Free PCSE sample questions

Correct answers: Cloud Key Management Service (KMS); Sensitive Data Protection (Cloud DLP)

Correct answer: Create a log sink in the project with a filter for Admin Activity and Data Access audit logs, exporting them to a Cloud Storage bucket with a 10-year retention policy and Bucket Lock.

This approach is the most efficient and meets all requirements. A log sink can be configured with a specific filter to only export the required audit logs. Exporting to Cloud Storage is cost-effective for long-term archival. Applying a retention policy and Bucket Lock ensures the logs are immutable for the specified 10-year period, satisfying audit and compliance needs.

Correct answer: Configure a SAML 2.0-based single sign-on (SSO) between Cloud Identity and AD FS. Use GCDS to sync only groups, and control session duration within AD FS.

This solution meets all requirements. Configuring SAML-based SSO ensures that authentication happens directly against the on-premises AD FS. GCDS is used to sync group memberships, allowing for group-based IAM policies in Google Cloud. Session duration is controlled by the identity provider (AD FS in this case), satisfying the 8-hour session limit requirement.

Correct answer: Security Command Center with Security Health Analytics enabled.

Security Command Center (SCC) is Google Cloud's centralized security and risk management platform. Its built-in service, Security Health Analytics, automatically scans for common misconfigurations and vulnerabilities across the organization, providing findings in a centralized dashboard. This perfectly matches the CTO's requirements for a managed, proactive security posture management tool.

Correct answer: True

This statement is true. A VPC Service Controls perimeter defines a virtual boundary for Google Cloud services. An Access Level is a condition that can be applied to this perimeter, and it can be based on attributes like IP address, device type, or user identity. By creating an access level that specifies the public IP ranges of the corporate network, you can enforce that only requests from that location can access the protected services within the perimeter.

Correct answer: Use Cloud External Key Manager (EKM) to connect to your own on-premises FIPS 140-2 Level 3 HSM.

Cloud EKM allows you to use keys managed in a supported third-party key management system to protect data in Google Cloud. By connecting it to your own FIPS 140-2 Level 3 validated HSM, you retain full control over the keys, and Google personnel have no access to the key material. Cloud HSM is FIPS 140-2 Level 3 validated, but it is a Google-managed service, which doesn't meet the strict requirement of prohibiting any Google personnel access.

Correct answers: Implement VPC Service Controls to create a service perimeter around the production project, preventing data exfiltration.; Enforce an Organization Policy to disable service account key creation and use Workload Identity for GKE workloads instead.

Correct answer: Organization Policy Service with the `compute.trustedImageProjects` and `compute.disableSerialPortAccess` constraints.

The Organization Policy Service is designed for this exact purpose. It allows administrators to enforce constraints on how resources can be configured. The `compute.trustedImageProjects` constraint can be used to define a list of projects from which images can be used, and `compute.disableSerialPortAccess` can be set to `True` to prevent serial port access. Applying these at the organization root enforces them everywhere.

Correct answer: Configure a Binary Authorization policy that requires attestations from both the vulnerability scanner and the QA lead before allowing a deployment to Cloud Run.

Binary Authorization is the service designed for this use case. You can create a policy that enforces that container images must be signed by specific attestors before they can be deployed. In this scenario, you would create two attestors: one for the automated vulnerability scanner and another for the QA lead. The policy for the production Cloud Run service would require valid attestations from both, thus automating the enforcement of the security requirement.

Correct answer: Assign a unique service account to the VMs in each tier. Create ingress firewall rules for each tier that use the source service account as the filter.

Using service accounts for firewall rules is the most secure and manageable method. Unlike network tags, which can be modified by any user with instance admin permissions, service account usage is governed by IAM. By creating specific ingress rules for each tier (e.g., an ingress rule for the App tier allowing TCP:8080 from the Web tier's service account), you create a robust, identity-based segmentation model that adheres to the principle of least privilege.