Can You Answer These 5 GCP-PSE Questions on Configuring access?

5 questions, one domain: Configuring access from the Google Cloud Professional Cloud Security Engineer (GCP-PSE) exam. It makes up about 25% of the exam. Pick your answer, then check it against the explanation.

Google Cloud Professional Cloud Security Engineer (GCP-PSE) · Configuring access · 5 questions with answers and explanations

🧭 Reading Configuring access questions

Access questions describe who can do what in an organization, often after an incident or a failed request, and ask which identity setup or policy fixes it. Where a role is granted and how groups nest usually decide. Strong options grant the narrowest role at the right level of the resource hierarchy; weaker ones widen access at the project or organization level to make an error go away.

Watch for these while you work

• Trace effective access through the hierarchy and nested groups before changing any binding; a deny policy or organization policy can override an allow.
• Prefer groups and predefined or custom roles scoped to the resource over primitive roles such as Editor.
• Workload identity federation and short-lived credentials beat downloaded service account keys whenever the scenario allows them.

Question 1 of 5

A deployment pipeline running as deployer-sa must deploy Cloud Run services that run as runtime-sa. Security rejects granting the Service Account User role to deployer-sa at the project level, because it could then run workloads as any service account in that project. What should be granted instead?

AThe Editor role on the organization, so that all deployments are covered by one grant

BThe Owner role on the project, because it is the only role that permits deploying services

CThe Service Account Token Creator role on the project, which allows the pipeline to attach any account without further checks

DThe Service Account User role on runtime-sa only, which grants permission to attach and act as that single account

Show answer

✅ Answer: D

Difficulty: applied · Topic: IAM

Attaching a service account is a privileged act
To deploy a resource that runs as a service account, the deployer needs iam.serviceAccounts.actAs on it (included in roles/iam.serviceAccountUser). A grant at the project level lets the deployer act as every service account in the project and could be used to run code with higher privileges than the deployer holds.

Narrow the scope
IAM roles can be granted on the service account resource. Granting Service Account User on runtime-sa only lets deployer-sa attach that single identity. Token Creator is a different permission set: it mints tokens (impersonation) rather than attaching accounts to resources.

Why each option works or fails
• ✗ A. Editor on the organization: this is an excessive basic role at the widest scope and does not follow least privilege.
• ✗ B. Owner on the project: it is far more privileged than needed and still includes broad access to all other accounts.
• ✗ C. Project-level Token Creator: it is broader than needed and grants token minting for every account in the project, not the attach permission.
• ✓ D. Resource-level grant (correct): actAs on runtime-sa lets the pipeline deploy services as that account and nothing else, preserving least privilege.

Question 2 of 5

Security shortened the Google session length to 8 hours for SSO users, but employees report that they almost never see a login prompt after the session expires. The IdP keeps its own sessions for 30 days. How can security make the shorter session meaningful?

ALengthen the Google session to 30 days so that both sessions expire at the same moment

BDisable SSO for all users so that Google passwords decide when a prompt appears

CAdd a network mask to the SSO settings so that expired sessions are verified against office addresses

DSet the IdP session shorter than the Google session, so a new Google sign-in forces new IdP authentication

Show answer

✅ Answer: D

Difficulty: applied · Topic: Cloud Identity

Two sessions, two clocks
After SSO, the user has a Google session (by default 14 days for Google services; a shorter value is configurable, and a separate Google Cloud session length covers the console, gcloud and API clients) and usually also a session at the IdP.

Silent re-authentication
When the Google session ends, the user is redirected to the IdP. If the IdP session is still alive, the IdP signs the user back in without a prompt, so shortening only the Google session achieves little. Make the IdP session shorter than the Google session so that expiry of Google forces a real authentication.

Why each option works or fails
• ✗ A. Equal 30-day sessions: this lengthens exposure and removes the intended 8-hour control.
• ✗ B. Disabling SSO: it throws away centralized authentication and MFA at the IdP to solve a session configuration issue.
• ✗ C. Network mask: a mask decides which networks use SSO and can weaken MFA; it does not make the IdP prompt again.
• ✓ D. Shorter IdP session (correct): when Google redirects an expired session to an IdP session that has already ended, the user must enter credentials and satisfy MFA again.

Question 3 of 5

Contractors hold Compute Instance Admin on a project, and the company wants to block those same permissions outside business hours and on weekends. A colleague proposes a deny policy with a denial condition that tests the request time. Why does this fail, and what is the right way?

ADenial conditions accept every attribute allowed in allow policies, so the proposal works if the expression is on the permission name

BDeny rules cannot target contractor groups, so convert the contractors to service accounts and deny those

CDenial conditions recognize only resource tag functions, so use conditional role bindings on request.time for the contractors' allow grants

DRequest time can be tested only in organization policies, so create a constraint that covers working hours

Show answer

✅ Answer: C

Difficulty: applied

Where conditions are accepted
IAM Conditions can be used in allow policy role bindings, deny policy rules and policy bindings of Principal Access Boundary policies.
• In allow bindings the expression can test attributes such as request.time, resource.name, resource.type and tags.
• Denial conditions have the same structure but recognize only resource tag functions.

Choosing
For a schedule (hours, weekdays, expiry), put the condition in the role binding so the role applies only when the time matches. Use deny rules for tag-based or principal-based guardrails.

Why each option works or fails
• ✗ A. Denial conditions accept all attributes: they only recognize tag functions, so a request-time expression is not valid there.
• ✗ B. Convert to service accounts: deny rules can target groups and users, and replacing human contractors with service accounts would not solve the time problem.
• ✓ C. Conditional bindings (correct): time attributes are available in allow policy bindings, while denial conditions are limited to resource tags, so the schedule belongs on the contractors' role grants.
• ✗ D. Organization policy for time: organization policy constraints govern resource configuration and cannot gate a person's IAM permissions by clock time.

Question 4 of 5

A security team wants to reduce the damage from a leaked access token that was captured from a developer laptop. Which property of Google Cloud tokens most directly limits the damage window?

AAccess tokens are signed with the developer's SSH key, so they cannot be replayed elsewhere

BAccess tokens are single-use and are rejected by the second API call that presents them

CAccess tokens are stored in Cloud KMS and are automatically destroyed 90 days after issue

DAccess tokens are short-lived and expire within hours, so a stolen one soon stops working

Show answer

✅ Answer: D

Difficulty: applied

Bearer tokens and exposure
Most access tokens are bearer tokens: whoever holds one can use it until it expires. Therefore the main defenses are small lifetime, narrow scope and, where available, binding the token to a client.
• Google Cloud access tokens are short-lived, usually expiring within a few hours.
• They are restricted to certain scopes or resources.
• Bound tokens require the client to prove it is the rightful owner, which is more restrictive than a bearer token and reduces the risk of token theft.

Contrast with long-lived secrets
A service account key has no expiry by default. Preferring short-lived tokens shrinks the attack window without extra revocation work.

Why each option works or fails
• ✗ A. Signed with an SSH key: tokens are issued by Google's authorization server, not signed with a developer's SSH key, and bearer tokens can be replayed by any holder.
• ✗ B. Single-use: tokens are reusable until they expire; being usable more than once is exactly why theft is a concern.
• ✗ C. Stored in Cloud KMS for 90 days: KMS stores encryption keys, not access tokens, and tokens expire far sooner than 90 days.
• ✓ D. Short lifetime (correct): expiry within hours caps how long a captured token is useful, which is the property that bounds the damage window.

Question 5 of 5

A security team plans to enforce a new constraint across 40 production projects that blocks creation of resources in non-approved locations. Teams fear that automation might break. The team wants evidence of what would be blocked before enforcement, with no change to behavior. What should the engineer do?

AEnforce it in production and rely on a project owner to remove the policy for any team that breaks

BCreate the policy in dry-run mode, review the audit-logged violations, then enforce it

CUse Policy Analyzer for allow policies to preview which creation requests the constraint will deny

DEnforce it only on a single test folder and wait for failures, then expand the scope gradually

Show answer

✅ Answer: B

Difficulty: advanced

Dry-run mode for organization policies
A dry-run organization policy is created like a normal one, but violating actions are only audit logged and are not denied. You then query the logs to see which principals and resources would have been blocked, adjust the policy or fix the automation, and finally enforce the policy.

Why it beats the alternatives
• It provides evidence from real production traffic, not from a sample.
• It carries no risk of outage.
• Note that new policies are generally not retroactive: existing resources in violation stay as they are, but new requests are denied once enforced.

Why each option works or fails
• ✗ A. Enforce and remove on complaint: it causes the outage the team wanted to avoid, and project owners cannot override an inherited organization policy.
• ✓ B. Dry-run mode (correct): production automation keeps running while violations are recorded in the audit logs, giving a concrete list of requests that enforcement would break.
• ✗ C. Policy Analyzer: it analyzes IAM allow policies, so it cannot preview what a resource constraint would deny.
• ✗ D. Enforce on a test folder: it proves nothing about the 40 production projects and causes real failures in whatever runs in the test folder.

🎯 What to remember

• Grant Service Account User on the specific runtime service account, not on the project.
• Keep the IdP session shorter than the Google session, or shortened Google sessions are renewed silently.
• Time-of-day access belongs in conditional allow bindings; denial conditions only understand resource tags.
• Short-lived, scope-restricted access tokens (and bound tokens) limit what a stolen credential can do.
• Test organization policies in dry-run mode, read the audit logs, then enforce.

📊 Set profile

Exam: GCP-PSE · 55 questions · 120 minutes · the largest of 5 domains
This set: 4 applied, 1 advanced · 1 comparison, 1 concept check, 1 scenario, 1 trade-off, 1 troubleshooting
Topics: IAM, Cloud Identity

🔗 Keep practicing on this blog

• All GCP-PSE practice sets
• Every exam on this blog

📚 Beyond this set

More GCP-PSE questions: https://hyunhp.github.io/cert-bank/#exam=GCP-PSE
Study guide: https://hyunhp.github.io/cert-bank/study.html#exam=GCP-PSE

These are original practice questions, not real exam questions, and cert-bank is not affiliated with any certification vendor.

Original practice questions written for this blog, not exam dumps.