Professional Cloud Security Engineer Free Practice Questions — Page 17
Question 153
Your organization has on-premises hosts that need to access Google Cloud APIs. You must enforce private connectivity between these hosts, minimize costs, and optimize for operational efficiency.
What should you do?
A. Set up VPC peering between the hosts on-premises and the VPC through the internet.
B. Route all on-premises traffic to Google Cloud through an IPsec VPN tunnel to a VPC with Private Google Access enabled.
C. Enforce a security policy that mandates all applications to encrypt data with a Cloud Key Management Service (KMS) key before you send it over the network.
D. Route all on-premises traffic to Google Cloud through a dedicated or Partner Interconnect to a VPC with Private Google Access enabled.
Show Answer
Correct Answer: B
Explanation: The requirement is private connectivity from on‑premises hosts to Google Cloud APIs while minimizing cost and operational overhead. Using an IPsec Cloud VPN tunnel with Private Google Access for on‑premises hosts allows API traffic to stay on private Google networking without using the public internet, meets the private connectivity requirement, and is significantly cheaper and simpler to operate than Dedicated or Partner Interconnect. Interconnect (D) offers higher bandwidth and SLA but increases cost and operational complexity, which is unnecessary for API access. The other options do not provide appropriate private connectivity.
Question 154
You run applications on Cloud Run. You already enabled container analysis for vulnerability scanning. However, you are concerned about the lack of control on the applications that are deployed. You must ensure that only trusted container images are deployed on Cloud Run.
What should you do? (Choose two.)
A. Enable Binary Authorization on the existing Cloud Run service.
B. Set the organization policy constraint constraints/run.allowedBinaryAuthorizationPolicies to the list or allowed Binary Authorization policy names.
C. Enable Binary Authorization on the existing Kubernetes cluster.
D. Use Cloud Run breakglass to deploy an image that meets the Binary Authorization policy by default.
E. Set the organization policy constraint constraints/compute.trustedImageProjects to the list of projects that contain the trusted container images.
Show Answer
Correct Answer: A, B
Explanation: To ensure only trusted container images are deployed on Cloud Run, you must use Binary Authorization for Cloud Run. First, you enable Binary Authorization on the Cloud Run service so that deployments are checked against an admission policy. Second, you enforce this requirement at scale by setting the organization policy constraint `constraints/run.allowedBinaryAuthorizationPolicies`, which restricts Cloud Run services to approved Binary Authorization policies. Other options either apply to GKE or Compute Engine, or are not mechanisms for enforcing trusted images on Cloud Run.
Question 155
Your organization previously stored files in Cloud Storage by using Google Managed Encryption Keys (GMEK), but has recently updated the internal policy to require Customer Managed Encryption Keys (CMEK). You need to re-encrypt the files quickly and efficiently with minimal cost.
What should you do?
A. Reupload the files to the same Cloud Storage bucket specifying a key file by using gsutil.
B. Encrypt the files locally, and then use gsutil to upload the files to a new bucket.
C. Copy the files to a new bucket with CMEK enabled in a secondary region.
D. Change the encryption type on the bucket to CMEK, and rewrite the objects.
Show Answer
Correct Answer: D
Explanation: Existing objects encrypted with Google-managed keys cannot have their encryption key changed in place. The supported, fastest, and lowest-cost approach is to set the bucket to use a Customer Managed Encryption Key and then rewrite the objects (for example, via a rewrite operation). This re-encrypts data entirely within Cloud Storage, avoiding local download/upload and avoiding cross-region data movement or egress charges, making it quicker and more cost-efficient than reuploading or copying to another bucket.
Question 156
You are auditing all your Google Cloud resources in the production project. You want to identify all principals who can change firewall rules.
What should you do?
A. Use Policy Analyzer to query the permissions compute.firewalls.get or compute.firewalls.list.
B. Use Firewall Insights to understand your firewall rules usage patterns.
C. Reference the Security Health Analytics – Firewall Vulnerability Findings in the Security Command Center.
D. Use Policy Analyzer to query the permissions compute.firewalls.create or compute.firewalls.update or compute.firewalls.delete.
Show Answer
Correct Answer: D
Explanation: To identify principals who can change firewall rules, you must look for permissions that allow modification of firewall resources. Creating, updating, or deleting firewall rules requires the permissions compute.firewalls.create, compute.firewalls.update, and compute.firewalls.delete. Policy Analyzer is the correct tool to query IAM policies across the project to find which principals have these permissions. The other options focus on visibility, usage, or vulnerability findings, not on who has change authority.
Question 157
You plan to synchronize identities to Cloud Identity from a third-party identity provider (IdP). You discovered that some employees used their corporate email address to set up consumer accounts to access Google services. You need to ensure that the organization has control over the configuration, security, and lifecycle of these consumer accounts.
What should you do? (Choose two.)
A. Mandate that those corporate employees delete their unmanaged consumer accounts.
B. Reconcile accounts that exist in Cloud Identity but not in the third-party IdP.
C. Evict the unmanaged consumer accounts in the third-party IdP before you sync identities.
D. Use Google Cloud Directory Sync (GCDS) to migrate the unmanaged consumer accounts' emails as user aliases.
E. Use the transfer tool to invite those corporate employees to transfer their unmanaged consumer accounts to the corporate domain.
Show Answer
Correct Answer: B, E
Explanation: To gain organizational control over consumer Google accounts created with corporate email addresses, you must both identify and bring those accounts under management. Reconciling accounts that exist in Cloud Identity but not in the third-party IdP addresses conflicts and orphaned accounts during synchronization. Using the Google account transfer tool is the official method to convert unmanaged consumer accounts into managed accounts, giving the organization control over configuration, security, and lifecycle.
Question 158
Your organization's Customers must scan and upload the contract and their driver license into a web portal in Cloud Storage. You must remove all personally identifiable information (PII) from files that are older than 12 months. Also, you must archive the anonymized files for retention purposes.
What should you do?
A. Set a time to live (TTL) of 12 months for the files in the Cloud Storage bucket that removes PII and moves the files to the archive storage class.
B. Create a Cloud Data loss Prevention (DLP) inspection job that de-identifies PII in files created more than 12 months ago and archives them to another Cloud Storage bucket. Delete the original files.
C. Configure the Autoclass feature of the Cloud Storage bucket to de-identify PII. Archive the files that are older than 12 months. Delete the original files.
D. Schedule a Cloud Key Management Service (KMS) rotation period of 12 months for the encryption keys of the Cloud Storage files containing PII to de-identify them. Delete the original keys.
Show Answer
Correct Answer: B
Explanation: The requirement is to detect and remove PII from files older than 12 months and then retain the anonymized versions. Cloud Data Loss Prevention (DLP) is the Google Cloud service designed to inspect and de-identify sensitive data such as PII in Cloud Storage objects. A DLP inspection/de-identification job can target objects based on age, output the anonymized files to another Cloud Storage bucket for archival, and allow deletion of the original files containing PII. The other options do not actually perform PII detection or de-identification.
Question 159
You need to set up a Cloud Interconnect connection between your company’s on-premises data center and VPC host network. You want to make sure that on-premises applications can only access Google APIs over the Cloud Interconnect and not through the public internet. You are required to only use APIs that are supported by VPC Service Controls to mitigate against exfiltration risk to non-supported APIs. How should you configure the network?
A. Enable Private Google Access on the regional subnets and global dynamic routing mode.
B. Create a CNAME to map *.googleapis.com to restricted.googleapis.com, and create A records for restricted.googleapis.com mapped to 199.36.153.8/30.
C. Use private.googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the connection.
D. Use restricted googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the Cloud Interconnect connection.
Show Answer
Correct Answer: D
Explanation: To ensure on‑premises traffic reaches Google APIs only over Cloud Interconnect and is limited to APIs supported by VPC Service Controls, you must use the restricted.googleapis.com endpoint. This endpoint advertises private IP ranges over Cloud Interconnect and enforces VPC Service Controls, preventing access to non‑supported APIs and blocking public internet paths. Other options either do not enforce VPC Service Controls, do not restrict internet access, or use incorrect DNS/IP configurations.
Question 160
Your company conducts clinical trials and needs to analyze the results of a recent study that are stored in BigQuery. The interval when the medicine was taken contains start and stop dates. The interval data is critical to the analysis, but specific dates may identify a particular batch and introduce bias. You need to obfuscate the start and end dates for each row and preserve the interval data.
What should you do?
A. Use date shifting with the context set to the unique ID of the test subject.
B. Extract the date using TimePartConfig from each date field and append a random month and year.
C. Use bucketing to shift values to a predetermined date based on the initial value.
D. Use the FFX mode of format preserving encryption (FPE) and maintain data consistency.
Show Answer
Correct Answer: A
Explanation: Date shifting obfuscates actual dates while preserving the relative intervals between start and end dates. By setting the context to a unique test subject ID, all dates for that subject are shifted by the same random offset, maintaining interval integrity without revealing real dates. Other options either lose interval fidelity, introduce randomness that breaks intervals, or are unnecessary for this requirement.
Question 161
Your organization develops software involved in many open source projects and is concerned about software supply chain threats. You need to deliver provenance for the build to demonstrate the software is untampered.
What should you do?
A. 1. Hire an external auditor to review and provide provenance. 2. Define the scope and conditions. 3. Get support from the Security department or representative. 4. Publish the attestation to your public web page.
B. 1. Review the software process. 2. Generate private and public key pairs and use Pretty Good Privacy (PGP) protocols to sign the output software artifacts together with a file containing the address of your enterprise and point of contact. 3. Publish the PGP signed attestation to your public web page.
C. 1. Publish the software code on GitHub as open source. 2. Establish a bug bounty program, and encourage the open source community to review, report, and fix the vulnerabilities.
D. 1. Generate Supply Chain Levels for Software Artifacts (SLSA) level 3 assurance by using Cloud Build. 2. View the build provenance in the Security insights side panel within the Google Cloud console.
Show Answer
Correct Answer: D
Explanation: The requirement is to deliver verifiable build provenance to demonstrate the software has not been tampered with, addressing software supply chain threats. SLSA is an industry-recognized framework specifically designed for this purpose. Using Cloud Build to achieve SLSA level 3 generates cryptographically verifiable, tamper-resistant build provenance automatically. This provenance can be inspected and validated (for example, via Security Insights), providing strong assurance about how, when, and from what sources the software was built. The other options do not provide standardized, verifiable supply-chain provenance comparable to SLSA.
Question 162
You have a highly sensitive BigQuery workload that contains personally identifiable information (PII) that you want to ensure is not accessible from the internet. To prevent data exfiltration, only requests from authorized IP addresses are allowed to query your BigQuery tables.
What should you do?
A. Use service perimeter and create an access level based on the authorized source IP address as the condition.
B. Use Google Cloud Armor security policies defining an allowlist of authorized IP addresses at the global HTTPS load balancer.
C. Use the Restrict Resource Service Usage organization policy constraint along with Cloud Data Loss Prevention (DLP).
D. Use the Restrict allowed Google Cloud APIs and services organization policy constraint along with Cloud Data Loss Prevention (DLP).
Show Answer
Correct Answer: A
Explanation: To prevent data exfiltration from BigQuery and ensure that only requests from authorized IP addresses can access sensitive PII, you should use VPC Service Controls. By creating a service perimeter and defining an access level based on authorized source IP addresses, you can restrict BigQuery access so that queries are only allowed from approved networks. Other options do not control direct BigQuery access at the API level or are focused on different security objectives (such as DLP inspection rather than network-based access control).
$19
Get all 350 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.