Professional Cloud Security Engineer Free Practice Questions — Page 12
Question 111
You are managing data in your organization's Cloud Storage buckets and are required to retain objects. To reduce storage costs, you must automatically downgrade the storage class of objects older than 365 days to Coldline storage. What should you do?
A. Use Cloud Asset Inventory to generate a report of the configuration of all storage buckets. Examine the Lifecycle management policy settings and ensure that they are set correctly.
B. Set up a CloudRun Job with Cloud Scheduler to execute a script that searches for and removes flies older than 365 days from your Cloud Storage.
C. Enable the Autoclass feature to manage all aspects of bucket storage classes.
D. Define a lifecycle policy JSON with an action on SetStorageClass to COLDLINE with an age condition of 365 and matchStorageClass STANDAR
Show Answer
Correct Answer: D
Explanation: Cloud Storage Object Lifecycle Management is the native feature for automatically transitioning objects based on age. A lifecycle rule with the SetStorageClass action, storage class COLDLINE, an age condition of 365 days, and matchStorageClass set to STANDARD achieves the requirement while retaining the objects and reducing storage costs. Autoclass automatically manages storage classes but does not let you specify a fixed transition at 365 days, and the other options do not meet the requirement.
Question 112
You have placed several Compute Engine instances in a private subnet. You want to allow these instances to access Google Cloud services, like Cloud Storage, without traversing the internet. What should you do?
A. Enable Private Google Access for the private subnet.
B. Configure Private Service Connect for the private subnet's Virtual Private Cloud (VPC) and allocate an IP range for the Compute Engine instances.
C. Reserve and assign static external IP addresses for the Compute Engine instances.
D. Create a Cloud NAT gateway for the region where the private subnet is configured.
Show Answer
Correct Answer: A
Explanation: Private Google Access allows VM instances without external IP addresses in a subnet to reach Google APIs and services (such as Cloud Storage) over Google's network without traversing the public internet. Cloud NAT provides outbound internet access, not private access to Google APIs. Private Service Connect is for privately consuming supported services but is not the standard solution for enabling private access to Google APIs from VMs. Assigning external IPs would require internet routing.
Question 113
Your company’s users access data in a BigQuery table. You want to ensure they can only access the data during working hours.
What should you do?
A. Assign a BigQuery Data Viewer role along with an IAM condition that limits the access to specified working hours.
B. Run a gsutil script that assigns a BigQuery Data Viewer role, and remove it only during the specified working hours.
C. Assign a BigQuery Data Viewer role to a service account that adds and removes the users daily during the specified working hours.
D. Configure Cloud Scheduler so that it triggers a Cloud Functions instance that modifies the organizational policy constraint for BigQuery during the specified working hours.
Show Answer
Correct Answer: A
Explanation: IAM Conditions support time-based access control by attaching a condition to an IAM role binding. Grant the BigQuery Data Viewer role with a condition that allows access only during specified working hours. The other options rely on repeatedly modifying IAM bindings or organization policies, which is unnecessary and not the intended mechanism for time-restricted access.
Question 114
An administrative application is running on a virtual machine (VM) in a managed group at port 5601 inside a Virtual Private Cloud (VPC) instance without access to the internet currently. You want to expose the web interface at port 5601 to users and enforce authentication and authorization Google credentials.
What should you do?
A. Configure the bastion host with OS Login enabled and allow connection to port 5601 at VPC firewall. Log in to the bastion host from the Google Cloud console by using SSH-in-browser and then to the web application.
B. Modify the VPC routing with the default route point to the default internet gateway. Modify the VPC Firewall rule to allow access from the internet 0.0.0.0/0 to port 5601 on the application instance.
C. Configure Secure Shell Access (SSH) bastion host in a public network, and allow only the bastion host to connect to the application on port 5601. Use a bastion host as a jump host to connect to the application.
D. Configure an HTTP Load Balancing instance that points to the managed group with Identity-Aware Proxy (IAP) protection with Google credentials. Modify the VPC firewall to allow access from IAP network range.
Show Answer
Correct Answer: D
Explanation: Identity-Aware Proxy (IAP) integrated with an external HTTP(S) Load Balancer is the Google Cloud service designed to expose internal web applications while enforcing authentication and authorization using Google identities. The backend VM instances remain without direct internet exposure, and firewall rules should allow traffic from the IAP IP range to the backend. Options A and C rely on SSH/bastion access rather than web access with Google credential enforcement, and B exposes the service directly to the internet without the required authentication.
Question 115
Your Google Cloud environment has one organization node, one folder named “Apps”, and several projects within that folder. The organizational node enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the terramearth.com organization. The “Apps” folder enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the flowlogistic.com organization. It also has the inheritFromParent: false property.
You attempt to grant access to a project in the “Apps” folder to the user
.
What is the result of your action and why?
A. The action succeeds because members from both organizations, terramearth.com or flowlogistic.com, are allowed on projects in the “Apps” folder.
B. The action succeeds and the new member is successfully added to the project's Identity and Access Management (IAM) policy because all policies are inherited by underlying folders and projects.
C. The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy must be defined on the current project to deactivate the constraint temporarily.
D. The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy is in place and only members from the flowlogistic.com organization are allowed.
Show Answer
Correct Answer: D
Explanation: The folder-level constraints/iam.allowedPolicyMemberDomains policy has inheritFromParent: false, so it does not inherit the organization-level allowed domain list. Projects under the folder are governed by the folder's policy, which allows only members from flowlogistic.com. Attempting to add a principal from a different domain is rejected.
Question 116
You are developing a new application that uses exclusively Compute Engine VMs. Once a day, this application will execute five different batch jobs. Each of the batch jobs requires a dedicated set of permissions on Google Cloud resources outside of your application. You need to design a secure access concept for the batch jobs that adheres to the least-privilege principle.
What should you do?
A. 1. Create a general service account “g-sa” to orchestrate the batch jobs. 2. Create one service account per batch job ‘b-sa-[1-5]’. Grant only the permissions required to run the individual batch jobs to the service accounts and generate service account keys for each of these service accounts. 3. Store the service account keys in Secret Manager. Grant g-sa access to Secret Manager and run the batch jobs with the permissions of b-sa-[1-5].
B. 1. Create a general service account “g-sa” to execute the batch jobs. 2. Grant the permissions required to execute the batch jobs to g-sa. 3. Execute the batch jobs with the permissions granted to g-sa.
C. 1. Create a workload identity pool and configure workload identity pool providers for each batch job. 2. Assign the workload identity user role to each of the identities configured in the providers. 3. Create one service account per batch job “b-sa-[1-5]”, and grant only the permissions required to run the individual batch jobs to the service accounts. 4. Generate credential configuration files for each of the providers. Use these files to execute the batch jobs with the permissions of b-sa-[1-5].
D. 1. Create a general service account “g-sa” to orchestrate the batch jobs. 2. Create one service account per batch job “b-sa-[1-5]”, and grant only the permissions required to run the individual batch jobs to the service accounts. 3. Grant the Service Account Token Creator role to g-sa. Use g-sa to obtain short-lived access tokens for b-sa-[1-5] and to execute the batch jobs with the permissions of b-sa-[1-5].
Show Answer
Correct Answer: D
Explanation: Option D follows the principle of least privilege by assigning a dedicated service account with only the required permissions to each batch job, while using a general orchestrator service account only to impersonate those service accounts via the Service Account Token Creator role. This avoids long-lived service account keys by using short-lived access tokens. Option A relies on service account keys, which are discouraged. Option B grants all permissions to one service account, violating least privilege. Option C uses Workload Identity Federation, which is intended for external workloads rather than Compute Engine VMs running within Google Cloud.
Question 117
Your customer has an on-premises Public Key Infrastructure (PKI) with a certificate authority (CA). You need to issue certificates for many HTTP load balancer frontends. The on-premises PKI should be minimally affected due to many manual processes, and the solution needs to scale.
What should you do?
A. Use Certificate Manager to issue Google managed public certificates and configure it at HTTP the load balancers in your infrastructure as code (IaC).
B. Use a subordinate CA in the Google Certificate Authority Service from the on-premises PKI system to issue certificates for the load balancers.
C. Use Certificate Manager to import certificates issued from on-premises PKI and for the frontends. Leverage the gcloud tool for importing.
D. Use the web applications with PKCS12 certificates issued from subordinate CA based on OpenSSL on-premises. Use the gcloud tool for importing. Use the External TCP/UDP Network load balancer instead of an external HTTP Load Balancer.
Show Answer
Correct Answer: B
Explanation: Using Google Cloud Certificate Authority Service (CAS) as a subordinate CA chained to the existing on-premises PKI allows certificate issuance to be delegated and automated in Google Cloud. This minimizes ongoing interaction with the on-premises root/issuing CA and scales for many HTTP load balancer frontends. Importing certificates still requires external issuance and repeated import operations, while Google-managed public certificates do not use the customer's private PKI, and the TCP/UDP load balancer option is not appropriate for HTTP load balancers.
Question 118
You control network traffic for a folder in your Google Cloud environment. Your folder includes multiple projects and Virtual Private Cloud (VPC) networks. You want to enforce on the folder level that egress connections are limited only to IP range 10.58.5.0/24 and only from the VPC network “dev-vpc”. You want to minimize implementation and maintenance effort.
What should you do?
A. 1. Leave the network configuration of the VMs in scope unchanged. 2. Create a new project including a new VPC network “new-vpc”. 3. Deploy a network appliance in “new-vpc” to filter access requests and only allow egress connections from “dev-vpc” to 10.58.5.0/24.
B. 1. Leave the network configuration of the VMs in scope unchanged. 2. Enable Cloud NAT for “dev-vpc” and restrict the target range in Cloud NAT to 10.58.5.0/24.
C. 1. Attach external IP addresses to the VMs in scope. 2. Define and apply a hierarchical firewall policy on folder level to deny all egress connections and to allow egress to IP range 10.58.5.0/24 from network dev-vpc.
D. 1. Attach external IP addresses to the VMs in scope. 2. Configure a VPC Firewall rule in “dev-vpc” that allows egress connectivity to IP range 10.58.5.0/24 for all source addresses in this network.
Show Answer
Correct Answer: C
Explanation: The key requirement is enforcement at the folder level across multiple projects and VPC networks with minimal ongoing maintenance. Hierarchical firewall policies are designed for organization/folder-level centralized enforcement, including egress rules. Cloud NAT is not an access-control mechanism for restricting destinations by policy across a folder, and a regular VPC firewall rule applies only to a single VPC rather than all projects in the folder. Although the external IP step is unnecessary in practice for the policy concept, C is the only option that uses the correct folder-level enforcement mechanism.
Question 119
Your company is concerned about unauthorized parties gaining access to the Google Cloud environment by using a fake login page. You must implement a solution to protect against person-in-the-middle attacks.
Which security measure should you use?
A. Security key
B. Google prompt
C. Text message or phone call code
D. Google Authenticator application
Show Answer
Correct Answer: A
Explanation: A security key (such as a FIDO/U2F or FIDO2 hardware security key) provides phishing-resistant authentication by cryptographically verifying the legitimate origin of the login page. This protects against fake login pages and person-in-the-middle attacks. SMS, phone calls, TOTP codes from Google Authenticator, and Google Prompt are stronger than passwords alone but are generally not as resistant to sophisticated phishing as security keys.
Question 120
Your organization wants full control of the keys used to encrypt data at rest in their Google Cloud environments. Keys must be generated and stored outside of Google and integrate with many Google Services including BigQuery.
What should you do?
A. Use customer-supplied encryption keys (CSEK) with keys generated on trusted external systems. Provide the raw CSEK as part of the API call.
B. Create a KMS key that is stored on a Google managed FIPS 140-2 level 3 Hardware Security Module (HSM). Manage the Identity and Access Management (IAM) permissions settings, and set up the key rotation period.
C. Use Cloud External Key Management (EKM) that integrates with an external Hardware Security Module (HSM) system from supported vendors.
D. Create a Cloud Key Management Service (KMS) key with imported key material. Wrap the key for protection during import. Import the key generated on a trusted system in Cloud KMS.
Show Answer
Correct Answer: C
Explanation: Cloud External Key Management (EKM) is designed for organizations that require encryption keys to be generated and stored outside Google Cloud while still integrating with Google Cloud services, including BigQuery. It provides external key control through supported external HSM/KMS vendors. CSEK is not broadly supported (including BigQuery), Cloud KMS HSM stores keys within Google, and imported key material is still stored in Cloud KMS after import.
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.