PCSE Managing Operations in a Cloud Solution Environment Practice Test 9 — 15 Questions

Question 1

Your organization wants to monitor and audit all administrative activities across multiple Google Cloud projects. You need to ensure that audit logs are retained for at least 1 year and can be queried easily. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a log sink at the organization level that exports Admin Activity audit logs to a BigQuery dataset.. Admin Activity audit logs capture administrative actions and are enabled by default. To centralize and retain them for a year with easy querying, create an organization-level log sink to BigQuery. BigQuery supports SQL queries and allows setting table expiration to meet retention. Data Access logs are not needed for administrative auditing, and default Logging retention is only 30 days, so exporting is necessary.

Answer

Enable Data Access audit logs for all services and export them to Cloud Storage.

Answer

Use Cloud Logging's default retention of 30 days and rely on the logs being available for 1 year in Logs Explorer.

Answer

Create a log sink at each project level to export logs to a central Cloud Storage bucket, and use Cloud SQL to query the logs.

Question 2

A security engineer needs to monitor for anomalous IAM activity in a Google Cloud organization. They want to detect when a service account key is created for a highly privileged service account and alert the security team in near real-time. They also want to minimize false positives. Which approach should they use?

Accepted Answer

Configure a log sink to Pub/Sub with a filter for the CreateServiceAccountKey method and the specific service account, then trigger a Cloud Function to send an alert.. A log sink to Pub/Sub with a precise filter on the method and service account enables near real-time, targeted alerting. This minimizes false positives by only triggering on the specified high-privilege service account. Cloud Functions can then send alerts.

Answer

Create a log-based metric for the CreateServiceAccountKey method and set up an alerting policy in Cloud Monitoring.

Answer

Enable Security Command Center Premium and rely on its built-in IAM anomaly detection.

Answer

Use Cloud Audit Logs to export all Admin Activity logs to BigQuery and run a scheduled query to find key creations.

Question 3

A security team needs to monitor for anomalous IAM activity in their Google Cloud organization. They want to detect when a service account key is created outside of normal change windows. Which Google Cloud service should they use to set up an alert?

Accepted Answer

Cloud Monitoring with log-based alerts on Cloud Audit Logs.. Cloud Monitoring log-based alerts are designed to monitor audit logs and trigger notifications based on specific events. By creating an alert policy with a filter for service account key creation, the team can be alerted in near real-time. This is the most direct and appropriate solution.

Answer

Security Command Center with Event Threat Detection.

Answer

VPC Service Controls with access levels.

Answer

Cloud Asset Inventory with a feed to Pub/Sub.

Question 4

Your company has a Google Kubernetes Engine (GKE) cluster with Binary Authorization enabled. You want to ensure that only container images that have been attested by a specific attestor can be deployed. You have already created the attestor and the attestation. What should you do next to enforce this?

Accepted Answer

Add the attestor to the Binary Authorization policy with a requirement that the attestation must be present.. Binary Authorization policies are used to enforce deployment rules. To require attestation by a specific attestor, you must add that attestor to the policy and configure the rule to require attestation. This ensures that only images with a valid attestation from that attestor are admitted. Other options either bypass the requirement, use unnecessary custom code, or do not enforce attestation.

Answer

Use Artifact Registry vulnerability scanning to ensure images are safe and then deploy them.

Answer

Enable the Binary Authorization API and set the default rule to allow all images.

Answer

Create a Kubernetes admission controller webhook that validates the attestation before allowing the pod.

Question 5

A security operations team wants to automatically receive a notification whenever a new high-severity vulnerability finding is created in Security Command Center. They need the notification delivered to a Pub/Sub topic that already exists in the same organization. Which configuration should they use?

Accepted Answer

Create a Pub/Sub notification config in Security Command Center that filters on the HIGH severity and publishes to the existing topic.. Security Command Center notification configs are the native way to publish findings that match a filter to a Pub/Sub topic. By specifying severity=HIGH in the filter and selecting the existing topic, the team gets automatic delivery of new high-severity findings. Other approaches either add unnecessary components or do not deliver the finding payload as required.

Answer

Configure a Cloud Monitoring alerting policy based on the security findings metric and send it to the Pub/Sub topic.

Answer

Use a Cloud Function triggered by a Cloud Storage bucket that stores exported findings, and publish to the topic from the function.

Answer

Create a Cloud Logging sink that routes the Security Command Center findings log to the existing Pub/Sub topic.

Question 6

Your organization has a requirement to ensure that all Compute Engine instances have the latest security patches applied within 30 days of release. You want to monitor compliance and receive alerts for non-compliant instances. Which Google Cloud service should you use to achieve this with minimal effort?

Accepted Answer

VM Manager with OS Config and the patch compliance dashboard.. VM Manager with OS Config is the recommended service for patch management and compliance. It allows you to set patch policies, automatically apply patches, and monitor compliance through a dashboard. It also integrates with Cloud Monitoring for alerts. This meets the requirement with minimal effort.

Answer

Cloud Asset Inventory with a custom script to check patch levels.

Answer

Security Command Center with the Vulnerability Assessment scanner.

Answer

Cloud Monitoring with custom metrics from the Ops Agent.

Question 7

Your organization runs a production Google Kubernetes Engine (GKE) cluster. A security analyst reports that the PodSecurityPolicy `restricted` is not being enforced, allowing pods to run as root. You need to determine which GKE cluster configuration is responsible. Which of the following should you check first?

Accepted Answer

Whether the GKE cluster has `--enable-pod-security-policy` set to true.. PodSecurityPolicy enforcement in GKE is controlled by the `--enable-pod-security-policy` flag at cluster creation. If this flag is not set, the PodSecurityPolicy admission controller is disabled, and policies such as `restricted` are not enforced. Therefore, checking this flag is the correct first step to diagnose the issue.

Answer

Whether the cluster has `--enable-binary-authorization` set to true.

Answer

Whether the cluster has `--enable-network-policy` set to true.

Answer

Whether the cluster's nodes are using Container-Optimized OS (COS).

Question 8

Your security team needs to ensure that all Google Cloud resources across your organization are compliant with a set of security policies. You want to use Security Command Center (SCC) to detect violations. Which TWO steps should you take to enable SCC to detect policy violations? (Choose two.)

Accepted Answer

Create custom security health analytics modules to define your specific policies.. To detect policy violations with SCC, you must enable SCC Premium at the organization level to gain organization-wide visibility and advanced detectors. Then, you can create custom security health analytics modules to define your specific policies. Other options like VPC Flow Logs, audit logs, or exporting findings do not directly enable detection of policy violations; they serve different purposes in security monitoring and response.

Answer

Configure SCC to export findings to Pub/Sub for further processing.

Answer

Set up Cloud Audit Logs to log all admin activity and data access.

Answer

Enable VPC Flow Logs for all subnets to capture network traffic.

Question 9

Your security team uses VPC Service Controls to protect a sensitive project containing BigQuery datasets. An engineer reports that they can still export BigQuery data to a Cloud Storage bucket in a different project that is inside the same perimeter. You need to block this data exfiltration path while still allowing legitimate analytics jobs. Which configuration change should you make?

Accepted Answer

Create an egress rule on the perimeter that denies the BigQuery service from writing to the Cloud Storage service except for the approved destination project.. VPC Service Controls ingress and egress rules control service-to-service traffic within a perimeter. A deny egress rule from BigQuery to Cloud Storage, with an exception for the approved project, prevents unauthorized export destinations while allowing intended analytics. Access levels, Private Google Access, and bucket-level access settings do not restrict in-perimeter service-to-service data movement, so they cannot close this path.

Answer

Add an access level that restricts access to the engineer's corporate IP range and attach it to the perimeter.

Answer

Apply an organization policy constraint constraints/storage.uniformBucketLevelAccess on the destination project.

Answer

Enable Private Google Access on all subnets in the perimeter so that BigQuery traffic stays on Google's network.

Question 10

A security engineer is configuring VPC Service Controls to protect a project that contains sensitive data in Cloud Storage and BigQuery. They need to allow access from a specific set of on-premises IP addresses while blocking access from all other external networks. Which TWO steps should they take to meet this requirement? (Choose two.)

Accepted Answer

Enable VPC Service Controls on the project and add the project to a service perimeter.. VPC Service Controls create a security perimeter around Google Cloud services, and access levels define the conditions under which access is allowed. To permit only specific on-premises IPs, you must create an access level with those CIDR ranges and apply it to the perimeter. You also need to enable VPC Service Controls and add the project to the perimeter. Together, these steps enforce the desired restriction.

Answer

Set up a Cloud VPN tunnel and route all API traffic through it, then rely on the tunnel's encryption to restrict access.

Answer

Use Cloud Identity-Aware Proxy (IAP) to restrict access to the Cloud Storage and BigQuery APIs from the on-premises network.

Answer

Configure VPC firewall rules to allow traffic only from the on-premises IP addresses to the Cloud Storage and BigQuery APIs.

Question 11

A company wants to ensure that their security team is alerted when a new project is created in their Google Cloud organization. They need a centralized, low-maintenance solution that requires minimal custom code. What should they do?

Accepted Answer

Create a log-based alert in Cloud Monitoring for the CreateProject method.. Admin Activity audit logs capture project creation. A log-based alert in Cloud Monitoring can trigger on the CreateProject method and notify the security team. This requires no custom code and is centralized. Other options either need custom code or do not provide real-time alerts, making the log-based alert the best choice.

Answer

Set up a Cloud Function triggered by a Pub/Sub topic that receives all audit logs.

Answer

Configure an alerting policy in Cloud Monitoring based on the project count metric.

Answer

Use Cloud Asset Inventory to monitor for new projects and send notifications.

Question 12

A company wants to ensure that all data stored in Cloud Storage buckets is encrypted with customer-managed encryption keys (CMEK) rather than Google-managed keys. They need to enforce this policy across the organization. Which Google Cloud service should they use to define and enforce this requirement?

Accepted Answer

Organization Policy Service with a constraint on Cloud Storage bucket encryption.. Organization Policy Service provides centralized, hierarchical policy enforcement across all projects in an organization. By applying a constraint that requires CMEK for Cloud Storage, the organization ensures that any bucket created without CMEK will be denied. This is the correct tool for enforcing encryption key requirements at scale.

Answer

VPC Service Controls with an access level that requires CMEK.

Answer

Cloud KMS with automatic key rotation enabled for all keys.

Answer

Security Command Center with a custom finding for unencrypted buckets.

Question 13

A security team wants to reduce the risk of compromised service account keys in their Google Cloud organization. They have many workloads running on Compute Engine and GKE that currently use exported JSON keys stored on disk. Which TWO changes should they make to eliminate long-lived credentials while preserving functionality? (Choose two.)

Accepted Answer

Attach user-managed service accounts to Compute Engine instances so applications obtain short-lived tokens from the metadata server.. Eliminating long-lived credentials requires replacing static keys with short-lived tokens. On Compute Engine, attaching a service account lets the metadata server issue tokens. On GKE, Workload Identity Federation maps Kubernetes service accounts to IAM service accounts and issues short-lived tokens. Guardrails, rotation, and secure storage reduce but do not remove the underlying long-lived credential risk.

Answer

Store service account keys in Secret Manager and mount them into containers at runtime.

Answer

Rotate all service account keys every 90 days using Cloud Scheduler and the IAM API.

Answer

Enable organization policy constraints/iam.disableServiceAccountKeyCreation to prevent new keys from being created.

Question 14

A security engineer at a financial services company needs to ensure that all administrative activity in their Google Cloud organization is captured and stored immutably for 7 years. The organization uses a single folder hierarchy with multiple projects. They want to minimize configuration effort and ensure logs cannot be altered or deleted by any user, including project owners. What should they do?

Accepted Answer

Create a log sink at the organization level that routes Admin Activity logs to a Cloud Storage bucket with a retention policy and Bucket Lock.. An organization-level log sink centralizes log routing and automatically includes all current and future projects, reducing administrative overhead. Routing Admin Activity logs to a Cloud Storage bucket with Bucket Lock ensures they are retained immutably for the required period, satisfying compliance. This combination provides both minimal configuration effort and strong protection against tampering.

Answer

Create a log sink in each project that routes Admin Activity logs to a centralized Cloud Storage bucket with a retention policy.

Answer

Enable Data Access audit logs for all services at the organization level and export them to BigQuery with a custom retention policy.

Answer

Use Cloud Logging's default retention of 30 days and rely on organization policy constraints to prevent log deletion.

Question 15

A security team is using Cloud Audit Logs to investigate an incident. They need to determine which user deleted a specific Compute Engine instance. The instance was deleted within the last 30 days. Which log type should they query to find this information?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs capture all API calls that modify resource configurations, including the deletion of a Compute Engine instance. They are enabled by default and retained for 400 days, covering the 30-day window. Therefore, querying these logs will reveal the identity of the user who performed the deletion.

Answer

Data Access audit logs

Answer

System Event audit logs

Answer

Policy Denied audit logs