Professional Cloud Security Engineer Free Practice Questions — Page 10
Question 91
Your organization operates in a highly regulated industry and needs to implement strict controls around temporary access to sensitive Google Cloud resources. You have been using Access Approval to manage this access, but your compliance team has mandated the use of a custom signing key. Additionally, they require that the key be stored in a hardware security module (HSM) located outside Google Cloud. You need to configure Access Approval to use a custom signing key that meets the compliance requirements. What should you do?
A. Create a new asymmetric signing key in Cloud Key Management System (Cloud KMS) using a supported algorithm and grant the Access Approval service account the IAM signerVerifier role on the key.
B. Export your existing Access Approval signing key as a PEM file. Upload the file to your external HSM and reconfigure Access Approval to use the key from the HSM.
C. Create a signing key in your external HSM. Integrate the HSM with Cloud External Key Manager (Cloud EKM) and make the key available within your project. Configure Access Approval to use this key.
D. Create a new asymmetric signing key in Cloud KMS and configure the key with a rotation period of 30 days. Add the corresponding public key to your external HSM.
Show Answer
Correct Answer: C
Explanation: The requirement is to use a custom signing key stored in an HSM outside Google Cloud. Cloud External Key Manager (Cloud EKM) is designed to let Google Cloud services use cryptographic keys that remain in an external key manager or on-premises HSM. Creating the signing key in the external HSM, exposing it through Cloud EKM, and configuring Access Approval to use it satisfies the compliance requirement. The other options either use Cloud KMS-managed keys, describe unsupported key export, or do not keep the signing key outside Google Cloud.
Question 92
Your organization is migrating a complex application to Google Cloud. The application has multiple internal components that interact with each other across several Google Cloud projects. Security is a major concern, and you must design an authorization scheme for administrators that aligns with the principles of least privilege and separation of duties. What should you do?
A. Identify the users who will migrate the application, revoke the default user roles and assign the users with purposely created custom roles.
B. Use multiple external identity providers (IdP) configured to use different SAML profiles and federate the IdPs for each application component.
C. Configure multi-factor authentication (MFA) to enforce the use of physical tokens for all users who will migrate the application.
D. No action needed. When a Google Cloud organization is created, the appropriate permissions are automatically assigned to all users in the domain.
Show Answer
Correct Answer: A
Explanation: The requirement emphasizes least privilege and separation of duties for administrators across multiple Google Cloud projects. Creating custom IAM roles with only the permissions required for each administrative function best satisfies these principles. Revoking overly broad default roles and assigning purpose-built custom roles reduces unnecessary access. MFA improves authentication but does not implement authorization or least privilege. Multiple IdPs and SAML profiles address identity federation rather than fine-grained authorization. Google Cloud does not automatically assign appropriate least-privilege permissions to all users in an organization.
Question 93
Your organization relies heavily on virtual machines (VMs) in Compute Engine. Due to team growth and resource demands, VM sprawl is becoming problematic. Maintaining consistent security hardening and timely package updates poses an increasing challenge. You need to centralize VM image management and automate the enforcement of security baselines throughout the virtual machine lifecycle. What should you do?
A. Use VM Manager to automatically distribute and apply patches to YMs across your projects. Integrate VM Manager with hardened, organization-standard VM images stored in a central repository.
B. Configure the sole-tenancy feature in Compute Engine for all projects. Set up custom organization policies in Policy Controller to restrict the operating systems and image sources that teams are allowed to use.
C. Create a Cloud Build trigger to build a pipeline that generates hardened VM images. Run vulnerability scans in the pipeline, and store images with passing scans in a registry. Use instance templates pointing to this registry.
D. Activate Security Command Center Enterprise. Use VM discovery and posture management features to monitor hardening state and trigger automatic responses upon detection of issues.
Show Answer
Correct Answer: A
Explanation: VM Manager is the Google Cloud service designed for ongoing fleet management, including OS patch management, inventory, and policy-based maintenance. Combined with centrally managed hardened images, it addresses both standardized provisioning and continuous enforcement of security baselines across the VM lifecycle. Option C improves image creation but does not provide comprehensive ongoing patching and lifecycle management. Option B focuses on placement and restrictions rather than lifecycle management, and Option D emphasizes detection/posture rather than centralized image management and enforcement.
Question 94
Customers complain about error messages when they access your organization's website. You suspect that the web application firewall rules configured in Cloud Armor are too strict. You want to collect request logs to investigate what triggered the rules and blocked the traffic. What should you do?
A. Modify the Application Load Balancer backend and increase the tog sample rate to a higher number.
B. Enable logging in the Application Load Balancer backend and set the log level to VERBOSE in the Cloud Armor policy.
C. Change the configuration of suspicious web application firewall rules in the Cloud Armor policy to preview mode.
D. Create a log sink with a filter for togs containing redirected_by_security_policy and set a BigQuery dataset as destination.
Show Answer
Correct Answer: B
Explanation: To investigate why Cloud Armor WAF rules are blocking requests, you need request logging enabled on the Application Load Balancer backend and Cloud Armor verbose logging enabled. Verbose logging adds detailed security policy evaluation information, including which WAF rules matched and why, making it the appropriate choice for troubleshooting. Preview mode (C) is useful for testing rule behavior without enforcement, but it does not by itself enable the detailed logging needed for investigating already blocked traffic. Increasing log sample rate alone (A) is insufficient without verbose security logs, and creating a log sink (D) only changes log export, not what information is collected.
Question 95
Your organization utilizes Cloud Run services within multiple projects underneath the non-production folder which requires primarily internal communication. Some services need external access to approved fully qualified domain names (FQDN) while other external traffic must be blocked. Internal applications must not be exposed. You must achieve this granular control with allowlists overriding broader restrictions only for designated VPCs. What should you do?
A. Implement a global-level allowlist rule for the necessary FQDNs within a hierarchical firewall policy. Apply this policy across all VPCs in the organization and configure Cloud NAT without any additional filtering.
B. Create a folder-level deny-all rule for outbound traffic within a hierarchical firewall policy. Define FQDN allowlist rules in separate policies and associate them with the necessary VPCs. Configure Cloud NAT for these VPCs.
C. Create a project-level deny-all rule within a hierarchical structure and apply it broadly. Override this rule with separate FQDN allowlists defined in VPC-level firewall policies associated with the relevant VPCs.
D. Configure Cloud NAT with IP-based filtering to permit outbound traffic only to the allowlist d FQDNs' IP ranges. Apply Cloud NAT uniformly to all VPCs within the organization's folder structure.
Show Answer
Correct Answer: B
Explanation: A folder-level hierarchical firewall policy can establish a deny-by-default egress baseline, while separate hierarchical firewall policies with FQDN allow rules can be associated only with the required VPCs, allowing those specific networks to override the broader restriction. Cloud NAT provides internet egress for the eligible workloads. The other options either apply allowlists too broadly, use unsupported policy layering, or rely on Cloud NAT for FQDN/IP filtering, which it does not provide.
Question 96
Your organization hosts a sensitive web application in Google Cloud. To protect the web application, you've set up a virtual private cloud (VPC) with dedicated subnets for the application's frontend and backend components. You must implement security controls to restrict incoming traffic, protect against web-based attacks, and monitor internal traffic. What should you do?
A. Configure Cloud Firewall to permit allow-listed traffic only, deploy Google Cloud Armor with predefined rules for blocking common web attacks, and deploy Cloud Intrusion Detection System (IDS) to detect internal traffic anomalies.
B. Configure Google Cloud Armor to allow incoming connections, configure DNS Security Extensions (DNSSEC) on Cloud DNS to secure against common web attacks, and deploy Cloud Intrusion Detection System (Cloud IDS) to detect internal traffic anomalies.
C. Configure Cloud Intrusion Detection System (Cloud IDS) to monitor incoming connections, deploy Identity-Aware Proxy (IAP) to block common web attacks, and deploy Google Cloud Armor to detect internal traffic anomalies.
D. Configure Cloud DNS to secure incoming traffic, deploy Cloud Intrusion Detection System (Cloud IDS) to detect common web attacks, and deploy Google Cloud Armor to detect internal traffic anomalies.
Show Answer
Correct Answer: A
Explanation: A correctly maps each requirement to the appropriate Google Cloud security service: VPC firewall rules restrict incoming traffic to allow-listed sources, Google Cloud Armor is the web application firewall that protects against common web attacks using predefined WAF rules, and Cloud IDS monitors VPC traffic for suspicious activity and internal traffic anomalies.
Question 97
Your organization uses Google Cloud to process large amounts of location data for analysis and visualization. The location data is potentially sensitive. You must design a solution that allows storing and processing the location data securely, minimizing data exposure risks, and adhering to both regulatory guidelines and your organization's internal data residency policies. What should you do?
A. Enable location restrictions on Compute Engine instances and virtual disk resources where the data is handled. Apply labels to tag geographic metadata for all stored data.
B. Use the Cloud Data Loss Prevention (Cloud DLP) API to scan for sensitive location data before any storage or processing. Create Cloud Storage buckets with global availability for optimal performance, relying on Cloud DLP results to filter and control data access.
C. Create regional Cloud Storage buckets with Object Lifecycle Management policies that limit data lifetime. Enable fine-grained access controls by using IAM conditions. Encrypt data with customer-managed encryption keys (CMEK) generated within specific Cloud KMS key locations.
D. Store data within BigQuery in a specified region by using dataset location configuration. Use authorized views and row-level security to enforce geographic access restrictions. Encrypt data within BigQuery tables by using customer-managed encryption keys (CMEK).
Show Answer
Correct Answer: D
Explanation: BigQuery is the most appropriate service for large-scale analysis and visualization. Configuring the dataset location satisfies data residency requirements, authorized views and row-level security minimize data exposure through fine-grained access control, and CMEK provides customer-controlled encryption. The other options either rely on features that do not enforce residency appropriately, use global storage, or focus on infrastructure rather than the analytics platform.
Question 98
Your team maintains 1PB of sensitive data within BigOuery that contains personally identifiable information (PII). You need to provide access to this dataset to another team within your organization for analysis purposes. You must share the BigQuery dataset with the other team while protecting the PII. What should you do?
A. Utilize BigQuery's row-level access policies to mask PII columns based on the other team's user identities.
B. Export the BigQuery dataset to Cloud Storage. Create a VPC Service Control perimeter and allow only their team's project access to the bucket.
C. Implement data pseudonymization techniques to replace the PII fields with non-identifiable values. Grant the other team access to the pseudonymized dataset.
D. Create a filtered copy of the dataset and replace the sensitive data with hash values in a separate project. Grant the other team access to this new project.
Show Answer
Correct Answer: C
Explanation: The intent is to share the data while protecting PII. Option A is incorrect because row-level access policies filter rows, not mask PII columns; column-level security and dynamic data masking are different features. B protects storage boundaries but does not protect PII exposure. D creates a separate hashed copy, but the recommended privacy-preserving approach is to pseudonymize the PII and share the pseudonymized dataset while retaining the original dataset internally.
Sources:
https://wayground.com/admin/quiz/66ea86d90f2b247ccb13b057/professional-security-engineer-251-294
Question 99
Your organization is adopting Google Cloud and wants to ensure sensitive resources are only accessible from devices within the internal on-premises corporate network. You must configure Access Context Manager to enforce this requirement. These considerations apply:
• The internal network uses IP ranges 10.100.0.0/16 and 192.168.0.0/16.
• Some employees work remotely but connect securely through a company-managed virtual private network (VPN). The VPN dynamically allocates IP addresses from the pool 172.16.0.0/20.
• Access should be restricted to a specific Google Cloud project that is contained within an existing service perimeter.
What should you do?
A. Create an access level named "Authorized Devices." Utilize the Device Policy attribute to require corporate-managed devices. Apply the access level to the Google Cloud project and instruct all employees to enroll their devices in the organization's management system.
B. Create an access level titled "Internal Network Only." Add a condition with these attributes: • IP Subnetworks: 10.100.0.0/16, 192.168.0.0/16 • Device Policy: Require OS as Windows or macOS. Apply this access level to the sensitive Google Cloud project.
C. Create an access level titled "Corporate Access." Add a condition with the IP Subnetworks attribute, including the ranges: 10.100.0.0/16, 192.168.0.0/16, 172.16.0.0/20. Assign this access level to a service perimeter encompassing the sensitive project.
D. Create a new IAM role called "InternalAccess. Add the IP ranges 10.100.0.0/16, 192.16.0.0/16, and 172.16.0.0/20 to the role as an IAM condition. Assign this role to IAM groups corresponding to on-premises and VPN users. Grant this role the necessary permissions on the resource within this sensitive Google Cloud project.
Show Answer
Correct Answer: C
Explanation: Access Context Manager enforces context-aware access through access levels that can include IP subnet conditions. To allow only requests originating from the corporate network and company VPN, the access level must include all trusted IP ranges (10.100.0.0/16, 192.168.0.0/16, and 172.16.0.0/20). The access level is then enforced by associating it with the existing service perimeter protecting the sensitive project. Device policies alone do not satisfy the network-based requirement, omitting the VPN range would block remote users, and IAM roles/conditions are not the correct mechanism for Access Context Manager network restrictions.
Question 100
Your organization has two VPC Service Controls service perimeters, Perimeter-A and Perimeter-B, in Google Cloud. You want to allow data to be copied from a Cloud Storage bucket in Perimeter-A to another Cloud Storage bucket in Perimeter-B. You must minimize exfiltration risk, only allow required connections, and follow the principle of least privilege. What should you do?
A. Configure a perimeter bridge between Perimeter-A and Perimeter-B, and specify the Cloud Storage buckets as the resources involved.
B. Configure a perimeter bridge between the projects hosting the Cloud Storage buckets in Perimeter-A and Perimeter-
C. Configure an egress rule for the Cloud Storage bucket in Perimeter-A and a corresponding ingress rule in Perimeter-B.
D. Configure a bidirectional egress/ingress rule for the Cloud Storage buckets in Perimeter-A and Perimeter-B.
Show Answer
Correct Answer: C
Explanation: Ingress and egress rules are the recommended, more granular mechanism for allowing specific cross-perimeter access while minimizing data exfiltration risk. An egress rule in Perimeter-A combined with a corresponding ingress rule in Perimeter-B allows only the required Cloud Storage access, scoped by identities, services, projects, and methods, aligning with least privilege. Perimeter bridges are broader and were the older mechanism for many inter-perimeter scenarios.
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.