PCSE Managing Operations in a Cloud Solution Environment Practice Test 6 — 15 Questions

Question 1

A security engineer needs to automatically remediate a high-severity finding in Security Command Center. The remediation involves restarting a Compute Engine instance. What is the recommended approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Cloud Function triggered by a Pub/Sub notification from SCC, and use the Compute Engine API to restart the instance.. The recommended approach is to create a Cloud Function triggered by a Pub/Sub notification from Security Command Center, then use the Compute Engine API to restart the instance. SCC can publish findings to Pub/Sub, and the Cloud Function reacts in near real-time, invoking the Compute Engine API for remediation. This is event-driven and aligns with Google Cloud best practices.

Answer

Configure a log sink to Cloud Functions and parse logs for the finding.

Answer

Use a Compute Engine startup script to check SCC and restart.

Answer

Use Cloud Scheduler to periodically check SCC and restart instances.

Question 2

Which Google Cloud service should be used for long-term archival of Audit Logs that must be immutable and stored for 10 years for compliance?

Accepted Answer

Cloud Storage with Archive storage class and retention policy. Cloud Storage with Archive storage class offers the lowest cost for long-term storage, and retention policies enforce immutability.

Answer

Cloud SQL with backups

Answer

BigQuery with time-based partitioning

Answer

Pub/Sub with message retention

Question 3

An organization wants to use Chronicle for SIEM. They need to ingest logs from an on-premises firewall. Which method should they use?

Accepted Answer

Use a forwarder (e.g., Syslog to UDM) to send logs to Chronicle. On-premises firewalls cannot natively push logs to Google Cloud services, so the standard Chronicle ingestion path is to deploy a forwarder (the Chronicle Forwarder, or a Syslog-based collector) that receives the firewall's syslog output, normalizes it to UDM, and forwards it to Chronicle over an authenticated channel. This is the documented method for ingesting third-party on-prem logs into Chronicle.

Answer

Configure a log sink from Cloud Logging to Chronicle

Answer

Export logs to Cloud Storage and have Chronicle import them

Answer

Directly send logs to a Pub/Sub topic that is ingested by Chronicle

Question 4

A security engineer wants to review all IAM permission changes made in the last 30 days. Which type of Cloud Audit Log should they query?

Accepted Answer

Admin Activity logs. Admin Activity logs record API calls that modify configuration or metadata, including IAM policy and permission changes (e.g., SetIamPolicy). They are enabled by default and retained for 400 days, making them the correct source for auditing permission changes over the last 30 days. Data Access logs, by contrast, record reads/writes of user data, not IAM configuration.

Answer

Data Access logs

Answer

System Event logs

Answer

Policy Denied logs

Question 5

A company uses Security Command Center (SCC) Premium tier and wants to automatically trigger a Cloud Function to remediate a threat finding. Which approach should they use?

Accepted Answer

Configure SCC to send findings to a Pub/Sub topic, and subscribe a Cloud Function to that topic.. Security Command Center (SCC) Premium can export findings to Pub/Sub, and a Cloud Function can be triggered by messages published to that topic. This event-driven approach enables automatic, near-real-time remediation of threat findings.

Answer

Use Cloud Tasks to periodically invoke Cloud Functions after reading findings from Security Command Center API.

Answer

Create a Cloud Scheduler job that polls SCC findings periodically and invokes Cloud Functions.

Answer

Export SCC findings to Cloud Storage, and set up a Cloud Function on object finalize.

Question 6

A security engineer needs to archive Cloud Audit Logs for regulatory compliance for 7 years. The logs should be immutable and cost-effective. Which solution should they choose?

Accepted Answer

Export logs to Cloud Storage using a sink, and enable Bucket Lock with retention policy.. Cloud Storage with the Archive storage class and retention policy using Bucket Lock provides immutable, low-cost storage for long-term archival. Logging exports can be configured via a sink to write logs to a bucket with these settings. BigQuery is not suitable for long-term archival due to cost; Pub/Sub is for streaming; Cloud Spanner is transactional and expensive.

Answer

Export logs to Pub/Sub and store them in a Cloud Spanner table with 7-year TTL.

Answer

Export logs to BigQuery and set a 7-year table expiration.

Answer

Use the default log retention of 400 days and copy logs to a persistent disk snapshot.

Question 7

Which Security Command Center tier provides Event Threat Detection and Container Threat Detection?

Accepted Answer

Premium tier. These threat detection services are available only in the Premium tier of Security Command Center. The Standard tier includes Security Health Analytics, Web Security Scanner, and Anomaly Detection. Compliance monitoring is also Premium-only.

Answer

Both tiers

Answer

Standard tier

Answer

Neither tier, they are separate services

Question 8

A security team wants to analyze VPC Flow Logs for potential data exfiltration. They need a solution that allows querying with SQL and requires minimal setup. Which approach should they take?

Accepted Answer

Export VPC Flow Logs to BigQuery via a log sink, then run SQL queries.. VPC Flow Logs can be exported to BigQuery via a log sink, which enables SQL analysis with minimal setup. Chronicle uses YARA-L rules, not SQL, and requires its own ingestion configuration. Cloud SQL requires a custom pipeline. Cloud Logging Log Analytics also supports SQL queries over logs, but the BigQuery log sink is the standard, managed approach for exporting flow logs to a SQL-queryable dataset.

Answer

Ingest VPC Flow Logs into Chronicle and use YARA-L rules.

Answer

Stream VPC Flow Logs to Cloud SQL using a custom pipeline.

Answer

Export VPC Flow Logs to Cloud Logging and use Log Analytics with SQL.

Question 9

An organization needs to scan container images stored in Artifact Registry for vulnerabilities before deployment. They want to use a managed service that integrates with their CI/CD pipeline. Which Google Cloud service should they use?

Accepted Answer

Container Analysis. Container Analysis is the Google Cloud managed service that performs vulnerability scanning on container images stored in Artifact Registry (and previously Container Registry). It integrates natively with CI/CD pipelines by exposing scan results via the Container Analysis API and Pub/Sub notifications, allowing builds to be gated on vulnerability findings. This makes it the correct choice for pre-deployment image scanning in a managed, pipeline-friendly way.

Answer

Web Security Scanner

Answer

Cloud Security Scanner

Answer

VM Manager patch management

Question 10

A company wants to use Chronicle to ingest logs from their on-premises firewalls into Google Cloud. They need to normalize logs into a common schema for analysis. Which Chronicle capability should they use?

Accepted Answer

Unified Data Model (UDM). Chronicle uses the Unified Data Model (UDM) to normalize logs from various sources into a common schema. Log forwarders can collect and send logs to Chronicle, but UDM is the normalization engine. YARA-L rules are for detection, not normalization. The dashboard is for visualization.

Answer

Log forwarders

Answer

YARA-L rules

Answer

Chronicle dashboards

Question 11

Which type of Cloud Audit Logs must be explicitly enabled and incur additional cost?

Accepted Answer

Data Access logs. Data Access logs track read and write operations on resources. They are opt-in, cost extra, and have additional retention costs. Admin Activity logs are free and enabled by default. System Event logs are also free. Policy Denied logs are generated automatically when access is denied.

Answer

Admin Activity logs

Answer

System Event logs

Answer

Policy Denied logs

Question 12

A security engineer needs to implement a logging pipeline that sends real-time Cloud Audit Logs to a third-party SIEM. They must ensure that if the SIEM is unavailable, logs are not lost. Which approach should they use?

Accepted Answer

Create a log sink that writes to a Pub/Sub topic, and use a subscription with a dead letter topic.. Using a Pub/Sub subscription with a dead letter topic allows messages to be retried and, if delivery fails persistently, moved to a dead letter topic for later reprocessing. This prevents data loss. Cloud Storage is not real-time; BigQuery is not for streaming to SIEM; Cloud Run without Pub/Sub would miss retries.

Answer

Configure a Cloud Run service to pull logs from Cloud Logging API and forward to SIEM.

Answer

Export logs to Cloud Storage via a sink, and have the SIEM ingest from there.

Answer

Use a log sink to BigQuery and have the SIEM query BigQuery periodically.

Question 13

An organization wants to use Security Command Center to detect misconfigurations in their Google Cloud resources. They need a service that can automatically check for common security issues like open firewall ports and IAM policy violations. Which SCC feature should they enable?

Accepted Answer

Security Health Analytics. Security Health Analytics is the SCC service that continuously scans Google Cloud resources against a library of detectors for misconfigurations such as open firewall rules, public buckets, and overly permissive IAM policies. It surfaces these as findings in SCC, making it the correct feature for configuration posture checks.

Answer

Anomaly Detection

Answer

Event Threat Detection

Answer

Web Security Scanner

Question 14

An incident responder needs to collect forensic evidence from a compromised Compute Engine instance for later analysis. They want to preserve disk state and network logs. Which THREE actions should they take?

Accepted Answer

Export and analyze VPC Flow Logs for the instance's network traffic.. Option A is correct because VPC Flow Logs capture the instance's network traffic metadata (5-tuple, bytes, timestamps) and can be exported to Cloud Storage or BigQuery for later forensic analysis, satisfying the requirement to preserve network logs. Option C is correct because creating a snapshot of the boot disk preserves the persistent disk state at a point in time, allowing the responder to attach the snapshot to a clean instance and analyze it without altering the original evidence. Option E is correct because isolating the instance with a firewall rule that blocks all traffic except from a forensic workstation contains the compromise while still permitting the responder to acquire live evidence or memory over the network. Option B is wrong because deleting the instance destroys the boot disk and any attached persistent disks, irreversibly losing forensic evidence. Option D is wrong because powering off the instance can destroy volatile evidence in memory and does not by itself preserve disk state or network logs as cleanly as a snapshot plus isolation.

Answer

Delete the instance to stop billing.

Answer

Power off the instance to prevent further compromise.

Question 15

A security engineer wants to monitor all actions that create or modify resources in a Google Cloud project. Which type of audit log is enabled by default and cannot be disabled?

Accepted Answer

Admin Activity logs. Admin Activity logs are enabled by default and cannot be disabled. They record all actions that modify the configuration or metadata of resources, such as creating a VM or changing IAM policies. This ensures a baseline audit trail for all administrative changes.

Answer

Policy Denied logs

Answer

Data Access logs

Answer

System Event logs