Professional Cloud Security Engineer Free Practice Questions
This is the free Google Professional Cloud Security Engineer practice question bank —
180 of 351 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-08-04.
Every answer is verified against official Google documentation —
see our methodology.
Question 1
Your financial services company needs to process customer personally identifiable information (PII) for analytics while adhering to strict privacy regulations. You must transform this data to protect individual privacy to ensure that the data retains its original format and consistency for analytical integrity. Your solution must avoid full irreversible deletion. What should you do?
A. Use Cloud Key Management Service (Cloud KMS) to encrypt the entire dataset with a customer-managed encryption key (CMEK).
B. Set up VPC Service Controls around the BigQuery project. Implement row-level encryption.
C. Implement a custom BigQuery user-defined function (UDF) by using JavaScript to hash all sensitive fields before they are loaded into the analytical tables.
D. Configure Sensitive Data Protection (SDP) to de-identify PII using format-preserving encryption (FPE).
Show Answer
Correct Answer: D
Explanation: Format-preserving encryption (FPE) in Sensitive Data Protection de-identifies PII while preserving the original data format, enabling analytics and maintaining schema consistency. It is reversible with the appropriate key, unlike hashing, so it avoids irreversible deletion. CMEK encrypts data at rest rather than transforming sensitive fields for analytics, and VPC Service Controls protect perimeters rather than de-identifying data.
Question 2
Your organization has established a highly sensitive project within a VPC Service Controls perimeter. You need to ensure that only users meeting specific contextual requirements such as having a company-managed device, a specific location, and a valid user identity can access resources within this perimeter. You want to evaluate the impact of this change without blocking legitimate access. What should you do?
A. Establish a Context-Aware Access policy that specifies the required contextual attributes, and associate the policy with the VPC Service Controls perimeter in dry run mode.
B. Use the VPC Service Control Violation dashboard to identify the impact of details about access denials by service perimeters.
C. Configure a VPC Service Controls perimeter in dry run mode, and enforce strict network segmentation using firewall rules. Use multi-factor authentication (MFA) for user verification.
D. Use Cloud Audit Logs to monitor user access to the project resources. Use post-incident analysis to identify unauthorized access attempts.
Show Answer
Correct Answer: A
Explanation: Context-Aware Access is the Google Cloud feature that enforces access based on contextual attributes such as managed device status, user identity, and location. VPC Service Controls can integrate with Context-Aware Access access levels. To evaluate the effect before enforcement, associate the access level with the service perimeter in dry run mode, which logs the impact without blocking legitimate requests.
Question 3
Your company has deployed an artificial intelligence model in a central project. This model has a lot of sensitive intellectual property and must be kept strictly isolated from the internet. You must expose the model endpoint only to a defined list of projects in your organization. What should you do?
A. Within the model project, create an internal Application Load Balancer that points to the model endpoint. Expose this load balancer with Private Service Connect to a configured list of projects.
B. Activate Private Google Access in both the model project and in each project that needs to connect to the model. Create a firewall policy to allow connectivity to Private Google Access addresses.
C. Create a central project to host Shared VPC networks that are provided to all other projects. Centrally administer all firewall rules in this project to grant access to the model.
D. Within the model project, create an external Application Load Balancer that points to the model endpoint. Create a Cloud Armor policy to restrict IP addresses to Google Cloud.
Show Answer
Correct Answer: A
Explanation: To keep the AI model isolated from the internet while allowing access only from a defined set of Google Cloud projects, expose it privately using an Internal Application Load Balancer with Private Service Connect (PSC). PSC enables private, controlled service publishing across projects and allows explicit consumer project allowlists. Private Google Access does not provide project-level service exposure or isolation, Shared VPC/firewalls alone do not expose managed endpoints privately across projects, and an external load balancer with Cloud Armor still exposes an internet-facing endpoint.
Question 4
Your company has recently enabled Security Command Center at the organization level. You need to implement runtime threat detection for applications running in containers within projects residing in the production folder. Specifically, you need to be notified if additional libraries are loaded or malicious scripts are executed within these running containers. You need to configure Security Command Center to meet this requirement while ensuring findings are visible within Security Command Center. What should you do?
A. Create log-based metrics and alerts in Cloud Logging and Cloud Monitoring for suspicious container activity within the production folder.
B. Configure Security Health Analytics within Security Command Center to monitor container runtime vulnerabilities in the production folder.
C. Ensure that the containers in the production folder are running on hosts that are using Container-Optimized OS.
D. Enable Container Threat Detection in Security Command Center Premium tier for the projects within the production folder.
Show Answer
Correct Answer: D
Explanation: Container Threat Detection in Security Command Center Premium provides runtime threat detection for containers, including detecting malicious script execution, unexpected library loading, and other suspicious runtime behaviors. Findings are surfaced directly in Security Command Center. Security Health Analytics focuses on configuration and posture issues rather than runtime threats, Container-Optimized OS alone does not provide these detections, and custom log-based alerts would not implement SCC's built-in runtime threat detection.
Question 5
Your company hosts a critical web application on Google Cloud. The application is experiencing an increasing number of sophisticated layer 7 attacks, including cross-site scripting (XSS) and SQL injection attempts. You need to protect the application from these attacks while minimizing the impact on legitimate traffic and ensuring high availability. What should you do?
A. Implement a load balancer in front of the web application instances, and enable Adaptive Protection and throttling to mitigate the occurrence of these malicious requests.
B. Configure Cloud Next Generation Firewall to block known malicious IP addresses targeting /32 addresses.
C. Enable Google Cloud Armor’s pre-configured WAF rules for OWASP Top 10 vulnerabilities at the backend service.
D. Configure a Cloud Armor security policy with customized and pre-configured WAF rules for OWASP Top 10 vulnerabilities at the load balancer.
Show Answer
Correct Answer: D
Explanation: Cloud Armor provides a web application firewall (WAF) at the external HTTP(S) load balancer. A security policy can include both pre-configured OWASP Top 10 WAF rules and custom rules, allowing protection against XSS, SQL injection, and other layer 7 attacks while minimizing false positives through tuning and maintaining high availability. Adaptive Protection and throttling are focused on DDoS and abusive traffic rather than comprehensive OWASP protections, Next Generation Firewall is not the appropriate control for application-layer WAF protection, and attaching only pre-configured WAF rules at the backend service is not how Cloud Armor policies are applied; they are attached to the load balancer/backend service via a security policy, with custom rules supported.
Question 6
You are managing a set of Google Cloud projects that are contained in a folder named Data Warehouse. A new data analysis team has been approved to perform data analysis for all BigQuery data in the projects within the Data Warehouse folder. They should only be able to read the data and not have permissions to modify or delete the data. You want to reduce the operational overhead of provisioning access while adhering to the principle of least privilege. What should you do?
A. Grant the BigQuery Data Viewer role at the project level for each project within the Data Warehouse folder.
B. Grant the BigQuery Data Viewer role at the Data Warehouse folder.
C. Grant the BigQuery Data Viewer role at the dataset level for each BigQuery dataset within each project in the Data Warehouse folder.
D. Grant the BigQuery Metadata Viewer role at the Data Warehouse folder.
Show Answer
Correct Answer: B
Explanation: Granting the BigQuery Data Viewer IAM role at the folder level inherits to all projects within the Data Warehouse folder, minimizing administrative overhead while providing read-only access to BigQuery data. Project-level grants require repeating the assignment for each project, dataset-level grants require managing every dataset, and Metadata Viewer does not allow reading table data.
Question 7
You work at a company in a regulated industry and are responsible for ongoing security of the Cloud environment. You need to prevent and detect misconfigurations in a particular folder based on specific compliance policies. You need to adhere to industry-specific compliance policies and policies that are internal to your company. What should you do?
A. Create a Posture file by using custom and predefined SHA or organization policies. Enforce the posture on the folder level.
B. Create custom organization policies that follow specific business requirements. Enforce the policies on the folder level.
C. Enable Assured Workloads on the folder level, with the specific control bundle appropriate for your industry’s regulations.
D. Use Workload Manager with custom Rego policies to continuously scan the environment for misconfigurations on the folder level.
Show Answer
Correct Answer: A
Explanation: Security Command Center Enterprise Posture lets you define a posture using predefined security posture templates and custom policies (including Security Health Analytics detectors and organization policy constraints) and enforce it at the organization, folder, or project level to prevent and detect misconfigurations. This best matches the requirement to combine industry-specific compliance with internal policies at the folder level.
Question 8
Your company’s storage team manages all product images within a specific Google Cloud project. To maintain control, you must isolate access to Cloud Storage for this project, allowing the storage team to manage restrictions at the project level. They must be restricted to using corporate computers. What should you do?
A. Use Identity and Access Management (IAM) roles at the project level within the storage team’s project. Grant the storage team granular permissions on the project’s Cloud Storage resources.
B. Employ organization-level firewall rules to block all traffic to Cloud Storage. Create exceptions for specific service accounts used by the storage team within their project.
C. Use Context-Aware Access Create an access level that defines the required context. Apply it as an organization policy specifically at the project level, restricting access to Cloud Storage based on that context.
D. Implement VPC Service Controls by establishing an organization-wide service perimeter with all projects. Configure ingress and egress rules to restrict access to Cloud Storage based on IP address ranges.
Show Answer
Correct Answer: C
Explanation: Context-Aware Access can enforce access based on device and other contextual attributes, such as requiring managed corporate computers. Applying the access level to the relevant project allows the storage team to manage project-level Cloud Storage access while restricting use to corporate-managed devices. IAM alone cannot enforce device context, firewall rules do not control Cloud Storage access this way, and VPC Service Controls protect against data exfiltration rather than enforcing end-user managed-device access.
Question 9
Your organization uses Google Workspace as the primary identity provider for Google Cloud. Users in your organization initially created their passwords. You need to improve password security due to a recent security event. What should you do?
A. Conduct a security awareness training session, and set the password expiration settings to require more frequent updates.
B. Check the Enforce strong password box, and check Enforce password policy at the next sign-in.
C. Check the Enforce strong password box, and set the password expiration to occur more frequently.
D. Audit user activity for suspicious logins by using the audit and investigation tool.
Show Answer
Correct Answer: B
Explanation: Enforcing strong password requirements improves password quality, and forcing the password policy at the next sign-in ensures existing user-created passwords are updated immediately. Simply shortening password expiration is no longer considered a best practice and does not address weak existing passwords. Auditing logins is useful for detection, not for improving password security after the incident.
Question 10
Your global defense company is migrating top-secret classified data to BigQuery and Cloud Storage. National security regulations demand that master encryption key material never leaves the accredited on-premises cryptographic hardware. You must retain the unilateral ability to revoke data access, independent of any cloud provider. What should you do?
A. Use customer-managed encryption keys (CMEKs) for the BigQuery datasets and Cloud Storage buckets. Store the keys in Cloud Key Management Service (Cloud KMS).
B. Use customer-supplied encryption keys (CSEKs) by providing your own encryption keys with each data operation in Cloud Storage and BigQuery.
C. Import existing on-premises master encryption keys into Cloud Key Management Service (Cloud KMS). Use the imported keys for BigQuery and Cloud Storage encryption.
D. Configure Cloud External Key Manager (Cloud EKM) for the BigQuery datasets and Cloud Storage buckets. Integrate EKM with your existing on-premises hardware security modules (HSMs).
Show Answer
Correct Answer: D
Explanation: Cloud External Key Manager (Cloud EKM) is designed for scenarios where encryption key material must remain outside Google Cloud, such as in on-premises HSMs. It enables BigQuery and Cloud Storage to use externally managed keys while ensuring the master key material never leaves the accredited hardware. Because access depends on the external key service, you can unilaterally revoke key access independently of the cloud provider. CMEK and imported Cloud KMS keys place key material in Google Cloud, and CSEKs are not supported for BigQuery and do not satisfy the stated requirements across both services.
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.