PCSE Managing Operations in a Cloud Solution Environment Practice Test 5 — 15 Questions

Question 1

A security engineer wants to export all Cloud Audit Logs from a Google Cloud project to a BigQuery dataset for long-term analysis. Which type of log sink should be configured?

Accepted Answer

Create a project-level aggregated sink with destination set to BigQuery dataset. A project-level aggregated sink collects logs from all resources within the project. BigQuery is the appropriate destination for analysis. The sink must include all log types, but Admin Activity logs are enabled by default and cannot be disabled.

Answer

Create a folder-level sink and assign it to the project

Answer

Create an organization-level sink with includeChildren set to true

Answer

Create a sink for each log type individually

Question 2

Your company uses Security Command Center (SCC) Standard tier and wants to detect threats like cryptocurrency mining or anomalous network behavior in real-time. You need to recommend an upgrade to SCC Premium tier and configure the appropriate module. Which SCC Premium module should be enabled?

Accepted Answer

Event Threat Detection. Event Threat Detection (ETD) monitors logs (e.g., Cloud Audit Logs, DNS, network) and uses machine learning to detect threats like cryptomining, C2 communication, and data exfiltration. It provides real-time detection and is a Premium tier feature.

Answer

Container Threat Detection

Answer

Web Security Scanner

Answer

Security Health Analytics

Question 3

A DevOps team wants to enforce that only container images signed by a specific authority can be deployed in a GKE cluster. They plan to use Binary Authorization. Which configuration is required?

Accepted Answer

Create an attestor, generate a key pair with Cloud KMS, and configure the policy to require at least one attestation from that attestor. Binary Authorization enforces deployment policies. To require signed images, you create an attestor (e.g., using Cloud KMS) and a policy that requires at least one attestation from that attestor. The policy type must be 'Require attestations' (not 'Allow all' or 'Deny all').

Answer

Create an attestor and set the policy to 'Deny all' and then add exceptions for signed images

Answer

Create an attestor and set the policy to 'Allow all' so that signed images are allowed

Answer

Create a vulnerability scan policy in Artifact Registry to block unsigned images

Question 4

During a security incident, a forensics team needs to capture a disk snapshot of a compromised Compute Engine instance for analysis. They want to ensure the snapshot is consistent and includes data in memory. Which step should be taken before taking the snapshot?

Accepted Answer

Stop the instance before taking the snapshot. For consistent snapshots of a running instance, you should first stop the instance (or at least freeze the filesystem). To capture memory, you would need to use a tool like LiME or dump the memory via a hypervisor; standard disk snapshots do not capture memory. However, the question asks about disk snapshot consistency; the best practice is to stop the instance.

Answer

Take a snapshot while the instance is running; consistency is automatic

Answer

Enable VPC Flow Logs on the network

Answer

Create an image from the disk first

Question 5

Your organization wants to use Chronicle SIEM to analyze security events from both Google Cloud and on-premises firewalls. They want to normalize firewall logs into a common schema. Which Chronicle feature should they use?

Accepted Answer

Unified Data Model (UDM). Chronicle's Unified Data Model (UDM) normalizes logs from different sources into a common schema, making it easier to search and analyze. Forwarders can send logs, but normalization is done via UDM parsing.

Answer

Log forwarder

Answer

Investigation timeline

Answer

YARA-L rules

Question 6

A company needs to archive Cloud Audit Logs for compliance purposes for 7 years. The logs are rarely accessed after the first year. Which storage option is the most cost-effective?

Accepted Answer

Export logs to Cloud Storage with Archive storage class. Cloud Storage offers Archive class for long-term, low-cost storage. BigQuery is for analysis, not archival. Pub/Sub is for streaming. Cloud Storage is the right choice; Archive class is cheaper than Nearline or Coldline.

Answer

Export logs to Cloud Storage with Standard storage class

Answer

Export logs to BigQuery dataset

Answer

Export logs to Pub/Sub topic

Question 7

You need to configure automated remediation for high-severity SCC findings. When a finding of type 'VULNERABILITY' with severity 'HIGH' is created, a Cloud Function should execute a script to patch the vulnerable VM. Which architecture is correct?

Accepted Answer

Configure SCC to publish findings to a Pub/Sub topic, and set up a Cloud Function subscribed to that topic. SCC can publish findings to a Pub/Sub topic. A Cloud Function subscribed to that topic can then trigger remediation actions. The Cloud Function must filter findings by severity and type.

Answer

Configure SCC to send findings to Cloud Storage, then use Cloud Functions on object change

Answer

Use Cloud Scheduler to poll SCC API every minute and trigger Cloud Function

Answer

Configure SCC to send notifications to Cloud Logging, then create a log-based metric and alert to trigger Cloud Function

Question 8

A security team wants to use Web Security Scanner to find vulnerabilities in their web application hosted on Compute Engine. They need to scan the public-facing URL weekly and receive a report of findings. Which configuration is required?

Accepted Answer

Create a managed scan in Security Command Center with the target URL and schedule. Web Security Scanner requires a managed scan target (URL) to be configured. Scans can be scheduled. It does not require an App Engine or GKE; it can scan any public URL. The scan is managed by Google Cloud and reports findings to SCC.

Answer

Install the Web Security Scanner agent on the VM

Answer

Use gcloud compute instances scan command

Answer

Deploy the application to App Engine, then enable Web Security Scanner

Question 9

Your organization uses VPC Flow Logs for network forensics. During an incident, you need to analyze traffic to a compromised instance for the last 72 hours. The Flow Logs are stored in Cloud Logging. Which approach allows you to query the logs most efficiently?

Accepted Answer

Use Logs Explorer in Cloud Logging to filter by instance and time range. Cloud Logging's Logs Explorer provides a query interface to filter and analyze logs. BigQuery is better for large-scale analysis, but for ad-hoc querying of recent logs, Logs Explorer is efficient. Note: Logs can be exported to BigQuery for complex analysis, but the question asks for efficient querying now.

Answer

Export logs to BigQuery and run SQL queries

Answer

Use the gcloud logging read command with appropriate filters

Answer

Download logs as CSV from Cloud Storage

Question 10

A developer wants to be notified when a new vulnerability is found in a container image stored in Artifact Registry. Which service should they configure?

Accepted Answer

Container Analysis. Artifact Registry integrates with Container Analysis to scan images for vulnerabilities. Notifications can be sent via Pub/Sub when new vulnerabilities are discovered.

Answer

Cloud Security Scanner

Answer

Binary Authorization

Answer

VM Manager

Question 11

Your company has hundreds of GKE clusters across multiple projects. You need to ensure that all clusters have Container Threat Detection enabled. Which approach is most scalable?

Accepted Answer

Write a script using gcloud container clusters update with --enable-threat-detection flag. SCC Premium includes Container Threat Detection. To enable it across clusters, you can use an organization policy or a custom script. Using Terraform or Config Controller to manage clusters as code is scalable. The most straightforward way: enable SCC Premium at the organization level and then enable Container Threat Detection per cluster via the API or gcloud. A script using gcloud commands can iterate through all clusters.

Answer

Create a new organization policy that enforces Container Threat Detection on all clusters

Answer

Deploy a DaemonSet that enables Container Threat Detection

Answer

Manually enable Container Threat Detection in each cluster via the Cloud Console

Question 12

A security analyst needs to mute a recurring false positive finding in Security Command Center so that it no longer appears in the active findings list. The analyst wants to keep the finding for historical reference. What should they do?

Accepted Answer

Mute the finding using the SCC console or API. Muting a finding in SCC hides it from active views but retains it for auditing. Muting can be done individually or via mute rules based on properties.

Answer

Set the finding's state to 'INACTIVE'

Answer

Create a filter to exclude the finding from view

Answer

Delete the finding from SCC

Question 13

Your company needs to implement real-time monitoring of security events from Google Cloud resources. They want to ingest logs into a third-party SIEM system. Which two services should they use together? (Choose two.)

Accepted Answer

Cloud Logging log sink with Pub/Sub destination. Cloud Logging can export logs to Pub/Sub, and a subscriber (SIEM connector) can ingest them. Chronicle is a Google SIEM, but the question asks for third-party SIEM integration.

Answer

Cloud Storage export

Answer

Chronicle SIEM

Answer

BigQuery export

Question 14

A security engineer is investigating a potential data exfiltration incident. They suspect that a compromised VM is sending sensitive data to an external IP. Which three data sources should they examine to trace the exfiltration? (Choose three.)

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture network metadata, DNS queries can show domain lookups, and Cloud Audit Logs (Data Access) can log data access events. Cloud NAT logs show outbound connections but are not as detailed for exfiltration. Compute Engine serial port output shows console logs but not network traffic.

Answer

Cloud NAT logs

Answer

Compute Engine serial port output

Question 15

Your organization uses VM Manager for patch management. You need to configure patch deployments to run weekly on all Windows VMs. Which two resources must be configured? (Choose two.)

Accepted Answer

Create a patch deployment with a weekly schedule. VM Manager uses patch deployments and patch jobs. You create a patch deployment with a schedule (weekly) and target VMs (e.g., by OS type). You also need to configure a maintenance window or use a rolling update.

Answer

Enable VPC Flow Logs on the VMs

Answer

Create a patch job manually each week

Answer

Install the OS Config agent on all VMs