PCSE practice questions 221–230

1. Question 221 · 356 in bank

   A security audit uncovered several inconsistencies in your project's Identity and Access Management (IAM) configuration. Some service accounts have overly permissive roles, and a few external collaborators have more access than necessary. You need to gain detailed visibility into changes to IAM policies, user activity, service account behavior, and access to sensitive projects. What should you do?

   • AConfigure Google Cloud Functions to be triggered by changes to IAM policies. Analyze changes by using the policy simulator, send alerts upon risky modifications, and store event details.
   • BEnable the metrics explorer in Cloud Monitoring to follow the service account authentication events and build alerts linked on it.
   • CUse Cloud Audit Logs. Create log export sinks to send these logs to a security information and event management (SIEM) solution for correlation with other event sources.
   • DDeploy the OS Config Management agent to your VMs. Use OS Config Management to create patch management jobs and monitor system modifications.

   Show answer

   Answer: C

   Explanation

   C - Comprehensive Logging: Cloud Audit Logs capture a wide range of activities, including IAM policy changes, user logins, API calls, and resource access. This provides a comprehensive view of your organization's IAM activity. Log Export: By creating log export sinks, you can send Cloud Audit Logs to a SIEM solution, where they can be correlated with other event sources to identify potential security threats. Detailed Analysis: SIEM solutions can provide advanced analytics and reporting capabilities, allowing you to analyze IAM changes, detect anomalies, and identify potential security risks.

   Source: Adapted from community discussion — abdelrahman89

   References

   • Google Cloud documentation

   Next question

2. Question 222 · 356 in bank

   You manage multiple internal-only applications that are hosted within different Google Cloud projects. You are deploying a new application that requires external internet access. To maintain security, you want to clearly separate this new application from internal systems. Your solution must have effective security isolation for the new externally-facing application. What should you do?

   • ADeploy the application within the same project as an internal application. Use a Shared VPC model to manage network configurations.
   • BPlace the application in the same project as an existing internal application, and adjust firewall rules to allow external traffic.
   • CCreate a VPC Service Controls perimeter, and place the new application’s project within that perimeter.
   • DCreate a new project for the application, and use VPC Network Peering to access necessary resources in the internal projects.

   Show answer

   Answer: D

   Explanation

   Option C suggests creating a VPC Service Controls perimeter and placing the new application’s project within that perimeter. While VPC Service Controls can enhance security by defining a security perimeter around Google Cloud resources, it is primarily designed to protect data from being exfiltrated to unauthorized networks or users. It does not inherently provide the level of isolation needed for an externally-facing application. Creating a new project (Option D) ensures complete separation of resources, IAM policies, and network configurations, which is crucial for maintaining security isolation between internal and external applications. This approach minimizes the risk of accidental exposure of internal resources to the internet.

   Source: Adapted from community discussion — Pime13

   Next question

3. Question 223 · 356 in bank

   A customer needs an alternative to storing their plain text secrets in their source-code management (SCM) system. How should the customer achieve this using Google Cloud Platform?

   • AUse Cloud Source Repositories, and store secrets in Cloud SQL.
   • BEncrypt the secrets with a Customer-Managed Encryption Key (CMEK), and store them in Cloud Storage.
   • CRun the Cloud Data Loss Prevention API to scan the secrets, and store them in Cloud SQL.
   • DDeploy the SCM to a Compute Engine VM with local SSDs, and enable preemptible VMs.

   Show answer

   Answer: B

   Explanation

   I guess this question was written prior to end of 2019, because Secret Manager is definitely the preferred solution nowadays. B is best of some bad options.

   Source: Adapted from community discussion — FatCharlie

   Next question

4. Question 224 · 356 in bank

   A company migrated their entire data/center to Google Cloud Platform. It is running thousands of instances across multiple projects managed by different departments. You want to have a historical record of what was running in Google Cloud Platform at any point in time. What should you do?

   • AUse Resource Manager on the organization level.
   • BUse Forseti Security to automate inventory snapshots.
   • CUse Stackdriver to create a dashboard across all projects.
   • DUse Security Command Center to view all assets across the organization.

   Show answer

   Answer: D

   Explanation

   'B is the correct answer. Only Forseti security can have both 'past' and 'present' (i.e. historical) records of the resources. https://forsetisecurity.org/about/

   Source: Adapted from community discussion — smart123

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 225 · 356 in bank

   You work for an ecommerce company that stores sensitive customer data across multiple Google Cloud regions. The development team has built a new 3-tier application to process orders and must integrate the application into the production environment. You must design the network architecture to ensure strong security boundaries and isolation for the new application, facilitate secure remote maintenance by authorized third-party vendors, and follow the principle of least privilege. What should you do?

   • ACreate separate VPC networks for each tier. Use VPC peering between application tiers and other required VPCs. Provide vendors with SSH keys and root access only to the instances within the VPC for maintenance purposes.
   • BCreate a single VPC network and create different subnets for each tier. Create a new Google project specifically for the third-party vendors and grant the network admin role to the vendors. Deploy a VPN appliance and rely on the vendors’ configurations to secure third-party access.
   • CCreate separate VPC networks for each tier. Use VPC peering between application tiers and other required VPCs. Enable Identity-Aware Proxy (IAP) for remote access to management resources, limiting access to authorized vendors.
   • DCreate a single VPC network and create different subnets for each tier. Create a new Google project specifically for the third-party vendors. Grant the vendors ownership of that project and the ability to modify the Shared VPC configuration.

   Show answer

   Answer: C

   Explanation

   C - Separate VPCs: Creating separate VPC networks for each tier provides a strong isolation boundary, reducing the risk of unauthorized access or lateral movement. VPC Peering: Using VPC peering between application tiers and other required VPCs allows for secure communication while maintaining isolation. Identity-Aware Proxy (IAP): Enabling IAP for remote access to management resources provides a secure and controlled way for authorized vendors to access the application. IAP requires authentication and authorization, ensuring that only authorized individuals can access the resources. Least Privilege: This approach adheres to the principle of least privilege by granting vendors only the necessary access to perform their maintenance tasks.

   Source: Adapted from community discussion — abdelrahman89

   Next question

6. Question 226 · 356 in bank

   Your organization is implementing separation of duties in a Google Cloud project. A group of developers must deploy new code, but cannot have permission to change network firewall rules. What should you do?

   • AAssign the network administrator IAM role to all developers. Tell developers not to change firewall settings.
   • BUse Access Context Manager to create conditions that allow only authorized administrators to change firewall rules based on attributes such as IP address or device security posture.
   • CCreate and assign two custom IAM roles. Assign the deployer role to control Compute Engine and deployment-related permissions. Assign the network administrator role to manage firewall permissions.
   • DGrant the editor IAM role to the developer group. Explicitly negate any firewall modification permissions by using IAM deny policies.

   Show answer

   Answer: C

   Explanation

   C - Custom Roles: Creating custom IAM roles allows you to define granular permissions, ensuring that developers only have the necessary access to deploy new code. Separation of Duties: By assigning the deployer role to control Compute Engine and deployment-related permissions, while assigning the network administrator role to manage firewall permissions, you effectively enforce separation of duties. This reduces the risk of unauthorized access or malicious activities. Granular Control: Custom roles provide more granular control over permissions compared to pre-defined roles, allowing you to tailor access to specific tasks.

   Source: Adapted from community discussion — abdelrahman89

   Next question

7. Question 227 · 356 in bank

   You manage a Google Cloud organization with many projects located in various regions around the world. The projects are protected by the same Access Context Manager access policy. You created a new folder that will host two projects that process protected health information (PHI) for US-based customers. The two projects will be separately managed and require stricter protections. You are setting up the VPC Service Controls configuration for the new folder. You must ensure that only US-based personnel can access these projects and restrict Google Cloud API access to only BigQuery and Cloud Storage within these projects. What should you do?

   • A• Create a scoped access policy, add the new folder under “Select resources to include in the policy,” and assign an administrator under “Manage principals.” • For the service perimeter, specify the two new projects as “Resources to protect” in the service perimeter configuration. • Set “Restricted services” to “all services,” set “VPC accessible services” to “Selected services,” and specify only BigQuery and Cloud Storage under “Selected services.”
   • B• Enable Identity Aware Proxy in the new projects. • Create an Access Context Manager access level with an “IP Subnetworks” attribute condition set to the US-based corporate IP range. • Enable the “Restrict Resource Service Usage” organization policy at the new folder level with an “Allow” policy type and set both “storage.googleapis.com” and “bigquery.googleapis.com” under “Custom values.”
   • C• Edit the organization-level access policy and add the new folder under “Select resources to include in the policy.” • Specify the two new projects as “Resources to protect” in the service perimeter configuration. • Set “Restricted services” to “all services,” set “VPC accessible services” to “Selected services,” and specify only BigQuery and Cloud Storage. • Edit the existing access level to add a “Geographic locations” condition set to “US.”
   • D• Configure a Cloud Interconnect connection or a Virtual Private Network (VPN) between the on-premises environment and the Google Cloud organization. • Configure the VPC firewall policies within the new projects to only allow connections from the on-premises IP address range. • Enable the Restrict Resource Service Usage organization policy on the new folder with an “Allow” policy type, and set both “storage.googleapis.com” and “bigquery.googleapis.com” under “Custom values.”

   Show answer

   Answer: C

   Explanation

   The best solution to meet the requirements of restricting access to US-based personnel and limiting Google Cloud API access to only BigQuery and Cloud Storage for the two new projects processing PHI is C.

   Source: Adapted from community discussion — siheom

   Next question

8. Question 228 · 356 in bank

   There is a threat actor that is targeting organizations like yours. Attacks are always initiated from a known IP address range. You want to deny-list those IPs for your website, which is exposed to the internet through an Application Load Balancer. What should you do?

   • ACreate a Cloud Armor policy with a deny-rule for the known IP address range. Attach the policy to the backend of the Application Load Balancer.
   • BActivate Identity-Aware Proxy for the backend of the Application Load Balancer. Create a firewall rule that only allows traffic from the proxy to the application.
   • CCreate a log sink with a filter containing the known IP address range. Trigger an alert that detects when the Application Load Balancer is accessed from those IPs.
   • DCreate a Cloud Firewall policy with a deny-rule for the known IP address range. Associate the firewall policy to the Virtual Private Cloud with the application backend.

   Show answer

   Answer: A

   Explanation

   A - Cloud Armor: Cloud Armor is a web application firewall (WAF) that provides DDoS protection and advanced security features. Creating a deny-rule for the known IP address range will effectively block traffic from those IPs, preventing them from reaching your website. Application Load Balancer Integration: Attaching the Cloud Armor policy to the backend of the Application Load Balancer ensures that the policy is applied to all traffic entering your website, regardless of the specific backend instance.

   Source: Adapted from community discussion — abdelrahman89

   Next question

9. Question 229 · 356 in bank

   You are managing a Google Cloud environment that is organized into folders that represent different teams. These teams need the flexibility to modify organization policies relevant to their work. You want to grant the teams the necessary permissions while upholding Google-recommended security practices and minimizing administrative complexity. What should you do?

   • ACreate a custom IAM role with the organization policy administrator permission and grant the permission to each team’s folder. Limit policy modifications based on folder names within the custom role’s definition.
   • BAssign the organization policy administrator role to a central service account and provide teams with the credentials to use the service account when needed.
   • CCreate an organization-level tag. Attach the tag to relevant folders. Use an IAM condition to restrict the organization policy administrator role to resources with that tag.
   • DGrant each team the organization policy administrator role at the organization level.

   Show answer

   Answer: C

   Explanation

   C - Granular Control: Creating an organization-level tag allows you to precisely control which teams have access to modify organization policies by attaching the tag to relevant folders. This ensures that only authorized teams can make changes. IAM Condition: Using an IAM condition to restrict the organization policy administrator role to resources with the tag provides a flexible and efficient way to grant permissions while maintaining control. This ensures that the role is only accessible for the intended teams. Security Best Practices: This approach aligns with Google-recommended security practices by limiting access to organization policies to authorized teams and using IAM conditions to enforce appropriate controls. Administrative Efficiency: This approach simplifies administration by providing a centralized mechanism for managing permissions and ensuring that only authorized teams can modify organization policies.

   Source: Adapted from community discussion — abdelrahman89

   Next question

10. Question 230 · 356 in bank

    Your organization is using Vertex AI Workbench Instances. You must ensure that newly deployed Instances are automatically kept up-to-date and that users cannot accidentally alter settings in the operating system. What should you do?

    • AEnforce the disableRootAccesa and requireAutoUpgradeSchedule organization policies for newly deployed Instances.
    • BEnable the VM Manager and ensure the corresponding Google Compute Engine instances are added.
    • CImplement a firewall rule that prevents Secure Shell access to the corresponding Google Compute Engine instances by using tags.
    • DAssign the AI Notebooks Runner and AI Notebooks Viewer roles to the users of the AI Workbench Instances.

    Show answer

    Answer: A

    Explanation

    A - disableRootAccess: This organization policy prevents users from accessing the root account of the underlying Google Compute Engine instance, which helps to prevent accidental configuration changes. requireAutoUpgradeSchedule: This organization policy ensures that instances are automatically upgraded to the latest operating system patches, keeping them secure and up-to-date.

    Source: Adapted from community discussion — abdelrahman89

    References

    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCSE practice, question 221. 356 questions available.