Professional Cloud Security Engineer Free Practice Questions — Page 14
Question 128
You are a Cloud Identity administrator for your organization. In your Google Cloud environment, groups are used to manage user permissions. Each application team has a dedicated group. Your team is responsible for creating these groups and the application teams can manage the team members on their own through the Google Cloud console. You must ensure that the application teams can only add users from within your organization to their groups.
What should you do?
A. Change the configuration of the relevant groups in the Google Workspace Admin console to prevent external users from being added to the group.
B. Set an Identity and Access Management (IAM) policy that includes a condition that restricts group membership to user principals that belong to your organization.
C. Define an Identity and Access Management (IAM) deny policy that denies the assignment of principals that are outside your organization to the groups in scope.
D. Export the Cloud Identity logs to BigQuery. Configure an alert for external members added to groups. Have the alert trigger a Cloud Function instance that removes the external members from the group.
Show Answer
Correct Answer: A
Explanation: Google Groups membership restrictions are configured in Google Workspace/Cloud Identity, not through IAM policies. You can configure the relevant groups to disallow external members while still delegating group membership management to application teams. IAM policies and IAM deny policies govern access to Google Cloud resources, not Google Group membership. A reactive log-and-function solution does not prevent the addition of external members.
Question 129
You are routing all your internet facing traffic from Google Cloud through your on-premises internet connection. You want to accomplish this goal securely and with the highest bandwidth possible.
What should you do?
A. Create an HA VPN connection to Google Cloud. Replace the default 0.0.0.0/0 route.
B. Create a routing VM in Compute Engine. Configure the default route with the VM as the next hop.
C. Configure Cloud Interconnect with HA VPN. Replace the default 0.0.0.0/0 route to an on-premises destination.
D. Configure Cloud Interconnect and route traffic through an on-premises firewall.
Show Answer
Correct Answer: D
Explanation: Cloud Interconnect provides the highest bandwidth for hybrid connectivity. To route all internet-bound Google Cloud traffic through the on-premises internet connection securely, use Cloud Interconnect and send egress traffic through the on-premises firewall for centralized inspection and policy enforcement. HA VPN alone is bandwidth-limited, a routing VM is not the recommended architecture, and combining Interconnect with HA VPN is intended for encrypted hybrid connectivity rather than being the primary solution for highest-bandwidth internet egress.
Question 130
You are migrating an on-premises data warehouse to BigQuery, Cloud SQL, and Cloud Storage. You need to configure security services in the data warehouse. Your company compliance policies mandate that the data warehouse must:
• Protect data at rest with full lifecycle management on cryptographic keys.
• Implement a separate key management provider from data management.
• Provide visibility into all encryption key requests.
What services should be included in the data warehouse implementation? (Choose two.)
A. Customer-managed encryption keys
B. Customer-Supplied Encryption Keys
C. Key Access Justifications
D. Access Transparency and Approval
E. Cloud External Key Manager
Show Answer
Correct Answer: C, E
Explanation: Cloud External Key Manager (EKM) satisfies the requirement for a separate key management provider and external lifecycle management of encryption keys. Key Access Justifications provides visibility into decryption key requests by giving the reason for each access request involving protected keys. Together they best match the stated compliance requirements.
Sources:
https://cloud.google.com/architecture/secured-data-warehouse-blueprint-onprem
https://cloud.google.com/security/products/security-key-management
Question 131
You manage one of your organization's Google Cloud projects (Project A). A VPC Service Control (SC) perimeter is blocking API access requests to this project, including Pub/Sub. A resource running under a service account in another project (Project B) needs to collect messages from a Pub/Sub topic in your project. Project B is not included in a VPC SC perimeter. You need to provide access from Project B to the Pub/Sub topic in Project A using the principle of least privilege.
What should you do?
A. Configure an ingress policy for the perimeter in Project A, and allow access for the service account in Project B to collect messages.
B. Create an access level that allows a developer in Project B to subscribe to the Pub/Sub topic that is located in Project A.
C. Create a perimeter bridge between Project A and Project B to allow the required communication between both projects.
D. Remove the Pub/Sub API from the list of restricted services in the perimeter configuration for Project A.
Show Answer
Correct Answer: A
Explanation: Project A is inside a VPC Service Controls perimeter, while Project B is outside any perimeter. To allow a specific service account outside the perimeter to access a protected Pub/Sub resource inside the perimeter, configure an ingress policy on the service perimeter that explicitly allows that principal and the required service access. This is the least-privilege approach. A perimeter bridge only connects two existing perimeters, so it does not apply when Project B is not in a perimeter. Access levels alone do not grant the required resource access, and removing Pub/Sub from restricted services weakens the perimeter broadly.
Question 132
You define central security controls in your Google Cloud environment. For one of the folders in your organization, you set an organizational policy to deny the assignment of external IP addresses to VMs. Two days later, you receive an alert about a new VM with an external IP address under that folder.
What could have caused this alert?
A. The VM was created with a static external IP address that was reserved in the project before the organizational policy rule was set.
B. The organizational policy constraint wasn't properly enforced and is running in "dry run" mode.
C. A project level, the organizational policy control has been overwritten with an "allow" value.
D. The policy constraint on the folder level does not have any effect because of an "allow" value for that constraint on the organizational level.
Show Answer
Correct Answer: B
Explanation: A folder-level deny policy would normally prevent new external IP assignments. A project-level allow does not override an inherited deny in the merged policy, and an organization-level allow likewise does not negate a descendant deny. A pre-reserved static IP still must be assigned to the new VM after the policy is in effect, so the constraint applies at assignment time. If the policy was configured in dry-run (preview) mode, violations are logged/alerted but not enforced, allowing creation of the VM with an external IP.
Sources:
https://docs.cloud.google.com/security-command-center/docs/compliance-manager-cloud-controls
Question 133
You are migrating an application into the cloud. The application will need to read data from a Cloud Storage bucket. Due to local regulatory requirements, you need to hold the key material used for encryption fully under your control and you require a valid rationale for accessing the key material.
What should you do?
A. Encrypt the data in the Cloud Storage bucket by using Customer Managed Encryption Keys. Configure an IAM deny policy for unauthorized groups.
B. Generate a key in your on-premises environment to encrypt the data before you upload the data to the Cloud Storage bucket. Upload the key to the Cloud Key Management Service (KMS). Activate Key Access Justifications (KAJ) and have the external key system reject unauthorized accesses.
C. Encrypt the data in the Cloud Storage bucket by using Customer Managed Encryption Keys backed by a Cloud Hardware Security Module (HSM). Enable data access logs.
D. Generate a key in your on-premises environment and store it in a Hardware Security Module (HSM) that is managed on-premises. Use this key as an external key in the Cloud Key Management Service (KMS). Activate Key Access Justifications (KAJ) and set the external key system to reject unauthorized accesses.
Show Answer
Correct Answer: D
Explanation: The requirement is to keep the encryption key material fully under your control and require a justification for every key access. This is achieved with Cloud External Key Manager (EKM), where the key remains in an on-premises HSM that you manage, combined with Key Access Justifications (KAJ). Options A and C use Google-managed infrastructure for key storage (even with CMEK/HSM). Option B is incorrect because you do not upload the key into Cloud KMS if you need to retain full control of the key material; external keys remain outside Google Cloud.
Question 134
Your company recently published a security policy to minimize the usage of service account keys. On-premises Windows-based applications are interacting with Google Cloud APIs. You need to implement Workload Identity Federation (WIF) with your identity provider on-premises.
What should you do?
A. Set up a workload identity pool with your corporate Active Directory Federation Service (ADFS). Configure a rule to let principals in the pool impersonate the Google Cloud service account.
B. Set up a workload identity pool with your corporate Active Directory Federation Service (ADFS). Let all principals in the pool impersonate the Google Cloud service account.
C. Set up a workload identity pool with an OpenID Connect (OIDC) service on the same machine. Configure a rule to let principals in the pool impersonate the Google Cloud service account.
D. Set up a workload identity pool with an OpenID Connect (OIDC) service on the same machine. Let all principals in the pool impersonate the Google Cloud service account.
Show Answer
Correct Answer: A
Explanation: For Windows-based on-premises workloads, integrating Workload Identity Federation with Active Directory Federation Services (ADFS) is the appropriate identity provider. Granting service account impersonation through a specific IAM binding or attribute-based rule follows the principle of least privilege. Allowing all principals in the pool to impersonate the service account is overly permissive, and deploying a separate OIDC service on the same machine is unnecessary when ADFS can act as the federation provider.
Question 135
After completing a security vulnerability assessment, you learned that cloud administrators leave Google Cloud CLI sessions open for days. You need to reduce the risk of attackers who might exploit these open sessions by setting these sessions to the minimum duration.
What should you do?
A. Set the session duration for the Google session control to one hour.
B. Set the reauthentication frequency for the Google Cloud Session Control to one hour.
C. Set the organization policy constraint constraints/iam.allowServiceAccountCredentialLifetimeExtension to one hour.
D. Set the organization policy constraint constraints/iam.serviceAccountKeyExpiryHours to one hour and inheritFromParent to false.
Show Answer
Correct Answer: B
Explanation: Google Cloud CLI user sessions are governed by Google Cloud session controls. To minimize the duration of authenticated user sessions, configure the Google Cloud Session Control reauthentication frequency to one hour, which is the minimum supported duration. The service account organization policy constraints in options C and D apply to service account credentials or keys, not interactive user CLI sessions. Option A refers to a generic session duration setting rather than the specific Google Cloud Session Control configuration used for Cloud services.
Question 136
You have stored company approved compute images in a single Google Cloud project that is used as an image repository. This project is protected with VPC Service Controls and exists in the perimeter along with other projects in your organization. This lets other projects deploy images from the image repository project. A team requires deploying a third-party disk image that is stored in an external Google Cloud organization. You need to grant read access to the disk image so that it can be deployed into the perimeter.
What should you do?
A. Allow the external project by using the organizational policy, constraints/compute.trustedImageProjects.
B. 1. Update the perimeter. 2. Configure the egressTo field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis.com. 3. Configure the egressFrom field to set identityType to ANY_IDENTITY.
C. 1. Update the perimeter. 2. Configure the ingressFrom field to set identityType to ANY_IDENTITY. 3. Configure the ingressTo field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis.com.
D. 1. Update the perimeter. 2. Configure the egressTo field to set identityType to ANY_IDENTITY. 3. Configure the egressFrom field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis.com.
Show Answer
Correct Answer: B
Explanation: When a resource inside a VPC Service Controls perimeter accesses a Compute Engine image stored outside the perimeter, this is an egress scenario from the perspective of the protected project. You must configure an egress rule that allows access to the external project for compute.googleapis.com, with egressFrom permitting the required identities (ANY_IDENTITY in this scenario). The trustedImageProjects organization policy does not grant cross-perimeter access to a private image in another organization.
Question 137
Your organization wants to protect all workloads that run on Compute Engine VM to ensure that the instances weren't compromised by boot-level or kernel-level malware. Also, you need to ensure that data in use on the VM cannot be read by the underlying host system by using a hardware-based solution.
What should you do?
A. 1. Use Google Shielded VM including secure boot, Virtual Trusted Platform Module (vTPM), and integrity monitoring. 2. Create a Cloud Run function to check for the VM settings, generate metrics, and run the function regularly.
B. 1. Activate Virtual Machine Threat Detection in Security Command Center (SCC) Premium. 2. Monitor the findings in SCC.
C. 1. Use Google Shielded VM including secure boot, Virtual Trusted Platform Module (vTPM), and integrity monitoring. 2. Activate Confidential Computing. 3. Enforce these actions by using organization policies.
D. 1. Use secure hardened images from the Google Cloud Marketplace. 2. When deploying the images, activate the Confidential Computing option. 3. Enforce the use of the correct images and Confidential Computing by using organization policies.
Show Answer
Correct Answer: C
Explanation: Shielded VM (Secure Boot, vTPM, and integrity monitoring) helps protect against boot-level and kernel-level malware. Confidential Computing protects data in use using hardware-based memory encryption so the underlying host cannot read VM memory. Organization policies can enforce these settings across the organization.
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.