PCSE Managing Operations in a Cloud Solution Environment Practice Test 8 — 15 Questions

Question 1

A security engineer is investigating a potential data exfiltration incident. They suspect that a compromised VM is sending sensitive data to an external IP. Which three data sources should they examine to trace the exfiltration? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VPC Flow Logs. VPC Flow Logs (B) are correct because they capture IP-level metadata for traffic to and from VM network interfaces, letting the engineer identify connections from the compromised VM to the suspicious external IP, including ports, protocols, and byte/packet counts that reveal exfiltration volume. Cloud Audit Logs Data Access (D) are correct because they record data-plane operations such as reads or downloads of sensitive resources (for example, Cloud Storage object access via storage.objects.get), showing what data was accessed before being sent out. Cloud DNS logging (E) is correct because it records DNS queries from the VPC, which can reveal resolution of external exfiltration domains or command-and-control hostnames used by the compromised VM. Cloud NAT logs (A) are not among the marked answers because NAT logging primarily records NAT translations and errors for egress, not the full flow-level or data-access context needed here. Compute Engine serial port output (C) is not marked because it only shows console/serial output from the VM and does not provide network flow, DNS, or data-access records for tracing exfiltration.

Answer

Cloud NAT logs

Answer

Compute Engine serial port output

Question 2

Your organization uses VM Manager for patch management. You need to configure patch deployments to run weekly on all Windows VMs. Which two resources must be configured? (Choose two.)

Accepted Answer

Create a patch deployment with a weekly schedule. Option C is correct because VM Manager patch management requires a patch deployment resource, and to run weekly you must define a schedule (e.g., a cron-like recurring schedule) on that patch deployment so it executes automatically each week. Option D is correct because a patch deployment must specify which VMs it targets, and VM Manager uses instance filters/labels (such as OS = Windows) to select the target VMs, ensuring only Windows VMs are patched. Option A is incorrect because VPC Flow Logs capture network traffic metadata and have nothing to do with patch deployment configuration. Option B is incorrect because manually creating a patch job each week is not a configured weekly schedule and defeats the purpose of automated recurring patch deployments. Option E is incorrect because, while the OS Config agent is needed on VMs for VM Manager to manage them, the question asks which resources must be configured for the deployment itself, and agent installation is a prerequisite rather than a patch deployment resource.

Answer

Enable VPC Flow Logs on the VMs

Answer

Create a patch job manually each week

Answer

Install the OS Config agent on all VMs

Question 3

A security engineer needs to ensure that all container images deployed to a GKE cluster are signed by a trusted authority. The organization uses Cloud KMS for key management and wants to enforce the policy at admission time. Which two components are essential to implement this requirement? (Choose two.)

Accepted Answer

Attestor created in Binary Authorization with Cloud KMS key. Binary Authorization requires attestors to verify image signatures and a policy that requires at least one attestation. Attestors use Cloud KMS keys for signing, and the policy is enforced at GKE admission time.

Answer

Cloud Audit Logs enabled for GKE

Answer

Container Analysis vulnerability scanning

Answer

Web Security Scanner configured to scan the GKE cluster

Question 4

A financial services company uses Security Command Center (SCC) Premium tier to monitor its GCP environment. The security team wants to automatically respond to high-severity threat findings, such as 'Cryptomining' from Event Threat Detection. The response should include isolating the affected VM by removing its external IP and applying a firewall rule to block egress traffic. Which two steps should the team implement? (Choose two.)

Accepted Answer

Deploy a Cloud Function that listens on the Pub/Sub topic and uses Compute Engine API to modify the VM's network tags and update firewall rules. Option E is correct because SCC Premium can export findings to Pub/Sub via a NotificationConfig, which is the supported event-driven mechanism for triggering automated responses to findings like Event Threat Detection's Cryptomining. Option A is correct because a Cloud Function subscribed to that Pub/Sub topic can call the Compute Engine API to remove the VM's external IP (e.g., deleting the accessConfig) and modify network tags or firewall rules to block egress, achieving the required isolation. Option B is wrong because Security Health Analytics performs posture/misconfiguration scanning, not automated threat response. Option C is wrong because exporting Admin Activity logs to BigQuery is for auditing and analysis, not real-time remediation. Option D is wrong because VPC Flow Logs only provide network telemetry and cannot isolate a VM or block traffic.

Answer

Create a Security Health Analytics scan to detect similar threats

Answer

Set up a log sink to export Admin Activity logs to BigQuery

Answer

Enable VPC Flow Logs for the affected VM's subnet

Question 5

A multinational organization uses Chronicle SIEM to aggregate and analyze security logs from multiple GCP projects and on-premises systems. The security team wants to detect a known threat pattern: a user authenticating from an anomalous geographic location followed by a large data egress from a Compute Engine instance within 10 minutes. Which three steps are necessary to create this detection? (Choose three.)

Accepted Answer

Ingest Cloud Audit Logs and VPC Flow Logs into Chronicle via forwarders or native integration. Option A is correct because Chronicle detection requires the relevant telemetry in UDM; ingesting Cloud Audit Logs (for authentication events) and VPC Flow Logs (for network egress) via native integration or forwarders provides the raw events the rule will match. Option B is correct because the scenario explicitly includes on-premises systems, so a forwarder must send those authentication logs into Chronicle to correlate them with GCP activity. Option E is correct because YARA-L is Chronicle's detection language, and a rule matching a UDM authentication event with anomalous geo-location followed within 10 minutes by a UDM network event with large bytes out directly implements the described threat pattern. Option C is not needed because BigQuery export is for long-term storage/analysis, not for creating a real-time Chronicle detection. Option D is not needed because Security Command Center findings are a separate GCP security service and do not create the Chronicle YARA-L detection logic.

Answer

Configure a BigQuery export of VPC Flow Logs for long-term analysis

Answer

Enable the Standard tier of Security Command Center to generate finding notifications

Question 6

A healthcare organization uses Google Cloud and must comply with HIPAA. They need to ensure that all access to patient data stored in Cloud Storage is logged and that any unauthorized access attempts are detected in near real-time. They also want to minimize false positives. Which approach should they take?

Accepted Answer

Enable Data Access audit logs for Cloud Storage, and use Security Command Center Premium to detect anomalous access patterns.. Data Access audit logs for Cloud Storage record all object access. Security Command Center Premium provides near real-time threat detection, including anomalous access patterns, which helps detect unauthorized attempts with fewer false positives. This combination meets HIPAA logging and detection requirements.

Answer

Use Cloud Audit Logs with a log sink to BigQuery, and create a scheduled query to detect unauthorized access.

Answer

Enable Cloud Armor on the Cloud Storage bucket, and configure rules to block unauthorized IP addresses.

Answer

Enable VPC Flow Logs for the VPC containing the Cloud Storage bucket, and use Cloud Monitoring to alert on unusual traffic.

Question 7

A company has a Google Kubernetes Engine (GKE) cluster with several workloads. They want to ensure that only container images that have been scanned for vulnerabilities and signed by a trusted authority are deployed. They also want to receive alerts when an unsigned image is attempted to be deployed. Which Google Cloud service should they use?

Accepted Answer

Binary Authorization with a policy that requires attestations from a trusted attestor, and enable audit logging to capture violations.. Binary Authorization is the Google Cloud service designed to enforce deploy-time policies on GKE. By requiring attestations from a trusted attestor, only images that have been signed are admitted. Audit logging captures violations, which can be used to generate alerts. This combination ensures that unsigned images are blocked and that security teams are notified of attempts.

Answer

Artifact Registry with vulnerability scanning, and use IAM policies to restrict who can push images.

Answer

Container Analysis with vulnerability scanning enabled, and configure Pub/Sub notifications for vulnerabilities.

Answer

Security Command Center Premium with Container Threat Detection enabled, and configure findings to trigger alerts.

Question 8

A security engineer at a financial services company needs to ensure that all VPC Flow Logs and Cloud Audit Logs generated in their Google Cloud organization are retained for seven years and are immutable, even if a project owner attempts to delete them. They also need the ability to prove to auditors that the logs have not been altered. Which combination of Google Cloud services should they use?

Accepted Answer

Create a log sink to a Cloud Storage bucket with a retention policy and Bucket Lock, and enable Object Versioning.. A log sink to Cloud Storage with a retention policy and Bucket Lock ensures logs are retained for the required period and cannot be deleted or altered. Object Versioning adds protection against overwrites. Other options lack immutability or sufficient retention duration.

Answer

Store logs in a Cloud Storage bucket with a lifecycle rule to move objects to Coldline storage after 30 days and enable uniform bucket-level access.

Answer

Export logs to BigQuery with a dataset default table expiration set to seven years and enable audit logs for data access.

Answer

Use Cloud Logging's default retention of 30 days and create a log-based metric to alert on deletion attempts.

Question 9

Your organization uses Google Cloud and wants to ensure that all security-related logs, such as Cloud Audit Logs and VPC Flow Logs, are retained for at least 365 days for compliance. Currently, logs are stored in Cloud Logging's default buckets with a 30-day retention period. You need a solution that automatically exports logs to a cost-effective storage service and allows for easy retrieval if needed. What should you do?

Accepted Answer

Create a log sink that exports logs to a Cloud Storage bucket with a 365-day retention policy, and set the bucket's storage class to Coldline.. A log sink to Cloud Storage with a retention policy and Coldline storage class provides a cost-effective, managed solution for long-term log retention. It ensures logs are automatically exported and retained for the required period, and Coldline storage minimizes costs for infrequently accessed data. This approach is scalable and meets compliance needs.

Answer

Use the Cloud Logging API to programmatically download logs and store them in a Cloud Storage bucket with a lifecycle rule to delete after 365 days.

Answer

Create a log sink that exports logs to a BigQuery dataset with a 365-day partition expiration, and use BigQuery's long-term storage pricing.

Answer

Increase the retention period of the default _Default log bucket to 365 days using the gcloud logging buckets update command.

Question 10

Your organization uses Google Cloud and wants to ensure that all VPC network firewall rule changes are logged for later analysis and alerting. You need to enable the appropriate logging and route the logs to a central project for analysis. What should you do?

Accepted Answer

Ensure Admin Activity audit logs are enabled and create a log sink to a central project's BigQuery dataset.. Admin Activity audit logs capture administrative changes such as firewall rule modifications. They are always enabled and cannot be disabled. To centralize these logs for analysis and alerting, you create a log sink that exports them to a destination like BigQuery in a central project. This approach meets the requirement to log and analyze changes without relying on data access logs or flow logs, which serve different purposes.

Answer

Configure Cloud Audit Logs to log all admin activity and set up a Pub/Sub topic to stream logs to a third-party SIEM.

Answer

Enable Data Access audit logs for Compute Engine API and export logs to a central project.

Answer

Enable VPC Flow Logs on all subnets and export logs to a central Cloud Storage bucket.

Question 11

A security operations team needs to monitor for IAM policy changes across all projects in their Google Cloud organization. They want to be alerted within minutes when a user is granted the Owner role on any project. They have enabled Cloud Audit Logs for all services and want to use a native Google Cloud service that can aggregate and filter logs across the organization. What should they do?

Accepted Answer

Create a log sink at the organization level that filters for IAM policy changes and routes to a Pub/Sub topic, then trigger an alert via a Cloud Function.. The correct approach uses an organization-level log sink to aggregate audit logs from all projects. Filtering for IAM policy changes and routing to Pub/Sub enables immediate processing and alerting. This leverages native Google Cloud services to achieve centralized, near-real-time detection of privileged role assignments.

Answer

Enable VPC Flow Logs on all subnets and export to Cloud Monitoring for alerting on IAM changes.

Answer

Use Cloud Asset Inventory to export IAM policies to BigQuery and set up a scheduled query to detect changes.

Answer

Configure Cloud IDS to monitor for IAM policy changes and create alerts.

Question 12

A cloud security engineer needs to grant a service account the ability to publish messages to a Cloud Pub/Sub topic. The service account is used by an application running on Compute Engine. Following the principle of least privilege, which IAM role should be granted?

Accepted Answer

roles/pubsub.publisher. The principle of least privilege requires granting only the permissions needed. For publishing to a Pub/Sub topic, roles/pubsub.publisher is the minimal predefined role that provides the required permission without extra privileges.

Answer

roles/pubsub.editor

Answer

roles/pubsub.subscriber

Answer

roles/pubsub.admin

Question 13

Your organization uses Security Command Center (SCC) Premium across 15 Google Cloud projects managed under a single organization node. A security analyst needs to receive near-real-time alerts in a Slack channel whenever a new HIGH severity finding is created. You want a low-maintenance, serverless approach that does not require managing a Compute Engine instance. What should you do?

Accepted Answer

Create a Pub/Sub topic in the security project, configure an SCC notification config filtered to HIGH severity findings to publish to that topic, and deploy a Cloud Run service subscribed to the topic that posts to Slack.. Security Command Center Premium supports notification configs that publish findings to Pub/Sub with filter expressions. Combining that with a serverless consumer such as Cloud Run provides event-driven, near-real-time delivery without managing infrastructure. Polling, flow logs, or batch exports either add latency, miss the finding data entirely, or require more operational overhead than the native notification path.

Answer

Configure a Cloud Logging log sink that exports SCC findings to a Cloud Storage bucket, then run a Cloud Function triggered by object finalization that parses the file and posts to Slack.

Answer

Enable VPC Flow Logs on all subnets and create a log-based alert that triggers a Cloud Monitoring notification channel configured for Slack.

Answer

Schedule a Cloud Scheduler job every 5 minutes that calls the Security Command Center API to list findings and posts new ones to Slack from a Cloud Function.

Question 14

Your security team uses Security Command Center (SCC) Premium. You need to automatically remediate a specific misconfiguration: a Cloud Storage bucket that has public access. When SCC detects this finding, you want to automatically remove the public access. What should you do?

Accepted Answer

Create a Cloud Function that is triggered by a Pub/Sub topic. Configure SCC to publish findings to that topic, and filter for the specific finding type. The function then removes the public IAM policy binding.. To automatically remediate a finding from Security Command Center, you can export findings to Pub/Sub and trigger a Cloud Function. The function can inspect the finding and take corrective action, such as removing public IAM bindings from a Cloud Storage bucket. This event-driven approach ensures timely remediation. SCC does not provide built-in auto-remediation, and periodic scans or VPC Service Controls do not meet the requirement for automatic, immediate response to the specific finding.

Answer

Use SCC's built-in auto-remediation feature to automatically remove public access from the bucket.

Answer

Create a Cloud Scheduler job that periodically scans all buckets for public access and removes it using a script.

Answer

Enable VPC Service Controls to prevent public access to Cloud Storage buckets.

Question 15

A security team wants to detect and respond to suspicious network traffic in near real-time across multiple VPC networks. They need to capture packet-level data for forensic analysis without impacting performance. Which Google Cloud service should they use?

Accepted Answer

Packet Mirroring. Packet Mirroring captures full packet data from selected instances and forwards it to a collector, enabling deep forensic analysis. VPC Flow Logs and Firewall Rules Logging only provide metadata, and Cloud IDS is for threat detection without raw packets. Therefore, Packet Mirroring is the correct choice for packet-level capture across multiple VPC networks.

Answer

Cloud IDS

Answer

VPC Flow Logs

Answer

Firewall Rules Logging