PCSE Timed Practice Test 5 — 10 Questions

Question 1

A company is migrating on-premises data to Cloud Storage. They have regulatory requirements to encrypt data using keys managed by their on-premises hardware security module (HSM). Which solution should they use?

Accepted Answer

Use Cloud External Key Manager (Cloud EKM) to reference keys in their on-premises HSM.. Cloud External Key Manager (Cloud EKM) allows you to use encryption keys stored in a supported on-premises HSM via a partner integration, meeting the regulatory requirement for key management outside of Google Cloud. This solution keeps the key material under your control while enabling Cloud Storage to encrypt data using those keys.

Answer

Use Cloud HSM to create and manage keys.

Answer

Use customer-supplied encryption keys (CSEK) for each object.

Answer

Use Cloud Key Management Service (Cloud KMS) with a key generated in the cloud.

Question 2

A security engineer reviews the IAM policy for a Cloud Storage bucket as shown in the exhibit. Alice reports that she cannot upload objects to the bucket, while Bob can view objects. What is the most likely issue?

Accepted Answer

The bucket has ACLs that deny Alice upload access.. Option A is correct because Cloud Storage buckets can have both IAM policies and Access Control Lists (ACLs) applied. If the bucket's ACL explicitly denies Alice the `WRITER` or `OWNER` permission, she will be unable to upload objects even if her IAM policy grants broader roles. Bob can view objects because his IAM role (e.g., `roles/storage.objectViewer`) is not overridden by a conflicting ACL, or his ACL entry grants `READER` access.

Answer

Alice has the objectViewer role but not the objectAdmin role.

Answer

Alice does not have the storage.buckets.getIamPolicy permission.

Answer

The objectAdmin role does not include the storage.objects.create permission.

Question 3

A healthcare organization stores PHI in BigQuery tables with row-level access policies. They need to ensure that data is automatically de-identified when exported to Cloud Storage for analytics. What is the most scalable solution with minimal manual intervention?

Accepted Answer

Use BigQuery data masking to define de-identification policies, then export the masked data directly.. Option D is correct because BigQuery data masking allows you to define column-level de-identification policies that are applied automatically at query time. When you export the masked data directly using an export job, the de-identification is enforced without additional scripting or post-processing, making it the most scalable and low-maintenance solution for PHI protection.

Answer

Set up VPC Service Controls to prevent data exfiltration and rely on access controls.

Answer

Create a scheduled query in BigQuery that exports data using a view with de-identification functions.

Answer

Use Cloud DLP API to scan and de-identify the export file after it is written to Cloud Storage.

Question 4

Refer to the exhibit. A security engineer runs this command to check bucket permissions. What is the most significant security issue?

Accepted Answer

The bucket allows public read access via 'allUsers' in both ACL and legacy role.. Option C is correct because the command output shows that the bucket has both an ACL granting 'allUsers' READER access and a legacy bucket role 'roles/storage.legacyBucketReader' assigned to 'allUsers'. This means the bucket is publicly readable via two independent mechanisms, which is the most significant security issue as it exposes all objects to the internet without authentication.

Answer

The domain example.com has viewer access, which may be too broad.

Answer

The legacy role 'roles/storage.legacyBucketReader' is used.

Answer

Uniform bucket-level access is disabled, allowing ACLs.

Question 5

A security engineer is configuring VPC Service Controls to protect a Google Cloud project containing sensitive data. The project uses Cloud Storage and BigQuery. The engineer wants to ensure that data cannot be exfiltrated to external IP addresses outside the perimeter, but internal users should still be able to access the data from on-premises via a VPN. Which configuration should be applied?

Accepted Answer

Add the project to a VPC Service Controls perimeter and configure an ingress rule to allow traffic from the on-premises VPN CIDR ranges. VPC Service Controls (VPC-SC) allow you to define a security perimeter around Google Cloud services like Cloud Storage and BigQuery, preventing data exfiltration to external IPs. By adding the project to a perimeter and configuring an ingress rule that permits traffic from the on-premises VPN CIDR ranges, internal users can access the data via VPN while all other external traffic is blocked. This meets the requirement of preventing exfiltration to external IPs while allowing authorized on-premises access.

Answer

Do not use VPC Service Controls; instead, rely on IAM permissions and firewall rules to control access

Answer

Create a separate perimeter that denies all traffic and apply it to the project

Answer

Add the project to a VPC Service Controls perimeter with no additional ingress rules

Question 6

A company runs a critical application on Compute Engine instances in a managed instance group (MIG) behind an external TCP/UDP Network Load Balancer. The security team requires that all traffic to the instances be inspected by a third-party next-generation firewall (NGFW) that is not yet deployed. Which architecture should the security engineer implement to meet the requirement with minimal disruption to traffic?

Accepted Answer

Deploy the NGFW as a Compute Engine instance in a separate instance group, and configure the load balancer to forward traffic to that instance group, which then forwards to the MIG.. Option A is correct because it inserts the NGFW as a middlebox in the traffic path without changing the existing load balancer or instance group configuration. The external TCP/UDP Network Load Balancer forwards traffic to the NGFW instance group, which then inspects and forwards packets to the backend MIG. This preserves the original client IP via proxy protocol or encapsulation, meets the security requirement, and minimizes disruption by avoiding reconfiguration of the existing MIG or load balancer type.

Answer

Change the load balancer type to Internal TCP/UDP Load Balancer and route traffic through the NGFW.

Answer

Replace the Network Load Balancer with a proxy-based load balancer that can integrate with the NGFW via Traffic Director.

Answer

Use Cloud NAT and route all egress traffic through the NGFW.

Question 7

A security engineer is investigating a potential data breach in a Google Cloud environment. The engineer suspects that a compromised service account key was used to access Cloud Storage buckets. Which TWO actions should the engineer take immediately to mitigate the risk?

Accepted Answer

Disable the service account. Disabling the service account immediately stops all access using any of its keys, including the compromised one, without deleting the account or its configuration. This is the fastest way to block the attacker while preserving the ability to investigate and re-enable the account later if needed. In Google Cloud, disabling a service account is a reversible action that revokes all authentication and authorization for that identity.

Answer

Revoke all IAM roles granted to the service account

Answer

Rotate the service account key

Answer

Enable Cloud Audit Logs for the service account

Question 8

A security engineer is designing a VPC Service Controls perimeter to protect a project containing sensitive data stored in Cloud Storage and BigQuery. The perimeter currently allows access from an on-premises data center via private connectivity (Cloud Interconnect). The business requires that a third-party SaaS application (outside the perimeter) be able to write data into a specific Cloud Storage bucket. Which action should the engineer take?

Accepted Answer

Create a service account for the SaaS application, grant it the Storage Object Creator role, and configure an access level that includes the service account. Then, add that access level to the perimeter's ingress policy.. Option B is correct because VPC Service Controls perimeters use ingress policies to explicitly allow access from outside the perimeter. By creating a service account for the SaaS application, granting it the Storage Object Creator role, and configuring an access level that includes that service account, the engineer can add the access level to the perimeter's ingress policy. This allows the external SaaS application to write data into the specific Cloud Storage bucket while still blocking all other external access, maintaining the security of the sensitive data.

Answer

Create a service account for the SaaS application and grant it the Storage Object Creator role; then add the service account to the perimeter's allowed identities.

Answer

Create an access level that includes the SaaS application's IP addresses and use that in the perimeter's ingress policy.

Answer

Add the SaaS application's external IP addresses to the perimeter's allowed IP ranges.

Question 9

A security engineer is designing a solution to monitor and detect anomalous IAM role usage across multiple Google Cloud projects. The engineer wants to create a centralized logging solution that captures all IAM policy changes and access attempts. Which THREE services should the engineer use together to achieve this?

Accepted Answer

BigQuery. BigQuery is correct because it serves as the centralized analytics destination for Cloud Audit Logs, enabling the security engineer to run SQL queries across IAM policy changes and access attempts from multiple Google Cloud projects. By exporting audit logs to BigQuery, you can perform complex aggregations and anomaly detection at scale, which is essential for monitoring IAM role usage across a fleet of projects.

Answer

Cloud Monitoring

Answer

Cloud Functions

Question 10

A security engineer is troubleshooting a connectivity issue between two VPCs connected via VPC Network Peering. VPC-A (project A) has a Compute Engine instance with internal IP 10.1.0.2. VPC-B (project B) has an instance with internal IP 10.2.0.2. The engineer has verified that the peering connection is active and the firewall rules allow ingress from 10.1.0.0/16. However, the instance in VPC-B cannot ping the instance in VPC-A. What is the most likely cause?

Accepted Answer

The VPC-B does not have a route to VPC-A's subnet ranges. Custom route exchange is not enabled on the peering connection.. The most likely cause is that custom route exchange is not enabled on the VPC Network Peering connection. By default, VPC peering does not exchange custom routes (including subnet routes) unless explicitly enabled. Without this, VPC-B has no route to the 10.1.0.0/16 subnet of VPC-A, so the instance in VPC-B cannot send traffic to 10.1.0.2, even though firewall rules allow ingress. The peering connection being active only means the link is established, not that routes are automatically propagated.

Answer

The VPC-A has a firewall rule that denies ICMP traffic from VPC-B.

Answer

The MTU configuration on the peering connection is set too low.

Answer

The instance in VPC-B does not have a public IP address.