

The analyst lacks the necessary IAM permissions to view logs in those projects.. The most likely reason is that the analyst lacks IAM permissions to view logs in those projects. Even with audit logs enabled, access is controlled by IAM. The analyst needs logging.viewer or similar roles on each project or at the organization level. Other options are less likely given the scenario.

Answer

The logs are stored in a different region and the analyst is querying from a region where logs are not replicated.

Answer

Data Access audit logs are not enabled for all services in those projects.

Answer

The projects have exceeded their log ingestion quota, so logs are being dropped.

Question 9

A security team is using Security Command Center (SCC) Premium to monitor their Google Cloud environment. They want to integrate SCC findings with their existing SIEM solution for centralized incident response. Which two methods can they use to export SCC findings to their SIEM? (Choose two.)

Accepted Answer

Use the SCC API to programmatically retrieve findings and push them to the SIEM.. Security Command Center findings can be exported to a SIEM using the SCC API to pull findings programmatically or by configuring Pub/Sub notifications to push findings to a topic. Both methods enable integration with external systems. The API approach gives you control over polling and transformation, while Pub/Sub provides near real-time streaming. Other options are either not supported natively or misrepresent the direction of data flow.

Answer

Use Cloud Logging to export SCC findings as logs to a Cloud Storage bucket, then have the SIEM ingest from there.

Answer

Create a custom SCC source and use the SCC API to write findings, then have the SIEM query that source.

Answer

Enable the SCC BigQuery export feature to automatically sync findings to a BigQuery dataset, then connect the SIEM to BigQuery.

Question 10

A financial services company uses Google Cloud and must ensure that all data stored in Cloud Storage buckets is encrypted with customer-managed encryption keys (CMEK) that they control and rotate regularly. They also need to prove to auditors that encryption keys are not accessible to Google. Which Google Cloud service should they use to manage these keys?

Accepted Answer

Cloud External Key Manager (Cloud EKM). Cloud External Key Manager (Cloud EKM) enables you to maintain control of encryption keys outside Google Cloud, ensuring Google cannot access the key material. This provides the necessary audit evidence that keys are externally managed and inaccessible to Google, fulfilling compliance requirements.

Answer

Cloud Hardware Security Module (Cloud HSM)

Answer

Customer-supplied encryption keys (CSEK)

Answer

Cloud Key Management Service (KMS) with CMEK

Question 11

A security administrator needs to grant a user the ability to view and manage firewall rules in a Google Cloud project. Which IAM role should they assign to follow the principle of least privilege?

Accepted Answer

roles/compute.networkAdmin. The Compute Network Admin role is specifically designed for managing network resources, including firewall rules, subnets, and networks. It provides the necessary permissions without granting excessive access. The Compute Security Admin role also includes firewall rule management but adds security policy permissions, making it less least-privilege for this scenario. The Editor role is too broad, and the Instance Admin role does not cover firewall rules.

Answer

roles/compute.instanceAdmin.v1

Answer

roles/compute.securityAdmin

Answer

roles/editor

Question 12

A security operations team needs to review administrative activity across all projects in their Google Cloud organization for the past 400 days. They want a single place to query who deleted a specific firewall rule three months ago. Which log type should they query, and where are these logs stored by default?

Accepted Answer

Admin Activity audit logs, aggregated through an organization-level log sink to a central project's log bucket with a 400-day retention period.. Administrative changes such as deleting a firewall rule are recorded in Admin Activity audit logs. Because each project's default _Default bucket retains audit logs for only 30 days, meeting a 400-day, organization-wide query requirement demands an organization-level log sink that routes those logs to a central log bucket with extended retention. Querying Data Access or System Event logs would return the wrong category of events.

Answer

System Event audit logs, which capture administrative changes and are automatically retained for 400 days at the organization level.

Answer

Admin Activity audit logs, stored in Cloud Logging for 400 days by default and queryable in the Logs Explorer.

Answer

Data Access audit logs, which are enabled by default and retained for 400 days in the _Default bucket at the organization level.

Question 13

A security operations team is using Security Command Center (SCC) Premium to manage findings. They want to automate the remediation of certain misconfigurations. Which TWO actions can they take to integrate SCC with their existing ticketing system and automate responses? (Choose two.)

Accepted Answer

Export findings to Pub/Sub and use a Cloud Function to create tickets.. To integrate SCC with a ticketing system and automate responses, exporting findings to Pub/Sub and using a Cloud Function is a real-time, event-driven approach. Alternatively, polling the SCC API with Cloud Scheduler and creating tickets programmatically also works. Native integrations or automatic remediation features do not exist in SCC, so those options are invalid.

Answer

Configure SCC to send email notifications via Cloud Monitoring alerting policies.

Answer

Enable SCC's automatic remediation feature to close findings.

Answer

Use SCC's built-in integration with Jira Service Management.

Question 14

A security team is configuring Cloud IDS to monitor traffic between two VPC networks in a shared VPC environment. They have deployed Cloud IDS in the host project. However, they notice that traffic from the service project is not being inspected. What is the most likely cause?

Accepted Answer

The Cloud IDS endpoint requires a route in the host project's VPC to direct traffic to the endpoint's internal IP address.. In a shared VPC, Cloud IDS is deployed in the host project. To inspect traffic from service projects, you must configure routing in the host project's VPC to direct traffic to the Cloud IDS endpoint. Specifically, a custom route with the IDS endpoint's internal IP as the next hop for the service project's subnets is required. Without this route, traffic does not pass through the IDS endpoint and remains uninspected. Firewall rules and service perimeters do not fulfill this role.

Answer

The Cloud IDS endpoint must be configured with a service perimeter to allow traffic from the service project.

Answer

The Cloud IDS endpoint is not configured to monitor the correct subnet; it must be deployed in the service project's subnet.

Answer

The firewall rules in the service project do not allow traffic to be redirected to the Cloud IDS endpoint.

Question 15

Your organization uses Security Command Center (SCC) Enterprise tier across 40 projects. The CISO wants to be alerted within minutes when an SCC finding's severity changes from MEDIUM to CRITICAL, but does not want email noise for every new LOW finding. You need to implement this with the least operational overhead. What should you do?

Accepted Answer

Create an SCC notification config filtered on severity="CRITICAL", route it to Pub/Sub, and use a Cloud Run service that queries the finding's eventTime and compares it to the last observed severity stored in Firestore.. SCC notification configs deliver findings to Pub/Sub based on current-state filters, so isolating a severity transition requires the consumer to remember the previous severity. Filtering on severity="CRITICAL" captures all CRITICAL findings, and a small stateful service comparing the stored prior severity against the incoming value alerts only on MEDIUM-to-CRITICAL promotions. This avoids email noise for LOW findings and requires no per-project configuration beyond the org-level notification config.

Answer

Create an SCC notification config with the filter "severity=\"CRITICAL\" AND NOT severity=\"MEDIUM\"" and route it to Pub/Sub.

Answer

Create a Pub/Sub topic, configure an SCC notification config filtered on severity="CRITICAL", and subscribe a Cloud Function that compares the finding's previous severity before alerting.

Answer

Create an SCC notification config with the filter "severity=\"CRITICAL\"" and set the mute state to MUTED for all LOW findings.