🔍

PCSE — questions

Page 11 of 18 · 356 total questions.

PCSE Question 201

Single page →
Topic 1 · Question 201

Your company's Google Cloud organization has about 200 projects and 1,500 virtual machines. There is no uniform strategy for logs and events management, which reduces visibility for your security operations team. You need to design a logs management solution that provides visibility and allows the security team to view the environment's configuration. What should you do?

  • A1. Create a dedicated log sink for each project that is in scope.2. Use a BigQuery dataset with time partitioning enabled as a destination of the log sinks.3. Deploy alerts based on log metrics in every project.4. Grant the role "Monitoring Viewer" to the security operations team in each project.
  • B1. Create one log sink at the organization level that includes all the child resources.2. Use as destination a Pub/Sub topic to ingest the logs into the security information and event. management (SIEM) on-premises, and ensure that the right team can access the SIEM.3. Grant the Viewer role at organization level to the security operations team. (correct answer)
  • C1. Enable network logs and data access logs for all resources in the "Production" folder.2. Do not create log sinks to avoid unnecessary costs and latency.3. Grant the roles "Logs Viewer" and "Browser" at project level to the security operations team.
  • D1. Create one sink for the "Production" folder that includes child resources and one sink for the logs ingested at the organization level that excludes child resources.2. As destination, use a log bucket with a minimum retention period of 90 days in a project that can be accessed by the security team.3. Grant the security operations team the role of Security Reviewer at organization level.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: 1. Create one log sink at the organization level that includes all the child resources.2. Use as destination a Pub/Sub topic to ingest the logs into the security information and event. management (SIEM) on-premises, a...

Explanation

Pub/Sub is a serverless, global messaging service that decouples services and ingests high-volume event streams.

PCSE Question 202

Single page →
Topic 1 · Question 202

Your Google Cloud organization allows for administrative capabilities to be distributed to each team through provision of a Google Cloud project with Owner role (roles/owner). The organization contains thousands of Google Cloud projects. Security Command Center Premium has surfaced multiple OPEN_MYSQL_PORT findings. You are enforcing the guardrails and need to prevent these types of common misconfigurations. What should you do?

  • ACreate a hierarchical firewall policy configured at the organization to deny all connections from 0.0.0.0/0.
  • BCreate a hierarchical firewall policy configured at the organization to allow connections only from internal IP ranges. (correct answer)
  • CCreate a Google Cloud Armor security policy to deny traffic from 0.0.0.0/0.
  • DCreate a firewall rule for each virtual private cloud (VPC) to deny traffic from 0.0.0.0/0 with priority 0.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create a hierarchical firewall policy configured at the organization to allow connections only from internal IP ranges.

PCSE Question 203

Single page →
Topic 1 · Question 203

Your organization must comply with the regulation to keep instance logging data within Europe. Your workloads will be hosted in the Netherlands in region europe-west4 in a new project. You must configure Cloud Logging to keep your data in the country. What should you do?

  • AConfigure the organization policy constraint gcp.resourceLocations to europe-west4.
  • BConfigure log sink to export all logs into a Cloud Storage bucket in europe-west4.
  • CCreate a new log bucket in europe-west4, and redirect the _Default bucket to the new bucket. (correct answer)
  • DSet the logging storage region to europe-west4 by using the gcloud CLI logging settings update.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create a new log bucket in europe-west4, and redirect the _Default bucket to the new bucket.

PCSE Question 204

Single page →
Topic 1 · Question 204

You are using Security Command Center (SCC) to protect your workloads and receive alerts for suspected security breaches at your company. You need to detect cryptocurrency mining software. Which SCC service should you use?

  • AVirtual Machine Threat Detection (correct answer)
  • BContainer Threat Detection
  • CRapid Vulnerability Detection
  • DWeb Security Scanner
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Virtual Machine Threat Detection.

PCSE Question 205

Single page →
Topic 1 · Question 205 · Select all that apply

You are running applications outside Google Cloud that need access to Google Cloud resources. You are using workload identity federation to grant external identities Identity and Access Management (IAM) roles to eliminate the maintenance and security burden associated with service account keys. You must protect against attempts to spoof another user's identity and gain unauthorized access to Google Cloud resources. What should you do? (Choose two.)

  • AEnable data access logs for IAM APIs.
  • BLimit the number of external identities that can impersonate a service account.
  • CUse a dedicated project to manage workload identity pools and providers. (correct answer)
  • DUse immutable attributes in attribute mappings. (correct answer)
  • ELimit the resources that a service account can access.
Reveal answer & explanation
Correct answer: C, D

The correct answer is C, D. Option C: Use a dedicated project to manage workload identity pools and providers. Option D: Use immutable attributes in attribute mappings.

Explanation

Workload Identity Federation lets workloads access Google Cloud without long-lived service account keys.

PCSE Question 206

Single page →
Topic 1 · Question 206 · Select all that apply

You manage a BigQuery analytical data warehouse in your organization. You want to keep data for all your customers in a common table while you also restrict query access based on rows and columns permissions. Non-query operations should not be supported. What should you do? (Choose two.)

  • ACreate row-level access policies to restrict the result data when you run queries with the filter expression set to TRUE.
  • BConfigure column-level encryption by using Authenticated Encryption with Associated Data (AEAD) functions with Cloud Key Management Service (KMS) to control access to columns at query runtime.
  • CCreate row-level access policies to restrict the result data when you run queries with the filter expression set to FALSE. (correct answer)
  • DConfigure dynamic data masking rules to control access to columns at query runtime.
  • ECreate column-level policy tags to control access to columns at query runtime. (correct answer)
Reveal answer & explanation
Correct answer: C, E

The correct answer is C, E. Option C: Create row-level access policies to restrict the result data when you run queries with the filter expression set to FALSE. Option E: Create column-level policy tags to control access to columns at query runtime.

PCSE Question 207

Single page →
Topic 1 · Question 207 · Select all that apply

Your DevOps team uses Packer to build Compute Engine images by using this process: 1. Create an ephemeral Compute Engine VM. 2. Copy a binary from a Cloud Storage bucket to the VM's file system. 3. Update the VM's package manager. 4. Install external packages from the internet onto the VM. Your security team just enabled the organizational policy, constraints/ compute.vmExternalIpAccess, to restrict the usage of public IP Addresses on VMs. In response, your DevOps team updated their scripts to remove public IP addresses on the Compute Engine VMs; however, the build pipeline is failing due to connectivity issues. What should you do? (Choose two.)

  • AProvision an HTTP load balancer with the VM in an unmanaged instance group to allow inbound connections from the internet to your VM.
  • BProvision a Cloud NAT instance in the same VPC and region as the Compute Engine VM. (correct answer)
  • CEnable Private Google Access on the subnet that the Compute Engine VM is deployed within. (correct answer)
  • DUpdate the VPC routes to allow traffic to and from the internet.
  • EProvision a Cloud VPN tunnel in the same VPC and region as the Compute Engine VM.
Reveal answer & explanation
Correct answer: B, C

The correct answer is B, C. Option B: Provision a Cloud NAT instance in the same VPC and region as the Compute Engine VM. Option C: Enable Private Google Access on the subnet that the Compute Engine VM is deployed within.

Explanation

Compute Engine provides configurable virtual machines when you need full control of the OS. Cloud NAT lets private instances reach the internet for outbound traffic without external IPs. Private Google Access lets internal instances reach Google APIs without external IPs.

PCSE Question 208

Single page →
Topic 1 · Question 208

Your organization recently activated the Security Command Center (SCC) standard tier. There are a few Cloud Storage buckets that were accidentally made accessible to the public. You need to investigate the impact of the incident and remediate it. What should you do?

  • A1. Remove the Identity and Access Management (IAM) granting access to all Users from the buckets.2. Apply the organization policy storage.uniformBucketLevelAccess to prevent regressions.3. Query the data access logs to report on unauthorized access.
  • B1. Change permissions to limit access for authorized users.2. Enforce a VPC Service Controls perimeter around all the production projects to immediately stop any unauthorized access.3. Review the administrator activity audit logs to report on any unauthorized access.
  • C1. Change the bucket permissions to limit access.2. Query the bucket's usage logs to report on unauthorized access to the data.3. Enforce the organization policy storage.publicAccessPrevention to avoid regressions. (correct answer)
  • D1. Change bucket permissions to limit access.2. Query the data access audit logs for any unauthorized access to the buckets.3. After the misconfiguration is corrected, mute the finding in the Security Command Center.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: 1. Change the bucket permissions to limit access.2. Query the bucket's usage logs to report on unauthorized access to the data.3. Enforce the organization policy storage.publicAccessPrevention to avoid regressions.

Explanation

Organization Policy sets guardrails that constrain how resources can be configured across the org.

PCSE Question 209

Single page →
Topic 1 · Question 209 · Select all that apply

Your organization is transitioning to Google Cloud. You want to ensure that only trusted container images are deployed on Google Kubernetes Engine (GKE) clusters in a project. The containers must be deployed from a centrally managed Container Registry and signed by a trusted authority. What should you do? (Choose two.)

  • AEnable Container Threat Detection in the Security Command Center (SCC) for the project.
  • BConfigure the trusted image organization policy constraint for the project.
  • CCreate a custom organization policy constraint to enforce Binary Authorization for Google Kubernetes Engine (GKE). (correct answer)
  • DEnable PodSecurity standards, and set them to Restricted.
  • EConfigure the Binary Authorization policy with respective attestations for the project. (correct answer)
Reveal answer & explanation
Correct answer: C, E

The correct answer is C, E. Option C: Create a custom organization policy constraint to enforce Binary Authorization for Google Kubernetes Engine (GKE). Option E: Configure the Binary Authorization policy with respective attestations for the project.

Explanation

Google Kubernetes Engine runs managed Kubernetes for containerized, portable workloads. Google Kubernetes Engine runs managed Kubernetes for containerized workloads. Organization Policy sets guardrails that constrain how resources can be configured across the org.

PCSE Question 210

Single page →
Topic 1 · Question 210

Your company uses Google Cloud and has publicly exposed network assets. You want to discover the assets and perform a security audit on these assets by using a software tool in the least amount of time. What should you do?

  • ARun a platform security scanner on all instances in the organization.
  • BIdentify all external assets by using Cloud Asset Inventory, and then run a network security scanner against them. (correct answer)
  • CContact a Google approved security vendor to perform the audit.
  • DNotify Google about the pending audit, and wait for confirmation before performing the scan.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Identify all external assets by using Cloud Asset Inventory, and then run a network security scanner against them.

PCSE Question 211

Single page →
Topic 1 · Question 211 · Select all that apply

Your organization wants to be compliant with the General Data Protection Regulation (GDPR) on Google Cloud. You must implement data residency and operational sovereignty in the EU. What should you do? (Choose two.)

  • ALimit the physical location of a new resource with the Organization Policy Service "resource locations constraint." (correct answer)
  • BUse Cloud IDS to get east-west and north-south traffic visibility in the EU to monitor intra-VPC and inter-VPC communication.
  • CLimit Google personnel access based on predefined attributes such as their citizenship or geographic location by using Key Access Justifications. (correct answer)
  • DUse identity federation to limit access to Google Cloud resources from non-EU entities.
  • EUse VPC Flow Logs to monitor intra-VPC and inter-VPC traffic in the EU.
Reveal answer & explanation
Correct answer: A, C

The correct answer is A, C. Option A: Limit the physical location of a new resource with the Organization Policy Service "resource locations constraint." Option C: Limit Google personnel access based on predefined attributes such as their citizenship or geographic location by using Key Access Justifications.

Explanation

Organization Policy sets guardrails that constrain how resources can be configured across the org.

PCSE Question 212

Single page →
Topic 1 · Question 212

Your company is moving to Google Cloud. You plan to sync your users first by using Google Cloud Directory Sync (GCDS). Some employees have already created Google Cloud accounts by using their company email addresses that were created outside of GCDS. You must create your users on Cloud Identity. What should you do?

  • AConfigure GCDS and use GCDS search rules to sync these users.
  • BUse the transfer tool to migrate unmanaged users. (correct answer)
  • CWrite a custom script to identify existing Google Cloud users and call the Admin SDK: Directory API to transfer their account.
  • DConfigure GCDS and use GCDS exclusion rules to ensure users are not suspended.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Use the transfer tool to migrate unmanaged users.

PCSE Question 213

Single page →
Topic 1 · Question 213

Your organization is using GitHub Actions as a continuous integration and delivery (CI/CD) platform. You must enable access to Google Cloud resources from the CI/CD pipelines in the most secure way. What should you do?

  • ACreate a service account key, and add it to the GitHub pipeline configuration file.
  • BCreate a service account key, and add it to the GitHub repository content.
  • CConfigure a Google Kubernetes Engine cluster that uses Workload Identity to supply credentials to GitHub.
  • DConfigure workload identity federation to use GitHub as an identity pool provider. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Configure workload identity federation to use GitHub as an identity pool provider.

Explanation

Workload Identity Federation lets workloads access Google Cloud without long-lived service account keys.

PCSE Question 214

Single page →
Topic 1 · Question 214

Your organization processes sensitive health information. You want to ensure that data is encrypted while in use by the virtual machines (VMs). You must create a policy that is enforced across the entire organization. What should you do?

  • AImplement an organization policy that ensures that all VM resources created across your organization use customer-managed encryption keys (CMEK) protection.
  • BImplement an organization policy that ensures all VM resources created across your organization are Confidential VM instances. (correct answer)
  • CImplement an organization policy that ensures that all VM resources created across your organization use Cloud External Key Manager (EKM) protection.
  • DNo action is necessary because Google encrypts data while it is in use by default.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Implement an organization policy that ensures all VM resources created across your organization are Confidential VM instances.

Explanation

Organization Policy sets guardrails that constrain how resources can be configured across the org.

PCSE Question 215

Single page →
Topic 1 · Question 215

You are a Cloud Identity administrator for your organization. In your Google Cloud environment, groups are used to manage user permissions. Each application team has a dedicated group. Your team is responsible for creating these groups and the application teams can manage the team members on their own through the Google Cloud console. You must ensure that the application teams can only add users from within your organization to their groups. What should you do?

  • AChange the configuration of the relevant groups in the Google Workspace Admin console to prevent external users from being added to the group. (correct answer)
  • BSet an Identity and Access Management (IAM) policy that includes a condition that restricts group membership to user principals that belong to your organization.
  • CDefine an Identity and Access Management (IAM) deny policy that denies the assignment of principals that are outside your organization to the groups in scope.
  • DExport the Cloud Identity logs to BigQuery. Configure an alert for external members added to groups. Have the alert trigger a Cloud Function instance that removes the external members from the group.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Change the configuration of the relevant groups in the Google Workspace Admin console to prevent external users from being added to the group.

PCSE Question 216

Single page →
Topic 1 · Question 216

Your organization wants to be continuously evaluated against CIS Google Cloud Computing Foundations Benchmark v1.3.0 (CIS Google Cloud Foundation 1.3). Some of the controls are irrelevant to your organization and must be disregarded in evaluation. You need to create an automated system or process to ensure that only the relevant controls are evaluated. What should you do?

  • AMark all security findings that are irrelevant with a tag and a value that indicates a security exception. Select all marked findings, and mute them on the console every time they appear. Activate Security Command Center (SCC) Premium.
  • BActivate Security Command Center (SCC) Premium. Create a rule to mute the security findings in SCC so they are not evaluated. (correct answer)
  • CDownload all findings from Security Command Center (SCC) to a CSV file. Mark the findings that are part of CIS Google Cloud Foundation 1.3 in the file. Ignore the entries that are irrelevant and out of scope for the company.
  • DAsk an external audit company to provide independent reports including needed CIS benchmarks. In the scope of the audit, clarify that some of the controls are not needed and must be disregarded.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Activate Security Command Center (SCC) Premium. Create a rule to mute the security findings in SCC so they are not evaluated.

Explanation

Security Command Center centralizes security findings, threats, and compliance posture.

PCSE Question 217

Single page →
Topic 1 · Question 217

You are routing all your internet facing traffic from Google Cloud through your on-premises internet connection. You want to accomplish this goal securely and with the highest bandwidth possible. What should you do?

  • ACreate an HA VPN connection to Google Cloud. Replace the default 0.0.0.0/0 route.
  • BCreate a routing VM in Compute Engine. Configure the default route with the VM as the next hop.
  • CConfigure Cloud Interconnect with HA VPN. Replace the default 0.0.0.0/0 route to an on-premises destination.
  • DConfigure Cloud Interconnect and route traffic through an on-premises firewall. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Configure Cloud Interconnect and route traffic through an on-premises firewall.

Explanation

Cloud Interconnect provides a dedicated, private, high-bandwidth link between on premises and Google Cloud.

PCSE Question 218

Single page →
Topic 1 · Question 218

Your organization uses Google Workspace Enterprise Edition for authentication. You are concerned about employees leaving their laptops unattended for extended periods of time after authenticating into Google Cloud. You must prevent malicious people from using an employee's unattended laptop to modify their environment. What should you do?

  • ACreate a policy that requires employees to not leave their sessions open for long durations.
  • BReview and disable unnecessary Google Cloud APIs.
  • CRequire strong passwords and 2SV through a security token or Google authenticator.
  • DSet the session length timeout for Google Cloud services to a shorter duration. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Set the session length timeout for Google Cloud services to a shorter duration.

PCSE Question 219

Single page →
Topic 1 · Question 219 · Select all that apply

You are migrating an on-premises data warehouse to BigQuery, Cloud SQL, and Cloud Storage. You need to configure security services in the data warehouse. Your company compliance policies mandate that the data warehouse must: • Protect data at rest with full lifecycle management on cryptographic keys. • Implement a separate key management provider from data management. • Provide visibility into all encryption key requests. What services should be included in the data warehouse implementation? (Choose two.)

  • ACustomer-managed encryption keys
  • BCustomer-Supplied Encryption Keys
  • CKey Access Justifications (correct answer)
  • DAccess Transparency and Approval
  • ECloud External Key Manager (correct answer)
Reveal answer & explanation
Correct answer: C, E

The correct answer is C, E. Option C: Key Access Justifications Option E: Cloud External Key Manager.

PCSE Question 220

Single page →
Topic 1 · Question 220

You manage one of your organization's Google Cloud projects (Project A). A VPC Service Control (SC) perimeter is blocking API access requests to this project, including Pub/Sub. A resource running under a service account in another project (Project B) needs to collect messages from a Pub/Sub topic in your project. Project B is not included in a VPC SC perimeter. You need to provide access from Project B to the Pub/Sub topic in Project A using the principle of least privilege. What should you do?

  • AConfigure an ingress policy for the perimeter in Project A, and allow access for the service account in Project B to collect messages. (correct answer)
  • BCreate an access level that allows a developer in Project B to subscribe to the Pub/Sub topic that is located in Project A.
  • CCreate a perimeter bridge between Project A and Project B to allow the required communication between both projects.
  • DRemove the Pub/Sub API from the list of restricted services in the perimeter configuration for Project A.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Configure an ingress policy for the perimeter in Project A, and allow access for the service account in Project B to collect messages.

Explanation

A service account provides an identity for workloads to access Google Cloud APIs securely.

Showing questions 201–220 of 356 · Page 11 of 18