Professional Cloud Security Engineer Free Practice Questions — Page 12
Question 103
Your company’s users access data in a BigQuery table. You want to ensure they can only access the data during working hours.
What should you do?
A. Assign a BigQuery Data Viewer role along with an IAM condition that limits the access to specified working hours.
B. Run a gsutil script that assigns a BigQuery Data Viewer role, and remove it only during the specified working hours.
C. Assign a BigQuery Data Viewer role to a service account that adds and removes the users daily during the specified working hours.
D. Configure Cloud Scheduler so that it triggers a Cloud Functions instance that modifies the organizational policy constraint for BigQuery during the specified working hours.
Show Answer
Correct Answer: A
Explanation: IAM Conditions in Google Cloud allow time-based access control. You can grant the BigQuery Data Viewer role and attach a condition that permits access only during defined working hours, enforcing the requirement without manual role changes or automation. The other options rely on operational scripts or policy changes that are unnecessary and error-prone compared to native IAM conditional access.
Question 104
An administrative application is running on a virtual machine (VM) in a managed group at port 5601 inside a Virtual Private Cloud (VPC) instance without access to the internet currently. You want to expose the web interface at port 5601 to users and enforce authentication and authorization Google credentials.
What should you do?
A. Configure the bastion host with OS Login enabled and allow connection to port 5601 at VPC firewall. Log in to the bastion host from the Google Cloud console by using SSH-in-browser and then to the web application.
B. Modify the VPC routing with the default route point to the default internet gateway. Modify the VPC Firewall rule to allow access from the internet 0.0.0.0/0 to port 5601 on the application instance.
C. Configure Secure Shell Access (SSH) bastion host in a public network, and allow only the bastion host to connect to the application on port 5601. Use a bastion host as a jump host to connect to the application.
D. Configure an HTTP Load Balancing instance that points to the managed group with Identity-Aware Proxy (IAP) protection with Google credentials. Modify the VPC firewall to allow access from IAP network range.
Show Answer
Correct Answer: D
Explanation: You need to expose a web interface securely and enforce authentication and authorization using Google credentials. Identity-Aware Proxy (IAP) is specifically designed for this purpose. By placing an HTTP(S) Load Balancer in front of the managed instance group and enabling IAP, users must authenticate with Google credentials before accessing the application. Allowing traffic only from IAP IP ranges in the VPC firewall ensures the backend is not directly exposed to the internet. Other options either do not provide web-based access, do not enforce Google authentication, or expose the service insecurely.
Question 105
Your Google Cloud environment has one organization node, one folder named “Apps”, and several projects within that folder. The organizational node enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the terramearth.com organization. The “Apps” folder enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the flowlogistic.com organization. It also has the inheritFromParent: false property.
You attempt to grant access to a project in the “Apps” folder to the user
.
What is the result of your action and why?
A. The action succeeds because members from both organizations, terramearth.com or flowlogistic.com, are allowed on projects in the “Apps” folder.
B. The action succeeds and the new member is successfully added to the project's Identity and Access Management (IAM) policy because all policies are inherited by underlying folders and projects.
C. The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy must be defined on the current project to deactivate the constraint temporarily.
D. The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy is in place and only members from the flowlogistic.com organization are allowed.
Show Answer
Correct Answer: D
Explanation: The folder-level constraints/iam.allowedPolicyMemberDomains policy on the “Apps” folder has inheritFromParent: false, so it does not inherit the organization-level policy. Only the folder’s policy applies to projects under it, allowing members only from flowlogistic.com. Therefore, attempting to grant access to a user from terramearth.com fails.
Question 106
You are developing a new application that uses exclusively Compute Engine VMs. Once a day, this application will execute five different batch jobs. Each of the batch jobs requires a dedicated set of permissions on Google Cloud resources outside of your application. You need to design a secure access concept for the batch jobs that adheres to the least-privilege principle.
What should you do?
A. 1. Create a general service account “g-sa” to orchestrate the batch jobs. 2. Create one service account per batch job ‘b-sa-[1-5]’. Grant only the permissions required to run the individual batch jobs to the service accounts and generate service account keys for each of these service accounts. 3. Store the service account keys in Secret Manager. Grant g-sa access to Secret Manager and run the batch jobs with the permissions of b-sa-[1-5].
B. 1. Create a general service account “g-sa” to execute the batch jobs. 2. Grant the permissions required to execute the batch jobs to g-sa. 3. Execute the batch jobs with the permissions granted to g-sa.
C. 1. Create a workload identity pool and configure workload identity pool providers for each batch job. 2. Assign the workload identity user role to each of the identities configured in the providers. 3. Create one service account per batch job “b-sa-[1-5]”, and grant only the permissions required to run the individual batch jobs to the service accounts. 4. Generate credential configuration files for each of the providers. Use these files to execute the batch jobs with the permissions of b-sa-[1-5].
D. 1. Create a general service account “g-sa” to orchestrate the batch jobs. 2. Create one service account per batch job “b-sa-[1-5]”, and grant only the permissions required to run the individual batch jobs to the service accounts. 3. Grant the Service Account Token Creator role to g-sa. Use g-sa to obtain short-lived access tokens for b-sa-[1-5] and to execute the batch jobs with the permissions of b-sa-[1-5].
Show Answer
Correct Answer: D
Explanation: Option D best adheres to the least-privilege principle on Compute Engine. Each batch job has its own dedicated service account with only the permissions it needs. The general orchestrator service account uses the Service Account Token Creator role to impersonate these job-specific service accounts and obtain short-lived tokens, avoiding long-lived keys. This is the recommended, secure pattern for service account impersonation on GCP. Option B violates least privilege, A relies on stored service account keys, and C (workload identity pools) is intended for external workloads, not Compute Engine VMs.
Question 107
Your customer has an on-premises Public Key Infrastructure (PKI) with a certificate authority (CA). You need to issue certificates for many HTTP load balancer frontends. The on-premises PKI should be minimally affected due to many manual processes, and the solution needs to scale.
What should you do?
A. Use Certificate Manager to issue Google managed public certificates and configure it at HTTP the load balancers in your infrastructure as code (IaC).
B. Use a subordinate CA in the Google Certificate Authority Service from the on-premises PKI system to issue certificates for the load balancers.
C. Use Certificate Manager to import certificates issued from on-premises PKI and for the frontends. Leverage the gcloud tool for importing.
D. Use the web applications with PKCS12 certificates issued from subordinate CA based on OpenSSL on-premises. Use the gcloud tool for importing. Use the External TCP/UDP Network load balancer instead of an external HTTP Load Balancer.
Show Answer
Correct Answer: B
Explanation: Using a subordinate CA in Google Certificate Authority Service that chains to the on‑premises PKI allows automated, scalable certificate issuance for many HTTP load balancer frontends. It minimizes manual processes and load on the on‑prem CA while maintaining trust and enabling native integration with Google Cloud load balancers. Other options either bypass the customer PKI, require ongoing manual imports, or do not fit HTTP load balancer requirements.
Question 108
You control network traffic for a folder in your Google Cloud environment. Your folder includes multiple projects and Virtual Private Cloud (VPC) networks. You want to enforce on the folder level that egress connections are limited only to IP range 10.58.5.0/24 and only from the VPC network “dev-vpc”. You want to minimize implementation and maintenance effort.
What should you do?
A. 1. Leave the network configuration of the VMs in scope unchanged. 2. Create a new project including a new VPC network “new-vpc”. 3. Deploy a network appliance in “new-vpc” to filter access requests and only allow egress connections from “dev-vpc” to 10.58.5.0/24.
B. 1. Leave the network configuration of the VMs in scope unchanged. 2. Enable Cloud NAT for “dev-vpc” and restrict the target range in Cloud NAT to 10.58.5.0/24.
C. 1. Attach external IP addresses to the VMs in scope. 2. Define and apply a hierarchical firewall policy on folder level to deny all egress connections and to allow egress to IP range 10.58.5.0/24 from network dev-vpc.
D. 1. Attach external IP addresses to the VMs in scope. 2. Configure a VPC Firewall rule in “dev-vpc” that allows egress connectivity to IP range 10.58.5.0/24 for all source addresses in this network.
Show Answer
Correct Answer: C
Explanation: You need to enforce an egress restriction centrally at the **folder level** across multiple projects and VPCs with minimal ongoing maintenance. Hierarchical firewall policies are specifically designed for this purpose: they apply at the organization or folder level and are inherited by all projects.
Option C uses a hierarchical firewall policy to deny all egress traffic by default and explicitly allow egress only to 10.58.5.0/24 and only when the source network is dev-vpc. This meets both requirements: folder-level enforcement and precise control over source network and destination range. Other options either work at the VPC/project level only (B, D), misuse Cloud NAT (B), or add unnecessary complexity (A).
Question 109
Your company is concerned about unauthorized parties gaining access to the Google Cloud environment by using a fake login page. You must implement a solution to protect against person-in-the-middle attacks.
Which security measure should you use?
A. Security key
B. Google prompt
C. Text message or phone call code
D. Google Authenticator application
Show Answer
Correct Answer: A
Explanation: Person-in-the-middle and phishing attacks rely on tricking users into entering credentials on fake login pages. Hardware security keys (FIDO/U2F or FIDO2) cryptographically verify the legitimate Google login origin and will not authenticate to a spoofed site. Other options (SMS, Google Authenticator, Google Prompt) provide MFA but can still be phished or relayed by an attacker. Therefore, a security key provides the strongest protection against person-in-the-middle attacks.
Question 110
Your organization wants full control of the keys used to encrypt data at rest in their Google Cloud environments. Keys must be generated and stored outside of Google and integrate with many Google Services including BigQuery.
What should you do?
A. Use customer-supplied encryption keys (CSEK) with keys generated on trusted external systems. Provide the raw CSEK as part of the API call.
B. Create a KMS key that is stored on a Google managed FIPS 140-2 level 3 Hardware Security Module (HSM). Manage the Identity and Access Management (IAM) permissions settings, and set up the key rotation period.
C. Use Cloud External Key Management (EKM) that integrates with an external Hardware Security Module (HSM) system from supported vendors.
D. Create a Cloud Key Management Service (KMS) key with imported key material. Wrap the key for protection during import. Import the key generated on a trusted system in Cloud KMS.
Show Answer
Correct Answer: C
Explanation: The requirement is full control of encryption keys, with keys generated and stored outside Google, while integrating with many Google services including BigQuery. Cloud External Key Management (EKM) is designed for this use case: keys remain in an external HSM managed by the customer or a supported third-party vendor, and Google Cloud services use those keys via secure external calls. Other options either store keys within Google-managed systems (Cloud KMS/HSM, imported keys) or require providing raw keys per request (CSEK), which is limited in service support and operationally risky.
Question 111
You are deploying regulated workloads on Google Cloud. The regulation has data residency and data access requirements. It also requires that support is provided from the same geographical location as where the data resides.
What should you do?
A. Enable Access Transparency Logging.
B. Deploy Assured Workloads.
C. Deploy resources only to regions permitted by data residency requirements.
D. Use Data Access logging and Access Transparency logging to confirm that no users are accessing data from another region.
Show Answer
Correct Answer: B
Explanation: Assured Workloads is specifically designed for regulated workloads on Google Cloud. It enforces data residency, restricts data and support personnel access to approved geographic locations, and applies compliance controls automatically. This directly satisfies requirements for data residency, controlled data access, and region-specific support, which the other options alone do not fully address.
Question 112
You are setting up a new Cloud Storage bucket in your environment that is encrypted with a customer managed encryption key (CMEK). The CMEK is stored in Cloud Key Management Service (KMS), in project “prj-a”, and the Cloud Storage bucket will use project “prj-b”. The key is backed by a Cloud Hardware Security Module (HSM) and resides in the region europe-west3. Your storage bucket will be located in the region europe-west1. When you create the bucket, you cannot access the key, and you need to troubleshoot why.
What has caused the access issue?
A. A firewall rule prevents the key from being accessible.
B. Cloud HSM does not support Cloud Storage.
C. The CMEK is in a different project than the Cloud Storage bucket.
D. The CMEK is in a different region than the Cloud Storage bucket.
Show Answer
Correct Answer: D
Explanation: For Cloud Storage CMEK, the Cloud KMS key ring (and key) must be in the same location as the bucket it encrypts. In this scenario, the CMEK is in region europe-west3 while the Cloud Storage bucket is in europe-west1. This regional mismatch prevents Cloud Storage from accessing the key during bucket creation, causing the access issue. Cross-project usage is supported with proper IAM, and Cloud HSM is supported, so the root cause is the region mismatch.
$19
Get all 350 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.