Professional Cloud Security Engineer Free Practice Questions — Page 16
Question 143
You are using Security Command Center (SCC) to protect your workloads and receive alerts for suspected security breaches at your company. You need to detect cryptocurrency mining software.
Which SCC service should you use?
A. Virtual Machine Threat Detection
B. Container Threat Detection
C. Rapid Vulnerability Detection
D. Web Security Scanner
Show Answer
Correct Answer: A
Explanation: Virtual Machine Threat Detection in Security Command Center is designed to detect malicious software running on Compute Engine VMs, including cryptocurrency mining software. The other options focus on containers, vulnerability scanning, or web apps, not runtime cryptomining detection on VMs.
Question 144
Your Google Cloud organization allows for administrative capabilities to be distributed to each team through provision of a Google Cloud project with Owner role (roles/owner). The organization contains thousands of Google Cloud projects. Security Command Center Premium has surfaced multiple OPEN_MYSQL_PORT findings. You are enforcing the guardrails and need to prevent these types of common misconfigurations.
What should you do?
A. Create a hierarchical firewall policy configured at the organization to deny all connections from 0.0.0.0/0.
B. Create a hierarchical firewall policy configured at the organization to allow connections only from internal IP ranges.
C. Create a Google Cloud Armor security policy to deny traffic from 0.0.0.0/0.
D. Create a firewall rule for each virtual private cloud (VPC) to deny traffic from 0.0.0.0/0 with priority 0.
Show Answer
Correct Answer: B
Explanation: The requirement is to enforce preventive guardrails across thousands of projects to stop common misconfigurations like publicly exposed MySQL ports. An organization-level hierarchical firewall policy is the correct control plane for this scale. Configuring it to allow connections only from internal IP ranges prevents exposure to 0.0.0.0/0 while still permitting legitimate internal access, aligning with least-privilege and Google’s recommended remediation for OPEN_MYSQL_PORT findings. Option A is overly broad and could break legitimate workloads, C is not applicable to L4 firewalling or all projects, and D is operationally unscalable.
Question 145
Your company's Google Cloud organization has about 200 projects and 1,500 virtual machines. There is no uniform strategy for logs and events management, which reduces visibility for your security operations team. You need to design a logs management solution that provides visibility and allows the security team to view the environment's configuration.
What should you do?
A. 1. Create a dedicated log sink for each project that is in scope. 2. Use a BigQuery dataset with time partitioning enabled as a destination of the log sinks. 3. Deploy alerts based on log metrics in every project. 4. Grant the role "Monitoring Viewer" to the security operations team in each project.
B. 1. Create one log sink at the organization level that includes all the child resources. 2. Use as destination a Pub/Sub topic to ingest the logs into the security information and event. management (SIEM) on-premises, and ensure that the right team can access the SIEM. 3. Grant the Viewer role at organization level to the security operations team.
C. 1. Enable network logs and data access logs for all resources in the "Production" folder. 2. Do not create log sinks to avoid unnecessary costs and latency. 3. Grant the roles "Logs Viewer" and "Browser" at project level to the security operations team.
D. 1. Create one sink for the "Production" folder that includes child resources and one sink for the logs ingested at the organization level that excludes child resources. 2. As destination, use a log bucket with a minimum retention period of 90 days in a project that can be accessed by the security team. 3. Grant the security operations team the role of Security Reviewer at organization level.
Show Answer
Correct Answer: B
Explanation: An organization with hundreds of projects needs centralized, consistent log collection and access. Creating a single organization-level log sink ensures visibility across all child resources without per-project overhead. Exporting logs to Pub/Sub enables integration with a SIEM, which is designed for security analysis and environment visibility at scale. Granting the Viewer role at the organization level allows the security team to view configurations and metadata across the environment. The other options either fragment logging, limit scope, or fail to provide centralized visibility.
Question 146
Your organization wants to be General Data Protection Regulation (GDPR) compliant. You want to ensure that your DevOps teams can only create Google Cloud resources in the Europe regions.
What should you do?
A. Use Identity-Aware Proxy (IAP) with Access Context Manager to restrict the location of Google Cloud resources.
B. Use the org policy constraint 'Google Cloud Platform – Resource Location Restriction' on your Google Cloud organization node.
C. Use the org policy constraint 'Restrict Resource Service Usage' on your Google Cloud organization node.
D. Use Identity and Access Management (IAM) custom roles to ensure that your DevOps team can only create resources in the Europe regions.
Show Answer
Correct Answer: B
Explanation: GDPR compliance requires enforcing where resources can be created. The correct way to enforce geographic restrictions in Google Cloud is via Organization Policy. The 'Resource Location Restriction' org policy constraint allows you to specify allowed regions (for example, europe-*), and it is technically enforced by the platform. IAM roles cannot restrict regions, IAP/Access Context Manager controls access to applications not resource creation, and 'Restrict Resource Service Usage' controls which APIs can be used, not where resources are located. Although the policy can be applied at the organization level, it can also be scoped to folders or projects if only certain teams need the restriction.
Question 147
You manage a mission-critical workload for your organization, which is in a highly regulated industry. The workload uses Compute Engine VMs to analyze and process the sensitive data after it is uploaded to Cloud Storage from the endpoint computers. Your compliance team has detected that this workload does not meet the data protection requirements for sensitive data. You need to meet these requirements:
• Manage the data encryption key (DEK) outside the Google Cloud boundary.
• Maintain full control of encryption keys through a third-party provider.
• Encrypt the sensitive data before uploading it to Cloud Storage.
• Decrypt the sensitive data during processing in the Compute Engine VMs.
• Encrypt the sensitive data in memory while in use in the Compute Engine VMs.
What should you do? (Choose two.)
A. Configure Customer Managed Encryption Keys to encrypt the sensitive data before it is uploaded to Cloud Storage, and decrypt the sensitive data after it is downloaded into your VMs.
B. Configure Cloud External Key Manager to encrypt the sensitive data before it is uploaded to Cloud Storage, and decrypt the sensitive data after it is downloaded into your VMs.
C. Create Confidential VMs to access the sensitive data.
D. Migrate the Compute Engine VMs to Confidential VMs to access the sensitive data.
E. Create a VPC Service Controls service perimeter across your existing Compute Engine VMs and Cloud Storage buckets.
Show Answer
Correct Answer: B, C
Explanation: The requirements mandate that encryption keys be managed outside Google Cloud, full control via a third-party provider, client-side encryption before upload, decryption during VM processing, and encryption of data in use (in memory).
Cloud External Key Manager (B) enables the use of externally managed keys held by a third-party HSM or key provider, satisfying external key control and encryption/decryption workflows for data stored in Cloud Storage and used by VMs.
Encrypting data in memory while it is being processed requires Confidential Computing. Creating Confidential VMs (C) ensures data-in-use protection through hardware-based memory encryption. Existing VMs cannot be converted to Confidential VMs, so “migrate” is not accurate.
Other options do not meet all requirements: CMEK keeps keys within Google Cloud boundaries, VPC Service Controls does not address encryption or key ownership, and migrating existing VMs to Confidential VMs is not supported.
Question 148
You are migrating your users to Google Cloud. There are cookie replay attacks with Google web and Google Cloud CLI SDK sessions on endpoint devices. You need to reduce the risk of these threats.
What should you do? (Choose two.)
A. Configure Google session control to a shorter duration.
B. Set an organizational policy for OAuth 2.0 access token with a shorter duration.
C. Set a reauthentication policy for Google Cloud services to a shorter duration.
D. Configure a third-party identity provider with session management.
E. Enforce Security Key Authentication with 2SV.
Show Answer
Correct Answer: A, C
Explanation: Cookie replay attacks abuse existing authenticated sessions. Reducing the lifetime of those sessions directly limits how long a stolen cookie can be reused. Configuring Google session control to a shorter duration reduces exposure for Google web sessions, and setting a shorter reauthentication policy for Google Cloud services forces periodic reauth for Cloud Console and CLI sessions, limiting replay risk. Options related to identity proofing (2SV, security keys) or OAuth access tokens do not effectively mitigate replay of already-issued session cookies.
Question 149
Your company must follow industry specific regulations. Therefore, you need to enforce customer-managed encryption keys (CMEK) for all new Cloud Storage resources in the organization called org1.
What command should you execute?
A. • organization poli-cy:constraints/gcp.restrictStorageNonCmekServices • binding at: org1 • policy type: allow • policy value: all supported services
Explanation: To require customer-managed encryption keys (CMEK) for all new Cloud Storage resources at the organization level, you must use the organization policy constraint `constraints/gcp.restrictNonCmekServices`. This is a list constraint that enforces CMEK by denying resource creation unless a CMEK key is specified. Setting the policy type to **deny** and specifying `storage.googleapis.com` ensures that Cloud Storage resources cannot be created without CMEK. The alternative constraint names or allow policies shown in other options are incorrect or do not enforce CMEK.
Question 150
Your organization is using Active Directory and wants to configure Security Assertion Markup Language (SAML). You must set up and enforce single sign-on (SSO) for all users.
What should you do?
A. 1. Create a new SAML profile. 2. Populate the sign-in and sign-out page URLs. 3. Upload the X.509 certificate. 4. Configure Entity ID and ACS URL in your IdP.
B. 1. Configure prerequisites for OpenID Connect (OIDC) in your Active Directory (AD) tenant. 2. Verify the AD domain. 3. Decide which users should use SAML. 4. Assign the pre-configured profile to the select organizational units (OUs) and groups.
C. 1. Create a new SAML profile. 2. Upload the X.509 certificate. 3. Enable the change password URL. 4. Configure Entity ID and ACS URL in your IdP.
D. 1. Manage SAML profile assignments. 2. Enable OpenID Connect (OIDC) in your Active Directory (AD) tenant. 3. Verify the domain.
Show Answer
Correct Answer: A
Explanation: To enforce SAML-based single sign-on for all users with Active Directory, you must configure a complete SAML SSO profile. This includes creating the SAML profile, defining the sign-in and sign-out URLs, uploading the X.509 certificate used for trust and assertion signing, and configuring the Entity ID and Assertion Consumer Service (ACS) URL in the Identity Provider. These are the core, required steps for SAML SSO. The other options either mix in OpenID Connect (which is a different protocol) or include unnecessary or incorrect steps.
Question 151
A company is using Google Kubernetes Engine (GKE) with container images of a mission-critical application. The company wants to scan the images for known security issues and securely share the report with the security team without exposing them outside Google Cloud.
What should you do?
A. 1. Enable Container Threat Detection in the Security Command Center Premium tier. 2. Upgrade all clusters that are not on a supported version of GKE to the latest possible GKE version. 3. View and share the results from the Security Command Center.
B. 1. Use an open source tool in Cloud Build to scan the images. 2. Upload reports to publicly accessible buckets in Cloud Storage by using gsutil. 3. Share the scan report link with your security department.
C. 1. Enable vulnerability scanning in the Artifact Registry settings. 2. Use Cloud Build to build the images. 3. Push the images to the Artifact Registry for automatic scanning. 4. View the reports in the Artifact Registry.
D. 1. Get a GitHub subscription. 2. Build the images in Cloud Build and store them in GitHub for automatic scanning. 3. Download the report from GitHub and share with the Security Team.
Show Answer
Correct Answer: C
Explanation: The requirement is to scan container images for known vulnerabilities and share the results securely within Google Cloud. Artifact Registry provides built-in vulnerability scanning for container images, automatically scanning images when they are pushed. Using Cloud Build to build and push images integrates seamlessly, and reports can be viewed and shared securely inside Google Cloud without exposing them publicly. Security Command Center Container Threat Detection focuses on runtime threats, not image vulnerability scanning.
Question 152
A service account key has been publicly exposed on multiple public code repositories. After reviewing the logs, you notice that the keys were used to generate short-lived credentials. You need to immediately remove access with the service account.
What should you do?
A. Delete the compromised service account.
B. Disable the compromised service account key.
C. Wait until the service account credentials expire automatically.
D. Rotate the compromised service account key.
Show Answer
Correct Answer: A
Explanation: The exposed key was used to mint short-lived credentials. Disabling or rotating the service account key does not revoke already issued short-lived credentials. To immediately remove access, you must disable or delete the service account itself. Among the options, deleting the compromised service account is the action that immediately revokes all credentials derived from it.
$19
Get all 350 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.