Free GCP-PCSE sample questions

Correct answer: Configure Workload Identity Federation by creating a Workload Identity Pool and AWS provider. Map the AWS IAM roles to a Google Cloud Service Account using impersonation.

Workload Identity Federation is the optimal and recommended way to grant on-premises or multi-cloud workloads access to Google Cloud resources without using long-lived service account keys. By configuring an identity pool and an AWS provider, AWS workloads can exchange their AWS STS tokens for short-lived Google Cloud access tokens, eliminating the risk of key leakage. flowchart LR A[AWS Pipeline] -->|1. AWS STS Token| B(GCP Workload Identity Pool) B -->|2. Exchange Token| A A -->|3. Impersonate| C[GCP Service Account] C -->|4. Access| D[(GCP Resources)]

Correct answer: Apply an IAM Deny policy at the 'PatientData' folder level that explicitly denies the `bigquery.googleapis.com/job.create` and `bigquery.googleapis.com/table.getData` permissions for the contractor team's principal group.

IAM Deny policies are evaluated before IAM Allow policies. If an IAM Deny policy explicitly denies a permission, the principal cannot perform the action, regardless of any Allow policies they possess. This is the most robust way to ensure a specific group is blocked from accessing sensitive data, even if they inherit broad allow permissions from higher up in the resource hierarchy.

Correct answer: Privileged Access Manager (PAM)

Privileged Access Manager (PAM) enables Just-In-Time (JIT) access in Google Cloud. It allows administrators to define entitlements that grant temporary, elevated access to resources. Requesters can ask for this access when needed, optionally requiring approvals, and the access automatically expires after a configured duration.

Correct answer: Set up Workforce Identity Federation using an Okta OIDC/SAML provider to map external identities to Google Cloud IAM roles.

Workforce Identity Federation allows you to grant external user identities (like those managed in Okta, Azure AD, or other OIDC/SAML IdPs) access to Google Cloud resources without needing to sync them into Cloud Identity or Google Workspace. It is specifically designed for workforce users accessing the Cloud Console or APIs.

Correct answer: roles/iam.serviceAccountTokenCreator

To impersonate a service account and generate short-lived OAuth 2.0 access tokens, signed JWTs, or signed blobs, the principal (in this case, `sa-terraform-runner`) must be granted the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) on the target service account (`sa-org-admin`). The Service Account User role is used for attaching service accounts to resources, not for direct API impersonation.

Correct answers: Apply the Organization Policy constraint `constraints/gcp.resourceLocations` at the Organization node.; Configure the allowed values for the constraint to `in:europe-west1-locations` and `in:europe-west3-locations`.

To restrict the physical location of newly created resources across the entire organization, you must use the Organization Policy Service. Specifically, you configure the `constraints/gcp.resourceLocations` constraint at the organization node and set the allowed values to the required European regions.

To restrict the physical location of newly created resources across the entire organization, you must use the Organization Policy Service. Specifically, you configure the `constraints/gcp.resourceLocations` constraint at the organization node and set the allowed values to the required European regions.