PCSE Practice Questions

Question 1

A company wants to allow employees to access a web application running on Google Kubernetes Engine (GKE) using their corporate Active Directory credentials. The application is exposed via an HTTPS load balancer. The Security Engineer needs to integrate identity federation and ensure that only authenticated users can reach the application. Which combination of services should be used?

Accepted Answer

Set up federation between Active Directory and Google Cloud using OIDC, and enable IAP on the load balancer.. It combines OIDC federation between Active Directory and Google Cloud with Identity-Aware Proxy (IAP) on the load balancer. IAP verifies user identity via OIDC tokens issued by the federated identity provider, ensuring only authenticated users can reach the application without exposing it to the public internet.

Answer

Use Cloud Armor to allow only traffic from specific IP ranges and require client certificates.

Answer

Enable IAP and configure it to use Active Directory as an identity provider.

Answer

Configure Cloud Identity as the identity provider and use IAP.

Question 2

An organization is using Assured Workloads to enforce ITAR compliance. They need to ensure that all resources are deployed in specific US regions and that Google personnel access is restricted. They also want to monitor for any configuration changes that violate compliance policies. Which service should they use for monitoring compliance drift?

Accepted Answer

Assured Workloads compliance monitoring. Assured Workloads includes built-in compliance monitoring that continuously evaluates the folder's resources against the selected compliance regime (e.g., ITAR) and surfaces violations such as resources deployed outside approved US regions or configuration drift. This is the native mechanism for monitoring compliance drift within an Assured Workloads environment.

Answer

Cloud Asset Inventory

Answer

Security Command Center

Answer

Cloud Monitoring

Question 3

Refer to the exhibit. A security engineer needs to ensure that all objects uploaded to the bucket are automatically encrypted with the specified KMS key. They also need to preserve older versions of objects. Which statement accurately describes the bucket configuration?

Accepted Answer

The bucket has default KMS encryption and versioning is enabled.. The question requires both automatic encryption of all uploaded objects using a specified KMS key and preservation of older object versions. Default KMS encryption ensures that any object uploaded without explicit encryption headers is automatically encrypted with the configured KMS key, while enabling versioning allows the bucket to retain noncurrent object versions. Together, these settings meet both requirements.

Answer

The bucket has default KMS encryption but versioning is disabled.

Answer

The bucket uses CSEK and versioning is enabled.

Answer

The bucket uses Google-managed encryption and versioning is disabled.

Question 4

A global e-commerce company is using Google Cloud to store customer data subject to GDPR. They have implemented data residency controls to keep data within the EU. However, during a routine audit, the compliance team discovers that some backups of customer data are being replicated to a US region due to a misconfigured backup policy. The data includes personal information. The company must ensure that all data remains within the EU. What should the team do to prevent this from recurring and remediate the current situation?

Accepted Answer

Use Organization Policies to enforce a constraint that disables the creation of resources outside the EU, and then delete the US backups.. Organization Policies allow the company to enforce a resource location constraint (e.g., `constraints/gcp.resourceLocations`), which prevents the creation of any Google Cloud resources outside the EU. This proactively stops misconfigured backups from being replicated to non-EU regions. Deleting the US backups after applying the policy remediates the current GDPR violation by removing the non-compliant data.

Answer

Delete the backups in the US region immediately and reconfigure the backup policy to only use EU regions.

Answer

Enable Access Transparency for the US backups to monitor access.

Answer

Encrypt the US backups with CMEK and leave them in place, as encryption satisfies GDPR.

Question 5

A healthcare company subject to HIPAA must prevent data exfiltration from Google Cloud storage buckets. They already use VPC Service Controls. Which additional control should they configure to directly block unauthorized copying of data to external projects?

Accepted Answer

Configure egress rules in the VPC Service Controls perimeter. VPC Service Controls allow you to define perimeters that restrict data movement between authorized and unauthorized projects. By configuring egress rules within the perimeter, you can explicitly block copying data to external projects, directly preventing data exfiltration. This is the correct additional control because it enforces policy at the network boundary, not just at the application or storage layer.

Answer

Enable Cloud Data Loss Prevention (DLP) scanning

Answer

Use Cloud Audit Logs to review access

Answer

Apply Cloud Identity-Aware Proxy (IAP) to buckets

Question 6

A company has two Google Cloud projects: Project A (production) and Project B (development). They want to allow a service account in Project B to list Compute Engine instances in Project A. What is the most secure way to grant this access?

Accepted Answer

Add the service account as a member in Project A's IAM policy with the roles/compute.viewer role.. It uses IAM to grant the service account from Project B the roles/compute.viewer role on Project A, which allows it to list Compute Engine instances without sharing keys or granting excessive permissions. This follows the principle of least privilege and avoids the security risks of key management.

Answer

Create a new service account in Project A, generate a key, and share it with the application in Project B.

Answer

Make the service account a project owner of Project A.

Answer

Export the service account key from Project B and use it in an application in Project A.

Question 7

A security team needs to automatically respond to high-severity vulnerability findings in Security Command Center. They want to trigger a Cloud Function that quarantines the affected VM. What is the recommended way to connect SCC findings to Cloud Functions?

Accepted Answer

Create a SCC notification config that sends findings to a Pub/Sub topic, and set up a Cloud Function to subscribe to that topic.. Security Command Center supports notification configs that publish findings to a Pub/Sub topic, and Cloud Functions can subscribe to that topic to trigger automated responses. This is the native, event-driven integration pattern recommended by Google Cloud for SCC-based automation, providing near-real-time response without polling.

Answer

Use Cloud Scheduler to poll SCC API every minute and invoke Cloud Function.

Answer

Configure Cloud Logging to capture SCC findings and create a log-based metric with an alert that triggers Cloud Function.

Answer

Export SCC findings to BigQuery and set up a BigQuery scheduled query to trigger Cloud Function.

Question 8

Refer to the exhibit. A user jane@example.com receives a 403 Access Denied error when trying to list objects in a Cloud Storage bucket. What is the most likely cause?

Accepted Answer

The IAM condition restricts access to requests originating from the 10.0.0.0/24 IP range. The IAM policy includes a condition that restricts access to requests originating from the 10.0.0.0/24 IP range. If jane@example.com is accessing the bucket from an IP outside this range, the condition fails and access is denied, resulting in a 403 error. Option B is incorrect; the role assigned to Jane includes the storage.objects.list permission, so lack of permission is not the issue. Option C is incorrect; there is no indication that the bucket is in a different project. Option D is incorrect; the policy is restrictive, not permissive, and there is no conflict with other policies.

Answer

Jane does not have the storage.objects.list permission

Answer

The bucket is in a different project

Answer

The IAM policy is too permissive and conflicts with other policies

Question 9

A company uses Access Context Manager to restrict access to Cloud Resources based on device policy. They want to allow access only from devices that are company-managed and have disk encryption enabled. What should they configure?

Accepted Answer

Create an access level with device policy conditions for corporate-owned and disk encryption.. Access Context Manager allows you to create access levels that define device policy conditions, such as requiring devices to be corporate-owned and have disk encryption enabled. These access levels are then applied to the organization's access policies to restrict access to cloud resources based on the device's compliance status.

Answer

Create an IAM condition requiring a specific device tag.

Answer

Use Identity-Aware Proxy with device policy.

Answer

Use VPC Service Controls with a device restriction.

Question 10

Which feature of Cloud Armor uses machine learning to detect and block distributed denial-of-service (DDoS) attacks?

Accepted Answer

Adaptive Protection. Adaptive Protection is the Cloud Armor capability that applies machine learning to model normal traffic to a backend service and detect deviations indicative of Layer 7 DDoS attacks. It then suggests or enforces rules to block the anomalous sources. This is the only Cloud Armor feature explicitly built on ML for DDoS detection.

Answer

Security policies

Answer

Rate limiting

Answer

Preconfigured WAF rules

Question 11

An organization uses Cloud Audit Logs to monitor admin activity. The security team wants to be alerted when a user creates a new IAM role at the organization level. Which type of audit log should they analyze?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs (option D) are the correct choice because they record operations that modify the configuration or metadata of resources, such as creating or modifying IAM roles and policies at the organization level. In Google Cloud, Admin Activity audit logs are enabled by default and capture all 'admin write' events, including the creation of an IAM role, which is a configuration change. The security team needs to monitor these logs to detect when a user creates a new IAM role, as this is an administrative action that alters the organization's security posture.

Answer

Policy Denied audit logs

Answer

System Event audit logs

Answer

Data Access audit logs

Question 12

A multinational company is migrating sensitive workloads to Google Cloud and must comply with GDPR data residency requirements. Which TWO actions ensure data remains stored only within the European Union? (Choose TWO.)

Accepted Answer

Define an Organization Policy with constraints/gcp.resourceLocations to allow resource creation only in EU regions.. The Organization Policy constraint `gcp.resourceLocations` explicitly restricts the Google Cloud regions where resources can be created. By setting this constraint to allow only EU regions (e.g., `europe-west1`, `europe-west4`), you enforce that all new resources are provisioned within the European Union, directly meeting GDPR data residency requirements. This policy is evaluated at resource creation time and prevents any resource from being deployed outside the allowed locations.

Answer

Enable Cloud Audit Logs with export to a BigQuery dataset in the EU region.

Answer

Use Cloud Data Loss Prevention (DLP) to scan for sensitive data and verify it remains in the EU.

Answer

Use Customer-Managed Encryption Keys (CMEK) stored in a Cloud KMS key ring located in the EU.

Question 13

Which TWO practices help implement the principle of least privilege when configuring access to Google Cloud resources? (Choose two.)

Accepted Answer

Create custom roles that include only the specific permissions needed.. Creating custom roles allows you to define a precise set of permissions, ensuring that a principal has only the minimum permissions required to perform their job function. This directly implements the principle of least privilege by avoiding the broad permissions often included in predefined roles.

Answer

Grant roles at the organization level to simplify administration.

Answer

Use a single service account for all Cloud Functions in a project to simplify key management.

Answer

Grant IAM roles directly to individual users for better traceability.

Question 14

A company needs to store financial records for 7 years to meet regulatory requirements. They want to ensure that once written, the records cannot be modified or deleted by anyone, including cloud administrators. Which Cloud Storage feature should they enable?

Accepted Answer

Object Retention Lock with a locked retention policy. Object Retention Lock with a locked retention policy enforces immutability on objects for a specified period, preventing deletion or modification even by administrators. Once the retention policy is locked, it cannot be removed or shortened, ensuring compliance with regulations like SEC Rule 17a-4. This directly meets the requirement of 7-year retention with no modifications.

Answer

Lifecycle management rules

Answer

Object Versioning

Answer

Customer-Managed Encryption Keys (CMEK)

Question 15

A security team wants to detect and block network-based threats such as malware and command-and-control traffic within their VPC. They need a managed service that provides deep packet inspection. Which Google Cloud service should they use?

Accepted Answer

Cloud IDS. Cloud IDS (Intrusion Detection System) is a managed service that uses Palo Alto Networks threat detection to inspect network traffic for threats. It integrates with packet mirroring to analyze traffic.

Answer

Security Command Center

Answer

VPC Flow Logs

Answer

Cloud Armor

Google Professional Cloud Security Engineer PCSE practice test

Three ways to study

Study PCSE by domain

Study PCSE by topic

Configuring Access Within a Cloud Solution Environment practice questions

Ensuring Data Protection practice questions

Managing Operations in a Cloud Solution Environment practice questions

Configuring Network Security practice questions

Supporting Compliance Requirements practice questions

PCSE fundamentals practice questions

PCSE scenario practice questions

PCSE troubleshooting practice questions

Top PCSE questions

Google Professional Cloud Security Engineer practice questions