Professional Cloud Security Engineer Free Practice Questions — Page 17
Question 159
Your company must follow industry specific regulations. Therefore, you need to enforce customer-managed encryption keys (CMEK) for all new Cloud Storage resources in the organization called org1.
What command should you execute?
A. • organization poli-cy:constraints/gcp.restrictStorageNonCmekServices • binding at: org1 • policy type: allow • policy value: all supported services
Explanation: To require customer-managed encryption keys (CMEK) for new resources, use the organization policy constraint `constraints/gcp.restrictNonCmekServices` as a deny list containing the target service. Denying `storage.googleapis.com` prevents creation of new Cloud Storage resources unless they are protected with CMEK. The `restrictStorageNonCmekServices` constraint is not the valid organization policy constraint for this feature.
Question 160
Your organization is using Active Directory and wants to configure Security Assertion Markup Language (SAML). You must set up and enforce single sign-on (SSO) for all users.
What should you do?
A. 1. Create a new SAML profile. 2. Populate the sign-in and sign-out page URLs. 3. Upload the X.509 certificate. 4. Configure Entity ID and ACS URL in your IdP.
B. 1. Configure prerequisites for OpenID Connect (OIDC) in your Active Directory (AD) tenant. 2. Verify the AD domain. 3. Decide which users should use SAML. 4. Assign the pre-configured profile to the select organizational units (OUs) and groups.
C. 1. Create a new SAML profile. 2. Upload the X.509 certificate. 3. Enable the change password URL. 4. Configure Entity ID and ACS URL in your IdP.
D. 1. Manage SAML profile assignments. 2. Enable OpenID Connect (OIDC) in your Active Directory (AD) tenant. 3. Verify the domain.
Show Answer
Correct Answer: A
Explanation: Configuring SAML SSO requires creating a SAML profile, providing the IdP sign-in and sign-out URLs, uploading the IdP X.509 certificate used to validate SAML assertions, and configuring the service provider's Entity ID and Assertion Consumer Service (ACS) URL in the identity provider. The other options incorrectly introduce OpenID Connect or unnecessary steps such as enabling a change password URL.
Question 161
A company is using Google Kubernetes Engine (GKE) with container images of a mission-critical application. The company wants to scan the images for known security issues and securely share the report with the security team without exposing them outside Google Cloud.
What should you do?
A. 1. Enable Container Threat Detection in the Security Command Center Premium tier. 2. Upgrade all clusters that are not on a supported version of GKE to the latest possible GKE version. 3. View and share the results from the Security Command Center.
B. 1. Use an open source tool in Cloud Build to scan the images. 2. Upload reports to publicly accessible buckets in Cloud Storage by using gsutil. 3. Share the scan report link with your security department.
C. 1. Enable vulnerability scanning in the Artifact Registry settings. 2. Use Cloud Build to build the images. 3. Push the images to the Artifact Registry for automatic scanning. 4. View the reports in the Artifact Registry.
D. 1. Get a GitHub subscription. 2. Build the images in Cloud Build and store them in GitHub for automatic scanning. 3. Download the report from GitHub and share with the Security Team.
Show Answer
Correct Answer: C
Explanation: Artifact Registry's built-in vulnerability scanning is the Google Cloud service designed to scan container images for known vulnerabilities. Building images with Cloud Build and pushing them to Artifact Registry triggers automatic scanning, and the reports remain available within Google Cloud for authorized users such as the security team. Container Threat Detection focuses on runtime threat detection rather than image vulnerability scanning, while the other options either use non-Google services or expose reports publicly.
Question 162
A service account key has been publicly exposed on multiple public code repositories. After reviewing the logs, you notice that the keys were used to generate short-lived credentials. You need to immediately remove access with the service account.
What should you do?
A. Delete the compromised service account.
B. Disable the compromised service account key.
C. Wait until the service account credentials expire automatically.
D. Rotate the compromised service account key.
Show Answer
Correct Answer: A
Explanation: Short-lived credentials that were minted from a compromised service account key remain valid even if the key is disabled or rotated. To immediately revoke those short-lived credentials, you must disable or delete the service account itself. Since the option given is delete the compromised service account (and disable service account is not an option), A is the correct choice. Disabling or rotating only the key prevents future use of that key but does not invalidate already-issued short-lived credentials.
Question 163
Your organization has on-premises hosts that need to access Google Cloud APIs. You must enforce private connectivity between these hosts, minimize costs, and optimize for operational efficiency.
What should you do?
A. Set up VPC peering between the hosts on-premises and the VPC through the internet.
B. Route all on-premises traffic to Google Cloud through an IPsec VPN tunnel to a VPC with Private Google Access enabled.
C. Enforce a security policy that mandates all applications to encrypt data with a Cloud Key Management Service (KMS) key before you send it over the network.
D. Route all on-premises traffic to Google Cloud through a dedicated or Partner Interconnect to a VPC with Private Google Access enabled.
Show Answer
Correct Answer: B
Explanation: Private Google Access for on-premises hosts supports accessing Google APIs privately over either Cloud VPN or Cloud Interconnect attached to a VPC with Private Google Access enabled. The question also requires minimizing costs and optimizing operational efficiency. Compared with Dedicated or Partner Interconnect, Cloud VPN has significantly lower cost and less deployment complexity while still providing private connectivity to Google APIs. VPC peering cannot be used from on-premises over the internet, and Cloud KMS encryption does not provide private network connectivity.
Question 164
You run applications on Cloud Run. You already enabled container analysis for vulnerability scanning. However, you are concerned about the lack of control on the applications that are deployed. You must ensure that only trusted container images are deployed on Cloud Run.
What should you do? (Choose two.)
A. Enable Binary Authorization on the existing Cloud Run service.
B. Set the organization policy constraint constraints/run.allowedBinaryAuthorizationPolicies to the list or allowed Binary Authorization policy names.
C. Enable Binary Authorization on the existing Kubernetes cluster.
D. Use Cloud Run breakglass to deploy an image that meets the Binary Authorization policy by default.
E. Set the organization policy constraint constraints/compute.trustedImageProjects to the list of projects that contain the trusted container images.
Show Answer
Correct Answer: A, B
Explanation: To enforce that only trusted container images are deployed to Cloud Run, you enable Binary Authorization on the Cloud Run service and configure the organization policy constraint that specifies the allowed Binary Authorization policies for Cloud Run (constraints/run.allowedBinaryAuthorizationPolicies). Binary Authorization for GKE (C) does not apply to Cloud Run, breakglass (D) is an exception mechanism rather than an enforcement control, and constraints/compute.trustedImageProjects (E) applies to Compute Engine trusted images, not Cloud Run.
Question 165
Your organization previously stored files in Cloud Storage by using Google Managed Encryption Keys (GMEK), but has recently updated the internal policy to require Customer Managed Encryption Keys (CMEK). You need to re-encrypt the files quickly and efficiently with minimal cost.
What should you do?
A. Reupload the files to the same Cloud Storage bucket specifying a key file by using gsutil.
B. Encrypt the files locally, and then use gsutil to upload the files to a new bucket.
C. Copy the files to a new bucket with CMEK enabled in a secondary region.
D. Change the encryption type on the bucket to CMEK, and rewrite the objects.
Show Answer
Correct Answer: D
Explanation: To migrate existing Cloud Storage objects from Google-managed encryption keys (GMEK) to customer-managed encryption keys (CMEK), configure the bucket to use the desired CMEK and rewrite the existing objects. Rewriting causes Cloud Storage to re-encrypt the object with the bucket's current default CMEK without downloading and reuploading data, making it the most efficient and lowest-cost approach among the options.
Question 166
You are auditing all your Google Cloud resources in the production project. You want to identify all principals who can change firewall rules.
What should you do?
A. Use Policy Analyzer to query the permissions compute.firewalls.get or compute.firewalls.list.
B. Use Firewall Insights to understand your firewall rules usage patterns.
C. Reference the Security Health Analytics – Firewall Vulnerability Findings in the Security Command Center.
D. Use Policy Analyzer to query the permissions compute.firewalls.create or compute.firewalls.update or compute.firewalls.delete.
Show Answer
Correct Answer: D
Explanation: To identify principals who can change firewall rules, use Policy Analyzer to query IAM permissions that grant modification capabilities: compute.firewalls.create, compute.firewalls.update, and compute.firewalls.delete. Querying get/list only identifies read access, while Firewall Insights and Security Health Analytics analyze firewall posture and usage rather than IAM principals with modification permissions.
Question 167
You plan to synchronize identities to Cloud Identity from a third-party identity provider (IdP). You discovered that some employees used their corporate email address to set up consumer accounts to access Google services. You need to ensure that the organization has control over the configuration, security, and lifecycle of these consumer accounts.
What should you do? (Choose two.)
A. Mandate that those corporate employees delete their unmanaged consumer accounts.
B. Reconcile accounts that exist in Cloud Identity but not in the third-party IdP.
C. Evict the unmanaged consumer accounts in the third-party IdP before you sync identities.
D. Use Google Cloud Directory Sync (GCDS) to migrate the unmanaged consumer accounts' emails as user aliases.
E. Use the transfer tool to invite those corporate employees to transfer their unmanaged consumer accounts to the corporate domain.
Show Answer
Correct Answer: B, E
Explanation: Before synchronizing from a third-party IdP, reconcile existing managed accounts so the directory state aligns and orphaned or pre-existing Cloud Identity accounts are handled appropriately. To bring unmanaged consumer accounts created with corporate email addresses under organizational control, use Google's account transfer tool to invite users to transfer those accounts into the managed domain. Deleting accounts, evicting them from the IdP, or using GCDS aliases do not achieve managed ownership of the consumer accounts.
Sources:
https://cloud.google.com/architecture/landing-zones/decide-how-to-onboard-identities
Question 168
Your organization's Customers must scan and upload the contract and their driver license into a web portal in Cloud Storage. You must remove all personally identifiable information (PII) from files that are older than 12 months. Also, you must archive the anonymized files for retention purposes.
What should you do?
A. Set a time to live (TTL) of 12 months for the files in the Cloud Storage bucket that removes PII and moves the files to the archive storage class.
B. Create a Cloud Data loss Prevention (DLP) inspection job that de-identifies PII in files created more than 12 months ago and archives them to another Cloud Storage bucket. Delete the original files.
C. Configure the Autoclass feature of the Cloud Storage bucket to de-identify PII. Archive the files that are older than 12 months. Delete the original files.
D. Schedule a Cloud Key Management Service (KMS) rotation period of 12 months for the encryption keys of the Cloud Storage files containing PII to de-identify them. Delete the original keys.
Show Answer
Correct Answer: B
Explanation: Cloud Sensitive Data Protection (formerly Cloud DLP) is the Google Cloud service designed to inspect and de-identify PII in data stored in Cloud Storage. A job can target objects older than 12 months, write anonymized copies to an archive bucket, and the originals can then be deleted. Cloud Storage lifecycle/TTL and Autoclass only manage object lifecycle and storage class, not de-identification, and Cloud KMS key rotation does not anonymize data.
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.