Professional Cloud Security Engineer Free Practice Questions — Page 13
Question 121
You are deploying regulated workloads on Google Cloud. The regulation has data residency and data access requirements. It also requires that support is provided from the same geographical location as where the data resides.
What should you do?
A. Enable Access Transparency Logging.
B. Deploy Assured Workloads.
C. Deploy resources only to regions permitted by data residency requirements.
D. Use Data Access logging and Access Transparency logging to confirm that no users are accessing data from another region.
Show Answer
Correct Answer: B
Explanation: Assured Workloads is specifically designed for regulated workloads and enforces controls for data residency, personnel access, and geographically restricted Google support based on supported compliance regimes. Simply choosing regions or enabling logging does not satisfy the requirement that support personnel be located in the same geography as the data.
Question 122
You are setting up a new Cloud Storage bucket in your environment that is encrypted with a customer managed encryption key (CMEK). The CMEK is stored in Cloud Key Management Service (KMS), in project “prj-a”, and the Cloud Storage bucket will use project “prj-b”. The key is backed by a Cloud Hardware Security Module (HSM) and resides in the region europe-west3. Your storage bucket will be located in the region europe-west1. When you create the bucket, you cannot access the key, and you need to troubleshoot why.
What has caused the access issue?
A. A firewall rule prevents the key from being accessible.
B. Cloud HSM does not support Cloud Storage.
C. The CMEK is in a different project than the Cloud Storage bucket.
D. The CMEK is in a different region than the Cloud Storage bucket.
Show Answer
Correct Answer: D
Explanation: For Cloud Storage CMEK, the Cloud KMS key must be in the same location as the bucket data it encrypts. A bucket in europe-west1 cannot use a CMEK key located in europe-west3. Using a KMS key from a different project is supported as long as the appropriate IAM permissions are granted, and Cloud HSM-backed keys are supported by Cloud Storage. Firewall rules are not the cause.
Question 123
Your organization uses BigQuery to process highly sensitive, structured datasets. Following the “need to know” principle, you need to create the Identity and Access Management (IAM) design to meet the needs of these users:
• Business user: must access curated reports.
• Data engineer: must administrate the data lifecycle in the platform.
• Security operator: must review user activity on the data platform.
What should you do?
A. Configure data access log for BigQuery services, and grant Project Viewer role to security operator.
B. Set row-based access control based on the “region” column, and filter the record from the United States for data engineers.
C. Create curated tables in a separate dataset and assign the role roles/bigquery.dataViewer.
D. Generate a CSV data file based on the business user's needs, and send the data to their email addresses.
Show Answer
Correct Answer: C
Explanation: The best available option is to isolate curated data into a separate BigQuery dataset and grant business users the minimal read-only role (roles/bigquery.dataViewer), which aligns with the principle of least privilege. Option A is insufficient because enabling BigQuery Data Access logs alone and granting Project Viewer does not allow a security operator to review Data Access audit logs; viewing those typically requires additional Logging permissions such as logging.privateLogViewer. Option B does not address the stated requirements, and Option D is insecure and not an IAM-based solution.
Question 124
You manage a fleet of virtual machines (VMs) in your organization. You have encountered issues with lack of patching in many VMs. You need to automate regular patching in your VMs and view the patch management data across multiple projects.
What should you do? (Choose two.)
A. View patch management data in VM Manager by using OS patch management.
B. View patch management data in Artifact Registry.
C. View patch management data in a Security Command Center dashboard.
D. Deploy patches with Security Command Genter by using Rapid Vulnerability Detection.
E. Deploy patches with VM Manager by using OS patch management.
Show Answer
Correct Answer: A, E
Explanation: VM Manager's OS patch management is the Google Cloud service used to automate OS patch deployment on Compute Engine VMs. It also provides patch compliance and summary views, including organization/folder/project scoped views in current documentation, making it the appropriate tool to view patch management data across multiple projects. Artifact Registry is unrelated, Security Command Center surfaces findings rather than performing patch management, and Rapid Vulnerability Detection does not deploy patches.
Question 125
Your organization uses the top-tier folder to separate application environments (prod and dev). The developers need to see all application development audit logs, but they are not permitted to review production logs. Your security team can review all logs in production and development environments. You must grant Identity and Access Management (IAM) roles at the right resource level for the developers and security team while you ensure least privilege.
What should you do?
A. 1. Grant logging.viewer role to the security team at the organization resource level. 2. Grant logging.viewer role to the developer team at the folder resource level that contains all the dev projects.
B. 1. Grant logging.viewer role to the security team at the organization resource level. 2. Grant logging.admin role to the developer team at the organization resource level.
C. 1. Grant logging.admin role to the security team at the organization resource level. 2. Grant logging.viewer role to the developer team at the folder resource level that contains all the dev projects.
D. 1. Grant logging.admin role to the security team at the organization resource level. 2. Grant logging.admin role to the developer team at the organization resource level.
Show Answer
Correct Answer: A
Explanation: Grant the security team the Logs Viewer (roles/logging.viewer) role at the organization level so they can view logs across all production and development resources. Grant the developer team the Logs Viewer role only on the development folder so they can view audit logs for development projects but have no access to production. This follows least privilege. The logging.admin role grants log configuration and management permissions that are unnecessary for simply reviewing logs.
Question 126
Your organization is rolling out a new continuous integration and delivery (CI/CD) process to deploy infrastructure and applications in Google Cloud. Many teams will use their own instances of the CI/CD workflow. It will run on Google Kubernetes Engine (GKE). The CI/CD pipelines must be designed to securely access Google Cloud APIs.
What should you do?
A. 1. Create two service accounts, one for the infrastructure and one for the application deployment. 2. Use workload identities to let the pods run the two pipelines and authenticate with the service accounts. 3. Run the infrastructure and application pipelines in separate namespaces.
B. 1. Create a dedicated service account for the CI/CD pipelines. 2. Run the deployment pipelines in a dedicated nodes pool in the GKE cluster. 3. Use the service account that you created as identity for the nodes in the pool to authenticate to the Google Cloud APIs.
C. 1. Create individual service accounts for each deployment pipeline. 2. Add an identifier for the pipeline in the service account naming convention. 3. Ensure each pipeline runs on dedicated pods. 4. Use workload identity to map a deployment pipeline pod with a service account.
D. 1. Create service accounts for each deployment pipeline. 2. Generate private keys for the service accounts. 3. Securely store the private keys as Kubernetes secrets accessible only by the pods that run the specific deploy pipeline.
Show Answer
Correct Answer: C
Explanation: Use Workload Identity instead of service account keys to let GKE pods securely access Google Cloud APIs. Assigning a distinct Google service account to each deployment pipeline provides the strongest least-privilege isolation across many independent CI/CD workflows. Options using node service accounts overgrant permissions, and using service account keys is not recommended.
Question 127
As part of your organization's zero trust strategy, you use Identity-Aware Proxy (IAP) to protect multiple applications. You need to ingest logs into a Security Information and Event Management (SIEM) system so that you are alerted to possible intrusions.
Which logs should you analyze?
A. Data Access audit logs
B. Policy Denied audit logs
C. Cloud Identity user log events
D. Admin Activity audit logs
Show Answer
Correct Answer: A
Explanation: Identity-Aware Proxy (IAP) access events are primarily recorded in Cloud Audit Logs as Data Access audit logs. These logs capture authorized and unauthorized access to IAP-protected resources and are the appropriate source to ingest into a SIEM for monitoring and intrusion detection. Admin Activity logs are for administrative changes, Policy Denied logs focus on IAM policy denials rather than IAP access activity, and Cloud Identity user log events are not the primary IAP access logs.
Question 128
You are a Cloud Identity administrator for your organization. In your Google Cloud environment, groups are used to manage user permissions. Each application team has a dedicated group. Your team is responsible for creating these groups and the application teams can manage the team members on their own through the Google Cloud console. You must ensure that the application teams can only add users from within your organization to their groups.
What should you do?
A. Change the configuration of the relevant groups in the Google Workspace Admin console to prevent external users from being added to the group.
B. Set an Identity and Access Management (IAM) policy that includes a condition that restricts group membership to user principals that belong to your organization.
C. Define an Identity and Access Management (IAM) deny policy that denies the assignment of principals that are outside your organization to the groups in scope.
D. Export the Cloud Identity logs to BigQuery. Configure an alert for external members added to groups. Have the alert trigger a Cloud Function instance that removes the external members from the group.
Show Answer
Correct Answer: A
Explanation: Google Groups membership restrictions are configured in Google Workspace/Cloud Identity, not through IAM policies. You can configure the relevant groups to disallow external members while still delegating group membership management to application teams. IAM policies and IAM deny policies govern access to Google Cloud resources, not Google Group membership. A reactive log-and-function solution does not prevent the addition of external members.
Question 129
You are routing all your internet facing traffic from Google Cloud through your on-premises internet connection. You want to accomplish this goal securely and with the highest bandwidth possible.
What should you do?
A. Create an HA VPN connection to Google Cloud. Replace the default 0.0.0.0/0 route.
B. Create a routing VM in Compute Engine. Configure the default route with the VM as the next hop.
C. Configure Cloud Interconnect with HA VPN. Replace the default 0.0.0.0/0 route to an on-premises destination.
D. Configure Cloud Interconnect and route traffic through an on-premises firewall.
Show Answer
Correct Answer: D
Explanation: Cloud Interconnect provides the highest bandwidth for hybrid connectivity. To route all internet-bound Google Cloud traffic through the on-premises internet connection securely, use Cloud Interconnect and send egress traffic through the on-premises firewall for centralized inspection and policy enforcement. HA VPN alone is bandwidth-limited, a routing VM is not the recommended architecture, and combining Interconnect with HA VPN is intended for encrypted hybrid connectivity rather than being the primary solution for highest-bandwidth internet egress.
Question 130
You are migrating an on-premises data warehouse to BigQuery, Cloud SQL, and Cloud Storage. You need to configure security services in the data warehouse. Your company compliance policies mandate that the data warehouse must:
• Protect data at rest with full lifecycle management on cryptographic keys.
• Implement a separate key management provider from data management.
• Provide visibility into all encryption key requests.
What services should be included in the data warehouse implementation? (Choose two.)
A. Customer-managed encryption keys
B. Customer-Supplied Encryption Keys
C. Key Access Justifications
D. Access Transparency and Approval
E. Cloud External Key Manager
Show Answer
Correct Answer: C, E
Explanation: Cloud External Key Manager (EKM) satisfies the requirement for a separate key management provider and external lifecycle management of encryption keys. Key Access Justifications provides visibility into decryption key requests by giving the reason for each access request involving protected keys. Together they best match the stated compliance requirements.
Sources:
https://cloud.google.com/architecture/secured-data-warehouse-blueprint-onprem
https://cloud.google.com/security/products/security-key-management
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.