PCSE Timed Practice Test 1 — 10 Questions

Question 1

A company wants to allow employees to access a web application running on Google Kubernetes Engine (GKE) using their corporate Active Directory credentials. The application is exposed via an HTTPS load balancer. The Security Engineer needs to integrate identity federation and ensure that only authenticated users can reach the application. Which combination of services should be used?

10 minute time limit — choose an answer to begin.

Accepted Answer

Set up federation between Active Directory and Google Cloud using OIDC, and enable IAP on the load balancer.. It combines OIDC federation between Active Directory and Google Cloud with Identity-Aware Proxy (IAP) on the load balancer. IAP verifies user identity via OIDC tokens issued by the federated identity provider, ensuring only authenticated users can reach the application without exposing it to the public internet.

Answer

Use Cloud Armor to allow only traffic from specific IP ranges and require client certificates.

Answer

Enable IAP and configure it to use Active Directory as an identity provider.

Answer

Configure Cloud Identity as the identity provider and use IAP.

Question 2

An organization is using Assured Workloads to enforce ITAR compliance. They need to ensure that all resources are deployed in specific US regions and that Google personnel access is restricted. They also want to monitor for any configuration changes that violate compliance policies. Which service should they use for monitoring compliance drift?

Accepted Answer

Assured Workloads compliance monitoring. Assured Workloads includes built-in compliance monitoring that continuously evaluates the folder's resources against the selected compliance regime (e.g., ITAR) and surfaces violations such as resources deployed outside approved US regions or configuration drift. This is the native mechanism for monitoring compliance drift within an Assured Workloads environment.

Answer

Cloud Asset Inventory

Answer

Security Command Center

Answer

Cloud Monitoring

Question 3

Refer to the exhibit. A security engineer needs to ensure that all objects uploaded to the bucket are automatically encrypted with the specified KMS key. They also need to preserve older versions of objects. Which statement accurately describes the bucket configuration?

Accepted Answer

The bucket has default KMS encryption and versioning is enabled.. The question requires both automatic encryption of all uploaded objects using a specified KMS key and preservation of older object versions. Default KMS encryption ensures that any object uploaded without explicit encryption headers is automatically encrypted with the configured KMS key, while enabling versioning allows the bucket to retain noncurrent object versions. Together, these settings meet both requirements.

Answer

The bucket has default KMS encryption but versioning is disabled.

Answer

The bucket uses CSEK and versioning is enabled.

Answer

The bucket uses Google-managed encryption and versioning is disabled.

Question 4

A global e-commerce company is using Google Cloud to store customer data subject to GDPR. They have implemented data residency controls to keep data within the EU. However, during a routine audit, the compliance team discovers that some backups of customer data are being replicated to a US region due to a misconfigured backup policy. The data includes personal information. The company must ensure that all data remains within the EU. What should the team do to prevent this from recurring and remediate the current situation?

Accepted Answer

Use Organization Policies to enforce a constraint that disables the creation of resources outside the EU, and then delete the US backups.. Organization Policies allow the company to enforce a resource location constraint (e.g., `constraints/gcp.resourceLocations`), which prevents the creation of any Google Cloud resources outside the EU. This proactively stops misconfigured backups from being replicated to non-EU regions. Deleting the US backups after applying the policy remediates the current GDPR violation by removing the non-compliant data.

Answer

Delete the backups in the US region immediately and reconfigure the backup policy to only use EU regions.

Answer

Enable Access Transparency for the US backups to monitor access.

Answer

Encrypt the US backups with CMEK and leave them in place, as encryption satisfies GDPR.

Question 5

A healthcare company subject to HIPAA must prevent data exfiltration from Google Cloud storage buckets. They already use VPC Service Controls. Which additional control should they configure to directly block unauthorized copying of data to external projects?

Accepted Answer

Configure egress rules in the VPC Service Controls perimeter. VPC Service Controls allow you to define perimeters that restrict data movement between authorized and unauthorized projects. By configuring egress rules within the perimeter, you can explicitly block copying data to external projects, directly preventing data exfiltration. This is the correct additional control because it enforces policy at the network boundary, not just at the application or storage layer.

Answer

Enable Cloud Data Loss Prevention (DLP) scanning

Answer

Use Cloud Audit Logs to review access

Answer

Apply Cloud Identity-Aware Proxy (IAP) to buckets

Question 6

A company has two Google Cloud projects: Project A (production) and Project B (development). They want to allow a service account in Project B to list Compute Engine instances in Project A. What is the most secure way to grant this access?

Accepted Answer

Add the service account as a member in Project A's IAM policy with the roles/compute.viewer role.. It uses IAM to grant the service account from Project B the roles/compute.viewer role on Project A, which allows it to list Compute Engine instances without sharing keys or granting excessive permissions. This follows the principle of least privilege and avoids the security risks of key management.

Answer

Create a new service account in Project A, generate a key, and share it with the application in Project B.

Answer

Make the service account a project owner of Project A.

Answer

Export the service account key from Project B and use it in an application in Project A.

Question 7

A security team needs to automatically respond to high-severity vulnerability findings in Security Command Center. They want to trigger a Cloud Function that quarantines the affected VM. What is the recommended way to connect SCC findings to Cloud Functions?

Accepted Answer

Create a SCC notification config that sends findings to a Pub/Sub topic, and set up a Cloud Function to subscribe to that topic.. Security Command Center supports notification configs that publish findings to a Pub/Sub topic, and Cloud Functions can subscribe to that topic to trigger automated responses. This is the native, event-driven integration pattern recommended by Google Cloud for SCC-based automation, providing near-real-time response without polling.

Answer

Use Cloud Scheduler to poll SCC API every minute and invoke Cloud Function.

Answer

Configure Cloud Logging to capture SCC findings and create a log-based metric with an alert that triggers Cloud Function.

Answer

Export SCC findings to BigQuery and set up a BigQuery scheduled query to trigger Cloud Function.

Question 8

Refer to the exhibit. A user jane@example.com receives a 403 Access Denied error when trying to list objects in a Cloud Storage bucket. What is the most likely cause?

Accepted Answer

The IAM condition restricts access to requests originating from the 10.0.0.0/24 IP range. The IAM policy includes a condition that restricts access to requests originating from the 10.0.0.0/24 IP range. If jane@example.com is accessing the bucket from an IP outside this range, the condition fails and access is denied, resulting in a 403 error. Option B is incorrect; the role assigned to Jane includes the storage.objects.list permission, so lack of permission is not the issue. Option C is incorrect; there is no indication that the bucket is in a different project. Option D is incorrect; the policy is restrictive, not permissive, and there is no conflict with other policies.

Answer

Jane does not have the storage.objects.list permission

Answer

The bucket is in a different project

Answer

The IAM policy is too permissive and conflicts with other policies

Question 9

A company uses Access Context Manager to restrict access to Cloud Resources based on device policy. They want to allow access only from devices that are company-managed and have disk encryption enabled. What should they configure?

Accepted Answer

Create an access level with device policy conditions for corporate-owned and disk encryption.. Access Context Manager allows you to create access levels that define device policy conditions, such as requiring devices to be corporate-owned and have disk encryption enabled. These access levels are then applied to the organization's access policies to restrict access to cloud resources based on the device's compliance status.

Answer

Create an IAM condition requiring a specific device tag.

Answer

Use Identity-Aware Proxy with device policy.

Answer

Use VPC Service Controls with a device restriction.

Question 10

Which feature of Cloud Armor uses machine learning to detect and block distributed denial-of-service (DDoS) attacks?

Accepted Answer

Adaptive Protection. Adaptive Protection is the Cloud Armor capability that applies machine learning to model normal traffic to a backend service and detect deviations indicative of Layer 7 DDoS attacks. It then suggests or enforces rules to block the anomalous sources. This is the only Cloud Armor feature explicitly built on ML for DDoS detection.

Answer

Security policies

Answer

Rate limiting

Answer

Preconfigured WAF rules