Professional Cloud Security Engineer Free Practice Questions
This is the free Google Professional Cloud Security Engineer practice question bank —
180 of 351 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-10-13.
Every answer is verified against official Google documentation —
see our methodology.
Question 1
You have the following resource hierarchy. There is an organization policy at each node in the hierarchy as shown. Which load balancer types are denied in VPC
A?
A. All load balancer types are denied in accordance with the global node's policy.
B. INTERNAL_TCP_UDP, INTERNAL_HTTP_HTTPS is denied in accordance with the folder's policy.
C. EXTERNAL_TCP_PROXY, EXTERNAL_SSL_PROXY are denied in accordance with the project's policy.
D. EXTERNAL_TCP_PROXY, EXTERNAL_SSL_PROXY, INTERNAL_TCP_UDP, and INTERNAL_HTTP_HTTPS are denied in accordance with the folder and project's policies.
Show Answer
Correct Answer: C
Explanation: Project 2 has its own policy for the same list constraint. Because it does not specify inheritance from its parent, that policy replaces the folder and organization policies for VPC A. It denies EXTERNAL_TCP_PROXY and EXTERNAL_SSL_PROXY.
Question 1
Your organization has recently migrated sensitive customer data to Cloud Storage buckets. For compliance reasons, you must ensure that all vendor data access and administrative access by Google personnel is logged. What should you do?
A. Configure Data Access audit logs for Cloud Storage on the project hosting the Cloud Storage buckets.
B. Enable Access Transparency for the organization.
C. Configure Data Access audit logs for Cloud Storage at the organization level.
D. Enable Access Transparency for the project hosting the Cloud Storage buckets.
Show Answer
Correct Answer: B
Explanation: Access Transparency logs when Google personnel access customer content, and enabling it at the organization level provides broad coverage across the organization’s projects. If “vendor” means third-party users who are not Google personnel, their data access must also be captured with Cloud Storage Data Access audit logs; Access Transparency does not replace those logs.
Question 1
Your financial services company needs to process customer personally identifiable information (PII) for analytics while adhering to strict privacy regulations. You must transform this data to protect individual privacy to ensure that the data retains its original format and consistency for analytical integrity. Your solution must avoid full irreversible deletion. What should you do?
A. Use Cloud Key Management Service (Cloud KMS) to encrypt the entire dataset with a customer-managed encryption key (CMEK).
B. Set up VPC Service Controls around the BigQuery project. Implement row-level encryption.
C. Implement a custom BigQuery user-defined function (UDF) by using JavaScript to hash all sensitive fields before they are loaded into the analytical tables.
D. Configure Sensitive Data Protection (SDP) to de-identify PII using format-preserving encryption (FPE).
Show Answer
Correct Answer: D
Explanation: Format-preserving encryption (FPE) in Sensitive Data Protection de-identifies PII while preserving the original data format, enabling analytics and maintaining schema consistency. It is reversible with the appropriate key, unlike hashing, so it avoids irreversible deletion. CMEK encrypts data at rest rather than transforming sensitive fields for analytics, and VPC Service Controls protect perimeters rather than de-identifying data.
Question 2
A customer needs to launch a 3-tier internal web application on Google Cloud Platform (GCP). The customer's internal compliance requirements dictate that end- user access may only be allowed if the traffic seems to originate from a specific known good CIDR. The customer accepts the risk that their application will only have SYN flood DDoS protection. They want to use GCP's native SYN flood protection.
Which product should be used to meet these requirements?
A. Cloud Armor
B. VPC Firewall Rules
C. Cloud Identity and Access Management
D. Cloud CDN
Show Answer
Correct Answer: B
Explanation: VPC firewall rules can allow traffic only from the specified CIDR, which meets the internal access requirement. Cloud Armor is aimed at protecting supported external load balancers and is not the right fit for this internal application; the customer is accepting only basic, native SYN-flood protection.
Question 2
You are setting up a CI/CD pipeline to deploy containerized applications to your production clusters on Google Kubernetes Engine (GKE). You need to prevent containers with known vulnerabilities from being deployed. You have the following requirements for your solution:
Must be cloud-native -
✑ Must be cost-efficient
✑ Minimize operational overhead
How should you accomplish this? (Choose two.)
A. Create a Cloud Build pipeline that will monitor changes to your container templates in a Cloud Source Repositories repository. Add a step to analyze Container Analysis results before allowing the build to continue.
B. Use a Cloud Function triggered by log events in Google Cloud's operations suite to automatically scan your container images in Container Registry.
C. Use a cron job on a Compute Engine instance to scan your existing repositories for known vulnerabilities and raise an alert if a non-compliant container image is found.
D. Deploy Jenkins on GKE and configure a CI/CD pipeline to deploy your containers to Container Registry. Add a step to validate your container images before deploying your container to the cluster.
E. In your CI/CD pipeline, add an attestation on your container image when no vulnerabilities have been found. Use a Binary Authorization policy to block deployments of containers with no attestation in your cluster.
Show Answer
Correct Answer: A, E
Explanation: Use Cloud Build and Container Analysis to scan images during the build and stop the pipeline when vulnerabilities are detected. Then create an attestation only for images that pass the vulnerability check, and enforce that attestation with Binary Authorization on GKE. These managed Google Cloud services are cloud-native and minimize operational overhead.
Question 2
Your organization has established a highly sensitive project within a VPC Service Controls perimeter. You need to ensure that only users meeting specific contextual requirements such as having a company-managed device, a specific location, and a valid user identity can access resources within this perimeter. You want to evaluate the impact of this change without blocking legitimate access. What should you do?
A. Establish a Context-Aware Access policy that specifies the required contextual attributes, and associate the policy with the VPC Service Controls perimeter in dry run mode.
B. Use the VPC Service Control Violation dashboard to identify the impact of details about access denials by service perimeters.
C. Configure a VPC Service Controls perimeter in dry run mode, and enforce strict network segmentation using firewall rules. Use multi-factor authentication (MFA) for user verification.
D. Use Cloud Audit Logs to monitor user access to the project resources. Use post-incident analysis to identify unauthorized access attempts.
Show Answer
Correct Answer: A
Explanation: Context-Aware Access is the Google Cloud feature that enforces access based on contextual attributes such as managed device status, user identity, and location. VPC Service Controls can integrate with Context-Aware Access access levels. To evaluate the effect before enforcement, associate the access level with the service perimeter in dry run mode, which logs the impact without blocking legitimate requests.
Question 3
Your company has deployed an artificial intelligence model in a central project. This model has a lot of sensitive intellectual property and must be kept strictly isolated from the internet. You must expose the model endpoint only to a defined list of projects in your organization. What should you do?
A. Within the model project, create an internal Application Load Balancer that points to the model endpoint. Expose this load balancer with Private Service Connect to a configured list of projects.
B. Activate Private Google Access in both the model project and in each project that needs to connect to the model. Create a firewall policy to allow connectivity to Private Google Access addresses.
C. Create a central project to host Shared VPC networks that are provided to all other projects. Centrally administer all firewall rules in this project to grant access to the model.
D. Within the model project, create an external Application Load Balancer that points to the model endpoint. Create a Cloud Armor policy to restrict IP addresses to Google Cloud.
Show Answer
Correct Answer: A
Explanation: To keep the AI model isolated from the internet while allowing access only from a defined set of Google Cloud projects, expose it privately using an Internal Application Load Balancer with Private Service Connect (PSC). PSC enables private, controlled service publishing across projects and allows explicit consumer project allowlists. Private Google Access does not provide project-level service exposure or isolation, Shared VPC/firewalls alone do not expose managed endpoints privately across projects, and an external load balancer with Cloud Armor still exposes an internet-facing endpoint.
Question 4
Your company has recently enabled Security Command Center at the organization level. You need to implement runtime threat detection for applications running in containers within projects residing in the production folder. Specifically, you need to be notified if additional libraries are loaded or malicious scripts are executed within these running containers. You need to configure Security Command Center to meet this requirement while ensuring findings are visible within Security Command Center. What should you do?
A. Create log-based metrics and alerts in Cloud Logging and Cloud Monitoring for suspicious container activity within the production folder.
B. Configure Security Health Analytics within Security Command Center to monitor container runtime vulnerabilities in the production folder.
C. Ensure that the containers in the production folder are running on hosts that are using Container-Optimized OS.
D. Enable Container Threat Detection in Security Command Center Premium tier for the projects within the production folder.
Show Answer
Correct Answer: D
Explanation: Container Threat Detection in Security Command Center Premium provides runtime threat detection for containers, including detecting malicious script execution, unexpected library loading, and other suspicious runtime behaviors. Findings are surfaced directly in Security Command Center. Security Health Analytics focuses on configuration and posture issues rather than runtime threats, Container-Optimized OS alone does not provide these detections, and custom log-based alerts would not implement SCC's built-in runtime threat detection.
Question 5
Your company hosts a critical web application on Google Cloud. The application is experiencing an increasing number of sophisticated layer 7 attacks, including cross-site scripting (XSS) and SQL injection attempts. You need to protect the application from these attacks while minimizing the impact on legitimate traffic and ensuring high availability. What should you do?
A. Implement a load balancer in front of the web application instances, and enable Adaptive Protection and throttling to mitigate the occurrence of these malicious requests.
B. Configure Cloud Next Generation Firewall to block known malicious IP addresses targeting /32 addresses.
C. Enable Google Cloud Armor’s pre-configured WAF rules for OWASP Top 10 vulnerabilities at the backend service.
D. Configure a Cloud Armor security policy with customized and pre-configured WAF rules for OWASP Top 10 vulnerabilities at the load balancer.
Show Answer
Correct Answer: D
Explanation: Cloud Armor provides a web application firewall (WAF) at the external HTTP(S) load balancer. A security policy can include both pre-configured OWASP Top 10 WAF rules and custom rules, allowing protection against XSS, SQL injection, and other layer 7 attacks while minimizing false positives through tuning and maintaining high availability. Adaptive Protection and throttling are focused on DDoS and abusive traffic rather than comprehensive OWASP protections, Next Generation Firewall is not the appropriate control for application-layer WAF protection, and attaching only pre-configured WAF rules at the backend service is not how Cloud Armor policies are applied; they are attached to the load balancer/backend service via a security policy, with custom rules supported.
Question 6
You are managing a set of Google Cloud projects that are contained in a folder named Data Warehouse. A new data analysis team has been approved to perform data analysis for all BigQuery data in the projects within the Data Warehouse folder. They should only be able to read the data and not have permissions to modify or delete the data. You want to reduce the operational overhead of provisioning access while adhering to the principle of least privilege. What should you do?
A. Grant the BigQuery Data Viewer role at the project level for each project within the Data Warehouse folder.
B. Grant the BigQuery Data Viewer role at the Data Warehouse folder.
C. Grant the BigQuery Data Viewer role at the dataset level for each BigQuery dataset within each project in the Data Warehouse folder.
D. Grant the BigQuery Metadata Viewer role at the Data Warehouse folder.
Show Answer
Correct Answer: B
Explanation: Granting the BigQuery Data Viewer IAM role at the folder level inherits to all projects within the Data Warehouse folder, minimizing administrative overhead while providing read-only access to BigQuery data. Project-level grants require repeating the assignment for each project, dataset-level grants require managing every dataset, and Metadata Viewer does not allow reading table data.
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
