Professional Cloud Security Engineer Free Practice Questions — Page 15
Question 133
Your company uses Google Cloud and has publicly exposed network assets. You want to discover the assets and perform a security audit on these assets by using a software tool in the least amount of time.
What should you do?
A. Run a platform security scanner on all instances in the organization.
B. Identify all external assets by using Cloud Asset Inventory, and then run a network security scanner against them.
C. Contact a Google approved security vendor to perform the audit.
D. Notify Google about the pending audit, and wait for confirmation before performing the scan.
Show Answer
Correct Answer: B
Explanation: The goal is to quickly discover publicly exposed Google Cloud assets and audit them with a software tool. Cloud Asset Inventory provides a fast, centralized way to identify all external-facing assets across the organization. Once those assets are identified, running a targeted network security scanner against them is the most time-efficient approach. Scanning all instances would be slower and incomplete, using a third-party vendor adds delay, and notifying Google is unnecessary for performing your own audit.
Question 134
Your organization recently activated the Security Command Center (SCC) standard tier. There are a few Cloud Storage buckets that were accidentally made accessible to the public. You need to investigate the impact of the incident and remediate it.
What should you do?
A. 1. Remove the Identity and Access Management (IAM) granting access to all Users from the buckets. 2. Apply the organization policy storage.uniformBucketLevelAccess to prevent regressions. 3. Query the data access logs to report on unauthorized access.
B. 1. Change permissions to limit access for authorized users. 2. Enforce a VPC Service Controls perimeter around all the production projects to immediately stop any unauthorized access. 3. Review the administrator activity audit logs to report on any unauthorized access.
C. 1. Change the bucket permissions to limit access. 2. Query the bucket's usage logs to report on unauthorized access to the data. 3. Enforce the organization policy storage.publicAccessPrevention to avoid regressions.
D. 1. Change bucket permissions to limit access. 2. Query the data access audit logs for any unauthorized access to the buckets. 3. After the misconfiguration is corrected, mute the finding in the Security Command Center.
Show Answer
Correct Answer: C
Explanation: First remediate by removing public access from the affected Cloud Storage buckets. To investigate impact, review the bucket’s usage/access logs, which are designed to show object access when buckets are public. Finally, enforce the organization policy storage.publicAccessPrevention to prevent future accidental public exposure. Other options either rely on less relevant logs, omit the strongest prevention control, or add unnecessary measures.
Question 135
You have numerous private virtual machines on Google Cloud. You occasionally need to manage the servers through Secure Socket Shell (SSH) from a remote location. You want to configure remote access to the servers in a manner that optimizes security and cost efficiency.
What should you do?
A. Create a site-to-site VPN from your corporate network to Google Cloud.
B. Configure server instances with public IP addresses. Create a firewall rule to only allow traffic from your corporate IPs.
C. Create a firewall rule to allow access from the Identity-Aware Proxy (IAP) IP range. Grant the role of an IAP-secured Tunnel User to the administrators.
D. Create a jump host instance with public IP. Manage the instances by connecting through the jump host.
Show Answer
Correct Answer: C
Explanation: Using Identity-Aware Proxy (IAP) for TCP forwarding allows secure SSH access to private VMs without public IP addresses. Access is controlled by Google-managed identity and IAM roles (IAP‑secured Tunnel User), reducing attack surface and operational cost. It avoids VPN setup and maintenance costs and is more secure and cost‑efficient than exposing public IPs or running a bastion host.
Question 136
Your organization's record data exists in Cloud Storage. You must retain all record data for at least seven years. This policy must be permanent.
What should you do?
A. 1. Identify buckets with record data. 2. Apply a retention policy, and set it to retain for seven years. 3. Monitor the bucket by using log-based alerts to ensure that no modifications to the retention policy occurs.
B. 1. Identify buckets with record data. 2. Apply a retention policy, and set it to retain for seven years. 3. Remove any Identity and Access Management (IAM) roles that contain the storage buckets update permission.
C. 1. Identify buckets with record data. 2. Enable the bucket policy only to ensure that data is retained. 3. Enable bucket lock.
D. 1. Identify buckets with record data. 2. Apply a retention policy and set it to retain for seven years. 3. Enable bucket lock.
Show Answer
Correct Answer: D
Explanation: Google Cloud Storage retention policies enforce minimum retention periods, but they can be modified or removed unless they are locked. Because the requirement states the policy must be permanent, you must enable Bucket Lock after setting a seven-year retention policy. Bucket Lock makes the retention policy immutable, ensuring data cannot be deleted or the policy shortened before the retention period expires.
Question 137
Your organization must comply with the regulation to keep instance logging data within Europe. Your workloads will be hosted in the Netherlands in region europe-west4 in a new project. You must configure Cloud Logging to keep your data in the country.
What should you do?
A. Configure the organization policy constraint gcp.resourceLocations to europe-west4.
B. Configure log sink to export all logs into a Cloud Storage bucket in europe-west4.
C. Create a new log bucket in europe-west4, and redirect the _Default bucket to the new bucket.
D. Set the logging storage region to europe-west4 by using the gcloud CLI logging settings update.
Show Answer
Correct Answer: D
Explanation: For a new project, the correct and intended way to enforce log data residency is to set the Cloud Logging storage location at creation time. Using `gcloud logging settings update --storage-location=europe-west4` configures the default region for the automatically created _Default and _Required log buckets so that all logs are stored in Europe from the start. Option C is a workaround mainly for existing projects where buckets already exist; it requires manual bucket creation and sink redirection, which is unnecessary for a new project.
Question 138
You are running applications outside Google Cloud that need access to Google Cloud resources. You are using workload identity federation to grant external identities Identity and Access Management (IAM) roles to eliminate the maintenance and security burden associated with service account keys. You must protect against attempts to spoof another user's identity and gain unauthorized access to Google Cloud resources.
What should you do? (Choose two.)
A. Enable data access logs for IAM APIs.
B. Limit the number of external identities that can impersonate a service account.
C. Use a dedicated project to manage workload identity pools and providers.
D. Use immutable attributes in attribute mappings.
E. Limit the resources that a service account can access.
Show Answer
Correct Answer: C, D
Explanation: To protect against identity spoofing when using workload identity federation, Google recommends hardening how identities are defined and managed. Using a dedicated project for workload identity pools and providers centralizes control and reduces the risk of unauthorized or inconsistent configurations. Using immutable attributes in attribute mappings ensures external identities cannot modify key identity claims to impersonate other users. These measures directly address spoofing threats, whereas logging or least-privilege controls do not specifically prevent identity spoofing.
Question 139
Your company is moving to Google Cloud. You plan to sync your users first by using Google Cloud Directory Sync (GCDS). Some employees have already created Google Cloud accounts by using their company email addresses that were created outside of GCDS. You must create your users on Cloud Identity.
What should you do?
A. Configure GCDS and use GCDS search rules to sync these users.
B. Use the transfer tool to migrate unmanaged users.
C. Write a custom script to identify existing Google Cloud users and call the Admin SDK: Directory API to transfer their account.
D. Configure GCDS and use GCDS exclusion rules to ensure users are not suspended.
Show Answer
Correct Answer: B
Explanation: Some employees already created unmanaged Google accounts using the company email domain. Before syncing users with Google Cloud Directory Sync, these accounts must be converted to managed Cloud Identity accounts. Google provides a built-in transfer tool specifically designed to migrate unmanaged users into a managed domain. GCDS rules or custom scripts are not appropriate for taking ownership of existing unmanaged accounts.
Question 140
Your organization is transitioning to Google Cloud. You want to ensure that only trusted container images are deployed on Google Kubernetes Engine (GKE) clusters in a project. The containers must be deployed from a centrally managed Container Registry and signed by a trusted authority.
What should you do? (Choose two.)
A. Enable Container Threat Detection in the Security Command Center (SCC) for the project.
B. Configure the trusted image organization policy constraint for the project.
C. Create a custom organization policy constraint to enforce Binary Authorization for Google Kubernetes Engine (GKE).
D. Enable PodSecurity standards, and set them to Restricted.
E. Configure the Binary Authorization policy with respective attestations for the project.
Show Answer
Correct Answer: C, E
Explanation: To ensure only trusted, signed container images are deployed on GKE, you must use Binary Authorization. Creating a custom organization policy constraint allows you to enforce Binary Authorization across GKE clusters at the org or project level, preventing clusters from bypassing it. Additionally, configuring the Binary Authorization policy with attestations ensures that only images signed by a trusted authority and coming from the approved registry are allowed to run. Other options either do not apply to containers (trusted image org policy), are detection-only (SCC), or address pod runtime security rather than image trust (PodSecurity).
Question 141
Your DevOps team uses Packer to build Compute Engine images by using this process:
1. Create an ephemeral Compute Engine VM.
2. Copy a binary from a Cloud Storage bucket to the VM's file system.
3. Update the VM's package manager.
4. Install external packages from the internet onto the VM.
Your security team just enabled the organizational policy, constraints/ compute.vmExternalIpAccess, to restrict the usage of public IP Addresses on VMs. In response, your DevOps team updated their scripts to remove public IP addresses on the Compute Engine VMs; however, the build pipeline is failing due to connectivity issues.
What should you do? (Choose two.)
A. Provision an HTTP load balancer with the VM in an unmanaged instance group to allow inbound connections from the internet to your VM.
B. Provision a Cloud NAT instance in the same VPC and region as the Compute Engine VM.
C. Enable Private Google Access on the subnet that the Compute Engine VM is deployed within.
D. Update the VPC routes to allow traffic to and from the internet.
E. Provision a Cloud VPN tunnel in the same VPC and region as the Compute Engine VM.
Show Answer
Correct Answer: B, C
Explanation: The build fails because VMs without public IPs lose outbound internet and Google API access.
B. Cloud NAT provides outbound internet access for VMs without public IP addresses, allowing package updates and external downloads during the Packer build.
C. Enabling Private Google Access allows the VM to reach Google APIs and services such as Cloud Storage over private IPs, enabling access to the binary stored in Cloud Storage without a public IP.
Other options either enable inbound internet access, do not restore outbound connectivity, or are unnecessary for this use case.
Question 142
You manage a BigQuery analytical data warehouse in your organization. You want to keep data for all your customers in a common table while you also restrict query access based on rows and columns permissions. Non-query operations should not be supported.
What should you do? (Choose two.)
A. Create row-level access policies to restrict the result data when you run queries with the filter expression set to TRUE.
B. Configure column-level encryption by using Authenticated Encryption with Associated Data (AEAD) functions with Cloud Key Management Service (KMS) to control access to columns at query runtime.
C. Create row-level access policies to restrict the result data when you run queries with the filter expression set to FALSE.
D. Configure dynamic data masking rules to control access to columns at query runtime.
E. Create column-level policy tags to control access to columns at query runtime.
Show Answer
Correct Answer: C, E
Explanation: To restrict access by rows and columns in a shared BigQuery table while allowing only query operations, you should use native BigQuery security features. Row-level access policies with a filter expression set to FALSE ensure that non-query operations (such as exports or copies) are not supported, satisfying the requirement. Column-level policy tags provide column-level security by controlling which users can query specific columns at runtime. Together, these meet the requirement for row- and column-based query access control without enabling non-query operations.
$19
Get all 350 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.