Professional Cloud Security Engineer Free Practice Questions — Page 10
Question 83
Your organization relies heavily on virtual machines (VMs) in Compute Engine. Due to team growth and resource demands, VM sprawl is becoming problematic. Maintaining consistent security hardening and timely package updates poses an increasing challenge. You need to centralize VM image management and automate the enforcement of security baselines throughout the virtual machine lifecycle. What should you do?
A. Use VM Manager to automatically distribute and apply patches to YMs across your projects. Integrate VM Manager with hardened, organization-standard VM images stored in a central repository.
B. Configure the sole-tenancy feature in Compute Engine for all projects. Set up custom organization policies in Policy Controller to restrict the operating systems and image sources that teams are allowed to use.
C. Create a Cloud Build trigger to build a pipeline that generates hardened VM images. Run vulnerability scans in the pipeline, and store images with passing scans in a registry. Use instance templates pointing to this registry.
D. Activate Security Command Center Enterprise. Use VM discovery and posture management features to monitor hardening state and trigger automatic responses upon detection of issues.
Show Answer
Correct Answer: A
Explanation: The requirement is to centralize VM image management and enforce security baselines throughout the entire VM lifecycle, including ongoing patching and configuration. VM Manager (OS Config) is designed for this purpose: it provides centralized patch management, configuration enforcement, and compliance reporting across fleets of existing VMs, directly addressing VM sprawl. When combined with hardened, organization-standard images stored centrally, it ensures both consistent VM creation and continuous security enforcement over time. Other options either focus only on image creation (C), policy restrictions without lifecycle management (B), or monitoring without direct enforcement (D).
Question 84
Customers complain about error messages when they access your organization's website. You suspect that the web application firewall rules configured in Cloud Armor are too strict. You want to collect request logs to investigate what triggered the rules and blocked the traffic. What should you do?
A. Modify the Application Load Balancer backend and increase the tog sample rate to a higher number.
B. Enable logging in the Application Load Balancer backend and set the log level to VERBOSE in the Cloud Armor policy.
C. Change the configuration of suspicious web application firewall rules in the Cloud Armor policy to preview mode.
D. Create a log sink with a filter for togs containing redirected_by_security_policy and set a BigQuery dataset as destination.
Show Answer
Correct Answer: B
Explanation: To investigate which Cloud Armor WAF rules are blocking requests, you need detailed request and rule-evaluation logs. Enabling logging on the Application Load Balancer backend and setting the Cloud Armor policy log level to VERBOSE records detailed information about matched rules, actions taken, and request attributes. This directly addresses the need to understand what triggered the blocks. Preview mode (C) helps test rules but does not itself collect richer logs, and the other options do not provide rule-level visibility.
Question 85
Your organization utilizes Cloud Run services within multiple projects underneath the non-production folder which requires primarily internal communication. Some services need external access to approved fully qualified domain names (FQDN) while other external traffic must be blocked. Internal applications must not be exposed. You must achieve this granular control with allowlists overriding broader restrictions only for designated VPCs. What should you do?
A. Implement a global-level allowlist rule for the necessary FQDNs within a hierarchical firewall policy. Apply this policy across all VPCs in the organization and configure Cloud NAT without any additional filtering.
B. Create a folder-level deny-all rule for outbound traffic within a hierarchical firewall policy. Define FQDN allowlist rules in separate policies and associate them with the necessary VPCs. Configure Cloud NAT for these VPCs.
C. Create a project-level deny-all rule within a hierarchical structure and apply it broadly. Override this rule with separate FQDN allowlists defined in VPC-level firewall policies associated with the relevant VPCs.
D. Configure Cloud NAT with IP-based filtering to permit outbound traffic only to the allowlist d FQDNs' IP ranges. Apply Cloud NAT uniformly to all VPCs within the organization's folder structure.
Show Answer
Correct Answer: B
Explanation: A folder-level hierarchical firewall policy with a default deny-all egress rule establishes a secure baseline for all non-production projects. More specific FQDN-based allow rules can then be defined in separate hierarchical firewall policies and associated only with the required VPCs, overriding the broader restriction where needed. This provides granular, least-privilege control, keeps internal services unexposed, and works with Cloud NAT to enable controlled external egress for Cloud Run.
Question 86
Your organization hosts a sensitive web application in Google Cloud. To protect the web application, you've set up a virtual private cloud (VPC) with dedicated subnets for the application's frontend and backend components. You must implement security controls to restrict incoming traffic, protect against web-based attacks, and monitor internal traffic. What should you do?
A. Configure Cloud Firewall to permit allow-listed traffic only, deploy Google Cloud Armor with predefined rules for blocking common web attacks, and deploy Cloud Intrusion Detection System (IDS) to detect internal traffic anomalies.
B. Configure Google Cloud Armor to allow incoming connections, configure DNS Security Extensions (DNSSEC) on Cloud DNS to secure against common web attacks, and deploy Cloud Intrusion Detection System (Cloud IDS) to detect internal traffic anomalies.
C. Configure Cloud Intrusion Detection System (Cloud IDS) to monitor incoming connections, deploy Identity-Aware Proxy (IAP) to block common web attacks, and deploy Google Cloud Armor to detect internal traffic anomalies.
D. Configure Cloud DNS to secure incoming traffic, deploy Cloud Intrusion Detection System (Cloud IDS) to detect common web attacks, and deploy Google Cloud Armor to detect internal traffic anomalies.
Show Answer
Correct Answer: A
Explanation: The requirements map directly to specific Google Cloud security services. Restricting incoming traffic at the network level is done with VPC firewall rules that allow only approved sources. Protecting against web-based attacks (such as SQL injection and XSS) is the role of Google Cloud Armor, which acts as a web application firewall in front of HTTP(S) load balancers. Monitoring and detecting suspicious activity within the VPC, including east-west traffic between frontend and backend subnets, is handled by Cloud Intrusion Detection System (IDS). The other options misapply services to responsibilities they are not designed for.
Question 87
Your organization uses Google Cloud to process large amounts of location data for analysis and visualization. The location data is potentially sensitive. You must design a solution that allows storing and processing the location data securely, minimizing data exposure risks, and adhering to both regulatory guidelines and your organization's internal data residency policies. What should you do?
A. Enable location restrictions on Compute Engine instances and virtual disk resources where the data is handled. Apply labels to tag geographic metadata for all stored data.
B. Use the Cloud Data Loss Prevention (Cloud DLP) API to scan for sensitive location data before any storage or processing. Create Cloud Storage buckets with global availability for optimal performance, relying on Cloud DLP results to filter and control data access.
C. Create regional Cloud Storage buckets with Object Lifecycle Management policies that limit data lifetime. Enable fine-grained access controls by using IAM conditions. Encrypt data with customer-managed encryption keys (CMEK) generated within specific Cloud KMS key locations.
D. Store data within BigQuery in a specified region by using dataset location configuration. Use authorized views and row-level security to enforce geographic access restrictions. Encrypt data within BigQuery tables by using customer-managed encryption keys (CMEK).
Show Answer
Correct Answer: D
Explanation: The requirement emphasizes secure storage and processing of large amounts of location data for analysis and visualization, while enforcing data residency and minimizing exposure. BigQuery is purpose-built for large-scale analytics and visualization. Setting the dataset location enforces regional data residency. Authorized views and row-level security provide fine-grained access controls to limit exposure of sensitive location data. Using customer-managed encryption keys (CMEK) adds strong, customer-controlled encryption to meet regulatory and internal security requirements. The other options either lack strong analytics capabilities, do not adequately enforce residency, or focus on detection rather than secure processing.
Question 88
Your team maintains 1PB of sensitive data within BigOuery that contains personally identifiable information (PII). You need to provide access to this dataset to another team within your organization for analysis purposes. You must share the BigQuery dataset with the other team while protecting the PII. What should you do?
A. Utilize BigQuery's row-level access policies to mask PII columns based on the other team's user identities.
B. Export the BigQuery dataset to Cloud Storage. Create a VPC Service Control perimeter and allow only their team's project access to the bucket.
C. Implement data pseudonymization techniques to replace the PII fields with non-identifiable values. Grant the other team access to the pseudonymized dataset.
D. Create a filtered copy of the dataset and replace the sensitive data with hash values in a separate project. Grant the other team access to this new project.
Show Answer
Correct Answer: A
Explanation: The requirement is to share a very large (1PB) BigQuery dataset with another internal team while protecting PII, without unnecessary duplication or movement of data. The correct approach is to use BigQuery’s built-in fine‑grained access controls so protection happens in place at query time. Option A best matches this intent: BigQuery supports column‑level security and dynamic data masking (often discussed alongside row‑level security) to restrict or mask sensitive columns for specific users or groups. This avoids copying or exporting data, scales efficiently for 1PB, and preserves a single authoritative dataset. The other options involve exporting, duplicating, or transforming the data, which is costly, operationally complex, and unnecessary.
Question 89
Your organization is adopting Google Cloud and wants to ensure sensitive resources are only accessible from devices within the internal on-premises corporate network. You must configure Access Context Manager to enforce this requirement. These considerations apply:
• The internal network uses IP ranges 10.100.0.0/16 and 192.168.0.0/16.
• Some employees work remotely but connect securely through a company-managed virtual private network (VPN). The VPN dynamically allocates IP addresses from the pool 172.16.0.0/20.
• Access should be restricted to a specific Google Cloud project that is contained within an existing service perimeter.
What should you do?
A. Create an access level named "Authorized Devices." Utilize the Device Policy attribute to require corporate-managed devices. Apply the access level to the Google Cloud project and instruct all employees to enroll their devices in the organization's management system.
B. Create an access level titled "Internal Network Only." Add a condition with these attributes: • IP Subnetworks: 10.100.0.0/16, 192.168.0.0/16 • Device Policy: Require OS as Windows or macOS. Apply this access level to the sensitive Google Cloud project.
C. Create an access level titled "Corporate Access." Add a condition with the IP Subnetworks attribute, including the ranges: 10.100.0.0/16, 192.168.0.0/16, 172.16.0.0/20. Assign this access level to a service perimeter encompassing the sensitive project.
D. Create a new IAM role called "InternalAccess. Add the IP ranges 10.100.0.0/16, 192.16.0.0/16, and 172.16.0.0/20 to the role as an IAM condition. Assign this role to IAM groups corresponding to on-premises and VPN users. Grant this role the necessary permissions on the resource within this sensitive Google Cloud project.
Show Answer
Correct Answer: C
Explanation: Access Context Manager enforces network-based access using access levels applied to service perimeters. To allow only on‑premises and VPN-connected users, the access level must include all trusted IP ranges (10.100.0.0/16, 192.168.0.0/16, and the VPN pool 172.16.0.0/20). Applying this access level to the existing service perimeter correctly restricts access to the specific project. Device policies or IAM roles are unnecessary and incorrect for this requirement.
Question 90
Your organization has two VPC Service Controls service perimeters, Perimeter-A and Perimeter-B, in Google Cloud. You want to allow data to be copied from a Cloud Storage bucket in Perimeter-A to another Cloud Storage bucket in Perimeter-B. You must minimize exfiltration risk, only allow required connections, and follow the principle of least privilege. What should you do?
A. Configure a perimeter bridge between Perimeter-A and Perimeter-B, and specify the Cloud Storage buckets as the resources involved.
B. Configure a perimeter bridge between the projects hosting the Cloud Storage buckets in Perimeter-A and Perimeter-
C. Configure an egress rule for the Cloud Storage bucket in Perimeter-A and a corresponding ingress rule in Perimeter-B.
D. Configure a bidirectional egress/ingress rule for the Cloud Storage buckets in Perimeter-A and Perimeter-B.
Show Answer
Correct Answer: C
Explanation: To copy data between Cloud Storage buckets in different VPC Service Controls perimeters while minimizing exfiltration risk and following least privilege, you should use explicit egress and ingress rules. An egress rule from Perimeter-A and a corresponding ingress rule into Perimeter-B can be tightly scoped to the specific service (Cloud Storage), methods, identities, and resources involved. Perimeter bridges allow broader cross-perimeter access and are less granular, which increases risk compared to targeted ingress/egress rules.
Question 91
You are running code in Google Kubernetes Engine (GKE) containers in Google Cloud that require access to objects stored in a Cloud Storage bucket. You need to securely grant the Pods access to the bucket while minimizing management overhead. What should you do?
A. Create a service account. Grant bucket access to the Pods by using Workload Identity Federation for GKE.
B. Create a service account with keys. Store the keys in Secret Manager with a 30-day rotation schedule. Reference the keys in the Pods.
C. Create a service account with keys. Store the keys as a Kubernetes secret. Reference the keys in the Pods.
D. Create a service account with keys. Store the keys in Secret Manager. Reference the keys in the Pods.
Show Answer
Correct Answer: A
Explanation: Using Workload Identity Federation for GKE lets Pods authenticate to Google Cloud services using a mapped Google Cloud service account without creating or managing service account keys. This provides short‑lived credentials, improves security, and minimizes operational overhead. Managing static keys (options B–D) increases risk and maintenance burden and is not Google‑recommended best practice.
Question 92
Your organization's financial modeling application is already deployed on Google Cloud. The application processes large amounts of sensitive customer financial data. Application code is old and poorly understood by your current software engineers. Recent threat modeling exercises have highlighted the potential risk of sophisticated side-channel attacks against the application while the application is running. You need to further harden the Google Cloud solution to mitigate the risk of these side-channel attacks, ensuring maximum protection for the confidentiality of financial data during processing, while minimizing application problems. What should you do?
A. Enforce stricter access controls for Compute Engine instances by using service accounts, least privilege IAM policies, and limit network access.
B. Implement a runtime library designed to introduce noise and timing variations into the application's execution which will disrupt side-channel attack.
C. Migrate the application to Confidential VMs to provide hardware-level encryption of memory and protect sensitive data during processing.
D. Utilize customer-managed encryption keys (CMEK) to ensure complete control over the encryption process.
Show Answer
Correct Answer: C
Explanation: Confidential VMs provide hardware-backed memory encryption and trusted execution environments that protect data while it is being processed, mitigating sophisticated side‑channel and memory‑based attacks with minimal application changes. Other options improve access control or data-at-rest encryption but do not address runtime side‑channel risks.
$19
Get all 350 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.