PCSE Managing Operations in a Cloud Solution Environment Practice Test 7 — 15 Questions

Question 1

An organization wants to enforce that all container images deployed to a GKE cluster must be signed by an approved authority. They have set up Binary Authorization with a policy that requires attestation. Where should the signing key be stored to meet security best practices?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Store the private key in Cloud Key Management Service (Cloud KMS).. Storing the private key in Cloud KMS is the best practice because it provides a secure, managed environment for cryptographic keys, with access controls, auditing, and hardware security module (HSM) backing. This ensures the signing key is protected and meets security compliance requirements.

Answer

Store the private key in a GCS bucket with uniform bucket-level access.

Answer

Store the private key in Secret Manager.

Answer

Store the private key on the developer's workstation.

Question 2

Which Google Cloud SIEM solution ingests logs from various sources, normalizes them into the Unified Data Model (UDM), and allows detection using YARA-L rules?

Accepted Answer

Chronicle. Google Chronicle (now part of Google Security Operations) is the cloud-native SIEM that ingests logs at scale, normalizes them into the Unified Data Model (UDM), and applies YARA-L detection rules. UDM and YARA-L are Chronicle-specific technologies, making it the only correct answer.

Answer

Cloud Logging

Answer

BigQuery

Answer

Security Command Center

Question 3

A security team needs to automatically respond to high-severity vulnerability findings in Security Command Center. They want to trigger a Cloud Function that quarantines the affected VM. What is the recommended way to connect SCC findings to Cloud Functions?

Accepted Answer

Create a SCC notification config that sends findings to a Pub/Sub topic, and set up a Cloud Function to subscribe to that topic.. Security Command Center supports notification configs that publish findings to a Pub/Sub topic, and Cloud Functions can subscribe to that topic to trigger automated responses. This is the native, event-driven integration pattern recommended by Google Cloud for SCC-based automation, providing near-real-time response without polling.

Answer

Use Cloud Scheduler to poll SCC API every minute and invoke Cloud Function.

Answer

Configure Cloud Logging to capture SCC findings and create a log-based metric with an alert that triggers Cloud Function.

Answer

Export SCC findings to BigQuery and set up a BigQuery scheduled query to trigger Cloud Function.

Question 4

During a security incident, a forensic investigator needs to analyze a compromised Compute Engine instance without affecting the live environment. The instance has persistent disks with critical data. What is the best first step to preserve evidence?

Accepted Answer

Create a snapshot of the persistent disks.. Creating a snapshot of the persistent disks is the correct first step because it produces a point-in-time, read-only copy of the disk state in Cloud Storage without modifying the running instance, preserving evidence for forensic analysis. The snapshot can then be used to create a new disk attached to an isolated forensic VM.

Answer

Clone the instance to a new VM.

Answer

Export the disk image to Cloud Storage.

Answer

Enable VPC Flow Logs for the instance's network.

Question 5

A company uses Chronicle as their SIEM. They need to ingest logs from an on-premises firewall that does not support direct integration with Chronicle. What is the recommended approach to ingest these logs?

Accepted Answer

Install a Chronicle forwarder on a local server to collect and forward logs to Chronicle.. Chronicle provides a forwarder that can be installed on a local server or VM to collect logs from sources that lack native integration, then securely forward them to Chronicle. This is the documented recommended approach for on-premises devices such as firewalls that cannot send logs directly to Chronicle.

Answer

Use the firewall's syslog capabilities to send logs directly to a Chronicle endpoint.

Answer

Export firewall logs to Cloud Storage and then create a BigQuery external table for Chronicle.

Answer

Use a Cloud Function to pull logs from the firewall and push them to Chronicle via API.

Question 6

An organization wants to detect and respond to potential data exfiltration attempts via VPC Flow Logs. They plan to export VPC Flow Logs to BigQuery for analysis. Which TWO actions should they take to enable this? (Choose TWO.)

Accepted Answer

Create a log sink with a filter for compute.googleapis.com/vpc_flows and destination BigQuery.. Option E is correct because VPC Flow Logs must first be enabled on the subnet (or instance) to generate the flow log records; without enabling them, no vpc_flows log entries exist to export. Option A is correct because exporting logs from Cloud Logging to BigQuery requires a log sink whose filter targets the resource type compute.googleapis.com/vpc_flows and whose destination is a BigQuery dataset, which is the supported native export path. Option B is not needed because Cloud Logging supports a built-in BigQuery sink destination, so a Cloud Function to copy logs is unnecessary and adds complexity. Option C is incorrect because a BigQuery view only queries data already in BigQuery; it does not export or enable flow logs. Option D is incorrect because Data Access logs for Compute Engine record admin/data access API activity, not VPC flow telemetry, so they do not produce the flow log data needed for exfiltration analysis.

Answer

Set up a Cloud Function to copy logs from Cloud Logging to BigQuery.

Answer

Create a BigQuery view to filter VPC Flow Logs.

Answer

Enable Data Access logs for Compute Engine.

Question 7

A company wants to ensure compliance with PCI DSS by monitoring access to BigQuery datasets containing sensitive data. They need to log all read operations and enable real-time alerting for anomalous access. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Create a log sink to export BigQuery Data Access logs to Pub/Sub.. Option C is correct because BigQuery Data Access logs record read operations (such as tabledata.list and jobs.query) against datasets, which is exactly the audit trail PCI DSS requires for monitoring access to sensitive data. Option A is correct because creating a log sink that exports those Data Access logs to Pub/Sub enables downstream real-time processing and alerting on anomalous access patterns. Option B is wrong because Admin Activity logs only capture configuration and metadata changes (e.g., creating or deleting datasets), not the read operations the scenario requires. Option D is wrong because Security Command Center detects misconfigurations and threats but does not itself provide the BigQuery read-operation audit logging needed here. Option E is wrong because a BigQuery view restricts column-level access but does not log read operations or provide alerting.

Answer

Enable Admin Activity logs for BigQuery.

Answer

Use Security Command Center to detect sensitive data access.

Answer

Create a BigQuery view to restrict access to sensitive columns.

Question 8

Your company uses Security Command Center (SCC) Standard tier and wants to detect threats like cryptocurrency mining or anomalous network behavior in real-time. You need to recommend an upgrade to SCC Premium tier and configure the appropriate module. Which SCC Premium module should be enabled?

Accepted Answer

Event Threat Detection. Event Threat Detection (ETD) monitors logs (e.g., Cloud Audit Logs, DNS, network) and uses machine learning to detect threats like cryptomining, C2 communication, and data exfiltration. It provides real-time detection and is a Premium tier feature.

Answer

Container Threat Detection

Answer

Web Security Scanner

Answer

Security Health Analytics

Question 9

A DevOps team wants to enforce that only container images signed by a specific authority can be deployed in a GKE cluster. They plan to use Binary Authorization. Which configuration is required?

Accepted Answer

Create an attestor, generate a key pair with Cloud KMS, and configure the policy to require at least one attestation from that attestor. Binary Authorization enforces deploy-time attestation: a container image can only be deployed if it has at least one valid attestation from an attestor referenced in the cluster's policy. The required setup is to create an attestor, generate a signing key pair (typically in Cloud KMS), and configure the policy to require attestation from that attestor. The CI/CD pipeline then signs images after verification, producing attestations that Binary Authorization validates at admission time.

Answer

Create an attestor and set the policy to 'Deny all' and then add exceptions for signed images

Answer

Create an attestor and set the policy to 'Allow all' so that signed images are allowed

Answer

Create a vulnerability scan policy in Artifact Registry to block unsigned images

Question 10

Your organization wants to use Chronicle SIEM to analyze security events from both Google Cloud and on-premises firewalls. They want to normalize firewall logs into a common schema. Which Chronicle feature should they use?

Accepted Answer

Unified Data Model (UDM). The Unified Data Model (UDM) is Chronicle's common schema that normalizes logs from diverse sources, including Google Cloud and on-premises firewalls, into a consistent format for analysis. By mapping raw logs to UDM fields, Chronicle enables correlation and search across heterogeneous data. This is exactly the feature required to normalize firewall logs into a common schema.

Answer

Log forwarder

Answer

Investigation timeline

Answer

YARA-L rules

Question 11

A company needs to archive Cloud Audit Logs for compliance purposes for 7 years. The logs are rarely accessed after the first year. Which storage option is the most cost-effective?

Accepted Answer

Export logs to Cloud Storage with Archive storage class. Cloud Storage Archive storage class is designed for data accessed less than once a year and retained for long periods, offering the lowest storage price among Cloud Storage classes. Since the logs are rarely accessed after year one but must be kept for seven years, Archive minimizes cost while meeting the retention requirement. Standard storage would be far more expensive for cold data.

Answer

Export logs to Cloud Storage with Standard storage class

Answer

Export logs to BigQuery dataset

Answer

Export logs to Pub/Sub topic

Question 12

You need to configure automated remediation for high-severity SCC findings. When a finding of type 'VULNERABILITY' with severity 'HIGH' is created, a Cloud Function should execute a script to patch the vulnerable VM. Which architecture is correct?

Accepted Answer

Configure SCC to publish findings to a Pub/Sub topic, and set up a Cloud Function subscribed to that topic. The correct architecture uses Security Command Center (SCC) to publish findings to a Pub/Sub topic, with a Cloud Function subscribed to that topic to trigger remediation. SCC natively supports continuous exports to Pub/Sub, enabling near-real-time, event-driven response to findings. This is the recommended pattern for automated remediation in Google Cloud.

Answer

Configure SCC to send findings to Cloud Storage, then use Cloud Functions on object change

Answer

Use Cloud Scheduler to poll SCC API every minute and trigger Cloud Function

Answer

Configure SCC to send notifications to Cloud Logging, then create a log-based metric and alert to trigger Cloud Function

Question 13

A security team wants to use Web Security Scanner to find vulnerabilities in their web application hosted on Compute Engine. They need to scan the public-facing URL weekly and receive a report of findings. Which configuration is required?

Accepted Answer

Create a managed scan in Security Command Center with the target URL and schedule. Web Security Scanner is a fully managed service within Google Cloud Security Command Center (SCC) that scans web applications for common vulnerabilities like XSS, SQL injection, and mixed content. To scan a public-facing URL on a scheduled basis, you create a managed scan in SCC, specifying the target URL and a schedule (e.g., weekly). No agent installation or code changes are required, and the scanner works with any publicly accessible endpoint, including those on Compute Engine.

Answer

Install the Web Security Scanner agent on the VM

Answer

Use gcloud compute instances scan command

Answer

Deploy the application to App Engine, then enable Web Security Scanner

Question 14

A security analyst needs to mute a recurring false positive finding in Security Command Center so that it no longer appears in the active findings list. The analyst wants to keep the finding for historical reference. What should they do?

Accepted Answer

Mute the finding using the SCC console or API. Security Command Center provides a mute feature that suppresses a finding from the active findings list while preserving it for historical reference and audit purposes. Muting is the intended mechanism for recurring false positives. Setting state to INACTIVE changes the finding's lifecycle state but does not remove it from active views in the same way, and deleting removes it entirely.

Answer

Set the finding's state to 'INACTIVE'

Answer

Create a filter to exclude the finding from view

Answer

Delete the finding from SCC

Question 15

Your company needs to implement real-time monitoring of security events from Google Cloud resources. They want to ingest logs into a third-party SIEM system. Which two services should they use together? (Choose two.)

Accepted Answer

Cloud Logging log sink with Pub/Sub destination. Option B is correct because a Cloud Logging log sink can route log entries to a Pub/Sub topic, which is the standard mechanism for streaming logs out of Google Cloud in real time to an external system. Option E is correct because the third-party SIEM must consume those messages via a Pub/Sub subscription, where a subscriber pulls (or receives push) the log data for ingestion. Together, the log sink with a Pub/Sub destination plus a Pub/Sub subscription with a pulling subscriber form the real-time streaming pipeline to the third-party SIEM. Option A (Cloud Storage export) is batch-oriented and not real-time, so it does not fit. Option C (Chronicle SIEM) is itself a SIEM, not the ingestion mechanism for a third-party SIEM. Option D (BigQuery export) is for analytics/querying and is not a real-time streaming path to an external SIEM.

Answer

Cloud Storage export

Answer

Chronicle SIEM

Answer

BigQuery export