Professional Cloud Security Engineer Free Practice Questions — Page 13
Question 113
Your organization uses BigQuery to process highly sensitive, structured datasets. Following the “need to know” principle, you need to create the Identity and Access Management (IAM) design to meet the needs of these users:
• Business user: must access curated reports.
• Data engineer: must administrate the data lifecycle in the platform.
• Security operator: must review user activity on the data platform.
What should you do?
A. Configure data access log for BigQuery services, and grant Project Viewer role to security operator.
B. Set row-based access control based on the “region” column, and filter the record from the United States for data engineers.
C. Create curated tables in a separate dataset and assign the role roles/bigquery.dataViewer.
D. Generate a CSV data file based on the business user's needs, and send the data to their email addresses.
Show Answer
Correct Answer: C
Explanation: The requirement is to apply least-privilege ('need to know') access in BigQuery. Business users should only see curated outputs, which is best achieved by publishing curated tables in a separate dataset and granting roles/bigquery.dataViewer on that dataset. Data engineers can be granted higher BigQuery roles to manage the data lifecycle, and security operators can separately be given logging/audit permissions. Option A only addresses audit visibility and does not control data access for business users. Options B and D do not align with BigQuery IAM best practices.
Question 114
You manage a fleet of virtual machines (VMs) in your organization. You have encountered issues with lack of patching in many VMs. You need to automate regular patching in your VMs and view the patch management data across multiple projects.
What should you do? (Choose two.)
A. View patch management data in VM Manager by using OS patch management.
B. View patch management data in Artifact Registry.
C. View patch management data in a Security Command Center dashboard.
D. Deploy patches with Security Command Genter by using Rapid Vulnerability Detection.
E. Deploy patches with VM Manager by using OS patch management.
Show Answer
Correct Answer: A, E
Explanation: To automate regular patching on Google Cloud VMs, you should use VM Manager OS patch management, which is designed specifically for this purpose.
Option E is correct because VM Manager OS patch management lets you schedule and automate patch deployments across your VMs.
Option A is correct because VM Manager OS patch management also provides patch compliance and deployment data, and you can view patch summaries across multiple projects when scoped appropriately (for example, at the organization or folder level).
The other options are incorrect because Artifact Registry does not handle VM patching, Security Command Center focuses on security findings rather than patch deployment, and Rapid Vulnerability Detection does not deploy OS patches.
Question 115
Your organization uses the top-tier folder to separate application environments (prod and dev). The developers need to see all application development audit logs, but they are not permitted to review production logs. Your security team can review all logs in production and development environments. You must grant Identity and Access Management (IAM) roles at the right resource level for the developers and security team while you ensure least privilege.
What should you do?
A. 1. Grant logging.viewer role to the security team at the organization resource level. 2. Grant logging.viewer role to the developer team at the folder resource level that contains all the dev projects.
B. 1. Grant logging.viewer role to the security team at the organization resource level. 2. Grant logging.admin role to the developer team at the organization resource level.
C. 1. Grant logging.admin role to the security team at the organization resource level. 2. Grant logging.viewer role to the developer team at the folder resource level that contains all the dev projects.
D. 1. Grant logging.admin role to the security team at the organization resource level. 2. Grant logging.admin role to the developer team at the organization resource level.
Show Answer
Correct Answer: A
Explanation: Developers must see only development audit logs, not production, so granting logging.viewer at the dev folder level limits visibility appropriately. The security team needs read-only access to all logs across prod and dev, which is achieved by granting logging.viewer at the organization level. Using logging.admin would grant unnecessary management permissions and violate least privilege. Therefore, option A is correct.
Question 116
Your organization is rolling out a new continuous integration and delivery (CI/CD) process to deploy infrastructure and applications in Google Cloud. Many teams will use their own instances of the CI/CD workflow. It will run on Google Kubernetes Engine (GKE). The CI/CD pipelines must be designed to securely access Google Cloud APIs.
What should you do?
A. 1. Create two service accounts, one for the infrastructure and one for the application deployment. 2. Use workload identities to let the pods run the two pipelines and authenticate with the service accounts. 3. Run the infrastructure and application pipelines in separate namespaces.
B. 1. Create a dedicated service account for the CI/CD pipelines. 2. Run the deployment pipelines in a dedicated nodes pool in the GKE cluster. 3. Use the service account that you created as identity for the nodes in the pool to authenticate to the Google Cloud APIs.
C. 1. Create individual service accounts for each deployment pipeline. 2. Add an identifier for the pipeline in the service account naming convention. 3. Ensure each pipeline runs on dedicated pods. 4. Use workload identity to map a deployment pipeline pod with a service account.
D. 1. Create service accounts for each deployment pipeline. 2. Generate private keys for the service accounts. 3. Securely store the private keys as Kubernetes secrets accessible only by the pods that run the specific deploy pipeline.
Show Answer
Correct Answer: C
Explanation: The CI/CD pipelines must securely access Google Cloud APIs from GKE, and Google’s recommended best practice is to use Workload Identity rather than node service accounts or service account keys. Option C provides the strongest security and least-privilege model by creating a dedicated service account per pipeline, allowing granular IAM permissions per team or application. Mapping each pipeline’s pod to its own service account via Workload Identity avoids long-lived keys and prevents permission sharing across pipelines. Options A and B are less granular, and D is discouraged because it relies on managing and storing service account keys.
Question 117
As part of your organization's zero trust strategy, you use Identity-Aware Proxy (IAP) to protect multiple applications. You need to ingest logs into a Security Information and Event Management (SIEM) system so that you are alerted to possible intrusions.
Which logs should you analyze?
A. Data Access audit logs
B. Policy Denied audit logs
C. Cloud Identity user log events
D. Admin Activity audit logs
Show Answer
Correct Answer: A
Explanation: For Identity-Aware Proxy, the logs that contain detailed information about who accessed (or attempted to access) protected resources are the Data Access audit logs. These logs record both authorized and unauthorized access events once IAP audit logging is enabled, making them the primary source for detecting suspicious behavior and potential intrusions in a SIEM. Policy Denied logs only capture denied decisions and provide less complete visibility, while Admin Activity and Cloud Identity logs do not focus on IAP-protected application access.
Question 118
You are a Cloud Identity administrator for your organization. In your Google Cloud environment, groups are used to manage user permissions. Each application team has a dedicated group. Your team is responsible for creating these groups and the application teams can manage the team members on their own through the Google Cloud console. You must ensure that the application teams can only add users from within your organization to their groups.
What should you do?
A. Change the configuration of the relevant groups in the Google Workspace Admin console to prevent external users from being added to the group.
B. Set an Identity and Access Management (IAM) policy that includes a condition that restricts group membership to user principals that belong to your organization.
C. Define an Identity and Access Management (IAM) deny policy that denies the assignment of principals that are outside your organization to the groups in scope.
D. Export the Cloud Identity logs to BigQuery. Configure an alert for external members added to groups. Have the alert trigger a Cloud Function instance that removes the external members from the group.
Show Answer
Correct Answer: A
Explanation: Group membership controls are managed in Google Workspace / Cloud Identity, not via IAM policies. You can configure each Google Group to disallow adding external members, ensuring application teams can only add users from your organization. IAM policies (including conditions or deny policies) govern access to Google Cloud resources, not who can be a member of a Google Group. Logging and remediation is reactive and does not prevent the issue.
Question 119
You are routing all your internet facing traffic from Google Cloud through your on-premises internet connection. You want to accomplish this goal securely and with the highest bandwidth possible.
What should you do?
A. Create an HA VPN connection to Google Cloud. Replace the default 0.0.0.0/0 route.
B. Create a routing VM in Compute Engine. Configure the default route with the VM as the next hop.
C. Configure Cloud Interconnect with HA VPN. Replace the default 0.0.0.0/0 route to an on-premises destination.
D. Configure Cloud Interconnect and route traffic through an on-premises firewall.
Show Answer
Correct Answer: D
Explanation: The requirement is to route all internet-facing traffic from Google Cloud through an on‑premises internet connection with the highest possible bandwidth and strong security. HA VPN (A) is limited to a few Gbps per tunnel, and a routing VM (B) is not suitable for high-bandwidth, highly available egress. Cloud Interconnect provides the highest bandwidth (up to tens or hundreds of Gbps) and is the recommended solution for high-throughput, low-latency connectivity. Routing traffic over Interconnect to an on‑premises firewall ensures centralized security inspection before egressing to the internet, which best satisfies both the security and bandwidth requirements.
Question 120
You are migrating an on-premises data warehouse to BigQuery, Cloud SQL, and Cloud Storage. You need to configure security services in the data warehouse. Your company compliance policies mandate that the data warehouse must:
• Protect data at rest with full lifecycle management on cryptographic keys.
• Implement a separate key management provider from data management.
• Provide visibility into all encryption key requests.
What services should be included in the data warehouse implementation? (Choose two.)
A. Customer-managed encryption keys
B. Customer-Supplied Encryption Keys
C. Key Access Justifications
D. Access Transparency and Approval
E. Cloud External Key Manager
Show Answer
Correct Answer: C, E
Explanation: The requirements are: (1) full lifecycle control of cryptographic keys, (2) separation of key management from data management, and (3) visibility into all encryption key requests.
Cloud External Key Manager (E) satisfies the separation requirement by keeping keys in an external KMS that you control and manage through their full lifecycle, independent of Google Cloud data services.
Key Access Justifications (C) provides visibility into encryption key access by requiring Google to present a justification for each key request, giving auditability and control over key usage.
Together, C and E meet all stated compliance requirements.
Question 121
You manage one of your organization's Google Cloud projects (Project A). A VPC Service Control (SC) perimeter is blocking API access requests to this project, including Pub/Sub. A resource running under a service account in another project (Project B) needs to collect messages from a Pub/Sub topic in your project. Project B is not included in a VPC SC perimeter. You need to provide access from Project B to the Pub/Sub topic in Project A using the principle of least privilege.
What should you do?
A. Configure an ingress policy for the perimeter in Project A, and allow access for the service account in Project B to collect messages.
B. Create an access level that allows a developer in Project B to subscribe to the Pub/Sub topic that is located in Project A.
C. Create a perimeter bridge between Project A and Project B to allow the required communication between both projects.
D. Remove the Pub/Sub API from the list of restricted services in the perimeter configuration for Project A.
Show Answer
Correct Answer: A
Explanation: Project A is inside a VPC Service Controls perimeter and Project B is not in any perimeter. To allow a specific service account in Project B to access a Pub/Sub topic in Project A with least privilege, you must configure an ingress policy on Project A’s service perimeter. An ingress rule can explicitly allow the external service account and only the required Pub/Sub method (subscriber access). Perimeter bridges only work between two service perimeters, access levels alone do not grant cross‑perimeter resource access, and removing Pub/Sub from restricted services would overly broaden access.
Question 122
You define central security controls in your Google Cloud environment. For one of the folders in your organization, you set an organizational policy to deny the assignment of external IP addresses to VMs. Two days later, you receive an alert about a new VM with an external IP address under that folder.
What could have caused this alert?
A. The VM was created with a static external IP address that was reserved in the project before the organizational policy rule was set.
B. The organizational policy constraint wasn't properly enforced and is running in "dry run" mode.
C. A project level, the organizational policy control has been overwritten with an "allow" value.
D. The policy constraint on the folder level does not have any effect because of an "allow" value for that constraint on the organizational level.
Show Answer
Correct Answer: B
Explanation: The most plausible cause is that the organizational policy was set in dry-run (preview) mode. In dry-run, the constraint is evaluated and violations generate alerts, but enforcement is not blocked, allowing a VM to be created with an external IP. A project-level allow cannot override a folder-level deny when enforced (deny takes precedence), and reserving a static IP before the policy does not bypass enforcement at VM creation time.
$19
Get all 350 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.