Professional Cloud Security Engineer Free Practice Questions — Page 14
Question 131
You manage one of your organization's Google Cloud projects (Project A). A VPC Service Control (SC) perimeter is blocking API access requests to this project, including Pub/Sub. A resource running under a service account in another project (Project B) needs to collect messages from a Pub/Sub topic in your project. Project B is not included in a VPC SC perimeter. You need to provide access from Project B to the Pub/Sub topic in Project A using the principle of least privilege.
What should you do?
A. Configure an ingress policy for the perimeter in Project A, and allow access for the service account in Project B to collect messages.
B. Create an access level that allows a developer in Project B to subscribe to the Pub/Sub topic that is located in Project A.
C. Create a perimeter bridge between Project A and Project B to allow the required communication between both projects.
D. Remove the Pub/Sub API from the list of restricted services in the perimeter configuration for Project A.
Show Answer
Correct Answer: A
Explanation: Project A is inside a VPC Service Controls perimeter, while Project B is outside any perimeter. To allow a specific service account outside the perimeter to access a protected Pub/Sub resource inside the perimeter, configure an ingress policy on the service perimeter that explicitly allows that principal and the required service access. This is the least-privilege approach. A perimeter bridge only connects two existing perimeters, so it does not apply when Project B is not in a perimeter. Access levels alone do not grant the required resource access, and removing Pub/Sub from restricted services weakens the perimeter broadly.
Question 132
You define central security controls in your Google Cloud environment. For one of the folders in your organization, you set an organizational policy to deny the assignment of external IP addresses to VMs. Two days later, you receive an alert about a new VM with an external IP address under that folder.
What could have caused this alert?
A. The VM was created with a static external IP address that was reserved in the project before the organizational policy rule was set.
B. The organizational policy constraint wasn't properly enforced and is running in "dry run" mode.
C. A project level, the organizational policy control has been overwritten with an "allow" value.
D. The policy constraint on the folder level does not have any effect because of an "allow" value for that constraint on the organizational level.
Show Answer
Correct Answer: B
Explanation: A folder-level deny policy would normally prevent new external IP assignments. A project-level allow does not override an inherited deny in the merged policy, and an organization-level allow likewise does not negate a descendant deny. A pre-reserved static IP still must be assigned to the new VM after the policy is in effect, so the constraint applies at assignment time. If the policy was configured in dry-run (preview) mode, violations are logged/alerted but not enforced, allowing creation of the VM with an external IP.
Sources:
https://docs.cloud.google.com/security-command-center/docs/compliance-manager-cloud-controls
Question 133
You are migrating an application into the cloud. The application will need to read data from a Cloud Storage bucket. Due to local regulatory requirements, you need to hold the key material used for encryption fully under your control and you require a valid rationale for accessing the key material.
What should you do?
A. Encrypt the data in the Cloud Storage bucket by using Customer Managed Encryption Keys. Configure an IAM deny policy for unauthorized groups.
B. Generate a key in your on-premises environment to encrypt the data before you upload the data to the Cloud Storage bucket. Upload the key to the Cloud Key Management Service (KMS). Activate Key Access Justifications (KAJ) and have the external key system reject unauthorized accesses.
C. Encrypt the data in the Cloud Storage bucket by using Customer Managed Encryption Keys backed by a Cloud Hardware Security Module (HSM). Enable data access logs.
D. Generate a key in your on-premises environment and store it in a Hardware Security Module (HSM) that is managed on-premises. Use this key as an external key in the Cloud Key Management Service (KMS). Activate Key Access Justifications (KAJ) and set the external key system to reject unauthorized accesses.
Show Answer
Correct Answer: D
Explanation: The requirement is to keep the encryption key material fully under your control and require a justification for every key access. This is achieved with Cloud External Key Manager (EKM), where the key remains in an on-premises HSM that you manage, combined with Key Access Justifications (KAJ). Options A and C use Google-managed infrastructure for key storage (even with CMEK/HSM). Option B is incorrect because you do not upload the key into Cloud KMS if you need to retain full control of the key material; external keys remain outside Google Cloud.
Question 134
Your company recently published a security policy to minimize the usage of service account keys. On-premises Windows-based applications are interacting with Google Cloud APIs. You need to implement Workload Identity Federation (WIF) with your identity provider on-premises.
What should you do?
A. Set up a workload identity pool with your corporate Active Directory Federation Service (ADFS). Configure a rule to let principals in the pool impersonate the Google Cloud service account.
B. Set up a workload identity pool with your corporate Active Directory Federation Service (ADFS). Let all principals in the pool impersonate the Google Cloud service account.
C. Set up a workload identity pool with an OpenID Connect (OIDC) service on the same machine. Configure a rule to let principals in the pool impersonate the Google Cloud service account.
D. Set up a workload identity pool with an OpenID Connect (OIDC) service on the same machine. Let all principals in the pool impersonate the Google Cloud service account.
Show Answer
Correct Answer: A
Explanation: For Windows-based on-premises workloads, integrating Workload Identity Federation with Active Directory Federation Services (ADFS) is the appropriate identity provider. Granting service account impersonation through a specific IAM binding or attribute-based rule follows the principle of least privilege. Allowing all principals in the pool to impersonate the service account is overly permissive, and deploying a separate OIDC service on the same machine is unnecessary when ADFS can act as the federation provider.
Question 135
After completing a security vulnerability assessment, you learned that cloud administrators leave Google Cloud CLI sessions open for days. You need to reduce the risk of attackers who might exploit these open sessions by setting these sessions to the minimum duration.
What should you do?
A. Set the session duration for the Google session control to one hour.
B. Set the reauthentication frequency for the Google Cloud Session Control to one hour.
C. Set the organization policy constraint constraints/iam.allowServiceAccountCredentialLifetimeExtension to one hour.
D. Set the organization policy constraint constraints/iam.serviceAccountKeyExpiryHours to one hour and inheritFromParent to false.
Show Answer
Correct Answer: B
Explanation: Google Cloud CLI user sessions are governed by Google Cloud session controls. To minimize the duration of authenticated user sessions, configure the Google Cloud Session Control reauthentication frequency to one hour, which is the minimum supported duration. The service account organization policy constraints in options C and D apply to service account credentials or keys, not interactive user CLI sessions. Option A refers to a generic session duration setting rather than the specific Google Cloud Session Control configuration used for Cloud services.
Question 136
You have stored company approved compute images in a single Google Cloud project that is used as an image repository. This project is protected with VPC Service Controls and exists in the perimeter along with other projects in your organization. This lets other projects deploy images from the image repository project. A team requires deploying a third-party disk image that is stored in an external Google Cloud organization. You need to grant read access to the disk image so that it can be deployed into the perimeter.
What should you do?
A. Allow the external project by using the organizational policy, constraints/compute.trustedImageProjects.
B. 1. Update the perimeter. 2. Configure the egressTo field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis.com. 3. Configure the egressFrom field to set identityType to ANY_IDENTITY.
C. 1. Update the perimeter. 2. Configure the ingressFrom field to set identityType to ANY_IDENTITY. 3. Configure the ingressTo field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis.com.
D. 1. Update the perimeter. 2. Configure the egressTo field to set identityType to ANY_IDENTITY. 3. Configure the egressFrom field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis.com.
Show Answer
Correct Answer: B
Explanation: When a resource inside a VPC Service Controls perimeter accesses a Compute Engine image stored outside the perimeter, this is an egress scenario from the perspective of the protected project. You must configure an egress rule that allows access to the external project for compute.googleapis.com, with egressFrom permitting the required identities (ANY_IDENTITY in this scenario). The trustedImageProjects organization policy does not grant cross-perimeter access to a private image in another organization.
Question 137
Your organization wants to protect all workloads that run on Compute Engine VM to ensure that the instances weren't compromised by boot-level or kernel-level malware. Also, you need to ensure that data in use on the VM cannot be read by the underlying host system by using a hardware-based solution.
What should you do?
A. 1. Use Google Shielded VM including secure boot, Virtual Trusted Platform Module (vTPM), and integrity monitoring. 2. Create a Cloud Run function to check for the VM settings, generate metrics, and run the function regularly.
B. 1. Activate Virtual Machine Threat Detection in Security Command Center (SCC) Premium. 2. Monitor the findings in SCC.
C. 1. Use Google Shielded VM including secure boot, Virtual Trusted Platform Module (vTPM), and integrity monitoring. 2. Activate Confidential Computing. 3. Enforce these actions by using organization policies.
D. 1. Use secure hardened images from the Google Cloud Marketplace. 2. When deploying the images, activate the Confidential Computing option. 3. Enforce the use of the correct images and Confidential Computing by using organization policies.
Show Answer
Correct Answer: C
Explanation: Shielded VM (Secure Boot, vTPM, and integrity monitoring) helps protect against boot-level and kernel-level malware. Confidential Computing protects data in use using hardware-based memory encryption so the underlying host cannot read VM memory. Organization policies can enforce these settings across the organization.
Question 138
Your organization uses Google Workspace Enterprise Edition for authentication. You are concerned about employees leaving their laptops unattended for extended periods of time after authenticating into Google Cloud. You must prevent malicious people from using an employee's unattended laptop to modify their environment.
What should you do?
A. Create a policy that requires employees to not leave their sessions open for long durations.
B. Review and disable unnecessary Google Cloud APIs.
C. Require strong passwords and 2SV through a security token or Google authenticator.
D. Set the session length timeout for Google Cloud services to a shorter duration.
Show Answer
Correct Answer: D
Explanation: To reduce the risk of someone using an authenticated but unattended workstation, configure a shorter Google Cloud session length timeout. This forces reauthentication after a defined period of inactivity or session duration, limiting the window in which an unattended authenticated session can be abused. Strong passwords and 2SV help at login but do not protect an already authenticated unattended session. Policies alone are unenforceable, and disabling APIs does not address the core risk.
Question 139
Your organization wants to be continuously evaluated against CIS Google Cloud Computing Foundations Benchmark v1.3.0 (CIS Google Cloud Foundation 1.3). Some of the controls are irrelevant to your organization and must be disregarded in evaluation. You need to create an automated system or process to ensure that only the relevant controls are evaluated.
What should you do?
A. Mark all security findings that are irrelevant with a tag and a value that indicates a security exception. Select all marked findings, and mute them on the console every time they appear. Activate Security Command Center (SCC) Premium.
B. Activate Security Command Center (SCC) Premium. Create a rule to mute the security findings in SCC so they are not evaluated.
C. Download all findings from Security Command Center (SCC) to a CSV file. Mark the findings that are part of CIS Google Cloud Foundation 1.3 in the file. Ignore the entries that are irrelevant and out of scope for the company.
D. Ask an external audit company to provide independent reports including needed CIS benchmarks. In the scope of the audit, clarify that some of the controls are not needed and must be disregarded.
Show Answer
Correct Answer: B
Explanation: Security Command Center Premium supports mute rules that automatically suppress findings matching defined criteria. This provides a continuous, automated way to exclude irrelevant CIS Google Cloud Foundations Benchmark findings from evaluation. Option A requires recurring manual muting, C is a manual offline process rather than continuous evaluation, and D does not create an automated control evaluation process.
Question 140
Your organization processes sensitive health information. You want to ensure that data is encrypted while in use by the virtual machines (VMs). You must create a policy that is enforced across the entire organization.
What should you do?
A. Implement an organization policy that ensures that all VM resources created across your organization use customer-managed encryption keys (CMEK) protection.
B. Implement an organization policy that ensures all VM resources created across your organization are Confidential VM instances.
C. Implement an organization policy that ensures that all VM resources created across your organization use Cloud External Key Manager (EKM) protection.
D. No action is necessary because Google encrypts data while it is in use by default.
Show Answer
Correct Answer: B
Explanation: Confidential VM provides memory encryption, protecting data while it is in use via confidential computing technologies (such as AMD SEV). An organization policy can enforce Confidential VM usage across the organization. CMEK and Cloud EKM manage encryption keys for data at rest, not data in use. Google encrypts data at rest and in transit by default, but not all workloads are encrypted in use unless Confidential Computing is used.
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.