🔍

PCSE — questions

Page 16 of 18 · 356 total questions.

PCSE Question 301

Single page →
Topic 1 · Question 301

Your organization is implementing separation of duties in a Google Cloud project. A group of developers must deploy new code, but cannot have permission to change network firewall rules. What should you do?

  • AAssign the network administrator IAM role to all developers. Tell developers not to change firewall settings.
  • BUse Access Context Manager to create conditions that allow only authorized administrators to change firewall rules based on attributes such as IP address or device security posture.
  • CCreate and assign two custom IAM roles. Assign the deployer role to control Compute Engine and deployment-related permissions. Assign the network administrator role to manage firewall permissions. (correct answer)
  • DGrant the editor IAM role to the developer group. Explicitly negate any firewall modification permissions by using IAM deny policies.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create and assign two custom IAM roles. Assign the deployer role to control Compute Engine and deployment-related permissions. Assign the network administrator role to manage firewall permissions.

Explanation

Compute Engine provides configurable virtual machines when you need full control of the OS. Cloud IAM grants fine-grained, least-privilege access to Google Cloud resources.

PCSE Question 302

Single page →
Topic 1 · Question 302

You manage a Google Cloud organization with many projects located in various regions around the world. The projects are protected by the same Access Context Manager access policy. You created a new folder that will host two projects that process protected health information (PHI) for US-based customers. The two projects will be separately managed and require stricter protections. You are setting up the VPC Service Controls configuration for the new folder. You must ensure that only US-based personnel can access these projects and restrict Google Cloud API access to only BigQuery and Cloud Storage within these projects. What should you do?

  • A• Create a scoped access policy, add the new folder under “Select resources to include in the policy,” and assign an administrator under “Manage principals.”• For the service perimeter, specify the two new projects as “Resources to protect” in the service perimeter configuration.• Set “Restricted services” to “all services,” set “VPC accessible services” to “Selected services,” and specify only BigQuery and Cloud Storage under “Selected services.”
  • B• Enable Identity Aware Proxy in the new projects.• Create an Access Context Manager access level with an “IP Subnetworks” attribute condition set to the US-based corporate IP range.• Enable the “Restrict Resource Service Usage” organization policy at the new folder level with an “Allow” policy type and set both “storage.googleapis.com” and “bigquery.googleapis.com” under “Custom values.”
  • C• Edit the organization-level access policy and add the new folder under “Select resources to include in the policy.”• Specify the two new projects as “Resources to protect” in the service perimeter configuration.• Set “Restricted services” to “all services,” set “VPC accessible services” to “Selected services,” and specify only BigQuery and Cloud Storage.• Edit the existing access level to add a “Geographic locations” condition set to “US.” (correct answer)
  • D• Configure a Cloud Interconnect connection or a Virtual Private Network (VPN) between the on-premises environment and the Google Cloud organization.• Configure the VPC firewall policies within the new projects to only allow connections from the on-premises IP address range.• Enable the Restrict Resource Service Usage organization policy on the new folder with an “Allow” policy type, and set both “storage.googleapis.com” and “bigquery.googleapis.com” under “Custom values.”
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: • Edit the organization-level access policy and add the new folder under “Select resources to include in the policy.”• Specify the two new projects as “Resources to protect” in the service perimeter configuration.• Se...

Explanation

Cloud Storage provides durable, scalable object storage that is fully managed. BigQuery is a serverless, petabyte-scale data warehouse for fast SQL analytics with no infrastructure to manage. A VPC provides a global, software-defined private network for your Google Cloud resources.

PCSE Question 303

Single page →
Topic 1 · Question 303

There is a threat actor that is targeting organizations like yours. Attacks are always initiated from a known IP address range. You want to deny-list those IPs for your website, which is exposed to the internet through an Application Load Balancer. What should you do?

  • ACreate a Cloud Armor policy with a deny-rule for the known IP address range. Attach the policy to the backend of the Application Load Balancer. (correct answer)
  • BActivate Identity-Aware Proxy for the backend of the Application Load Balancer. Create a firewall rule that only allows traffic from the proxy to the application.
  • CCreate a log sink with a filter containing the known IP address range. Trigger an alert that detects when the Application Load Balancer is accessed from those IPs.
  • DCreate a Cloud Firewall policy with a deny-rule for the known IP address range. Associate the firewall policy to the Virtual Private Cloud with the application backend.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a Cloud Armor policy with a deny-rule for the known IP address range. Attach the policy to the backend of the Application Load Balancer.

Explanation

A load balancer distributes traffic across healthy backends in multiple zones for availability and scale. Cloud Armor protects applications from DDoS and common web attacks with WAF rules.

PCSE Question 304

Single page →
Topic 1 · Question 304

You are managing a Google Cloud environment that is organized into folders that represent different teams. These teams need the flexibility to modify organization policies relevant to their work. You want to grant the teams the necessary permissions while upholding Google-recommended security practices and minimizing administrative complexity. What should you do?

  • ACreate a custom IAM role with the organization policy administrator permission and grant the permission to each team’s folder. Limit policy modifications based on folder names within the custom role’s definition.
  • BAssign the organization policy administrator role to a central service account and provide teams with the credentials to use the service account when needed.
  • CCreate an organization-level tag. Attach the tag to relevant folders. Use an IAM condition to restrict the organization policy administrator role to resources with that tag. (correct answer)
  • DGrant each team the organization policy administrator role at the organization level.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create an organization-level tag. Attach the tag to relevant folders. Use an IAM condition to restrict the organization policy administrator role to resources with that tag.

Explanation

Cloud IAM grants fine-grained, least-privilege access to Google Cloud resources. Organization Policy sets guardrails that constrain how resources can be configured across the org.

PCSE Question 305

Single page →
Topic 1 · Question 305

Your organization is using Vertex AI Workbench Instances. You must ensure that newly deployed Instances are automatically kept up-to-date and that users cannot accidentally alter settings in the operating system. What should you do?

  • AEnforce the disableRootAccesa and requireAutoUpgradeSchedule organization policies for newly deployed Instances. (correct answer)
  • BEnable the VM Manager and ensure the corresponding Google Compute Engine instances are added.
  • CImplement a firewall rule that prevents Secure Shell access to the corresponding Google Compute Engine instances by using tags.
  • DAssign the AI Notebooks Runner and AI Notebooks Viewer roles to the users of the AI Workbench Instances.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Enforce the disableRootAccesa and requireAutoUpgradeSchedule organization policies for newly deployed Instances.

PCSE Question 306

Single page →
Topic 1 · Question 306

You must ensure that the keys used for at-rest encryption of your data are compliant with your organization's security controls. One security control mandates that keys get rotated every 90 days. You must implement an effective detection strategy to validate if keys are rotated as required. What should you do?

  • AAnalyze the crypto key versions of the keys by using data from Cloud Asset Inventory. If an active key is older than 90 days, send an alert message through your incident notification channel.
  • BAssess the keys in the Cloud Key Management Service by implementing code in Cloud Run. If a key is not rotated after 90 days, raise a finding in Security Command Center.
  • CDefine a metric that checks for timely key updates by using Cloud Logging. If a key is not rotated after 90 days, send an alert message through your incident notification channel.
  • DIdentify keys that have not been rotated by using Security Health Analytics. If a key is not rotated after 90 days, a finding in Security Command Center is raised. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Identify keys that have not been rotated by using Security Health Analytics. If a key is not rotated after 90 days, a finding in Security Command Center is raised.

Explanation

Security Command Center centralizes security findings, threats, and compliance posture.

PCSE Question 307

Single page →
Topic 1 · Question 307

Your organization is developing a sophisticated machine learning (ML) model to predict customer behavior for targeted marketing campaigns. The BigQuery dataset used for training includes sensitive personal information. You must design the security controls around the AI/ML pipeline. Data privacy must be maintained throughout the model’s lifecycle and you must ensure that personal data is not used in the training process. Additionally, you must restrict access to the dataset to an authorized subset of people only. What should you do?

  • ADe-identify sensitive data before model training by using Cloud Data Loss Prevention (DLP)APIs. and implement strict Identity and Access Management (IAM) policies to control access to BigQuery. (correct answer)
  • BImplement Identity-Aware Proxy to enforce context-aware access to BigQuery and models based on user identity and device.
  • CImplement at-rest encryption by using customer-managed encryption keys (CMEK) for the pipeline. Implement strict Identity and Access Management (IAM) policies to control access to BigQuery.
  • DDeploy the model on Confidential VMs for enhanced protection of data and code while in use. Implement strict Identity and Access Management (IAM) policies to control access to BigQuery.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: De-identify sensitive data before model training by using Cloud Data Loss Prevention (DLP)APIs. and implement strict Identity and Access Management (IAM) policies to control access to BigQuery.

Explanation

BigQuery is a serverless, petabyte-scale data warehouse for fast SQL analytics with no infrastructure to manage. Cloud IAM grants fine-grained, least-privilege access to Google Cloud resources.

PCSE Question 308

Single page →
Topic 1 · Question 308

Your organization wants to publish yearly reports of your website usage analytics. You must ensure that no data with personally identifiable information (PII) is published by using the Cloud Data Loss Prevention (Cloud DLP) API. Data integrity must be preserved. What should you do?

  • ADetect all PII in storage by using the Cloud DLP API. Create a cloud function to delete the PII.
  • BDiscover and quarantine your PII data in your storage by using the Cloud DLP API.
  • CDiscover and transform PII data in your reports by using the Cloud DLP API. (correct answer)
  • DEncrypt the PII from the report by using the Cloud DLP API.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Discover and transform PII data in your reports by using the Cloud DLP API.

PCSE Question 309

Single page →
Topic 1 · Question 309

Your development team is launching a new application. The new application has a microservices architecture on Compute Engine instances and serverless components, including Cloud Functions. This application will process financial transactions that require temporary, highly sensitive data in memory. You need to secure data in use during computations with a focus on minimizing the risk of unauthorized access to memory for this financial application. What should you do?

  • AEnable Confidential VM instances for Compute Engine, and ensure that relevant Cloud Functions can leverage hardware-based memory isolation. (correct answer)
  • BUse data masking and tokenization techniques on sensitive financial data fields throughout the application and the application's data processing workflows.
  • CUse the Cloud Data Loss Prevention (Cloud DLP) API to scan and mask sensitive data before feeding the data into any compute environment.
  • DStore all sensitive data during processing in Cloud Storage by using customer-managed encryption keys (CMEK), and set strict bucket-level permissions.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Enable Confidential VM instances for Compute Engine, and ensure that relevant Cloud Functions can leverage hardware-based memory isolation.

Explanation

Cloud Functions runs event-driven code without managing servers and scales automatically. Compute Engine provides configurable virtual machines when you need full control of the OS.

PCSE Question 310

Single page →
Topic 1 · Question 310

You work for a financial organization in a highly regulated industry that is subject to active regulatory compliance. To meet compliance requirements, you need to continuously maintain a specific set of configurations, data residency, organizational policies, and personnel data access controls. What should you do?

  • AApply an organizational policy constraint at the organization level to limit the location of new resource creation.
  • BCreate an Assured Workloads folder for your required compliance program to apply defined controls and requirements. (correct answer)
  • CGo to the Compliance page in Security Command Center. View the report for your status against the required compliance standard. Triage violations to maintain compliance on a regular basis.
  • DCreate a posture.yaml file with the required security compliance posture. Apply the posture with the gcloud scc postures createPOSTURE_NAME --posture-from-file=posture.yaml command in Security Command Center Premium.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create an Assured Workloads folder for your required compliance program to apply defined controls and requirements.

PCSE Question 311

Single page →
Topic 1 · Question 311

Your organization is worried about recent news headlines regarding application vulnerabilities in production applications that have led to security breaches. You want to automatically scan your deployment pipeline for vulnerabilities and ensure only scanned and verified containers can run in the environment. What should you do?

  • AUse Kubernetes role-based access control (RBAC) as the source of truth for cluster access by granting “container.clusters.get” to limited users. Restrict deployment access by allowing these users to generate a kubeconfig file containing the configuration access to the GKE cluster.
  • BUse gcloud artifacts docker images describe LOCATION-docker.pkg.dev/PROJECT_ID/REPOSITORY/IMAGE_ID@sha256:HASH --show-package-vulnerability in your CI/CD pipeline, and trigger a pipeline failure for critical vulnerabilities.
  • CEnforce the use of Cloud Code for development so users receive real-time security feedback on vulnerable libraries and dependencies before they check in their code.
  • DEnable Binary Authorization and create attestations of scans. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Enable Binary Authorization and create attestations of scans.

PCSE Question 312

Single page →
Topic 1 · Question 312

A team at your organization collects logs in an on-premises security information and event management system (SIEM). You must provide a subset of Google Cloud logs for the SIEM, and minimize the risk of data exposure in your cloud environment. What should you do?

  • ACreate a new BigQuery dataset. Stream all logs to this dataset. Provide the on-premises SIEM system access to the data in BigQuery by using workload identity federation and let the SIEM team filter for the relevant log data.
  • BDefine a log view for the relevant logs. Provide access to the log view to a principal from your on-premises identity provider by using workforce identity federation.
  • CCreate a log sink for the relevant logs. Send the logs to Pub/Sub. Retrieve the logs from Pub/Sub and push the logs to the SIEM by using Dataflow. (correct answer)
  • DFilter for the relevant logs. Store the logs in a Cloud Storage bucket. Grant the service account access to the bucket. Provide the service account key to the SIEM team.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create a log sink for the relevant logs. Send the logs to Pub/Sub. Retrieve the logs from Pub/Sub and push the logs to the SIEM by using Dataflow.

Explanation

Dataflow runs serverless Apache Beam pipelines for stream and batch data processing with autoscaling. Pub/Sub is a serverless, global messaging service that decouples services and ingests high-volume event streams.

PCSE Question 313

Single page →
Topic 1 · Question 313

Your Google Cloud organization is subdivided into three folders: production, development, and networking, Networking resources for the organization are centrally managed in the networking folder. You discovered that projects in the production folder are attaching to Shared VPCs that are outside of the networking folder which could become a data exfiltration risk. You must resolve the production folder issue without impacting the development folder. You need to use the most efficient and least disruptive approach. What should you do?

  • AEnable the Restrict Shared VPC Host Projects organization policy on the production folder. Create a custom rule and configure the policy type to Allow. In the Custom value section, enter under:folders/networking. (correct answer)
  • BEnable the Restrict Shared VPC Host Projects organization policy on the networking folder only. Create a new custom rule and configure the policy type to Allow. In the Custom value section, enter under:organizations/123456739123.
  • CEnable the Restrict Shared VPC Host Projects organization policy at the project level for each of the production projects. Create a custom rule and configure the policy type to Allow. In the Custom value section, enter under:folders/networking.
  • DEnable the Restrict Shared VPC Host Projects organization policy at the organization level. Create a custom rule and configure the policy type to Allow. In the Custom value section, enter under:folders/networking.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Enable the Restrict Shared VPC Host Projects organization policy on the production folder. Create a custom rule and configure the policy type to Allow. In the Custom value section, enter under:folders/networking.

Explanation

Shared VPC centralizes network administration by sharing one VPC across multiple projects. A VPC provides a global, software-defined private network for your Google Cloud resources. Organization Policy sets guardrails that constrain how resources can be configured across the org.

PCSE Question 314

Single page →
Topic 1 · Question 314

Your organization operates in a highly regulated environment and has a stringent set of compliance requirements for protecting customer data. You must encrypt data while in use to meet regulations. What should you do?

  • AEnable the use of customer-supplied encryption keys (CSEK) keys in the Google Compute Engine VMs to give your organization maximum control over their VM disk encryption.
  • BEstablish a trusted execution environment with a Confidential VM. (correct answer)
  • CUse a Shielded VM to ensure a secure boot with integrity monitoring for the application environment.
  • DUse customer-managed encryption keys (CMEK) and Cloud KSM to enable your organization to control their keys for data encryption in Cloud SQL.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Establish a trusted execution environment with a Confidential VM.

PCSE Question 315

Single page →
Topic 1 · Question 315

Your organization is building a real-time recommendation engine using ML models that process live user activity data stored in BigQuery and Cloud Storage. Each new model developed is saved to Artifact Registry. This new system deploys models to Google Kubernetes Engine, and uses Pub/Sub for message queues. Recent industry news have been reporting attacks exploiting ML model supply chains. You need to enhance the security in this serverless architecture, specifically against risks to the development and deployment pipeline. What should you do?

  • AEnable container image vulnerability scanning during development and pre-deployment. Enforce Binary Authorization on images deployed from Artifact Registry to your continuous integration and continuous deployment (CVCD) pipeline. (correct answer)
  • BThoroughly sanitize all training data prior to model development to reduce risk of poisoning attacks. Use IAM for authorization, and apply role-based restrictions to code repositories and cloud services.
  • CLimit external libraries and dependencies that are used for the ML models as much as possible. Continuously rotate encryption keys that are used to access the user data from BigQuery and Cloud Storage.
  • DDevelop strict firewall rules to limit external traffic to Cloud Run instances. Integrate intrusion detection systems (IDS) for real-time anomaly detection on Pub/Sub message flows.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Enable container image vulnerability scanning during development and pre-deployment. Enforce Binary Authorization on images deployed from Artifact Registry to your continuous integration and continuous deployment (CVC...

Explanation

Artifact Registry stores and manages container images and language packages. This option meets the real-time / low-latency performance requirement.

PCSE Question 316

Single page →
Topic 1 · Question 316

You want to set up a secure, internal network within Google Cloud for database servers. The servers must not have any direct communication with the public internet. What should you do?

  • AAssign a private IP address to each database server. Use a NAT gateway to provide internet connectivity to the database servers.
  • BAssign a static public IP address to each database server. Use firewall rules to restrict external access.
  • CCreate a VPC with a private subnet. Assign a private IP address to each database server. (correct answer)
  • DAssign both a private IP address and a public IP address to each database server.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create a VPC with a private subnet. Assign a private IP address to each database server.

Explanation

A VPC provides a global, software-defined private network for your Google Cloud resources.

PCSE Question 317

Single page →
Topic 1 · Question 317

You work for a large organization that recently implemented a 100GB Cloud Interconnect connection between your Google Cloud and your on-premises edge router. While routinely checking the connectivity, you noticed that the connection is operational but there is an error message that indicates MACsec is operationally down. You need to resolve this error. What should you do?

  • AEnsure that the Cloud Interconnect connection supports MACsec.
  • BEnsure that the on-premises router is not down.
  • CEnsure that the active pre-shared key created for MACsec is not expired on both the on-premises and Google edge routers.
  • DEnsure that the active pre-shared key matches on both the on-premises and Google edge routers. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Ensure that the active pre-shared key matches on both the on-premises and Google edge routers.

PCSE Question 318

Single page →
Topic 1 · Question 318

Your organization must store highly sensitive data within Google Cloud. You need to design a solution that provides the strongest level of security and control. What should you do?

  • AUse Cloud Storage with customer-supplied encryption keys (CSEK), VPC Service Controls for network isolation, and Cloud DLP for data inspection.
  • BUse Cloud Storage with customer-managed encryption keys (CMEK), Cloud DLP for data classification, and Secret Manager for storing API access tokens.
  • CUse Cloud Storage with client-side encryption, Cloud KMS for key management, and Cloud HSM for cryptographic operations. (correct answer)
  • DUse Cloud Storage with server-side encryption, BigQuery with column-level encryption, and IAM roles for access control.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use Cloud Storage with client-side encryption, Cloud KMS for key management, and Cloud HSM for cryptographic operations.

Explanation

Cloud Storage provides durable, scalable object storage that is fully managed. Cloud KMS manages encryption keys and integrates with Google Cloud services for encryption. Cloud HSM provides hardware security modules for key protection to meet compliance.

PCSE Question 319

Single page →
Topic 1 · Question 319

The InfoSec team has mandated that all new Cloud Run jobs and services in production must have Binary Authorization enabled. You need to enforce this requirement. What should you do?

  • AConfigure an organization policy to require Binary Authorization enforcement on images deployed to Cloud Run. (correct answer)
  • BConfigure a Security Health Analytics (SHA) custom rule that prevents the execution of Cloud Run jobs and services without Binary Authorization.
  • CEnsure the Cloud Run admin role is not assigned to developers.
  • DConfigure a Binary Authorization custom policy that is not editable by developers and auto-attaches to all Cloud Run jobs and services.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Configure an organization policy to require Binary Authorization enforcement on images deployed to Cloud Run.

Explanation

Cloud Run runs stateless containers serverlessly and scales to zero, minimizing operational overhead. Organization Policy sets guardrails that constrain how resources can be configured across the org.

PCSE Question 320

Single page →
Topic 1 · Question 320

You are developing an application that runs on a Compute Engine VM. The application needs to access data stored in Cloud Storage buckets in other Google Cloud projects. The required access to the buckets is variable. You need to provide access to these resources while following Google- recommended practices. What should you do?

  • ALimit the VMs access to the Cloud Storage buckets by setting the relevant access scope of the VM.
  • BCreate IAM bindings for the VM’s service account and the required buckets that allow appropriate access to the data stored in the buckets. (correct answer)
  • CGrant the VM's service account access to the required buckets by using domain-wide delegation.
  • DCreate a group and assign IAM bindings to the group for each bucket that the application needs to access. Assign the VM's service account to the group.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create IAM bindings for the VM’s service account and the required buckets that allow appropriate access to the data stored in the buckets.

Explanation

A service account provides an identity for workloads to access Google Cloud APIs securely. Cloud IAM grants fine-grained, least-privilege access to Google Cloud resources.

Showing questions 301–320 of 356 · Page 16 of 18