PCSE Timed Practice Test 4 — 10 Questions

Question 1

A security engineer is using Cloud Asset Inventory to find all Compute Engine instances that are not labeled with a 'compliance' label. Based on the exhibit, which instance(s) are missing the compliance label?

Accepted Answer

instance-2 only. Option B is correct because the exhibit shows that instance-1 has a 'compliance' label with a value of 'true', while instance-2 has no 'compliance' label at all. Cloud Asset Inventory can query assets using label filters; the absence of the 'compliance' label on instance-2 means it fails the compliance labeling requirement. Therefore, only instance-2 is missing the compliance label.

Answer

Both instances

Answer

Neither instance

Answer

instance-1 only

Question 2

A company is using Cloud Data Loss Prevention (DLP) to inspect and de-identify sensitive data in Cloud Storage. They want to classify data using infoTypes and apply de-identification techniques. Which TWO actions should they take?

Accepted Answer

Use the DLP API to inspect the storage for sensitive data.. Option B is correct because the DLP API's `inspect` method is the primary mechanism to scan Cloud Storage objects for sensitive data patterns defined by infoTypes. Option C is correct because after inspection, de-identification transformations like masking or tokenization are applied via the DLP API's `deidentify` method to redact or replace sensitive content. Together, these two actions form the standard workflow for classifying and protecting data in Cloud Storage using Cloud DLP.

Answer

Create custom infoTypes for all sensitive data.

Answer

Store de-identification templates in Cloud KMS.

Answer

Use VPC Service Controls to restrict access to the data.

Question 3

A company is using Cloud SQL for MySQL to store financial data. They need to ensure that all data is encrypted at rest and in transit. What should they do?

Accepted Answer

Use the default encryption provided by Cloud SQL and enforce SSL/TLS connections.. Option D is correct because Cloud SQL for MySQL automatically encrypts data at rest using AES-256, with no additional configuration required. To protect data in transit, you must enforce SSL/TLS connections by configuring the instance to require SSL and downloading the server certificate for client connections. This combination satisfies both encryption requirements without unnecessary complexity.

Answer

Use client-side encryption before storing data in Cloud SQL.

Answer

Enable encryption at rest by checking a box in the Cloud Console.

Answer

Enable CMEK on the Cloud SQL instance and configure SSL/TLS.

Question 4

A security engineer needs to grant a data analyst read-only access to a BigQuery dataset containing customer data, but must prevent the analyst from viewing or querying a specific column that contains personally identifiable information (PII). Which approach should the engineer use?

Accepted Answer

Use BigQuery column-level security with a policy tag on the PII column, and assign the analyst a role that denies access to that tag.. Option A is correct because BigQuery column-level security uses policy tags to control access at the column level. By assigning a policy tag to the PII column and then granting the analyst a role that explicitly denies access to that tag (e.g., using a deny role or IAM deny policies), the analyst can query the dataset but will be blocked from viewing or querying the tagged column. This approach directly meets the requirement of read-only access while preventing access to the specific PII column.

Answer

Grant the analyst the roles/bigquery.user role, and use IAM conditions to deny access to the PII column.

Answer

Create a row-level access policy on the table that denies access to rows containing PII.

Answer

Grant the analyst the BigQuery Data Viewer role on the dataset, and create an authorized view that excludes the PII column.

Question 5

A security engineer is troubleshooting an issue where a Compute Engine VM cannot connect to a Cloud SQL instance that has a private IP address. Both resources are in the same VPC network. The VM's firewall rules allow egress to any destination, and the Cloud SQL instance's authorized networks include the VPC network. What is the most likely cause of the connection failure?

Accepted Answer

The VPC network does not have a private services access connection (VPC peering) to the Service Networking API.. Cloud SQL instances with private IP addresses require a private services access connection (VPC peering) between the VPC network and the Service Networking API's managed tenant project. Without this VPC peering, the VM cannot route traffic to the Cloud SQL instance's private IP, even if both are in the same VPC network. Option C directly identifies this missing prerequisite.

Answer

Private Google Access is not enabled on the subnet.

Answer

The VM's firewall rules block traffic to the Cloud SQL IP range.

Answer

The Cloud SQL instance requires the Cloud SQL Auth proxy to be installed on the VM.

Question 6

A company wants to use Cloud Armor to block traffic from specific countries to comply with data sovereignty requirements. They have a global HTTP Load Balancer configured. Where should they configure the Cloud Armor policy?

Accepted Answer

Attach to the backend service of the load balancer.. Cloud Armor policies must be attached to a backend service (or backend bucket) of a global HTTP(S) Load Balancer to filter traffic at the edge. This allows the policy to evaluate incoming requests based on geographic location before they reach the backend, enforcing data sovereignty rules without modifying VPC networking or firewall rules.

Answer

Attach to the VPC network that hosts the load balancer.

Answer

Configure as an Organization Policy constraint.

Answer

Configure as a firewall rule in the VPC network.

Question 7

Refer to the exhibit. A security engineer runs the command to view recent decrypt operations on a Cloud KMS key. The output shows a successful decryption. However, the engineer is concerned about the exposure of the plaintext. Based on the log entry, what is the most accurate statement regarding the visibility of the decrypted plaintext?

Accepted Answer

The plaintext field is redacted by Cloud KMS, and the actual plaintext is not visible in the log entry.. Option C is correct because Cloud KMS automatically redacts the plaintext field in Cloud Audit Logs for decrypt operations. The log entry shows a successful decryption, but the actual decrypted data is never written to the logs; instead, the plaintext field is replaced with a redacted marker (e.g., `[REDACTED]`). This is a security feature to prevent sensitive data from being exposed in audit logs, even to users with access to view them.

Answer

The plaintext field is not present in the log because the service does not log it.

Answer

The plaintext field contains the base64-encoded ciphertext, and the engineer needs to decode it.

Answer

The plaintext field contains the actual decrypted data in plaintext, and the engineer should restrict access to the logs.

Question 8

A healthcare organization is migrating sensitive patient data to Google Cloud and must comply with HIPAA. They plan to use Cloud SQL for MySQL with CMEK for encryption at rest. The security team is concerned about key management and access logging. Which additional measure should be implemented to meet HIPAA audit requirements?

Accepted Answer

Enable Data Access audit logs for the Cloud SQL instance and Cloud KMS key.. Option C is correct because HIPAA audit requirements mandate that access to protected health information (PHI) and the keys protecting it must be logged. Enabling Data Access audit logs on both the Cloud SQL instance and the Cloud KMS key captures read, write, and administrative operations, providing the necessary audit trail for compliance. Without these logs, the organization cannot demonstrate who accessed the data or the encryption keys, which is a core HIPAA requirement.

Answer

Configure VPC Service Controls to restrict access to the Cloud SQL instance.

Answer

Use Cloud DLP to de-identify the data before storing it in Cloud SQL.

Answer

Store the CMEK keys in Cloud HSM to meet FIPS 140-2 Level 3 requirements.

Question 9

A security engineer runs the command in the exhibit. The command fails with an error: 'Permission denied: cryptoKeyVersions.encrypt'. What is the most likely cause?

Accepted Answer

The user does not have the cloudkms.cryptoKeyVersions.encrypt permission on the key.. The error message 'Permission denied: cryptoKeyVersions.encrypt' explicitly indicates that the user lacks the cloudkms.cryptoKeyVersions.encrypt permission on the specific key version. In Google Cloud KMS, encrypt operations require the cloudkms.cryptoKeyVersions.encrypt permission (or a broader role like roles/cloudkms.cryptoKeyEncrypter) on the key resource. The command itself is syntactically correct, so the failure is due to insufficient IAM permissions, not resource existence or location.

Answer

The key ring 'my-keyring' does not exist.

Answer

The key ring location is incorrect.

Answer

The user does not have the cloudkms.cryptoKeyVersions.decrypt permission.

Question 10

A financial services company runs a sensitive application on Google Kubernetes Engine (GKE) with Workload Identity enabled. Security policy requires that only pods with a specific service account can access a Cloud Storage bucket containing customer data. The bucket has uniform bucket-level access enabled. What is the correct combination of IAM bindings to achieve this?

Accepted Answer

Bind the Google service account (linked to the Kubernetes service account via Workload Identity) to the bucket IAM policy with roles/storage.objectViewer. Workload Identity links a Kubernetes service account (KSA) to a Google service account (GSA). When a pod uses that KSA, it authenticates as the linked GSA. Since the bucket has uniform bucket-level access, IAM permissions must be granted directly on the bucket resource, not at the project level. Binding the GSA to the bucket with roles/storage.objectViewer ensures only pods using that specific KSA can read the bucket.

Answer

Add the Google service account as a member of the bucket with roles/storage.objectViewer

Answer

Grant the Google service account roles/storage.objectViewer at the project level

Answer

Bind the Kubernetes service account to the bucket IAM policy with roles/storage.objectViewer