Professional Cloud Security Engineer Free Practice Questions
This is the free Google Professional Cloud Security Engineer practice question bank —
180 of 350 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-04-24.
Every answer is verified against official Google documentation —
see our methodology.
Question 1
Your organization has recently migrated sensitive customer data to Cloud Storage buckets. For compliance reasons, you must ensure that all vendor data access and administrative access by Google personnel is logged. What should you do?
A. Configure Data Access audit logs for Cloud Storage on the project hosting the Cloud Storage buckets.
B. Enable Access Transparency for the organization.
C. Configure Data Access audit logs for Cloud Storage at the organization level.
D. Enable Access Transparency for the project hosting the Cloud Storage buckets.
Show Answer
Correct Answer: B
Explanation: The requirement is to log administrative access by Google personnel in addition to access to customer data. Data Access audit logs record access by customers and service accounts, not actions taken by Google support or administrators. Access Transparency is specifically designed to log Google personnel access, and enabling it at the organization level ensures coverage across all current and future projects and buckets, meeting compliance requirements.
Question 1
Your financial services company needs to process customer personally identifiable information (PII) for analytics while adhering to strict privacy regulations. You must transform this data to protect individual privacy to ensure that the data retains its original format and consistency for analytical integrity. Your solution must avoid full irreversible deletion. What should you do?
A. Use Cloud Key Management Service (Cloud KMS) to encrypt the entire dataset with a customer-managed encryption key (CMEK).
B. Set up VPC Service Controls around the BigQuery project. Implement row-level encryption.
C. Implement a custom BigQuery user-defined function (UDF) by using JavaScript to hash all sensitive fields before they are loaded into the analytical tables.
D. Configure Sensitive Data Protection (SDP) to de-identify PII using format-preserving encryption (FPE).
Show Answer
Correct Answer: D
Explanation: The requirement is to transform PII to protect privacy while preserving the original data format and consistency for analytics, and without irreversible deletion. Sensitive Data Protection (formerly DLP) with format-preserving encryption (FPE) is specifically designed for this: it de-identifies sensitive fields while keeping the same format (length, character set), enabling analytics and joins. Cloud KMS encryption (A) encrypts data at rest but does not transform it for analytics. VPC Service Controls and row-level encryption (B) are access controls, not de-identification. Hashing via UDFs (C) is typically irreversible and not format-preserving.
Question 2
Your organization is implementing a Zero Trust security model and using Chrome Enterprise Premium. The company is interested in governing access to sensitive data stored in Cloud Storage. You need to configure access controls that ensure only authorized users on managed devices can access this data, regardless of their network location. Access should be restricted based on the device's security posture. This requires up-to-date operating system patches and antivirus software. What should you do?
A. Grant access to specific users to the VPC Service Controls to create a perimeter to access the Cloud Storage buckets. Configure Identity-Aware Proxy (IAP) to authenticate users before they can access the data.
B. Configure IAM conditions based on IP address ranges. Require users to connect through a VPN. Implement endpoint verification software on user devices to check for basic compliance.
C. Create an access level in Access Context Manager that requires a device policy. Create a Context-Aware Access policy using this access level. Apply the policy to the VPC Service Controls perimeter that includes the Cloud Storage buckets.
D. Use Cloud Firewall rules to restrict access to the Cloud Storage buckets based on the source IP addresses. Require users to authenticate with a multi-factor authentication method.
Show Answer
Correct Answer: C
Explanation: Zero Trust requires evaluating user and device context rather than network location. Access Context Manager allows you to define an access level with a device policy that enforces managed device status, OS patch level, and antivirus posture (via Chrome Enterprise/endpoint signals). Applying this access level as a Context-Aware Access policy to a VPC Service Controls perimeter protecting Cloud Storage ensures only authorized users on compliant devices can access the data from any location.
Question 2
Your organization has established a highly sensitive project within a VPC Service Controls perimeter. You need to ensure that only users meeting specific contextual requirements such as having a company-managed device, a specific location, and a valid user identity can access resources within this perimeter. You want to evaluate the impact of this change without blocking legitimate access. What should you do?
A. Establish a Context-Aware Access policy that specifies the required contextual attributes, and associate the policy with the VPC Service Controls perimeter in dry run mode.
B. Use the VPC Service Control Violation dashboard to identify the impact of details about access denials by service perimeters.
C. Configure a VPC Service Controls perimeter in dry run mode, and enforce strict network segmentation using firewall rules. Use multi-factor authentication (MFA) for user verification.
D. Use Cloud Audit Logs to monitor user access to the project resources. Use post-incident analysis to identify unauthorized access attempts.
Show Answer
Correct Answer: A
Explanation: Context-Aware Access is the correct mechanism to enforce user/device/location conditions (company-managed device, location, identity). Associating the policy with the VPC Service Controls perimeter in dry run mode allows you to evaluate the impact and see what would be denied without blocking legitimate access. The other options only provide monitoring or unrelated controls and do not evaluate contextual access enforcement.
Question 3
Your organization is using AI to improve products through innovation. The developers want to use Gemini in Vertex AI on a project. You need to provide a secure Google Cloud environment to prevent and detect information leakages. What should you do?
A. Set up VPC Service Controls perimeters around the Vertex AI project. Enable Data Loss Prevention API for content inspection.
B. Grant the developers and AI engineers the Vertex AI User role. Monitor the audit trails with Cloud Logging.
C. Deploy Model Armor to protect the Vertex AI endpoint. Review Security Command Center findings to detect information leakages.
D. Implement a firewall rule that allows all traffic to and from the Vertex AI API endpoint.
Show Answer
Correct Answer: C
Explanation: The goal is to prevent and detect information leakage when using Gemini in Vertex AI. Model Armor is designed specifically to protect generative AI workloads by preventing sensitive data exposure (prompt and response filtering, sensitive data protection). Security Command Center aggregates and surfaces security findings to help detect such issues. VPC Service Controls do not inspect model prompts or responses and DLP is not directly integrated for Gemini content inspection, making option A less suitable.
Question 3
Your company has deployed an artificial intelligence model in a central project. This model has a lot of sensitive intellectual property and must be kept strictly isolated from the internet. You must expose the model endpoint only to a defined list of projects in your organization. What should you do?
A. Within the model project, create an internal Application Load Balancer that points to the model endpoint. Expose this load balancer with Private Service Connect to a configured list of projects.
B. Activate Private Google Access in both the model project and in each project that needs to connect to the model. Create a firewall policy to allow connectivity to Private Google Access addresses.
C. Create a central project to host Shared VPC networks that are provided to all other projects. Centrally administer all firewall rules in this project to grant access to the model.
D. Within the model project, create an external Application Load Balancer that points to the model endpoint. Create a Cloud Armor policy to restrict IP addresses to Google Cloud.
Show Answer
Correct Answer: A
Explanation: The requirement is to keep the model completely isolated from the public internet while exposing it only to a specific set of projects. Using an internal Application Load Balancer combined with Private Service Connect allows private, project-scoped access over Google’s internal network without any external IP exposure. PSC is specifically designed for securely publishing services to selected consumer projects. The other options either still rely on broader network access, do not provide strict project-level isolation, or expose an external endpoint.
Question 4
You are responsible for configuring Identity and Access Management in your organization's Google Cloud environment. You need to restrict your organization's users from accessing Cloud Storage buckets in other Google Cloud organizations. What should you do?
A. Set a principal access boundary policy with the appropriate enforcement version. Bind the policy to the principals of your organization.
B. Configure organization restriction headers for your environment. Only include the organization ID of your organization in the list of allowed resources.
C. Create an IAM deny policy on the organization level that prevents access to Cloud Storage buckets outside the organization.
D. Enforce domain restricted sharing in your organization. Configure a managed constraint, and only include the principals in your organization.
Show Answer
Correct Answer: A
Explanation: Principal Access Boundaries (PAB) are specifically designed to restrict what resources a principal can access, even if those resources grant IAM permissions. By defining a boundary that only allows resources within your organization and binding it to your users, any attempt to access Cloud Storage buckets in other organizations will be blocked at request time. The other options either do not apply to Cloud Storage access enforcement (organization restriction headers), do not scale cleanly across all external resources (deny policies), or only prevent being granted roles but do not enforce access at runtime (domain restricted sharing).
Question 4
Your company hosts a critical web application on Google Cloud. The application is experiencing an increasing number of sophisticated layer 7 attacks, including cross-site scripting (XSS) and SQL injection attempts. You need to protect the application from these attacks while minimizing the impact on legitimate traffic and ensuring high availability. What should you do?
A. Implement a load balancer in front of the web application instances, and enable Adaptive Protection and throttling to mitigate the occurrence of these malicious requests.
B. Configure Cloud Next Generation Firewall to block known malicious IP addresses targeting /32 addresses.
C. Enable Google Cloud Armor’s pre-configured WAF rules for OWASP Top 10 vulnerabilities at the backend service.
D. Configure a Cloud Armor security policy with customized and pre-configured WAF rules for OWASP Top 10 vulnerabilities at the load balancer.
Show Answer
Correct Answer: D
Explanation: Layer 7 attacks such as XSS and SQL injection are best mitigated with a web application firewall. Google Cloud Armor integrates with the external HTTP(S) load balancer and provides pre-configured and custom WAF rules for OWASP Top 10 vulnerabilities, protecting traffic before it reaches backends while maintaining high availability and minimizing false positives. Adaptive protection or IP blocking alone does not adequately address sophisticated application-layer attacks.
Question 5
Your organization is storing regulated data in Cloud Storage. Data in Cloud Storage buckets is encrypted by Google-managed encryption keys. To meet compliance requirements, you need to update the existing data to use customer-managed encryption keys instead. What should you do?
A. Create a new key ring and key in the Cloud Key Management Service. In each Cloud Storage bucket configuration, change the encryption type to customer-managed encryption key.
B. Identify which projects contain Cloud Storage buckets with regulated data. Apply the restrictNonCmekServices organization policy constraint to the identified projects or parent folder.
C. Create a new key ring and key in the Cloud Key Management Service. Identify which projects contain Cloud Storage buckets with regulated data. Perform a write action on all existing objects in the buckets.
D. Create a customer-managed encryption key. Change the encryption type in each Cloud Storage bucket configuration to the newly created key. Perform a write action on all existing objects in the buckets.
Show Answer
Correct Answer: D
Explanation: Existing Cloud Storage objects encrypted with Google-managed keys are not retroactively re-encrypted when you change a bucket’s default encryption setting. To use customer-managed encryption keys (CMEK) for existing data, you must: (1) create a CMEK in Cloud KMS, (2) configure the bucket to use that CMEK as the default encryption key, and (3) rewrite all existing objects (for example, copy them in place) so they are re-encrypted with the CMEK. Option D includes all required steps.
Question 5
You are managing a set of Google Cloud projects that are contained in a folder named Data Warehouse. A new data analysis team has been approved to perform data analysis for all BigQuery data in the projects within the Data Warehouse folder. They should only be able to read the data and not have permissions to modify or delete the data. You want to reduce the operational overhead of provisioning access while adhering to the principle of least privilege. What should you do?
A. Grant the BigQuery Data Viewer role at the project level for each project within the Data Warehouse folder.
B. Grant the BigQuery Data Viewer role at the Data Warehouse folder.
C. Grant the BigQuery Data Viewer role at the dataset level for each BigQuery dataset within each project in the Data Warehouse folder.
D. Grant the BigQuery Metadata Viewer role at the Data Warehouse folder.
Show Answer
Correct Answer: B
Explanation: Granting the BigQuery Data Viewer role at the folder level applies the permission to all projects under the Data Warehouse folder, minimizing operational overhead while still following least privilege. The Data Viewer role allows read-only access to BigQuery data, which meets the requirement. Project-level or dataset-level grants would increase administrative effort, and the Metadata Viewer role would not allow reading the actual data.
$19
Get all 350 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.