Professional Cloud Security Engineer Free Practice Questions — Page 11
Question 101
You are running code in Google Kubernetes Engine (GKE) containers in Google Cloud that require access to objects stored in a Cloud Storage bucket. You need to securely grant the Pods access to the bucket while minimizing management overhead. What should you do?
A. Create a service account. Grant bucket access to the Pods by using Workload Identity Federation for GKE.
B. Create a service account with keys. Store the keys in Secret Manager with a 30-day rotation schedule. Reference the keys in the Pods.
C. Create a service account with keys. Store the keys as a Kubernetes secret. Reference the keys in the Pods.
D. Create a service account with keys. Store the keys in Secret Manager. Reference the keys in the Pods.
Show Answer
Correct Answer: A
Explanation: Workload Identity Federation for GKE is the Google-recommended best practice for granting GKE workloads access to Google Cloud resources. It lets Pods authenticate as a Google service account using short-lived credentials without creating, storing, or rotating service account keys, minimizing both security risk and operational overhead.
Question 102
Your organization's financial modeling application is already deployed on Google Cloud. The application processes large amounts of sensitive customer financial data. Application code is old and poorly understood by your current software engineers. Recent threat modeling exercises have highlighted the potential risk of sophisticated side-channel attacks against the application while the application is running. You need to further harden the Google Cloud solution to mitigate the risk of these side-channel attacks, ensuring maximum protection for the confidentiality of financial data during processing, while minimizing application problems. What should you do?
A. Enforce stricter access controls for Compute Engine instances by using service accounts, least privilege IAM policies, and limit network access.
B. Implement a runtime library designed to introduce noise and timing variations into the application's execution which will disrupt side-channel attack.
C. Migrate the application to Confidential VMs to provide hardware-level encryption of memory and protect sensitive data during processing.
D. Utilize customer-managed encryption keys (CMEK) to ensure complete control over the encryption process.
Show Answer
Correct Answer: C
Explanation: Confidential VMs are specifically designed to protect data in use by encrypting memory with hardware-based confidential computing technologies, helping mitigate risks from sophisticated memory and certain side-channel attacks while requiring minimal application changes. Option A improves access control but does not address data-in-use side-channel risks. Option B is not a standard Google Cloud mitigation and would require risky application changes, especially for poorly understood legacy code. Option D protects data at rest through key management, not data during processing.
Question 103
Your organization has applications that run in multiple clouds. The applications require access to a Google Cloud resource running in your project. You must use short-lived access credentials to maintain security across the clouds. What should you do?
A. Create a managed workload identity. Bind an attested identity to the Compute Engine workload.
B. Create a service account key. Download the key to each application that requires access to the Google Cloud resource.
C. Create a workload identity pool with a workload identity provider for each external cloud. Set up a service account and add an IAM binding for impersonation.
D. Create a VPC firewall rule for ingress traffic with an allowlist of the IP ranges of the external cloud applications.
Show Answer
Correct Answer: C
Explanation: For workloads running outside Google Cloud (such as in other cloud providers) that need secure access to Google Cloud resources using short-lived credentials, the recommended solution is Workload Identity Federation. Create a workload identity pool and configure a workload identity provider for each external cloud. Then allow the external identities to impersonate a Google Cloud service account via IAM. This avoids long-lived service account keys and issues short-lived access tokens. Option A is for managed workload identities within supported environments, B uses long-lived keys (not recommended), and D only controls network access, not authentication or authorization.
Question 104
Your organization is building a chatbot that is powered by generative AI to deliver automated conversations with internal employees. You must ensure that no data with personally identifiable information (PII) is communicated through the chatbot. What should you do?
A. Encrypt data at rest for both input and output by using Cloud KMS, and apply least privilege access to the encryption keys.
B. Discover and transform PII data in both input and output by using the Cloud Data Loss Prevention (Cloud DLP) API.
C. Prevent PII data exfiltration by using VPC-SC to create a safe scope around your chatbot.
D. Scan both input and output by using data encryption tools from the Google Cloud Marketplace.
Show Answer
Correct Answer: B
Explanation: Use the Cloud Data Loss Prevention (Cloud DLP) API to inspect and de-identify or redact personally identifiable information in both user inputs and model outputs. This directly addresses the requirement to prevent PII from being communicated through the chatbot. Encryption at rest (A) protects stored data but does not prevent PII from appearing in conversations. VPC Service Controls (C) reduce data exfiltration risk at the service perimeter but do not detect or remove PII from chatbot content. Generic encryption tools (D) likewise do not inspect and transform conversational data.
Question 105
Your organization is migrating a sensitive data processing workflow from on-premises infrastructure to Google Cloud. This workflow involves the collection, storage, and analysis of customer information that includes personally identifiable information (PII). You need to design security measures to mitigate the risk of data exfiltration in this new cloud environment. What should you do?
A. Encrypt all sensitive data in transit and at rest. Establish secure communication channels by using TLS and HTTPS protocols.
B. Implement a Cloud DLP solution to scan and identify sensitive information, and apply redaction or masking techniques to the PII. Integrate VPC SC with your network security controls to block potential data exfiltration attempts.
C. Restrict all outbound network traffic from cloud resources. Implement rigorous access controls and logging for all sensitive data and the systems that process the data.
D. Rely on employee expertise to prevent accidental data exfiltration incidents.
Show Answer
Correct Answer: B
Explanation: Option B most directly addresses data exfiltration risk in Google Cloud by combining Cloud DLP to discover and protect PII with VPC Service Controls to establish a security perimeter around supported Google Cloud services, reducing the risk of data exfiltration. Option A provides important baseline encryption but does not specifically mitigate exfiltration. Option C is overly broad and impractical, and while access controls and logging are important, it lacks the targeted Google Cloud exfiltration controls. Option D is insufficient as a primary security measure.
Question 106
Your organization has a centralized identity provider that is used to manage human and machine access. You want to leverage this existing identity management system to enable on-premises applications to access Google Cloud without hard coded credentials. What should you do?
A. Enable Secure Web Proxy. Create a proxy subnet for each region that Secure Web Proxy will be deployed. Deploy an SSL certificate to Certificate Manager. Create a Secure Web Proxy policy and rules that allow access to Google Cloud services.
B. Enable Workforce Identity Federation. Create a workforce identity pool and specify the on-premises identity provider as a workforce identity pool provider. Create an attribute mapping to map the on-premises identity provider token to a Google STS token. Create an IAM binding that binds the required role(s) to the external identity by specifying the project ID, workload identity pool, and attribute that should be matched.
C. Enable Identity-Aware Proxy (IAP). Configure IAP by specifying the groups and service accounts that should have access to the application. Grant these identities the IAP-secured web app user role.
D. Enable Workload Identity Federation. Create a workload identity pool and specify the on-premises identity provider as a workload identity pool provider. Create an attribute mapping to map the on-premises identity provider token to a Google STS token. Create a service account with the necessary permissions for the workload. Grant the external identity the Workload Identity user role on the service account.
Show Answer
Correct Answer: D
Explanation: The requirement is for on-premises applications (machine identities) to access Google Cloud without hard-coded credentials by federating with an existing identity provider. Workload Identity Federation is designed for external workloads, including on-premises applications, to exchange external identity provider tokens for Google Cloud credentials via STS and impersonate a service account. Workforce Identity Federation is intended for human users, not application workloads. Secure Web Proxy and IAP do not address federated, credentialless access for external workloads.
Question 107
During a routine security review, your team discovered a suspicious login attempt to impersonate a highly privileged but regularly used service account by an unknown IP address. You need to effectively investigate in order to respond to this potential security incident. What should you do?
A. Enable Cloud Audit Logs for the resources that the service account interacts with. Review the logs for further evidence of unauthorized activity.
B. Review Cloud Audit Logs for activity related to the service account. Focus on the time period of the suspicious login attempt.
C. Run a vulnerability scan to identify potentially exploitable weaknesses in systems that use the service account.
D. Check Event Threat Detection in Security Command Center for any related alerts. Cross-reference your findings with Cloud Audit Logs.
Show Answer
Correct Answer: D
Explanation: The best investigation workflow is to check Event Threat Detection in Security Command Center for alerts related to the suspected service account impersonation and then validate and investigate the activity using Cloud Audit Logs. Audit Logs provide the forensic record of actions, while Event Threat Detection can surface high-confidence detections for suspicious behavior. Option B only examines logs and is less comprehensive. Option A is inappropriate because enabling logs after the event may not capture past activity. Option C is unrelated to investigating a suspected account impersonation.
Question 108
Your organization has an operational image classification model running on a managed AI service on Google Cloud. You are in a configuration review with stakeholders and must describe the security responsibilities for the image classification model. What should you do?
A. Explain that using platform-as-a-service (PaaS) transfers security concerns to Google. Describe the need for strict API usage limits to protect against unexpected usage and billing spikes.
B. Explain the security aspects of the code that transforms user-uploaded images using Google's service. Define Cloud IAM for fine-grained access control within the development team.
C. Explain Google's shared responsibility model. Focus the configuration review on Identity and Access Management (IAM) permissions, secure data upload/download procedures, and monitoring logs for any potential malicious activity.
D. Explain the development of custom network firewalls around the image classification service for deep intrusion detection and prevention. Describe vulnerability scanning tools for known vulnerabilities.
Show Answer
Correct Answer: C
Explanation: The correct approach is to explain Google's shared responsibility model. For a managed AI service, Google secures the underlying infrastructure, while the customer remains responsible for configuring IAM, protecting data, securing access and data transfer, and monitoring logs for suspicious activity. Option A incorrectly implies PaaS transfers most security responsibilities to Google. Option B is too narrow and focuses on application code rather than the overall security model. Option D emphasizes custom network controls that are generally not the primary customer responsibility for a managed AI service.
Question 109
You run a web application on top of Cloud Run that is exposed to the internet with an Application Load Balancer. You want to ensure that only privileged users from your organization can access the application. The proposed solution must support browser access with single sign-on. What should you do?
A. Change Cloud Run configuration to require authentication. Assign the role of Cloud Run Invoker to the group of privileged users.
B. Create a group of privileged users in Cloud Identity. Assign the role of Cloud Run User to the group directly on the Cloud Run service.
C. Change the Ingress Control configuration of Cloud Run to internal and create firewall rules to allow only access from known IP addresses.
D. Activate Identity-Aware Proxy (IAP) on the Application Load Balancer backend. Assign the role of IAP-secured Web App User to the group of privileged users.
Show Answer
Correct Answer: D
Explanation: Identity-Aware Proxy (IAP) on the external Application Load Balancer provides browser-based authentication with Google single sign-on and centralized authorization. Granting the IAP-secured Web App User role to the privileged users' group restricts access appropriately. Option A requires Cloud Run authentication but does not provide the intended ALB/IAP SSO access pattern for browser users behind the load balancer. Option B uses the wrong IAM role. Option C relies on IP filtering rather than user identity and does not support SSO.
Question 110
Your organization relies heavily on Cloud Run for its containerized applications. You utilize Cloud Build for image creation, Artifact Registry for image storage, and Cloud Run for deployment. You must ensure that containers with vulnerabilities rated above a common vulnerability scoring system (CVSS) score of "medium" are not deployed to production. What should you do?
A. Implement vulnerability scanning as part of the Cloud Build process. If any medium or higher vulnerabilities are detected, manually rebuild the image with updated components.
B. Perform manual vulnerability checks post-build, but before Cloud Run deployment. Implement a manual security-engineer-driven remediation process.
C. Configure Binary Authorization on Cloud Run to enforce image signatures. Create policies to allow deployment only for images passing a defined vulnerability threshold.
D. Utilize a vulnerability scanner during the Cloud Build stage and set Artifact Registry permissions to block images containing vulnerabilities above "medium."
Show Answer
Correct Answer: C
Explanation: Binary Authorization for Cloud Run is designed to enforce deployment policies so only trusted images are deployed. By integrating vulnerability scanning/attestations into the build pipeline and requiring the appropriate attestation, you can prevent deployment of images with vulnerabilities above the defined CVSS threshold. The other options rely on manual processes or Artifact Registry capabilities that do not enforce deployment policy in this way.
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.