Courseiva

Google Professional Cloud Security Engineer (PCSE) — Questions 601675

960 questions total · 13pages · All types, answers revealed

Page 8

Page 9 of 13

Page 10
601
MCQmedium

Refer to the exhibit. A security engineer runs the gcloud command to analyze IAM policy for a user in an organization. The output shows that the user has the 'compute.instances.create' permission via a role at the organization level. However, the user is unable to create Compute Engine instances in a specific project. What is the most likely cause?

A.The user does not have the 'compute.instances.create' permission at the project level.
B.The user has the permission but through a different role than expected.
C.An organization policy constraint is denying the creation of Compute Engine instances.
D.The user's role is not granted at the project level.
AnswerC

Organization policies can deny actions even if IAM allows them.

Why this answer

Organization policy constraints in Google Cloud can override IAM permissions at any level. Even if the user has the 'compute.instances.create' permission via an organization-level role, an organization policy constraint (e.g., constraints/compute.vmExternalIpAccess or constraints/compute.restrictCreateVM) can explicitly deny the creation of Compute Engine instances in a specific project. This is a common scenario where IAM allows the action, but organization policy blocks it.

Exam trap

Google Cloud often tests the distinction between IAM permissions and organization policy constraints, trapping candidates who assume that having the correct IAM permission at any level is sufficient to perform an action, without considering that organization policies can override IAM.

How to eliminate wrong answers

Option A is wrong because the user has the permission at the organization level, which is inherited by all projects in the organization, so the permission is effectively present at the project level. Option B is wrong because the role through which the permission is granted is irrelevant; IAM evaluates permissions based on the permission itself, not the role name. Option D is wrong because the role is granted at the organization level, and organization-level roles are inherited by all projects, so the role is effectively granted at the project level.

602
MCQmedium

A healthcare organization is migrating to Google Cloud and needs to store Protected Health Information (PHI) in Cloud Storage. They have signed a Business Associate Agreement (BAA) with Google. Which additional step is REQUIRED to ensure HIPAA compliance for the data stored?

A.Use Customer-Managed Encryption Keys (CMEK) for the bucket.
B.Configure the bucket to be in a VPC with no public access.
C.Enable Object Versioning on the bucket.
D.No additional action is required; Cloud Storage is HIPAA-eligible and encrypts data at rest by default.
AnswerD

Cloud Storage is a HIPAA-eligible service. With a BAA in place and default encryption at rest, no further steps are strictly required for storage.

Why this answer

HIPAA requires encryption of PHI at rest. Cloud Storage automatically encrypts data at rest using Google-managed keys. Customers can optionally use CMEK, but CMEK is not required.

Enabling Object Versioning is not a HIPAA requirement. Configuring a VPC is a network control, not a specific HIPAA requirement for storage.

603
MCQmedium

A company uses Cloud Armor Managed Protection Plus to protect their applications. They want to automatically block IP addresses that are identified as malicious by adaptive protection. How should they configure this?

A.Manually review adaptive protection alerts and create deny rules.
B.Use the 'rate limiting' rule to block high-traffic IPs.
C.Set up a Cloud Function to parse logs and create rules via API.
D.Enable 'auto-deploy' in the adaptive protection configuration.
AnswerD

Correct: Adaptive protection has an auto-deploy option that automatically creates deny rules for identified malicious IPs.

Why this answer

Cloud Armor adaptive protection uses machine learning to detect DDoS attacks. It can automatically create deny rules for malicious IPs if configured to do so. The setting is in the security policy's adaptive protection configuration.

604
MCQhard

An organization uses VPC Service Controls with a service perimeter that includes Cloud Storage and BigQuery. They need to allow a specific on-premises service account to write data to a Cloud Storage bucket inside the perimeter. The on-premises network connects via Cloud VPN. What must be configured in the perimeter?

A.An ingress rule that specifies the on-premises service account and the Cloud VPN network as sources
B.A VPC firewall rule allowing traffic from the VPN to the Cloud Storage bucket
C.An egress rule that allows the service account to exit the perimeter
D.An access level that includes the on-premises IP range
AnswerA

Ingress rules allow external identities and networks to access resources inside the perimeter.

Why this answer

To allow an on-premises service account to access resources inside a service perimeter, you need an ingress rule that specifies the source (the on-premises identities and network) and the target resources (the Cloud Storage bucket). The source must include both the identity (service account) and the network (VPC or IP range).

605
MCQhard

During an incident response, a security engineer needs to analyze a Pub/Sub message that was produced by a Cloud Function triggered by a SCC finding. The message has been acknowledged and deleted from the subscription. How can the engineer retrieve the message again?

A.Submit a support ticket to Google to recover the message from internal storage.
B.Check the Cloud Function logs to view the message payload.
C.Create a new subscription to the same topic and enable 'retain_acked_messages' before the message was published.
D.Use the 'gcloud pubsub subscriptions seek' command with a snapshot or timestamp to replay the message.
AnswerD

Seek allows replaying messages from a specific point, including acked messages if a snapshot was taken or retention is enabled.

Why this answer

Pub/Sub supports message replay by seeking a snapshot or a timestamp. This allows reprocessing messages that have been acknowledged. There is no 'dead-letter queue' for this scenario.

Cloud Logging logs the message payload if configured, but not by default.

606
MCQhard

An organization uses VPC Service Controls in dry-run mode for a project containing Google Cloud Storage. They notice that BigQuery jobs are being logged as violations. How should they interpret this?

A.The perimeters are logging potential violations; no action has been taken yet.
B.The dry-run mode is not supported for Cloud Storage projects.
C.The perimeters are not configured correctly because BigQuery should not be affected.
D.The perimeters are working correctly and BigQuery access is blocked.
AnswerA

Dry-run logs violations without enforcement.

Why this answer

In dry-run mode, VPC Service Controls logs violations without enforcement, allowing administrators to review and adjust perimeters before enabling enforcement.

607
MCQmedium

A financial institution must store audit logs for 7 years to comply with PCI DSS requirements. By default, Cloud Audit Logs are retained for 30 days. What is the most cost-effective way to retain audit logs for 7 years?

A.Use Assured Workloads to automatically extend audit log retention to 7 years.
B.Create a log bucket with a retention period of 7 years using Log Analytics.
C.Configure a log sink to export logs to Cloud Storage with a retention policy set to 7 years using Object Lifecycle Management.
D.Increase the retention period for Cloud Audit Logs in the Logs Router to 7 years.
AnswerC

Exporting logs to Cloud Storage and setting a retention policy via lifecycle management is cost-effective and meets retention requirements.

Why this answer

To retain audit logs beyond Cloud Logging's 365-day max, export to Cloud Storage using a log sink and use Object Lifecycle Management to set a retention policy.

608
MCQhard

A company runs a batch job on Compute Engine that processes sensitive data. The job uses a service account with a JSON key file stored on the VM. A security audit recommends removing long-lived keys. The job must run unattended. What is the best alternative?

A.Store the service account key in Secret Manager and retrieve it at runtime.
B.Create a new service account and attach it to the VM instance; remove the old key.
C.Use the default compute engine service account instead.
D.Use Workload Identity Federation to authenticate the batch job.
AnswerB

Attached service accounts use short-lived tokens from the metadata server, no keys needed.

Why this answer

Using a service account attached to the VM instance is the best practice. Compute Engine automatically obtains short-lived tokens from the metadata server, eliminating the need for keys. Workload Identity Federation is for external workloads.

Secret Manager still requires a key to access. Default compute service account is less secure than a custom one.

609
MCQeasy

Users are reporting 502 Bad Gateway errors when accessing an application behind an external HTTPS Load Balancer. What is the most likely cause?

A.The backend instances are unhealthy or the SSL certificate is invalid
B.Cloud CDN is not enabled for the load balancer
C.The backend instances have reached maximum concurrent connections
D.The load balancer is configured as an internal load balancer
AnswerA

A 502 error indicates a communication failure between the load balancer and backend, often due to health check failures or SSL misconfiguration.

Why this answer

502 errors typically indicate that the load balancer cannot communicate with the backend, often due to unhealthy instances or SSL certificate issues. Option B is wrong because CDN affects content delivery, not backend connectivity. Option C is wrong because connection limits cause 503 or 429 errors, not 502.

Option D is wrong because internal load balancers would not serve HTTPS externally.

610
MCQeasy

A security team wants to detect and block network-based threats such as malware and command-and-control traffic within their VPC. They need a managed service that provides deep packet inspection. Which Google Cloud service should they use?

A.Cloud IDS
B.Security Command Center
C.VPC Flow Logs
D.Cloud Armor
AnswerA

Correct: Cloud IDS provides managed network threat detection and can block threats.

Why this answer

Cloud IDS (Intrusion Detection System) is a managed service that uses Palo Alto Networks threat detection to inspect network traffic for threats. It integrates with packet mirroring to analyze traffic.

611
MCQmedium

A company uses Cloud KMS with automatic rotation enabled for a symmetric key. The rotation period is set to 90 days. After 90 days, a new key version is created. The compliance team asks: what happens to data encrypted with the old key version?

A.The old key version remains available for decryption of existing data.
B.The old key version is immediately disabled, and all data must be re-encrypted.
C.Data encrypted with the old key is automatically re-encrypted with the new key.
D.The old key version is deleted after the rotation period.
AnswerA

Old key versions are retained and can decrypt data encrypted with them.

Why this answer

When a key is rotated, a new version is created. Data encrypted with the old version can still be decrypted because the old version remains available for decryption. The key material is not destroyed unless manually deleted.

Automatic rotation does not re-encrypt existing data.

612
MCQmedium

A security engineer receives an alert from Cloud Security Command Center (Cloud SCC) about a resource that is publicly accessible. The engineer identifies that the resource is a Cloud Storage bucket containing sensitive data. After making the bucket private, what is the next best step to prevent recurrence?

A.Add a note in the operations runbook to check bucket permissions weekly.
B.Delete the bucket and all its contents to avoid future exposure.
C.Set an organization policy to disable public access to all Cloud Storage buckets.
D.Create a Cloud Security Command Center notification for public bucket findings and use a Cloud Function to automatically disable public access.
AnswerD

Automated response reduces recurrence risk.

Why this answer

It automates the prevention of future public exposure by using Cloud SCC notifications to trigger a Cloud Function that disables public access. Option A is incorrect because manual checks are not preventive and rely on human action. Option B is incorrect because deleting the bucket causes data loss and does not address the root cause.

Option C is incorrect because an organization policy disallowing public access may be too restrictive for legitimate use cases, and it does not provide automated remediation for existing buckets.

613
MCQeasy

Which Google Cloud service provides the ability to enforce data retention policies on Cloud Storage objects to prevent deletion or modification for a specified duration?

A.Cloud Storage Bucket Lock
B.VPC Service Controls
C.Cloud Storage Object Retention Lock
D.Cloud Storage Object Lifecycle Management
AnswerC

Object Retention Lock enforces a WORM (Write Once Read Many) policy, preventing deletion or modification.

Why this answer

Object Retention Lock uses retention policies and legal holds to comply with WORM requirements.

614
MCQhard

Refer to the exhibit. A security engineer reviews this IAM policy. Which compliance requirement does this policy help satisfy?

A.Key rotation schedule for encryption keys
B.Data residency by limiting access to European regions
C.Audit logging of data access
D.Encryption of data at rest
AnswerB

By restricting access to resources in europe-west, the policy supports data residency compliance.

Why this answer

The IAM policy includes a `Condition` block using `resource.location` to explicitly deny access to any Google Cloud region outside of the specified European regions (europe-west1, europe-west4, etc.). This enforces data residency by ensuring that API calls that would create or modify resources are restricted to approved geographic boundaries, helping satisfy compliance requirements such as GDPR or local data sovereignty laws.

Exam trap

Google Cloud often tests the distinction between IAM policies that control access (like region restriction) versus resource-level configurations (like encryption or logging), leading candidates to confuse a condition-based access control policy with a data protection mechanism.

How to eliminate wrong answers

Option A is wrong because key rotation schedules are managed through AWS KMS key policies or automated rotation settings, not through IAM policies that control API access based on region. Option C is wrong because audit logging of data access is enabled by services like AWS CloudTrail or Amazon S3 server access logs, not by an IAM policy that restricts regional access. Option D is wrong because encryption of data at rest is enforced through encryption settings on the resource itself (e.g., S3 SSE, EBS encryption) or via KMS key policies, not by an IAM policy that limits the regions where API calls can be made.

615
MCQhard

A company uses SAML 2.0 federation with an external IdP. Users are synced from Active Directory to Cloud Identity using Google Cloud Directory Sync (GCDS). The security engineer needs to ensure that only users from a specific Active Directory group can access Google Cloud resources. What should be configured?

A.Configure the SAML IdP to include a custom attribute indicating group membership, and use attribute-based access control in Google Cloud.
B.Use IAP to restrict access based on user identity.
C.Configure an organization policy constraint (constraints/iam.allowedPolicyMemberDomains) to restrict IAM policies to the company's domain.
D.Create a Cloud Identity group that is synced with the AD group via GCDS, and assign IAM roles to that group.
AnswerD

This ensures only users in the AD group are members of the Cloud Identity group, and thus have access.

Why this answer

The correct approach is to configure the IdP to only send SAML assertions for users in that specific AD group, and then in Cloud Identity, map that group to a Cloud Identity group or use attribute-based access. Alternatively, use organization policies with constraints/iam.allowedPolicyMemberDomains to restrict members to specific domains. But the question is about user access, not policy binding.

The best answer is to create a Cloud Identity group that syncs with the AD group, and grant IAM roles to that group. This ensures only members of the AD group get access.

616
MCQmedium

A security team wants to scan a web application hosted on Compute Engine for vulnerabilities like XSS and outdated libraries. They want the scan to be authenticated to cover areas behind login. Which Google Cloud service and configuration should they use?

A.VM Manager patch management to check for outdated libraries.
B.Cloud Security Scanner with a custom scan configuration including authentication headers.
C.Container Analysis with a custom scanning schedule.
D.Web Security Scanner with a managed scan and custom login credentials.
AnswerD

Web Security Scanner supports authenticated scanning.

Why this answer

Web Security Scanner can perform authenticated scans by providing login credentials. It can scan applications on Compute Engine and App Engine. It identifies vulnerabilities like XSS, mixed content, and outdated libraries.

617
Multi-Selecthard

Which THREE steps are necessary to ensure that a Google Cloud project complies with FedRAMP Moderate baseline requirements for access control? (Choose three.)

Select 3 answers
A.Set up session expiration policies that automatically log out inactive users after 15 minutes.
B.Configure Cloud NAT to allow instances to access the internet without public IPs.
C.Enforce multi-factor authentication (MFA) for all users accessing the Google Cloud Console.
D.Create custom IAM roles that grant only the minimum permissions required for each job function.
E.Implement VPC Service Controls to prevent data exfiltration.
AnswersA, C, D

Session timeouts are required for access control.

Why this answer

FedRAMP Moderate requires session timeout policies to mitigate the risk of unauthorized access from unattended sessions. Google Cloud IAM session settings allow you to enforce a maximum session duration, and setting it to 15 minutes aligns with the FedRAMP requirement for automatic logout of inactive users. This directly addresses the access control family (AC-12) in the FedRAMP baseline.

Exam trap

Google Cloud often tests the distinction between access control (user authentication, session management, least privilege) and network security controls (NAT, VPC perimeters), leading candidates to incorrectly select options that address data exfiltration or internet access rather than direct access control requirements.

618
Multi-Selectmedium

A company is deploying a multi-region application that must store data only within the European Union to comply with GDPR data residency requirements. They also need to ensure that Google Cloud administrators cannot access customer content. Which two controls should they implement? (Choose TWO).

Select 2 answers
A.Use VPC Service Controls.
B.Apply the organization policy constraint gcp.resourceLocations with the allowed regions set to europe-west1, europe-west2, etc.
C.Enable Access Transparency.
D.Configure Cloud DLP inspection jobs to scan for GDPR-sensitive data.
E.Enable Assured Workloads with EU regions boundary.
AnswersB, C

This policy ensures resources are only created in specified EU regions.

Why this answer

To enforce data residency, the organization policy constraint gcp.resourceLocations restricts resource creation to specific regions. For EU data residency, they would list EU regions. Access Transparency provides logs of Google admin access to customer content, allowing the customer to monitor and audit such access.

Assured Workloads is for compliance frameworks like FedRAMP, not specifically for data residency. Cloud DLP is for data loss prevention, not residency. VPC Service Controls is for data exfiltration prevention, not residency.

619
MCQhard

A security engineer reviews the IAM policy for a Cloud Storage bucket as shown in the exhibit. Alice reports that she cannot upload objects to the bucket, while Bob can view objects. What is the most likely issue?

A.The bucket has ACLs that deny Alice upload access.
B.Alice has the objectViewer role but not the objectAdmin role.
C.Alice does not have the storage.buckets.getIamPolicy permission.
D.The objectAdmin role does not include the storage.objects.create permission.
AnswerA

If uniform bucket-level access is not enabled, ACLs can override IAM.

Why this answer

Cloud Storage buckets can have both IAM policies and Access Control Lists (ACLs) applied. If the bucket's ACL explicitly denies Alice the `WRITER` or `OWNER` permission, she will be unable to upload objects even if her IAM policy grants broader roles. Bob can view objects because his IAM role (e.g., `roles/storage.objectViewer`) is not overridden by a conflicting ACL, or his ACL entry grants `READER` access.

Exam trap

Google Cloud often tests the misconception that IAM policies alone control all access to Cloud Storage, ignoring that ACLs can override or deny permissions, leading candidates to incorrectly blame missing roles or permissions rather than a conflicting ACL.

How to eliminate wrong answers

Option B is wrong because the `objectViewer` role only allows reading objects, not uploading; however, the question states Alice cannot upload, so the issue is not about missing `objectAdmin` but a specific denial. Option C is wrong because `storage.buckets.getIamPolicy` is used to view the bucket's IAM policy, not to upload objects; lacking this permission would not prevent uploading. Option D is wrong because the `objectAdmin` role (`roles/storage.objectAdmin`) does include `storage.objects.create`, which is required for uploading; this option misrepresents the role's permissions.

620
Multi-Selecthard

A gaming company deploys a multiplayer game backend on Google Kubernetes Engine (GKE) with multiple microservices. The operations team needs to collect structured logs from containers, analyze them in real-time for anomalies, and store them for 30 days for compliance. They also need to monitor custom application metrics (e.g., player count per game server). Which three Google Cloud services should they use? (Choose three.)

Select 3 answers
A.Cloud Logging to collect container logs and store them for 30 days using a log bucket retention policy
B.Chronicle to ingest logs from Cloud Logging and apply anomaly detection rules
C.BigQuery to store logs for 30 days and run real-time queries
D.Cloud SQL to store application metrics
E.Cloud Monitoring to collect custom metrics via the Monitoring API and set up dashboards
AnswersA, B, E

Cloud Logging is the native log management service for GCP, supporting custom retention.

Why this answer

Cloud Logging collects and stores logs, Cloud Monitoring collects metrics and supports custom metrics, and Chronicle can analyze logs for anomalies in real-time. BigQuery is for long-term analysis but not real-time anomaly detection.

621
MCQeasy

Which Cloud KMS key purpose should be used to encrypt and decrypt data directly?

A.ASYMMETRIC_DECRYPT
B.ASYMMETRIC_SIGN
C.ENCRYPT_DECRYPT
D.MAC
AnswerC

This purpose enables symmetric encryption and decryption operations.

Why this answer

The ENCRYPT_DECRYPT purpose is for symmetric encryption/decryption. ASYMMETRIC_SIGN is for digital signing, ASYMMETRIC_DECRYPT is for asymmetric decryption (e.g., using RSA), and MAC is for message authentication codes.

622
Multi-Selectmedium

Which TWO configurations are required to use Customer-Managed Encryption Keys (CMEK) with Cloud Storage to meet a compliance requirement that keys must be rotated every 30 days? (Choose two.)

Select 2 answers
A.Set a key destruction policy to prevent accidental deletion of the key.
B.Use Cloud External Key Manager (EKM) to manage the key externally.
C.Create a Cloud KMS key ring and key with a rotation period of 30 days.
D.Use a Cloud HSM key with protection level HSM to meet key storage requirements.
E.Grant the Cloud Storage service account the Cloud KMS CryptoKey Encrypter/Decrypter role on the key.
AnswersC, E

The key must have a rotation schedule to meet the requirement.

Why this answer

Cloud KMS allows you to set a rotation period on a key, and when you use a CMEK with Cloud Storage, the key is used to encrypt the data encryption keys (DEKs). Setting a rotation period of 30 days ensures that the key material is automatically rotated every 30 days, meeting the compliance requirement. Option E is correct because the Cloud Storage service account must be granted the Cloud KMS CryptoKey Encrypter/Decrypter role to be authorized to use the CMEK for encrypting and decrypting objects.

Exam trap

Google Cloud often tests the distinction between key rotation (a lifecycle policy) and key protection (HSM or destruction policies), so candidates mistakenly select options that address security or deletion prevention instead of the rotation requirement.

623
MCQmedium

A company uses hierarchical firewall policies at the organization level to enforce a baseline deny-all rule. A project administrator wants to create a firewall rule that allows HTTP traffic to a specific VM. Which statement is correct?

A.The project administrator can modify the hierarchical policy to allow HTTP.
B.The project administrator can create a VPC firewall rule to allow HTTP, and it will work if the policy is not enforced.
C.The project administrator cannot allow HTTP because the hierarchical policy denies all traffic.
D.The project administrator can create a VPC firewall rule with higher priority to override the policy.
AnswerC

Hierarchical policies are mandatory and override lower-level rules.

Why this answer

Hierarchical firewall policies are inherited and cannot be overridden by lower-level rules. The deny-all rule from the policy takes precedence over any VPC firewall rule that would allow traffic.

624
MCQhard

A multinational corporation is implementing a least-privilege access model for their CI/CD pipeline using Cloud Build, Artifact Registry, and GKE. The pipeline builds container images, pushes them to Artifact Registry, and deploys them to GKE clusters. The security team wants to ensure that the Cloud Build service account used by the pipeline has only the minimum necessary permissions. The service account currently has: roles/cloudbuild.builds.editor, roles/artifactregistry.writer, and roles/container.developer. After a successful build and push, the deployment step completes without errors, but the newly deployed pods on GKE immediately fail with ImagePullBackOff errors. The error message indicates: "Failed to pull image 'us-central1-docker.pkg.dev/my-project/my-repo/my-image:latest': rpc error: code = PermissionDenied desc = unauthenticated: Request had insufficient authentication scopes." The GKE cluster is a private cluster with Workload Identity enabled. The node pool uses a default Compute Engine service account with only the storage scope. What is the most likely missing permission or configuration that prevents the pods from pulling images?

A.The service account needs roles/artifactregistry.reader on the repository.
B.The service account needs roles/storage.objectViewer on the bucket where images are cached.
C.The service account needs roles/container.clusterAdmin on the cluster.
D.The service account needs roles/iam.serviceAccountUser on the GKE node service account.
AnswerA

Correct. The node's service account lacks Artifact Registry read permissions. Granting `roles/artifactregistry.reader` on the repository allows the node to authenticate when pulling images, resolving the error.

Why this answer

The ImagePullBackOff error occurs because the GKE node's default Compute Engine service account lacks the necessary authentication scopes and IAM permissions to pull images from Artifact Registry. The node pool uses a service account with only the storage scope, meaning it cannot authenticate to Artifact Registry. Although Workload Identity is enabled, it is not properly configured for the pods; the pods are falling back to the node's service account.

To resolve this, the node's service account must be granted `roles/artifactregistry.reader` on the Artifact Registry repository. Alternatively, Workload Identity can be used to bind the pod's Kubernetes service account to a dedicated Google service account with that role. The missing permission is `roles/artifactregistry.reader` on the repository for the node's service account.

Exam trap

Candidates often think the issue is with the Cloud Build service account's permissions, but the error occurs at pod runtime when the node tries to pull the image. The node's service account needs the Artifact Registry reader role, not the Cloud Build service account. Additionally, Workload Identity is a red herring here because it's enabled but not leveraged; the pod inherits the node's identity.

How to eliminate wrong answers

Option A is wrong because the Cloud Build service account already has `roles/artifactregistry.writer`, which includes read permissions; the issue is not about the Cloud Build service account's permissions but about the node's service account lacking Artifact Registry read access. Option B is wrong because Artifact Registry does not use Cloud Storage buckets for image caching; images are stored directly in the registry, and the error is about authentication scopes, not storage permissions. Option C is wrong because `roles/container.clusterAdmin` grants cluster management permissions, not the ability to pull images from Artifact Registry; the error occurs at the pod level, not during deployment.

625
MCQeasy

Which Cloud Armor feature uses machine learning to detect and mitigate DDoS attacks?

A.Preconfigured WAF rules
B.Rate limiting
C.Adaptive Protection
D.Custom rules
AnswerC

Adaptive Protection uses ML to detect anomalies.

Why this answer

Cloud Armor Adaptive Protection uses ML-based DDoS detection to automatically learn normal traffic patterns and alert or mitigate attacks.

626
Matchingmedium

Match each Google Cloud security tool to its primary purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

DDoS protection and WAF

Centralized security and risk management

Intrusion detection for network traffic

Logs of Google staff access to customer data

Data exfiltration prevention via service perimeters

Why these pairings

Cloud IAM controls access, Security Command Center detects threats, and Cloud DLP protects sensitive data. Confusions often arise between these tools due to overlapping security contexts.

627
Multi-Selectmedium

A company wants to deploy a containerized application on GKE that needs to access Cloud SQL. They want to avoid storing database credentials in the application. Which THREE components should they use?

Select 3 answers
A.Cloud SQL Auth Proxy (sidecar container)
B.Cloud SQL private IP
C.Workload Identity
D.Service account key stored in a Kubernetes secret
E.IAM database authentication
AnswersA, C, E

Handles TLS and IAM authentication to Cloud SQL.

Why this answer

Workload Identity binds a Kubernetes service account to a GCP service account. The Cloud SQL Auth Proxy provides secure access to Cloud SQL using IAM database authentication. IAM database authentication allows the service account to authenticate to Cloud SQL without passwords.

628
MCQmedium

A company wants to allow their employees to access an internal web application running on Compute Engine using Identity-Aware Proxy (IAP). They want to ensure that only users from their corporate domain (example.com) can access the app. What is the recommended approach?

A.Grant the IAP-secured Web App User role to each individual user from the corporate domain.
B.Create a Cloud Identity group containing all corporate users, and grant the IAP-secured Web App User role to that group.
C.Use a custom SAML attribute in the IdP to filter access.
D.Configure a firewall rule that allows traffic only from the corporate IP range.
AnswerB

Scalable and maintainable approach.

Why this answer

Identity-Aware Proxy (IAP) uses Cloud Identity groups to manage access at scale. By creating a group containing all corporate users (e.g., from example.com) and granting the IAP-secured Web App User role to that group, you enforce domain-level access without managing individual users. This approach leverages IAP's integration with Cloud Identity to verify the user's email domain against the group membership, ensuring only example.com users can reach the application.

Exam trap

A common misconception is that IP-based firewall rules (Option D) are sufficient for access control, but the trap here is that IAP is specifically designed to replace network-level controls with identity-based access, making IP filtering an outdated and insecure approach in this context.

How to eliminate wrong answers

Option A is wrong because granting the IAP-secured Web App User role to each individual user is not scalable and violates the principle of least privilege management; it also does not inherently restrict to the corporate domain unless each user is manually verified. Option C is wrong because custom SAML attributes in the IdP are used for attribute-based access control (ABAC) but are not the recommended approach for domain-level filtering with IAP; IAP relies on Cloud Identity groups or OAuth scopes, not SAML attributes, to enforce domain restrictions. Option D is wrong because configuring a firewall rule based on corporate IP ranges bypasses IAP's identity-aware access control, exposing the application to network-level risks and failing to authenticate individual users; IAP is designed to replace IP-based restrictions with user identity verification.

629
MCQhard

An organization has a deny policy that denies the compute.instances.create permission for all principals on a folder. A user is granted the Compute Admin role (which includes compute.instances.create) at the project level within that folder. Can the user create Compute Engine instances in that project?

A.No, because deny policies take precedence over allow policies.
B.No, because the user is not an organization administrator.
C.Yes, if the user also has the Owner role at the project level.
D.Yes, because the project-level IAM grant overrides the folder-level deny.
AnswerA

Deny policies are evaluated after allow policies and take precedence.

Why this answer

Deny policies override allow policies regardless of hierarchy. If a deny policy denies the permission, it cannot be granted by any allow policy. The user will be denied even though they have the role.

630
MCQeasy

A small company has a single VPC with subnets in us-central1 (10.0.1.0/24) and us-west1 (10.0.2.0/24). They have a Compute Engine VM (web-server) in us-central1 that needs to connect to a Cloud SQL MySQL instance also in us-central1 using its private IP address 10.0.1.3. The Cloud SQL instance is configured with private IP only and is deployed in the same VPC. The web-server can successfully ping the Cloud SQL private IP (10.0.1.3). However, the application on the web-server fails to connect to the MySQL database with an authentication error. There are no custom firewall rules; only the default VPC firewall rules are in place. What is the most likely cause of the connection failure?

A.The default-allow-internal firewall rule does not allow TCP port 3306.
B.The web-server's service account lacks the Cloud SQL Client IAM role.
C.The Cloud SQL instance does not have the public IP address enabled.
D.The Cloud SQL instance is in a different region than the web-server.
AnswerB

This role is necessary to authenticate to Cloud SQL; without it, the application fails with a permission error.

Why this answer

The web-server can ping the Cloud SQL private IP (10.0.1.3), confirming network connectivity at Layer 3. The authentication error indicates the application is reaching the database but being denied access. Cloud SQL uses IAM for authentication when connecting via private IP; the web-server's service account must have the Cloud SQL Client IAM role to authenticate successfully.

Without this role, the connection is rejected even though the network path is open.

Exam trap

Google Cloud often tests the distinction between network connectivity (Layer 3 reachability) and application-layer authentication, leading candidates to incorrectly blame firewall rules or IP configuration when the real issue is missing IAM permissions for Cloud SQL private IP access.

How to eliminate wrong answers

Option A is wrong because the default-allow-internal firewall rule in GCP allows all TCP traffic (including port 3306) between instances in the same VPC, so it does not block MySQL connections. Option C is wrong because the Cloud SQL instance is configured with private IP only, which is sufficient for connectivity; enabling a public IP is not required for private access and would not cause an authentication error. Option D is wrong because both the web-server and the Cloud SQL instance are in us-central1, as stated in the scenario, so region mismatch is not the issue.

631
MCQmedium

An organization uses Google Workspace for email and collaboration. They want to allow employees to sign in to a custom web application using their Google Workspace credentials. The application runs on Compute Engine and uses a PostgreSQL database. Which identity solution should they implement?

A.Workload Identity Federation.
B.Cloud Identity-Aware Proxy (IAP) with OIDC.
C.SAML 2.0 federation with the web app.
D.Firebase Authentication with Google provider.
AnswerB

IAP provides authentication using Google identity and works with OIDC for web apps.

Why this answer

IAP with OIDC is the correct approach. IAP integrates with Google identity (including Google Workspace) and provides authentication and authorization for web applications. OIDC is the protocol used to verify identity.

SAML is for SSO but IAP uses OIDC. Firebase Auth is for consumer apps. Cloud Identity-Aware Proxy (IAP) is specifically designed for this use case.

632
MCQmedium

A company runs a multi-tier application on Compute Engine behind an external HTTP(S) Load Balancer. The backend consists of a managed instance group for the application tier and a Cloud Storage bucket for static assets. During peak traffic, some users receive HTTP 503 errors. The backend instances are healthy and the load balancer shows no connection errors. The company has already enabled Cloud CDN for the backend bucket. What should they do to resolve the 503 errors?

A.Increase the size of the instance group to handle more requests.
B.Enable Cloud CDN on the backend bucket to cache static content.
C.Increase the backend bucket's cache mode to force caching of dynamic content.
D.Adjust the load balancer's connection draining timeout.
AnswerA

Scaling up the instance group adds capacity to serve more requests, reducing 503 errors from resource exhaustion.

Why this answer

The 503 errors likely indicate that the instance group cannot handle the request volume. Increasing the size of the instance group provides more capacity. Option B is incorrect because CDN is already enabled for static content, and the 503 errors are likely for dynamic content.

Option C is incorrect because forcing caching of dynamic content may serve stale data or not be allowed. Option D is incorrect because connection draining affects instance removal, not capacity.

633
MCQmedium

A company is subject to PCI DSS and needs to protect a web application that processes credit card data. They want to block common web attacks such as SQL injection and cross-site scripting (XSS). Which Google Cloud service should they use?

A.Cloud Armor
B.Cloud NAT
C.Cloud CDN
D.Identity-Aware Proxy (IAP)
AnswerA

Cloud Armor provides WAF capabilities including preconfigured rules for SQLi and XSS, meeting the requirement.

Why this answer

Cloud Armor is a Web Application Firewall (WAF) that provides protections against OWASP Top 10 threats like SQL injection and XSS. It integrates with Cloud Load Balancing to filter traffic.

634
MCQeasy

A new employee needs to be able to create and manage Compute Engine instances. Which role should be granted at the project level?

A.roles/compute.instanceAdmin
B.roles/compute.admin
C.roles/compute.networkAdmin
D.roles/compute.viewer
AnswerA

This role includes the necessary permissions to create and manage instances.

Why this answer

The roles/compute.instanceAdmin role grants permissions to create, modify, and delete Compute Engine instances, including starting, stopping, and managing disks and snapshots, but does not allow changing project-wide network configurations or granting IAM policies. This is the least-privilege role that meets the requirement to 'create and manage Compute Engine instances' at the project level.

Exam trap

The trap here is that candidates often confuse 'admin' with 'instanceAdmin', assuming the broader role is required, but the PCSE exam emphasizes granting the minimal set of permissions needed to perform a specific job function.

How to eliminate wrong answers

Option B (roles/compute.admin) is wrong because it grants full administrative access to all Compute Engine resources, including network and security settings, which exceeds the stated need and violates the principle of least privilege. Option C (roles/compute.networkAdmin) is wrong because it only allows management of networking resources (firewalls, routes, VPNs) and does not grant permissions to create or manage instances. Option D (roles/compute.viewer) is wrong because it provides read-only access to Compute Engine resources, with no ability to create, modify, or delete instances.

635
Multi-Selectmedium

A company has multiple Google Cloud projects under an organization. They want to ensure that only service accounts from their own Cloud Identity domain (example.com) can be used in IAM policies. Which TWO steps should they take? (Choose 2)

Select 2 answers
A.Configure VPC Service Controls to restrict access.
B.Remove any IAM policies that include members from other domains.
C.Use Cloud Identity to block external users.
D.Create a deny policy that denies the resourcemanager.projects.setIamPolicy permission for non-example.com users.
E.Apply the organization policy constraint constraints/iam.allowedPolicyMemberDomains with value ['example.com'] at the organization level.
AnswersB, E

Existing policies with other domains would violate the constraint and cause errors.

Why this answer

The organization policy constraint constraints/iam.allowedPolicyMemberDomains restricts member domains in IAM policies. Setting it to ['example.com'] ensures only principals from that domain can be added. Additionally, removing other domains from existing policies is necessary to enforce the constraint.

636
MCQeasy

A DevOps team wants to grant a contractor temporary access to a specific Cloud Storage bucket for 30 days. The contractor has a Google account (example@gmail.com). The bucket contains sensitive data, and the access should be as restrictive as possible. What is the recommended way to grant this access?

A.Create a bucket ACL granting the contractor READ access.
B.Add the contractor's email to the project-level IAM policy with the 'Storage Object Viewer' role.
C.Add the contractor's email to the bucket-level IAM policy with the 'Storage Object Viewer' role.
D.Generate a signed URL for the contractor to access the bucket objects.
AnswerC

Bucket-level IAM is granular and can be removed after 30 days.

Why this answer

Bucket-level IAM policies allow you to grant granular, time-bound access to a specific bucket without affecting other resources in the project. By adding the contractor's email (example@gmail.com) to the bucket-level IAM policy with the 'Storage Object Viewer' role, you restrict access to only that bucket and only to read objects, which is the most restrictive approach for a 30-day temporary access requirement.

Exam trap

Google Cloud often tests the distinction between project-level and resource-level IAM policies, and the trap here is that candidates choose project-level IAM (Option B) thinking it's simpler, but they overlook that it grants access to all buckets in the project, violating the principle of least privilege.

How to eliminate wrong answers

Option A is wrong because bucket ACLs are legacy and do not support IAM conditions for time-bound access; they also lack the granularity of IAM roles and are not recommended for new configurations. Option B is wrong because adding the contractor to the project-level IAM policy grants read access to all storage buckets in the project, which violates the 'as restrictive as possible' requirement and exposes other sensitive data. Option D is wrong because signed URLs provide temporary access to specific objects, not the entire bucket, and managing them for all objects over 30 days is impractical and insecure for ongoing bucket-level access.

637
Multi-Selectmedium

A company is implementing VPC Service Controls to protect a project that contains Cloud Storage and BigQuery. They want to allow a specific on-premises service account to read data from Cloud Storage and write to BigQuery. The on-premises network connects via Cloud VPN. Which TWO components must be configured in the service perimeter? (Choose two.)

Select 2 answers
A.Add Cloud Storage and BigQuery to the list of restricted services in the perimeter (they already are)
B.An ingress rule that allows the on-premises service account to access Cloud Storage and BigQuery
C.An access level based on the on-premises IP range (10.0.0.0/8)
D.A VPC firewall rule allowing traffic from the VPN to the Cloud Storage and BigQuery APIs
E.An egress rule that allows the on-premises service account to leave the perimeter
AnswersB, C

Ingress rules allow external identities to access resources inside the perimeter.

Why this answer

To allow external access, you need an ingress rule that specifies the source (on-premises service account and the Cloud VPN network) and the allowed services (Cloud Storage and BigQuery). An access level can be used to define the IP range, but the ingress rule is the primary mechanism. Adding the service to the perimeter is already done; you don't need to add it again.

An egress rule is not needed for inbound access.

638
Multi-Selectmedium

Which TWO of the following are valid Google Cloud firewall rule components? (Choose TWO.)

Select 2 answers
A.Priority
B.Protocol signature
C.Target service accounts
D.Next hop
E.Network tier
AnswersA, C

Priority determines the order in which rules are evaluated.

Why this answer

A is correct because firewall rules in Google Cloud require a priority value (0–65535) to determine evaluation order. Lower numbers are evaluated first, and the first matching rule is applied. This is a mandatory component of every firewall rule.

Exam trap

Google Cloud often tests the distinction between firewall rule components and routing/network tier components, so candidates mistakenly select 'Next hop' or 'Network tier' because they are familiar networking terms, but they are not part of a firewall rule definition.

639
MCQmedium

An organization needs to comply with ITAR regulations. They want to ensure that all data processed by their GCP resources remains within the United States. Which service should they use?

A.VPC Service Controls
B.Assured Workloads
C.Cloud DLP
D.Organization policy constraint gcp.resourceLocations
AnswerB

Assured Workloads provides compliance controls for ITAR, FedRAMP High, etc., including data residency and access restrictions.

Why this answer

Assured Workloads provides regulatory compliance controls, including support for ITAR. It helps enforce data residency and access controls required for ITAR workloads.

640
MCQmedium

A company has an organization policy that denies the use of certain GCP services unless the project is in a specific folder. The DevOps team wants to create a new project in that folder. However, the project creation fails. What is the most likely cause?

A.The folder has reached its maximum number of projects.
B.The project name is already taken.
C.The organization policy prevents any project creation in the organization.
D.The user does not have the resourcemanager.projects.create permission at the folder level.
AnswerD

Project creation requires the Project Creator role at the folder or organization level.

Why this answer

The most likely cause is that the user lacks the `resourcemanager.projects.create` permission at the folder level. Even if the project is being created in a folder that allows GCP services, the user must have the Project Creator role (or equivalent) granted on that specific folder. Without this permission, the creation request is denied by the Resource Manager, regardless of the folder's capacity or the project name's uniqueness.

Exam trap

A common trap in the Google PCSE exam is confusing organization policy constraints (which control service usage) with IAM permissions (which control who can create projects). The question tests that project creation fails due to missing IAM permissions at the folder level, not due to organization policy restrictions.

How to eliminate wrong answers

Option A is wrong because the folder-level project quota is a soft limit that can be increased, and the error message for hitting the quota is distinct from a permission-denied error. Option B is wrong because a duplicate project name would cause a different error (e.g., 'Project name already exists') and is not related to the folder's policy or permissions. Option C is wrong because the organization policy only denies certain GCP services, not project creation itself; project creation is controlled by IAM permissions, not by the organization policy constraints on service usage.

641
MCQmedium

A financial institution uses Cloud HSM to protect cryptographic keys used for signing sensitive transactions. They want to ensure that keys are never exportable and that key usage is logged. Which key type should they create in Cloud HSM?

A.Purpose: ASYMMETRIC_SIGN with algorithm: RSA_SIGN_PKCS1_2048_SHA256
B.Purpose: SYMMETRIC_ENCRYPT_DECRYPT with algorithm: GOOGLE_SYMMETRIC_ENCRYPTION
C.Purpose: ASYMMETRIC_DECRYPT with algorithm: RSA_DECRYPT_OAEP_2048_SHA256
D.Purpose: MAC with algorithm: HMAC_SHA256
AnswerA

This key type is designed for signing and uses Cloud HSM which provides non-exportable keys.

Why this answer

Cloud HSM supports ASYMMETRIC_SIGN key purpose with RSA_SIGN_PKCS1_2048_SHA256, which creates a non-exportable key pair used for signing. Cloud HSM ensures the private key never leaves the HSM boundary, and all key usage is automatically logged via Cloud Audit Logs, meeting the requirements for non-exportability and logging.

Exam trap

Google Cloud often tests the distinction between key purposes: candidates confuse ASYMMETRIC_DECRYPT (used for decrypting ciphertext) with signing, but signing requires the private key to produce a signature, not to decrypt data.

How to eliminate wrong answers

Option B is wrong because SYMMETRIC_ENCRYPT_DECRYPT keys are used for encryption/decryption, not signing, and symmetric keys do not provide the non-repudiation needed for signing sensitive transactions. Option C is wrong because ASYMMETRIC_DECRYPT keys are designed for decryption operations (e.g., RSA-OAEP), not for creating digital signatures; signing requires the private key to generate a signature, not to decrypt. Option D is wrong because MAC (Message Authentication Code) keys, such as HMAC_SHA256, are symmetric and used for integrity and authentication, not for asymmetric signing; they do not provide non-repudiation and are exportable by design in Cloud HSM.

642
Multi-Selectmedium

A company wants to prevent data exfiltration by restricting access to Google APIs from only authorized VPC networks. They also need to allow a specific on-premises IP range to access BigQuery. Which TWO services should be used together? (Choose 2)

Select 2 answers
A.Cloud Armor
B.Access levels (IP-based)
C.Hierarchical firewall policy
D.Private Service Connect
E.VPC Service Controls
AnswersB, E

Access levels define conditions (like IP ranges) to allow access into the perimeter.

Why this answer

VPC Service Controls create a service perimeter around Google APIs, and an access level (IP-based) can be used to allow the on-premises IP range into the perimeter.

643
MCQmedium

A company is deploying a microservices architecture on Google Kubernetes Engine (GKE). They need to securely store and access database credentials, API keys, and other secrets. They want to avoid storing secrets in plaintext in the container image or Kubernetes manifests. Which solution should they use?

A.Encrypt secrets with Cloud KMS and store them in a ConfigMap.
B.Store secrets in a ConfigMap and mount as environment variables.
C.Use Secret Manager and mount secrets as volumes using the Secret Manager CSI driver.
D.Use Kubernetes native Secrets, committing them to a private repository.
AnswerC

This provides secure, audited access without storing secrets in the cluster.

Why this answer

Secret Manager provides a centralized, secure, and auditable way to store secrets, and the Secret Manager CSI driver allows pods to mount these secrets as volumes without exposing them in the container image or Kubernetes manifests. This approach ensures secrets are never stored in plaintext on disk or in etcd, and it integrates with GKE's workload identity for fine-grained access control.

Exam trap

The trap here is that candidates often confuse Kubernetes native Secrets (which are only base64-encoded, not encrypted) with a secure solution, or they assume ConfigMaps can be used for secrets if encrypted, missing the fact that ConfigMaps are not designed for sensitive data and are stored in plaintext in etcd.

How to eliminate wrong answers

Option A is wrong because Cloud KMS is a key management service for encryption keys, not a secret store; storing encrypted secrets in a ConfigMap still leaves the secrets in etcd and Kubernetes API, and ConfigMaps are not designed for sensitive data. Option B is wrong because ConfigMaps store data in plaintext in etcd and can be easily read by anyone with access to the Kubernetes API, violating the requirement to avoid plaintext storage. Option D is wrong because committing Kubernetes native Secrets to a private repository still stores them in plaintext in the repository and in etcd, and native Secrets are only base64-encoded, not encrypted by default, which is not a secure practice.

644
MCQmedium

A security engineer runs the command in the exhibit. The command fails with an error: 'Permission denied: cryptoKeyVersions.encrypt'. What is the most likely cause?

A.The key ring 'my-keyring' does not exist.
B.The user does not have the cloudkms.cryptoKeyVersions.encrypt permission on the key.
C.The key ring location is incorrect.
D.The user does not have the cloudkms.cryptoKeyVersions.decrypt permission.
AnswerB

The error indicates missing encrypt permission.

Why this answer

The error message 'Permission denied: cryptoKeyVersions.encrypt' explicitly indicates that the user lacks the cloudkms.cryptoKeyVersions.encrypt permission on the specific key version. In Google Cloud KMS, encrypt operations require the cloudkms.cryptoKeyVersions.encrypt permission (or a broader role like roles/cloudkms.cryptoKeyEncrypter) on the key resource. The command itself is syntactically correct, so the failure is due to insufficient IAM permissions, not resource existence or location.

Exam trap

Google Cloud often tests the distinction between resource existence errors (e.g., 'Not found') and permission errors (e.g., 'Permission denied'), so candidates must read the exact error message to avoid confusing missing resources with insufficient IAM permissions.

How to eliminate wrong answers

Option A is wrong because if the key ring 'my-keyring' did not exist, the error would be 'Not found' or 'Key ring not found', not a permission denied error. Option C is wrong because an incorrect location would produce a 'Not found' or 'Invalid location' error, not a permission denied error. Option D is wrong because the error specifically mentions 'encrypt', not 'decrypt'; lacking the decrypt permission would not cause an encrypt operation to fail with this error message.

645
MCQeasy

A company wants to scan all container images stored in Artifact Registry for vulnerabilities before deployment. Which Google Cloud service should they use?

A.Binary Authorization
B.Cloud Build
C.Container Analysis
D.Security Command Center
AnswerC

Container Analysis scans images for vulnerabilities and provides findings.

Why this answer

Container Analysis (now part of Artifact Registry) provides vulnerability scanning for images. Binary Authorization enforces policies. Security Command Center aggregates findings.

Cloud Build is for building images.

646
MCQmedium

A company is deploying an internal service on GKE that needs to be accessible privately from on-premises data centers over a VPN connection. The service should not be exposed to the internet. Which connectivity solution is MOST appropriate?

A.Expose the service via an external load balancer with Cloud Armor IP allowlisting
B.Cloud NAT with firewall rules to allow on-premises IPs
C.VPC peering between the GKE VPC and on-premises
D.Private Service Connect with an internal load balancer
AnswerD

PSC enables private connectivity; internal load balancer keeps traffic within the VPC and on-premises via VPN.

Why this answer

Private Service Connect (PSC) allows publishing services using internal IP addresses that are accessible via VPC peering or VPN. The service can be exposed as an internal load balancer and attached to a PSC service attachment. On-premises can reach it via the VPN tunnel to the VPC.

647
MCQmedium

An organization wants to use Cloud IDS to detect network threats within their VPC. They have enabled the Cloud IDS endpoint and configured packet mirroring. Which of the following is required for the packet mirroring policy to work?

A.The IDS endpoint must be in the same zone as the VMs.
B.VPC firewall rules must allow traffic to the IDS endpoint.
C.VMs must be tagged with 'cloud-ids-packet-mirroring'.
D.All VMs must have an external IP address.
AnswerC

This tag is used to select which VMs have their traffic mirrored.

Why this answer

Packet mirroring requires that the source VMs have the cloud-ids-packet-mirroring tag. The mirrored traffic is sent to the IDS endpoint via an internal load balancer.

648
MCQmedium

Your organization uses VPC Flow Logs for network forensics. During an incident, you need to analyze traffic to a compromised instance for the last 72 hours. The Flow Logs are stored in Cloud Logging. Which approach allows you to query the logs most efficiently?

A.Export logs to BigQuery and run SQL queries
B.Use the gcloud logging read command with appropriate filters
C.Use Logs Explorer in Cloud Logging to filter by instance and time range
D.Download logs as CSV from Cloud Storage
AnswerC

Logs Explorer allows real-time querying of log entries.

Why this answer

Cloud Logging's Logs Explorer provides a query interface to filter and analyze logs. BigQuery is better for large-scale analysis, but for ad-hoc querying of recent logs, Logs Explorer is efficient. Note: Logs can be exported to BigQuery for complex analysis, but the question asks for efficient querying now.

649
MCQeasy

A developer wants to be notified when a new vulnerability is found in a container image stored in Artifact Registry. Which service should they configure?

A.Container Analysis
B.Cloud Security Scanner
C.Binary Authorization
D.VM Manager
AnswerA

Container Analysis scans images in Artifact Registry and publishes findings to Pub/Sub.

Why this answer

Artifact Registry integrates with Container Analysis to scan images for vulnerabilities. Notifications can be sent via Pub/Sub when new vulnerabilities are discovered.

650
MCQhard

An organization uses Cloud DLP to scan a Cloud SQL database for PII. They want to automatically pseudonymize email addresses found in a specific column using a deterministic encryption that can be reversed for authorized users. The key must be stored in Cloud KMS. Which DLP transformation should they configure?

A.CryptoHashConfig with a cryptographic key from Cloud KMS.
B.CryptoDeterministicConfig with a key from Cloud KMS.
C.CryptoReplaceFfxFpeConfig using a key from Cloud KMS.
D.ReplaceWithInfoTypeConfig with a cryptographic key.
AnswerB

This provides deterministic, reversible encryption suitable for pseudonymization.

Why this answer

CryptoDeterministicConfig performs deterministic encryption (same plaintext always produces the same ciphertext) using a key from Cloud KMS, which allows pseudonymization that can be reversed by authorized users. This matches the requirement for a reversible, deterministic transformation on email addresses in a Cloud SQL column.

Exam trap

Google Cloud often tests the distinction between deterministic encryption (reversible, same output for same input) and hashing (one-way), leading candidates to mistakenly choose CryptoHashConfig when they need reversibility.

How to eliminate wrong answers

Option A is wrong because CryptoHashConfig uses a cryptographic hash function (e.g., SHA-256) which is one-way and cannot be reversed, so it does not meet the requirement for reversible pseudonymization. Option C is wrong because CryptoReplaceFfxFpeConfig uses Format-Preserving Encryption (FFX) which preserves the format of the data (e.g., email structure) but is not specifically designed for deterministic encryption with Cloud KMS key management in this context; it is more suited for preserving format while encrypting, not for simple deterministic reversal. Option D is wrong because ReplaceWithInfoTypeConfig replaces the entire value with the info type name (e.g., 'EMAIL_ADDRESS') and does not use a cryptographic key or provide any encryption or reversibility.

651
MCQmedium

Refer to the exhibit. A compliance auditor reviews the key configuration and finds a potential issue. What is the most likely compliance impact?

A.The key is disabled and cannot encrypt data
B.The key was created too recently
C.The key lacks automatic rotation, which may violate compliance requirements
D.The key is not used for the correct purpose
AnswerC

Many compliance standards (e.g., PCI DSS) require periodic key rotation; a null rotation period means no rotation is scheduled.

Why this answer

Many compliance frameworks (e.g., PCI DSS, SOC 2, NIST SP 800-57) require cryptographic keys to be rotated periodically to limit the amount of data encrypted under a single key and reduce the impact of key compromise. In Google Cloud KMS, if automatic rotation is not enabled or configured, the key remains static, which can violate these compliance mandates. The auditor identifies the lack of automatic rotation as a potential non-compliance issue, even if the key is otherwise valid and functional.

Exam trap

Google Cloud often tests the distinction between a key being 'functional' versus 'compliant' — candidates may assume that because a key works and is not expired, it is compliant, but the trap is that compliance frameworks require proactive rotation policies, not just key validity.

How to eliminate wrong answers

Option A is wrong because a key being disabled would be a separate administrative action or state; the exhibit does not show the key as disabled, and a disabled key would not be available for encryption at all, which is not the issue flagged by the auditor. Option B is wrong because the age of the key alone does not create a compliance impact unless a specific maximum key lifetime is defined by policy; the auditor's concern is about rotation, not recency. Option D is wrong because the key purpose (e.g., encryption, signing) is typically defined in the key's attributes or usage policy, and the exhibit does not indicate that the key is being used for an incorrect purpose; the issue is the lack of rotation, not misuse.

652
MCQmedium

A company uses Cloud Armor to protect a web application. They want to block requests that contain SQL injection patterns based on the OWASP ModSecurity Core Rule Set. Which preconfigured rule set should they enable?

A.Custom rules using CEL expression
B.OWASP ModSecurity CRS
C.Google Cloud Armor Managed Rules (SQL Injection)
D.Rate limiting rules
AnswerB

Correct: The OWASP CRS includes rules for SQL injection, XSS, etc.

Why this answer

Cloud Armor provides preconfigured WAF rules based on the OWASP ModSecurity CRS. To block SQL injection, the rule set 'owasp-crs' with the specific paranoia level can be used, or the 'sqli' rule set if available. The correct answer is the OWASP ModSecurity CRS rule set that includes SQL injection detection.

653
Multi-Selecteasy

Which TWO of the following are valid methods to protect data in transit between on-premises and Google Cloud using Cloud VPN?

Select 2 answers
A.Use Cloud VPN with SSL VPN.
B.Use Cloud VPN with IPsec IKEv2.
C.Use Cloud NAT for outbound traffic.
D.Use Cloud VPN with IPsec IKEv1.
E.Use Cloud Interconnect with MACsec.
AnswersB, D

Cloud VPN supports IPsec with IKEv2.

Why this answer

Cloud VPN supports both IPsec IKEv1 and IKEv2 as valid protocols for establishing secure tunnels between on-premises networks and Google Cloud. IKEv2 offers improved stability and mobility support, but both are explicitly supported by Google Cloud VPN for protecting data in transit.

Exam trap

Google Cloud often tests the distinction between Cloud VPN (which uses IPsec with IKEv1 or IKEv2) and other connectivity options like Cloud Interconnect or SSL VPN, leading candidates to mistakenly select SSL VPN or MACsec as valid Cloud VPN methods.

654
Multi-Selecthard

A financial services company must ensure that its Google Cloud environment complies with PCI DSS. The security team needs to implement controls to protect cardholder data. Which TWO measures should they implement? (Choose TWO.)

Select 2 answers
A.Enable Data Access audit logs for all Cloud Storage buckets.
B.Use Security Command Center to detect misconfigurations.
C.Configure VPC Service Controls to restrict data movement from managed services.
D.Enable Shielded VMs on all Compute Engine instances.
E.Use Customer-Managed Encryption Keys (CMEK) to encrypt data at rest.
AnswersC, E

VPC Service Controls help prevent unauthorized data exfiltration, a PCI DSS requirement.

Why this answer

C is correct because VPC Service Controls create a security perimeter around Google Cloud managed services, preventing data exfiltration by restricting data movement from within the perimeter to unauthorized external networks. This is critical for PCI DSS compliance as it helps protect cardholder data from unauthorized access or transfer. E is correct because Customer-Managed Encryption Keys (CMEK) allow the organization to control and manage the encryption keys used to protect data at rest, meeting PCI DSS requirement 3.4 for rendering cardholder data unreadable.

Exam trap

Google Cloud often tests the distinction between detective controls (like audit logs and Security Command Center) and preventive controls (like VPC Service Controls and CMEK), leading candidates to mistakenly select logging or detection options as direct compliance measures.

655
MCQhard

A multinational corporation uses Google Cloud and must comply with GDPR. They want to process personal data for a new purpose that was not originally disclosed to data subjects. What is the correct course of action under GDPR?

A.Anonymize the data before processing, as anonymized data is not subject to GDPR.
B.Rely on the existing DPA with Google, as it covers all processing activities.
C.Obtain explicit consent from the data subjects for the new processing purpose.
D.Proceed with the new processing as long as the data is pseudonymized.
AnswerC

Under GDPR, processing for a new purpose generally requires a new legal basis, such as explicit consent.

Why this answer

GDPR requires a valid legal basis for each processing purpose. For a new purpose, explicit consent is often required unless another basis applies.

656
MCQmedium

An organization has multiple GCP projects managed through folders in the resource hierarchy. They want to enforce a policy that prohibits the creation of service account keys across all projects. Which approach should be used?

A.Use a deny policy at the project level to deny the 'iam.serviceAccountKeys.create' permission.
B.Configure a script that runs daily to delete any service account keys found in projects.
C.Create a custom IAM role that denies the permission to create keys and assign it to all users.
D.Apply an organization policy with the constraint 'constraints/iam.disableServiceAccountKeyCreation' at the folder level.
AnswerD

Organization policies enforce restrictions across the resource hierarchy. This constraint disables key creation for all service accounts in the folder's projects.

Why this answer

Organization policies can be applied at the folder or organization level to enforce constraints across all projects. The constraint 'constraints/iam.disableServiceAccountKeyCreation' specifically disables service account key creation. Applying it at a folder level is the most efficient way to enforce the policy across all projects in that folder.

657
MCQeasy

A security engineer needs to ensure that all data stored in Cloud Storage buckets and BigQuery tables is encrypted at rest using keys that the organization generates and manages on-premises. The keys must not be stored by Google. Which key management approach should they use?

A.Cloud HSM with Customer-Managed Keys
B.Customer-Managed Encryption Keys (CMEK) via Cloud KMS
C.Google default encryption (GMEK)
D.Customer-Supplied Encryption Keys (CSEK)
AnswerD

CSEK allows customers to supply their own keys per API call; Google does not store them.

Why this answer

Customer-Supplied Encryption Keys (CSEK) allow customers to provide their own encryption keys with each API call. Google never stores these keys, ensuring the customer retains full control. GMEK and CMEK involve Google storing the keys, and Cloud HSM is a managed service that stores keys, so none meet the 'not stored by Google' requirement.

658
MCQmedium

To comply with regulatory requirements, a company needs to prevent service account keys from being created for all projects. What should they use?

A.VPC Service Controls
B.Organization policy with a constraint
C.Security Command Center
D.IAM conditions
AnswerB

The Organization policy `iam.disableServiceAccountKeyCreation` can be applied at the organization level to prevent key creation.

Why this answer

Organization policies with constraints allow you to enforce restrictions across all projects in an organization. The `constraints/iam.disableServiceAccountKeyCreation` constraint specifically prevents the creation of service account keys, ensuring compliance with regulatory requirements that prohibit long-lived keys. This is a native Google Cloud IAM feature that applies at the organization, folder, or project level.

Exam trap

Google Cloud often tests the distinction between preventive controls (organization policy constraints) and detective/monitoring tools (Security Command Center), leading candidates to mistakenly choose Security Command Center because they think it can block actions, when in fact it only detects and alerts.

How to eliminate wrong answers

Option A is wrong because VPC Service Controls are used to define security perimeters around Google Cloud resources to mitigate data exfiltration risks, not to manage IAM policies or service account key creation. Option C is wrong because Security Command Center is a security and risk management platform that provides threat detection and vulnerability findings, but it does not enforce preventive policies like disabling key creation. Option D is wrong because IAM conditions allow you to define conditional, attribute-based access to resources (e.g., based on time, IP address, or resource tags), but they cannot prevent the creation of service account keys themselves.

659
Multi-Selecteasy

Your organization uses VM Manager for patch management. You need to configure patch deployments to run weekly on all Windows VMs. Which two resources must be configured? (Choose two.)

Select 2 answers
A.Enable VPC Flow Logs on the VMs
B.Create a patch job manually each week
C.Create a patch deployment with a weekly schedule
D.Specify the target VMs using instance filters (e.g., OS = Windows)
E.Install the OS Config agent on all VMs
AnswersC, D

Correct: A patch deployment with a weekly schedule automates the patching process as required.

Why this answer

VM Manager uses patch deployments and patch jobs. You create a patch deployment with a schedule (weekly) and target VMs (e.g., by OS type). You also need to configure a maintenance window or use a rolling update.

660
MCQmedium

A company is using Cloud SQL for MySQL in production. They notice that during peak hours, query latency increases significantly. The database is running on a db-n1-standard-2 instance with 100GB SSD. The CPU utilization spikes to 95% during peaks. The application uses connection pooling. Which action should the company take to improve performance while minimizing cost?

A.Increase the storage to 200GB to improve IOPS.
B.Add a read replica and redirect read queries to it.
C.Enable Cloud SQL Proxy to cache connections.
D.Increase the number of CPUs by switching to a db-n1-highcpu-2 instance.
AnswerB

Read replicas handle SELECT queries, reducing the primary instance's load and lowering latency for read-heavy workloads.

Why this answer

Adding a read replica offloads read queries from the primary instance, reducing CPU load and latency, which is the most cost-effective solution. Option A is incorrect because increasing storage improves IOPS but CPU remains the bottleneck. Option C is incorrect because Cloud SQL Proxy provides secure connections, not performance improvement.

Option D is incorrect because switching to a highcpu type does not increase CPU count (both have 2 vCPUs) and reduces memory, potentially causing memory pressure.

661
MCQmedium

An organization has a folder-level organization policy that enforces 'constraints/compute.requireShieldedVm'. A development team wants to create a test VM that does not use Shielded VM features. What is the correct approach?

A.Create the VM in a different folder that does not have the policy.
B.Use a custom role that bypasses the organization policy.
C.Override the organization policy at the project level to set the constraint to 'not enforce' for that project.
D.Create the VM with Shielded VM disabled; the policy will not apply to test projects.
AnswerC

Policy overrides at a lower level can change enforcement. The dev team should request an override.

Why this answer

Organization policies can be overridden at a lower level in the resource hierarchy using policy inheritance rules. The dev team should request an exemption for their project or folder by creating a policy override that sets the constraint to 'not enforce'. This must be done by a user with the appropriate organization policy administrator role.

662
MCQeasy

You need to grant a security auditor read-only access to all resources in a project, but they must not be able to view data within resources (e.g., table contents). Which predefined IAM role should you grant?

A.roles/iam.securityReviewer
B.roles/owner
C.roles/viewer
D.roles/editor
AnswerC

Viewer role provides read-only access to resource configurations without data access.

Why this answer

The roles/viewer role provides read-only access to view resource configurations but not data. For example, it allows listing Compute Engine instances but not connecting to them or reading data from BigQuery tables. The Security Reviewer role (roles/iam.securityReviewer) is similar but includes additional permissions; however, the question asks for read-only access without data access, and roles/viewer is the standard read-only role.

663
MCQmedium

A company has multiple GCP projects managed under a single organization node. They want to enforce that all Compute Engine VMs are created with Shielded VM features enabled. Which approach should they use?

A.Use the organization policy service with the constraint constraints/compute.requireShieldedVm at the organization level.
B.Run a gcloud command after each VM creation to enable Shielded VM.
C.Apply a deny policy that denies the compute.instances.create permission if Shielded VM is not enabled.
D.Create a custom IAM role that includes compute.instances.create permission and assign it to all users.
AnswerA

This constraint ensures all new VMs must have Shielded VM enabled.

Why this answer

Organization policies can enforce constraints across projects. The constraint constraints/compute.requireShieldedVm can be applied at the organization, folder, or project level to require Shielded VM on all new VMs. IAM roles don't enforce configuration, and gcloud commands are manual.

Deny policies are for permission denial, not resource configuration.

664
MCQhard

A company needs to respond to a GDPR data subject deletion request for a user's data stored across BigQuery and Cloud Storage. The data must be completely erased upon request. What is the most effective approach to ensure compliance?

A.Use Cloud DLP to identify the user's data across services, delete the data using API calls, and verify deletion with Cloud Audit Logs
B.Set up BigQuery time-based table expiration and Cloud Storage lifecycle policies with a 1-day deletion rule
C.Use Cloud Identity-Aware Proxy to block the user's access and mark the data as deleted
D.Enable Access Transparency logs and request Google to delete the data on their behalf
AnswerA

Cloud DLP discovers data locations, deletion APIs remove data, and audit logs confirm deletion, meeting GDPR requirements.

Why this answer

Cloud DLP can be used to inspect and classify the user's data across BigQuery and Cloud Storage, then you can programmatically delete the identified data via API calls. Cloud Audit Logs provide a verifiable record that the deletion was performed, which is essential for demonstrating compliance with GDPR's right to erasure.

Exam trap

Google Cloud often tests the misconception that access control mechanisms (like IAP) or automated lifecycle policies can substitute for actual data deletion, but GDPR requires complete erasure of the specific data subject's information, not just blocking access or delayed removal.

How to eliminate wrong answers

Option B is wrong because time-based table expiration and lifecycle policies are automated deletion mechanisms that cannot target a specific user's data on demand; they delete entire tables or objects based on age, not in response to an individual deletion request. Option C is wrong because Cloud Identity-Aware Proxy controls access but does not delete data; marking data as deleted without actual erasure fails GDPR's requirement for complete removal. Option D is wrong because Access Transparency logs only provide visibility into Google's access to your data, and requesting Google to delete data on your behalf is not a supported mechanism for customer-managed data in BigQuery or Cloud Storage.

665
MCQhard

An organization uses Binary Authorization with a GKE cluster that enforces attestation. A developer builds a container and pushes it to Artifact Registry. The image must be signed before it can be deployed. Which steps are required to allow this image to run on the cluster?

A.Push the image to Artifact Registry and allow the Binary Authorization policy to automatically sign it.
B.Configure the cluster to allow all images by setting the policy to 'Allow All' for the developer's namespace.
C.Sign the image using Cloud KMS and an attestor, then create a signed attestation in Container Analysis, and deploy the image.
D.Use the Binary Authorization API to create an attestation by specifying the image URL and the attestor, then deploy.
AnswerC

This is the correct workflow: sign the image digest with the attestor's key, store the attestation as a note in Container Analysis, and the policy will verify it.

Why this answer

Binary Authorization requires a signed attestation from a trusted attestor, stored in Cloud KMS. The image must be signed using a private key associated with the attestor, and the attestation is typically stored as a note in Container Analysis. Simply having a vulnerability scan or pushing without signing will not satisfy the policy.

666
Multi-Selectmedium

Your company needs to implement real-time monitoring of security events from Google Cloud resources. They want to ingest logs into a third-party SIEM system. Which two services should they use together? (Choose two.)

Select 2 answers
A.Cloud Storage export
B.Cloud Logging log sink with Pub/Sub destination
C.Chronicle SIEM
D.BigQuery export
E.Pub/Sub subscription with a subscriber pulling logs
AnswersB, E

This enables streaming logs to Pub/Sub for real-time consumption.

Why this answer

Cloud Logging can export logs to Pub/Sub, and a subscriber (SIEM connector) can ingest them. Chronicle is a Google SIEM, but the question asks for third-party SIEM integration.

667
MCQhard

A company has a multi-project setup with a shared VPC. They want to centrally audit all firewall rule changes. What is the most efficient way?

A.Create a log sink in each project that routes firewall-related logs to a Cloud Storage bucket and then aggregate.
B.Enable VPC Flow Logs on all subnets.
C.Export Admin Activity audit logs to a centralized project's BigQuery dataset.
D.Use Cloud Asset Inventory with IAM policy change feed.
AnswerC

Admin Activity logs include firewall rule changes; BigQuery enables efficient querying.

Why this answer

Admin Activity audit logs record all configuration changes, including firewall rules. By exporting these logs from all projects to a centralized BigQuery dataset, you can efficiently query and analyze all changes across the organization.

Option A: Creating a log sink in each project to route firewall-related logs to Cloud Storage and then aggregate is less efficient because it requires managing multiple sinks and aggregating data manually. Also, log sinks for firewall logs may not capture all rule changes if not configured for appropriate log types.

Option B: VPC Flow Logs capture metadata about network traffic, not firewall rule changes. They are useful for network analysis but not for auditing configuration changes.

Option D: Cloud Asset Inventory with IAM policy change feed tracks IAM policy changes, not firewall rule changes. It is not suitable for auditing firewall rule modifications.

Thus, the most efficient way is to export Admin Activity audit logs to a centralized BigQuery dataset.

668
MCQmedium

Your organization uses Shared VPC with a host project and several service projects. You need to ensure that all egress traffic from Compute Engine instances in a service project is routed through a centralized Cloud NAT in the host project. What is the required configuration?

A.Create a firewall rule in the host project that denies all egress traffic except to the Cloud NAT IP
B.Set the instances to use a custom route with next-hop as the Cloud NAT IP address
C.Configure a Cloud NAT on the Cloud Router in the host project for the subnet that is shared with the service project
D.Configure a Cloud NAT in each service project and associate it with the subnet that the instances use
AnswerC

Correct: In Shared VPC, the host project owns the subnets. Cloud NAT on the host project's router for those subnets will handle egress for all instances in those subnets, including those from service projects.

Why this answer

A Cloud NAT configured on the Cloud Router in the host project for the shared subnet allows all Compute Engine instances in service projects attached to that subnet to use the host project's NAT IP for outbound traffic. This is the only way to centralize egress traffic through the host project's Cloud NAT while respecting Shared VPC architecture, as the NAT is tied to the subnet and Cloud Router in the host project.

Exam trap

Google Cloud often tests the misconception that a Cloud NAT must be configured in the same project as the instances, but in Shared VPC, the NAT is configured in the host project for the shared subnet, and service project instances automatically use it without any additional configuration.

How to eliminate wrong answers

Option A is wrong because firewall rules in the host project cannot selectively deny egress traffic for instances in a service project; firewall rules are applied per VPC network, not per project, and a deny-all-egress rule would block all outbound traffic, including legitimate responses, and does not route traffic through Cloud NAT. Option B is wrong because a custom route with next-hop as the Cloud NAT IP address is invalid; Cloud NAT is not a routable next-hop IP — it is a translation function on the Cloud Router, and instances must use the default route (0.0.0.0/0) to reach the internet via the NAT gateway. Option D is wrong because configuring a Cloud NAT in each service project would create separate NAT gateways, defeating the requirement for centralized egress through the host project's Cloud NAT.

669
MCQeasy

An organization's security policy requires that all audit logs be stored in a separate project for centralized monitoring. Which Google Cloud service should be used to aggregate logs from multiple projects?

A.Cloud Monitoring
B.Cloud Audit Logs
C.Security Command Center
D.Cloud Logging with log sinks
AnswerD

Log sinks can aggregate logs from multiple projects to a centralized destination.

Why this answer

Cloud Logging log sinks can be configured to route logs from multiple source projects to a common destination, such as a Cloud Storage bucket or BigQuery dataset, in a separate central project. This meets the requirement of aggregating logs for centralized monitoring. Option A (Cloud Monitoring) is used for metrics, dashboards, and alerting, not log aggregation.

Option B (Cloud Audit Logs) refers to the type of logs themselves, not a service for aggregation. Option C (Security Command Center) is for security posture and findings, not log routing.

670
Multi-Selectmedium

A company wants to deploy a web application with a global load balancer and needs to configure SSL/TLS termination. They want to use a certificate from their own CA and have the ability to manage multiple certificates for different domains. Which THREE steps should they take?

Select 3 answers
A.Ensure the certificate chain includes intermediate CA certificates
B.Set up a Cloud DNS zone with DNSSEC
C.Create a Certificate Manager certificate resource and map it to the load balancer
D.Upload the PEM certificate to the load balancer as a self-managed certificate
E.Use a Google-managed certificate for automatic renewal
AnswersA, C, D

For self-managed certificates, the full chain (leaf, intermediates) must be uploaded for the load balancer to trust the certificate.

Why this answer

To use self-managed certificates with a load balancer, you can upload the PEM file directly to the load balancer, or use Certificate Manager to manage multiple certificates. The steps: create a Certificate Manager certificate resource with your PEM, map it to the load balancer target, and ensure the certificate is properly uploaded. Self-managed certificates require manual renewal, so you need to monitor expiration.

671
MCQhard

A security team uses Security Command Center Premium to detect threats. They want to receive real-time notifications when a finding of type 'Threat' with severity 'CRITICAL' or 'HIGH' is created. Which approach should they use?

A.Use BigQuery to query SCC findings and schedule a query that pushes results to Pub/Sub.
B.Create a log sink to export SCC findings to Pub/Sub and then filter using Cloud Functions.
C.Create a SCC notification config with a filter for threat type and severity levels, sending to a Pub/Sub topic.
D.Enable Event Threat Detection and configure it to send alerts via email.
AnswerC

This is the standard way to get real-time notifications for specific findings.

Why this answer

SCC Premium provides built-in Pub/Sub notifications for findings. You can configure notification configs with filters to receive only specific finding types and severities. There is no need to export to BigQuery or use Cloud Functions to poll; the notification config pushes to a Pub/Sub topic.

672
Multi-Selectmedium

A company wants to enforce that all Compute Engine instances are created with a specific set of tags for compliance. They also want to audit any changes to firewall rules. Which two Google Cloud services or features should they use? (Choose TWO.)

Select 2 answers
A.Cloud Deployment Manager
B.Cloud IAM
C.Cloud Monitoring
D.Cloud Audit Logs
E.Organization Policy Service
AnswersD, E

Logs changes to firewall rules for auditing.

Why this answer

Organization policies can enforce VM creation with tags via a custom constraint. Cloud Audit Logs can log changes to firewall rules for auditing. IAM is for permissions, not enforcement.

Cloud Monitoring is for metrics. Cloud Deployment Manager is for infrastructure deployment but not continuous enforcement.

673
MCQmedium

A developer needs to create a custom IAM role that allows only a specific set of permissions for managing Cloud SQL instances. The role should be available at the organization level. Which command should they use?

A.gcloud iam roles create ROLE_ID --organization=ORGANIZATION_ID --file=role.yaml
B.gcloud projects add-iam-policy-binding PROJECT_ID --member=... --role=...
C.gcloud iam service-accounts create SA_NAME --display-name=...
D.gcloud organizations add-iam-policy-binding ORGANIZATION_ID --member=... --role=...
AnswerA

This command creates a custom role at the organization level using a YAML file with permissions defined.

Why this answer

Custom roles can be created at the organization level using the 'gcloud iam roles create' command with the '--organization' flag (or '--org' for short). The role is defined in a YAML file that specifies the permissions. The 'gcloud organizations add-iam-policy-binding' is used to assign roles, not create them.

The 'gcloud iam service-accounts create' is for service accounts. The 'gcloud projects add-iam-policy-binding' is for project-level IAM bindings.

674
MCQeasy

A company wants to protect its HTTP(S) Load Balancer from common web attacks like SQL injection and cross-site scripting. Which Google Cloud service should they use?

A.Identity-Aware Proxy (IAP)
B.Cloud Armor
C.VPC Service Controls
D.Cloud CDN
AnswerB

Cloud Armor offers WAF rules to block common web attacks.

Why this answer

Cloud Armor is the correct service because it provides web application firewall (WAF) capabilities that can inspect HTTP(S) traffic and filter out common web attacks such as SQL injection and cross-site scripting (XSS). It integrates directly with HTTP(S) Load Balancers to enforce security policies at the edge, blocking malicious requests before they reach backend instances.

Exam trap

The trap here is that candidates may confuse Cloud Armor with IAP because both involve security at the load balancer, but IAP handles authentication and authorization, not web application attack filtering.

How to eliminate wrong answers

Option A is wrong because Identity-Aware Proxy (IAP) is used for identity-based access control and authentication, not for inspecting HTTP payloads or blocking web application attacks like SQL injection or XSS. Option C is wrong because VPC Service Controls are designed to prevent data exfiltration by controlling access to Google Cloud APIs and services using perimeters, not for filtering application-layer traffic at the load balancer. Option D is wrong because Cloud CDN is a content delivery network that caches static and dynamic content to improve latency and reduce load, and it does not include a WAF or any capability to inspect or block malicious HTTP requests.

675
MCQmedium

A security engineer wants to export Cloud Audit Logs to a third-party SIEM in real time. Which log sink destination should they configure?

A.Pub/Sub
B.BigQuery
C.Cloud Storage
D.Logging bucket
AnswerA

Pub/Sub enables real-time streaming of logs to a SIEM via a push subscription.

Why this answer

To export logs in real time, configure a log sink with a Pub/Sub topic as the destination. The SIEM can then subscribe to that topic.

Page 8

Page 9 of 13

Page 10