🔍

PCSE — questions

Page 5 of 18 · 356 total questions.

PCSE Question 81

Single page →
Topic 1 · Question 81 · Select all that apply

A customer is running an analytics workload on Google Cloud Platform (GCP) where Compute Engine instances are accessing data stored on Cloud Storage. Your team wants to make sure that this workload will not be able to access, or be accessed from, the internet. Which two strategies should your team use to meet these requirements? (Choose two.)

  • AConfigure Private Google Access on the Compute Engine subnet (correct answer)
  • BAvoid assigning public IP addresses to the Compute Engine cluster. (correct answer)
  • CMake sure that the Compute Engine cluster is running on a separate subnet.
  • DTurn off IP forwarding on the Compute Engine instances in the cluster.
  • EConfigure a Cloud NAT gateway.
Reveal answer & explanation
Correct answer: A, B

The correct answer is A, B. Option A: Configure Private Google Access on the Compute Engine subnet Option B: Avoid assigning public IP addresses to the Compute Engine cluster.

Explanation

Compute Engine provides configurable virtual machines when you need full control of the OS. Private Google Access lets internal instances reach Google APIs without external IPs.

PCSE Question 82

Single page →
Topic 1 · Question 82

A customer wants to run a batch processing system on VMs and store the output files in a Cloud Storage bucket. The networking and security teams have decided that no VMs may reach the public internet. How should this be accomplished?

  • ACreate a firewall rule to block internet traffic from the VM.
  • BProvision a NAT Gateway to access the Cloud Storage API endpoint.
  • CEnable Private Google Access. (correct answer)
  • DMount a Cloud Storage bucket as a local filesystem on every VM.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Enable Private Google Access.

Explanation

Private Google Access lets internal instances reach Google APIs without external IPs.

PCSE Question 83

Single page →
Topic 1 · Question 83

As adoption of the Cloud Data Loss Prevention (Cloud DLP) API grows within your company, you need to optimize usage to reduce cost. Cloud DLP target data is stored in Cloud Storage and BigQuery. The location and region are identified as a suffix in the resource name. Which cost reduction options should you recommend?

  • ASet appropriate rowsLimit value on BigQuery data hosted outside the US and set appropriate bytesLimitPerFile value on multiregional Cloud Storage buckets.
  • BSet appropriate rowsLimit value on BigQuery data hosted outside the US, and minimize transformation units on multiregional Cloud Storage buckets.
  • CUse rowsLimit and bytesLimitPerFile to sample data and use CloudStorageRegexFileSet to limit scans. (correct answer)
  • DUse FindingLimits and TimespanContfig to sample data and minimize transformation units.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use rowsLimit and bytesLimitPerFile to sample data and use CloudStorageRegexFileSet to limit scans. This option delivers the requirement at the lowest cost.

PCSE Question 84

Single page →
Topic 1 · Question 84

Your team uses a service account to authenticate data transfers from a given Compute Engine virtual machine instance of to a specified Cloud Storage bucket. An engineer accidentally deletes the service account, which breaks application functionality. You want to recover the application as quickly as possible without compromising security. What should you do?

  • ATemporarily disable authentication on the Cloud Storage bucket.
  • BUse the undelete command to recover the deleted service account. (correct answer)
  • CCreate a new service account with the same name as the deleted service account.
  • DUpdate the permissions of another existing service account and supply those credentials to the applications.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Use the undelete command to recover the deleted service account.

Explanation

A service account provides an identity for workloads to access Google Cloud APIs securely.

PCSE Question 85

Single page →
Topic 1 · Question 85

You are the Security Admin in your company. You want to synchronize all security groups that have an email address from your LDAP directory in Cloud IAM. What should you do?

  • AConfigure Google Cloud Directory Sync to sync security groups using LDAP search rules that have "user email address" as the attribute to facilitate one-way sync. (correct answer)
  • BConfigure Google Cloud Directory Sync to sync security groups using LDAP search rules that have "user email address" as the attribute to facilitate bidirectional sync.
  • CUse a management tool to sync the subset based on the email address attribute. Create a group in the Google domain. A group created in a Google domain will automatically have an explicit Google Cloud Identity and Access Management (IAM) role.
  • DUse a management tool to sync the subset based on group object class attribute. Create a group in the Google domain. A group created in a Google domain will automatically have an explicit Google Cloud Identity and Access Management (IAM) role.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Configure Google Cloud Directory Sync to sync security groups using LDAP search rules that have "user email address" as the attribute to facilitate one-way sync.

PCSE Question 86

Single page →
Topic 1 · Question 86

You are part of a security team investigating a compromised service account key. You need to audit which new resources were created by the service account. What should you do?

  • AQuery Data Access logs.
  • BQuery Admin Activity logs. (correct answer)
  • CQuery Access Transparency logs.
  • DQuery Stackdriver Monitoring Workspace.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Query Admin Activity logs.

PCSE Question 87

Single page →
Topic 1 · Question 87

You have an application where the frontend is deployed on a managed instance group in subnet A and the data layer is stored on a mysql Compute Engine virtual machine (VM) in subnet B on the same VPC. Subnet A and Subnet B hold several other Compute Engine VMs. You only want to allow the application frontend to access the data in the application's mysql instance on port 3306. What should you do?

  • AConfigure an ingress firewall rule that allows communication from the src IP range of subnet A to the tag "data-tag" that is applied to the mysql Compute Engine VM on port 3306.
  • BConfigure an ingress firewall rule that allows communication from the frontend's unique service account to the unique service account of the mysql Compute Engine VM on port 3306. (correct answer)
  • CConfigure a network tag "fe-tag" to be applied to all instances in subnet A and a network tag "data-tag" to be applied to all instances in subnet B. Then configure an egress firewall rule that allows communication from Compute Engine VMs tagged with data-tag to destination Compute Engine VMs tagged fe- tag.
  • DConfigure a network tag "fe-tag" to be applied to all instances in subnet A and a network tag "data-tag" to be applied to all instances in subnet B. Then configure an ingress firewall rule that allows communication from Compute Engine VMs tagged with fe-tag to destination Compute Engine VMs tagged with data-tag.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Configure an ingress firewall rule that allows communication from the frontend's unique service account to the unique service account of the mysql Compute Engine VM on port 3306.

Explanation

Compute Engine provides configurable virtual machines when you need full control of the OS. A service account provides an identity for workloads to access Google Cloud APIs securely.

PCSE Question 88

Single page →
Topic 1 · Question 88

Your company operates an application instance group that is currently deployed behind a Google Cloud load balancer in us-central-1 and is configured to use the Standard Tier network. The infrastructure team wants to expand to a second Google Cloud region, us-east-2. You need to set up a single external IP address to distribute new requests to the instance groups in both regions. What should you do?

  • AChange the load balancer backend configuration to use network endpoint groups instead of instance groups.
  • BChange the load balancer frontend configuration to use the Premium Tier network, and add the new instance group. (correct answer)
  • CCreate a new load balancer in us-east-2 using the Standard Tier network, and assign a static external IP address.
  • DCreate a Cloud VPN connection between the two regions, and enable Google Private Access.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Change the load balancer frontend configuration to use the Premium Tier network, and add the new instance group.

Explanation

A load balancer distributes traffic across healthy backends in multiple zones for availability and scale.

PCSE Question 89

Single page →
Topic 1 · Question 89

You are the security admin of your company. You have 3,000 objects in your Cloud Storage bucket. You do not want to manage access to each object individually. You also do not want the uploader of an object to always have full control of the object. However, you want to use Cloud Audit Logs to manage access to your bucket. What should you do?

  • ASet up an ACL with OWNER permission to a scope of allUsers.
  • BSet up an ACL with READER permission to a scope of allUsers.
  • CSet up a default bucket ACL and manage access for users using IAM.
  • DSet up Uniform bucket-level access on the Cloud Storage bucket and manage access for users using IAM. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Set up Uniform bucket-level access on the Cloud Storage bucket and manage access for users using IAM.

Explanation

Cloud Storage provides durable, scalable object storage that is fully managed. Cloud IAM grants fine-grained, least-privilege access to Google Cloud resources.

PCSE Question 90

Single page →
Topic 1 · Question 90

You are the security admin of your company. Your development team creates multiple GCP projects under the "implementation" folder for several dev, staging, and production workloads. You want to prevent data exfiltration by malicious insiders or compromised code by setting up a security perimeter. However, you do not want to restrict communication between the projects. What should you do?

  • AUse a Shared VPC to enable communication between all projects, and use firewall rules to prevent data exfiltration.
  • BCreate access levels in Access Context Manager to prevent data exfiltration, and use a shared VPC for communication between projects.
  • CUse an infrastructure-as-code software tool to set up a single service perimeter and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub. When the function notices that a new project is added to the folder, it executes Terraform to add the new project to the associated perimeter. (correct answer)
  • DUse an infrastructure-as-code software tool to set up three different service perimeters for dev, staging, and prod and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub. When the function notices that a new project is added to the folder, it executes Terraform to add the new project to the respective perimeter.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use an infrastructure-as-code software tool to set up a single service perimeter and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub. When the function notices th...

Explanation

Pub/Sub is a serverless, global messaging service that decouples services and ingests high-volume event streams. Cloud Operations (formerly Stackdriver) provides monitoring, logging, and tracing for reliability. Terraform provisions Google Cloud infrastructure as code repeatably.

PCSE Question 91

Single page →
Topic 1 · Question 91 · Select all that apply

You need to provide a corporate user account in Google Cloud for each of your developers and operational staff who need direct access to GCP resources. Corporate policy requires you to maintain the user identity in a third-party identity management provider and leverage single sign-on. You learn that a significant number of users are using their corporate domain email addresses for personal Google accounts, and you need to follow Google recommended practices to convert existing unmanaged users to managed accounts. Which two actions should you take? (Choose two.)

  • AUse Google Cloud Directory Sync to synchronize your local identity management system to Cloud Identity. (correct answer)
  • BUse the Google Admin console to view which managed users are using a personal account for their recovery email.
  • CAdd users to your managed Google account and force users to change the email addresses associated with their personal accounts.
  • DUse the Transfer Tool for Unmanaged Users (TTUU) to find users with conflicting accounts and ask them to transfer their personal Google accounts. (correct answer)
  • ESend an email to all of your employees and ask those users with corporate email addresses for personal Google accounts to delete the personal accounts immediately.
Reveal answer & explanation
Correct answer: A, D

The correct answer is A, D. Option A: Use Google Cloud Directory Sync to synchronize your local identity management system to Cloud Identity. Option D: Use the Transfer Tool for Unmanaged Users (TTUU) to find users with conflicting accounts and ask them to transfer their personal Google accounts.

Explanation

Cloud Identity manages users, groups, and device policies as a managed identity platform.

PCSE Question 92

Single page →
Topic 1 · Question 92

You are on your company's development team. You noticed that your web application hosted in staging on GKE dynamically includes user data in web pages without first properly validating the inputted data. This could allow an attacker to execute gibberish commands and display arbitrary content in a victim user's browser in a production environment. How should you prevent and fix this vulnerability?

  • AUse Cloud IAP based on IP address or end-user device attributes to prevent and fix the vulnerability.
  • BSet up an HTTPS load balancer, and then use Cloud Armor for the production environment to prevent the potential XSS attack.
  • CUse Web Security Scanner to validate the usage of an outdated library in the code, and then use a secured version of the included library.
  • DUse Web Security Scanner in staging to simulate an XSS injection attack, and then use a templating system that supports contextual auto-escaping. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use Web Security Scanner in staging to simulate an XSS injection attack, and then use a templating system that supports contextual auto-escaping.

PCSE Question 93

Single page →
Topic 1 · Question 93

You are part of a security team that wants to ensure that a Cloud Storage bucket in Project A can only be readable from Project B. You also want to ensure that data in the Cloud Storage bucket cannot be accessed from or copied to Cloud Storage buckets outside the network, even if the user has the correct credentials. What should you do?

  • AEnable VPC Service Controls, create a perimeter with Project A and B, and include Cloud Storage service. (correct answer)
  • BEnable Domain Restricted Sharing Organization Policy and Bucket Policy Only on the Cloud Storage bucket.
  • CEnable Private Access in Project A and B networks with strict firewall rules to allow communication between the networks.
  • DEnable VPC Peering between Project A and B networks with strict firewall rules to allow communication between the networks.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Enable VPC Service Controls, create a perimeter with Project A and B, and include Cloud Storage service.

Explanation

Cloud Storage provides durable, scalable object storage that is fully managed. VPC Service Controls create a security perimeter around managed services to prevent data exfiltration. A VPC provides a global, software-defined private network for your Google Cloud resources.

PCSE Question 94

Single page →
Topic 1 · Question 94

You are responsible for protecting highly sensitive data in BigQuery. Your operations teams need access to this data, but given privacy regulations, you want to ensure that they cannot read the sensitive fields such as email addresses and first names. These specific sensitive fields should only be available on a need-to- know basis to the Human Resources team. What should you do?

  • APerform data masking with the Cloud Data Loss Prevention API, and store that data in BigQuery for later use.
  • BPerform data redaction with the Cloud Data Loss Prevention API, and store that data in BigQuery for later use.
  • CPerform data inspection with the Cloud Data Loss Prevention API, and store that data in BigQuery for later use.
  • DPerform tokenization for Pseudonymization with the Cloud Data Loss Prevention API, and store that data in BigQuery for later use. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Perform tokenization for Pseudonymization with the Cloud Data Loss Prevention API, and store that data in BigQuery for later use.

Explanation

BigQuery is a serverless, petabyte-scale data warehouse for fast SQL analytics with no infrastructure to manage.

PCSE Question 95

Single page →
Topic 1 · Question 95

You are a Security Administrator at your organization. You need to restrict service account creation capability within production environments. You want to accomplish this centrally across the organization. What should you do?

  • AUse Identity and Access Management (IAM) to restrict access of all users and service accounts that have access to the production environment.
  • BUse organization policy constraints/iam.disableServiceAccountKeyCreation boolean to disable the creation of new service accounts.
  • CUse organization policy constraints/iam.disableServiceAccountKeyUpload boolean to disable the creation of new service accounts.
  • DUse organization policy constraints/iam.disableServiceAccountCreation boolean to disable the creation of new service accounts. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use organization policy constraints/iam.disableServiceAccountCreation boolean to disable the creation of new service accounts.

Explanation

A service account provides an identity for workloads to access Google Cloud APIs securely. Cloud IAM grants fine-grained, least-privilege access to Google Cloud resources. Organization Policy sets guardrails that constrain how resources can be configured across the org.

PCSE Question 96

Single page →
Topic 1 · Question 96

You are the project owner for a regulated workload that runs in a project you own and manage as an Identity and Access Management (IAM) admin. For an upcoming audit, you need to provide access reviews evidence. Which tool should you use?

  • APolicy Troubleshooter
  • BPolicy Analyzer (correct answer)
  • CIAM Recommender
  • DPolicy Simulator
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Policy Analyzer.

PCSE Question 97

Single page →
Topic 1 · Question 97

Your organization has implemented synchronization and SAML federation between Cloud Identity and Microsoft Active Directory. You want to reduce the risk of Google Cloud user accounts being compromised. What should you do?

  • ACreate a Cloud Identity password policy with strong password settings, and configure 2-Step Verification with security keys in the Google Admin console.
  • BCreate a Cloud Identity password policy with strong password settings, and configure 2-Step Verification with verification codes via text or phone call in the Google Admin console.
  • CCreate an Active Directory domain password policy with strong password settings, and configure post-SSO (single sign-on) 2-Step Verification with security keys in the Google Admin console. (correct answer)
  • DCreate an Active Directory domain password policy with strong password settings, and configure post-SSO (single sign-on) 2-Step Verification with verification codes via text or phone call in the Google Admin console.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create an Active Directory domain password policy with strong password settings, and configure post-SSO (single sign-on) 2-Step Verification with security keys in the Google Admin console.

PCSE Question 98

Single page →
Topic 1 · Question 98

You have been tasked with implementing external web application protection against common web application attacks for a public application on Google Cloud. You want to validate these policy changes before they are enforced. What service should you use?

  • AGoogle Cloud Armor's preconfigured rules in preview mode (correct answer)
  • BPrepopulated VPC firewall rules in monitor mode
  • CThe inherent protections of Google Front End (GFE)
  • DCloud Load Balancing firewall rules
  • EVPC Service Controls in dry run mode
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Google Cloud Armor's preconfigured rules in preview mode

Explanation

Cloud Armor protects applications from DDoS and common web attacks with WAF rules.

PCSE Question 99

Single page →
Topic 1 · Question 99

You are asked to recommend a solution to store and retrieve sensitive configuration data from an application that runs on Compute Engine. Which option should you recommend?

  • ACloud Key Management Service
  • BCompute Engine guest attributes
  • CCompute Engine custom metadata
  • DSecret Manager (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Secret Manager

Explanation

Secret Manager stores and controls access to secrets such as API keys and credentials.

PCSE Question 100

Single page →
Topic 1 · Question 100

You need to implement an encryption at-rest strategy that reduces key management complexity for non-sensitive data and protects sensitive data while providing the flexibility of controlling the key residency and rotation schedule. FIPS 140-2 L1 compliance is required for all data types. What should you do?

  • AEncrypt non-sensitive data and sensitive data with Cloud External Key Manager.
  • BEncrypt non-sensitive data and sensitive data with Cloud Key Management Service
  • CEncrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud External Key Manager.
  • DEncrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud Key Management Service. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud Key Management Service.

Showing questions 81–100 of 356 · Page 5 of 18