PCSE — frequently asked questions

Manual log review lacks automated correlation and prioritization. Event Threat Detection surfaces relevant alerts faster, enabling efficient triage before deep-diving into raw logs.

Yes, PCSE assumes core security posture tools are active. The exam tests optimal incident response workflows, not infrastructure provisioning steps.

Workforce Identity Federation is designed exclusively for human users logging into Google Cloud consoles or APIs. Applications require Workload Identity Federation to exchange machine tokens for temporary service account credentials.

Yes, it allows workloads to request short-lived OAuth2 tokens instead of storing static JSON key files. This significantly reduces the attack surface and eliminates manual key rotation overhead.

Scoped access policies restrict which resources can be accessed but do not generate the required short-lived tokens for external clouds.

Yes, WIF dynamically exchanges external tokens for Google OAuth tokens, eliminating the need to download or rotate static keys.

Ingress and egress rules regulate access within a single perimeter or to external services. Cross-perimeter replication requires a dedicated perimeter bridge to maintain isolation boundaries.

Yes, scoping the bridge to exact resources enforces least privilege. Only those buckets can transmit data across the security boundary, preventing unauthorized lateral movement.

Pseudonymization permanently alters data, breaking analytical continuity and requiring complex ETL pipelines. Native masking preserves the original dataset for real-time queries.

Yes, BigQuery row-level access policies support dynamic column masking using SQL expressions tied to user attributes, hiding sensitive fields without duplicating data.

Cloud Build only handles the image creation phase. It cannot patch or update already deployed VMs, which is required for ongoing security baselines.

No. VM Manager manages the lifecycle (patches/config) of existing VMs. You still need hardened base images to ensure a secure starting state before deployment.

Preview mode disables rule enforcement, which risks exposing your site during an active incident. It is intended for safe testing, not for collecting detailed forensic logs.

Yes, verbose logging generates significantly more data and may slightly increase latency. It should only be enabled temporarily during troubleshooting or policy validation.

Assured Workloads enforces baseline policies and isolates workloads but does not actively scan configurations or generate control-failure findings like SCC Premium Compliance Monitoring does.

No, it only discovers and classifies sensitive data at rest. PCI DSS requires ongoing evaluation of network, IAM, and system configurations, which falls under SCC Premium.

Chronicle is a separate, costly SIEM platform not mentioned in the scenario. Native VPC Firewall Policies with Threat Intelligence integrate directly with SCC Premium, making Chronicle unnecessary.

You can attach prebuilt Google Threat Intelligence lists to firewall rules. The system automatically matches destination IPs/domains against these lists to allow, deny, or log traffic.

Vertex AI automatically protects operational metadata using Google-managed keys for performance and consistency, so CMEK only covers user data and models.

Yes, creating a regional Cloud KMS key ring in Europe and linking it to your Vertex AI project satisfies compliance without adding latency to training workloads.

GCDS syncs users from an on-prem AD to Cloud Identity, treating them as internal employees. Partners should remain managed by their own IdPs via federation.

SSO profiles are often for primary workforce single sign-on. Workforce identity pools are specifically designed for federating external identities like partners and contractors.

VPC Service Controls focus on preventing data exfiltration, not on managing network routing topology. The question requires a specific network architecture for a single on-premises entry point.

Shared VPCs share the same IP space and underlying network infrastructure. For 'full isolation' and preventing any network traffic, separate VPCs with firewalls are more robust and compliant with strict security policies.

Cloud Identity only validates the policy during password creation or change. Legacy passwords remain valid until the administrator explicitly forces a retroactive update via the next sign-in enforcement toggle.

No, resetting passwords individually is inefficient and breaks audit trails. The Admin console provides a centralized enforcement switch designed exactly for this scenario.

Disabling it stops all unmatched logs from being captured, breaking automatic retention. Editing the destination maintains continuous ingestion.

Yes, but it adds unnecessary complexity since the default sink already acts as a catch-all. Direct editing saves time and reduces configuration errors.

CI/CD only validates code before deployment, missing runtime injections or post-deployment changes. Scheduled scanning covers the entire lifecycle.

Yes, it automates continuous discovery across organizations and projects, eliminating human error and ensuring consistent, timely reporting.

Standard encryption changes data length and character sets, causing format-checking logic to reject the records during testing.

Yes, FPE provides strong cryptographic protection while retaining necessary data formats for compliant development workflows.

Access Approval only restricts Google personnel access to your resources. It does not transmit justification fields to external KMS partners for audit or denial purposes.

No, it complements your existing infrastructure by sending request reasons to your external KMS. Your on-premises system retains full control over allow or deny decisions.

WIF is architected solely for granting external personnel access to Google Cloud resources, lacking features for public customer onboarding and self-service registration.

Yes. Identity Platform supports enterprise federation protocols like SAML and OIDC, allowing corporate users to authenticate seamlessly via existing organizational directories.

VPC firewall rules are legacy constructs that lack the policy container needed for NGFW features. TLS inspection requires a hierarchical or global firewall policy attached to a resource node.

No. Secure Web Proxy is optimized for outbound internet traffic inspection. Inbound application traffic should use Cloud NGFW policies for centralized decryption and threat prevention.

Standard HTTPS termination at the edge satisfies regulatory encryption mandates without breaking browser compatibility or session management.

No, the LB can be configured for SSL bridging to re-encrypt traffic to backend services, maintaining full encryption throughout the data path.

VPC-SC enforces data exfiltration guardrails at the service perimeter level but does not segment networks or replace project boundaries for workload isolation.

No, peering creates a private, non-routable link between VPCs without merging CIDR blocks or granting broad project-level access, maintaining strict boundaries.

Cloud Asset Inventory can list CryptoKey versions and their create times, but it has no built-in rotation detector or alerting workflow; Security Health Analytics is the managed service for this.

Yes, its kms_key_not_rotated detector identifies Cloud KMS keys that were not rotated within the required period and raises an SCC finding for remediation.

Log views only restrict IAM access to logs stored in GCP log buckets; they do not contain functionality to route or stream data to external on-premises systems.

While not strictly mandatory for basic setups, Dataflow provides the secure transformation, retry logic, and scaling needed to reliably deliver filtered logs to enterprise SIEMs.

The question only requires preventing direct internet access, which a private subnet handles natively without granting unnecessary egress.

Exam wording can be tricky, but security best practices dictate databases should have zero internet exposure unless explicitly mandated.

CMEK still relies on Google’s software-managed encryption infrastructure, whereas client-side encryption combined with HSM guarantees complete data isolation and hardware-backed cryptographic control.

No, Cloud KMS handles key lifecycle management while Cloud HSM performs the actual cryptographic operations inside FIPS-validated hardware, satisfying strict compliance mandates.

Permissions control user access, not image vulnerability states. Binary Authorization evaluates scan results against policies before deployment.

No, it acts as a deployment gate that consumes scan data from Container Analysis. Scanning still occurs in Cloud Build or Artifact Registry.

Cloud Run Invoker grants permission to invoke the service programmatically or via service accounts, not for interactive browser sessions requiring SSO.

No, firewall rules filter traffic by IP address only and cannot authenticate individual users or enforce single sign-on in a web browser.

Platform-as-a-Service does not transfer data or access security to Google. Customers remain responsible for protecting uploaded images and controlling who can invoke the model.

No, managed AI services abstract the underlying network layer. Network security relies on VPC Service Controls and IAM rather than custom perimeter appliances.

Autoclass adjusts storage classes based on access patterns rather than fixed age rules, so it cannot guarantee objects move to Coldline exactly after 365 days.

Yes, it ensures the rule only applies to objects currently in STANDARD storage, avoiding redundant operations on already-downgraded or archived files.

VPC Service Controls only enforce network boundaries and isolate services. They do not inspect, analyze, or redact the actual content flowing through allowed connections.

No. Encryption protects data at rest or in transit but leaves the payload readable to the processing system. Content must be inspected and transformed before model ingestion.

CMEK only secures data at rest and in transit. Once the application decrypts data for computation, it resides in plaintext memory where side-channel attacks can extract it.

Yes, you can migrate your current VM images to Confidential VMs without rewriting your application code, ensuring immediate hardware isolation upon deployment.

Secret Manager still requires manual key generation, injection into pods, and periodic rotation. Workload Identity Federation handles authentication natively without credential management overhead.

Yes, it supports any Google Cloud API that accepts Google IAM tokens, including Cloud Storage, BigQuery, and Pub/Sub, making it universally applicable for GKE workloads.

IAM conditions evaluate permissions after perimeter checks and lack native support for enforcing infrastructure-level network boundaries like service perimeters require.

Service perimeter policies operate at the VPC network boundary, blocking traffic before it reaches IAM evaluation, making them ideal for strict IP-based restrictions.

Cloud Storage excels at object retention, but the prompt explicitly requires large-scale analysis and visualization, which BigQuery handles natively with SQL and built-in BI tools.

Row-level security and authorized views filter query results based on user attributes or IP/location contexts, preventing unauthorized geographic data exposure.

Cloud NAT only performs IP/port translation and does not inspect DNS queries or resolve domains. FQDN filtering requires hierarchical firewall policies or a third-party proxy.

Use the folder level since the question specifies a non-production folder boundary. Scoping it higher would affect unrelated production environments unnecessarily.

Cloud Armor operates exclusively at the external load balancer edge to filter HTTP/HTTPS requests. Internal east-west traffic bypasses this boundary and requires Cloud IDS for inspection.

No. DNSSEC only validates DNS record authenticity to prevent spoofing. It provides zero protection against SQL injection, XSS, or other application-layer attacks.

Access Approval does not support direct PEM imports; it relies on KMS or EKM integrations to manage key lifecycle and permissions securely.

No, EKM acts as a bridge. The actual key material remains in your external HSM, while EKM provides authorized access points within your GCP project.

Access Context Manager controls access by location but does not enforce certified data residency boundaries or explicit administrative approval workflows required for healthcare compliance.

No. Access Transparency logs Google’s access to your data, while Cloud Audit Logs track user and system activities; both are needed for complete regulatory auditability.

It creates a single point of failure and cannot auto-scale to handle traffic spikes, violating the fault tolerance and scaling requirements.

Cloud Functions lack the built-in state management and high-throughput stream processing needed for reliable, near real-time log delivery at scale.

SCC detects and alerts but cannot natively enforce or block new resource creation; Organization Policies provide declarative, real-time enforcement at the API layer.

No, it only prevents future creations. Existing workloads must be identified and migrated manually or via automation scripts after the policy is enforced.

SDP performs point-in-time classification scans rather than continuous compliance tracking, making it unsuitable for ongoing regulatory detection.

No, Organization Policies act as preventive controls that block new resource creation but do not audit or alert on already deployed infrastructure.

PGA only configures VPC subnets to route Google API traffic privately; it does not modify on-premises DNS servers or resolve hostnames outside the VPC.

Cloud NAT provides outbound internet access, but the scenario explicitly states no internet route exists. Private DNS routing through the interconnect is required.

Cloud NAT only provides outbound internet access for private subnets and does not intercept or filter web traffic. Secure Web Proxy requires explicit client routing to enforce security policies.

No, it operates strictly as an explicit proxy, meaning endpoints must be manually pointed to the proxy IP and port. Transparent interception is not supported natively.

ETD focuses on detecting active exploits and emerging attacks using threat intelligence, not on auditing static misconfigurations or compliance baselines.

No, it is automatically enabled when you activate Security Command Center and runs continuous scans without manual detector configuration.

Cloud IDS detects network-level intrusion attempts but cannot monitor identity administration, IAM policy modifications, or configuration drift across projects.

Security Health Analytics automatically scans environments against CIS benchmarks to find misconfigurations, whereas Cloud Logging requires manual filter creation for specific events.

Google-managed keys default to automatic encryption where Google holds the keys, violating the explicit requirement for organizational control over encryption keys for compliance.

Cloud Audit Logs provides immutable, granular records of administrative and data-access events required for compliance auditing, whereas Cloud Monitoring focuses on metrics and alerting.

Organization-level policies apply across the entire enterprise, violating the requirement to manage restrictions solely at the folder level. Scoped policies isolate governance to the target folder and its projects.

No. Service perimeters enforce network and data boundary restrictions, while IAM roles control who can configure and manage those policies. Both are required for proper implementation.

Directory sync creates local Google Cloud identities, violating the explicit requirement to avoid identity synchronization.

Yes, CEL expressions evaluate incoming OIDC claims to dynamically assign IAM roles based on external attributes.

Adding external users to your IdP creates permanent accounts that require manual deletion. Federation delegates authentication to their IdP, enabling instant automatic revocation.

No. JIT is designed for short-term privilege escalation for internal staff. Workforce federation supports sustained, policy-driven access for long-term external collaborations.

Compliance checks run inside the Cloud Build pipeline; only after passing do you trigger the attestation step that ties the image to the build ID.

Binary Authorization relies on attestations produced during CI/CD. Standalone scanners lack the cryptographic proof linking the final image back to the approved build process.

Metrics track performance and availability thresholds, whereas Audit Logs capture immutable administrative and data access events required for compliance.

Yes, under Logging > Explorer, but exporting to a SIEM via sinks is necessary for centralized correlation and long-term retention.

Direct SSH exposes management ports to the internet and requires elevated privileges, violating least privilege. IAP proxies traffic through Google’s infrastructure using granular IAM policies instead.

Subnets lack hard network-level isolation and cannot prevent lateral movement during a breach. Separate VPCs create distinct security boundaries required for sensitive ecommerce data.

Custom IAM role definitions are static and cannot evaluate dynamic resource attributes like folder paths at runtime. IAM conditions are required for runtime filtering.

No. Sharing credentials violates least privilege and breaks audit trails. Delegated access should use distinct identities or workload identity federation.

VM Manager targets standard Compute Engine instances and lacks native integration with Workbench’s managed lifecycle. Use the dedicated AI Platform org policies instead.

It blocks SSH root login for end-users, preventing accidental OS configuration changes while preserving admin override capabilities through approved service accounts.

CMEK encrypts data at rest but does not remove or mask PII, meaning sensitive information remains available to authorized users and can still be ingested into the ML training process.

DLP automatically discovers and classifies sensitive data before it enters the workflow, enabling programmatic de-identification tailored specifically for model training requirements without manual intervention.

SCC Compliance only reports and helps triage violations; it does not proactively enforce the underlying controls, data residency, or IAM policies required by regulations.

No. OCP constraints only govern resource attributes like location or allowed APIs, whereas Assured Workloads provides a complete, audited compliance framework with automated control enforcement.

It only queries image metadata and reports findings. It cannot block deployments or enforce admission policies at runtime.

Pipeline tools sign images and upload attestations to Artifact Registry after passing scans, which Binary Authorization then validates before deployment.

CMEK secures data at rest on disks and backups, not active memory. Confidential VMs handle in-use encryption via hardware TEEs.

No. Shielded VMs verify secure boot and protect against rootkits, but they do not encrypt data processing in RAM.

Data sanitization prevents training-phase poisoning, whereas supply chain attacks target build artifacts and deployment pipelines. The question explicitly asks about the development and deployment stages.

No. Scanning identifies known vulnerabilities in images, while Binary Authorization enforces admission policies to block unauthorized or unscanned images from deploying to GKE.

Expiration applies to long-running deployments; a newly provisioned link fails immediately due to configuration mismatch, making alignment the priority.

Yes. MACsec operates at Layer 2 for encryption and authentication, negotiating independently of the base transport path status.

Access scopes are legacy mechanisms that grant overly broad permissions. Modern GCP relies on IAM bindings for granular, least-privilege control.

Groups add unnecessary complexity for single-workload scenarios. Direct IAM bindings to the service account are simpler, more auditable, and Google-recommended.

IAM controls identity access but cannot audit infrastructure configurations or enforce policy compliance across environments. You need posture management tools to catch drift.

No, SHA feeds findings into SCC, which then correlates them with posture templates and org policies for a unified prevent-and-detect workflow.