PCSE practice questions 91–100

1. Question 91 · 356 in bank

   Your organization develops software involved in many open source projects and is concerned about software supply chain threats. You need to deliver provenance for the build to demonstrate the software is untampered. What should you do?

   • A1. Hire an external auditor to review and provide provenance. 2. Define the scope and conditions. 3. Get support from the Security department or representative. 4. Publish the attestation to your public web page.
   • B1. Review the software process. 2. Generate private and public key pairs and use Pretty Good Privacy (PGP) protocols to sign the output software artifacts together with a file containing the address of your enterprise and point of contact. 3. Publish the PGP signed attestation to your public web page.
   • C1. Publish the software code on GitHub as open source. 2. Establish a bug bounty program, and encourage the open source community to review, report, and fix the vulnerabilities.
   • D1. Generate Supply Chain Levels for Software Artifacts (SLSA) level 3 assurance by using Cloud Build. 2. View the build provenance in the Security insights side panel within the Google Cloud console.

   Show answer

   Answer: D

   Explanation

   The best option would be D. Generate Supply Chain Levels for Software Artifacts (SLSA) level 3 assurance by using Cloud Build and view the build provenance in the Security insights side panel within the Google Cloud console. SLSA (pronounced “salsa”) is an end-to-end framework for ensuring the integrity of software artifacts throughout the software supply chain. The SLSA assurance levels provide a scalable compromise between the security benefits and the implementation costs. Level 3 is recommended for moderately to highly critical software and should provide strong, provenance-based security guarantees.

   Source: Adapted from community discussion — i_am_robot

   References

   • Google Cloud documentation

   Next question

2. Question 92 · 356 in bank

   Your organization operates Virtual Machines (VMs) with only private IPs in the Virtual Private Cloud (VPC) with internet access through Cloud NAT. Everyday, you must patch all VMs with critical OS updates and provide summary reports. What should you do?

   • AValidate that the egress firewall rules allow any outgoing traffic. Log in to each VM and execute OS specific update commands. Configure the Cloud Scheduler job to update with critical patches daily for daily updates.
   • BCopy the latest patches to the Cloud Storage bucket. Log in to each VM, download the patches from the bucket, and install them.
   • CAssign public IPs to VMs. Validate that the egress firewall rules allow any outgoing traffic. Log in to each VM, and configure a daily cron job to enable for OS updates at night during low activity periods.
   • DEnsure that VM Manager is installed and running on the VMs. In the OS patch management service, configure the patch jobs to update with critical patches dally.

   Show answer

   Answer: D

   Explanation

   VM manager is a suite of tools used to automate managing of the fleet of VMs (including OS patching) https://cloud.google.com/compute/docs/vm-manager

   Source: Adapted from community discussion — a190d62

   References

   • Google Cloud documentation

   Next question

3. Question 93 · 356 in bank

   For compliance reporting purposes, the internal audit department needs you to provide the list of virtual machines (VMs) that have critical operating system (OS) security updates available, but not installed. You must provide this list every six months, and you want to perform this task quickly. What should you do?

   • ARun a Security Command Center security scan on all VMs to extract a list of VMs with critical OS vulnerabilities every six months.
   • BRun a gcloud CLI command from the Command Line Interface (CLI) to extract the VM's OS version information every six months.
   • CEnsure that the Cloud Logging agent is installed on all VMs, and extract the OS last update log date every six months.
   • DEnsure the OS Config agent is installed on all VMs and extract the patch status dashboard every six months.

   Show answer

   Answer: D

   Explanation

   The best option would be D. Ensure the OS Config agent is installed on all VMs and extract the patch status dashboard every six months**. The OS Config agent is a service that provides a fast and flexible way to manage operating system configurations across an entire fleet of virtual machines. It can provide information about the patch state of a VM, including which patches are installed, which patches are available, and the severity of the patches. This would allow you to quickly identify VMs that have critical OS security updates available but not installed.

   Source: Adapted from community discussion — i_am_robot

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

4. Question 94 · 356 in bank

   Your company conducts clinical trials and needs to analyze the results of a recent study that are stored in BigQuery. The interval when the medicine was taken contains start and stop dates. The interval data is critical to the analysis, but specific dates may identify a particular batch and introduce bias. You need to obfuscate the start and end dates for each row and preserve the interval data. What should you do?

   • AUse date shifting with the context set to the unique ID of the test subject.
   • BExtract the date using TimePartConfig from each date field and append a random month and year.
   • CUse bucketing to shift values to a predetermined date based on the initial value.
   • DUse the FFX mode of format preserving encryption (FPE) and maintain data consistency.

   Show answer

   Answer: A

   Explanation

   A - date shifting. Bucketing is not an option here, because we would lose the order. Encryption is overpowered here https://cloud.google.com/dlp/docs/concepts-date-shifting

   Source: Adapted from community discussion — a190d62

   References

   • Google Cloud documentation

   Next question

5. Question 95 · 356 in bank

   You have a highly sensitive BigQuery workload that contains personally identifiable information (PII) that you want to ensure is not accessible from the internet. To prevent data exfiltration, only requests from authorized IP addresses are allowed to query your BigQuery tables. What should you do?

   • AUse service perimeter and create an access level based on the authorized source IP address as the condition.
   • BUse Google Cloud Armor security policies defining an allowlist of authorized IP addresses at the global HTTPS load balancer.
   • CUse the Restrict Resource Service Usage organization policy constraint along with Cloud Data Loss Prevention (DLP).
   • DUse the Restrict allowed Google Cloud APIs and services organization policy constraint along with Cloud Data Loss Prevention (DLP).

   Show answer

   Answer: A

   Explanation

   The best option would be A. Use service perimeter and create an access level based on the authorized source IP address as the condition. This approach allows you to create a boundary that controls access to Google Cloud resources for services within the same perimeter. By creating an access level based on the authorized source IP address as the condition, you can ensure that only requests from authorized IP addresses are allowed to query your BigQuery tables. This effectively prevents data exfiltration and ensures that your sensitive BigQuery workload is not accessible from the internet.

   Source: Adapted from community discussion — i_am_robot

   Next question

6. Question 96 · 356 in bank

   Your organization is moving virtual machines (VMs) to Google Cloud. You must ensure that operating system images that are used across your projects are trusted and meet your security requirements. What should you do?

   • AImplement an organization policy to enforce that boot disks can only be created from images that come from the trusted image project.
   • BImplement an organization policy constraint that enables the Shielded VM service on all projects to enforce the trusted image repository usage.
   • CCreate a Cloud Function that is automatically triggered when a new virtual machine is created from the trusted image repository. Verify that the image is not deprecated.
   • DAutomate a security scanner that verifies that no common vulnerabilities and exposures (CVEs) are present in your trusted image repository.

   Show answer

   Answer: A

   References

   • Google Cloud documentation

   Next question

7. Question 97 · 356 in bank

   You have stored company approved compute images in a single Google Cloud project that is used as an image repository. This project is protected with VPC Service Controls and exists in the perimeter along with other projects in your organization. This lets other projects deploy images from the image repository project. A team requires deploying a third-party disk image that is stored in an external Google Cloud organization. You need to grant read access to the disk image so that it can be deployed into the perimeter. What should you do?

   • AAllow the external project by using the organizational policy, constraints/compute.trustedImageProjects.
   • B1. Update the perimeter. 2. Configure the egressTo field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis.com. 3. Configure the egressFrom field to set identityType to ANY_IDENTITY.
   • C1. Update the perimeter. 2. Configure the ingressFrom field to set identityType to ANY_IDENTITY. 3. Configure the ingressTo field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis.com.
   • D1. Update the perimeter. 2. Configure the egressTo field to set identityType to ANY_IDENTITY. 3. Configure the egressFrom field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis.com.

   Show answer

   Answer: B

   Explanation

   A Compute Engine client within a service perimeter calling a Compute Engine create operation where the image resource is outside the perimeter. https://cloud.google.com/vpc-service-controls/docs/ingress-egress-rules#:~:text=Egress%20Refers%20to%20any%20access,resource%20is%20outside%20the%20perimeter.

   Source: Adapted from community discussion — anshad666

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

8. Question 98 · 356 in bank

   A service account key has been publicly exposed on multiple public code repositories. After reviewing the logs, you notice that the keys were used to generate short-lived credentials. You need to immediately remove access with the service account. What should you do?

   • ADelete the compromised service account.
   • BDisable the compromised service account key.
   • CWait until the service account credentials expire automatically.
   • DRotate the compromised service account key.

   Show answer

   Answer: A

   Explanation

   Normally you would just choose (D) to not break the business continuity. But in this case, when short-lived credentials are created you need to disable/delete service account (disabling service account key doesn't revoke short-lived credentials) https://cloud.google.com/iam/docs/keys-disable-enable#disabling

   Source: Adapted from community discussion — a190d62

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

9. Question 99 · 356 in bank

   A company is using Google Kubernetes Engine (GKE) with container images of a mission-critical application. The company wants to scan the images for known security issues and securely share the report with the security team without exposing them outside Google Cloud. What should you do?

   • A1. Enable Container Threat Detection in the Security Command Center Premium tier. 2. Upgrade all clusters that are not on a supported version of GKE to the latest possible GKE version. 3. View and share the results from the Security Command Center.
   • B1. Use an open source tool in Cloud Build to scan the images. 2. Upload reports to publicly accessible buckets in Cloud Storage by using gsutil. 3. Share the scan report link with your security department.
   • C1. Enable vulnerability scanning in the Artifact Registry settings. 2. Use Cloud Build to build the images. 3. Push the images to the Artifact Registry for automatic scanning. 4. View the reports in the Artifact Registry.
   • D1. Get a GitHub subscription. 2. Build the images in Cloud Build and store them in GitHub for automatic scanning. 3. Download the report from GitHub and share with the Security Team.

   Show answer

   Answer: C

   Explanation

   C Seems like the best fit. I initially chose A but: "The service evaluates all changes and remote access attempts to detect runtime attacks in near-real time." : https://cloud.google.com/security-command-center/docs/concepts-container-threat-detection-overview This has nothing to do with KNOWN security Vulns in images

   Source: Adapted from community discussion — espressoboy

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

10. Question 100 · 356 in bank

    Your application is deployed as a highly available, cross-region solution behind a global external HTTP(S) load balancer. You notice significant spikes in traffic from multiple IP addresses, but it is unknown whether the IPs are malicious. You are concerned about your application's availability. You want to limit traffic from these clients over a specified time interval. What should you do?

    • AConfigure a throttle action by using Google Cloud Armor to limit the number of requests per client over a specified time interval.
    • BConfigure a rate_based_ban action by using Google Cloud Armor and set the ban_duration_sec parameter to the specified lime interval.
    • CConfigure a firewall rule in your VPC to throttle traffic from the identified IP addresses.
    • DConfigure a deny action by using Google Cloud Armor to deny the clients that issued too many requests over the specified time interval.

    Show answer

    Answer: A

    Explanation

    To limit traffic from the identified IP addresses over a specified time interval, you should configure a throttle action by using Google Cloud Armor. This will limit the number of requests per client over a specified time interval, which can help prevent your application from being overwhelmed by traffic spikes. Option B is not recommended because it would ban the clients that issue too many requests over the specified time interval, which might not be desirable if the clients are legitimate. Option C is not recommended because it would throttle traffic from all IP addresses that match the firewall rule, which might not be desirable if some of the IP addresses are legitimate. Option D is not recommended because it would deny the clients that issue too many requests over the specified time interval, which might not be desirable if the clients are legitimate. Therefore, Option A is the most appropriate choice for limiting traffic from multiple IP addresses over a specified time interval.

    Source: Adapted from community discussion — Xoxoo

    References

    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCSE practice, question 91. 356 questions available.