Hard — PCSE Practice Quiz

Question 1

A financial services company runs a CI/CD pipeline that pushes container images to Artifact Registry. Security requires that any image with a CRITICAL OS-package vulnerability must never be promoted to the production GKE cluster, while HIGH and below can proceed with tracking. The team already uses Binary Authorization with an attestor. What is the most effective way to automatically enforce this severity-based gate before deployment?

Accepted Answer

Enable Artifact Registry automatic vulnerability scanning, then use a Cloud Build step that queries the scan results via the Container Analysis API and only creates the Binary Authorization attestation when no CRITICAL vulnerabilities are found

Answer

Configure a GKE admission webhook that scans the running pod's filesystem at startup and evicts the pod if a CRITICAL vulnerability is detected

Answer

Rely on Security Command Center Container Threat Detection to alert the security team when a CRITICAL vulnerability is running, then manually delete the deployment

Answer

Set an Artifact Registry cleanup policy to automatically delete any image tagged with a CRITICAL vulnerability so it cannot be pulled by the cluster

Question 2

A healthcare company is deploying a new analytics platform on Google Cloud that must comply with a regional data sovereignty regulation requiring that all cryptographic key material be generated, stored, and controlled outside of Google's infrastructure and remain in the customer's jurisdiction. The security team has created an Assured Workloads folder configured for the appropriate compliance regime. During design review, an architect asks how encryption keys should be managed to satisfy the requirement that Google must never have access to unwrapped key material. Which approach should the team adopt?

Accepted Answer

Use CMEK backed by Cloud External Key Manager (EKM), storing keys in a supported third-party key management partner outside Google Cloud

Answer

Use CMEK backed by Cloud HSM in the same region, relying on FIPS 140-2 Level 3 hardware to isolate key material

Answer

Rely on Google-managed default encryption, since Assured Workloads already enforces data residency for the folder

Answer

Import externally generated keys into Cloud KMS using the key import feature so Google stores the wrapped versions

Question 3

A European financial services company must onboard to Google Cloud while meeting EU digital sovereignty requirements. Their legal team mandates that data storage and processing remain within EU boundaries, that Google support personnel access is restricted to EU-based staff, and that customer approval is required before any Google administrator can access data during support operations. Which approach best satisfies these compliance requirements with the least custom engineering effort?

Accepted Answer

Create an Assured Workloads folder using the 'EU Regions and Support' compliance regime, which enforces EU data residency and personnel controls, and enable Key Access Justifications with Access Approval for administrator access control.

Answer

Apply an organization policy list constraint restricting resource locations to EU regions and rely on default Access Transparency logs to review Google access after the fact.

Answer

Deploy resources into europe-west regions and configure VPC Service Controls perimeters to block all Google support access to the data.

Answer

Use CMEK with an external key manager (EKM) hosted in the EU and manually revoke keys whenever Google support activity is detected in audit logs.

Question 4

Your organization enforces a Binary Authorization policy on a GKE cluster requiring attestations from your CI/CD pipeline. A security review reveals a concern: images that passed admission weeks ago may later be found to contain newly disclosed vulnerabilities, but they continue running in the cluster because the policy is only evaluated at Pod creation time. The security team wants ongoing assurance that running Pods still comply with the Binary Authorization policy, and to be alerted when they drift out of compliance, without blocking currently running workloads. What should you do?

Accepted Answer

Enable Binary Authorization continuous validation, which periodically re-evaluates running Pods against the policy and records non-compliant Pods in Cloud Logging.

Answer

Configure the Binary Authorization policy enforcement mode to 'Dryrun Audit Log Only' so all admission decisions are logged for later review.

Answer

Add a cron job that deletes and recreates all Pods every hour so the admission controller re-evaluates each image against the current policy.

Answer

Enable GKE Container Threat Detection to monitor runtime behavior and flag Pods running vulnerable binaries.

Question 5

A media company serves static video thumbnails through a global external Application Load Balancer with Cloud CDN enabled. Their security team wants to filter requests based on source IP address and geographic region BEFORE any content is served from the CDN cache, so that malicious or out-of-region requests never reach cached or backend content. Which Cloud Armor configuration meets this requirement?

Accepted Answer

Attach a Cloud Armor edge security policy to the backend service, using rules that match on source IP and region expressions

Answer

Attach a standard Cloud Armor backend security policy to the backend service and enable rate-based ban rules

Answer

Configure a Cloud Armor security policy on the URL map with a preconfigured WAF rule set

Answer

Apply VPC firewall rules that deny traffic from disallowed geographic IP ranges before it reaches the load balancer

Question 6

Your organization uses an on-premises Active Directory as the authoritative source for identities. You have deployed Google Cloud Directory Sync (GCDS) to provision users into Cloud Identity, and SSO is federated to your AD FS provider via SAML. An employee is terminated and their account is disabled in Active Directory. Security requires that this person can no longer authenticate to any Google Cloud resource. What is the correct outcome you should expect and configure to guarantee immediate loss of access?

Accepted Answer

Because SSO is federated, disabling the AD account alone blocks new sign-ins, but you should also suspend or delete the Cloud Identity user via GCDS and revoke existing OAuth/session tokens to terminate active sessions.

Answer

Deleting the user only in the Google Admin console is sufficient, because GCDS will detect the deletion and prevent re-creation on the next sync.

Answer

Removing all IAM role bindings for the user's email in the affected projects is the only step needed, since IAM policy fully controls authentication.

Answer

Rotating the SAML signing certificate in Cloud Identity will immediately invalidate the terminated user's access without affecting other users.

Question 7

A financial services company runs a fleet of 200 backend VMs (no external IPs) in a single subnet. These VMs make a very high volume of outbound API calls to a small number of external partner endpoints. Operations reports intermittent connection failures, and Cloud NAT logs show numerous 'OUT_OF_RESOURCES' drop entries for allocation, even though CPU and network throughput are well within limits. The team needs to resolve the failures without adding public IPs to the VMs. What is the most effective action?

Accepted Answer

Increase the minimum ports per VM instance allocation on the Cloud NAT gateway (and consider enabling dynamic port allocation) so more source ports are available for connections to the same destination.

Answer

Assign ephemeral external IP addresses to the backend VMs so they can bypass the NAT gateway for outbound traffic.

Answer

Lower the TCP established idle timeout to 30 seconds so ports are recycled, and leave the default 64 ports per VM unchanged.

Answer

Replace Cloud NAT with a Secure Web Proxy to handle all outbound partner API traffic and rely on its connection pooling.

Question 8

A financial services company stores highly regulated customer data in BigQuery and Cloud Storage, encrypted with Cloud KMS CMEK keys. Auditors require that any time Google or an internal automated process attempts to use these keys to decrypt data, the company can review the stated reason for access and automatically deny requests that lack an approved business justification. Which Cloud KMS capability should the security engineer configure to meet this requirement?

Accepted Answer

Enable Key Access Justifications and configure a justification policy that allows only approved reason codes, denying key use for unapproved justifications

Answer

Enable Cloud KMS key rotation on a 30-day schedule so that any unauthorized access is limited to a single key version

Answer

Configure Cloud Audit Logs for Cloud KMS to capture data access events and set up log-based alerts for decrypt operations

Answer

Migrate the CMEK keys to Cloud HSM to ensure hardware-backed key protection and FIPS 140-2 Level 3 compliance

Question 9

A financial services company must comply with a regulation requiring that the cryptographic keys protecting customer data in BigQuery and Cloud Storage be generated on the company's on-premises FIPS 140-2 Level 3 hardware security module and never exist in software form inside Google Cloud. The company still wants to use Cloud KMS to manage the key lifecycle and reference the keys as CMEK on Google Cloud resources. Which approach meets these requirements?

Accepted Answer

Configure Cloud External Key Manager (Cloud EKM) so Cloud KMS references key material that remains in an external key management system, then use it as CMEK.

Answer

Create Cloud HSM keys in Cloud KMS and enable automatic rotation so keys are generated inside Google's HSM.

Answer

Generate the key material on the on-premises HSM and import it into Cloud KMS as an imported key, then reference it as CMEK.

Answer

Use customer-supplied encryption keys (CSEK) by passing the raw key from the on-premises HSM with each Cloud Storage request.

Question 10

A data governance team needs a group of auditors to list all Cloud Storage buckets in a project and view each bucket's IAM policy and configuration metadata, but they must NOT be able to read the objects stored inside any bucket. The security engineer wants to grant the narrowest possible access. Which approach best satisfies least privilege?

Accepted Answer

Create a custom role containing only storage.buckets.list, storage.buckets.get, and storage.buckets.getIamPolicy permissions, and grant it to the auditors group at the project level.

Answer

Grant the auditors group the predefined roles/storage.objectViewer role at the project level.

Answer

Grant the auditors group the predefined roles/storage.admin role at the project level.

Answer

Grant the auditors group roles/viewer at the project level so they can inspect all resources read-only.

Question 11

A data engineering team at a healthcare analytics company must de-identify a customer email address column before loading data into BigQuery for analysts. Requirements: (1) the same email must always produce the same token so analysts can perform GROUP BY joins across tables, (2) the wrapped cryptographic key used for tokenization must never be embedded in the Sensitive Data Protection (DLP) template or stored in plaintext, and (3) the security team must be able to rotate the key material centrally. Which configuration satisfies all requirements?

Accepted Answer

Use a cryptoDeterministicConfig transformation with a KMS-wrapped crypto key (kmsWrapped), storing only the ciphertext key reference and the Cloud KMS resource name in the de-identify template.

Answer

Use a cryptoReplaceFfxFpeConfig transformation with an unwrapped transient crypto key generated per job so no key persists anywhere.

Answer

Use a cryptoDeterministicConfig transformation with an unwrapped raw key value placed directly in the de-identify template for reproducibility.

Answer

Use a replaceWithInfoTypeConfig transformation and rely on Cloud KMS to encrypt the resulting BigQuery table at rest.

Question 12

A healthcare analytics team wants to load customer records containing credit card numbers into BigQuery for fraud analysis. The data scientists must be able to correlate transactions belonging to the same card across different tables (referential integrity), and an authorized security team must occasionally re-identify specific cards during confirmed fraud investigations. The solution should keep the tokenized values in the same numeric format as the original card numbers so downstream schemas remain unchanged. Which Sensitive Data Protection (DLP) de-identification technique should you configure?

Accepted Answer

Format-preserving encryption (FPE) using a cryptoKey wrapped by Cloud KMS with a surrogate infoType

Answer

Cryptographic hashing (HMAC-SHA-256) of the credit card numbers with a KMS-wrapped key

Answer

Redaction of the credit card numbers, replacing detected values with a fixed string

Answer

Date shifting combined with bucketing to generalize the sensitive values

Question 13

A financial services company is migrating to Google Cloud and needs a dedicated, high-bandwidth (10 Gbps) connection between their on-premises data center and their VPC. A compliance requirement mandates that all traffic traversing the connection between on-premises and Google Cloud must be encrypted in transit. The company wants the lowest-latency dedicated option while still meeting the encryption requirement. Which approach should they implement?

Accepted Answer

Provision Dedicated Interconnect and run HA VPN over the Interconnect connection using MACsec or IPsec to encrypt traffic

Answer

Provision Dedicated Interconnect alone, since traffic over a private physical circuit is inherently encrypted by Google

Answer

Use HA VPN over the public internet, which provides IPsec encryption and comparable bandwidth to Dedicated Interconnect

Answer

Use Partner Interconnect with Private Google Access enabled to encrypt all traffic to Google APIs

Question 14

Your organization has thousands of projects and a broad set of principals who hold roles that include storage.buckets.delete and compute.instances.delete permissions through various inherited and directly-granted IAM roles. Security leadership mandates that no principal — regardless of any role grant, including at the project level — may delete Cloud Storage buckets across the entire organization, except for a break-glass group named org-admins@example.com. You want a centrally enforced control that overrides existing allow grants without editing every role or policy. What should you do?

Accepted Answer

Create an IAM deny policy attached at the organization node that denies storage.buckets.delete for all principals, with a denial exception for the org-admins@example.com group.

Answer

Create a custom role that excludes storage.buckets.delete and reassign every principal to that custom role across all projects.

Answer

Apply the constraints/storage.uniformBucketLevelAccess organization policy constraint at the organization node to prevent bucket deletion.

Answer

Add an IAM condition to each allow binding that evaluates the resource type and blocks deletion actions on buckets.

Question 15

Your security operations team receives a Security Command Center finding indicating a Compute Engine VM in a production project is communicating with a known cryptomining command-and-control endpoint. The incident response runbook requires that you preserve volatile and disk evidence for forensic analysis while immediately stopping the malicious outbound traffic, and you must minimize the risk of the attacker detecting your response. Which sequence of actions best meets these requirements?

Accepted Answer

Apply a deny-all egress firewall rule tagged to the VM (or move it to a quarantine network), take a disk snapshot, capture a memory image, then detach the disk for offline forensic analysis.

Answer

Delete the VM immediately to stop the attack, then restore from the most recent snapshot into an isolated project for analysis.

Answer

Stop the VM instance right away, then create a snapshot of the boot disk and share it with the forensics team.

Answer

Reset the VM's SSH keys and rotate all service account credentials, then continue monitoring the traffic in Cloud Logging to gather more evidence.

Question 16

During an active investigation, your security team suspects that a compromised service account was used to modify and delete objects in a Cloud Storage bucket over the past several days. Legal requires that all relevant Cloud Logging entries be preserved in a tamper-resistant, immutable form for potential litigation, and the retention must survive any attempt by an attacker with project-level permissions to delete logs. Which approach best meets these requirements?

Accepted Answer

Create a dedicated log bucket in a separate, tightly controlled project, route the relevant logs there via an aggregated sink, and apply a locked retention policy on the log bucket.

Answer

Increase the _Default log bucket retention period to 3650 days and rely on IAM to prevent deletion of log entries.

Answer

Export the logs to a BigQuery dataset in the same project and grant the legal team the BigQuery Data Viewer role.

Answer

Enable Access Transparency logs and forward them to a Pub/Sub topic monitored by the incident response team.

Question 17

A financial services company runs an internal HTTP(S) API on Compute Engine instances in a producer VPC. Multiple consumer teams in separate VPCs, plus an on-premises data center connected via Cloud Interconnect, need to reach this API. Security requires that all traffic stay on Google's private network with no exposure to the internet, and that the producer team explicitly control which consumer projects can connect. Which approach best meets these requirements?

Accepted Answer

Publish the internal API behind an internal load balancer as a Private Service Connect service attachment with an explicit consumer accept list, and have each consumer create a PSC endpoint; on-premises reaches the endpoint over the existing Interconnect.

Answer

Assign external IP addresses to the backend instances and restrict access using Cloud Armor security policies scoped to the consumer and on-premises IP ranges.

Answer

Create VPC Network Peering between the producer VPC and every consumer VPC, and advertise the load balancer route to on-premises via Cloud Router.

Answer

Configure Private Google Access on all consumer subnets and expose the API through a Cloud NAT gateway shared across the projects.

Question 18

A financial services company has a Google Cloud organization with a dedicated 'networking' folder containing Shared VPC host projects. The security team discovers that a developer in a separate 'apps' folder was able to attach their service project to a Shared VPC host project without approval. The team wants to ensure that only specifically designated host projects can be used as Shared VPC hosts across the organization, blocking all others by default. Which approach should they take?

Accepted Answer

Apply the 'constraints/compute.restrictSharedVpcHostProjects' list constraint at the organization node, denying all host projects, and add an allow entry for only the approved host project resource IDs

Answer

Grant the 'roles/compute.xpnAdmin' role only to the networking team at the folder level and remove it from all other principals

Answer

Enable the 'constraints/compute.disableSerialPortAccess' boolean constraint on the apps folder to prevent unauthorized service project attachment

Answer

Create an IAM deny policy that blocks the 'compute.subnetworks.setPrivateIpGoogleAccess' permission for all developers in the apps folder

Question 19

A financial services company runs on-premises servers connected to a Google Cloud VPC through a Dedicated Interconnect. These servers must call Cloud Storage and BigQuery APIs, but corporate security policy forbids any traffic to Google APIs from traversing the public internet, and the on-premises hosts have no external IPs. DNS resolution for googleapis.com currently returns public IP addresses. What should the security engineer configure to meet these requirements?

Accepted Answer

Enable Private Google Access for on-premises hosts by creating Cloud DNS response policies (or private zones) that resolve *.googleapis.com to the restricted.googleapis.com VIP range (199.36.153.4/30) and add routes over the Interconnect toward that range.

Answer

Assign external IP addresses to the on-premises servers and rely on Cloud Armor to restrict which Google API endpoints they can reach.

Answer

Enable Private Google Access on the subnets where the on-premises hosts reside, since Private Google Access automatically applies to any host reachable over the Interconnect.

Answer

Deploy Cloud NAT in the VPC and route on-premises API traffic through it so the servers reach googleapis.com public endpoints via a shared egress IP.

Question 20

A financial services company runs Compute Engine instances in a VPC with no external IP addresses and an organization policy that blocks external IPs. The instances must reach Google APIs such as Cloud Storage and BigQuery, but the security team requires that traffic use a private internal IP endpoint that they fully control and can reference in firewall rules and DNS, rather than the default public API domains. They also want to avoid routing this traffic over the internet or through Cloud NAT. Which approach meets these requirements?

Accepted Answer

Create a Private Service Connect endpoint for Google APIs with a consumer internal IP address, and configure DNS so API requests resolve to that endpoint

Answer

Enable Private Google Access on the subnet so instances can reach the default Google API public IP ranges without external addresses

Answer

Deploy Cloud NAT and restrict egress firewall rules to only Google's published API IP ranges

Answer

Configure a VPC Service Controls perimeter around the project to force API traffic onto internal IP addresses

Question 21

A SaaS provider (the producer) runs a managed data-processing service in their own VPC. For certain workloads, the producer's service instances must initiate outbound connections into a customer's (consumer's) VPC to reach an on-prem database exposed through the consumer network — while keeping the traffic on Google's backbone and avoiding VPC Peering, which would create IP overlap and full route exchange. The producer wants a network interface that lets their instances originate traffic into the consumer VPC with controlled, one-directional reachability. Which Private Service Connect construct should the producer use?

Accepted Answer

A Private Service Connect interface attached to the producer instances, connecting to a network attachment in the consumer VPC

Answer

A Private Service Connect endpoint (forwarding rule) in the consumer VPC pointing at a Google API bundle

Answer

A Private Service Connect endpoint in the producer VPC referencing a service attachment published by the consumer

Answer

VPC Network Peering between the producer and consumer VPCs with custom route exchange disabled

Question 22

A fintech company stores database credentials and API tokens in Secret Manager. Their security policy requires that (1) all secret payloads be encrypted with keys the company controls and can audit, and (2) the credentials must never leave the EU region for data-residency compliance. A developer needs read access to only one specific secret without being granted access to all secrets in the project. Which combination of configurations satisfies all these requirements?

Accepted Answer

Create a regional secret in a europe-west location configured with a CMEK from a Cloud KMS key ring in the same region, and grant the developer roles/secretmanager.secretAccessor on that individual secret resource.

Answer

Create a global secret with automatic replication, enable Google-managed encryption, and grant the developer roles/secretmanager.admin at the project level.

Answer

Create a global secret with a user-managed replication policy limited to EU regions using Google-managed keys, and grant the developer roles/secretmanager.secretAccessor at the project level.

Answer

Create a regional secret in a europe-west location with Google-managed encryption, and grant the developer roles/secretmanager.viewer on the individual secret resource.

Question 23

A data engineering team runs an on-premises batch job that must call the BigQuery API in Google Cloud. Security policy prohibits downloading and distributing long-lived service account key files. The on-premises environment cannot be enrolled in workload identity federation because it uses a legacy authentication broker that already holds valid Google credentials for a central automation service account. The team needs the batch job to act as a dedicated BigQuery service account without any exported key material. What is the most appropriate way to grant this access?

Accepted Answer

Grant the central automation service account the roles/iam.serviceAccountTokenCreator role on the dedicated BigQuery service account, and have the job generate short-lived access tokens through impersonation.

Answer

Create a user-managed key for the BigQuery service account, encrypt it with Cloud KMS, and store the ciphertext in the on-premises secret store for the job to decrypt at runtime.

Answer

Grant the central automation service account the roles/iam.serviceAccountUser role on the BigQuery service account so it can attach and run as that identity.

Answer

Add the central automation service account to a Google group that holds the roles/bigquery.dataEditor role and let the job inherit access directly.

Question 24

A retail company uses a Shared VPC where the network team owns the host project and application teams deploy Compute Engine instances into attached service projects. The security team wants application teams to be able to target their own VM instances with firewall rules WITHOUT granting them the ability to create or modify firewall rules directly, and without relying on network tags that any instance owner could freely apply. Which approach best meets these requirements?

Accepted Answer

Have the network team define firewall rules in the host project that reference secure tags (tag-based firewalling) bound to specific resources, and grant application teams only the Tag User permission on the relevant tag values.

Answer

Grant application teams the Compute Network Admin role on the host project so they can manage firewall rules scoped to their instances.

Answer

Instruct application teams to apply network tags to their VMs and create matching firewall rules in each service project.

Answer

Grant application teams the Compute Security Admin role on the Shared VPC host project and rely on network tags for targeting.

Question 25

A financial services company stores sensitive customer records in BigQuery and Cloud Storage across three projects. Security wants to guarantee that even if a valid service account credential is stolen, data cannot be queried or copied from outside the corporate environment. They also need engineers who work from the on-premises data center (accessing Google APIs through a Dedicated Interconnect) to continue analyzing the data without disruption. Which approach best establishes this data-exfiltration boundary?

Accepted Answer

Create a VPC Service Controls perimeter enclosing the three projects, protect the BigQuery and Cloud Storage APIs, and add an access level in Access Context Manager permitting the on-premises IP ranges reaching Google APIs via the Interconnect.

Answer

Apply an organization policy that restricts external IP addresses on all VMs and enable Private Google Access on every subnet in the three projects.

Answer

Configure firewall rules that deny all egress except to Google API ranges, and grant the analysts a custom IAM role limited to BigQuery read access.

Answer

Enable Cloud Armor security policies on the load balancers fronting the projects and require mutual TLS for all client connections to the data services.