Professional Cloud Security Engineer Free Practice Questions — Page 11
Question 93
Your organization has applications that run in multiple clouds. The applications require access to a Google Cloud resource running in your project. You must use short-lived access credentials to maintain security across the clouds. What should you do?
A. Create a managed workload identity. Bind an attested identity to the Compute Engine workload.
B. Create a service account key. Download the key to each application that requires access to the Google Cloud resource.
C. Create a workload identity pool with a workload identity provider for each external cloud. Set up a service account and add an IAM binding for impersonation.
D. Create a VPC firewall rule for ingress traffic with an allowlist of the IP ranges of the external cloud applications.
Show Answer
Correct Answer: C
Explanation: The requirement is to grant applications running in multiple external clouds secure access to Google Cloud resources using short-lived credentials. Workload Identity Federation is designed for this use case. By creating a workload identity pool and a provider for each external cloud, external workloads can exchange their native identities for short-lived Google Cloud tokens. Binding these identities to a service account via IAM impersonation avoids long-lived service account keys and provides centralized, secure access management. Other options either use long-lived credentials, apply only within Google Cloud, or do not address identity-based access.
Question 94
Your organization is building a chatbot that is powered by generative AI to deliver automated conversations with internal employees. You must ensure that no data with personally identifiable information (PII) is communicated through the chatbot. What should you do?
A. Encrypt data at rest for both input and output by using Cloud KMS, and apply least privilege access to the encryption keys.
B. Discover and transform PII data in both input and output by using the Cloud Data Loss Prevention (Cloud DLP) API.
C. Prevent PII data exfiltration by using VPC-SC to create a safe scope around your chatbot.
D. Scan both input and output by using data encryption tools from the Google Cloud Marketplace.
Show Answer
Correct Answer: B
Explanation: The requirement is to ensure that no personally identifiable information is communicated through the chatbot. Cloud Data Loss Prevention (DLP) is purpose-built to inspect, detect, and transform sensitive data such as PII. By applying Cloud DLP to both chatbot inputs and outputs, you can redact, mask, or tokenize PII before it is processed or returned, directly addressing the risk. The other options focus on encryption or network boundaries, which do not prevent PII from being processed or generated.
Question 95
Your organization is migrating a sensitive data processing workflow from on-premises infrastructure to Google Cloud. This workflow involves the collection, storage, and analysis of customer information that includes personally identifiable information (PII). You need to design security measures to mitigate the risk of data exfiltration in this new cloud environment. What should you do?
A. Encrypt all sensitive data in transit and at rest. Establish secure communication channels by using TLS and HTTPS protocols.
B. Implement a Cloud DLP solution to scan and identify sensitive information, and apply redaction or masking techniques to the PII. Integrate VPC SC with your network security controls to block potential data exfiltration attempts.
C. Restrict all outbound network traffic from cloud resources. Implement rigorous access controls and logging for all sensitive data and the systems that process the data.
D. Rely on employee expertise to prevent accidental data exfiltration incidents.
Show Answer
Correct Answer: B
Explanation: Option B directly addresses data exfiltration risk in Google Cloud by combining detection and prevention. Cloud DLP identifies and classifies PII so it can be masked or redacted, reducing the sensitivity of exposed data. VPC Service Controls create a security perimeter around managed services to prevent unauthorized data access and exfiltration, even from compromised credentials. Other options are either baseline controls (encryption), overly restrictive or incomplete (blocking all outbound traffic), or ineffective (relying on employees).
Question 96
Your organization has a centralized identity provider that is used to manage human and machine access. You want to leverage this existing identity management system to enable on-premises applications to access Google Cloud without hard coded credentials. What should you do?
A. Enable Secure Web Proxy. Create a proxy subnet for each region that Secure Web Proxy will be deployed. Deploy an SSL certificate to Certificate Manager. Create a Secure Web Proxy policy and rules that allow access to Google Cloud services.
B. Enable Workforce Identity Federation. Create a workforce identity pool and specify the on-premises identity provider as a workforce identity pool provider. Create an attribute mapping to map the on-premises identity provider token to a Google STS token. Create an IAM binding that binds the required role(s) to the external identity by specifying the project ID, workload identity pool, and attribute that should be matched.
C. Enable Identity-Aware Proxy (IAP). Configure IAP by specifying the groups and service accounts that should have access to the application. Grant these identities the IAP-secured web app user role.
D. Enable Workload Identity Federation. Create a workload identity pool and specify the on-premises identity provider as a workload identity pool provider. Create an attribute mapping to map the on-premises identity provider token to a Google STS token. Create a service account with the necessary permissions for the workload. Grant the external identity the Workload Identity user role on the service account.
Show Answer
Correct Answer: D
Explanation: The requirement is to allow on-premises applications (non-human workloads) to access Google Cloud using an existing centralized identity provider without hard-coded credentials. Workload Identity Federation is designed for this exact use case: it federates external workload identities (including on-premises applications) to Google Cloud, maps external IdP tokens to Google STS tokens, and allows the workload to impersonate a Google Cloud service account via the Workload Identity User role. Workforce Identity Federation is intended for human users, while Secure Web Proxy and IAP do not address application-to-Google-Cloud authentication.
Question 97
During a routine security review, your team discovered a suspicious login attempt to impersonate a highly privileged but regularly used service account by an unknown IP address. You need to effectively investigate in order to respond to this potential security incident. What should you do?
A. Enable Cloud Audit Logs for the resources that the service account interacts with. Review the logs for further evidence of unauthorized activity.
B. Review Cloud Audit Logs for activity related to the service account. Focus on the time period of the suspicious login attempt.
C. Run a vulnerability scan to identify potentially exploitable weaknesses in systems that use the service account.
D. Check Event Threat Detection in Security Command Center for any related alerts. Cross-reference your findings with Cloud Audit Logs.
Show Answer
Correct Answer: B
Explanation: To effectively investigate a suspicious login attempt, the most direct and universally applicable action is to review existing Cloud Audit Logs for activity related to the service account during the time of the incident. Cloud Audit Logs provide authoritative, detailed records of authentication and authorization events and do not assume that additional services (such as Security Command Center or Event Threat Detection) are enabled. Option A delays investigation by enabling logging after the fact, option C is not incident-focused, and option D relies on SCC being enabled, which is not stated.
Question 98
Your organization has an operational image classification model running on a managed AI service on Google Cloud. You are in a configuration review with stakeholders and must describe the security responsibilities for the image classification model. What should you do?
A. Explain that using platform-as-a-service (PaaS) transfers security concerns to Google. Describe the need for strict API usage limits to protect against unexpected usage and billing spikes.
B. Explain the security aspects of the code that transforms user-uploaded images using Google's service. Define Cloud IAM for fine-grained access control within the development team.
C. Explain Google's shared responsibility model. Focus the configuration review on Identity and Access Management (IAM) permissions, secure data upload/download procedures, and monitoring logs for any potential malicious activity.
D. Explain the development of custom network firewalls around the image classification service for deep intrusion detection and prevention. Describe vulnerability scanning tools for known vulnerabilities.
Show Answer
Correct Answer: C
Explanation: Managed AI services on Google Cloud follow a shared responsibility model: Google secures the underlying infrastructure and service, while the customer is responsible for configuring access, data handling, and monitoring. A configuration review should therefore focus on IAM permissions, secure data upload/download practices, and log monitoring for misuse or threats, which is exactly what option C describes.
Question 99
You run a web application on top of Cloud Run that is exposed to the internet with an Application Load Balancer. You want to ensure that only privileged users from your organization can access the application. The proposed solution must support browser access with single sign-on. What should you do?
A. Change Cloud Run configuration to require authentication. Assign the role of Cloud Run Invoker to the group of privileged users.
B. Create a group of privileged users in Cloud Identity. Assign the role of Cloud Run User to the group directly on the Cloud Run service.
C. Change the Ingress Control configuration of Cloud Run to internal and create firewall rules to allow only access from known IP addresses.
D. Activate Identity-Aware Proxy (IAP) on the Application Load Balancer backend. Assign the role of IAP-secured Web App User to the group of privileged users.
Show Answer
Correct Answer: D
Explanation: The requirement is browser-based access with single sign-on for only privileged users. Identity-Aware Proxy (IAP) integrated with the Application Load Balancer provides authentication via Cloud Identity/Google identities, supports SSO, and enforces authorization before traffic reaches Cloud Run. Granting the IAP-secured Web App User role to the privileged user group restricts access appropriately. Other options either do not provide browser SSO (Cloud Run IAM alone) or rely on network controls rather than user identity.
Question 100
Your organization relies heavily on Cloud Run for its containerized applications. You utilize Cloud Build for image creation, Artifact Registry for image storage, and Cloud Run for deployment. You must ensure that containers with vulnerabilities rated above a common vulnerability scoring system (CVSS) score of "medium" are not deployed to production. What should you do?
A. Implement vulnerability scanning as part of the Cloud Build process. If any medium or higher vulnerabilities are detected, manually rebuild the image with updated components.
B. Perform manual vulnerability checks post-build, but before Cloud Run deployment. Implement a manual security-engineer-driven remediation process.
C. Configure Binary Authorization on Cloud Run to enforce image signatures. Create policies to allow deployment only for images passing a defined vulnerability threshold.
D. Utilize a vulnerability scanner during the Cloud Build stage and set Artifact Registry permissions to block images containing vulnerabilities above "medium."
Show Answer
Correct Answer: C
Explanation: Binary Authorization for Cloud Run provides a centralized, automated enforcement point at deployment time. By integrating vulnerability scanning results (from Artifact Registry/Container Analysis) into Binary Authorization policies, you can prevent deployment of images with CVSS scores above the allowed threshold. This ensures vulnerable containers never reach production, unlike manual checks or build-time-only controls that can be bypassed.
Question 101
You are managing data in your organization's Cloud Storage buckets and are required to retain objects. To reduce storage costs, you must automatically downgrade the storage class of objects older than 365 days to Coldline storage. What should you do?
A. Use Cloud Asset Inventory to generate a report of the configuration of all storage buckets. Examine the Lifecycle management policy settings and ensure that they are set correctly.
B. Set up a CloudRun Job with Cloud Scheduler to execute a script that searches for and removes flies older than 365 days from your Cloud Storage.
C. Enable the Autoclass feature to manage all aspects of bucket storage classes.
D. Define a lifecycle policy JSON with an action on SetStorageClass to COLDLINE with an age condition of 365 and matchStorageClass STANDAR
Show Answer
Correct Answer: D
Explanation: Google Cloud Storage supports lifecycle management rules that automatically transition objects based on age. Defining a lifecycle policy with the action SetStorageClass to COLDLINE and a condition of age >= 365 days directly fulfills the requirement to retain objects while reducing storage cost. Using matchStorageClass (e.g., STANDARD) ensures only eligible objects are transitioned. Other options either do not modify storage class automatically or introduce unnecessary complexity.
Question 102
You have placed several Compute Engine instances in a private subnet. You want to allow these instances to access Google Cloud services, like Cloud Storage, without traversing the internet. What should you do?
A. Enable Private Google Access for the private subnet.
B. Configure Private Service Connect for the private subnet's Virtual Private Cloud (VPC) and allocate an IP range for the Compute Engine instances.
C. Reserve and assign static external IP addresses for the Compute Engine instances.
D. Create a Cloud NAT gateway for the region where the private subnet is configured.
Show Answer
Correct Answer: A
Explanation: Instances in a private subnet without external IPs can access Google APIs and services privately by enabling Private Google Access on the subnet. This allows traffic to Google services to stay on Google's network without traversing the public internet. Cloud NAT is for outbound internet access, Private Service Connect is for private access to specific services/endpoints, and external IPs are unnecessary and counter to the requirement.
$19
Get all 350 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.