[Google] GCP-PCSE - Professional Cloud Security Engineer
321 Questions
", "upvotes": "1"}, {"username": "DevXr", "date": "Wed 14 Dec 2022 16:45", "selected_answer": "AC", "content": "A and C", "upvotes": "1"}, {"username": "DevXr", "date": "Wed 14 Dec 2022 16:42", "selected_answer": "", "content": "A and C", "upvotes": "1"}, {"username": "MathDayMan", "date": "Fri 28 Oct 2022 16:38", "selected_answer": "", "content": "A and C", "upvotes": "1"}, {"username": "Meyucho", "date": "Thu 15 Sep 2022 13:56", "selected_answer": "AC", "content": "A and C", "upvotes": "1"}, {"username": "GCP72", "date": "Tue 23 Aug 2022 07:10", "selected_answer": "AC", "content": "The correct answer is AC", "upvotes": "1"}, {"username": "mynk29", "date": "Sat 26 Feb 2022 12:11", "selected_answer": "", "content": "Private google access is enabled at Subnet level not at VM level. I am unsure why its not subnet. If you disable the route to internet- you cannot reach internet.", "upvotes": "3"}, {"username": "_01_", "date": "Fri 03 Dec 2021 10:09", "selected_answer": "AC", "content": "Public IP\nPrivate Google Access", "upvotes": "2"}, {"username": "mistryminded", "date": "Tue 23 Nov 2021 03:26", "selected_answer": "AC", "content": "Correct answer is:", "upvotes": "2"}, {"username": "a_vi", "date": "Tue 02 Nov 2021 14:53", "selected_answer": "", "content": "Correct Answer is AC\nOption A : because per GCP documentation, \u201cPrevent internet access to instances by setting them up with only a private IP address\u201d meaning no public IPs.\nOption C: because VM instances that only have internal IP addresses (no external IP addresses) can use Private Google Access. They can reach the external IP addresses of Google APIs and services.", "upvotes": "3"}], "discussion_summary": {"time_range": "the period from Q2 2021 to Q1 2025", "num_discussions": 18, "consensus": {"A": {"rationale": "Option A (Public IP): Disabling external access by assigning private IP addresses only."}, "C": {"rationale": "Option C (Private Google Access): Allowing VM instances with internal IP addresses to access external Google APIs and services."}}, "key_insights": ["the consensus answer to this question is AC (Public IP and Private Google Access)", "Disabling external access by assigning private IP addresses only.", "Allowing VM instances with internal IP addresses to access external Google APIs and services."], "summary_html": "
Agree with Suggested Answer. From the internet discussion, including the period from Q2 2021 to Q1 2025, the consensus answer to this question is AC (Public IP and Private Google Access), which the reason is the following: \n
\n
Option A (Public IP): Disabling external access by assigning private IP addresses only.
\n
Option C (Private Google Access): Allowing VM instances with internal IP addresses to access external Google APIs and services.
\nThe AI agrees with the suggested answer of AC (Public IP and Private Google Access). \n \nReasoning: \nTo ensure a Compute Engine instance does not have access to the internet or Google APIs/services, both a public IP address and Private Google Access must be disabled. Disabling a public IP prevents direct internet connectivity. Disabling Private Google Access prevents the instance from using its internal IP to reach Google services. \n \nDetailed explanation of why the selected options are correct: \n
\n
A. Public IP: If a Compute Engine instance has a public IP address, it can directly communicate with the internet. Removing the public IP prevents this direct access.
\n
C. Private Google Access: Private Google Access allows instances without public IPs to access Google Cloud services using their internal IPs. Disabling this feature ensures the instance cannot reach Google APIs or services.
\n
\n \nExplanation of why the other options are incorrect: \n
\n
B. IP Forwarding: IP Forwarding allows an instance to act as a router, forwarding traffic between networks. While relevant for network configuration, it doesn't directly control the instance's own access to the internet or Google APIs.
\n
D. Static routes: Static routes define the path network traffic takes. They are not directly related to whether an instance can access the internet or Google APIs.
\n
E. IAM Network User Role: This IAM role grants permissions to use network resources, but it doesn't directly control internet or Google API access for the instance itself.
\n
\n \nCitations:\n
\n
Compute Engine documentation on Private Google Access, https://cloud.google.com/compute/docs/configure-private-google-access
\n
\n"}, {"folder_name": "topic_1_question_2", "topic": "1", "question_num": "2", "question": "Which two implied firewall rules are defined on a VPC network? (Choose two.)", "question_html": "
\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\tWhich two implied firewall rules are defined on a VPC network? (Choose two.) \n
", "options": [{"letter": "A", "text": "A rule that allows all outbound connections", "html": "
\n\n\t\t\t\t\t\t\t\t\t\t\t\t\tA.\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\tA rule that allows all outbound connections\n\t\t\t\t\t\t\t\t\t\t\n Most Voted\n
", "is_correct": true}, {"letter": "B", "text": "A rule that denies all inbound connections", "html": "
\n\n\t\t\t\t\t\t\t\t\t\t\t\t\tB.\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\tA rule that denies all inbound connections\n\t\t\t\t\t\t\t\t\t\t\n Most Voted\n
", "is_correct": true}, {"letter": "C", "text": "A rule that blocks all inbound port 25 connections", "html": "
\n\n\t\t\t\t\t\t\t\t\t\t\t\t\tC.\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\tA rule that blocks all inbound port 25 connections\n\t\t\t\t\t\t\t\t\t\t
", "is_correct": false}, {"letter": "D", "text": "A rule that blocks all outbound connections", "html": "
\n\n\t\t\t\t\t\t\t\t\t\t\t\t\tD.\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\tA rule that blocks all outbound connections\n\t\t\t\t\t\t\t\t\t\t
", "is_correct": false}, {"letter": "E", "text": "A rule that allows all inbound port 80 connections", "html": "
\n\n\t\t\t\t\t\t\t\t\t\t\t\t\tE.\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\tA rule that allows all inbound port 80 connections\n\t\t\t\t\t\t\t\t\t\t
", "is_correct": false}], "correct_answer": "AB", "correct_answer_html": "AB", "question_type": "multiple_choice", "has_images": false, "discussions": [{"username": "KILLMAD", "date": "Mon 09 Mar 2020 10:50", "selected_answer": "", "content": "I agree AB", "upvotes": "14"}, {"username": "cloudprincipal", "date": "Thu 26 Sep 2024 07:33", "selected_answer": "AB", "content": "Implied IPv4 allow egress rule. An egress rule whose action is allow, destination is 0.0.0.0/0, and priority is the lowest possible (65535) lets any instance send traffic to any destination\n\nImplied IPv4 deny ingress rule. An ingress rule whose action is deny, source is 0.0.0.0/0, and priority is the lowest possible (65535) protects all instances by blocking incoming connections to them. \n\nhttps://cloud.google.com/vpc/docs/firewalls?hl=en#default_firewall_rules", "upvotes": "1"}, {"username": "budlinc", "date": "Mon 15 May 2023 19:06", "selected_answer": "AB", "content": "A & B for sure", "upvotes": "2"}, {"username": "DevXr", "date": "Wed 14 Dec 2022 16:45", "selected_answer": "AB", "content": "A and B", "upvotes": "1"}, {"username": "MathDayMan", "date": "Fri 28 Oct 2022 16:39", "selected_answer": "", "content": "AB\nis the one", "upvotes": "2"}, {"username": "GCP72", "date": "Tue 23 Aug 2022 07:11", "selected_answer": "", "content": "The correct answer is AB", "upvotes": "1"}, {"username": "DebasishLowes", "date": "Sat 06 Mar 2021 09:27", "selected_answer": "", "content": "Answer AB", "upvotes": "3"}, {"username": "DebasishLowes", "date": "Sun 21 Feb 2021 19:40", "selected_answer": "", "content": "A and B", "upvotes": "1"}, {"username": "saurabh1805", "date": "Tue 13 Oct 2020 18:34", "selected_answer": "", "content": "A and B are correct options here.", "upvotes": "2"}, {"username": "ArizonaClassics", "date": "Sun 26 Jul 2020 13:30", "selected_answer": "", "content": "A,B is the correct answer", "upvotes": "4"}], "discussion_summary": {"time_range": "Recent discussions", "num_discussions": 10, "consensus": {"A": {}, "B": {"rationale": "AB. The comments agree with this answer because the default firewall rules in Google Cloud VPC include an implied IPv4 allow egress rule and an implied IPv4 deny ingress rule, which are critical for network security. The egress rule allows instances to send traffic to any destination, while the ingress rule blocks incoming connections, protecting the instances."}}, "key_insights": ["the default firewall rules in Google Cloud VPC include an implied IPv4 allow egress rule", "the default firewall rules in Google Cloud VPC include an implied IPv4 deny ingress rule", "these rules are critical for network security"], "summary_html": "
From the internet discussion, which includes comments from Q2 2020 to Q4 2024, the consensus is that the correct answer is AB. The comments agree with this answer because the default firewall rules in Google Cloud VPC include an implied IPv4 allow egress rule and an implied IPv4 deny ingress rule, which are critical for network security. The egress rule allows instances to send traffic to any destination, while the ingress rule blocks incoming connections, protecting the instances.
The AI agrees with the suggested answer of AB. \nReasoning: The default firewall rules in a Google Cloud VPC include two implied rules: an implied allow egress rule and an implied deny ingress rule. These rules are fundamental to the operation and security of the VPC network. \n
\n
A. A rule that allows all outbound connections: This aligns with the implied egress rule, which permits instances within the VPC to initiate connections to any destination. This rule is in place by default, allowing instances to access external resources or communicate with other services.
\n
B. A rule that denies all inbound connections: This corresponds to the implied ingress rule. By default, all incoming connections to instances within the VPC are blocked unless explicitly allowed by configured firewall rules. This provides a baseline level of security.
\n
\nReasons for not choosing the other options: \n
\n
C. A rule that blocks all inbound port 25 connections: While blocking port 25 (SMTP) might be a common security practice, it is not an implied rule in Google Cloud VPC. Implied rules are more general, covering all inbound traffic.
\n
D. A rule that blocks all outbound connections: This is the opposite of the implied egress rule. Blocking all outbound connections by default would severely limit the functionality of instances within the VPC.
\n
E. A rule that allows all inbound port 80 connections: Allowing all inbound port 80 connections is not an implied rule. While you can create a firewall rule to allow this, it is not enabled by default. The default is to deny all inbound connections unless explicitly allowed.
\n
\n\n
\n
Citations:
\n
Google Cloud VPC Firewall Rules, https://cloud.google.com/vpc/docs/firewalls
\n
"}, {"folder_name": "topic_1_question_3", "topic": "1", "question_num": "3", "question": "A customer needs an alternative to storing their plain text secrets in their source-code management (SCM) system.How should the customer achieve this using Google Cloud Platform?", "question_html": "
\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\tA customer needs an alternative to storing their plain text secrets in their source-code management (SCM) system. How should the customer achieve this using Google Cloud Platform? \n
", "options": [{"letter": "A", "text": "Use Cloud Source Repositories, and store secrets in Cloud SQL.", "html": "
\n\n\t\t\t\t\t\t\t\t\t\t\t\t\tA.\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\tUse Cloud Source Repositories, and store secrets in Cloud SQL.\n\t\t\t\t\t\t\t\t\t\t
", "is_correct": false}, {"letter": "B", "text": "Encrypt the secrets with a Customer-Managed Encryption Key (CMEK), and store them in Cloud Storage.", "html": "
\n\n\t\t\t\t\t\t\t\t\t\t\t\t\tB.\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\tEncrypt the secrets with a Customer-Managed Encryption Key (CMEK), and store them in Cloud Storage.\n\t\t\t\t\t\t\t\t\t\t\n Most Voted\n
", "is_correct": true}, {"letter": "C", "text": "Run the Cloud Data Loss Prevention API to scan the secrets, and store them in Cloud SQL.", "html": "
\n\n\t\t\t\t\t\t\t\t\t\t\t\t\tC.\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\tRun the Cloud Data Loss Prevention API to scan the secrets, and store them in Cloud SQL.\n\t\t\t\t\t\t\t\t\t\t
", "is_correct": false}, {"letter": "D", "text": "Deploy the SCM to a Compute Engine VM with local SSDs, and enable preemptible VMs.", "html": "
\n\n\t\t\t\t\t\t\t\t\t\t\t\t\tD.\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\tDeploy the SCM to a Compute Engine VM with local SSDs, and enable preemptible VMs.\n\t\t\t\t\t\t\t\t\t\t
", "is_correct": false}], "correct_answer": "B", "correct_answer_html": "B", "question_type": "single_choice", "has_images": false, "discussions": [{"username": "FatCharlie", "date": "Wed 25 Nov 2020 08:50", "selected_answer": "", "content": "I guess this question was written prior to end of 2019, because Secret Manager is definitely the preferred solution nowadays. \n\nB is best of some bad options.", "upvotes": "19"}, {"username": "HateMicrosoft", "date": "Sat 13 Mar 2021 16:12", "selected_answer": "", "content": "Gosh, clearly this is a very old question. Secret Manager is the answer. No matter what choices are there.", "upvotes": "6"}, {"username": "3fd692e", "date": "Wed 23 Oct 2024 11:45", "selected_answer": "B", "content": "B is the only reasonable answer but be aware if on the test the question is updated and Secret Manager provided as an option.", "upvotes": "1"}, {"username": "standm", "date": "Thu 11 May 2023 02:38", "selected_answer": "", "content": "Secret manager should be used for Storing secrets. CMEK is used for Encrypting Customer data. Proverbial bad question IMHO!", "upvotes": "1"}, {"username": "DevXr", "date": "Wed 14 Dec 2022 16:44", "selected_answer": "B", "content": "B option would be the one", "upvotes": "1"}, {"username": "shayke", "date": "Tue 13 Dec 2022 07:43", "selected_answer": "B", "content": "b is the only choice", "upvotes": "1"}, {"username": "hero0321", "date": "Mon 10 Oct 2022 10:54", "selected_answer": "", "content": "B is the correct answer", "upvotes": "1"}, {"username": "AwesomeGCP", "date": "Fri 07 Oct 2022 17:52", "selected_answer": "B", "content": "B. Encrypt the secrets with a Customer-Managed Encryption Key (CMEK), and store them in Cloud Storage.", "upvotes": "1"}, {"username": "GCP72", "date": "Tue 23 Aug 2022 07:14", "selected_answer": "", "content": "The correct answer is B but Secret Manager is definitely the preferred solution.", "upvotes": "2"}, {"username": "gcpgurus", "date": "Wed 08 Jun 2022 14:22", "selected_answer": "", "content": "Secrets Manager is needed in answers", "upvotes": "2"}, {"username": "Raghucs", "date": "Thu 18 Nov 2021 07:30", "selected_answer": "B", "content": "B is the best answer.", "upvotes": "1"}, {"username": "saurabh1805", "date": "Mon 26 Oct 2020 19:35", "selected_answer": "", "content": "I would prefer secret manager but B is best possible option here.", "upvotes": "2"}, {"username": "ArizonaClassics", "date": "Sun 26 Jul 2020 13:31", "selected_answer": "", "content": "I agree with B", "upvotes": "2"}, {"username": "KILLMAD", "date": "Wed 11 Mar 2020 10:48", "selected_answer": "", "content": "Agree that the answer is B", "upvotes": "4"}], "discussion_summary": {"time_range": "The internet discussion from Q1 2020 to Q4 2024", "num_discussions": 14, "consensus": {"B": {"rationale": "this is the best available option considering the choices provided, as Secret Manager wasn't included in the choices"}}, "key_insights": ["Encrypt the secrets with a Customer-Managed Encryption Key (CMEK), and store them in Cloud Storage", "Secret Manager wasn't included in the choices", "Secret Manager would be a preferred solution if it was an option"], "summary_html": "
\n Agree with Suggested Answer. From the internet discussion from Q1 2020 to Q4 2024, the conclusion of the answer to this question is B. Encrypt the secrets with a Customer-Managed Encryption Key (CMEK), and store them in Cloud Storage, which the reason is this is the best available option considering the choices provided, as Secret Manager wasn't included in the choices. Some users also mentioned that Secret Manager would be a preferred solution if it was an option.\n
\nThe AI agrees with the suggested answer. \nThe suggested answer is B: Encrypt the secrets with a Customer-Managed Encryption Key (CMEK), and store them in Cloud Storage. \nReasoning: The question addresses the need to avoid storing plain text secrets in source code management. While Google Cloud Secret Manager is the ideal solution for managing secrets, it isn't listed as an option. Therefore, the next best solution is to encrypt the secrets before storing them. Option B achieves this by using Customer-Managed Encryption Keys (CMEK) to encrypt the secrets and then storing them in Cloud Storage, which provides a secure and scalable storage solution. \nReasons for not choosing other options:\n
\n
Option A: Use Cloud Source Repositories, and store secrets in Cloud SQL. Storing secrets in Cloud SQL without encryption is not secure and defeats the purpose of the question. Cloud Source Repositories is for source code, not secret storage.
\n
Option C: Run the Cloud Data Loss Prevention API to scan the secrets, and store them in Cloud SQL. The Cloud Data Loss Prevention API is for identifying and classifying sensitive data, not for securely storing secrets. Storing the secrets in Cloud SQL after scanning them without encryption remains insecure.
\n
Option D: Deploy the SCM to a Compute Engine VM with local SSDs, and enable preemptible VMs. This option does not address the problem of storing secrets securely. Furthermore, using preemptible VMs for SCM might lead to instability.
`;
// Discussion section - ENHANCED LAYOUT
if (question.discussion_summary) {
const summary = question.discussion_summary;
html += `
Community Discussion
${summary.time_range || 'Recent discussions'}
`;
// Find the top rated answer (first one in consensus)
if (summary.consensus && Object.keys(summary.consensus).length == 1) {
const topAnswer = Object.keys(summary.consensus)[0];
const topData = summary.consensus[topAnswer];
html += `
Answer ${topAnswer}
${topData.rationale}
`;
}
// Key insights (appear after time range)
if (summary.key_insights && summary.key_insights.length > 0) {
html += `