PCSE Managing Operations in a Cloud Solution Environment — Timed 10 Questions

Question 1

A security team wants to analyze VPC Flow Logs for potential data exfiltration. They need a solution that allows querying with SQL and requires minimal setup. Which approach should they take?

Accepted Answer

Export VPC Flow Logs to BigQuery via a log sink, then run SQL queries.. VPC Flow Logs can be exported to BigQuery via a logs sink, which enables SQL analysis. BigQuery is the best option because it supports standard SQL and requires no management. Chronicle is a SIEM with its own query language (YARA-L) and requires ingestion configuration; Cloud Logging has limited query power compared to BigQuery; Cloud SQL would require additional ingestion logic.

Answer

Ingest VPC Flow Logs into Chronicle and use YARA-L rules.

Answer

Stream VPC Flow Logs to Cloud SQL using a custom pipeline.

Answer

Export VPC Flow Logs to Cloud Logging and use Log Analytics with SQL.

Question 2

A security engineer needs to ensure that all Google Cloud API calls in the organization are logged and retained for 7 years for compliance. Admin Activity logs are enabled by default but retention is limited. Which combination of actions should the engineer take?

Accepted Answer

Create a log sink with _Required log view filter to export Admin Activity logs to Cloud Storage with a retention policy of 7 years.. Admin Activity logs are enabled by default but cannot be retained beyond the default period (400 days for audit logs). To retain for 7 years, you must use a log sink to export them to Cloud Storage (which can be configured with retention policies). BigQuery is for analysis, not archival. The default retention cannot be changed.

Answer

Create a log sink to export Admin Activity logs to BigQuery and set the table expiration to 7 years.

Answer

Enable Data Access logs for all services and set a custom retention period of 7 years on the log bucket.

Answer

Enable the 'Admin Activity logs' retention to 7 years in the Logging settings.

Question 3

A company wants to receive real-time notifications when Security Command Center (SCC) detects a high-severity vulnerability in their Google Cloud projects. They need to integrate with their existing SIEM. Which approach should they use?

Accepted Answer

Create a Pub/Sub notification config in SCC for the desired finding types and have the SIEM subscribe to the Pub/Sub topic.. SCC findings can be exported to Pub/Sub for real-time integration. The SIEM can subscribe to the Pub/Sub topic. Cloud Logging can also be used but SCC does not directly write findings to Logging. Cloud Functions alone would require Pub/Sub as trigger.

Answer

Use the SCC API to poll for new findings every minute and push them to the SIEM via a custom script.

Answer

Enable Event Threat Detection in SCC Premium tier and configure it to stream findings to Cloud Logging via a log sink.

Answer

Configure SCC to send findings to Cloud Logging and set up a log-based metric that triggers a Cloud Function to send to the SIEM.

Question 4

A DevOps team is implementing Binary Authorization for a GKE cluster. They want to ensure that only container images signed by a specific attestor can be deployed. They have created the attestor and configured Cloud KMS for signing. Which additional step is required to enforce the policy?

Accepted Answer

Create a Binary Authorization policy that requires at least one attestation and attach it to the GKE cluster.. Binary Authorization requires a policy to enforce attestation. The policy must be set to 'Require Attestations' and attached to the GKE cluster (via a policy binding). Creating the attestor alone is insufficient. The policy can be set at project level.

Answer

Enable the 'gke-binary-authorization' feature flag on the cluster and update the kubeconfig.

Answer

Create a policy that allows all images and then override it with an admission webhook.

Answer

Configure the container registry to block unsigned images by setting a repository-level policy.

Question 5

A security analyst needs to investigate a potential breach in a Compute Engine instance. They want to create an offline forensic copy of the disk without affecting the running instance. Which action should they take?

Accepted Answer

Stop the instance and create a snapshot of the boot disk.. Creating a snapshot is the correct method to create a point-in-time copy of a persistent disk for forensic analysis. The snapshot can be used to create a new disk for analysis. Stopping or creating an image modifies the instance state or does not preserve all data.

Answer

Create an image from the disk while the instance is running.

Answer

Use the gcloud compute disks copy command to replicate the disk.

Answer

Attach a new blank disk to the instance and use dd to clone the data.

Question 6

A company is using Security Command Center (SCC) Standard tier and wants to detect threats like crypto mining attacks and anomalous IAM activity in their GCP environment. Which built-in service should they enable?

Accepted Answer

Event Threat Detection. Event Threat Detection is a premium tier service that detects threats such as crypto mining and suspicious IAM activity. Security Health Analytics is misconfigurations. Web Security Scanner is for web apps. VM Threat Detection is also premium but for VMs.

Answer

Security Health Analytics

Answer

Web Security Scanner

Answer

VM Threat Detection

Question 7

An organization uses Chronicle SIEM to ingest logs from multiple GCP projects and on-premises firewalls. They need to write a detection rule that triggers when an IP address makes more than 100 failed login attempts across different GCP projects within 10 minutes. Which Chronicle feature should they use?

Accepted Answer

YARA-L detection rule. YARA-L is the detection language for Chronicle. It allows multi-event correlation across data sources, including timestamps and grouping by source IP. UDM is the data model. Dashboards are visual. Reference lists are for static data.

Answer

Dashboard and alerting

Answer

Reference list

Answer

Unified Data Model (UDM)

Question 8

A company wants to scan all container images stored in Artifact Registry for vulnerabilities before deployment. Which Google Cloud service should they use?

Accepted Answer

Container Analysis. Container Analysis (now part of Artifact Registry) provides vulnerability scanning for images. Binary Authorization enforces policies. Security Command Center aggregates findings. Cloud Build is for building images.

Answer

Binary Authorization

Answer

Cloud Build

Answer

Security Command Center

Question 9

A security team needs to detect and respond to a potential data exfiltration via VPC Flow Logs. They want to identify traffic to known malicious IP addresses in real-time. Which architecture should they use?

Accepted Answer

Create a log sink to send VPC Flow Logs to Pub/Sub, trigger a Cloud Function that checks IP addresses against a threat list and sends alerts.. VPC Flow Logs can be streamed via a log sink to Pub/Sub, then processed by Cloud Functions to compare against a threat feed. BigQuery is for analysis, not real-time. Dataflow could be used but is more complex. Cloud NAT is unrelated.

Answer

Enable VPC Flow Logs and use Dataflow to stream logs to a third-party SIEM.

Answer

Use Cloud NAT to block traffic to malicious IPs based on a predefined list.

Answer

Export VPC Flow Logs to BigQuery and schedule a query every minute to check for matches.

Question 10

A company wants to enforce that all GKE clusters in their organization use Binary Authorization with a specific attestor. They have multiple projects and want to set this policy centrally. Which approach should they use?

Accepted Answer

Use the organization policy service to set a constraint that requires Binary Authorization enforcement across all projects.. Organization policies can enforce constraints at the organization, folder, or project level. The Binary Authorization policy can be set at the organization level using a constraint, but the specific attestor configuration is done via the Binary Authorization API per project. However, to enforce the use of Binary Authorization, you can use an organization policy constraint 'constraints/gcp.restrictBinaryAuthorizationPolicy'.

Answer

Create a Binary Authorization policy in each project and use a script to apply it.

Answer

Create a shared VPC and enable Binary Authorization on the host project.

Answer

Use Deployment Manager to deploy Binary Authorization configuration to all projects.