PCSE Managing Operations in a Cloud Solution Environment Practice Test 4 — 15 Questions

Question 1

A security engineer wants to monitor all actions that create or modify resources in a Google Cloud project. Which type of audit log is enabled by default and cannot be disabled?

Accepted Answer

Admin Activity logs. Admin Activity logs record all API calls that modify configuration or metadata. They are enabled by default and cannot be disabled. Data Access logs are opt-in, System Event logs are enabled by default but cannot be disabled either, and Policy Denied logs are generated when access is denied by IAM policies.

Answer

Policy Denied logs

Answer

Data Access logs

Answer

System Event logs

Question 2

An organization needs to centralize audit logs from multiple Google Cloud projects into a BigQuery dataset for long-term analysis. They also want to retain raw logs in Cloud Storage for archival purposes. What is the most efficient way to accomplish this?

Accepted Answer

Create two log sinks: one exporting to BigQuery, one to Cloud Storage, using an aggregated sink at the organization level.. Log sinks can route logs to multiple destinations by creating separate sinks for each destination. One sink can export logs to BigQuery, and another sink can export logs to Cloud Storage. Aggregated sinks at the organization or folder level allow collecting logs from all projects.

Answer

Create a single log sink that exports to both BigQuery and Cloud Storage.

Answer

Enable Data Access logs for all services and configure BigQuery as the default log destination.

Answer

Use Cloud Functions to copy logs from Cloud Logging to BigQuery and Cloud Storage.

Question 3

A security team uses Security Command Center Premium to detect threats. They want to receive real-time notifications when a finding of type 'Threat' with severity 'CRITICAL' or 'HIGH' is created. Which approach should they use?

Accepted Answer

Create a SCC notification config with a filter for threat type and severity levels, sending to a Pub/Sub topic.. SCC Premium provides built-in Pub/Sub notifications for findings. You can configure notification configs with filters to receive only specific finding types and severities. There is no need to export to BigQuery or use Cloud Functions to poll; the notification config pushes to a Pub/Sub topic.

Answer

Use BigQuery to query SCC findings and schedule a query that pushes results to Pub/Sub.

Answer

Create a log sink to export SCC findings to Pub/Sub and then filter using Cloud Functions.

Answer

Enable Event Threat Detection and configure it to send alerts via email.

Question 4

An organization wants to enforce that all container images deployed to a GKE cluster must be signed by an approved authority. They have set up Binary Authorization with a policy that requires attestation. Where should the signing key be stored to meet security best practices?

Accepted Answer

Store the private key in Cloud Key Management Service (Cloud KMS).. Binary Authorization integrates with Cloud Key Management Service (KMS) to store attestor keys. Cloud KMS provides centralized key management, access control via IAM, and audit logging. Using a key stored in Cloud KMS is the recommended approach.

Answer

Store the private key in a GCS bucket with uniform bucket-level access.

Answer

Store the private key in Secret Manager.

Answer

Store the private key on the developer's workstation.

Question 5

Which Google Cloud SIEM solution ingests logs from various sources, normalizes them into the Unified Data Model (UDM), and allows detection using YARA-L rules?

Accepted Answer

Chronicle. Chronicle is Google Cloud's SIEM solution that ingests logs, normalizes them into UDM, and enables detection rules with YARA-L. Security Command Center is a security posture management tool, not a SIEM. Cloud Logging is for log storage and analysis, not SIEM. BigQuery is a data warehouse.

Answer

Cloud Logging

Answer

BigQuery

Answer

Security Command Center

Question 6

A security team needs to automatically respond to high-severity vulnerability findings in Security Command Center. They want to trigger a Cloud Function that quarantines the affected VM. What is the recommended way to connect SCC findings to Cloud Functions?

Accepted Answer

Create a SCC notification config that sends findings to a Pub/Sub topic, and set up a Cloud Function to subscribe to that topic.. SCC can publish findings to a Pub/Sub topic via notification configs. Cloud Functions can subscribe to that topic and execute the remediation logic. This is the recommended event-driven architecture.

Answer

Use Cloud Scheduler to poll SCC API every minute and invoke Cloud Function.

Answer

Configure Cloud Logging to capture SCC findings and create a log-based metric with an alert that triggers Cloud Function.

Answer

Export SCC findings to BigQuery and set up a BigQuery scheduled query to trigger Cloud Function.

Question 7

During a security incident, a forensic investigator needs to analyze a compromised Compute Engine instance without affecting the live environment. The instance has persistent disks with critical data. What is the best first step to preserve evidence?

Accepted Answer

Create a snapshot of the persistent disks.. Creating a snapshot of the persistent disks preserves a point-in-time copy without affecting the running instance. The snapshot can then be used to create a new disk attached to a forensic VM for analysis. Disk cloning requires stopping the instance.

Answer

Clone the instance to a new VM.

Answer

Export the disk image to Cloud Storage.

Answer

Enable VPC Flow Logs for the instance's network.

Question 8

An organization uses Binary Authorization to enforce that only images signed by an approved attestor are deployed in GKE. They want to allow a specific set of images from a trusted registry to bypass the policy. Which Binary Authorization policy type should they use?

Accepted Answer

Require Attestation. Binary Authorization supports policy types like 'Require Attestation', 'Allow All', and 'Deny All'. To allow specific images while requiring attestation for others, they would use 'Require Attestation' with an exception list. There is no 'Allow by Registry' built-in type.

Answer

Deny All

Answer

Allow All

Answer

Allow by Registry

Question 9

Which of the following is a feature available only in Security Command Center Premium tier, not in Standard tier?

Accepted Answer

Event Threat Detection. Event Threat Detection is a Premium-only feature. Security Health Analytics, Web Security Scanner, and Anomaly Detection are available in both tiers.

Answer

Security Health Analytics

Answer

Anomaly Detection

Answer

Web Security Scanner

Question 10

A security team wants to scan a web application hosted on Compute Engine for vulnerabilities like XSS and outdated libraries. They want the scan to be authenticated to cover areas behind login. Which Google Cloud service and configuration should they use?

Accepted Answer

Web Security Scanner with a managed scan and custom login credentials.. Web Security Scanner can perform authenticated scans by providing login credentials. It can scan applications on Compute Engine and App Engine. It identifies vulnerabilities like XSS, mixed content, and outdated libraries.

Answer

VM Manager patch management to check for outdated libraries.

Answer

Cloud Security Scanner with a custom scan configuration including authentication headers.

Answer

Container Analysis with a custom scanning schedule.

Question 11

A company uses Chronicle as their SIEM. They need to ingest logs from an on-premises firewall that does not support direct integration with Chronicle. What is the recommended approach to ingest these logs?

Accepted Answer

Install a Chronicle forwarder on a local server to collect and forward logs to Chronicle.. Chronicle provides forwarders (software agents) that can be installed on a machine to collect logs from various sources like firewalls and forward them to Chronicle. The forwarder normalizes logs into UDM. The forwarder can be deployed on-premises or in a VM.

Answer

Use the firewall's syslog capabilities to send logs directly to a Chronicle endpoint.

Answer

Export firewall logs to Cloud Storage and then create a BigQuery external table for Chronicle.

Answer

Use a Cloud Function to pull logs from the firewall and push them to Chronicle via API.

Question 12

A company wants to automate patching of operating system vulnerabilities on their Compute Engine instances. They need a solution that supports both Windows and Linux and can schedule patch deployments with rolling updates. Which service should they use?

Accepted Answer

VM Manager. VM Manager is the OS management service that includes patch management. It supports both Windows and Linux, allows scheduling, and can perform rolling updates. OS Config Management and Cloud Scheduler are not patch management solutions.

Answer

OS Config Management

Answer

Cloud Scheduler

Answer

Deployment Manager

Question 13

An organization wants to detect and respond to potential data exfiltration attempts via VPC Flow Logs. They plan to export VPC Flow Logs to BigQuery for analysis. Which TWO actions should they take to enable this? (Choose TWO.)

Accepted Answer

Create a log sink with a filter for compute.googleapis.com/vpc_flows and destination BigQuery.. To export VPC Flow Logs to BigQuery, you need to create a log sink that filters for VPC Flow Logs and exports to BigQuery. The sink must be configured with a destination of BigQuery. Enabling Data Access logs is not required for VPC Flow Logs.

Answer

Set up a Cloud Function to copy logs from Cloud Logging to BigQuery.

Answer

Create a BigQuery view to filter VPC Flow Logs.

Answer

Enable Data Access logs for Compute Engine.

Question 14

A security team is designing an incident response workflow for container threats detected by Security Command Center Premium. They want to automatically capture forensic evidence from compromised GKE nodes. Which THREE steps should they include? (Choose THREE.)

Accepted Answer

Export the container image from Artifact Registry for analysis.. When a container threat is detected, the team should capture evidence by taking snapshots of persistent disks, collecting pod logs from the node, and exporting container logs. Deleting the cluster or creating a new node pool would destroy evidence.

Answer

Immediately drain and delete all pods on the node.

Answer

Delete the compromised node pool to prevent further damage.

Question 15

A company wants to ensure compliance with PCI DSS by monitoring access to BigQuery datasets containing sensitive data. They need to log all read operations and enable real-time alerting for anomalous access. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Create a log sink to export BigQuery Data Access logs to Pub/Sub.. BigQuery Data Access logs record read operations but are not enabled by default. To enable them, you must explicitly enable Data Access logs for BigQuery. For real-time alerting, you can export logs to Pub/Sub and process them with a Cloud Function.

Answer

Enable Admin Activity logs for BigQuery.

Answer

Use Security Command Center to detect sensitive data access.

Answer

Create a BigQuery view to restrict access to sensitive columns.