PCSE Managing Operations in a Cloud Solution Environment Practice Test 4 — 15 Questions

Question 1

A security engineer needs to ensure that all data written to Cloud Storage buckets containing sensitive data is encrypted with a customer-managed encryption key (CMEK) that is rotated every 90 days. They want to enforce this automatically. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an organization policy constraint for CMEK and set the KMS key rotation period to 90 days.. An organization policy constraint can enforce CMEK usage on all Cloud Storage buckets, preventing non-compliant buckets. The KMS key can be configured with a 90-day rotation period. This provides automatic enforcement and rotation. Other options either use manual processes or do not enforce CMEK, so they are incorrect.

Answer

Use a Cloud Function to monitor bucket creation and apply CMEK if missing.

Answer

Enable default encryption with Google-managed keys and set a rotation policy.

Answer

Create a KMS key with a 90-day rotation and manually apply it to all buckets.

Question 2

A multinational enterprise uses Google Cloud with an organization node containing 40 folders and 250 projects. Their security operations center (SOC) must retain all Cloud Audit Logs (Admin Activity, Data Access, System Event, and Policy Denied) for 400 days to satisfy a regulatory mandate, and analysts must be able to search any log entry by principal email across the entire organization within minutes. The current setup uses the default _Default sink at the organization level with a 30-day log bucket. Cost optimization is a secondary concern, but completeness of the audit trail is mandatory. Which TWO changes should the security engineer implement to meet the retention and search requirements? (Choose two.)

Accepted Answer

Create a new organization-level log bucket with a 400-day retention period, then create an aggregated sink at the organization level that includes all projects and routes logs to that bucket.. An organization-level aggregated sink is required to capture logs from all 250 projects and 40 folders in one destination, and a user-defined log bucket with a 400-day retention period provides the mandatory retention. Enabling Log Analytics on that bucket makes entries queryable by fields such as principal email, satisfying the SOC's search requirement. The default sink and per-project sinks cannot deliver either organization-wide coverage or the required retention in a single, auditable location.

Answer

Modify the existing _Default organization sink's destination to point at a new Cloud Storage bucket and set the bucket's lifecycle to delete objects after 400 days.

Answer

Create a log bucket in each of the 250 projects with 400-day retention and a project-level sink in each project to route logs to a shared BigQuery dataset.

Answer

Enable a Data Access audit log exemption at the folder level to reduce volume, then extend the _Default bucket retention to 400 days.

Question 3

A healthcare company uses Google Cloud and must monitor for suspicious network activity across multiple VPC networks in different projects. They want to detect anomalies such as unusual outbound traffic to known malicious IPs and receive alerts in real time. They have enabled VPC Flow Logs for all subnets and have a Security Command Center Premium subscription. What should they do to meet these requirements?

Accepted Answer

Use Security Command Center Premium's Event Threat Detection and Container Threat Detection to analyze VPC Flow Logs and generate findings.. Security Command Center Premium's Event Threat Detection ingests VPC Flow Logs and other logs to identify threats such as communication with known malicious IPs. It automatically generates findings and supports real-time notifications, satisfying the need for anomaly detection across multiple projects. This approach uses existing Google Cloud services and requires no additional appliances.

Answer

Export VPC Flow Logs to a Cloud Storage bucket and use a scheduled query in BigQuery to analyze traffic patterns.

Answer

Enable Packet Mirroring on all subnets and send mirrored traffic to a third-party IDS appliance.

Answer

Configure Cloud IDS in each VPC network and create alerts based on its threat signatures.

Question 4

A security team at a financial services company uses Security Command Center Premium. They need to automatically export all findings of category 'Persistence: IAM Anomalous Grant' to a Pub/Sub topic so that an external SOAR platform can ingest them in near real time. They also want to avoid exporting duplicate findings when a finding is updated. Which approach should they use?

Accepted Answer

Use the Security Command Center API with a continuous export configured in the Google Cloud console, filtering for the desired category, and target a Pub/Sub topic.. Continuous exports are the native Security Command Center Premium mechanism for streaming findings to Pub/Sub. They support category filters and emit findings as they are created or updated, which satisfies the near real-time, deduplicated delivery requirement. Cloud Logging sinks, VPC Flow Logs, and Cloud Asset Inventory feeds do not carry SCC finding objects and therefore cannot fulfil the scenario.

Answer

Create a Cloud Logging sink that filters for protoPayload.methodName="google.cloud.securitycenter.v1.SecurityCenter.CreateFinding" and routes logs to Pub/Sub.

Answer

Enable VPC Flow Logs on all subnets and create a log-based alert that triggers a Cloud Function to publish to Pub/Sub when IAM changes occur.

Answer

Configure a Cloud Asset Inventory feed for IAM policy changes and route the updates to Pub/Sub, then have the SOAR platform parse the asset changes.

Question 5

A financial services company runs a three-tier application on Compute Engine. Their security team needs to detect when an external IP address attempts to connect to a backend VM on TCP port 22 and then correlate that event with the identity of the user who created the firewall rule that allowed it. The team uses Security Command Center Premium and wants the fastest possible path to both detection and attribution. What should the security engineer do?

Accepted Answer

Enable VPC Flow Logs on the backend subnet and enable the Firewall Insights detector in Security Command Center Premium, which correlates network connection attempts with the Admin Activity audit log entry for the firewall rule.. VPC Flow Logs provide the network-layer evidence that an external IP attempted TCP port 22, and Security Command Center Premium's Firewall Insights detector surfaces the firewall rule change that permitted it, with the principal captured in Admin Activity audit logs. This combination is native to Google Cloud, requires no custom SQL or packet collection infrastructure, and gives both detection and attribution. The other approaches either miss one half of the requirement or add unnecessary operational overhead.

Answer

Enable VPC Flow Logs on the backend subnet and enable the Firewall Insights and Event Threat Detection detectors in Security Command Center Premium to surface the connection attempt and its associated firewall change.

Answer

Enable VPC Flow Logs on the backend subnet and export them to Cloud Logging, then manually join the flow log entries with Admin Activity audit logs in BigQuery.

Answer

Enable VPC Flow Logs on the backend subnet and enable Packet Mirroring on the backend VM's network interface, then review mirrored traffic in Cloud Logging.

Question 6

A security engineer needs to ensure that all data written to Cloud Storage buckets containing sensitive data is encrypted with a customer-managed encryption key (CMEK) that is rotated every 90 days. They want to enforce this automatically. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a log sink at the organization level that includes all Admin Activity logs, and export them to a BigQuery dataset with a partition expiration of 365 days.. The correct solution is to create an organization-level log sink that exports Admin Activity logs to BigQuery, with partition expiration set to 365 days. BigQuery enables SQL-based search and analysis, and partition expiration automatically manages retention. This meets both the retention and searchability requirements. Other options either lack search capabilities, do not guarantee retention, or focus on the wrong log type.

Answer

Create a log sink at the organization level that includes all Admin Activity logs, and export them to a Cloud Storage bucket with a retention policy of 365 days.

Answer

Enable Data Access audit logs for all services, and rely on Cloud Logging's default retention.

Answer

Use Cloud Logging's default retention of 30 days, and create a log-based metric to count admin activities.

Question 7

A security team is using Security Command Center (SCC) Premium to monitor their Google Cloud environment. They want to reduce the number of false positives from Event Threat Detection findings. Which TWO actions can they take to tune the findings and reduce noise? (Choose two.)

Accepted Answer

Create a mute rule in SCC to suppress specific findings based on filter criteria.. Mute rules allow suppression of specific findings, and excluding logs from ingestion prevents Event Threat Detection from analyzing them, reducing false positives. These are the two supported tuning mechanisms in SCC Premium for reducing noise without disabling the service.

Answer

Modify the Event Threat Detection detector code to ignore specific patterns.

Answer

Disable Event Threat Detection entirely to stop all related findings.

Answer

Adjust the severity of findings by creating a custom finding severity rule.

Question 8

A multinational enterprise has a Google Cloud organization with many projects. The security team needs to review all administrative activity across every project, including actions taken by Google support engineers, for at least one year. They want a single, tamper-evident destination that is independent of project-level log retention settings. What should they do?

Accepted Answer

Create an aggregated log sink at the organization level that includes all projects and routes logs to a new log bucket with a custom retention period of 365 days.. Organization-level aggregated sinks are the standard way to centralize audit logs across all projects, including future ones, and capture Admin Activity and System Event logs that record support access. Routing to a user-defined log bucket with a 365-day retention satisfies the one-year requirement and provides tamper-evident storage because log bucket retention cannot be shortened once set. Project-level or manual approaches leave gaps and lack immutability.

Answer

Enable Data Access audit logs for all services in every project and increase the default log retention to 365 days.

Answer

Create a project-level log sink in each project that routes logs to a shared Cloud Storage bucket with Object Lifecycle Management set to delete after 365 days.

Answer

Use the gcloud logging read command on each project daily and export the results to Cloud Storage with a lifecycle policy of one year.

Question 9

A security engineer needs to give an incident response team temporary read access to Cloud Storage objects in a compromised project so they can collect evidence. The access must expire automatically after 8 hours and must be auditable. What should the engineer do?

Accepted Answer

Use IAM Conditions with a request.time expiry on a role binding that grants roles/storage.objectViewer to the incident response group.. IAM Conditions can include a request.time expiration, so a role binding granting roles/storage.objectViewer with a time-based condition automatically stops granting access after the specified timestamp. The binding, condition, and resulting access are recorded in audit logs, giving the incident response team temporary, identity-based, auditable read access without manual cleanup.

Answer

Create a service account, grant it roles/storage.objectViewer, generate a key, and share the key with the incident response team for 8 hours.

Answer

Create a custom IAM role with storage.objects.get and grant it to the incident response group at the project level.

Answer

Generate a signed URL for each object with an 8-hour expiration and share the URLs with the incident response team.

Question 10

A multinational corporation uses Google Cloud and needs to ensure that all data access audit logs for BigQuery are retained for 3 years and are immutable. They also need to be able to search these logs for specific user activity. The organization has multiple projects and wants a centralized solution. What should they do?

Accepted Answer

Enable Data Access audit logs for BigQuery at the organization level and create a log sink to a Cloud Storage bucket with a retention policy and Bucket Lock, then use a BigQuery external table to query the logs.. The combination of a Cloud Storage bucket with Bucket Lock for immutable retention and BigQuery external tables for querying meets both requirements. Data Access audit logs are enabled at the organization level to capture all BigQuery activity. The log sink routes logs to Cloud Storage, where Bucket Lock enforces immutability. External tables in BigQuery allow SQL queries over the logs without duplicating storage.

Answer

Enable Data Access audit logs for BigQuery at the organization level and create a log sink to a Cloud Storage bucket with Bucket Lock.

Answer

Enable Data Access audit logs for BigQuery at the organization level and create a log sink to BigQuery with a custom retention policy.

Answer

Enable Data Access audit logs for BigQuery at the organization level and create a log sink to Pub/Sub for real-time analysis.

Question 11

A security team is using Security Command Center (SCC) Premium to monitor their Google Cloud environment. They want to integrate SCC findings with their existing ticketing system and also perform automated remediation for certain finding types. Which TWO components should they use to achieve this? (Choose two.)

Accepted Answer

SCC notifications to Pub/Sub, and a Dataflow job to process findings and call the ticketing API.. The two valid components are using SCC notifications to Pub/Sub with either a Cloud Function or a Dataflow job to process findings. Both enable event-driven integration with a ticketing system and automated remediation. The other options either introduce latency, use non-native paths, or rely on polling, which is less efficient.

Answer

SCC findings exported to BigQuery, and a scheduled query to detect new findings and call the ticketing API.

Answer

SCC notifications to Cloud Logging, and a log-based alert to trigger a Cloud Function.

Answer

SCC findings accessed via the SCC API, and a Cloud Scheduler job that polls the API every minute to create tickets and remediate.

Question 12

A company wants to ensure that all their Google Cloud resources are tagged with specific labels for cost allocation and security classification. They need to enforce that certain labels are present on all resources at creation time. What should they use?

Accepted Answer

Custom organization policy constraints. Custom organization policy constraints enable you to enforce label requirements at resource creation. By defining a constraint that mandates certain labels, you prevent non-compliant resources from being created, ensuring consistent labeling for cost and security.

Answer

IAM conditions with resource labels

Answer

Cloud Asset Inventory with a custom script to check labels

Answer

Organization Policy constraints for labels

Question 13

A healthcare company runs a regulated workload on Google Cloud. Their security operations center needs to detect and respond to threats in near real time. They have enabled Security Command Center Premium and want to integrate its findings with their existing ticketing system. They also need to ensure that only authorized personnel can view findings that contain protected health information (PHI). Which two actions should they take? (Choose two.)

Accepted Answer

Use IAM Conditions on the Security Center Findings Viewer role to restrict access based on the resource's security labels or tags, so only authorized personnel can view PHI findings.. Streaming findings through a continuous export to Pub/Sub with a narrowly scoped subscriber role satisfies the integration requirement without over-privileging the ticketing system. Restricting Findings Viewer access with IAM Conditions based on resource labels ensures that only authorized personnel can see findings tied to PHI-sensitive resources. Broad organization-level read roles and network-only controls do not meet the least-privilege and fine-grained access goals.

Answer

Disable Security Command Center Premium and use only the Standard tier to reduce the amount of sensitive data stored in findings.

Answer

Grant the ticketing system's service account the Security Center Findings Viewer role at the organization level so it can read all findings directly.

Answer

Enable VPC Service Controls around the Security Command Center API to prevent data exfiltration, and rely on that alone to restrict who can view PHI findings.

Question 14

You are configuring Cloud Audit Logs for a project that contains sensitive data. You need to ensure that all access to the data is logged, including read operations, and that logs are retained for 365 days. What should you do?

Accepted Answer

Enable Data Access audit logs for all services and create a log sink to a Cloud Storage bucket with a 365-day retention policy.. To log all access, including reads, you must enable Data Access audit logs. To retain logs for 365 days, you create a log sink to a destination that supports retention policies, such as Cloud Storage, and configure the bucket's retention policy. This ensures logs are captured and retained as required.

Answer

Enable Data Access audit logs and increase the default retention period in Cloud Logging to 365 days.

Answer

Enable Admin Activity audit logs and set the default retention to 365 days in Cloud Logging.

Answer

Enable Data Access audit logs and create a log sink to BigQuery with a 365-day partition expiration.

Question 15

A security team wants to monitor for changes to IAM policies across all projects in their Google Cloud organization and receive alerts when a user is granted the Owner role. They want the alerts to include the principal who made the change and the affected resource. They also want to minimize the number of services they need to enable. Which solution should they use?

Accepted Answer

Create a Cloud Asset Inventory feed for IAM policies at the organization level and route updates to Pub/Sub, then filter for Owner role grants.. Cloud Asset Inventory feeds are purpose-built to monitor IAM policy changes across an organization and publish them to Pub/Sub, including the principal and affected resource. They require only the Cloud Asset API, which aligns with the goal of minimizing enabled services. Data Access audit logs, VPC Flow Logs, and Security Command Center Premium do not provide the same combination of organization-wide coverage, specificity, and low service overhead.

Answer

Enable Data Access audit logs for IAM and create a log-based alert that filters for SetIamPolicy calls.

Answer

Use Security Command Center Premium's IAM anomaly detection to generate findings for Owner role grants and export them to Pub/Sub.

Answer

Enable VPC Flow Logs and create a log-based metric that counts SetIamPolicy calls, then alert when the count exceeds a threshold.