PCSE sample questions with answers
The other 89 questions are in the practice tool, with answers revealed as you go.
Start 20 questionsConfiguring access
- Several pods on the same GKE node need different Cloud Storage permissions. Which feature lets each pod authenticate to Google Cloud APIs with its own IAM identity instead of the node's service account?
- Every Compute Engine instance in a business unit's folder should authorize administrator logins through IAM roles, not through public keys stored in instance or project metadata. What is the most centralized way to enforce this?
- After a service account's key surfaced in a public repository, responders must list every project, folder, and bucket that the identity can reach, including access inherited from higher levels. Which tool gives them that view?
Securing communications and boundary protection
- A research institute's security policy forbids any virtual machine in its Google Cloud organization from being assigned a public IP address. Which mechanism enforces this across all current and future projects?
- A media company needs to block requests that combine a particular header value, a URL path pattern and a specific country. Which Cloud Armor feature supports this kind of logic?
Ensuring data protection
- A government agency must keep its encryption keys in its own on-premises key management system, and Google Cloud services must use those keys without the key material ever being stored in Google Cloud. Which option meets this requirement?
- A key administrator schedules a Cloud KMS key version for destruction and wants the most time possible to notice a mistake before the cryptographic material is removed. What is the longest pending window available?
- A regulated firm requires every new Compute Engine persistent disk to be protected by a customer-managed key. Prevention matters more than cleanup, so non-compliant disks must never be created. Which control achieves this?
Managing operations and threat detection
Supporting compliance requirements
- An auditor needs a record of which user ran which SQL statement against BigQuery datasets across the organization, including the statement text. Which logging must be in place?
- A CISO wants the organization's approved baseline, covering selected organization policies, detectors, and custom rules, written as a versioned definition, deployed to folders, and monitored for drift with findings. Which Security Command Center capability fits?