Professional Cloud Security Engineer Free Practice Questions — Page 14
Question 123
You are migrating an application into the cloud. The application will need to read data from a Cloud Storage bucket. Due to local regulatory requirements, you need to hold the key material used for encryption fully under your control and you require a valid rationale for accessing the key material.
What should you do?
A. Encrypt the data in the Cloud Storage bucket by using Customer Managed Encryption Keys. Configure an IAM deny policy for unauthorized groups.
B. Generate a key in your on-premises environment to encrypt the data before you upload the data to the Cloud Storage bucket. Upload the key to the Cloud Key Management Service (KMS). Activate Key Access Justifications (KAJ) and have the external key system reject unauthorized accesses.
C. Encrypt the data in the Cloud Storage bucket by using Customer Managed Encryption Keys backed by a Cloud Hardware Security Module (HSM). Enable data access logs.
D. Generate a key in your on-premises environment and store it in a Hardware Security Module (HSM) that is managed on-premises. Use this key as an external key in the Cloud Key Management Service (KMS). Activate Key Access Justifications (KAJ) and set the external key system to reject unauthorized accesses.
Show Answer
Correct Answer: D
Explanation: The requirement is to keep encryption key material fully under your control and to require a justification for every key access. This is achieved by using Cloud External Key Manager with an externally managed key stored in an on‑premises HSM. Option D ensures Google never has access to the key material, while Key Access Justifications (KAJ) provides and enforces a valid rationale for each access attempt, which the external key system can approve or reject. Other options either keep keys in Google-managed systems or do not satisfy KAJ requirements.
Question 124
Your company recently published a security policy to minimize the usage of service account keys. On-premises Windows-based applications are interacting with Google Cloud APIs. You need to implement Workload Identity Federation (WIF) with your identity provider on-premises.
What should you do?
A. Set up a workload identity pool with your corporate Active Directory Federation Service (ADFS). Configure a rule to let principals in the pool impersonate the Google Cloud service account.
B. Set up a workload identity pool with your corporate Active Directory Federation Service (ADFS). Let all principals in the pool impersonate the Google Cloud service account.
C. Set up a workload identity pool with an OpenID Connect (OIDC) service on the same machine. Configure a rule to let principals in the pool impersonate the Google Cloud service account.
D. Set up a workload identity pool with an OpenID Connect (OIDC) service on the same machine. Let all principals in the pool impersonate the Google Cloud service account.
Show Answer
Correct Answer: A
Explanation: On-premises Windows applications typically authenticate via an enterprise IdP such as ADFS, which can federate with Google Cloud using Workload Identity Federation. Creating a workload identity pool backed by ADFS avoids service account keys. Configuring an attribute/impersonation rule so that only specific principals can impersonate the Google Cloud service account follows the principle of least privilege. Allowing all principals (options B and D) is overly permissive, and running a local OIDC provider on the same machine (options C and D) is unnecessary and less aligned with enterprise identity practices.
Question 125
After completing a security vulnerability assessment, you learned that cloud administrators leave Google Cloud CLI sessions open for days. You need to reduce the risk of attackers who might exploit these open sessions by setting these sessions to the minimum duration.
What should you do?
A. Set the session duration for the Google session control to one hour.
B. Set the reauthentication frequency for the Google Cloud Session Control to one hour.
C. Set the organization policy constraint constraints/iam.allowServiceAccountCredentialLifetimeExtension to one hour.
D. Set the organization policy constraint constraints/iam.serviceAccountKeyExpiryHours to one hour and inheritFromParent to false.
Show Answer
Correct Answer: B
Explanation: The risk described is long-lived interactive Google Cloud CLI user sessions. These are controlled by Google Cloud Session Control for user authentication, not by service account key policies. Setting the reauthentication frequency to one hour forces users to reauthenticate regularly, effectively limiting how long a CLI session can remain active without fresh credentials. Options C and D apply to service account credentials, not human users, and option A is imprecise because the actual control to enforce session duration for Cloud tools is the reauthentication frequency setting.
Question 126
You have stored company approved compute images in a single Google Cloud project that is used as an image repository. This project is protected with VPC Service Controls and exists in the perimeter along with other projects in your organization. This lets other projects deploy images from the image repository project. A team requires deploying a third-party disk image that is stored in an external Google Cloud organization. You need to grant read access to the disk image so that it can be deployed into the perimeter.
What should you do?
A. Allow the external project by using the organizational policy, constraints/compute.trustedImageProjects.
B. 1. Update the perimeter. 2. Configure the egressTo field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis.com. 3. Configure the egressFrom field to set identityType to ANY_IDENTITY.
C. 1. Update the perimeter. 2. Configure the ingressFrom field to set identityType to ANY_IDENTITY. 3. Configure the ingressTo field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis.com.
D. 1. Update the perimeter. 2. Configure the egressTo field to set identityType to ANY_IDENTITY. 3. Configure the egressFrom field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis.com.
Show Answer
Correct Answer: B
Explanation: The Compute Engine create operation is initiated from within the service perimeter, but the image resource resides in an external project outside the perimeter. In VPC Service Controls, this is an egress scenario (access from inside the perimeter to a resource outside). To allow this, you must update the perimeter with an egress rule that permits access to the external project for compute.googleapis.com, and allow any identity in the perimeter to perform the operation. Ingress rules would be configured on the external project’s perimeter, which is not applicable here.
Question 127
Your organization wants to protect all workloads that run on Compute Engine VM to ensure that the instances weren't compromised by boot-level or kernel-level malware. Also, you need to ensure that data in use on the VM cannot be read by the underlying host system by using a hardware-based solution.
What should you do?
A. 1. Use Google Shielded VM including secure boot, Virtual Trusted Platform Module (vTPM), and integrity monitoring. 2. Create a Cloud Run function to check for the VM settings, generate metrics, and run the function regularly.
B. 1. Activate Virtual Machine Threat Detection in Security Command Center (SCC) Premium. 2. Monitor the findings in SCC.
C. 1. Use Google Shielded VM including secure boot, Virtual Trusted Platform Module (vTPM), and integrity monitoring. 2. Activate Confidential Computing. 3. Enforce these actions by using organization policies.
D. 1. Use secure hardened images from the Google Cloud Marketplace. 2. When deploying the images, activate the Confidential Computing option. 3. Enforce the use of the correct images and Confidential Computing by using organization policies.
Show Answer
Correct Answer: C
Explanation: The requirements are (1) protection against boot-level and kernel-level malware and (2) hardware-based protection so data in use cannot be read by the underlying host. Shielded VM (secure boot, vTPM, integrity monitoring) addresses boot and kernel integrity, while Confidential Computing protects data in use using hardware-based memory encryption. Enforcing both via organization policies ensures all Compute Engine VMs comply. Other options either detect issues after the fact or do not fully meet both requirements.
Question 128
Your organization uses Google Workspace Enterprise Edition for authentication. You are concerned about employees leaving their laptops unattended for extended periods of time after authenticating into Google Cloud. You must prevent malicious people from using an employee's unattended laptop to modify their environment.
What should you do?
A. Create a policy that requires employees to not leave their sessions open for long durations.
B. Review and disable unnecessary Google Cloud APIs.
C. Require strong passwords and 2SV through a security token or Google authenticator.
D. Set the session length timeout for Google Cloud services to a shorter duration.
Show Answer
Correct Answer: D
Explanation: The risk described is misuse of an already authenticated, unattended session. Shortening the session length timeout for Google Cloud services ensures that inactive sessions automatically expire, preventing unauthorized changes if a laptop is left unattended. Other options either rely on user behavior, address different security concerns, or do not mitigate active session misuse.
Question 129
Your organization wants to be continuously evaluated against CIS Google Cloud Computing Foundations Benchmark v1.3.0 (CIS Google Cloud Foundation 1.3). Some of the controls are irrelevant to your organization and must be disregarded in evaluation. You need to create an automated system or process to ensure that only the relevant controls are evaluated.
What should you do?
A. Mark all security findings that are irrelevant with a tag and a value that indicates a security exception. Select all marked findings, and mute them on the console every time they appear. Activate Security Command Center (SCC) Premium.
B. Activate Security Command Center (SCC) Premium. Create a rule to mute the security findings in SCC so they are not evaluated.
C. Download all findings from Security Command Center (SCC) to a CSV file. Mark the findings that are part of CIS Google Cloud Foundation 1.3 in the file. Ignore the entries that are irrelevant and out of scope for the company.
D. Ask an external audit company to provide independent reports including needed CIS benchmarks. In the scope of the audit, clarify that some of the controls are not needed and must be disregarded.
Show Answer
Correct Answer: B
Explanation: Security Command Center (SCC) Premium supports continuous evaluation against CIS benchmarks and provides automation through mute rules. By creating rules to automatically mute or exclude findings for controls that are irrelevant to the organization, only relevant CIS Google Cloud Foundation 1.3 controls are evaluated on an ongoing basis. Other options involve manual effort, offline processing, or external audits, which do not meet the requirement for an automated, continuous process.
Question 130
Your organization processes sensitive health information. You want to ensure that data is encrypted while in use by the virtual machines (VMs). You must create a policy that is enforced across the entire organization.
What should you do?
A. Implement an organization policy that ensures that all VM resources created across your organization use customer-managed encryption keys (CMEK) protection.
B. Implement an organization policy that ensures all VM resources created across your organization are Confidential VM instances.
C. Implement an organization policy that ensures that all VM resources created across your organization use Cloud External Key Manager (EKM) protection.
D. No action is necessary because Google encrypts data while it is in use by default.
Show Answer
Correct Answer: B
Explanation: The requirement is to encrypt data while it is in use by VMs. Only Confidential VM instances provide encryption of data in memory during processing (confidential computing). CMEK and EKM protect data at rest, not in-use data, and Google does not encrypt data in use by default. An organization policy can enforce Confidential VMs across the organization.
Question 131
Your organization is using GitHub Actions as a continuous integration and delivery (CI/CD) platform. You must enable access to Google Cloud resources from the CI/CD pipelines in the most secure way.
What should you do?
A. Create a service account key, and add it to the GitHub pipeline configuration file.
B. Create a service account key, and add it to the GitHub repository content.
C. Configure a Google Kubernetes Engine cluster that uses Workload Identity to supply credentials to GitHub.
D. Configure workload identity federation to use GitHub as an identity pool provider.
Show Answer
Correct Answer: D
Explanation: The most secure approach is to avoid long‑lived service account keys. Workload Identity Federation allows GitHub Actions to authenticate to Google Cloud using short‑lived credentials by trusting GitHub as an external identity provider. This eliminates key management risks and is the recommended best practice for CI/CD access to Google Cloud.
Question 132
Your organization wants to be compliant with the General Data Protection Regulation (GDPR) on Google Cloud. You must implement data residency and operational sovereignty in the EU.
What should you do? (Choose two.)
A. Limit the physical location of a new resource with the Organization Policy Service "resource locations constraint."
B. Use Cloud IDS to get east-west and north-south traffic visibility in the EU to monitor intra-VPC and inter-VPC communication.
C. Limit Google personnel access based on predefined attributes such as their citizenship or geographic location by using Key Access Justifications.
D. Use identity federation to limit access to Google Cloud resources from non-EU entities.
E. Use VPC Flow Logs to monitor intra-VPC and inter-VPC traffic in the EU.
Show Answer
Correct Answer: A, C
Explanation: GDPR data residency requires that data is stored and processed in the EU, which is achieved by enforcing the Organization Policy Service resource locations constraint to restrict resources to EU regions (A). Operational sovereignty focuses on controlling provider access to data; using Key Access Justifications (typically with CMEK and Assured Workloads) allows you to control and audit when Google personnel can access encryption keys protecting EU data, supporting EU operational sovereignty requirements (C).
$19
Get all 350 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.