🔍

PCSE — questions

Page 17 of 18 · 356 total questions.

PCSE Question 321

Single page →
Topic 1 · Question 321 · Select all that apply

Your organization strives to be a market leader in software innovation. You provided a large number of Google Cloud environments so developers can test the integration of Gemini in Vertex AI into their existing applications or create new projects. Your organization has 200 developers and a five-person security team. You must prevent and detect proper security policies across the Google Cloud environments. What should you do? (Choose two.)

  • AApply organization policy constraints. Detect and monitor drifts by using Security Health Analytics. (correct answer)
  • BPublish internal policies and clear guidelines to securely develop applications.
  • CUse Cloud Logging to create log filters to detect misconfigurations. Trigger Cloud Run functions to remediate misconfigurations.
  • DApply a predefined AI-recommended security posture template for Gemini in Vertex AI in Security Command Center Enterprise or Premium tiers. (correct answer)
  • EImplement the least privileged access Identity and Access Management roles to prevent misconfigurations.
Reveal answer & explanation
Correct answer: A, D

The correct answer is A, D. Option A: Apply organization policy constraints. Detect and monitor drifts by using Security Health Analytics. Option D: Apply a predefined AI-recommended security posture template for Gemini in Vertex AI in Security Command Center Enterprise or Premium tiers.

Explanation

Vertex AI is the unified managed platform to build, train, tune, deploy, and operate ML models. Security Command Center centralizes security findings, threats, and compliance posture. Organization Policy sets guardrails that constrain how resources can be configured across the org.

PCSE Question 322

Single page →
Topic 1 · Question 322

You are responsible for managing identities in your company’s Google Cloud organization. Employees are frequently using your organization's corporate domain name to create unmanaged Google accounts. You want to implement a practical and efficient solution to prevent employees from completing this action in the future. What should you do?

  • ACreate a Google Cloud identity for all users in your organization. Ensure that new users are added automatically. (correct answer)
  • BImplement an automated process that scans all identities in your organization and disables any unmanaged accounts.
  • CRegister a new domain for your Google Cloud resources. Move all existing identities and resources to this domain.
  • DSwitch your corporate email system to another domain to avoid using the same domain for Google Cloud identities and corporate emails.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a Google Cloud identity for all users in your organization. Ensure that new users are added automatically.

Explanation

Cloud Identity manages users, groups, and device policies as a managed identity platform.

PCSE Question 323

Single page →
Topic 1 · Question 323

Your organization leverages folders to represent different teams within your Google Cloud environment. To support Infrastructure as Code (IaC) practices, each team receives a dedicated service account upon onboarding. You want to ensure that teams have comprehensive permissions to manage resources within their assigned folders while adhering to the principle of least privilege. You must design the permissions for these team-based service accounts in the most effective way possible. What should you do?

  • AGrant each service account the folder administrator role on its respective folder. (correct answer)
  • BGrant each service account the project creator role at the organization level and use folder-level IAM conditions to restrict project creation to specific folders.
  • CAssign each service account the project editor role at the organization level and instruct teams to use IAM bindings at the folder level for fine-grained permissions.
  • DAssign each service account the folder IAM administrator role on its respective folder to allow teams to create and manage additional custom roles if needed.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Grant each service account the folder administrator role on its respective folder.

Explanation

A service account provides an identity for workloads to access Google Cloud APIs securely.

PCSE Question 324

Single page →
Topic 1 · Question 324

Your organization has a workload that is regulated by European laws. You must restrict the creation of resources outside of the EU for this specific workload. You must find an effective way to implement this security control without disrupting the other global applications. What should you do?

  • ACreate a Cloud Function triggered at asset creation that detects and deletes resources outside of the EU.
  • BCreate all your workload’s assets in a regional subnet in the EU in one project or folder.
  • CSegment your workload in the EU in one project or folder by using VPC Service Controls.
  • DImplement an organization policy that only allows the EU as the location for your workload’s project or folder. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Implement an organization policy that only allows the EU as the location for your workload’s project or folder.

Explanation

Organization Policy sets guardrails that constrain how resources can be configured across the org.

PCSE Question 325

Single page →
Topic 1 · Question 325

Your organization manages a critical web application that serves international customers on Google Cloud. An increase in malicious traffic targeting this application has strained resources and caused periods of downtime. You need to design security measures to increase the application's resilience against web attacks, enhance perimeter protection, and provide access control. What should you do?

  • AEmploy network load balancing for traffic distribution. Update Identity-Aware Proxy (IAP) policies to allow only administrative access. Implement custom firewall rules on all external IP addresses.
  • BSet up firewall rules on Compute Engine instances within the application's environment. Rely on load balancers for threat detection. Increase instance resources to cope with attack volume.
  • CConfigure firewall rules to block traffic from known malicious IP ranges. Set up Google Cloud Armor and implement Identity-Aware Proxy (IAP) for granular access control. (correct answer)
  • DAdd firewall rules that restrict all internal IP ranges. Establish Cloud DNS security policies. Disable external IP addresses to reduce the attack surface. Create user groups for access control.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Configure firewall rules to block traffic from known malicious IP ranges. Set up Google Cloud Armor and implement Identity-Aware Proxy (IAP) for granular access control.

Explanation

Cloud Armor protects applications from DDoS and common web attacks with WAF rules. Identity-Aware Proxy enforces per-request access control to apps without a VPN. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

PCSE Question 326

Single page →
Topic 1 · Question 326

Your organization deploys a large number of containerized applications on Google Kubernetes Engine (GKE). Node updates are currently applied manually. Audit findings show that a critical patch has not been installed due to a missed notification. You need to design a more reliable, cloud-first, and scalable process for node updates. What should you do?

  • AConfigure node auto-upgrades for node pools in the maintenance windows. (correct answer)
  • BDevelop a custom script to continuously check for patch availability, download patches, and apply the patches across all components of the cluster.
  • CMigrate the cluster infrastructure to a self-managed Kubernetes environment for greater control over the patching process.
  • DSchedule a daily reboot for all nodes to automatically upgrade.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Configure node auto-upgrades for node pools in the maintenance windows.

PCSE Question 327

Single page →
Topic 1 · Question 327

Your organization is migrating its primary web application from on-premises to Google Kubernetes Engine (GKE). You must advise the development team on how to grant their applications access to Google Cloud services from within GKE according to security recommended practices. What should you advise the development team to do?

  • AConfigure the GKE nodes to use the default Compute Engine service account.
  • BEnable Workload Identity for GKE. Assign a Kubernetes service account to the application and configure that Kubernetes service account to act as an Identity and Access Management (IAM) service account. Grant the required roles to the IAM service account. (correct answer)
  • CCreate a user-managed service account with only the roles required for the specific workload. Assign this service account to the GKE nodes.
  • DCreate an application-specific IAM service account and generate a user-managed service account key for it. Inject the key to the workload by storing it as a Kubernetes secret within the same namespace as the application.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Enable Workload Identity for GKE. Assign a Kubernetes service account to the application and configure that Kubernetes service account to act as an Identity and Access Management (IAM) service account. Grant the requi...

Explanation

Google Kubernetes Engine runs managed Kubernetes for containerized, portable workloads. Workload Identity Federation lets workloads access Google Cloud without long-lived service account keys. A service account provides an identity for workloads to access Google Cloud APIs securely.

PCSE Question 328

Single page →
Topic 1 · Question 328

Your organization’s application is being integrated with a partner application that requires read access to customer data to process customer orders. The customer data is stored in one of your Cloud Storage buckets. You have evaluated different options and determined that this activity requires the use of service account keys. You must advise the partner on how to minimize the risk of a compromised service account key causing a loss of data. What should you advise the partner to do?

  • AScan the Cloud Storage bucket with Sensitive Data Protection when new data is added, and automatically mask all customer data.
  • BDefine a VPC Service Controls perimeter, and restrict the Cloud Storage API. Add an ingress rule to the perimeter to allow access to the Cloud Storage API for the service account from outside of the perimeter.
  • CEnsure that all data for the application that is accessed through the relevant service accounts is encrypted at rest by using customer-managed encryption keys (CMEK).
  • DImplement a secret management service. Configure the service to frequently rotate the service account key. Configure proper access control to the key, and restrict who can create service account keys. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Implement a secret management service. Configure the service to frequently rotate the service account key. Configure proper access control to the key, and restrict who can create service account keys.

Explanation

A service account provides an identity for workloads to access Google Cloud APIs securely.

PCSE Question 329

Single page →
Topic 1 · Question 329

Your organization is implementing a new Python application that will be deployed on Cloud Run. The application needs to connect to a MySQL database that runs on Cloud SQL in a different project in your Google Cloud organization. You must secure the connection from the application to the Cloud SQL instance while minimizing management overhead. What should you do?

  • AUse a public IP address for the Cloud SQL instance. Integrate the Cloud SQL Python Connector into your application code to connect to the Cloud SQL instance.
  • BEnsure that the Cloud SQL instance doesn’t have a public IP address. Configure Cloud Run to use Cloud SQL Auth Proxy to connect to the Cloud SQL instance. (correct answer)
  • CEnsure that the Cloud SQL instance doesn't have a public IP address. Enforce SSL/TLS. Require the use of a trusted client certificate to connect to the Cloud SQL instance.
  • DEnsure that the Cloud SQL instance doesn’t have a public IP address. Configure the application's IP address as an authorized network to connect to the Cloud SQL instance.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Ensure that the Cloud SQL instance doesn’t have a public IP address. Configure Cloud Run to use Cloud SQL Auth Proxy to connect to the Cloud SQL instance.

Explanation

Cloud Run runs stateless containers serverlessly and scales to zero, minimizing operational overhead. Cloud SQL is a managed relational database (MySQL/PostgreSQL/SQL Server) that handles patching, backups, and failover.

PCSE Question 330

Single page →
Topic 1 · Question 330

Your organization has Google Cloud applications that require access to external web services. You must monitor, control, and log access to these services. What should you do?

  • ASet up a Secure Web Proxy that allows access to the specific external web services. Configure applications to use the proxy for the web service requests. (correct answer)
  • BSet up a Cloud NAT instance to allow egress traffic from your VPC.
  • CConfigure VPC firewall rules to allow the services to access the IP addresses of required external web services.
  • DConfigure Google Cloud Armor to monitor and protect your applications by checking incoming traffic patterns for attack patterns.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Set up a Secure Web Proxy that allows access to the specific external web services. Configure applications to use the proxy for the web service requests.

PCSE Question 331

Single page →
Topic 1 · Question 331

Your organization uses a microservices architecture based on Google Kubernetes Engine (GKE). Recent security reviews recommend tighter controls around deployed container images to reduce potential vulnerabilities and maintain compliance. You need to implement an automated system by using managed services to ensure that only approved container images are deployed to the GKE clusters. What should you do?

  • ADevelop custom organization policies that restrict GKE cluster deployments to container images hosted within a specific Artifact Registry project where your approved images reside.
  • BEnforce Binary Authorization in your GKE clusters. Integrate container image vulnerability scanning into the CI/CD pipeline and require vulnerability scan results to be used for Binary Authorization policy decisions. (correct answer)
  • CAutomatically deploy new container images upon successful CI/CD builds by using Cloud Build triggers. Set up firewall rules to limit and control access to instances to mitigate malware injection.
  • DBuild a system using third-party vulnerability databases and custom scripts to identify potential Common Vulnerabilities and Exposures (CVEs) in your container images. Prevent image deployment if the CVE impact score is beyond a specified threshold.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Enforce Binary Authorization in your GKE clusters. Integrate container image vulnerability scanning into the CI/CD pipeline and require vulnerability scan results to be used for Binary Authorization policy decisions.

Explanation

Google Kubernetes Engine runs managed Kubernetes for containerized, portable workloads.

PCSE Question 332

Single page →
Topic 1 · Question 332

Your organization has recently migrated sensitive customer data to Cloud Storage buckets. For compliance reasons, you must ensure that all vendor data access and administrative access by Google personnel is logged. What should you do?

  • AConfigure Data Access audit logs for Cloud Storage on the project hosting the Cloud Storage buckets.
  • BEnable Access Transparency for the organization. (correct answer)
  • CConfigure Data Access audit logs for Cloud Storage at the organization level.
  • DEnable Access Transparency for the project hosting the Cloud Storage buckets.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Enable Access Transparency for the organization.

PCSE Question 333

Single page →
Topic 1 · Question 333

Your organization is implementing a Zero Trust security model and using Chrome Enterprise Premium. The company is interested in governing access to sensitive data stored in Cloud Storage. You need to configure access controls that ensure only authorized users on managed devices can access this data, regardless of their network location. Access should be restricted based on the device's security posture. This requires up-to-date operating system patches and antivirus software. What should you do?

  • AGrant access to specific users to the VPC Service Controls to create a perimeter to access the Cloud Storage buckets. Configure Identity-Aware Proxy (IAP) to authenticate users before they can access the data.
  • BConfigure IAM conditions based on IP address ranges. Require users to connect through a VPN. Implement endpoint verification software on user devices to check for basic compliance.
  • CCreate an access level in Access Context Manager that requires a device policy. Create a Context-Aware Access policy using this access level. Apply the policy to the VPC Service Controls perimeter that includes the Cloud Storage buckets. (correct answer)
  • DUse Cloud Firewall rules to restrict access to the Cloud Storage buckets based on the source IP addresses. Require users to authenticate with a multi-factor authentication method.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create an access level in Access Context Manager that requires a device policy. Create a Context-Aware Access policy using this access level. Apply the policy to the VPC Service Controls perimeter that includes the Cl...

Explanation

Cloud Storage provides durable, scalable object storage that is fully managed. VPC Service Controls create a security perimeter around managed services to prevent data exfiltration. A VPC provides a global, software-defined private network for your Google Cloud resources.

PCSE Question 334

Single page →
Topic 1 · Question 334

Your organization is using AI to improve products through innovation. The developers want to use Gemini in Vertex AI on a project. You need to provide a secure Google Cloud environment to prevent and detect information leakages. What should you do?

  • ASet up VPC Service Controls perimeters around the Vertex AI project. Enable Data Loss Prevention API for content inspection.
  • BGrant the developers and AI engineers the Vertex AI User role. Monitor the audit trails with Cloud Logging.
  • CDeploy Model Armor to protect the Vertex AI endpoint. Review Security Command Center findings to detect information leakages. (correct answer)
  • DImplement a firewall rule that allows all traffic to and from the Vertex AI API endpoint.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Deploy Model Armor to protect the Vertex AI endpoint. Review Security Command Center findings to detect information leakages.

Explanation

Vertex AI is the unified managed platform to build, train, tune, deploy, and operate ML models. Security Command Center centralizes security findings, threats, and compliance posture.

PCSE Question 335

Single page →
Topic 1 · Question 335

You are responsible for configuring Identity and Access Management in your organization's Google Cloud environment. You need to restrict your organization's users from accessing Cloud Storage buckets in other Google Cloud organizations. What should you do?

  • ASet a principal access boundary policy with the appropriate enforcement version. Bind the policy to the principals of your organization. (correct answer)
  • BConfigure organization restriction headers for your environment. Only include the organization ID of your organization in the list of allowed resources.
  • CCreate an IAM deny policy on the organization level that prevents access to Cloud Storage buckets outside the organization.
  • DEnforce domain restricted sharing in your organization. Configure a managed constraint, and only include the principals in your organization.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Set a principal access boundary policy with the appropriate enforcement version. Bind the policy to the principals of your organization.

PCSE Question 336

Single page →
Topic 1 · Question 336

Your organization is storing regulated data in Cloud Storage. Data in Cloud Storage buckets is encrypted by Google-managed encryption keys. To meet compliance requirements, you need to update the existing data to use customer-managed encryption keys instead. What should you do?

  • ACreate a new key ring and key in the Cloud Key Management Service. In each Cloud Storage bucket configuration, change the encryption type to customer-managed encryption key.
  • BIdentify which projects contain Cloud Storage buckets with regulated data. Apply the restrictNonCmekServices organization policy constraint to the identified projects or parent folder.
  • CCreate a new key ring and key in the Cloud Key Management Service. Identify which projects contain Cloud Storage buckets with regulated data. Perform a write action on all existing objects in the buckets.
  • DCreate a customer-managed encryption key. Change the encryption type in each Cloud Storage bucket configuration to the newly created key. Perform a write action on all existing objects in the buckets. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Create a customer-managed encryption key. Change the encryption type in each Cloud Storage bucket configuration to the newly created key. Perform a write action on all existing objects in the buckets.

Explanation

Cloud Storage provides durable, scalable object storage that is fully managed.

PCSE Question 337

Single page →
Topic 1 · Question 337

There is a vendor who needs access to your company's Google Cloud environment. The vendor uses a third-party identity provider (IdP). You need to integrate this IdP with your company's Google Cloud environment to enable single sign-on (SSO) for the vendor's users in the most secure way. You don't want to manage any of the vendor users' lifecycle management. What should you do?

  • AUse Google Cloud Directory Sync to synchronize user accounts from the IdP to Google Workspace, and then configure SSO between Google Workspace and Google Cloud.
  • BDevelop a custom application that queries the IdP for user authentication and then programmatically creates Google Cloud user accounts.
  • CConnect the vendor's IdP with Google Cloud using Workforce Identify Federation. (correct answer)
  • DCreate Google Cloud accounts for each user and synchronize their passwords with the third-party IdP.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Connect the vendor's IdP with Google Cloud using Workforce Identify Federation.

PCSE Question 338

Single page →
Topic 1 · Question 338

Your organization is planning to deploy a large number of Google Kubernetes Engine (GKE) clusters to run business applications in different folders and projects. You must ensure that all GKE nodes always run the latest release to minimize vulnerability risk and administrative effort. What should you do?

  • AAfter creating clusters, use the Google Cloud console gcloud container node-pools describe NODE_POOL_NAME --cluster=CLUSTER_NAME command. Examine the upgradeSettings and UpdateInfo output.
  • BCreate a custom organization policy constraint resource.management.autoUpgrade == true with an action type of ALLOW at the organization level before deployment. (correct answer)
  • CCreate a new node pool with the newer version for each cluster. Migrate the workload. Eliminate the outdated node pool.
  • DManually run the Google Cloud console gcloud container clusters upgrade CLUSTER_NAME--node-pool=NODE_POOL_NAME --cluster-version VERSION command on newly created clusters regularly.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create a custom organization policy constraint resource.management.autoUpgrade == true with an action type of ALLOW at the organization level before deployment.

Explanation

Organization Policy sets guardrails that constrain how resources can be configured across the org.

PCSE Question 339

Single page →
Topic 1 · Question 339

Your company is migrating a three-tier web application to Google Cloud. The application consists of a web frontend, an application backend, and a database. Due to regulatory requirements and existing on-premises infrastructure dependencies, you need to implement a hybrid cloud architecture. The web frontend will be hosted on Google Cloud, while the application backend and the database will remain on-premises initially. You need to ensure secure and efficient communication between the cloud-based frontend and the on-premises backend and database, minimizing latency and maximizing availability. What should you do?

  • AEstablish a Dedicated Interconnect connection between the Google Cloud VPC network and the on-premises network. Configure firewall rules to allow communication between the three tiers. (correct answer)
  • BEstablish a direct internet connection between the Google Cloud VPC network hosting the web frontend and the on-premises network that hosts the backend and database. Configure firewall rules to allow communication between the three tiers.
  • CReplicate the on-premises backend and database to Google Cloud. Use a hybrid connectivity network endpoint group for the primary. Backup to the zonal network endpoint group.
  • DUse a highly-available Cloud VPN connection over the public internet to connect the Google Cloud VPC network to the on-premises network.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Establish a Dedicated Interconnect connection between the Google Cloud VPC network and the on-premises network. Configure firewall rules to allow communication between the three tiers.

Explanation

Dedicated Interconnect provides a private physical connection into Google's network. A VPC provides a global, software-defined private network for your Google Cloud resources.

PCSE Question 340

Single page →
Topic 1 · Question 340

Your organization is building an application powered by generative AI that uses sensitive internal data lo train the AI model. The application is built using Vertex AI, which is generally available in your region. You must ensure Google does not use your sensitive data when tuning public models because it could result in your data being shared with other Google Cloud customers. What should you do?

  • ADo not use Vertex AI for sensitive data. Use only public data with minimal privacy requirements.
  • BEncrypt your data by using customer-managed encryption keys (CMEK) to have full control over encryption key access.
  • CDo nothing. Vertex AI foundation models are frozen by default and do not use your data for model-tuning purposes. (correct answer)
  • DContact Google support to opt out of model tuning.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Do nothing. Vertex AI foundation models are frozen by default and do not use your data for model-tuning purposes.

Explanation

Vertex AI is the unified managed platform to build, train, tune, deploy, and operate ML models.

Showing questions 321–340 of 356 · Page 17 of 18