Professional Cloud Security Engineer Free Practice Questions — Page 17
Question 162
A service account key has been publicly exposed on multiple public code repositories. After reviewing the logs, you notice that the keys were used to generate short-lived credentials. You need to immediately remove access with the service account.
What should you do?
A. Delete the compromised service account.
B. Disable the compromised service account key.
C. Wait until the service account credentials expire automatically.
D. Rotate the compromised service account key.
Show Answer
Correct Answer: A
Explanation: Short-lived credentials that were minted from a compromised service account key remain valid even if the key is disabled or rotated. To immediately revoke those short-lived credentials, you must disable or delete the service account itself. Since the option given is delete the compromised service account (and disable service account is not an option), A is the correct choice. Disabling or rotating only the key prevents future use of that key but does not invalidate already-issued short-lived credentials.
Question 163
Your organization has on-premises hosts that need to access Google Cloud APIs. You must enforce private connectivity between these hosts, minimize costs, and optimize for operational efficiency.
What should you do?
A. Set up VPC peering between the hosts on-premises and the VPC through the internet.
B. Route all on-premises traffic to Google Cloud through an IPsec VPN tunnel to a VPC with Private Google Access enabled.
C. Enforce a security policy that mandates all applications to encrypt data with a Cloud Key Management Service (KMS) key before you send it over the network.
D. Route all on-premises traffic to Google Cloud through a dedicated or Partner Interconnect to a VPC with Private Google Access enabled.
Show Answer
Correct Answer: B
Explanation: Private Google Access for on-premises hosts supports accessing Google APIs privately over either Cloud VPN or Cloud Interconnect attached to a VPC with Private Google Access enabled. The question also requires minimizing costs and optimizing operational efficiency. Compared with Dedicated or Partner Interconnect, Cloud VPN has significantly lower cost and less deployment complexity while still providing private connectivity to Google APIs. VPC peering cannot be used from on-premises over the internet, and Cloud KMS encryption does not provide private network connectivity.
Question 164
You run applications on Cloud Run. You already enabled container analysis for vulnerability scanning. However, you are concerned about the lack of control on the applications that are deployed. You must ensure that only trusted container images are deployed on Cloud Run.
What should you do? (Choose two.)
A. Enable Binary Authorization on the existing Cloud Run service.
B. Set the organization policy constraint constraints/run.allowedBinaryAuthorizationPolicies to the list or allowed Binary Authorization policy names.
C. Enable Binary Authorization on the existing Kubernetes cluster.
D. Use Cloud Run breakglass to deploy an image that meets the Binary Authorization policy by default.
E. Set the organization policy constraint constraints/compute.trustedImageProjects to the list of projects that contain the trusted container images.
Show Answer
Correct Answer: A, B
Explanation: To enforce that only trusted container images are deployed to Cloud Run, you enable Binary Authorization on the Cloud Run service and configure the organization policy constraint that specifies the allowed Binary Authorization policies for Cloud Run (constraints/run.allowedBinaryAuthorizationPolicies). Binary Authorization for GKE (C) does not apply to Cloud Run, breakglass (D) is an exception mechanism rather than an enforcement control, and constraints/compute.trustedImageProjects (E) applies to Compute Engine trusted images, not Cloud Run.
Question 165
Your organization previously stored files in Cloud Storage by using Google Managed Encryption Keys (GMEK), but has recently updated the internal policy to require Customer Managed Encryption Keys (CMEK). You need to re-encrypt the files quickly and efficiently with minimal cost.
What should you do?
A. Reupload the files to the same Cloud Storage bucket specifying a key file by using gsutil.
B. Encrypt the files locally, and then use gsutil to upload the files to a new bucket.
C. Copy the files to a new bucket with CMEK enabled in a secondary region.
D. Change the encryption type on the bucket to CMEK, and rewrite the objects.
Show Answer
Correct Answer: D
Explanation: To migrate existing Cloud Storage objects from Google-managed encryption keys (GMEK) to customer-managed encryption keys (CMEK), configure the bucket to use the desired CMEK and rewrite the existing objects. Rewriting causes Cloud Storage to re-encrypt the object with the bucket's current default CMEK without downloading and reuploading data, making it the most efficient and lowest-cost approach among the options.
Question 166
You are auditing all your Google Cloud resources in the production project. You want to identify all principals who can change firewall rules.
What should you do?
A. Use Policy Analyzer to query the permissions compute.firewalls.get or compute.firewalls.list.
B. Use Firewall Insights to understand your firewall rules usage patterns.
C. Reference the Security Health Analytics – Firewall Vulnerability Findings in the Security Command Center.
D. Use Policy Analyzer to query the permissions compute.firewalls.create or compute.firewalls.update or compute.firewalls.delete.
Show Answer
Correct Answer: D
Explanation: To identify principals who can change firewall rules, use Policy Analyzer to query IAM permissions that grant modification capabilities: compute.firewalls.create, compute.firewalls.update, and compute.firewalls.delete. Querying get/list only identifies read access, while Firewall Insights and Security Health Analytics analyze firewall posture and usage rather than IAM principals with modification permissions.
Question 167
You plan to synchronize identities to Cloud Identity from a third-party identity provider (IdP). You discovered that some employees used their corporate email address to set up consumer accounts to access Google services. You need to ensure that the organization has control over the configuration, security, and lifecycle of these consumer accounts.
What should you do? (Choose two.)
A. Mandate that those corporate employees delete their unmanaged consumer accounts.
B. Reconcile accounts that exist in Cloud Identity but not in the third-party IdP.
C. Evict the unmanaged consumer accounts in the third-party IdP before you sync identities.
D. Use Google Cloud Directory Sync (GCDS) to migrate the unmanaged consumer accounts' emails as user aliases.
E. Use the transfer tool to invite those corporate employees to transfer their unmanaged consumer accounts to the corporate domain.
Show Answer
Correct Answer: B, E
Explanation: Before synchronizing from a third-party IdP, reconcile existing managed accounts so the directory state aligns and orphaned or pre-existing Cloud Identity accounts are handled appropriately. To bring unmanaged consumer accounts created with corporate email addresses under organizational control, use Google's account transfer tool to invite users to transfer those accounts into the managed domain. Deleting accounts, evicting them from the IdP, or using GCDS aliases do not achieve managed ownership of the consumer accounts.
Sources:
https://cloud.google.com/architecture/landing-zones/decide-how-to-onboard-identities
Question 168
Your organization's Customers must scan and upload the contract and their driver license into a web portal in Cloud Storage. You must remove all personally identifiable information (PII) from files that are older than 12 months. Also, you must archive the anonymized files for retention purposes.
What should you do?
A. Set a time to live (TTL) of 12 months for the files in the Cloud Storage bucket that removes PII and moves the files to the archive storage class.
B. Create a Cloud Data loss Prevention (DLP) inspection job that de-identifies PII in files created more than 12 months ago and archives them to another Cloud Storage bucket. Delete the original files.
C. Configure the Autoclass feature of the Cloud Storage bucket to de-identify PII. Archive the files that are older than 12 months. Delete the original files.
D. Schedule a Cloud Key Management Service (KMS) rotation period of 12 months for the encryption keys of the Cloud Storage files containing PII to de-identify them. Delete the original keys.
Show Answer
Correct Answer: B
Explanation: Cloud Sensitive Data Protection (formerly Cloud DLP) is the Google Cloud service designed to inspect and de-identify PII in data stored in Cloud Storage. A job can target objects older than 12 months, write anonymized copies to an archive bucket, and the originals can then be deleted. Cloud Storage lifecycle/TTL and Autoclass only manage object lifecycle and storage class, not de-identification, and Cloud KMS key rotation does not anonymize data.
Question 169
You need to set up a Cloud Interconnect connection between your company’s on-premises data center and VPC host network. You want to make sure that on-premises applications can only access Google APIs over the Cloud Interconnect and not through the public internet. You are required to only use APIs that are supported by VPC Service Controls to mitigate against exfiltration risk to non-supported APIs. How should you configure the network?
A. Enable Private Google Access on the regional subnets and global dynamic routing mode.
B. Create a CNAME to map *.googleapis.com to restricted.googleapis.com, and create A records for restricted.googleapis.com mapped to 199.36.153.8/30.
C. Use private.googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the connection.
D. Use restricted googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the Cloud Interconnect connection.
Show Answer
Correct Answer: D
Explanation: To ensure on-premises systems access Google APIs only over Cloud Interconnect and to restrict access to only APIs supported by VPC Service Controls, use restricted.googleapis.com. The restricted.googleapis.com VIPs are advertised over Cloud Interconnect and only expose supported Google APIs, reducing exfiltration risk. Option A does not enforce restricted API access. Option B uses the wrong IP range for restricted.googleapis.com (it should be 199.36.153.4/30, not .8/30). Option C uses private.googleapis.com, which allows access to a broader set of Google APIs and does not meet the VPC Service Controls restriction requirement.
Question 170
Your company conducts clinical trials and needs to analyze the results of a recent study that are stored in BigQuery. The interval when the medicine was taken contains start and stop dates. The interval data is critical to the analysis, but specific dates may identify a particular batch and introduce bias. You need to obfuscate the start and end dates for each row and preserve the interval data.
What should you do?
A. Use date shifting with the context set to the unique ID of the test subject.
B. Extract the date using TimePartConfig from each date field and append a random month and year.
C. Use bucketing to shift values to a predetermined date based on the initial value.
D. Use the FFX mode of format preserving encryption (FPE) and maintain data consistency.
Show Answer
Correct Answer: A
Explanation: Date shifting is designed to obfuscate dates while preserving the duration and sequence of intervals. By using the test subject's unique ID as the context, the same deterministic shift is applied to both the start and end dates for that subject, preserving the interval while hiding the actual dates. Bucketing loses precision, TimePartConfig does not preserve intervals, and FPE preserves exact values in encrypted form rather than providing date-specific interval-preserving de-identification.
Question 171
Your organization develops software involved in many open source projects and is concerned about software supply chain threats. You need to deliver provenance for the build to demonstrate the software is untampered.
What should you do?
A. 1. Hire an external auditor to review and provide provenance. 2. Define the scope and conditions. 3. Get support from the Security department or representative. 4. Publish the attestation to your public web page.
B. 1. Review the software process. 2. Generate private and public key pairs and use Pretty Good Privacy (PGP) protocols to sign the output software artifacts together with a file containing the address of your enterprise and point of contact. 3. Publish the PGP signed attestation to your public web page.
C. 1. Publish the software code on GitHub as open source. 2. Establish a bug bounty program, and encourage the open source community to review, report, and fix the vulnerabilities.
D. 1. Generate Supply Chain Levels for Software Artifacts (SLSA) level 3 assurance by using Cloud Build. 2. View the build provenance in the Security insights side panel within the Google Cloud console.
Show Answer
Correct Answer: D
Explanation: Build provenance is a core goal of the SLSA (Supply-chain Levels for Software Artifacts) framework. Using Google Cloud Build to generate SLSA Level 3 provenance provides cryptographically verifiable build attestations demonstrating how software artifacts were produced and helping show they were not tampered with. Viewing the build provenance in the Security insights panel is the corresponding Google Cloud workflow. The other options do not provide standardized, verifiable build provenance.
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.