Courseiva
← Back to Google Professional Cloud Security Engineer questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise Google Professional Cloud Security Engineer practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice testRead exam guide
15
scenario questions
PCSE
exam code
Google Cloud
vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Related practice questions

Related PCSE topic practice pages

Scenario questions usually connect to one or more exam topics. Use these links to review the underlying concepts behind the scenario.

Configuring Access Within a Cloud Solution Environment practice questions

Sharpen your PCSE knowledge of Configuring Access Within a Cloud Solution Environment.

Ensuring Data Protection practice questions

Sharpen your PCSE knowledge of Ensuring Data Protection.

Managing Operations in a Cloud Solution Environment practice questions

Practise PCSE questions linked to Managing Operations in a Cloud Solution Environment.

Configuring Network Security practice questions

Targeted PCSE practice covering Configuring Network Security.

Supporting Compliance Requirements practice questions

Sharpen your PCSE knowledge of Supporting Compliance Requirements.

PCSE fundamentals practice questions

Work through PCSE questions on PCSE fundamentals.

PCSE scenario practice questions

Practise PCSE questions linked to PCSE scenario.

PCSE troubleshooting practice questions

Practise PCSE questions linked to PCSE troubleshooting.

Practice set

Practice scenarios

Question 1mediummultiple choice
Full question →

Refer to the exhibit. A security engineer runs this command to check bucket permissions. What is the most significant security issue?

Exhibit

Resource: bucket 'my-data-bucket'
  IAM policy:
  - role: roles/storage.objectViewer
    members:
    - user:alice@example.com
    - domain:example.com
  - role: roles/storage.legacyBucketReader
    members:
    - allUsers
  Uniform bucket-level access: disabled
  ACLs:
  - entity: allUsers
    role: READER
Question 2hardmultiple choice
Full question →

Refer to the exhibit. The security team created this key for encrypting database backups. After an audit, they found that data encrypted before May 1, 2023, cannot be decrypted. What is the most likely cause?

Network Topology
location=globalkeyring=keyring-devRefer to the exhibit.```createTime: '2023-05-01T10:00:00Z'primary:name: projects/my-project/locations/global/keyRings/keyring-dev/cryptoKeys/test-key/cryptoKeyVersions/2state: ENABLEDprotectionLevel: HSMalgorithm: GOOGLE_SYMMETRIC_ENCRYPTIONattestation:format: CAVIUM_V3_COMPRESSEDed25519: <attestation_data>purpose: ENCRYPT_DECRYPTrotationPeriod: 7776000snextRotationTime: '2023-07-30T10:00:00Z'versionTemplate:
Question 3hardmultiple choice
Full question →

Refer to the exhibit. A developer created the firewall rule to allow HTTPS traffic from the API service account to instances tagged 'api-instances'. However, HTTPS requests from the API server (which runs on an instance with tag 'api-instances' and uses the default compute engine service account) are failing. What is the most likely cause?

Exhibit

{
  "name": "allow-api-traffic",
  "priority": 1000,
  "direction": "INGRESS",
  "allowed": [{"IPProtocol": "tcp", "ports": ["443"]}],
  "sourceServiceAccounts": ["api-sa@project.iam.gserviceaccount.com"],
  "targetTags": ["api-instances"]
}
Question 4mediummultiple choice
Full question →

Refer to the exhibit. A compliance officer is reviewing an Access Transparency log entry. Which compliance benefit does this log provide?

Exhibit

Refer to the exhibit.

```json
{
  "insertId": "xxx",
  "logName": "projects/my-project/logs/cloudaudit.googleapis.com%2Faccess_transparency",
  "protoPayload": {
    "methodName": "google.cloud.storage.Storage.GetObject",
    "principalEmail": "system@google.com",
    ...
  }
}
```
Question 5mediummultiple choice
Full question →

A security engineer is using Cloud Asset Inventory to find all Compute Engine instances that are not labeled with a 'compliance' label. Based on the exhibit, which instance(s) are missing the compliance label?

Network Topology
$ gcloud asset search-all-resourcesscope=organizations/123456789012asset-types='compute.googleapis.com/Instance'Refer to the exhibit.Output from gcloud command:```name: //compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/instance-1assetType: compute.googleapis.com/Instanceproject: projects/123456789012ancestors: ["organizations/123456789012", "folders/456", "projects/123456789012"]labels:env: productioncompliance: hipaaname: //compute.googleapis.com/projects/other-project/zones/us-central1-a/instances/instance-2project: projects/987654321098ancestors: ["organizations/123456789012", "folders/789", "projects/987654321098"]env: dev
Question 6hardmultiple choice
Full question →

Refer to the exhibit. An operations engineer configured this alert policy to notify when any VM instance in project my-project has high CPU utilization. However, no notifications are received even when CPU is consistently above 90% on multiple instances in us-central1-a. What is the most likely cause?

Exhibit

Refer to the exhibit.

```yaml
# monitoring alert policy
combiner: OR
conditions:
- conditionThreshold:
    filter: resource.type="gce_instance" AND metric.type="compute.googleapis.com/instance/cpu/utilization"
    aggregations:
    - alignmentPeriod: 60s
      perSeriesAligner: ALIGN_RATE
    duration: 300s
    comparison: COMPARISON_GT
    thresholdValue: 0.8
    trigger:
      count: 1
  displayName: CPU > 80%
- conditionMonitoringQueryLanguage:
    query: |
      fetch gce_instance
      | metric 'compute.googleapis.com/instance/cpu/utilization'
      | filter resource.zone == 'us-central1-a'
      | group_by [resource.instance_id], 60s, [value_utilization_mean: mean(value.utilization)]
      | every 60s
      | condition value_utilization_mean > 0.9
    duration: 0s
    trigger:
      count: 1
  displayName: High average CPU per instance
documentation:
  content: |
    Alert when CPU is high.
  mime_type: text/markdown
```
Question 7hardmultiple choice
Full question →

Refer to the exhibit. A security engineer runs the command to view recent decrypt operations on a Cloud KMS key. The output shows a successful decryption. However, the engineer is concerned about the exposure of the plaintext. Based on the log entry, what is the most accurate statement regarding the visibility of the decrypted plaintext?

Exhibit

Refer to the exhibit.

```
$ gcloud logging read "logName=projects/my-project/logs/cloudaudit.googleapis.com%2Factivity AND protoPayload.methodName=google.cloud.kms.v1.Decrypt" --limit 5

---
insertId: 1a2b3c4d5e
logName: projects/my-project/logs/cloudaudit.googleapis.com%2Factivity
protoPayload:
  @type: type.googleapis.com/google.cloud.audit.AuditLog
  authenticationInfo:
    principalEmail: user@example.com
  methodName: google.cloud.kms.v1.Decrypt
  resourceName: projects/my-project/locations/global/keyRings/my-keyring/cryptoKeys/my-key/cryptoKeyVersions/1
  response:
    plaintext: "REDACTED"
  serviceName: cloudkms.googleapis.com
  status: {}
resource:
  labels:
    key_id: my-key
    location: global
    key_ring: my-keyring
  type: cloudkms_crypto_key
severity: NOTICE
```
Question 8mediummultiple choice
Full question →

Refer to the exhibit. A security engineer is reviewing a Cloud KMS key. What can be concluded about this key?

Exhibit

{
  "name": "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",
  "primary": {
    "name": "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key/cryptoKeyVersions/2",
    "state": "ENABLED",
    "algorithm": "GOOGLE_SYMMETRIC_ENCRYPTION",
    "protectionLevel": "HSM",
    "attestation": {
      "certChains": [...]
    }
  },
  "versionTemplate": {
    "protectionLevel": "HSM",
    "algorithm": "GOOGLE_SYMMETRIC_ENCRYPTION"
  }
}
Question 9mediummultiple choice
Full question →

Refer to the exhibit. The output shows that Alice has the following IAM policy binding:

{
  "role": "roles/storage.objectAdmin",
  "members": ["user:alice@example.com"],
  "condition": {
    "title": "storage_access_condition",
    "expression": "request.time < timestamp('2024-12-31T23:59:59Z') && source.ip in ['203.0.113.0/24']"
  }
}

Alice is currently working from an IP address 198.51.100.10, and the date is 2025-01-01. What is the result when Alice tries to upload an object to a bucket in this project?

Network Topology
gcloud projects get-iam-policy my-projectformat=json
Question 10mediummultiple choice
Full question →

A security engineer runs the command in the exhibit. The command fails with an error: 'Permission denied: cryptoKeyVersions.encrypt'. What is the most likely cause?

Exhibit

Refer to the exhibit.

```
gcloud kms encrypt \
  --location=global \
  --keyring=my-keyring \
  --key=my-key \
  --plaintext-file=secret.txt \
  --ciphertext-file=secret.enc
```
Question 11easymultiple choice
Full question →

Refer to the exhibit. A compliance officer sees this Organization Policy applied at the organization level. Which compliance requirement does this policy primarily address?

Exhibit

{
  "constraint": "constraints/gcp.resourceLocations",
  "listPolicy": {
    "allowedValues": ["us-central1", "us-east1"]
  }
}
Question 12hardmultiple choice
Full question →

Refer to the exhibit. A company configured this VPC Service Controls perimeter for a PCI DSS project. The compliance auditor notes that BigQuery data can be accessed from outside the perimeter. Which change must be made to restrict access to BigQuery?

Exhibit

{
  "name": "projects/123/locations/global/perimeters/pci-perimeter",
  "status": {
    "resources": ["projects/123"],
    "restrictedServices": ["bigquery.googleapis.com"],
    "vpcAccessibleServices": {
      "allowedServices": ["storage.googleapis.com"]
    }
  }
}
Question 13mediummultiple choice
Full question →

Refer to the exhibit. A security engineer runs the gcloud command to analyze IAM policy for a user in an organization. The output shows that the user has the 'compute.instances.create' permission via a role at the organization level. However, the user is unable to create Compute Engine instances in a specific project. What is the most likely cause?

Network Topology
gcloud asset analyze-iam-policyproject=my-project \organization=123456789012 \resource='//cloudresourcemanager.googleapis.com/projects/123456789012' \identity='user:alice@example.com' \permissions='compute.instances.create'Refer to the exhibit.
Question 14hardmultiple choice
Full question →

Refer to the exhibit. Based on the exhibit, the corporate security policy requires that all Cloud KMS symmetric keys have automatic rotation enabled. Which statement is true?

Network Topology
gcloud kms keys listkeyring=my-keyringlocation=globalformat=json"name": "my-keyring/encryption-key","labels": {"env": "prod"},"rotationPeriod": "7776000s","primary": {"name": "encryption-key/cryptoKeyVersions/2","state": "ENABLED""name": "my-keyring/decryption-key","labels": {},"rotationPeriod": null,"name": "decryption-key/cryptoKeyVersions/1",
Question 15hardmultiple choice
Full question →

Refer to the exhibit. An organization has the above IAM policy on a project. The user user@example.com is trying to view a list of objects in a bucket from IP address 10.1.1.1. What will be the result?

Exhibit

{
  "bindings": [
    {
      "role": "roles/storage.admin",
      "members": ["user:admin@example.com"]
    },
    {
      "role": "roles/storage.objectViewer",
      "members": ["user:user@example.com"],
      "condition": {
        "title": "ip_restriction",
        "expression": "source.ip in ['10.0.0.0/8']"
      }
    }
  ]
}

These PCSE practice questions are part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style PCSE questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.