Google Professional Cloud Security Engineer (PCSE) — Questions 376–450

Cloud NAT allows instances without external IP addresses to initiate outbound connections to the internet, translating their private IPs to a single public IP or a range. This is a core benefit because it enables secure outbound internet access without exposing instances to inbound traffic.

The roles/iam.securityReviewer role at the organization level grants read-only access to all IAM policies and audit logs across all projects in the organization, without granting any write or management permissions. This allows the auditor to review IAM policy changes efficiently without needing per-project assignments.

Cloud KMS offers two protection levels: software and HSM. HSM protection level uses Cloud HSM, which is FIPS 140-2 Level 3 validated. Software keys are validated to Level 1.

VPC firewall rules are implicitly deny-all at the end of the evaluation order. By creating a single allow rule for SSH from the bastion host's IP, all other SSH traffic is implicitly denied by the default deny rule, without needing an explicit deny rule. This is the most efficient approach as it minimizes rule count and avoids potential priority conflicts.

A single slow query to a backend database can increase p99 latency without affecting request count. Other options would affect availability or count.

Customer-Supplied Encryption Keys (CSEK) allow you to provide your own encryption keys for Cloud Storage objects. Google discards the key after encryption/decryption, and you manage the key lifecycle.

IAM conditions involve identifying the scope, writing the condition, binding it, attaching the policy, and testing.

The shared responsibility model assigns physical security, hardware, and hypervisor security to Google; the customer is responsible for data encryption, IAM, network controls, and application security.

Cloud KMS symmetric encryption keys are used to encrypt data encryption keys (DEKs) that protect the column data. In field-level encryption, the application or database encrypts each column value using a DEK, which is then wrapped (encrypted) by a Cloud KMS key. This ensures the sensitive data is encrypted at the application layer, independent of the underlying storage encryption.

The condition in the IAM policy uses the `request.time` attribute with a date/time comparison operator, which is a supported variable in IAM conditions. The condition `StringEquals` with `request.time` and a specific date (e.g., `2025-12-31T23:59:59Z`) restricts access to only before that timestamp, effectively granting access only until December 31, 2025. This is a common pattern for time-based access control in cloud IAM policies.

Cloud SQL does not support enabling CMEK on an existing instance; you must create a new instance with CMEK enabled at provisioning time. Exporting data from the old instance and importing it into the new one ensures the database is re-encrypted under the customer-managed key with minimal downtime and no data loss, as the export/import process preserves the data.

Cloud Storage buckets support Object holds, which prevent object deletion or modification, ensuring immutability. A retention policy set to 7 years enforces the minimum retention period required by HIPAA. This combination meets compliance needs with minimal operational overhead, as it leverages native GCP features without requiring custom infrastructure or manual management.

Workload Identity for GKE allows you to bind a Kubernetes service account to a GCP service account. Pods running with that Kubernetes SA can then authenticate as the GCP SA to access GCP resources. This provides pod-level granularity.

The Cloud Console requires the 'resourcemanager.projects.get' permission to list and display projects. Even though the custom role grants permissions to manage Cloud Storage buckets, without this specific permission, the contractor cannot see the project in the console. Granting the permission at the project level allows the user to view the project in the console while still restricting access to other resources.

Removing public IP and enabling Secure Boot reduce exposure. vTPM and other options do not directly reduce attack surface.

VPC Flow Logs capture metadata about IP traffic going to and from network interfaces in a VPC, including source/destination IPs, ports, protocols, and packet/byte counts. This historical data is essential for post-incident network forensics, allowing you to trace the path of malicious traffic, identify compromised hosts, and reconstruct the timeline of an attack. Without flow logs, you would lack the granular traffic records needed for such analysis.

Cloud DLP synchronous inspection latency is directly proportional to the content size and the number of infoTypes scanned. By limiting the content item size (e.g., to 1 MB) and using stored infoTypes (which are pre-compiled for faster matching), you reduce the inspection time significantly, enabling de-identification within the 5-second window without compromising security.

The command 'gcloud auth activate-service-account' uses a service account key file to authenticate as that service account. If the key file is invalid (e.g., corrupted, expired, or malformed) or the service account itself has been deleted, authentication will fail, causing subsequent commands like 'gcloud compute instances list' to return a permission denied error even if the service account has the correct role. The error is not about missing permissions on the role, but about the inability to prove identity.

Disabling the service account immediately stops all access using any of its keys, including the compromised one, without deleting the account or its configuration. This is the fastest way to block the attacker while preserving the ability to investigate and re-enable the account later if needed. In Google Cloud, disabling a service account is a reversible action that revokes all authentication and authorization for that identity.

Correct matches: Google-managed encryption (A) is fully handled by Google; CMEK (B) lets you manage keys via Cloud KMS; CSEK (C) requires you to supply keys. Common confusions involve who manages the keys.

VPC Service Controls create a security perimeter around Google Cloud resources, allowing you to restrict data access based on attributes like IP address or geographic location. By configuring VPC Service Controls to block access from outside the EU, the organization can enforce that data stored and processed in Google Cloud remains within the European Union, directly supporting GDPR compliance for data residency.

The rule is configured to allow HTTP traffic, but if the rule direction is set to egress instead of ingress, it will not apply to incoming HTTP requests from the source IP range. In Google Cloud VPC firewall rules, direction determines whether the rule applies to inbound (ingress) or outbound (egress) traffic; an egress rule only controls traffic leaving the VPC network, so HTTP requests arriving from the internet would be denied by the implied deny ingress rule.

The most likely issue is that the Cloud Function is using the default App Engine service account instead of the custom service account that was granted the roles/storage.objectViewer role. When a Cloud Function is deployed without explicitly specifying a service account, it defaults to the App Engine default service account (project-id@appspot.gserviceaccount.com), which does not have the necessary permissions to read the file. The custom service account with the objectViewer role exists but is not assigned to the function, causing the permission denied error.

Even with correct IAM roles, the Cloud SQL API must be enabled for the project. The service account being attached is confirmed by the role assignment, private IP is not required for Client role, and using a proxy is optional but not the cause of permission denied.

Cloud DLP can inspect and de-identify data, including pseudonymisation (e.g., tokenization, masking). Dataflow can process streaming data and apply transformations using DLP templates. Together, they can pseudonymise data before loading into BigQuery.

FedRAMP Moderate requires multi-factor authentication (MFA) for all users accessing the system, including Google Cloud users. Enabling MFA for all users with access to the project satisfies this control by adding an additional authentication factor beyond a password, as mandated by NIST SP 800-53 IA-2. Option C is correct because FedRAMP Moderate requires encryption at rest for all data, and using Customer-Managed Encryption Keys (CMEK) or Google-managed keys meets this requirement under NIST SP 800-53 SC-28.

VPC firewall rules are stateful, so allowing egress for specific destinations (e.g., package repositories) automatically allows return traffic. Deny rules should be used to block all other egress. The correct approach is an egress allow rule for the specific destinations and a lower-priority egress deny rule for all other traffic.

Custom IAM roles allow you to curate a specific set of permissions tailored to your needs. Predefined roles like roles/compute.instanceAdmin include broader permissions that may not be desired. Basic roles (Owner, Editor, Viewer) are too broad and should be avoided in production.

VPC Service Controls access levels can define IP-based conditions. By creating an ingress rule that allows traffic from the specified IP address to access the BigQuery API, the external application can be authorized.

To access a secret version's payload (the actual secret value), the permission 'secretmanager.versions.access' is required. The role 'roles/secretmanager.secretAccessor' includes this permission. The other permissions are for listing or managing metadata.

The organization policy constraint constraints/compute.requireShieldedVm enforces that all new VMs must have Shielded VM enabled. It is a built-in constraint available in the Organization Policy service.

Cloud Identity supports OIDC federation, allowing users to authenticate with an external OIDC IdP and access GCP.

To serve HTTPS traffic with Cloud CDN and a custom domain, the load balancer must have an SSL certificate attached to its HTTPS target proxy. This is because Cloud CDN relies on the load balancer's target proxy to terminate TLS and present the certificate to clients. Creating an SSL certificate resource (either Google-managed or self-managed) and attaching it to the HTTPS target proxy is the required step.

VPC Service Controls allows ingress rules to permit traffic from specific identities or IP ranges into the perimeter. They need to create an ingress rule that allows the on-premises IP to access BigQuery.

SAML 2.0 federation requires a SAML Identity Provider (AD FS or similar) to authenticate users, Cloud Identity or Google Workspace as the identity platform to configure the SAML trust, and Cloud Directory Sync to synchronize users from AD to Google Cloud Directory so that users exist in Google's directory for IAM binding.

BigQuery column-level encryption with CMEK ensures data is encrypted at rest using customer-managed keys, while Authorized Views provide row- and column-level access control without exposing the underlying encrypted columns to unauthorized users. This combination satisfies both encryption requirements (at rest and in transit, as BigQuery enforces TLS in transit) and fine-grained access control for specific columns.

VPC Service Controls can allow traffic from a specific VPC network via private Google access, which uses RFC 1918 addresses and does not traverse the public internet. This restricts data exfiltration by ensuring that only resources within the defined VPC can access the protected services, while still allowing legitimate Compute Engine instances to reach Cloud Storage and BigQuery within the perimeter.

The iam.serviceAccounts.actAs permission on the target service account allows a principal to impersonate that service account. This permission is included in the Service Account User role (roles/iam.serviceAccountUser). The developer needs to grant that role to the source service account (or user) on the target service account.

Establishing a two-way trust between Managed Microsoft AD and the on-premises AD domain allows users to authenticate to Compute Engine Windows instances using their existing on-premises credentials without any additional user setup. This trust enables Kerberos authentication to flow seamlessly across the two domains, ensuring that on-premises users can access cloud resources securely and scalably without duplicating identities or credentials.

Chronicle uses YARA-L rules to detect patterns across different log sources. UDM normalizes logs into a common schema. The rule can reference events from multiple log types (e.g., authentication logs and network logs) and define temporal relationships.

The IAM policy bindings grant `roles/storage.objectViewer` to user `alice@example.com` and to all authenticated users from the `example.com` domain (via `domain:example.com`), and `roles/storage.objectAdmin` to a service account. The viewer role allows listing and reading objects, while the admin role allows full control over objects, including creation, deletion, and modification. There is no public access granted because the bindings do not include `allUsers` or `allAuthenticatedUsers`.

IAM manages identities and permissions, VPC Service Controls prevent data exfiltration, and Organization Policies set configuration constraints. Distractors confuse these definitions with each other or with Access Context Manager.

HSM keys in Cloud KMS are generated and stored within a FIPS 140-2 Level 3 certified hardware security module (HSM) that is physically and logically controlled by Google. The key material never leaves the HSM boundary; all cryptographic operations are performed inside the HSM, and export of the key material is prevented by design. This satisfies the requirement that key material is never exported from the KMS service.

Enabling data access audit logs for Compute Engine captures the request payloads of API calls, including the instance creation request. This allows the compliance officer to inspect the exact parameters sent, such as any sensitive data that might have been passed as metadata or startup scripts, which are not included in the default admin activity audit logs. Data access audit logs provide the granularity needed to determine if sensitive data was exposed during the operation.

To automatically de-identify sensitive data in Cloud Storage using Cloud DLP, you must create three resources: a Cloud DLP job trigger (C) to initiate the scan when new objects are uploaded, a Cloud DLP de-identification template (E) that specifies the transformation (e.g., removing credit card numbers), and a Cloud DLP job (B) that references both the trigger and the de-identification template. The inspection template (A) is not required because the job can directly specify the infoTypes to inspect in its configuration.

Right of access and privacy by design are explicit GDPR requirements. Other options are either too prescriptive or incorrect.

Admin Activity logs record all API calls that modify configuration or metadata. They are enabled by default and cannot be disabled. Data Access logs are opt-in, System Event logs are enabled by default but cannot be disabled either, and Policy Denied logs are generated when access is denied by IAM policies.

Workload Identity for GKE allows you to bind a Kubernetes service account (KSA) to a Google service account (GSA). The KSA can then impersonate the GSA when accessing Google Cloud APIs, eliminating the need for service account keys.

SSL policies on the target HTTPS proxy allow setting minimum TLS version and cipher profile. Set the minimum TLS version to 1.2 and choose the MODERN or RESTRICTED profile to disable weak ciphers.

A policy-based route in the host project can match traffic based on source and destination subnets from different service projects and force that traffic to be forwarded to the next-hop IP of the third-party firewall appliance. This ensures all inter-service-project traffic is inspected by the firewall, as the route overrides the default VPC routing behavior within the Shared VPC environment.

BigQuery Data Policy with data masking rules allows you to define column-level masking policies that automatically redact sensitive data (e.g., SSN, email) in query results based on the user's role, without altering the underlying table. This meets the requirement for consistent masking across all queries without modifying the source data.

Log Sinks can route logs to Cloud Storage Buckets, which support retention policies. Object Retention Lock can enforce WORM compliance if required.

Assured Workloads provides compliance controls for ITAR (among others) and can enforce data residency within the US. Cloud HSM provides FIPS 140-2 Level 3 validated HSM for encryption keys. Together they satisfy both requirements.

Cloud EKM allows you to manage encryption keys using a supported external key management partner, ensuring keys are stored outside Google Cloud. This meets the requirement for encryption at rest and in transit (Dataflow and Cloud Storage use these keys transparently) while keeping key material external to Google's infrastructure. Only authorized users can access raw data via IAM and the external key manager's access controls.

The default VPC firewall rules include an egress rule that allows all outbound traffic (target: all instances, action: allow, protocol: all, destination: 0.0.0.0/0). Removing this default egress rule and replacing it with more restrictive outbound rules is a security best practice to prevent unauthorized data exfiltration and limit outbound connections to only necessary destinations. This aligns with the principle of least privilege for network traffic.

Cloud DLP job triggers can be configured to scan Cloud Storage buckets on a schedule or event-driven (e.g., via Cloud Storage Pub/Sub notifications). The trigger will inspect objects for sensitive data and log results. This meets the requirement for automatic scanning.

VPC firewall rules consist of components like Source IP (traffic origin), Destination IP (traffic target), Action (allow/deny), and Priority (evaluation order). Common confusions include swapping Source and Destination, or confusing Action with Priority.

The constraint 'constraints/iam.disableServiceAccountKeyCreation' prevents key creation. 'constraints/iam.allowedPolicyMemberDomains' restricts IAM members to specified domains. Both can be applied at the project level.