How should I use these Scenario practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Scenario questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Scenario domain.

PCSE · topic practice

Scenario practice questions

Practise Google Professional Cloud Security Engineer Scenario practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

7 questionsDomain: Scenario

Practice 10 questions Browse domain →

What the exam tests

What to know about Scenario

Scenario questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Scenario exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Scenario questions

7 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Read the full NAT/PAT explanation →

A security team needs to enforce that only requests originating from a corporate IP range (203.0.113.0/24) can access a Cloud Storage bucket containing sensitive data. They have created a custom IAM role with storage.objects.get permission and attached a condition that requires the request to have a specific IP address. However, some legitimate users outside the IP range are unable to access the data. What is the most likely cause?

Trap 1: Users must use a VPN to be assigned a corporate IP, but some are…

If they are not using corporate IP, they should be denied; this behavior is expected, not a cause of unexpected denial.

Trap 2: The condition uses the attribute 'request.network' instead of…

Both can be used, but the correct attribute is 'source.ip'; however, the issue is more fundamental.

Trap 3: The bucket ACL is set to deny all access by default.

IAM conditions take precedence over ACLs; the issue is with the IAM condition, not ACL.

Study all Scenario common traps →

A
Users must use a VPN to be assigned a corporate IP, but some are not connected.
Why wrong: If they are not using corporate IP, they should be denied; this behavior is expected, not a cause of unexpected denial.
B
The condition uses the attribute 'request.network' instead of 'source.ip'.
Why wrong: Both can be used, but the correct attribute is 'source.ip'; however, the issue is more fundamental.
C
The bucket ACL is set to deny all access by default.
Why wrong: IAM conditions take precedence over ACLs; the issue is with the IAM condition, not ACL.
D
The IAM condition evaluates after authentication, and users are already authenticated; the condition is not restricting based on source IP correctly because the condition is on the user's identity, not the request's source IP.
IAM conditions can restrict by source IP, but if misconfigured (e.g., using wrong attribute or not applying to the correct principal), they may not work; the most likely cause is that the condition is not properly written to check the source IP.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full Scenario explanation →

Refer to the exhibit. A security engineer runs the gcloud command to analyze IAM policy for a user in an organization. The output shows that the user has the 'compute.instances.create' permission via a role at the organization level. However, the user is unable to create Compute Engine instances in a specific project. What is the most likely cause?

Network Topology

Trap 1: The user does not have the 'compute.instances.create' permission at…

The command shows the permission is granted at the organization level, which should be inherited.

Trap 2: The user has the permission but through a different role than…

The permission is present regardless of role.

Trap 3: The user's role is not granted at the project level.

Organization-level roles are inherited by all projects.

Study all Scenario common traps →

A
The user does not have the 'compute.instances.create' permission at the project level.
Why wrong: The command shows the permission is granted at the organization level, which should be inherited.
B
The user has the permission but through a different role than expected.
Why wrong: The permission is present regardless of role.
C
An organization policy constraint is denying the creation of Compute Engine instances.
Organization policies can deny actions even if IAM allows them.
D
The user's role is not granted at the project level.
Why wrong: Organization-level roles are inherited by all projects.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full Scenario explanation →

A company uses a shared VPC with multiple service projects. A security administrator created an organization policy with the constraint 'gcp.resourceLocations' to restrict Cloud SQL instance creation to only the 'us-central1' region. The policy is applied at the organization level. A Cloud SQL administrator is using a service account with the predefined role 'roles/cloudsql.admin' (also granted at the organization level) to create instances. Despite the organization policy, the service account successfully creates a Cloud SQL instance in the 'europe-west1' region. The administrator verifies that the organization policy is active and the constraint is enforced. What is the most likely reason the policy is not preventing the creation?

Trap 1: The organization policy is applied at the organization level, but…

Incorrect: Organization policies are independent of IAM permissions; they don't override each other.

Trap 2: The service account has the 'Organization Policy Administrator'…

Incorrect: Even with that role, the service account would need to modify the policy; it doesn't bypass enforcement.

Trap 3: The gcp.resourceLocations constraint does not apply to Cloud SQL…

Incorrect: The constraint applies to Cloud SQL as documented.

Study all Scenario common traps →

A
The organization policy is set to 'dry-run' mode, so it logs violations but does not deny the operation.
Correct: In dry-run mode, the policy is not enforced, only audited.
B
The organization policy is applied at the organization level, but the service account's permissions are also at the organization level, causing an override.
Why wrong: Incorrect: Organization policies are independent of IAM permissions; they don't override each other.
C
The service account has the 'Organization Policy Administrator' role, which allows it to bypass constraints.
Why wrong: Incorrect: Even with that role, the service account would need to modify the policy; it doesn't bypass enforcement.
D
The gcp.resourceLocations constraint does not apply to Cloud SQL instances.
Why wrong: Incorrect: The constraint applies to Cloud SQL as documented.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Scenario explanation →

A company uses Cloud Storage buckets to store sensitive data. They want to allow a third-party auditor to list bucket contents but not download the objects. Which IAM role should be assigned?

Trap 1: roles/storage.objectAdmin

Grants full object management, including downloading.

Trap 2: roles/storage.objectViewer

Includes storage.objects.get, which allows downloading objects.

Trap 3: roles/storage.objectCreator

Only allows creating objects, not listing.

Study all Scenario common traps →

A
roles/storage.legacyBucketReader
Allows listing bucket contents without downloading objects.
B
roles/storage.objectAdmin
Why wrong: Grants full object management, including downloading.
C
roles/storage.objectViewer
Why wrong: Includes storage.objects.get, which allows downloading objects.
D
roles/storage.objectCreator
Why wrong: Only allows creating objects, not listing.

Full breakdown with real-world context →

Question 5easymultiple choice

Read the full Scenario explanation →

A company in the EU is moving to Google Cloud and must comply with GDPR data residency requirements. They have users across multiple EU countries and want to ensure that personal data remains within the European Economic Area (EEA). They plan to use Cloud Storage, BigQuery, and Compute Engine. The security administrator sets organization policies to restrict resource locations to europe-west1, europe-west3, and europe-west4. After deploying applications, the compliance team finds that some data is stored in a Cloud Storage bucket in us-central1. Investigation shows that the bucket was created by a developer who manually chose the region. The organization policy seems to have been bypassed. The administrator confirms the policy is active and applied to the project. What is the most likely cause?

Trap 1: The policy only applies to Compute Engine resources, not Cloud…

constraints/gcp.resourceLocations applies to all resources that have a location property.

Trap 2: The developer has the orgpolicy.policyCreator role, which allows…

No role allows bypassing organization policies; they are enforced for all users.

Trap 3: The policy was set to allowlist mode, and us-central1 is in the…

If us-central1 were in the allowlist, it would be allowed, but the policy restricted to EU regions.

Study all Scenario common traps →

A
The policy only applies to Compute Engine resources, not Cloud Storage.
Why wrong: constraints/gcp.resourceLocations applies to all resources that have a location property.
B
The organization policy was set at the folder level, and the project where the bucket was created is not a child of that folder.
Organization policies are hierarchical; if the project is not under the folder where the policy is set, it is not enforced.
C
The developer has the orgpolicy.policyCreator role, which allows them to bypass the policy.
Why wrong: No role allows bypassing organization policies; they are enforced for all users.
D
The policy was set to allowlist mode, and us-central1 is in the allowlist.
Why wrong: If us-central1 were in the allowlist, it would be allowed, but the policy restricted to EU regions.

Full breakdown with real-world context →

Question 6mediummultiple choice

Read the full Scenario explanation →

A company has deployed an internal HTTP Load Balancer (ILB) in us-west1 within a Shared VPC. The host project contains the ILB's forwarding rule and the backend service. The backend instances are Compute Engine VMs running in a service project in us-east1. The health checks for the ILB are consistently failing with 'unhealthy' status. The firewall rules in the host project allow ingress from the Google Cloud health checker ranges (130.211.0.0/22 and 35.191.0.0/16) on TCP port 80 to all VMs in the VPC. The backend VMs are running a web server listening on port 80. What is the most likely cause of the health check failures?

Trap 1: The health checker firewall rule is not applied to the service…

Firewall rules in the host project apply to all VMs in the VPC, including those in service projects.

Trap 2: The backend VMs are not in the same project as the ILB.

Shared VPC allows backend VMs in different service projects; this is not an issue.

Trap 3: The backend VMs do not have the correct IAM permissions for the ILB.

IAM permissions are not required for backends to respond to health checks.

Study all Scenario common traps →

A
The ILB's forwarding rule and backends are in different regions.
ILB requires backends to be in the same region as the forwarding rule; otherwise health checks fail.
B
The health checker firewall rule is not applied to the service project.
Why wrong: Firewall rules in the host project apply to all VMs in the VPC, including those in service projects.
C
The backend VMs are not in the same project as the ILB.
Why wrong: Shared VPC allows backend VMs in different service projects; this is not an issue.
D
The backend VMs do not have the correct IAM permissions for the ILB.
Why wrong: IAM permissions are not required for backends to respond to health checks.

Full breakdown with real-world context →

Question 7easymultiple choice

Read the full Scenario explanation →

Your company runs a data analytics platform on Google Cloud that processes sensitive financial data. Data is ingested from various sources into a Cloud Storage bucket, then processed by Dataflow jobs, and final results are stored in BigQuery. You have implemented the following security controls: - VPC Service Controls perimeter around the project - Cloud KMS CMEK for all storage services - IAM conditions restricting access based on tags - Cloud Audit Logs enabled for all services

Recently, an auditor discovered that a compromised service account was able to read data from the Cloud Storage bucket even though it was outside the VPC Service Controls perimeter. The auditor reviewed the logs and found that the access came from a Compute Engine instance that was running within the same project. What is the most likely reason the VPC Service Controls perimeter did not block this access?

Trap 1: The Cloud KMS key used for encryption was not bound to the…

CMEK does not affect VPC Service Controls enforcement; it is about encryption, not access control.

Trap 2: The Cloud Audit Logs were not enabled for the Cloud Storage bucket,…

The auditor reviewed logs, so logging was enabled.

Trap 3: The VPC Service Controls perimeter was not configured to include…

If the bucket is within the perimeter, access from outside is blocked; however, the instance is inside the project, so it might still be allowed.

Study all Scenario common traps →

A
The VPC Service Controls perimeter allows access from resources within the same project, even if they are outside the perimeter.
VPC Service Controls only block access from outside the perimeter; resources within the same project are considered inside and allowed by default.
B
The Cloud KMS key used for encryption was not bound to the perimeter.
Why wrong: CMEK does not affect VPC Service Controls enforcement; it is about encryption, not access control.
C
The Cloud Audit Logs were not enabled for the Cloud Storage bucket, so the access was not logged.
Why wrong: The auditor reviewed logs, so logging was enabled.
D
The VPC Service Controls perimeter was not configured to include the Cloud Storage bucket.
Why wrong: If the bucket is within the perimeter, access from outside is blocked; however, the instance is inside the project, so it might still be allowed.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Scenario sessions

Start a Scenario only practice session

Every question in these sessions is drawn from the Scenario domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Scenario questions →Mixed PCSE session

Frequently asked questions

What does the PCSE exam test about Scenario?: Scenario questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Scenario questions in a focused session?: Yes — the session launcher on this page draws every question from the Scenario domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other PCSE topics?: Use the topic links above to move to related areas, or go back to the PCSE question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the PCSE exam covers. They are not copied from any real exam or dump site.

Scenario only

10 questions 20 questions 30 questions 50 questions

Mixed PCSE session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All PCSE questions Scenario domain overview PCSE exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Scenario practice questions

What to know about Scenario

Common Scenario exam traps

Scenario questions

A company uses Cloud Storage buckets to store sensitive data. They want to allow a third-party auditor to list bucket contents but not download the objects. Which IAM role should be assigned?

Track your progress over time

Start a Scenario only practice session

Related PCSE topic practice pages

Configuring network security practice questions

Configuring access within a cloud solution environment practice questions

Ensuring data protection practice questions

Managing operations in a cloud solution environment practice questions

Supporting compliance requirements practice questions

PCSE fundamentals practice questions

PCSE scenario practice questions

PCSE troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid