Professional Cloud Security Engineer Free Practice Questions — Page 16
Question 151
Your DevOps team uses Packer to build Compute Engine images by using this process:
1. Create an ephemeral Compute Engine VM.
2. Copy a binary from a Cloud Storage bucket to the VM's file system.
3. Update the VM's package manager.
4. Install external packages from the internet onto the VM.
Your security team just enabled the organizational policy, constraints/ compute.vmExternalIpAccess, to restrict the usage of public IP Addresses on VMs. In response, your DevOps team updated their scripts to remove public IP addresses on the Compute Engine VMs; however, the build pipeline is failing due to connectivity issues.
What should you do? (Choose two.)
A. Provision an HTTP load balancer with the VM in an unmanaged instance group to allow inbound connections from the internet to your VM.
B. Provision a Cloud NAT instance in the same VPC and region as the Compute Engine VM.
C. Enable Private Google Access on the subnet that the Compute Engine VM is deployed within.
D. Update the VPC routes to allow traffic to and from the internet.
E. Provision a Cloud VPN tunnel in the same VPC and region as the Compute Engine VM.
Show Answer
Correct Answer: B, C
Explanation: The VM needs outbound internet access to download external packages and access to Google Cloud services (Cloud Storage) without a public IP. Cloud NAT provides outbound internet connectivity for instances without external IP addresses, enabling package downloads. Private Google Access allows VMs without external IPs to reach Google APIs and services such as Cloud Storage over Google's network. An HTTP load balancer is for inbound traffic, changing routes alone does not provide internet egress without an external IP or NAT, and Cloud VPN is unrelated to general internet access.
Question 152
You manage a BigQuery analytical data warehouse in your organization. You want to keep data for all your customers in a common table while you also restrict query access based on rows and columns permissions. Non-query operations should not be supported.
What should you do? (Choose two.)
A. Create row-level access policies to restrict the result data when you run queries with the filter expression set to TRUE.
B. Configure column-level encryption by using Authenticated Encryption with Associated Data (AEAD) functions with Cloud Key Management Service (KMS) to control access to columns at query runtime.
C. Create row-level access policies to restrict the result data when you run queries with the filter expression set to FALSE.
D. Configure dynamic data masking rules to control access to columns at query runtime.
E. Create column-level policy tags to control access to columns at query runtime.
Show Answer
Correct Answer: C, E
Explanation: Use row-level access policies with a FALSE filter to prevent non-query operations while still enforcing row-level security for queries. For column restrictions, BigQuery's native column-level security uses policy tags to control access at query runtime. AEAD encryption is for application-managed encryption rather than access control, and dynamic data masking masks values but is distinct from column-level permission enforcement.
Question 153
You are using Security Command Center (SCC) to protect your workloads and receive alerts for suspected security breaches at your company. You need to detect cryptocurrency mining software.
Which SCC service should you use?
A. Virtual Machine Threat Detection
B. Container Threat Detection
C. Rapid Vulnerability Detection
D. Web Security Scanner
Show Answer
Correct Answer: A
Explanation: Virtual Machine Threat Detection is the Security Command Center service designed to detect malicious software running on Compute Engine VMs, including cryptocurrency mining software, kernel-mode rootkits, and other suspicious activity. Container Threat Detection is for GKE/container workloads, Rapid Vulnerability Detection identifies vulnerabilities rather than active cryptomining, and Web Security Scanner scans web applications for common web vulnerabilities.
Question 154
Your Google Cloud organization allows for administrative capabilities to be distributed to each team through provision of a Google Cloud project with Owner role (roles/owner). The organization contains thousands of Google Cloud projects. Security Command Center Premium has surfaced multiple OPEN_MYSQL_PORT findings. You are enforcing the guardrails and need to prevent these types of common misconfigurations.
What should you do?
A. Create a hierarchical firewall policy configured at the organization to deny all connections from 0.0.0.0/0.
B. Create a hierarchical firewall policy configured at the organization to allow connections only from internal IP ranges.
C. Create a Google Cloud Armor security policy to deny traffic from 0.0.0.0/0.
D. Create a firewall rule for each virtual private cloud (VPC) to deny traffic from 0.0.0.0/0 with priority 0.
Show Answer
Correct Answer: B
Explanation: Use an organization-level hierarchical firewall policy to enforce centralized guardrails across thousands of projects. Allowing only trusted internal IP ranges prevents public exposure (such as OPEN_MYSQL_PORT findings) while still permitting legitimate internal connectivity. Cloud Armor is not appropriate for general VPC firewall enforcement, and per-VPC firewall rules do not scale. A blanket deny of all 0.0.0.0/0 traffic at the organization level is overly broad and would block legitimate public-facing services.
Question 156
Your organization wants to be General Data Protection Regulation (GDPR) compliant. You want to ensure that your DevOps teams can only create Google Cloud resources in the Europe regions.
What should you do?
A. Use Identity-Aware Proxy (IAP) with Access Context Manager to restrict the location of Google Cloud resources.
B. Use the org policy constraint 'Google Cloud Platform – Resource Location Restriction' on your Google Cloud organization node.
C. Use the org policy constraint 'Restrict Resource Service Usage' on your Google Cloud organization node.
D. Use Identity and Access Management (IAM) custom roles to ensure that your DevOps team can only create resources in the Europe regions.
Show Answer
Correct Answer: B
Explanation: The correct control for restricting where Google Cloud resources can be created is the Organization Policy constraint for Resource Location Restriction (constraints/gcp.resourceLocations). This policy enforces allowed regions (such as European regions) for supported resources. IAM custom roles control permissions, not geographic placement. Identity-Aware Proxy and Access Context Manager govern access to applications and access context, not resource creation locations. The policy can be applied at the organization, folder, or project level, so it does not have to affect every team if scoped appropriately.
Question 157
You manage a mission-critical workload for your organization, which is in a highly regulated industry. The workload uses Compute Engine VMs to analyze and process the sensitive data after it is uploaded to Cloud Storage from the endpoint computers. Your compliance team has detected that this workload does not meet the data protection requirements for sensitive data. You need to meet these requirements:
• Manage the data encryption key (DEK) outside the Google Cloud boundary.
• Maintain full control of encryption keys through a third-party provider.
• Encrypt the sensitive data before uploading it to Cloud Storage.
• Decrypt the sensitive data during processing in the Compute Engine VMs.
• Encrypt the sensitive data in memory while in use in the Compute Engine VMs.
What should you do? (Choose two.)
A. Configure Customer Managed Encryption Keys to encrypt the sensitive data before it is uploaded to Cloud Storage, and decrypt the sensitive data after it is downloaded into your VMs.
B. Configure Cloud External Key Manager to encrypt the sensitive data before it is uploaded to Cloud Storage, and decrypt the sensitive data after it is downloaded into your VMs.
C. Create Confidential VMs to access the sensitive data.
D. Migrate the Compute Engine VMs to Confidential VMs to access the sensitive data.
E. Create a VPC Service Controls service perimeter across your existing Compute Engine VMs and Cloud Storage buckets.
Show Answer
Correct Answer: B, C
Explanation: The requirements specify that encryption keys must be managed outside Google Cloud and under the control of a third-party provider, which is addressed by Cloud External Key Manager (Cloud EKM). The workload also requires encryption of data in use (memory), which is provided by Confidential VMs. Customer-managed encryption keys (CMEK) remain within Google Cloud and do not satisfy external key control. VPC Service Controls do not provide encryption. Existing VMs cannot simply be converted to Confidential VMs; Confidential Computing must be enabled when creating the VM, so creating Confidential VMs is the correct choice rather than migrating existing VMs directly.
Question 158
You are migrating your users to Google Cloud. There are cookie replay attacks with Google web and Google Cloud CLI SDK sessions on endpoint devices. You need to reduce the risk of these threats.
What should you do? (Choose two.)
A. Configure Google session control to a shorter duration.
B. Set an organizational policy for OAuth 2.0 access token with a shorter duration.
C. Set a reauthentication policy for Google Cloud services to a shorter duration.
D. Configure a third-party identity provider with session management.
E. Enforce Security Key Authentication with 2SV.
Show Answer
Correct Answer: A, C
Explanation: Cookie replay attacks target authenticated sessions. Shortening Google session duration reduces the lifetime of stolen session cookies for Google web apps, and enforcing more frequent reauthentication for Google Cloud services reduces the usefulness of hijacked Cloud console/CLI sessions. Shortening OAuth access token lifetime is focused on API tokens rather than browser session cookies, configuring a third-party IdP is not the primary mitigation, and security keys strengthen initial authentication but do not invalidate an already stolen session cookie.
Question 159
Your company must follow industry specific regulations. Therefore, you need to enforce customer-managed encryption keys (CMEK) for all new Cloud Storage resources in the organization called org1.
What command should you execute?
A. • organization poli-cy:constraints/gcp.restrictStorageNonCmekServices • binding at: org1 • policy type: allow • policy value: all supported services
Explanation: To require customer-managed encryption keys (CMEK) for new resources, use the organization policy constraint `constraints/gcp.restrictNonCmekServices` as a deny list containing the target service. Denying `storage.googleapis.com` prevents creation of new Cloud Storage resources unless they are protected with CMEK. The `restrictStorageNonCmekServices` constraint is not the valid organization policy constraint for this feature.
Question 160
Your organization is using Active Directory and wants to configure Security Assertion Markup Language (SAML). You must set up and enforce single sign-on (SSO) for all users.
What should you do?
A. 1. Create a new SAML profile. 2. Populate the sign-in and sign-out page URLs. 3. Upload the X.509 certificate. 4. Configure Entity ID and ACS URL in your IdP.
B. 1. Configure prerequisites for OpenID Connect (OIDC) in your Active Directory (AD) tenant. 2. Verify the AD domain. 3. Decide which users should use SAML. 4. Assign the pre-configured profile to the select organizational units (OUs) and groups.
C. 1. Create a new SAML profile. 2. Upload the X.509 certificate. 3. Enable the change password URL. 4. Configure Entity ID and ACS URL in your IdP.
D. 1. Manage SAML profile assignments. 2. Enable OpenID Connect (OIDC) in your Active Directory (AD) tenant. 3. Verify the domain.
Show Answer
Correct Answer: A
Explanation: Configuring SAML SSO requires creating a SAML profile, providing the IdP sign-in and sign-out URLs, uploading the IdP X.509 certificate used to validate SAML assertions, and configuring the service provider's Entity ID and Assertion Consumer Service (ACS) URL in the identity provider. The other options incorrectly introduce OpenID Connect or unnecessary steps such as enabling a change password URL.
Question 161
A company is using Google Kubernetes Engine (GKE) with container images of a mission-critical application. The company wants to scan the images for known security issues and securely share the report with the security team without exposing them outside Google Cloud.
What should you do?
A. 1. Enable Container Threat Detection in the Security Command Center Premium tier. 2. Upgrade all clusters that are not on a supported version of GKE to the latest possible GKE version. 3. View and share the results from the Security Command Center.
B. 1. Use an open source tool in Cloud Build to scan the images. 2. Upload reports to publicly accessible buckets in Cloud Storage by using gsutil. 3. Share the scan report link with your security department.
C. 1. Enable vulnerability scanning in the Artifact Registry settings. 2. Use Cloud Build to build the images. 3. Push the images to the Artifact Registry for automatic scanning. 4. View the reports in the Artifact Registry.
D. 1. Get a GitHub subscription. 2. Build the images in Cloud Build and store them in GitHub for automatic scanning. 3. Download the report from GitHub and share with the Security Team.
Show Answer
Correct Answer: C
Explanation: Artifact Registry's built-in vulnerability scanning is the Google Cloud service designed to scan container images for known vulnerabilities. Building images with Cloud Build and pushing them to Artifact Registry triggers automatic scanning, and the reports remain available within Google Cloud for authorized users such as the security team. Container Threat Detection focuses on runtime threat detection rather than image vulnerability scanning, while the other options either use non-Google services or expose reports publicly.
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.