PCSE practice questions 151–160

1. Question 151 · 356 in bank

   Your organization uses BigQuery to process highly sensitive, structured datasets. Following the “need to know” principle, you need to create the Identity and Access Management (IAM) design to meet the needs of these users: • Business user: must access curated reports. • Data engineer: must administrate the data lifecycle in the platform. • Security operator: must review user activity on the data platform. What should you do?

   • AConfigure data access log for BigQuery services, and grant Project Viewer role to security operator.
   • BSet row-based access control based on the “region” column, and filter the record from the United States for data engineers.
   • CCreate curated tables in a separate dataset and assign the role roles/bigquery.dataViewer.
   • DGenerate a CSV data file based on the business user's needs, and send the data to their email addresses.

   Show answer

   Answer: C

   Explanation

   Correction. The most correct answer would be C. Create curated tables in a separate dataset and assign the role roles/bigquery.dataViewer. This option directly addresses the needs of the business user who must access curated reports. By creating curated tables in a separate dataset, you can control access to specific data. Assigning the roles/bigquery.dataViewer role allows the business user to view the data in BigQuery. While option A is also a good practice for a security operator, it doesn’t directly address the specific needs of the users mentioned in the question as effectively as option C does. Therefore, if you can only choose one answer, option C would be the most correct.

   Source: Adapted from community discussion — MisterHairy

   Next question

2. Question 152 · 356 in bank

   You are setting up a new Cloud Storage bucket in your environment that is encrypted with a customer managed encryption key (CMEK). The CMEK is stored in Cloud Key Management Service (KMS), in project “prj-a”, and the Cloud Storage bucket will use project “prj-b”. The key is backed by a Cloud Hardware Security Module (HSM) and resides in the region europe-west3. Your storage bucket will be located in the region europe-west1. When you create the bucket, you cannot access the key, and you need to troubleshoot why. What has caused the access issue?

   • AA firewall rule prevents the key from being accessible.
   • BCloud HSM does not support Cloud Storage.
   • CThe CMEK is in a different project than the Cloud Storage bucket.
   • DThe CMEK is in a different region than the Cloud Storage bucket.

   Show answer

   Answer: D

   Explanation

   You must create the Cloud KMS key ring in the same location as the data you intend to encrypt. For example, if your bucket is located in US-EAST1, any key ring used for encrypting objects in that bucket must also be created in US-EAST1. https://cloud.google.com/storage/docs/encryption/customer-managed-keys#restrictions

   Source: Adapted from community discussion — irmingard_examtopics

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

3. Question 153 · 356 in bank

   You are deploying regulated workloads on Google Cloud. The regulation has data residency and data access requirements. It also requires that support is provided from the same geographical location as where the data resides. What should you do?

   • AEnable Access Transparency Logging.
   • BDeploy Assured Workloads.
   • CDeploy resources only to regions permitted by data residency requirements.
   • DUse Data Access logging and Access Transparency logging to confirm that no users are accessing data from another region.

   Show answer

   Answer: B

   Explanation

   We should deploy Assured Workloads. Assured Workloads helps businesses in regulated sectors meet compliance requirements by providing a secure and compliant environment with features like data residency controls for specific compliance types, data and personnel access controls, and real-time monitoring for compliance violations. It ensures that only Google Cloud support personnel meeting specific geographical locations and personnel conditions support customers' workloads. We can select the regulatory framework you need to follow and Assured Workloads will automatically configure and deploy the controls needed to help meet your requirements.

   Source: Adapted from community discussion — i_am_robot

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

4. Question 154 · 356 in bank

   Your organization wants full control of the keys used to encrypt data at rest in their Google Cloud environments. Keys must be generated and stored outside of Google and integrate with many Google Services including BigQuery. What should you do?

   • AUse customer-supplied encryption keys (CSEK) with keys generated on trusted external systems. Provide the raw CSEK as part of the API call.
   • BCreate a KMS key that is stored on a Google managed FIPS 140-2 level 3 Hardware Security Module (HSM). Manage the Identity and Access Management (IAM) permissions settings, and set up the key rotation period.
   • CUse Cloud External Key Management (EKM) that integrates with an external Hardware Security Module (HSM) system from supported vendors.
   • DCreate a Cloud Key Management Service (KMS) key with imported key material. Wrap the key for protection during import. Import the key generated on a trusted system in Cloud KMS.

   Show answer

   Answer: C

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 155 · 356 in bank

   Your company is concerned about unauthorized parties gaining access to the Google Cloud environment by using a fake login page. You must implement a solution to protect against person-in-the-middle attacks. Which security measure should you use?

   • ASecurity key
   • BGoogle prompt
   • CText message or phone call code
   • DGoogle Authenticator application

   Show answer

   Answer: A

   Explanation

   The correct answer is A. Security key. A security key is a physical device that you can use for two-step verification, providing an additional layer of security for your Google Account. Security keys can defend against phishing and man-in-the-middle attacks, making your login process more secure.

   Source: Adapted from community discussion — MisterHairy

   Next question

6. Question 156 · 356 in bank

   You control network traffic for a folder in your Google Cloud environment. Your folder includes multiple projects and Virtual Private Cloud (VPC) networks. You want to enforce on the folder level that egress connections are limited only to IP range 10.58.5.0/24 and only from the VPC network “dev-vpc”. You want to minimize implementation and maintenance effort. What should you do?

   • A1. Leave the network configuration of the VMs in scope unchanged. 2. Create a new project including a new VPC network “new-vpc”. 3. Deploy a network appliance in “new-vpc” to filter access requests and only allow egress connections from “dev-vpc” to 10.58.5.0/24.
   • B1. Leave the network configuration of the VMs in scope unchanged. 2. Enable Cloud NAT for “dev-vpc” and restrict the target range in Cloud NAT to 10.58.5.0/24.
   • C1. Attach external IP addresses to the VMs in scope. 2. Define and apply a hierarchical firewall policy on folder level to deny all egress connections and to allow egress to IP range 10.58.5.0/24 from network dev-vpc.
   • D1. Attach external IP addresses to the VMs in scope. 2. Configure a VPC Firewall rule in “dev-vpc” that allows egress connectivity to IP range 10.58.5.0/24 for all source addresses in this network.

   Show answer

   Answer: C

   Explanation

   Hierarchical Firewall Policy: These policies are defined at the organization or folder level and are inherited by all projects under the folder. You can use this to enforce a rule that allows egress traffic only to the specific IP range (10.58.5.0/24) from the dev-vpc network while blocking all other egress traffic. This minimizes ongoing maintenance because the policy applies automatically to all resources in the folder. External IP Addresses: By attaching external IP addresses to the VMs, you ensure they can communicate outside the VPC, subject to the egress policies defined at the folder level.

   Source: Adapted from community discussion — BPzen

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

7. Question 157 · 356 in bank

   A company's application is deployed with a user-managed Service Account key. You want to use Google-recommended practices to rotate the key. What should you do?

   • AOpen Cloud Shell and run gcloud iam service-accounts enable-auto-rotate --iam-account=IAM_ACCOUNT.
   • BOpen Cloud Shell and run gcloud iam service-accounts keys rotate --iam-account=IAM_ACCOUNT --key=NEW_KEY.
   • CCreate a new key, and use the new key in the application. Delete the old key from the Service Account.
   • DCreate a new key, and use the new key in the application. Store the old key on the system as a backup key.

   Show answer

   Answer: C

   Explanation

   C is correct. As explained, You can rotate a key by creating a new key, updating applications to use the new key, and deleting the old key. Use the serviceAccount.keys.create() method and serviceAccount.keys.delete() method together to automate the rotation. https://cloud.google.com/iam/docs/creating-managing-service-account-keys#deleting_service_account_keys

   Source: Adapted from community discussion — mdc

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

8. Question 158 · 356 in bank

   Your customer has an on-premises Public Key Infrastructure (PKI) with a certificate authority (CA). You need to issue certificates for many HTTP load balancer frontends. The on-premises PKI should be minimally affected due to many manual processes, and the solution needs to scale. What should you do?

   • AUse Certificate Manager to issue Google managed public certificates and configure it at HTTP the load balancers in your infrastructure as code (IaC).
   • BUse a subordinate CA in the Google Certificate Authority Service from the on-premises PKI system to issue certificates for the load balancers.
   • CUse Certificate Manager to import certificates issued from on-premises PKI and for the frontends. Leverage the gcloud tool for importing.
   • DUse the web applications with PKCS12 certificates issued from subordinate CA based on OpenSSL on-premises. Use the gcloud tool for importing. Use the External TCP/UDP Network load balancer instead of an external HTTP Load Balancer.

   Show answer

   Answer: B

   Explanation

   The correct answer is B. Use a subordinate CA in the Google Certificate Authority Service from the on-premises PKI system to issue certificates for the load balancers. This approach allows you to leverage your existing on-premises PKI infrastructure while minimizing its impact and manual processes. By creating a subordinate CA in Google’s Certificate Authority Service, you can automate the process of issuing certificates for your HTTP load balancer frontends. This solution scales well as the number of load balancers increases.

   Source: Adapted from community discussion — MisterHairy

   Next question

9. Question 159 · 356 in bank

   You are developing a new application that uses exclusively Compute Engine VMs. Once a day, this application will execute five different batch jobs. Each of the batch jobs requires a dedicated set of permissions on Google Cloud resources outside of your application. You need to design a secure access concept for the batch jobs that adheres to the least-privilege principle. What should you do?

   • A1. Create a general service account “g-sa” to orchestrate the batch jobs. 2. Create one service account per batch job ‘b-sa-[1-5]’. Grant only the permissions required to run the individual batch jobs to the service accounts and generate service account keys for each of these service accounts. 3. Store the service account keys in Secret Manager. Grant g-sa access to Secret Manager and run the batch jobs with the permissions of b-sa-[1-5].
   • B1. Create a general service account “g-sa” to execute the batch jobs. 2. Grant the permissions required to execute the batch jobs to g-sa. 3. Execute the batch jobs with the permissions granted to g-sa.
   • C1. Create a workload identity pool and configure workload identity pool providers for each batch job. 2. Assign the workload identity user role to each of the identities configured in the providers. 3. Create one service account per batch job “b-sa-[1-5]”, and grant only the permissions required to run the individual batch jobs to the service accounts. 4. Generate credential configuration files for each of the providers. Use these files to execute the batch jobs with the permissions of b-sa-[1-5].
   • D1. Create a general service account “g-sa” to orchestrate the batch jobs. 2. Create one service account per batch job “b-sa-[1-5]”, and grant only the permissions required to run the individual batch jobs to the service accounts. 3. Grant the Service Account Token Creator role to g-sa. Use g-sa to obtain short-lived access tokens for b-sa-[1-5] and to execute the batch jobs with the permissions of b-sa-[1-5].

   Show answer

   Answer: D

   Explanation

   The correct answer is D. 1. Create a general service account “g-sa” to orchestrate the batch jobs. 2. Create one service account per batch job “b-sa-[1-5]”, and grant only the permissions required to run the individual batch jobs to the service accounts. 3. Grant the Service Account Token Creator role to g-sa. Use g-sa to obtain short-lived access tokens for b-sa-[1-5] and to execute the batch jobs with the permissions of b-sa-[1-5]. This approach adheres to the principle of least privilege by ensuring that each batch job has only the permissions it needs to run. The general service account “g-sa” is used to orchestrate the batch jobs, and the Service Account Token Creator role allows it to obtain short-lived access tokens for the batch job service accounts “b-sa-[1-5]”. This setup allows the batch jobs to be executed with the permissions of the respective service accounts.

   Source: Adapted from community discussion — MisterHairy

   Next question

10. Question 160 · 356 in bank

    Your Google Cloud environment has one organization node, one folder named “Apps”, and several projects within that folder. The organizational node enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the terramearth.com organization. The “Apps” folder enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the flowlogistic.com organization. It also has the inheritFromParent: false property. You attempt to grant access to a project in the “Apps” folder to the user testuser@terramearth.com. What is the result of your action and why?

    • AThe action succeeds because members from both organizations, terramearth.com or flowlogistic.com, are allowed on projects in the “Apps” folder.
    • BThe action succeeds and the new member is successfully added to the project's Identity and Access Management (IAM) policy because all policies are inherited by underlying folders and projects.
    • CThe action fails because a constraints/iam.allowedPolicyMemberDomains organization policy must be defined on the current project to deactivate the constraint temporarily.
    • DThe action fails because a constraints/iam.allowedPolicyMemberDomains organization policy is in place and only members from the flowlogistic.com organization are allowed.

    Show answer

    Answer: D

    Explanation

    The correct answer is D. The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy is in place and only members from the flowlogistic.com organization are allowed. The inheritFromParent: false property on the “Apps” folder means that it does not inherit the organization policy from the organization node. Therefore, only the policy set at the folder level applies, which allows only members from the flowlogistic.com organization. As a result, the attempt to grant access to the user testuser@terramearth.com fails because this user is not a member of the flowlogistic.com organization.

    Source: Adapted from community discussion — MisterHairy

    References

    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCSE practice, question 151. 356 questions available.