Professional Cloud Security Engineer Free Practice Questions — Page 13
Question 118
You control network traffic for a folder in your Google Cloud environment. Your folder includes multiple projects and Virtual Private Cloud (VPC) networks. You want to enforce on the folder level that egress connections are limited only to IP range 10.58.5.0/24 and only from the VPC network “dev-vpc”. You want to minimize implementation and maintenance effort.
What should you do?
A. 1. Leave the network configuration of the VMs in scope unchanged. 2. Create a new project including a new VPC network “new-vpc”. 3. Deploy a network appliance in “new-vpc” to filter access requests and only allow egress connections from “dev-vpc” to 10.58.5.0/24.
B. 1. Leave the network configuration of the VMs in scope unchanged. 2. Enable Cloud NAT for “dev-vpc” and restrict the target range in Cloud NAT to 10.58.5.0/24.
C. 1. Attach external IP addresses to the VMs in scope. 2. Define and apply a hierarchical firewall policy on folder level to deny all egress connections and to allow egress to IP range 10.58.5.0/24 from network dev-vpc.
D. 1. Attach external IP addresses to the VMs in scope. 2. Configure a VPC Firewall rule in “dev-vpc” that allows egress connectivity to IP range 10.58.5.0/24 for all source addresses in this network.
Show Answer
Correct Answer: C
Explanation: The key requirement is enforcement at the folder level across multiple projects and VPC networks with minimal ongoing maintenance. Hierarchical firewall policies are designed for organization/folder-level centralized enforcement, including egress rules. Cloud NAT is not an access-control mechanism for restricting destinations by policy across a folder, and a regular VPC firewall rule applies only to a single VPC rather than all projects in the folder. Although the external IP step is unnecessary in practice for the policy concept, C is the only option that uses the correct folder-level enforcement mechanism.
Question 119
Your company is concerned about unauthorized parties gaining access to the Google Cloud environment by using a fake login page. You must implement a solution to protect against person-in-the-middle attacks.
Which security measure should you use?
A. Security key
B. Google prompt
C. Text message or phone call code
D. Google Authenticator application
Show Answer
Correct Answer: A
Explanation: A security key (such as a FIDO/U2F or FIDO2 hardware security key) provides phishing-resistant authentication by cryptographically verifying the legitimate origin of the login page. This protects against fake login pages and person-in-the-middle attacks. SMS, phone calls, TOTP codes from Google Authenticator, and Google Prompt are stronger than passwords alone but are generally not as resistant to sophisticated phishing as security keys.
Question 120
Your organization wants full control of the keys used to encrypt data at rest in their Google Cloud environments. Keys must be generated and stored outside of Google and integrate with many Google Services including BigQuery.
What should you do?
A. Use customer-supplied encryption keys (CSEK) with keys generated on trusted external systems. Provide the raw CSEK as part of the API call.
B. Create a KMS key that is stored on a Google managed FIPS 140-2 level 3 Hardware Security Module (HSM). Manage the Identity and Access Management (IAM) permissions settings, and set up the key rotation period.
C. Use Cloud External Key Management (EKM) that integrates with an external Hardware Security Module (HSM) system from supported vendors.
D. Create a Cloud Key Management Service (KMS) key with imported key material. Wrap the key for protection during import. Import the key generated on a trusted system in Cloud KMS.
Show Answer
Correct Answer: C
Explanation: Cloud External Key Management (EKM) is designed for organizations that require encryption keys to be generated and stored outside Google Cloud while still integrating with Google Cloud services, including BigQuery. It provides external key control through supported external HSM/KMS vendors. CSEK is not broadly supported (including BigQuery), Cloud KMS HSM stores keys within Google, and imported key material is still stored in Cloud KMS after import.
Question 121
You are deploying regulated workloads on Google Cloud. The regulation has data residency and data access requirements. It also requires that support is provided from the same geographical location as where the data resides.
What should you do?
A. Enable Access Transparency Logging.
B. Deploy Assured Workloads.
C. Deploy resources only to regions permitted by data residency requirements.
D. Use Data Access logging and Access Transparency logging to confirm that no users are accessing data from another region.
Show Answer
Correct Answer: B
Explanation: Assured Workloads is specifically designed for regulated workloads and enforces controls for data residency, personnel access, and geographically restricted Google support based on supported compliance regimes. Simply choosing regions or enabling logging does not satisfy the requirement that support personnel be located in the same geography as the data.
Question 122
You are setting up a new Cloud Storage bucket in your environment that is encrypted with a customer managed encryption key (CMEK). The CMEK is stored in Cloud Key Management Service (KMS), in project “prj-a”, and the Cloud Storage bucket will use project “prj-b”. The key is backed by a Cloud Hardware Security Module (HSM) and resides in the region europe-west3. Your storage bucket will be located in the region europe-west1. When you create the bucket, you cannot access the key, and you need to troubleshoot why.
What has caused the access issue?
A. A firewall rule prevents the key from being accessible.
B. Cloud HSM does not support Cloud Storage.
C. The CMEK is in a different project than the Cloud Storage bucket.
D. The CMEK is in a different region than the Cloud Storage bucket.
Show Answer
Correct Answer: D
Explanation: For Cloud Storage CMEK, the Cloud KMS key must be in the same location as the bucket data it encrypts. A bucket in europe-west1 cannot use a CMEK key located in europe-west3. Using a KMS key from a different project is supported as long as the appropriate IAM permissions are granted, and Cloud HSM-backed keys are supported by Cloud Storage. Firewall rules are not the cause.
Question 123
Your organization uses BigQuery to process highly sensitive, structured datasets. Following the “need to know” principle, you need to create the Identity and Access Management (IAM) design to meet the needs of these users:
• Business user: must access curated reports.
• Data engineer: must administrate the data lifecycle in the platform.
• Security operator: must review user activity on the data platform.
What should you do?
A. Configure data access log for BigQuery services, and grant Project Viewer role to security operator.
B. Set row-based access control based on the “region” column, and filter the record from the United States for data engineers.
C. Create curated tables in a separate dataset and assign the role roles/bigquery.dataViewer.
D. Generate a CSV data file based on the business user's needs, and send the data to their email addresses.
Show Answer
Correct Answer: C
Explanation: The best available option is to isolate curated data into a separate BigQuery dataset and grant business users the minimal read-only role (roles/bigquery.dataViewer), which aligns with the principle of least privilege. Option A is insufficient because enabling BigQuery Data Access logs alone and granting Project Viewer does not allow a security operator to review Data Access audit logs; viewing those typically requires additional Logging permissions such as logging.privateLogViewer. Option B does not address the stated requirements, and Option D is insecure and not an IAM-based solution.
Question 124
You manage a fleet of virtual machines (VMs) in your organization. You have encountered issues with lack of patching in many VMs. You need to automate regular patching in your VMs and view the patch management data across multiple projects.
What should you do? (Choose two.)
A. View patch management data in VM Manager by using OS patch management.
B. View patch management data in Artifact Registry.
C. View patch management data in a Security Command Center dashboard.
D. Deploy patches with Security Command Genter by using Rapid Vulnerability Detection.
E. Deploy patches with VM Manager by using OS patch management.
Show Answer
Correct Answer: A, E
Explanation: VM Manager's OS patch management is the Google Cloud service used to automate OS patch deployment on Compute Engine VMs. It also provides patch compliance and summary views, including organization/folder/project scoped views in current documentation, making it the appropriate tool to view patch management data across multiple projects. Artifact Registry is unrelated, Security Command Center surfaces findings rather than performing patch management, and Rapid Vulnerability Detection does not deploy patches.
Question 125
Your organization uses the top-tier folder to separate application environments (prod and dev). The developers need to see all application development audit logs, but they are not permitted to review production logs. Your security team can review all logs in production and development environments. You must grant Identity and Access Management (IAM) roles at the right resource level for the developers and security team while you ensure least privilege.
What should you do?
A. 1. Grant logging.viewer role to the security team at the organization resource level. 2. Grant logging.viewer role to the developer team at the folder resource level that contains all the dev projects.
B. 1. Grant logging.viewer role to the security team at the organization resource level. 2. Grant logging.admin role to the developer team at the organization resource level.
C. 1. Grant logging.admin role to the security team at the organization resource level. 2. Grant logging.viewer role to the developer team at the folder resource level that contains all the dev projects.
D. 1. Grant logging.admin role to the security team at the organization resource level. 2. Grant logging.admin role to the developer team at the organization resource level.
Show Answer
Correct Answer: A
Explanation: Grant the security team the Logs Viewer (roles/logging.viewer) role at the organization level so they can view logs across all production and development resources. Grant the developer team the Logs Viewer role only on the development folder so they can view audit logs for development projects but have no access to production. This follows least privilege. The logging.admin role grants log configuration and management permissions that are unnecessary for simply reviewing logs.
Question 126
Your organization is rolling out a new continuous integration and delivery (CI/CD) process to deploy infrastructure and applications in Google Cloud. Many teams will use their own instances of the CI/CD workflow. It will run on Google Kubernetes Engine (GKE). The CI/CD pipelines must be designed to securely access Google Cloud APIs.
What should you do?
A. 1. Create two service accounts, one for the infrastructure and one for the application deployment. 2. Use workload identities to let the pods run the two pipelines and authenticate with the service accounts. 3. Run the infrastructure and application pipelines in separate namespaces.
B. 1. Create a dedicated service account for the CI/CD pipelines. 2. Run the deployment pipelines in a dedicated nodes pool in the GKE cluster. 3. Use the service account that you created as identity for the nodes in the pool to authenticate to the Google Cloud APIs.
C. 1. Create individual service accounts for each deployment pipeline. 2. Add an identifier for the pipeline in the service account naming convention. 3. Ensure each pipeline runs on dedicated pods. 4. Use workload identity to map a deployment pipeline pod with a service account.
D. 1. Create service accounts for each deployment pipeline. 2. Generate private keys for the service accounts. 3. Securely store the private keys as Kubernetes secrets accessible only by the pods that run the specific deploy pipeline.
Show Answer
Correct Answer: C
Explanation: Use Workload Identity instead of service account keys to let GKE pods securely access Google Cloud APIs. Assigning a distinct Google service account to each deployment pipeline provides the strongest least-privilege isolation across many independent CI/CD workflows. Options using node service accounts overgrant permissions, and using service account keys is not recommended.
Question 127
As part of your organization's zero trust strategy, you use Identity-Aware Proxy (IAP) to protect multiple applications. You need to ingest logs into a Security Information and Event Management (SIEM) system so that you are alerted to possible intrusions.
Which logs should you analyze?
A. Data Access audit logs
B. Policy Denied audit logs
C. Cloud Identity user log events
D. Admin Activity audit logs
Show Answer
Correct Answer: A
Explanation: Identity-Aware Proxy (IAP) access events are primarily recorded in Cloud Audit Logs as Data Access audit logs. These logs capture authorized and unauthorized access to IAP-protected resources and are the appropriate source to ingest into a SIEM for monitoring and intrusion detection. Admin Activity logs are for administrative changes, Policy Denied logs focus on IAM policy denials rather than IAP access activity, and Cloud Identity user log events are not the primary IAP access logs.
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.