VendorsExamsEnterprise
Support
Request an ExamContact UsFAQ

Professional Cloud Security Engineer Free Sample Questions

Description

Covers managing Cloud Identity and service accounts, perimeter and boundary security, data loss prevention and encryption including AI workloads, and security automation and compliance.

12 free sample questions180 in the full practice test Other version: PCSE(234)

Try simulator

GCP-PCSE Sample Questions

  1. Question 1

    Intermediate

    Configuring Access · Configuring Workload Identity Federation

    NovaTech is a multi-cloud organization that runs its primary CI/CD pipelines in AWS. These AWS-based pipelines need to deploy infrastructure and upload build artifacts to Google Cloud. The Chief Information Security Officer (CISO) has strictly forbidden the creation and export of long-lived Google Cloud Service Account keys to prevent credential leakage. Which approach is the most secure and optimal way to grant the AWS pipelines access to Google Cloud resources?

    Answer and explanation

    Correct answer: B

    Workload Identity Federation is the optimal and recommended way to grant on-premises or multi-cloud workloads access to Google Cloud resources without using long-lived service account keys. By configuring an identity pool and an AWS provider, AWS workloads can exchange their AWS STS tokens for short-lived Google Cloud access tokens, eliminating the risk of key leakage.

    flowchart LR A[AWS Pipeline] -->|1. AWS STS Token| B(GCP Workload Identity Pool) B -->|2. Exchange Token| A A -->|3. Impersonate| C[GCP Service Account] C -->|4. Access| D[(GCP Resources)]

  2. Question 2

    Advanced

    Configuring Access · Granting permissions using IAM conditions and IAM deny policies

    Aegis Healthcare uses Google Cloud to store sensitive patient records in a specific folder named 'PatientData'. The organization has an IAM Allow policy at the folder level granting the 'Data Analysts' group the roles/bigquery.dataViewer role. However, a recent compliance audit requires that a specific contractor team (which is part of the Data Analysts group) must NEVER have access to the 'PatientData' folder under any circumstances. What is the most robust and scalable way to enforce this restriction?

    Answer and explanation

    Correct answer: B

    IAM Deny policies are evaluated before IAM Allow policies. If an IAM Deny policy explicitly denies a permission, the principal cannot perform the action, regardless of any Allow policies they possess. This is the most robust way to ensure a specific group is blocked from accessing sensitive data, even if they inherit broad allow permissions from higher up in the resource hierarchy.

  3. Question 3

    Intermediate

    Configuring Access · Identifying use cases and configuring Privileged Access Manager

    Zephyr Financial is implementing least privilege across its engineering teams. Site Reliability Engineers (SREs) normally only have Viewer access to production projects. During a P1 incident, they need elevated privileges (e.g., roles/compute.admin) to mitigate issues, but these privileges must expire automatically after 2 hours and require approval from an engineering manager. Which Google Cloud service should be configured to meet this requirement?

    Answer and explanation

    Correct answer: A

    Privileged Access Manager (PAM) enables Just-In-Time (JIT) access in Google Cloud. It allows administrators to define entitlements that grant temporary, elevated access to resources. Requesters can ask for this access when needed, optionally requiring approvals, and the access automatically expires after a configured duration.

  4. Question 4

    Beginner

    Configuring Access · Configuring Workforce Identity Federation

    A retail company has acquired a smaller startup. The startup's employees currently use Okta for identity management. The parent company wants to grant the startup's developers access to specific Google Cloud Console projects without creating new user accounts in the parent company's Google Workspace/Cloud Identity domain. Which solution should the cloud security engineer implement?

    Answer and explanation

    Correct answer: B

    Workforce Identity Federation allows you to grant external user identities (like those managed in Okta, Azure AD, or other OIDC/SAML IdPs) access to Google Cloud resources without needing to sync them into Cloud Identity or Google Workspace. It is specifically designed for workforce users accessing the Cloud Console or APIs.

  5. Question 5

    Intermediate

    Configuring Access · Managing service account impersonation

    A Terraform CI/CD pipeline runs on a Google Kubernetes Engine (GKE) cluster using a dedicated service account named sa-terraform-runner. This service account needs to deploy resources across multiple projects by assuming the identity of a highly privileged service account named sa-org-admin. Which IAM role must be granted to sa-terraform-runner on the sa-org-admin service account to allow this impersonation?

    Answer and explanation

    Correct answer: C

    To impersonate a service account and generate short-lived OAuth 2.0 access tokens, signed JWTs, or signed blobs, the principal (in this case, sa-terraform-runner) must be granted the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account (sa-org-admin). The Service Account User role is used for attaching service accounts to resources, not for direct API impersonation.

  6. Question 6

    IntermediateMultiple answers

    Configuring Access · Managing pre-built or custom organization policies for the organization, folders, and projects

    Kallisto Corp operates under strict European data residency laws. The compliance team mandates that no Google Cloud resources can be created outside of the europe-west1 and europe-west3 regions. Which TWO actions should the security engineer take to enforce this requirement comprehensively across the entire organization? (Select TWO)

    Answer and explanation

    Correct answers: B, C

    To restrict the physical location of newly created resources across the entire organization, you must use the Organization Policy Service. Specifically, you configure the constraints/gcp.resourceLocations constraint at the organization node and set the allowed values to the required European regions.

Register free for 6 more questions

Or unlock all 180 GCP-PCSE questions with explanations, timed mode and flashcards.

Related practice tests

All Google practice exams