Courseiva

Google Professional Cloud Security Engineer (PCSE) — Questions 151–225

960 questions total · 13pages · All types, answers revealed

Take a mock examExam hub
Page 2

Page 3 of 13

Page 4
151
MCQhard

A company is implementing VPC Service Controls to protect sensitive data in Google Cloud Storage. They want to allow a private on-premises subnet (10.1.0.0/16) to access the storage buckets via a Cloud VPN tunnel, but deny all other on-premises traffic. Which configuration approach meets this requirement with least privilege?

A.Create a service perimeter that allows all traffic from on-premises, then an explicit deny rule for other IP ranges.
B.Create a bridged access level that includes the private IP range 10.1.0.0/16 and a VPC network condition.
C.Configure Cloud NAT in the on-premises network and allow the NAT IP in an access level.
D.Create an access level with the IP range 10.1.0.0/16 and apply it to a service perimeter.
AnswerB

Correct: bridged access level ensures traffic goes through VPN and originates from correct subnet.

Why this answer

VPC Service Controls use access levels to define which client identities or network sources can access protected services. By creating a bridged access level that includes both the private IP range 10.1.0.0/16 and a VPC network condition (the VPC connected via Cloud VPN), you ensure that only traffic originating from that specific on-premises subnet and arriving through the authorized VPC is allowed, denying all other on-premises traffic by default. This follows the least-privilege principle by not allowing broader IP ranges or relying on implicit denies.

Exam trap

Google Cloud often tests the misconception that an IP-based access level alone is sufficient for VPN-connected traffic, but the trap here is that without a VPC network condition, the access level would allow any traffic with that IP range, including from other networks or spoofed sources, failing the least-privilege and VPN-specific requirement.

How to eliminate wrong answers

Option A is wrong because creating a service perimeter that allows all on-premises traffic and then adding an explicit deny for other IP ranges violates least privilege by initially granting overly broad access, and VPC Service Controls do not support explicit deny rules within a perimeter—they rely on default deny for sources not in the access level. Option C is wrong because Cloud NAT is a Google Cloud service used for outbound traffic from private GCP instances to the internet, not for on-premises networks; configuring NAT in the on-premises network would require a public IP, which defeats the purpose of using a private IP range and does not integrate with VPC Service Controls access levels. Option D is wrong because an access level with only the IP range 10.1.0.0/16 does not include a VPC network condition, so it would allow traffic from any network claiming that IP range (including spoofed or overlapping ranges), not just traffic arriving via the specific Cloud VPN tunnel, thus violating the requirement to restrict access to the VPN-connected subnet only.

Full explanation →
152
MCQhard

A security engineer is designing a VPC Service Controls perimeter to protect a project containing sensitive data stored in Cloud Storage and BigQuery. The perimeter currently allows access from an on-premises data center via private connectivity (Cloud Interconnect). The business requires that a third-party SaaS application (outside the perimeter) be able to write data into a specific Cloud Storage bucket. Which action should the engineer take?

A.Create a service account for the SaaS application and grant it the Storage Object Creator role; then add the service account to the perimeter's allowed identities.
B.Create a service account for the SaaS application, grant it the Storage Object Creator role, and configure an access level that includes the service account. Then, add that access level to the perimeter's ingress policy.
C.Create an access level that includes the SaaS application's IP addresses and use that in the perimeter's ingress policy.
D.Add the SaaS application's external IP addresses to the perimeter's allowed IP ranges.
AnswerB

VPC Service Controls ingress policies can use access levels based on service accounts. This allows the specific service account to write to the bucket while maintaining the perimeter.

Why this answer

VPC Service Controls perimeters use ingress policies to explicitly allow access from outside the perimeter. By creating a service account for the SaaS application, granting it the Storage Object Creator role, and configuring an access level that includes that service account, the engineer can add the access level to the perimeter's ingress policy. This allows the external SaaS application to write data into the specific Cloud Storage bucket while still blocking all other external access, maintaining the security of the sensitive data.

Exam trap

Google Cloud often tests the distinction between VPC Service Controls and IAM permissions, where candidates mistakenly think that granting IAM roles and adding identities to the perimeter is sufficient, ignoring the requirement for explicit ingress policies to allow external access.

How to eliminate wrong answers

Option A is wrong because simply adding the service account to the perimeter's allowed identities does not create an ingress rule; VPC Service Controls require an explicit ingress policy to allow traffic from outside the perimeter, and allowed identities alone cannot bypass the perimeter for external entities. Option C is wrong because using the SaaS application's IP addresses in an access level and ingress policy would allow access based on source IP, but the SaaS application likely uses dynamic IPs or operates from multiple IP ranges, making IP-based access control unreliable and less secure than identity-based access. Option D is wrong because VPC Service Controls do not support adding external IP addresses to 'allowed IP ranges' within the perimeter; the perimeter blocks all traffic from outside by default, and IP-based exceptions are not a feature of VPC Service Controls—this misconception confuses VPC firewall rules with VPC Service Controls.

Full explanation →
153
MCQmedium

An organization has hundreds of Google Cloud projects and wants to enforce a uniform firewall rule that blocks outbound traffic to known malicious IP addresses. They want to centrally manage this rule without manually applying it to each VPC. What should they do?

A.Create a hierarchical firewall rule at the organization or folder level.
B.Use Organization Policies to block the IP addresses.
C.Create a global VPC firewall rule in each project using Deployment Manager.
D.Use Shared VPC and configure firewall rules in the host project.
AnswerA

Hierarchical firewall rules are inherited by all VPCs under that node.

Why this answer

Hierarchical firewall rules can be applied at the organization or folder level and are inherited by all VPC networks in the projects under that node, enabling centralized enforcement without manual per-project configuration. Option B is incorrect because Organization Policies are used for constraints like resource locations, not for firewall rules. Option C is incorrect because global VPC firewall rules must still be applied to each VPC network individually.

Option D is incorrect because Shared VPC only affects projects that use the shared VPC, not all projects.

Full explanation →
154
Multi-Selecteasy

Which TWO of the following are valid methods to automate responses to Cloud Security Command Center findings?

Select 2 answers
A.Create a Cloud Function that is triggered by a Pub/Sub topic receiving SCC notifications.
B.Set up Cloud Tasks to process SCC findings and send alerts.
C.Configure Cloud Run to directly receive webhooks from SCC.
D.Use Eventarc to trigger a Cloud Run job based on SCC findings.
E.Use Cloud Scheduler to periodically query SCC and trigger a Cloud Run service.
AnswersA, D

Standard pattern for automated response.

Why this answer

Options A and D are correct. Cloud Functions can subscribe to SCC notifications via Pub/Sub, and Eventarc triggers can react to findings. Option B is incorrect because Cloud Tasks is for task distribution, not direct response.

Option C is incorrect because Cloud Run does not directly integrate with SCC. Option E is incorrect because Cloud Scheduler is for scheduled jobs, not event-driven automation.

Full explanation →
155
MCQmedium

A DevOps engineer accidentally assigned the role roles/editor to a service account used by a backend service. This gives the service account excessive permissions. The engineer wants to remove the role from the service account. What is the correct command?

A.gcloud projects remove-iam-policy-binding PROJECT_ID --member serviceAccount:SA_EMAIL --role roles/editor
B.gcloud iam policy-bindings remove --member serviceAccount:SA_EMAIL --role roles/editor
C.gcloud iam service-accounts remove-role SA_EMAIL --role roles/editor
D.gcloud projects set-iam-policy PROJECT_ID policy.yaml
AnswerA

This command correctly removes the specified role binding.

Why this answer

`gcloud projects remove-iam-policy-binding` is the specific command to remove an IAM role binding from a project-level policy for a given member (service account). The syntax correctly includes the `--member` flag with the `serviceAccount:` prefix and the `--role` flag specifying `roles/editor`, which removes the excessive Editor role from the service account.

Exam trap

Google Cloud often tests the distinction between project-level IAM commands (`gcloud projects`) and service account-specific commands, leading candidates to incorrectly choose non-existent or misnamed subcommands like `gcloud iam service-accounts remove-role`.

How to eliminate wrong answers

Option B is wrong because `gcloud iam policy-bindings remove` is not a valid gcloud command; the correct command uses `gcloud projects remove-iam-policy-binding` for project-level policies. Option C is wrong because `gcloud iam service-accounts remove-role` does not exist; service account roles are managed via IAM policy bindings, not a direct service account subcommand. Option D is wrong because `gcloud projects set-iam-policy` replaces the entire IAM policy with a YAML file, which is an overly complex and error-prone approach for a single role removal, and it does not directly remove a specific role binding.

Full explanation →
156
MCQhard

A company uses Cloud SQL for PostgreSQL with IAM database authentication. A security engineer needs to grant a user named 'analyst@example.com' the ability to run SELECT queries on the 'orders' table. The user is a member of the group 'analysts@example.com'. What is the correct combination of IAM and database permissions?

A.Grant the user 'roles/cloudsql.viewer' on the project. In the database, grant SELECT on orders to 'analyst@example.com'.
B.Grant the user 'cloudsql.instances.connect' on the instance. In the database, create a user 'analyst@example.com' with 'cloudsqllogin' role and grant SELECT on orders to that user.
C.Grant the group 'roles/cloudsql.instanceUser' on the instance. In the database, create a user 'analysts@example.com' (the group) and grant SELECT on orders to that group.
D.Grant the group 'analysts@example.com' the role 'roles/cloudsql.instanceUser' on the instance. In the database, create a user 'analyst@example.com' with 'cloudsqllogin' role and grant SELECT on orders to that user.
AnswerD

Correct approach: IAM group gets instanceUser, then database user created with cloudsqllogin and table-level grant.

Why this answer

IAM database authentication requires granting the IAM group the `roles/cloudsql.instanceUser` role on the instance to allow members to connect, and then creating a database user with the same name as the IAM user (not the group) with the `cloudsqllogin` role, which maps the IAM user to the database. Granting SELECT on the `orders` table to that database user then allows the IAM user to query the table.

Exam trap

Google Cloud often tests the misconception that the database user should be created with the group email address instead of the individual user's email, leading candidates to pick Option C, which incorrectly assumes the group name is used in the database.

How to eliminate wrong answers

Option A is wrong because `roles/cloudsql.viewer` grants read-only access to Cloud SQL metadata (e.g., instance configurations) but does not allow connecting to the database or running SQL queries; it also incorrectly grants permissions at the project level instead of the instance level. Option B is wrong because granting `cloudsql.instances.connect` directly to the user is not a valid IAM role (the correct role is `roles/cloudsql.instanceUser`), and creating a database user with `cloudsqllogin` role for the individual user works but misses the group-based IAM binding, which is less scalable and not the best practice described in the scenario. Option C is wrong because while it correctly grants the group the IAM role, it incorrectly creates a database user named after the group (`analysts@example.com`) instead of the individual IAM user (`analyst@example.com`); IAM database authentication requires the database user to match the IAM user's email, not the group's email.

Full explanation →
157
Multi-Selecthard

A company wants to implement workload identity federation for a GitHub Actions workflow, allowing it to access Google Cloud resources without using service account keys. Which three steps are required? (Choose three.)

Select 3 answers
A.Grant the service account the roles/iam.workloadIdentityUser role on the workload identity pool.
B.Generate a JSON key for the service account and store it as a GitHub secret.
C.Create a service account in GCP and grant it the necessary roles.
D.Create a workload identity pool and provider in GCP for GitHub Actions.
E.Configure GitHub Actions workflow to authenticate using the workload identity provider.
AnswersC, D, E

A service account is needed as the target identity.

Why this answer

To implement workload identity federation for GitHub Actions, you need to: create a service account with necessary roles (C), create a workload identity pool and provider for GitHub (D), and configure the GitHub Actions workflow to authenticate using the provider (E). Option A is incorrect because the role `roles/iam.workloadIdentityUser` is granted on the service account, not on the pool. Option B is incorrect because storing a JSON key defeats the purpose of workload identity federation, which avoids using service account keys.

Full explanation →
158
MCQhard

Your company has a hybrid cloud environment with on-premises servers and Google Cloud. You are using Cloud VPN to connect the on-premises network to a VPC in us-central1. The on-premises network uses RFC 1918 addresses (10.0.0.0/8). The VPC has subnets in 10.0.0.0/8 as well, causing IP overlap. To resolve this, you have configured the VPC with a custom IP range of 172.16.0.0/12 and migrated some workloads. However, some legacy on-premises servers still need to access a specific set of Compute Engine VMs in the VPC. The security team requires that only authenticated service accounts from the VPC can access on-premises resources, and that traffic from on-premises to Google Cloud must be limited to specific ports (e.g., 443, 8443). You have set up a Cloud VPN tunnel with route-based VPN. What should you do to enforce these access controls?

A.Use Cloud Armor to create a security policy that filters traffic from on-premises IP ranges on ports 443 and 8443, and attach it to the VPN gateway.
B.Assign network tags to the Compute Engine VMs and create a firewall rule that allows traffic from the on-premises IP ranges on ports 443 and 8443 only to VMs with that tag.
C.Use Cloud NAT to provide outbound-only access from the VPC, and create firewall rules to block inbound traffic from on-premises.
D.Create VPC firewall rules that allow ingress from the on-premises IP ranges on ports 443 and 8443 to the target VMs. On the on-premises side, configure firewall rules to allow only traffic from the VPC IP ranges and require that the source VMs present a valid service account token, which can be verified using a proxy or by using Google Cloud's Identity-Aware Proxy (IAP) for TCP forwarding.
AnswerD

Correct approach: Firewall rules restrict ports, and IAP TCP forwarding or service account tokens provide authentication.

Why this answer

It addresses both requirements: limiting traffic to specific ports (443, 8443) via VPC firewall rules, and enforcing authenticated service account access from the VPC to on-premises resources. Identity-Aware Proxy (IAP) for TCP forwarding allows on-premises servers to verify that source VMs present a valid service account token, ensuring only authenticated VPC workloads can initiate connections. This combination satisfies the security team's need for both port restriction and authentication without relying on IP-based trust alone.

Exam trap

Google Cloud often tests the misconception that firewall rules alone (like tags or Cloud Armor) can enforce authentication, when in reality they only filter by IP/port and cannot verify the identity of the source VM, which requires a solution like IAP or mutual TLS.

How to eliminate wrong answers

Option A is wrong because Cloud Armor is a web application firewall (WAF) for HTTP(S) load balancers, not for VPN gateways; it cannot filter traffic at the VPN tunnel level or enforce service account authentication. Option B is wrong because network tags and firewall rules can restrict ports but cannot authenticate the source; they rely solely on source IP ranges, which are overlapping and do not verify the identity of the requesting VM. Option C is wrong because Cloud NAT provides outbound-only internet access for VMs without public IPs, but it does not restrict inbound traffic from on-premises or enforce authentication; it also does not solve the IP overlap issue or control specific ports.

Full explanation →
159
MCQmedium

An engineer needs to schedule automatic rotation of a symmetric key in Cloud KMS every 30 days. The key is currently enabled. What should they do?

A.Automatic rotation is not supported for symmetric keys
B.Set a rotation period via 'gcloud kms keyrings create'
C.Manually create a new key version every 30 days using 'gcloud kms keys versions create'
D.Set the rotation period on the key via 'gcloud kms keys update'
AnswerD

The 'gcloud kms keys update' command allows setting the rotation period for automatic rotation.

Why this answer

Cloud KMS supports automatic rotation by setting a rotation period on the key. The key must have purpose ENCRYPT_DECRYPT (symmetric). The rotation period can be set in seconds (e.g., 2592000 for 30 days).

Manual rotation is also possible but not automatic.

Full explanation →
160
Multi-Selectmedium

A company uses Cloud Armor to protect their HTTP(S) load balancer. They want to block requests from a specific geographic region. Which TWO actions should they take? (Choose 2)

Select 2 answers
A.Create a security policy with a geo-match condition for the region.
B.Enable Cloud CDN and set geo-restrictions.
C.Attach the security policy to the backend service.
D.Configure the load balancer to use a custom header for geo-blocking.
E.Add a rule in the security policy with deny action and priority lower than the default.
AnswersA, C

Correct. Creating a security policy with a geo-match condition allows you to specify which geographic locations to block.

Why this answer

To block requests by geography in Cloud Armor, you create a security policy with a geo-match condition (A) and then attach that policy to the backend service (C), not to the load balancer itself. Option B is incorrect because Cloud CDN geo-restrictions affect caching, not request blocking. Option D is unnecessary; custom headers are not used for geo-blocking.

Option E is incorrect because the deny rule should have a higher priority (lower number) than the default rule, not lower.

Full explanation →
161
MCQeasy

A company has a Google Group called team-a@example.com that contains all developers. The developers need to deploy Cloud Functions. What is the best practice to grant the necessary permissions?

A.Add each developer's email to the IAM policy with roles/cloudfunctions.developer.
B.Grant the group roles/cloudfunctions.developer at the organization level.
C.Grant the group roles/cloudfunctions.developer on the project.
D.Grant the group roles/cloudfunctions.admin on the project.
AnswerC

This role allows deploying functions without full admin.

Why this answer

Granting the IAM role `roles/cloudfunctions.developer` to the Google Group at the project level follows the principle of least privilege and allows all members of the group to deploy Cloud Functions without granting excessive permissions. This approach centralizes permission management via the group, avoiding the need to manage individual user IAM bindings.

Exam trap

Google Cloud often tests the distinction between project-level and organization-level IAM roles, where candidates mistakenly choose the organization level thinking it covers all projects, but the correct answer is project-level to avoid over-permissioning.

How to eliminate wrong answers

Option A is wrong because adding each developer's email individually to the IAM policy is not a best practice; it creates administrative overhead and violates the principle of using groups for scalable access management. Option B is wrong because granting the role at the organization level would apply the permission to all projects in the organization, which is overly broad and violates least privilege. Option D is wrong because `roles/cloudfunctions.admin` grants full administrative control (including deleting functions and modifying IAM policies), which is more permissive than what developers need for deploying functions.

Full explanation →
162
Multi-Selectmedium

A security team wants to restrict service account key creation in their organization to prevent key-based authentication. They have set the organization policy constraint constraints/iam.disableServiceAccountKeyCreation to True. However, they need to allow a specific project to continue creating keys for legacy applications. Which two steps are required? (Choose two.)

Select 2 answers
A.Remove the constraint from the organization level and apply it to all child projects except the legacy one.
B.Use a deny policy to block key creation for all projects except the legacy one.
C.Create a custom role with iam.serviceAccountKeys.create permission and assign it to the project.
D.Set a folder-level policy to disable the constraint for the folder containing the project.
E.Add an exception in the organization policy for the specific project using conditions.
AnswersD, E

A folder policy can override the org policy if it is less restrictive.

Why this answer

Setting a folder-level policy to disable the constraint for the folder containing the project allows the organization policy to remain enforced at the org level while creating an exception for the specific folder and its child projects. Option E is correct because the organization policy supports conditions, enabling you to add an exception for a specific project without removing the constraint from the organization level.

Exam trap

A common misconception is that you must remove the constraint from the organization level and reapply it to individual projects. In Google Cloud, you can use hierarchical overrides (e.g., folder-level policy) or organization policy conditions to create targeted exceptions without altering the organization-level policy.

Full explanation →
163
Matchingmedium

Match each Google Cloud logging/monitoring term to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Routes logs to a destination (e.g., BigQuery, Pub/Sub)

Storage location for log entries

Counts log entries matching a filter

Records of admin and data access activities

Copies logs to a Cloud Storage or BigQuery

Why these pairings

Log buckets store logs, log sinks route logs, log-based metrics derive metrics from logs, and log entries are individual records. Common confusions include mixing sinks with metrics and buckets with queries.

Full explanation →
164
MCQmedium

A developer wants to run a containerized application on GKE that needs to read from a Cloud Storage bucket. The developer needs to securely provide credentials. What is the recommended approach?

A.Create a Google service account with necessary permissions, create a Kubernetes service account, and configure Workload Identity to bind them.
B.Use the default compute engine service account for the GKE nodes.
C.Store the service account key in Cloud Secret Manager and retrieve it in the pod at startup.
D.Create a service account key, store it as a Kubernetes secret, and mount it in the pod.
AnswerA

Workload Identity allows pods to use GCP service accounts without keys, following best practices.

Why this answer

The recommended approach is to use Workload Identity to bind a Kubernetes service account to a Google service account. This avoids managing keys and allows fine-grained access. The developer should create a GCP service account with the Storage Object Viewer role, then create a Kubernetes service account, and bind them using Workload Identity.

The pod should use the Kubernetes service account.

Full explanation →
165
Multi-Selecthard

A company needs to comply with GDPR and must implement data subject access request (DSAR) capabilities. Which TWO Google Cloud services should they use to locate and export personal data across various data stores?

Select 2 answers
A.Cloud Key Management Service (KMS)
B.Cloud Storage
C.BigQuery
D.Cloud Data Loss Prevention (DLP)
E.VPC Service Controls
AnswersC, D

BigQuery can store and query personal data for DSAR responses.

Why this answer

BigQuery is correct because it can be used to query and export personal data stored in BigQuery tables via SQL, enabling DSAR compliance by locating and extracting data subject information. Cloud Data Loss Prevention (DLP) is correct because it can inspect and classify personal data across various Google Cloud data stores (including Cloud Storage, BigQuery, and Datastore) and de-identify or export findings, directly supporting DSAR workflows.

Exam trap

Google Cloud often tests the misconception that Cloud Storage or VPC Service Controls can handle DSARs, but they are storage and security boundary services respectively, not data discovery or export tools; candidates confuse data storage with data subject access request capabilities.

Full explanation →
166
MCQhard

A company is using Assured Workloads to meet EU data residency requirements (EU_REGIONS_AND_SUPPORT). They want to monitor compliance drift when changes are made to the environment. Which service should they use?

A.Cloud Audit Logs
B.Cloud Monitoring
C.Assured Workloads Compliance Monitoring
D.Cloud Security Command Center
AnswerC

Assured Workloads includes a compliance monitoring capability that detects configuration changes that could cause drift from the compliance regime.

Why this answer

Assured Workloads Compliance Monitoring (part of Assured Workloads) continuously monitors the environment for compliance with the selected regime (e.g., data residency). It alerts on drift. Alternatively, Cloud Security Command Center (Cloud SCC) can be used, but the question asks for monitoring compliance drift specifically.

The built-in monitoring in Assured Workloads is the correct answer.

Full explanation →
167
MCQmedium

A company is migrating to Google Cloud and wants to ensure that all service account keys are rotated automatically every 90 days. The security engineer needs to implement a solution that detects keys older than 90 days and notifies the security team. What is the most efficient way to achieve this?

A.Use Cloud Monitoring to query the IAM API for key creation timestamps and trigger an alert
B.Use Cloud Asset Inventory to list service account keys, then run a Cloud Scheduler job that invokes a Cloud Function to check key ages and send notifications
C.Create a log-based metric for service account key creation and set up an alert in Cloud Monitoring
D.Configure a custom role in Cloud IAM that denies access to keys older than 90 days
AnswerB

This combination efficiently checks key ages periodically and alerts.

Why this answer

Cloud Asset Inventory can list all service account keys and their creation timestamps, and a Cloud Scheduler job can trigger a Cloud Function to check key ages against the 90-day threshold and send notifications via email or Slack. This approach is efficient as it uses serverless components and avoids polling the IAM API repeatedly, which would be less scalable and more complex.

Exam trap

Google Cloud often tests the distinction between detecting key creation events (Option C) and detecting key age, leading candidates to mistakenly choose a log-based metric that only triggers on creation, not on the passage of time.

How to eliminate wrong answers

Option A is wrong because Cloud Monitoring cannot directly query the IAM API for key creation timestamps; it relies on metrics and logs, not API queries, and would require custom metric ingestion, making it inefficient. Option C is wrong because a log-based metric for key creation only detects when keys are created, not their age, so it cannot identify keys older than 90 days. Option D is wrong because IAM custom roles cannot deny access based on key age; they define permissions, not conditional access based on time, and this approach would not detect or notify about old keys.

Full explanation →
168
MCQhard

A large healthcare organization is migrating its on-premises data center to Google Cloud. The organization must comply with HIPAA and has signed a BAA with Google Cloud. They plan to use BigQuery for analytics on PHI data. The security team has enabled encryption at rest with CMEK and has configured VPC Service Controls to prevent data exfiltration. During a penetration test, the testers discovered that they could query the BigQuery dataset using a service account that has BigQuery Data Viewer role from a non-VPC-SC-compliant network. This could allow unauthorized access to PHI data. The team needs to restrict all access to the BigQuery dataset to only originate from within the VPC perimeter defined by VPC Service Controls. What should the team do to enforce this requirement?

A.Set up Private Google Access for the on-premises network and route all traffic through a VPN tunnel.
B.Configure an Organization Policy that restricts BigQuery access to only service accounts with a specific prefix.
C.Enable VPC Service Controls perimeters for the BigQuery API and ensure that the project containing the dataset is in the perimeter, and configure ingress/egress rules to allow only requests from within the perimeter.
D.Use Cloud IAP to require users to authenticate before accessing BigQuery.
AnswerC

VPC Service Controls can enforce network-based access restrictions.

Why this answer

VPC Service Controls are specifically designed to create a security perimeter around Google Cloud services like BigQuery, preventing data exfiltration and restricting access to only requests originating from within the defined perimeter. By placing the project containing the BigQuery dataset inside the VPC Service Controls perimeter and configuring ingress/egress rules, the team ensures that even a service account with BigQuery Data Viewer role cannot query the dataset from a non-VPC-SC-compliant network, as the API call is blocked at the Google Cloud edge before it reaches BigQuery.

Exam trap

Google Cloud often tests the distinction between IAM-based access control (who can access) and network-based perimeter control (from where they can access), and the trap here is that candidates confuse VPC Service Controls with Private Google Access or IAP, thinking that private connectivity or identity verification alone can enforce network origin restrictions.

How to eliminate wrong answers

Option A is wrong because Private Google Access and VPN tunnels enable on-premises access to Google Cloud APIs via private IP addresses, but they do not enforce that all access must originate from within the VPC Service Controls perimeter; they merely provide a private connectivity path, not a restriction on the source network. Option B is wrong because an Organization Policy restricting BigQuery access to service accounts with a specific prefix does not enforce network-level origin restrictions; it only controls which identities can access BigQuery, not from where they can access it, leaving the data vulnerable to queries from non-VPC-SC-compliant networks. Option D is wrong because Cloud IAP provides identity-aware access control for applications and SSH/RDP, but it does not integrate with BigQuery's API or enforce network perimeter restrictions; it cannot block API calls from a service account outside the VPC Service Controls perimeter.

Full explanation →
169
Multi-Selectmedium

A company wants to use Cloud DLP to de-identify sensitive data in a BigQuery table. They need to replace credit card numbers with a token that preserves the format and also mask email addresses by showing only the first character. Which TWO de-identification transforms should they use? (Choose two.)

Select 2 answers
A.MaskingConfig
B.CryptoReplaceFfxFpeConfig
C.DateShiftConfig
D.ReplaceValueConfig
E.BucketingConfig
AnswersA, B

Masking can replace part of the email with 'x'.

Why this answer

CryptoReplaceFfxFpeConfig performs format-preserving encryption, suitable for credit card numbers. MaskingConfig with a 'x' character can mask email addresses (e.g., first character visible).

Full explanation →
170
MCQmedium

A security engineer needs to ensure that a specific Compute Engine instance can only be accessed via HTTPS from users authenticated through Cloud Identity. The instance is behind an HTTP(S) load balancer. What should the engineer configure on the load balancer to enforce this access control?

A.Set firewall rules to allow only HTTPS traffic from the load balancer's IP ranges
B.Enable HTTPS only on the load balancer and use client certificates for authentication
C.Configure Cloud Armor with a security policy to require valid JWT tokens
D.Configure IAP on the backend service of the load balancer
AnswerD

IAP can be enabled on the backend service of an HTTPS load balancer to enforce authentication and authorization for all requests.

Why this answer

Identity-Aware Proxy (IAP) provides zero-trust access control for web applications and can be enabled on a load balancer backend service. It verifies user identity and context before allowing access. Configuring IAP on the backend service of the load balancer restricts access to authenticated users only.

Full explanation →
171
MCQmedium

A DevOps engineer wants to allow a CI/CD pipeline running in GitHub Actions to deploy resources to a Google Cloud project without using long-lived service account keys. What should the engineer implement?

A.Use a Cloud Functions HTTP trigger called from GitHub Actions.
B.Create a service account and distribute its JSON key to the GitHub repository secrets.
C.Enable Cloud Build triggers that watch the GitHub repository.
D.Configure Workload Identity Federation between GitHub and the service account.
AnswerD

This allows keyless authentication using OIDC.

Why this answer

Workload Identity Federation allows GitHub Actions to exchange OpenID Connect (OIDC) tokens for Google Cloud temporary credentials, eliminating the need for long-lived service account keys. This approach follows Google's security best practices by using short-lived, automatically rotated tokens and avoids the risk of key exposure in repository secrets.

Exam trap

The PCSE exam often tests the distinction between using Google Cloud's native CI/CD triggers (like Cloud Build) versus configuring an external identity federation (like Workload Identity Federation) to allow a different CI/CD tool (GitHub Actions) to authenticate securely.

How to eliminate wrong answers

Option A is wrong because a Cloud Functions HTTP trigger would require the CI/CD pipeline to call an HTTP endpoint, which still needs authentication (e.g., an API key or OAuth token) and does not solve the long-lived credential problem; it merely shifts the authentication point. Option B is wrong because distributing a service account JSON key to GitHub repository secrets creates a long-lived, static credential that can be leaked or misused, violating the principle of avoiding long-lived keys. Option C is wrong because Cloud Build triggers that watch a GitHub repository are a separate CI/CD service, not a method for GitHub Actions to authenticate to Google Cloud; this option confuses the CI/CD platform (Cloud Build) with the authentication mechanism needed for GitHub Actions.

Full explanation →
172
MCQmedium

Refer to the exhibit. A Terraform configuration applies an IAM binding with a condition. After applying this configuration, a member of the group data-scientists@example.com tries to query a BigQuery dataset on July 1, 2025. What will be the result?

A.Access is denied because the condition is no longer satisfied.
B.Access is denied because the condition is invalid after the date.
C.Access is granted because the IAM binding exists.
D.Access is granted and the condition is ignored after the date.
AnswerA

request.time is after the condition's timestamp, so the condition is false and the role is not granted.

Why this answer

The IAM binding includes a condition that restricts access based on a date/time attribute. On July 1, 2025, the condition is no longer satisfied (e.g., the condition might require the request to occur before a specific date, such as before June 30, 2025). When the condition evaluates to false, the IAM binding does not grant access, even though the binding itself exists and the user is a member of the group.

Exam trap

Google Cloud often tests the misconception that an IAM binding always grants access regardless of its condition, or that a condition becomes invalid after its date, rather than simply evaluating to false.

How to eliminate wrong answers

Option B is wrong because the condition is not 'invalid after the date'; it is a valid condition that simply evaluates to false after the specified date, which is a normal behavior for date-based conditions. Option C is wrong because the IAM binding exists but the condition attached to it must also be satisfied for access to be granted; the condition is not optional. Option D is wrong because the condition is never ignored; it is always evaluated, and if it evaluates to false, access is denied regardless of the binding's existence.

Full explanation →
173
MCQhard

A large financial institution runs a critical application on Google Kubernetes Engine (GKE) clusters. Their security policy requires that all container images must be scanned for vulnerabilities and must come from a trusted artifact registry. They use Cloud Build to automatically build images from a CI/CD pipeline and push them to Artifact Registry. They want to enforce that only images that have passed vulnerability scanning and are signed can be deployed to the GKE cluster. Currently, they have set up Cloud Build to automatically tag images with a 'latest' tag on successful build, but they need a mechanism to prevent deployment of unsigned or vulnerable images. They also want to audit any attempts to deploy non-compliant images. What should they do?

A.Use Cloud NAT to control which images can be pulled by GKE nodes.
B.Configure GKE policy to only allow images from a specific Artifact Registry repository and enable vulnerability scanning.
C.Use Cloud IAP to block nodes from pulling non-compliant images.
D.Enable Binary Authorization on the GKE cluster, create Attestations for images that pass vulnerability scanning and signing in Cloud Build, and configure admission control to require attestations.
AnswerD

Binary Authorization enforces that only attested images can be deployed.

Why this answer

Combining Binary Authorization with Attestations from vulnerability and signing enables enforcement. Option A is incorrect because Cloud Nat is for outbound traffic, not image enforcement. Option B is incorrect because GKE policy does not natively enforce image contracts.

Option C is incorrect because IAP is for access, not for image verification.

Full explanation →
174
MCQmedium

An application running on Compute Engine needs to authenticate to Google Cloud APIs. The security engineer wants to avoid managing keys. What is the recommended method?

A.Store the service account key in Cloud Secret Manager and retrieve it at boot.
B.Create a service account key and store it in the instance's local disk.
C.Use workload identity federation to exchange a JWT from the application.
D.Attach a service account to the VM instance and use the metadata server to obtain tokens.
AnswerD

This is the recommended approach; no keys are needed, and the service account is securely attached to the VM.

Why this answer

Use the default compute engine service account or a custom service account attached to the VM instance. The VM automatically obtains tokens via the metadata server, no keys required. This is the recommended approach for workloads on Compute Engine.

Full explanation →
175
MCQhard

A financial institution is deploying a payment application on GKE that must comply with PCI DSS. They need to isolate the cardholder data environment (CDE) from other workloads and ensure only authorized services can communicate. Which combination of controls should they implement?

A.Use Cloud Armor to inspect all traffic and block non-compliant requests.
B.Use a separate VPC and VPC Service Controls perimeter for the CDE, and apply Kubernetes Network Policies to restrict pod communication.
C.Enable Data Loss Prevention to scan payment data and restrict access.
D.Deploy the CDE in a separate project and use IAM roles to restrict access.
AnswerB

Separate VPC for network isolation, VPC Service Controls to restrict data access to managed services, and Network Policies for pod-level segmentation align with PCI DSS requirements.

Why this answer

VPC Service Controls provide a perimeter that prevents data exfiltration from managed services, while GKE network policies enforce pod-level isolation. Both are recommended for PCI DSS CDE isolation.

Full explanation →
176
MCQhard

A company using Assured Workloads with the FedRAMP High compliance regime wants to monitor for configuration changes that could cause the environment to become non-compliant. Which tool should they use to detect compliance drift?

A.Security Command Center
B.Cloud Monitoring
C.Assured Workloads Compliance Status dashboard
D.Cloud Asset Inventory
AnswerC

The Compliance Status dashboard within Assured Workloads shows current compliance status and alerts on drift.

Why this answer

Assured Workloads provides a Compliance Status dashboard that shows the compliance state of the folder. It monitors for policy violations and configuration drifts that could affect compliance. Security Command Center provides security posture, but not specifically compliance drift for Assured Workloads.

Cloud Monitoring monitors metrics, not compliance. Cloud Asset Inventory tracks resources but does not evaluate compliance against a regime.

Full explanation →
177
MCQeasy

An engineer needs to block a specific IP address from accessing an HTTPS load balancer. Which Cloud Armor rule should be used?

A.A VPC firewall rule with a deny ingress for that IP
B.A custom rule with a 'deny' action and the IP address in the 'src_ip_ranges' field
C.A Cloud Armor rate limiting rule
D.A preconfigured rule from the OWASP ModSecurity CRS
AnswerB

Custom rules can block specific IPs using 'src_ip_ranges'.

Why this answer

Cloud Armor custom rules allow IP allow/deny lists. A deny rule with the specific IP address will block traffic.

Full explanation →
178
MCQmedium

A company uses Cloud DLP to scan a BigQuery table for sensitive data. They want to automatically mask credit card numbers in query results for users who are not data stewards. Which approach should they use?

A.Enable Access Transparency to log queries and manually review
B.Use Cloud DLP de-identification jobs to replace credit card numbers with tokens in the source table
C.Use Cloud DLP inspect job and then manually apply a view that masks the column
D.Create a BigQuery Data Policy with masking rules on the column and assign appropriate IAM roles
AnswerD

BigQuery Data Policy allows column-level masking that applies dynamically based on the user's access, without modifying the underlying data.

Why this answer

BigQuery column-level security with data masking rules (via BigQuery Data Policy) allows defining masking policies (e.g., email masking, hash masking) that are automatically applied to query results based on user IAM. DLP inspection can identify the sensitive columns, but the masking is enforced by BigQuery policies.

Full explanation →
179
MCQmedium

A security engineer needs to allow HTTP (port 80) traffic from all VMs in the production environment to a specific set of VMs running a web server. The web server VMs are identified by a service account 'web-sa@...'. Which firewall rule configuration should the engineer create?

A.Egress rule: destination = 0.0.0.0/0, targetServiceAccounts = ['web-sa@...'], allow tcp:80
B.Ingress rule: source = 0.0.0.0/0, targetTags = ['web-server'], deny tcp:80
C.Ingress rule: source = 0.0.0.0/0, targetTags = ['web-server'], allow tcp:80
D.Ingress rule: source = 0.0.0.0/0, targetServiceAccounts = ['web-sa@...'], allow tcp:80
AnswerD

This rule allows HTTP traffic to VMs with the specified service account, which is the recommended approach.

Why this answer

Using a service account as the target (serviceAccount = web-sa@...) is the recommended approach for security, as it is more dynamic and less error-prone than using network tags. The rule allows ingress traffic from any source (0.0.0.0/0) on TCP port 80 to VMs with that service account.

Full explanation →
180
Multi-Selectmedium

A company is using Cloud Run for a containerized application. They notice increased latency during peak hours. The operations team wants to identify the root cause. Which two steps should they take?

Select 2 answers
A.Enable Cloud Logging and use Logs Explorer to query request latency for each endpoint.
B.Use Cloud Profiler to continuously profile the application code and identify performance bottlenecks.
C.Implement Cloud Armor security policies to protect against DDoS attacks.
D.Set up a Cloud Monitoring dashboard to visualize CPU utilization for the Cloud Run service.
E.Enable VPC Flow Logs to analyze network traffic to and from the Cloud Run service.
AnswersA, B

Logs can show request latency, helping identify slow endpoints.

Why this answer

Cloud Logging with Logs Explorer allows the operations team to query and analyze request latency per endpoint, which is essential for identifying which specific endpoints contribute to increased latency during peak hours. This granular visibility into request-level performance helps pinpoint the root cause of latency issues in a Cloud Run service.

Exam trap

Google Cloud often tests the distinction between monitoring (e.g., CPU utilization) and diagnostic tools (e.g., logging and profiling), leading candidates to choose a monitoring dashboard (Option D) when they need granular request-level analysis.

Full explanation →
181
MCQeasy

A company has a VPC with several subnets. They want to allow HTTP traffic from the internet to a web server in subnet-a, but block all other inbound traffic. What is the simplest firewall rule configuration?

A.Create an ingress rule allowing all tcp and udp traffic from 0.0.0.0/0.
B.Create an egress rule allowing tcp:80 from the internet to the web server.
C.Create an ingress rule allowing tcp:80 from 0.0.0.0/0 to instances with the 'web-server' tag. The implied deny all ingress rule blocks other traffic.
D.Create an ingress rule allowing tcp:80 from the web server's internal IP range. The implied deny all ingress rule blocks other traffic.
AnswerC

Correct: single rule with tag and source range, plus implied deny.

Why this answer

It creates an ingress rule that explicitly allows TCP port 80 traffic from any source (0.0.0.0/0) to instances tagged as 'web-server'. In cloud VPC firewalls (e.g., AWS Security Groups or GCP Firewall Rules), the default behavior is an implied deny all ingress traffic; only explicitly allowed traffic is permitted. This configuration satisfies the requirement to allow HTTP from the internet while blocking all other inbound traffic without needing additional rules.

Exam trap

Google Cloud often tests the distinction between ingress and egress rules, and the trap here is that candidates mistakenly think an egress rule (Option B) can control inbound traffic, or that restricting to internal IPs (Option D) is sufficient for internet access.

How to eliminate wrong answers

Option A is wrong because allowing all TCP and UDP traffic from 0.0.0.0/0 would permit all inbound traffic, not just HTTP, violating the requirement to block other traffic. Option B is wrong because an egress rule controls outbound traffic from the web server, not inbound traffic from the internet; the requirement is to allow inbound HTTP, which requires an ingress rule. Option D is wrong because it restricts HTTP traffic to the web server's internal IP range, which would block legitimate internet traffic (since internet clients do not originate from that internal range), failing to allow HTTP from the internet.

Full explanation →
182
MCQhard

A company is using Assured Workloads to enforce FEDRAMP_HIGH compliance. They need to ensure that only US-based personnel from Google can access their data. Which configuration setting within the Assured Workloads folder should they enable?

A.Access Transparency logs
B.Resource location restrictions
C.Google personnel access restrictions
D.Key Access Justification (KAJ) logs
AnswerC

This setting allows restricting Google personnel access based on geographic location, e.g., only US-based personnel.

Why this answer

Assured Workloads provides access restrictions that can limit Google personnel access based on geographic location. The 'Google personnel access restrictions' setting can be configured to restrict access to Google personnel located in specific countries, e.g., the United States. The compliance regime selection defines the overall framework, while resource location restrictions control where data is stored.

Full explanation →
183
MCQhard

A large enterprise runs analytics workloads on BigQuery containing sensitive financial data. They have implemented VPC Service Controls (VPC SC) to create a perimeter around the BigQuery dataset, allowing access only from a specific VPC network. Despite this, security auditors discovered that data was accessed from an IP address outside the perimeter. After investigation, they found the access originated from a user's personal laptop using the Google Cloud Console. The company's security policy requires that sensitive data can only be accessed from corporate-managed devices. What should they do to prevent this type of access?

A.Enable Cloud Data Loss Prevention (DLP) to automatically redact sensitive data before it is displayed in the console.
B.Reconfigure the VPC Service perimeter to use a more restrictive set of allowed IP ranges.
C.Activate Access Transparency logs and create a log-based alert to notify security of anomalous access.
D.Add a context-aware access level to the VPC Service perimeter that requires a corporate device policy (e.g., OS version, disk encryption).
AnswerD

This enforces device trust, blocking access from non-corporate devices while still respecting the VPC SC perimeter.

Why this answer

VPC Service Controls can integrate with Access Context Manager to enforce context-aware access levels. By adding a level that requires a corporate device policy (e.g., verified OS version, disk encryption status), access from unmanaged personal laptops is blocked at the perimeter boundary, even if the user is authenticated. This directly addresses the security policy requirement that sensitive data must only be accessible from corporate-managed devices.

Exam trap

The trap here is that candidates confuse logging/monitoring (Option C) or data masking (Option A) with preventive access control, or they assume IP-based restrictions (Option B) are sufficient when the real requirement is device identity enforcement.

How to eliminate wrong answers

Option A is wrong because Cloud DLP redacts or masks sensitive data in the dataset itself, but it does not prevent access from unauthorized devices or IPs; the data is still accessible from the personal laptop, just with redacted content, which violates the security policy. Option B is wrong because reconfiguring the VPC Service perimeter to use a more restrictive set of allowed IP ranges would not block access from a personal laptop if the laptop is using a corporate VPN or if the user is accessing via the Google Cloud Console from an IP that falls within the allowed range; the issue is device identity, not IP address. Option C is wrong because Access Transparency logs and log-based alerts only provide visibility into access events after they occur; they do not prevent the access from happening in the first place, which is the requirement.

Full explanation →
184
MCQeasy

You are configuring a new VPC network with a private subnet for Compute Engine instances that need to access the internet for updates. Which configuration is the simplest and most secure?

A.Create a default VPC firewall rule that allows all egress traffic and assign only internal IPs to instances.
B.Configure Cloud NAT to provide outbound internet access for the instances and create a firewall rule that blocks inbound traffic from the internet.
C.Use a managed instance group with a proxy instance that has an external IP, and route traffic through the proxy.
D.Assign static external IP addresses to each instance and configure firewall rules to allow egress.
AnswerB

Cloud NAT provides secure outbound-only internet access without exposing instance IPs.

Why this answer

Cloud NAT allows instances without external IPs to access the internet for outbound connections, while preventing inbound traffic. Option B is correct. Option A is incorrect because a default egress firewall rule that allows all outbound traffic is less secure than using Cloud NAT, which provides controlled outbound access.

Option C is incorrect because using a proxy instance adds complexity and a single point of failure. Option D is incorrect because assigning static external IPs to each instance increases the attack surface and is less secure than using Cloud NAT.

Full explanation →
185
MCQeasy

A security engineer is configuring access for a new team member who needs to manage Cloud Storage buckets, but should not be able to delete or modify existing objects. Which IAM role should be assigned?

A.Storage Legacy Bucket Writer (roles/storage.legacyBucketWriter)
B.Storage Object Viewer (roles/storage.objectViewer)
C.Storage Admin (roles/storage.admin)
D.Storage Object Admin (roles/storage.objectAdmin)
AnswerA

Storage Legacy Bucket Writer (roles/storage.legacyBucketWriter) allows users to list, create, and update buckets, and list objects within buckets. However, it does not grant permissions to create, modify, or delete objects. Therefore, it satisfies the requirement of managing buckets without being able to delete or modify existing objects.

Why this answer

The Storage Legacy Bucket Writer role (roles/storage.legacyBucketWriter) allows a user to list, create, and update buckets, but it does not grant permissions to delete or modify existing objects within those buckets. This role is specifically designed for managing bucket-level metadata while restricting object-level write and delete operations, making it the correct choice for the described requirement.

Exam trap

The PCSE exam often tests the distinction between bucket-level and object-level roles, and the trap here is that candidates confuse 'bucket writer' with 'object writer,' assuming it allows object modification, when in fact it only affects bucket metadata and not the objects themselves.

How to eliminate wrong answers

Option B (Storage Object Viewer) is wrong because it only provides read-only access to objects (e.g., viewing and listing), with no ability to manage buckets or create/update objects, which the team member needs. Option C (Storage Admin) is wrong because it grants full control over all Cloud Storage resources, including deleting and modifying objects, which violates the restriction. Option D (Storage Object Admin) is wrong because it allows full control over objects (create, read, update, delete) but does not include bucket-level management permissions, and it permits object deletion, which is explicitly prohibited.

Full explanation →
186
MCQhard

A company has deployed an application in Assured Workloads with the FEDRAMP_HIGH compliance regime. They need to ensure that Google Cloud personnel cannot access their data. Which additional control should they enable?

A.Enable Google personnel access restrictions
B.Enable Access Transparency logs
C.Enable CMEK for all services
D.Enable VPC Service Controls
AnswerA

This control, available in Assured Workloads, restricts Google employees from accessing the customer's data, meeting the requirement.

Why this answer

Assured Workloads for FedRAMP High includes the option to enable Google personnel access restrictions, which blocks Google employees from accessing the customer's data. This is a key control for FedRAMP High compliance.

Full explanation →
187
MCQeasy

A security engineer needs to grant a data analyst read-only access to a BigQuery dataset containing customer data, but must prevent the analyst from viewing or querying a specific column that contains personally identifiable information (PII). Which approach should the engineer use?

A.Use BigQuery column-level security with a policy tag on the PII column, and assign the analyst a role that denies access to that tag.
B.Grant the analyst the roles/bigquery.user role, and use IAM conditions to deny access to the PII column.
C.Create a row-level access policy on the table that denies access to rows containing PII.
D.Grant the analyst the BigQuery Data Viewer role on the dataset, and create an authorized view that excludes the PII column.
AnswerA

Policy tags can restrict access to specific columns based on IAM conditions.

Why this answer

BigQuery column-level security uses policy tags to control access at the column level. By assigning a policy tag to the PII column and then granting the analyst a role that explicitly denies access to that tag (e.g., using a deny role or IAM deny policies), the analyst can query the dataset but will be blocked from viewing or querying the tagged column. This approach directly meets the requirement of read-only access while preventing access to the specific PII column.

Exam trap

Google Cloud often tests the distinction between column-level security (policy tags) and row-level security (row-level access policies), and the trap here is that candidates may confuse row-level filtering with column-level restriction, or assume that an authorized view is sufficient without considering that the underlying table remains accessible via the dataset-level role.

How to eliminate wrong answers

Option B is wrong because the roles/bigquery.user role does not provide fine-grained column-level control; IAM conditions can restrict access based on resource properties but cannot deny access to a specific column within a table. Option C is wrong because row-level access policies filter rows based on conditions, not columns; they cannot prevent access to a specific column across all rows. Option D is wrong because creating an authorized view that excludes the PII column would require granting the analyst the BigQuery Data Viewer role on the dataset, which would give them access to all tables in the dataset, including the original table with the PII column; the authorized view only controls access to the view itself, not the underlying table.

Full explanation →
188
MCQeasy

A security engineer needs to restrict access to Cloud Storage buckets so that only resources in a specific VPC can reach the Google APIs. Which Google Cloud service should be used?

A.Firewall Rules
B.VPC Service Controls
C.Identity-Aware Proxy
D.Cloud Armor
AnswerB

VPC Service Controls enforces perimeters around Google Cloud APIs to control data access.

Why this answer

VPC Service Controls allows you to define a service perimeter that restricts access to Google Cloud APIs (like Cloud Storage) to only resources from authorized VPCs, preventing data exfiltration.

Full explanation →
189
MCQeasy

A security engineer needs to enforce that all new Compute Engine disks are created in a specific geographic region to meet data residency requirements. Which organization policy constraint should they use?

A.gcp.resourceLocations
B.constraints/compute.trustedImageProjects
C.compute.skipDefaultNetworkCreation
D.iam.allowedPolicyMemberDomains
AnswerA

This organization policy constraint restricts the locations where resources can be created.

Why this answer

The constraint 'gcp.resourceLocations' restricts where Google Cloud resources can be created. It can be set to a list of allowed locations. The other constraints: 'iam.allowedPolicyMemberDomains' restricts member domains, 'compute.skipDefaultNetworkCreation' prevents default network creation, 'constraints/compute.trustedImageProjects' restricts image projects.

Full explanation →
190
MCQeasy

A company is experiencing high latency on their HTTPS Load Balancer. Which action is most likely to resolve the issue?

A.Increase the machine type of the backend instances
B.Verify that the backend instances pass health checks
C.Modify the SSL policy for the load balancer
D.Add more backend instances in additional zones
AnswerB

Correct. Health check failures can cause traffic to be concentrated on healthy instances, leading to latency. Verifying health checks is the first step to resolve the issue.

Why this answer

If backend instances fail health checks, the load balancer will stop sending traffic to them, potentially causing traffic to be routed to fewer healthy instances, leading to increased latency. Verifying health checks is the first step in diagnosing latency issues. Option A is wrong because increasing machine type may improve performance but does not address the root cause if instances are unhealthy.

Option C is wrong because SSL policy changes affect encryption protocols, not latency. Option D is wrong while adding more instances can distribute load, it does not solve latency caused by unhealthy backends.

Full explanation →
191
MCQeasy

A security engineer wants to export all Cloud Audit Logs from a Google Cloud project to a BigQuery dataset for long-term analysis. Which type of log sink should be configured?

A.Create a folder-level sink and assign it to the project
B.Create an organization-level sink with includeChildren set to true
C.Create a project-level aggregated sink with destination set to BigQuery dataset
D.Create a sink for each log type individually
AnswerC

A project-level aggregated sink exports all logs from the project to the specified destination, such as BigQuery.

Why this answer

A project-level aggregated sink collects logs from all resources within the project. BigQuery is the appropriate destination for analysis. The sink must include all log types, but Admin Activity logs are enabled by default and cannot be disabled.

Full explanation →
192
MCQmedium

A multinational corporation must store all data subject to GDPR in the European Union. They have multiple projects and want to enforce this at the organization level. Which approach should they use to prevent resource creation outside allowed locations?

A.Configure VPC Service Controls to limit network traffic to EU regions
B.Use Cloud Deployment Manager to deploy resources only in EU regions
C.Apply Organization Policy constraints (constraints/gcp.resourceLocations) with allowed regions in EU
D.Enable Cloud Audit Logs to monitor resource locations and alert on violations
AnswerC

The Organization Policy resourceLocations constraint prevents resource creation outside specified regions, enforcing compliance across all projects.

Why this answer

Organization policies provide centralized control to constrain resource locations, ensuring all projects under the organization adhere to the data residency requirement.

Full explanation →
193
MCQeasy

A company wants to detect and alert on potential network threats, such as malware and command-and-control traffic, within their VPC. They need a managed service that integrates with packet mirroring. Which Google Cloud service should they use?

A.Cloud IDS
B.Security Command Center
C.VPC Flow Logs
D.Cloud Armor
AnswerA

Cloud IDS provides managed threat detection using packet mirroring.

Why this answer

Cloud IDS (Intrusion Detection System) is a managed network threat detection service that uses packet mirroring to inspect traffic for threats. It is powered by Palo Alto Networks.

Full explanation →
194
MCQhard

A security administrator needs to audit all changes to IAM policies across the organization. They want to detect when a policy binding is added that grants a sensitive role to a user outside the organization. What is the most efficient method?

A.Use Cloud Asset Inventory to monitor IAM policy changes and trigger Cloud Functions.
B.Create a log sink to export Admin Activity audit logs to BigQuery and run queries for setIamPolicy events.
C.Enable Data Access audit logs for all services and filter for policy changes.
D.Set up VPC Service Controls to prevent external access.
AnswerB

Admin Activity logs include all IAM policy changes; BigQuery enables efficient querying to find specific bindings.

Why this answer

Admin Activity audit logs capture all setIamPolicy calls, and exporting them to BigQuery allows for powerful querying to detect specific changes. Option A is incorrect because Cloud Asset Inventory can monitor policy changes but setting up feeds and triggers is more complex and not the most efficient method for this specific use case. Option C is incorrect because Data Access audit logs are for data access, not admin changes.

Option D is incorrect because VPC Service Controls are for perimeter security, not auditing.

Full explanation →
195
MCQhard

Your Cloud SQL PostgreSQL instance is experiencing high replication lag between primary and read replica. You have verified the network and instance metrics. What is a likely cause?

A.The replica is using a different machine type
B.Long-running queries on the replica
C.The replica has point-in-time recovery enabled
D.The primary has automated backups enabled
AnswerB

Long-running queries can hold locks and prevent replay of WAL from primary.

Why this answer

Long-running queries on the replica can block the apply process, increasing lag. Other options do not directly affect replication lag.

Full explanation →
196
Multi-Selecthard

A security engineer is designing a VPC Service Controls perimeter to protect sensitive BigQuery data. They need to allow a specific on-premises application (source IP range 203.0.113.0/24) to query BigQuery, and also allow a managed instance group in another project (project 'analytics') to export data from BigQuery to Cloud Storage. Which THREE configurations are required? (Choose three.)

Select 3 answers
A.Add the analytics project to the service perimeter
B.Configure Cloud Armor to allow the on-premises IP
C.Create an egress rule to allow Cloud Storage access from the perimeter
D.Create an ingress rule to allow the service account of the managed instance group
E.Add the on-premises IP range to an access level and create an ingress rule
AnswersA, C, E

The managed instance group's project must be within the perimeter to access BigQuery.

Why this answer

To allow on-premises access, an ingress rule with the source IP range is needed. To allow the managed instance group in another project, that project must be added to the perimeter (as a project within the perimeter) and an ingress rule for the service account or VPC of that project must be created. Also, the managed instance group will need an egress rule to allow access to Cloud Storage from within the perimeter.

So ingress rule for on-premises, adding the analytics project to the perimeter, and an egress rule for Cloud Storage are required.

Full explanation →
197
MCQmedium

A company runs a critical application on Compute Engine instances in a managed instance group (MIG) behind an external TCP/UDP Network Load Balancer. The security team requires that all traffic to the instances be inspected by a third-party next-generation firewall (NGFW) that is not yet deployed. Which architecture should the security engineer implement to meet the requirement with minimal disruption to traffic?

A.Deploy the NGFW as a Compute Engine instance in a separate instance group, and configure the load balancer to forward traffic to that instance group, which then forwards to the MIG.
B.Change the load balancer type to Internal TCP/UDP Load Balancer and route traffic through the NGFW.
C.Replace the Network Load Balancer with a proxy-based load balancer that can integrate with the NGFW via Traffic Director.
D.Use Cloud NAT and route all egress traffic through the NGFW.
AnswerA

This allows traffic inspection while preserving the load balancer frontend.

Why this answer

It inserts the NGFW as a middlebox in the traffic path without changing the existing load balancer or instance group configuration. The external TCP/UDP Network Load Balancer forwards traffic to the NGFW instance group, which then inspects and forwards packets to the backend MIG. This preserves the original client IP via proxy protocol or encapsulation, meets the security requirement, and minimizes disruption by avoiding reconfiguration of the existing MIG or load balancer type.

Exam trap

Google Cloud often tests the misconception that you can simply change the load balancer type or use Cloud NAT to inspect ingress traffic, when in fact those solutions address different traffic directions or protocol requirements, and the correct approach is to insert the NGFW as a middlebox in the forwarding path without altering the existing load balancer or MIG configuration.

How to eliminate wrong answers

Option B is wrong because changing to an Internal TCP/UDP Load Balancer would make the application inaccessible from the internet, as internal load balancers only handle traffic within a VPC. Option C is wrong because replacing the Network Load Balancer with a proxy-based load balancer (e.g., HTTPS Load Balancer) would change the traffic type from TCP/UDP to HTTP/HTTPS, breaking the application if it uses non-HTTP protocols, and Traffic Director integrates with service mesh, not NGFW middlebox inspection. Option D is wrong because Cloud NAT handles only egress traffic from instances to the internet, not ingress traffic from clients to the application, so it cannot inspect incoming traffic from the load balancer.

Full explanation →
198
MCQeasy

A healthcare company subject to HIPAA must prevent data exfiltration from Google Cloud storage buckets. They already use VPC Service Controls. Which additional control should they configure to directly block unauthorized copying of data to external projects?

A.Enable Cloud Data Loss Prevention (DLP) scanning
B.Use Cloud Audit Logs to review access
C.Apply Cloud Identity-Aware Proxy (IAP) to buckets
D.Configure egress rules in the VPC Service Controls perimeter
AnswerD

Egress rules define allowed destinations for data leaving the perimeter, directly preventing exfiltration to external projects.

Why this answer

VPC Service Controls allow you to define perimeters that restrict data movement between authorized and unauthorized projects. By configuring egress rules within the perimeter, you can explicitly block copying data to external projects, directly preventing data exfiltration. This is the correct additional control because it enforces policy at the network boundary, not just at the application or storage layer.

Exam trap

Google Cloud often tests the distinction between detective controls (like audit logs) and preventive controls (like VPC Service Controls egress rules), leading candidates to choose Cloud Audit Logs because they think logging alone can stop exfiltration.

How to eliminate wrong answers

Option A is wrong because Cloud DLP is a content inspection and classification tool, not a network-level enforcement mechanism; it can detect sensitive data but cannot block data transfer to external projects. Option B is wrong because Cloud Audit Logs provide visibility into who accessed what and when, but they do not actively block or prevent data exfiltration. Option C is wrong because Cloud Identity-Aware Proxy (IAP) controls access to applications and VMs via identity and context, not to Cloud Storage buckets; IAP does not apply to GCS buckets and cannot restrict data copying between projects.

Full explanation →
199
MCQmedium

A company uses BigQuery to store analytics data. They need to restrict access to specific rows based on the user's department. What should they implement?

A.Column-level security
B.Row-level security using authorized views
C.Data Catalog tags
D.IAM conditions on BigQuery datasets
AnswerB

Authorized views can include row-level filters, such as filtering by the user's department.

Why this answer

Authorized views in BigQuery can filter rows based on the user's identity or other context. Column-level security is for columns, not rows. IAM conditions cannot restrict rows.

Data Catalog is for metadata.

Full explanation →
200
MCQmedium

A company uses Binary Authorization for their GKE clusters. They want to ensure that only images signed by their internal CI/CD system can be deployed. Which IAM role is required for the CI/CD service account to attach attestations?

A.roles/binaryauthorization.attestorsViewer
B.roles/container.developer
C.roles/cloudkms.signerVerifier
D.roles/binaryauthorization.attestorsEditor
AnswerD

Grants the binaryauthorization.attestations.create permission needed to attach attestations.

Why this answer

The `roles/binaryauthorization.attestorsEditor` IAM role grants the necessary permissions to create and manage attestations, including the `binaryauthorization.attestors.attest` permission required for a CI/CD service account to attach an attestation to a container image. Without this role, the service account cannot create a signed attestation that Binary Authorization will accept during admission control.

Exam trap

Google Cloud often tests the distinction between roles that grant read access to attestors (like `attestorsViewer`) versus roles that grant the ability to create attestations (like `attestorsEditor`), and candidates may confuse the `container.developer` role as sufficient because it allows deploying containers, but it lacks the specific Binary Authorization attestation permission.

How to eliminate wrong answers

Option A is wrong because `roles/binaryauthorization.attestorsViewer` only provides read-only access to attestors and their public keys, not the ability to create or attach attestations. Option B is wrong because `roles/container.developer` grants permissions to deploy and manage GKE clusters and workloads, but does not include the `binaryauthorization.attestors.attest` permission needed to attach attestations. Option C is wrong because `roles/cloudkms.signerVerifier` is used for signing and verifying operations with Cloud Key Management Service (KMS) keys, but it does not grant the specific Binary Authorization attestation permissions required to attach an attestation to an image.

Full explanation →
201
MCQhard

A company has a Cloud Storage bucket containing sensitive data. They want to ensure that only users with specific IAM roles can access the bucket, and that access is logged for audit purposes. They also want to prevent public access. Which configuration steps should they take?

A.Use IAM roles only and enable Cloud Audit Logs, but keep ACLs enabled.
B.Use VPC Service Controls and enable Cloud Audit Logs.
C.Enable uniform bucket-level access, set IAM policies, and enable Cloud Audit Logs.
D.Enable fine-grained access using ACLs and enable Cloud Audit Logs.
AnswerC

Uniform bucket-level access disables ACLs and relies solely on IAM, and audit logs track access.

Why this answer

Enabling uniform bucket-level access disables ACLs, forcing all access decisions to be made by IAM policies alone, which simplifies permission management and prevents public access. Setting IAM policies ensures only users with specific roles can access the bucket, and enabling Cloud Audit Logs captures all access requests for audit purposes. This combination meets all requirements: no public access, role-based access control, and logging.

Exam trap

Google Cloud often tests the misconception that ACLs are still needed for granular control, but uniform bucket-level access combined with IAM is the modern, secure approach that prevents public access and simplifies auditing.

How to eliminate wrong answers

Option A is wrong because keeping ACLs enabled alongside IAM roles can allow public access if ACLs grant allUsers or allAuthenticatedUsers permissions, and ACLs can override IAM policies, creating a security gap. Option B is wrong because VPC Service Controls restrict data exfiltration and access based on VPC context but do not directly control bucket-level IAM permissions or prevent public access via ACLs; they are a perimeter security control, not a substitute for IAM and uniform access. Option D is wrong because fine-grained ACLs can inadvertently allow public access (e.g., via allUsers) and are harder to audit consistently; uniform bucket-level access is the recommended approach for sensitive data.

Full explanation →
202
MCQhard

A company uses Forseti Security to monitor their GCP environment for compliance violations. They want to automatically enforce policies that prevent the deployment of resources without required labels. What should they do?

A.Use Forseti Config Validator with a deny policy that blocks creation of resources without required labels
B.Configure Forseti Inventory to scan and report resources missing labels, then manually delete them
C.Enable VPC Service Controls to restrict projects without labels from accessing resources
D.Use Cloud Asset Inventory to trigger Cloud Functions that delete resources missing labels
AnswerA

Config Validator can enforce policies using constraints that deny resource creation if labels are missing, using Organization Policy constraints or Forseti's own enforcement.

Why this answer

Forseti Config Validator can enforce policies at deployment time by using a deny policy that blocks resource creation if required labels are missing. This is the correct approach because it prevents non-compliant resources from being created in the first place, rather than detecting and remediating them after the fact.

Exam trap

The trap here is confusing reactive detection and remediation (Inventory, Cloud Asset Inventory, Cloud Functions) with proactive enforcement (Config Validator), leading candidates to choose options that only report or clean up violations instead of preventing them.

How to eliminate wrong answers

Option B is wrong because Forseti Inventory only scans and reports resources missing labels; it does not automatically enforce policies or block deployments, and manual deletion is not automated enforcement. Option C is wrong because VPC Service Controls are designed to control data exfiltration and access between projects, not to enforce labeling requirements on resource creation. Option D is wrong because Cloud Asset Inventory is a discovery and monitoring service, not a policy enforcement engine; triggering Cloud Functions to delete resources is a reactive, not preventive, approach and does not block deployment.

Full explanation →
203
MCQeasy

Refer to the exhibit. A security engineer runs the following command to check encryption settings on a Cloud Storage bucket. What does the output indicate about encryption?

A.The bucket uses customer-supplied encryption keys (CSEK).
B.The bucket has no default encryption.
C.The bucket uses Google-managed encryption keys.
D.The bucket uses a customer-managed encryption key (CMEK).
AnswerD

The key path shows a CMEK key.

Why this answer

The output shows `default_kms_key_name` is set to a Cloud KMS key resource name (e.g., `projects/<project>/locations/<location>/keyRings/<keyring>/cryptoKeys/<key>`), which indicates the bucket uses a customer-managed encryption key (CMEK). CMEK allows you to control and manage the key via Cloud KMS, while Google manages the underlying encryption operations.

Exam trap

Google Cloud often tests the distinction between default encryption (CMEK or GMEK) and per-object encryption (CSEK), trapping candidates who confuse a configured default KMS key with the absence of encryption or with customer-supplied keys.

How to eliminate wrong answers

Option A is wrong because customer-supplied encryption keys (CSEK) are provided per-object in the request header, not configured as a default on the bucket; the output shows a default KMS key, not per-object key supply. Option B is wrong because the presence of `default_kms_key_name` explicitly indicates a default encryption configuration is set, not absent. Option C is wrong because Google-managed encryption keys (GMEK) are the default when no `default_kms_key_name` is specified; the output shows a KMS key name, meaning the bucket is not using GMEK.

Full explanation →
204
MCQhard

A company uses a multi-region Cloud Storage bucket for disaster recovery of critical data. They want to prevent accidental deletion of objects by requiring that objects be retained for at least 7 days after creation, and any attempt to delete or overwrite an object during that period must fail. Which configuration meets these requirements?

A.Enable object versioning and set a lifecycle rule to delete old versions after 7 days.
B.Set a bucket lock with a retention policy of 7 days and lock the bucket.
C.Set a retention policy for 7 days and apply object holds to all objects at upload time.
D.Use a lifecycle rule to delete objects that are less than 7 days old as a way to block deletion.
AnswerC

This is correct. A retention policy with object holds ensures objects are retained for the specified duration and cannot be deleted or overwritten.

Why this answer

A retention policy ensures objects cannot be deleted or overwritten for a specified duration, and object holds can be applied to enforce this on a per-object basis. Option A is incorrect because object versioning only preserves previous versions but does not prevent deletion of the current version; lifecycle rules can delete old versions but do not block deletion. Option B is incorrect because a bucket lock with a retention policy makes the retention policy permanent and cannot be removed, which is more restrictive than required and not flexible.

Option D is incorrect because lifecycle rules automatically delete objects based on age, they do not prevent deletion of objects less than 7 days old.

Full explanation →
205
MCQmedium

A company is using Cloud Armor with adaptive protection enabled. They notice that adaptive protection has generated a rule that is blocking some legitimate traffic. What should they do to minimize false positives while still benefiting from adaptive protection?

A.Disable adaptive protection immediately
B.Add a higher-priority allow rule for the legitimate traffic
C.Increase the sensitivity threshold of adaptive protection
D.Change the adaptive protection rule action to 'throttle'
AnswerB

A higher-priority allow rule can override the adaptive protection rule for specific traffic.

Why this answer

Adaptive protection works by learning traffic patterns and generating rules. The best practice is to initially set the adaptive protection rule to 'throttle' or 'log' mode (or use a low priority) to monitor its impact. Alternatively, you can override the rule with a higher-priority allow rule for known good traffic.

The recommended approach is to use the rule in preview or monitoring mode before enforcing.

Full explanation →
206
MCQhard

A DevOps team is implementing Binary Authorization for a GKE cluster. They want to ensure that only container images signed by a specific attestor can be deployed. They have created the attestor and configured Cloud KMS for signing. Which additional step is required to enforce the policy?

A.Enable the 'gke-binary-authorization' feature flag on the cluster and update the kubeconfig.
B.Create a Binary Authorization policy that requires at least one attestation and attach it to the GKE cluster.
C.Create a policy that allows all images and then override it with an admission webhook.
D.Configure the container registry to block unsigned images by setting a repository-level policy.
AnswerB

The policy must require attestation and be applied to the cluster for enforcement.

Why this answer

Binary Authorization requires a policy to enforce attestation. The policy must be set to 'Require Attestations' and attached to the GKE cluster (via a policy binding). Creating the attestor alone is insufficient.

The policy can be set at project level.

Full explanation →
207
MCQhard

A company is using a Shared VPC in Google Cloud with multiple service projects. The security team wants to restrict egress traffic from a specific service project to only allowed external IP addresses. The network project hosts the VPC. What is the best approach?

A.Use Private Google Access to restrict egress.
B.Use VPC Service Controls to restrict egress.
C.Create a firewall rule in the service project's VPC that denies egress.
D.Create a firewall rule in the host project that denies egress to all destinations except the allowed IPs, and apply it to the service project's VMs via service accounts.
AnswerD

Firewall rules in host project can target service projects VMs by service account.

Why this answer

In a Shared VPC, firewall rules are defined in the host project and apply to VM instances in service projects. Option D correctly creates a deny-all egress rule in the host project, then uses a higher-priority allow rule for specific external IPs, scoped to service accounts of the target VMs. This ensures egress traffic from the specific service project is restricted at the VPC firewall level, which is the only effective way to control outbound traffic in a Shared VPC architecture.

Exam trap

Google Cloud often tests the misconception that firewall rules can be created in service projects within a Shared VPC, but the correct understanding is that all firewall rules must be managed in the host project, and service accounts are the mechanism to scope rules to specific VMs.

How to eliminate wrong answers

Option A is wrong because Private Google Access only allows on-premises or VM instances to reach Google APIs and services using internal IPs, not restrict egress to external IPs. Option B is wrong because VPC Service Controls protect Google-managed services (like Cloud Storage) by creating perimeters, not by controlling egress traffic from VMs to arbitrary external IP addresses. Option C is wrong because in a Shared VPC, firewall rules cannot be created in the service project's VPC; the service project does not own the VPC, and all firewall rules must be defined in the host project.

Full explanation →
208
Multi-Selecthard

An organization wants to ensure that all service accounts used by Compute Engine instances have the minimal permissions required. Which TWO practices should be implemented? (Choose 2)

Select 2 answers
A.Attach service accounts to instances using the gcloud compute instances set-service-account command after creation.
B.Use the default compute service account and restrict its scopes.
C.Use Access Transparency to audit service account usage.
D.Create custom service accounts with only the needed roles.
E.Disable service account key creation for service accounts.
AnswersD, E

Custom service accounts allow fine-grained permissions.

Why this answer

Options D and E are correct. Creating custom service accounts with only the needed roles (D) ensures minimal permissions by following the principle of least privilege. Disabling service account key creation (E) reduces the risk of key exposure and is a security best practice.

Option A is incorrect because attaching a service account after instance creation is possible but not a best practice for minimal permissions; the service account should be assigned at creation. Option B is incorrect because the default compute service account often has excessive permissions and restricting scopes is not as secure as using a custom service account. Option C is incorrect because Access Transparency is for auditing Google support access, not for managing service account permissions.

Full explanation →
209
MCQeasy

A company wants to encrypt data at rest in Cloud Storage using their own keys. Which Cloud service should they use to manage these keys?

A.Cloud Data Loss Prevention (Cloud DLP)
B.Cloud Key Management Service (Cloud KMS)
C.Secret Manager
D.Cloud HSM
AnswerB

Cloud KMS is the service for managing encryption keys.

Why this answer

Cloud Key Management Service (Cloud KMS) allows customers to create, rotate, and manage their own encryption keys. Cloud HSM provides hardware security module-backed keys, but Cloud KMS is the management service. Cloud DLP is for data loss prevention, and Secret Manager is for storing secrets like API keys.

Full explanation →
210
MCQmedium

A company wants to allow an application running in an on-premises data center to access Google Cloud Storage buckets without storing long-lived service account keys. The on-premises application authenticates using an external identity provider (IdP) that supports OpenID Connect (OIDC). Which Google Cloud feature should they use?

A.Use Cloud VPN to connect the on-premises network and access Cloud Storage via private IP
B.Configure a VPN between on-premises and Google Cloud and use a Compute Engine instance as a proxy
C.Create a service account key and store it securely on-premises
D.Use workload identity federation to exchange OIDC tokens for Google Cloud tokens
AnswerD

Workload identity federation enables keyless access from external workloads by federating with external IdPs.

Why this answer

Workload identity federation allows the on-premises application to exchange OIDC tokens from the external IdP for short-lived Google Cloud access tokens, eliminating the need to store long-lived service account keys. This directly meets the requirement of accessing Cloud Storage buckets without managing static credentials.

Exam trap

A common mistake in the Google PCSE exam is to assume that network connectivity solutions like Cloud VPN or proxies are sufficient for authentication and authorization. However, the question requires identity-based access without static keys, which only workload identity federation provides.

How to eliminate wrong answers

Option A is wrong because Cloud VPN only provides network connectivity; it does not solve the authentication requirement of exchanging OIDC tokens for Google Cloud tokens. Option B is wrong because using a Compute Engine instance as a proxy still requires managing credentials or service account keys on that instance, and does not leverage the external IdP's OIDC tokens for direct federation. Option C is wrong because storing a service account key on-premises violates the explicit requirement to avoid long-lived keys and introduces security risks.

Full explanation →
211
Multi-Selectmedium

A company wants to implement a zero-trust access model for SSH access to Compute Engine instances. They need to ensure that only authorized users can connect and that all connections are logged. Which two services should they use? (Choose TWO.)

Select 2 answers
A.Identity-Aware Proxy (IAP)
B.Cloud NAT
C.Cloud Shell
D.Cloud VPN
E.Cloud Audit Logs
AnswersA, E

Provides zero-trust SSH access via TCP forwarding.

Why this answer

Identity-Aware Proxy (IAP) allows zero-trust TCP forwarding for SSH and RDP without a bastion host. Cloud Audit Logs record all IAP tunnel connections. Cloud NAT is for outbound internet, Cloud VPN is for network connectivity, and Cloud Shell is a browser-based terminal but does not provide zero-trust access control.

Full explanation →
212
MCQeasy

What is the purpose of Identity-Aware Proxy (IAP) on Google Cloud?

A.To enforce identity-based access control for web applications and SSH/RDP to VMs without requiring a VPN.
B.To manage firewall rules for VPC networks.
C.To provide a VPN connection between on-premises and Google Cloud.
D.To act as a web application firewall (WAF) that blocks SQL injection and XSS attacks.
AnswerA

IAP provides zero-trust access by verifying the user's identity and context, allowing access to web apps and VMs via SSH/RDP without a VPN.

Why this answer

Identity-Aware Proxy (IAP) is a service that provides a zero-trust access control layer for applications and resources. It verifies a user's identity and context before allowing access, enforcing application-level access control. It is not a VPN or firewall; it works at the identity level, not network level.

It does not replace Cloud Armor or VPC firewalls but complements them.

Full explanation →
213
MCQeasy

A financial services company must comply with PCI DSS requirements for encryption key management. They want to use Google-managed keys with automatic rotation. Which key management solution should they choose?

A.Customer-supplied encryption keys (CSEK)
B.Cloud KMS with CMEK (Customer-Managed Encryption Keys)
C.Google-managed encryption keys (default)
D.Cloud HSM
AnswerB

CMEK lets customers create, manage, and rotate keys in Cloud KMS, meeting PCI DSS requirements for key management and rotation.

Why this answer

(Cloud KMS with CMEK) is correct because it allows the company to use Google-managed keys with automatic rotation while retaining control over the key material. CMEK keys are created and managed in Cloud KMS, but the actual cryptographic operations are performed by Google's key management infrastructure, and automatic rotation can be configured (e.g., every 90 days) to meet PCI DSS rotation requirements. This provides a balance between compliance control and operational simplicity.

Exam trap

Google Cloud often tests the distinction between key management (Cloud KMS with CMEK) and key hosting (Cloud HSM), tricking candidates into selecting Cloud HSM because it sounds more secure, even though the question explicitly asks for a solution with automatic rotation and managed keys.

How to eliminate wrong answers

Option A (CSEK) is wrong because CSEK requires the customer to supply their own key material and manage rotation manually, which does not satisfy the requirement for automatic rotation. Option C (Google-managed encryption keys, default) is wrong because these keys are fully managed by Google with no customer control over rotation schedule or key material, failing PCI DSS requirements for documented key management responsibilities. Option D (Cloud HSM) is wrong because while it provides FIPS 140-2 Level 3 validated hardware security modules, it is a key hosting option, not a key management solution with automatic rotation; CMEK can use Cloud HSM as a backing key store, but Cloud HSM alone does not provide the automatic rotation feature.

Full explanation →
214
MCQeasy

A security engineer wants to automatically rotate a database password stored in Secret Manager every 30 days. The new password should be generated and stored in Secret Manager without manual intervention. Which approach meets these requirements?

A.Configure a rotation period in Secret Manager, set a Pub/Sub topic, and implement a Cloud Function that listens for rotation messages to generate and add a new secret version.
B.Set up a Cloud Lifecycle rule to delete the old secret version and create a new one with the same value.
C.Use a Cloud KMS key to re-encrypt the secret each month.
D.Use gcloud secrets versions add with a scheduled Cloud Scheduler job that generates a new password and adds it as a new version.
AnswerA

Secret Manager can send Pub/Sub messages when rotation is due; a Cloud Function can generate the new password and add a version.

Why this answer

Secret Manager supports automatic rotation by configuring a rotation period and a Pub/Sub topic. A Cloud Function or other subscriber can listen for rotation notifications, generate a new secret version, and add it. This automates the rotation without manual steps.

Full explanation →
215
MCQeasy

A company has a VPC with several subnets. They want to restrict traffic between instances in the same subnet using firewall rules while allowing traffic from a specific load balancer health check range. What is the best approach?

A.Create an ingress firewall rule denying all traffic from the subnet CIDR, then create a higher priority rule allowing traffic from the health check range.
B.Use hierarchical firewall policies to enforce the rule at the organization level.
C.Use VPC firewall rules with target tags to apply rules only to instances that need health checks.
D.Create a firewall rule that allows only health check traffic and deny all other ingress by default using implied deny.
AnswerD

This leverages the implied deny rule at the end of the firewall evaluation, ensuring that only allowed health check traffic is permitted, and all other traffic is denied by default.

Why this answer

GCP VPC firewall rules have an implied deny at the end; therefore, allowing only the health check traffic and relying on the implied deny for all other ingress is the simplest and most secure approach. Option A is incorrect because using explicit deny rules can lead to complexity and potential misconfigurations; the implied deny already blocks unwanted traffic. Option B is incorrect because hierarchical firewall policies are designed for organization-level enforcement, not for restricting traffic within a specific subnet.

Option C is incorrect because target tags help apply rules to specific instances but do not automatically restrict internal subnet traffic; you still need to configure rules to deny or allow based on the health check source.

Full explanation →
216
MCQmedium

An organization wants to use Chronicle for SIEM. They need to ingest logs from an on-premises firewall. Which method should they use?

A.Configure a log sink from Cloud Logging to Chronicle
B.Export logs to Cloud Storage and have Chronicle import them
C.Use a forwarder (e.g., Syslog to UDM) to send logs to Chronicle
D.Directly send logs to a Pub/Sub topic that is ingested by Chronicle
AnswerC

Chronicle supports third-party log ingestion via forwarders that convert logs to UDM format.

Why this answer

Chronicle provides forwarders (e.g., Syslog, Winlogbeat) that parse and send logs to the Chronicle backend.

Full explanation →
217
MCQeasy

A company needs to ensure that all data stored in Cloud Storage is encrypted using a key that is rotated every 30 days. Which encryption option should they choose to meet this requirement with automated rotation?

A.Cloud External Key Manager (EKM)
B.Customer-Managed Encryption Key (CMEK) using Cloud KMS
C.Google-managed encryption keys
D.Customer-Supplied Encryption Key (CSEK)
AnswerB

CMEK allows customers to set a rotation period (e.g., 30 days) and KMS handles automatic rotation.

Why this answer

Customer-Managed Encryption Keys (CMEK) with Cloud KMS allow you to control and rotate encryption keys on a schedule. Cloud KMS supports automatic key rotation with a configurable rotation period (e.g., every 30 days), meeting the requirement without manual intervention.

Exam trap

The trap here is that candidates confuse CMEK (which supports automated rotation) with CSEK (which requires manual key management and does not support rotation), leading them to choose D thinking they have more control, but CSEK lacks the automated rotation feature needed for this requirement.

How to eliminate wrong answers

Option A is wrong because Cloud External Key Manager (EKM) lets you manage keys outside Google Cloud, but it does not provide automated rotation within Cloud KMS; rotation must be handled externally. Option C is wrong because Google-managed encryption keys are rotated automatically by Google, but you cannot control the rotation schedule or set it to exactly 30 days. Option D is wrong because Customer-Supplied Encryption Keys (CSEK) require you to supply the key with each API call and do not support automated rotation; you must manually rotate and re-encrypt data.

Full explanation →
218
MCQeasy

A healthcare organization must store protected health information (PHI) in Google Cloud and ensure compliance with HIPAA. They need to prevent data from being stored outside the United States. Which Google Cloud product should they use to enforce this requirement?

A.Cloud Healthcare API
B.Organization Policy
C.VPC Service Controls
D.Cloud Data Loss Prevention (DLP) API
AnswerB

Organization Policies with constraints like constraints/gcp.resourceLocations can restrict resources to specific regions.

Why this answer

Organization Policy allows you to define and enforce constraints on Google Cloud resources at the organization, folder, or project level. The `gcp.resourceRestriction` constraint can be used to restrict the location where data can be stored, ensuring PHI remains within the United States to meet HIPAA requirements.

Exam trap

Google Cloud often tests the distinction between data residency enforcement (Organization Policy) and data exfiltration prevention (VPC Service Controls), leading candidates to confuse the two when the question focuses on storage location restrictions.

How to eliminate wrong answers

Option A is wrong because Cloud Healthcare API is a managed service for ingesting and managing healthcare data, but it does not enforce geographic restrictions on data storage. Option C is wrong because VPC Service Controls create a security perimeter around Google Cloud services to prevent data exfiltration, but they do not restrict the geographic location where data is stored. Option D is wrong because Cloud Data Loss Prevention (DLP) API is used to inspect, classify, and de-identify sensitive data, not to enforce data residency policies.

Full explanation →
219
MCQhard

A company uses Cloud Identity-Aware Proxy (IAP) to secure access to their web applications. They notice that some users are able to access the application even though they are not in the IAP access policy. What could be the cause?

A.The users have been granted the 'roles/iap.httpsResourceAccessor' role at the folder level.
B.The load balancer is not using HTTPS.
C.The users are using a service account that has the 'roles/iap.httpsResourceAccessor' role.
D.The backend service has an external IP address and firewall rule allowing public access.
AnswerD

Direct access to the backend bypasses IAP, allowing unauthorized users.

Why this answer

If the backend service has an external IP address and a firewall rule allowing public access, users can bypass IAP enforcement entirely. Option A is incorrect because granting the 'roles/iap.httpsResourceAccessor' role at the folder level still requires IAP to be enabled and does not allow unauthorized access. Option B is incorrect because using HTTP instead of HTTPS would cause IAP to fail for all users, not just some.

Option C is incorrect because using a service account with the IAP role is a legitimate way to grant access, not an unauthorized bypass.

Full explanation →
220
MCQmedium

A company uses Shared VPC with host project and service projects. They want to ensure that only specific service projects can create firewall rules in the host project's network. What is the correct IAM configuration?

A.Grant the Compute Security Admin role to the service project's compute service account in the service project.
B.Grant the Compute Network Admin role to the service project's service accounts in the host project.
C.Grant the Compute Security Admin role to the service project's service accounts in the host project.
D.Create a custom role with compute.firewalls.create and grant it to the host project's compute service account.
AnswerC

Correct: allows managing firewall rules in the shared VPC.

Why this answer

In a Shared VPC setup, the host project owns the network, and service projects connect to it. To allow a service project to create firewall rules in the host project's network, you must grant the Compute Security Admin role (which includes compute.firewalls.create) to the service project's service accounts at the host project level. This grants the necessary permissions on the host project's resources without giving broader network administration rights.

Exam trap

Google Cloud often tests the distinction between granting roles in the host project versus the service project, and the trap here is that candidates mistakenly think the Compute Network Admin role is required for firewall rule creation, when in fact Compute Security Admin is the correct, more restrictive role.

How to eliminate wrong answers

Option A is wrong because granting the Compute Security Admin role to the service project's compute service account in the service project only affects resources within that service project, not the host project's network. Option B is wrong because the Compute Network Admin role includes permissions to modify network configurations (e.g., create/modify VPCs, subnets) beyond just firewall rules, which violates the principle of least privilege and is not the specific role for firewall rule creation. Option D is wrong because creating a custom role with compute.firewalls.create and granting it to the host project's compute service account would allow the host project's own service account to create firewall rules, not the service project's service accounts; the requirement is to enable specific service projects, not the host project itself.

Full explanation →
221
Multi-Selectmedium

A company wants to use Cloud KMS to protect sensitive data. They have a requirement that the key material must be stored in a FIPS 140-2 Level 3 validated HSM. They also need to be able to create and use asymmetric keys for signing. Which two steps should they take? (Choose TWO).

Select 2 answers
A.Set the protection level of the key to software.
B.Create a key ring in Cloud KMS.
C.Create a symmetric key with protection level HSM.
D.Enable key rotation on the key ring.
E.Create a key with purpose ASYMMETRIC_SIGN and protection level HSM.
AnswersB, E

Key rings are containers for keys; they must exist before creating keys.

Why this answer

Cloud HSM provides FIPS 140-2 Level 3 validated HSM for key material. Creating a key ring and setting the protection level to HSM ensures keys are generated in the HSM. Asymmetric signing keys can be created in Cloud HSM with purpose ASYMMETRIC_SIGN.

Setting protection level to software would not meet the HSM requirement. Using symmetric keys only would not support signing. Creating a key ring in Cloud KMS is a prerequisite, but protection level must be HSM.

Full explanation →
222
MCQmedium

A company wants to demonstrate to an auditor that all data access requests to a Cloud Storage bucket are logged, but they must exclude a specific service account from logging to reduce noise. What should they do to remain compliant with their audit policy?

A.Enable Data Access audit logs with exempted members set to that service account
B.Enable Data Access audit logs without exempting any service accounts
C.Configure VPC Service Controls to block the service account from accessing the bucket
D.Use Cloud Logging exclusion filters to filter out the service account logs after ingestion
AnswerB

Not exempting any service account ensures all data access is logged, satisfying audit requirements for comprehensive logging.

Why this answer

Enabling Data Access audit logs without exempting any service accounts ensures that all data access requests to the Cloud Storage bucket are logged, meeting the auditor's requirement. Exempting a service account (as in Option A) would violate the policy by excluding its requests from the logs entirely. Cloud Logging exclusion filters (Option D) operate after ingestion and cannot guarantee compliance, as the auditor may require logs to be captured in the first place.

Exam trap

Google Cloud often tests the distinction between logging configuration that prevents log generation (exempted members) versus post-ingestion filtering (exclusion filters), and candidates mistakenly think exclusion filters can satisfy audit requirements because they reduce noise, but they do not ensure logs are captured for compliance.

How to eliminate wrong answers

Option A is wrong because setting exempted members on the Data Access audit log configuration would exclude the specified service account from logging entirely, which directly contradicts the requirement to log all data access requests. Option C is wrong because VPC Service Controls block access at the network perimeter, but they do not log requests; they prevent the service account from accessing the bucket, which is not the goal and would break functionality. Option D is wrong because Cloud Logging exclusion filters are applied after logs are ingested, meaning the logs are still generated and stored temporarily; this does not satisfy an audit policy that requires logs to be captured for all requests, and the auditor may consider this non-compliant if logs are discarded.

Full explanation →
223
Multi-Selecteasy

Which two statements correctly describe Cloud KMS key versions? (Choose TWO.)

Select 2 answers
A.Key versions are immutable once created.
B.Key versions can be rotated automatically without creating a new version.
C.The destruction of a key version is immediate upon request.
D.You can disable a key version to prevent its use.
E.Each key version can have a different purpose.
AnswersA, D

Key material cannot be changed; you create new versions for rotation.

Why this answer

Key versions in Cloud KMS are immutable and each has its own key material. You can enable or disable versions for rotation. A key has multiple versions; rotation creates new versions.

The state can be ENABLED, DISABLED, DESTROYED, etc. The grace period applies to destruction scheduling.

Full explanation →
224
MCQeasy

A user has been granted the role roles/editor on a folder. What is the effective access in the projects within that folder? (Assume no deny policies)

A.Full editor access on all resources in the folder, including projects.
B.Editor access on the projects but not on resources within the projects.
C.The user must also be granted editor on each project separately.
D.Editor access on the folder resource only, not on projects.
AnswerA

Folder-level roles are inherited by projects and their resources.

Why this answer

In Google Cloud, IAM roles are inherited from parent resources to child resources. Granting the roles/editor role on a folder automatically applies that role to all projects and resources within the folder, provided there are no deny policies to override it. This means the user has full editor access on all resources in the folder, including the projects themselves and all resources within those projects.

Exam trap

Google Cloud often tests the misconception that IAM roles are not inherited across resource hierarchies, leading candidates to incorrectly believe that separate grants are needed for each project or that the role only applies to the folder itself.

How to eliminate wrong answers

Option B is wrong because editor access on a folder grants editor access not only on the projects but also on all resources within those projects, such as Compute Engine instances, Cloud Storage buckets, and BigQuery datasets. Option C is wrong because IAM roles are inherited from the folder to its child projects; the user does not need to be granted editor on each project separately. Option D is wrong because the roles/editor role on a folder is inherited by all projects and resources within the folder, not just the folder resource itself.

Full explanation →
225
Multi-Selecthard

Which three actions help protect Cloud KMS key material? (Choose three.)

Select 3 answers
A.Store the key in an HSM cluster.
B.Use VPC Service Controls to restrict access to the key.
C.Assign the Cloud KMS Admin role to all developers.
D.Enable automatic key rotation.
E.Enable Cloud Audit Logs for key operations.
AnswersB, D, E

VPC SC prevents data exfiltration and restricts access to the key.

Why this answer

B is correct because VPC Service Controls create a security perimeter around Cloud KMS resources, preventing data exfiltration by restricting access to the key material from unauthorized networks or projects. This helps protect the key material even if an attacker gains credentials to the key, as the request must originate from within the allowed VPC scope.

Exam trap

Google Cloud often tests the misconception that hardware security modules (HSMs) alone provide complete protection for key material, but the trap here is that HSMs secure key storage, not access control or perimeter security, which are addressed by VPC Service Controls and audit logging.

Full explanation →
Page 2

Page 3 of 13

Page 4

All pages

12345678910111213

Practice PCSE by domain

Target a specific domain to shore up weak areas.

Configuring Access Within a Cloud Solution EnvironmentEnsuring Data ProtectionManaging Operations in a Cloud Solution EnvironmentConfiguring Network SecuritySupporting Compliance Requirements
See all domains with question counts →