Professional Cloud Security Engineer Free Practice Questions — Page 18
Question 163
Your organization is moving virtual machines (VMs) to Google Cloud. You must ensure that operating system images that are used across your projects are trusted and meet your security requirements.
What should you do?
A. Implement an organization policy to enforce that boot disks can only be created from images that come from the trusted image project.
B. Implement an organization policy constraint that enables the Shielded VM service on all projects to enforce the trusted image repository usage.
C. Create a Cloud Function that is automatically triggered when a new virtual machine is created from the trusted image repository. Verify that the image is not deprecated.
D. Automate a security scanner that verifies that no common vulnerabilities and exposures (CVEs) are present in your trusted image repository.
Show Answer
Correct Answer: A
Explanation: To ensure OS images used across projects are trusted and compliant, the most effective approach is to centrally enforce image provenance. An organization policy can restrict boot disk creation so that VMs can only be created from images hosted in a designated trusted image project. This provides preventive, organization-wide enforcement. Shielded VM (B) hardens VMs but does not enforce image source. Cloud Functions (C) and vulnerability scanning (D) are reactive controls and do not prevent untrusted images from being used.
Question 164
Employees at your company use their personal computers to access your organization's Google Cloud console. You need to ensure that users can only access the Google Cloud console from their corporate-issued devices and verify that they have a valid enterprise certificate.
What should you do?
A. Implement an Access Policy in BeyondCorp Enterprise to verify the device certificate. Create an access binding with the access policy just created.
B. Implement a VPC firewall policy. Activate packet inspection and create an allow rule to validate and verify the device certificate.
C. Implement an organization policy to verify the certificate from the access context.
D. Implement an Identity and Access Management (IAM) conditional policy to verify the device certificate.
Show Answer
Correct Answer: A
Explanation: Restricting access to the Google Cloud Console based on device trust and enterprise certificates requires a zero-trust, context-aware access control mechanism. BeyondCorp Enterprise Access Policies are specifically designed to enforce device-based conditions such as corporate-issued devices and valid enterprise certificates before allowing access to Google-managed services like the Cloud Console. VPC firewall rules, organization policies, and IAM conditional policies cannot inspect or validate end-user device certificates for console access.
Question 165
Your application is deployed as a highly available, cross-region solution behind a global external HTTP(S) load balancer. You notice significant spikes in traffic from multiple IP addresses, but it is unknown whether the IPs are malicious. You are concerned about your application's availability. You want to limit traffic from these clients over a specified time interval.
What should you do?
A. Configure a throttle action by using Google Cloud Armor to limit the number of requests per client over a specified time interval.
B. Configure a rate_based_ban action by using Google Cloud Armor and set the ban_duration_sec parameter to the specified lime interval.
C. Configure a firewall rule in your VPC to throttle traffic from the identified IP addresses.
D. Configure a deny action by using Google Cloud Armor to deny the clients that issued too many requests over the specified time interval.
Show Answer
Correct Answer: A
Explanation: You want to limit (throttle) traffic over a defined time interval without blocking potentially legitimate clients. Google Cloud Armor’s throttle action is designed exactly for this use case, allowing you to cap the number of requests per client per interval while preserving availability. A rate_based_ban or deny action would block clients entirely, and VPC firewall rules cannot perform application-layer rate limiting behind a global HTTP(S) load balancer.
Question 166
For compliance reporting purposes, the internal audit department needs you to provide the list of virtual machines (VMs) that have critical operating system (OS) security updates available, but not installed. You must provide this list every six months, and you want to perform this task quickly.
What should you do?
A. Run a Security Command Center security scan on all VMs to extract a list of VMs with critical OS vulnerabilities every six months.
B. Run a gcloud CLI command from the Command Line Interface (CLI) to extract the VM's OS version information every six months.
C. Ensure that the Cloud Logging agent is installed on all VMs, and extract the OS last update log date every six months.
D. Ensure the OS Config agent is installed on all VMs and extract the patch status dashboard every six months.
Show Answer
Correct Answer: D
Explanation: OS Config (VM Manager) provides built-in patch management and compliance reporting. With the OS Config agent installed, you can directly view patch compliance and identify VMs that have critical OS security updates available but not installed via the patch status dashboard, making it fast and suitable for recurring six‑month compliance reporting. Other options either don’t provide patch compliance status or are less efficient for this requirement.
Question 167
Your organization operates Virtual Machines (VMs) with only private IPs in the Virtual Private Cloud (VPC) with internet access through Cloud NAT. Everyday, you must patch all VMs with critical OS updates and provide summary reports.
What should you do?
A. Validate that the egress firewall rules allow any outgoing traffic. Log in to each VM and execute OS specific update commands. Configure the Cloud Scheduler job to update with critical patches daily for daily updates.
B. Copy the latest patches to the Cloud Storage bucket. Log in to each VM, download the patches from the bucket, and install them.
C. Assign public IPs to VMs. Validate that the egress firewall rules allow any outgoing traffic. Log in to each VM, and configure a daily cron job to enable for OS updates at night during low activity periods.
D. Ensure that VM Manager is installed and running on the VMs. In the OS patch management service, configure the patch jobs to update with critical patches dally.
Show Answer
Correct Answer: D
Explanation: VMs have only private IPs and already reach the internet via Cloud NAT, so manual login, public IPs, or custom scripts are unnecessary and non-scalable. Google Cloud VM Manager (OS patch management) is designed to centrally automate OS patching across VM fleets, including scheduling critical updates and generating reports. Ensuring the VM Manager agent is installed and configuring daily critical patch jobs meets both the patching and reporting requirements in a secure, managed way.
Question 168
For data residency requirements, you want your secrets in Google Clouds Secret Manager to only have payloads in europe-west1 and europe-west4. Your secrets must be highly available in both regions.
What should you do?
A. Create your secret with a user managed replication policy, and choose only compliant locations.
B. Create your secret with an automatic replication policy, and choose only compliant locations.
C. Create two secrets by using Terraform, one in europe-west1 and the other in europe-west4.
D. Create your secret with an automatic replication policy, and create an organizational policy to deny secret creation in non-compliant locations.
Show Answer
Correct Answer: A
Explanation: Google Cloud Secret Manager meets strict data residency requirements only when you use **user-managed replication**. With this policy, you explicitly select the regions where secret payloads are stored. By choosing **europe-west1** and **europe-west4**, the secret is replicated across both regions for high availability while guaranteeing that payloads never leave those compliant locations. Automatic replication does not allow restricting regions, and creating multiple secrets adds unnecessary operational complexity.
Question 169
An organization wants to track how bonus compensations have changed over time to identify employee outliers and correct earning disparities. This task must be performed without exposing the sensitive compensation data for any individual and must be reversible to identify the outlier.
Which Cloud Data Loss Prevention API technique should you use?
A. Cryptographic hashing
B. Redaction
C. Format-preserving encryption
D. Generalization
Show Answer
Correct Answer: C
Explanation: The requirement is to analyze compensation trends and identify outliers over time without exposing individual values, while still being able to reverse the protection to identify the outlier when needed. Format-preserving encryption (FPE) encrypts sensitive values, keeps their original format so they can be compared, sorted, and tracked over time, and is reversible with the proper key. Hashing and redaction are not reversible, and generalization loses precision and cannot reliably identify specific outliers. Therefore, FPE is the correct technique.
Question 170
You work for a large organization where each business unit has thousands of users. You need to delegate management of access control permissions to each business unit. You have the following requirements:
✑ Each business unit manages access controls for their own projects.
✑ Each business unit manages access control permissions at scale.
✑ Business units cannot access other business units' projects.
✑ Users lose their access if they move to a different business unit or leave the company.
✑ Users and access control permissions are managed by the on-premises directory service.
What should you do? (Choose two.)
A. Use VPC Service Controls to create perimeters around each business unit's project.
B. Organize projects in folders, and assign permissions to Google groups at the folder level.
C. Group business units based on Organization Units (OUs) and manage permissions based on OUs
D. Create a project naming convention, and use Google's IAM Conditions to manage access based on the prefix of project names.
E. Use Google Cloud Directory Sync to synchronize users and group memberships in Cloud Identity.
Show Answer
Correct Answer: B, E
Explanation: Organizing projects into folders per business unit and assigning IAM roles to Google Groups at the folder level allows each unit to manage access to its own projects at scale while remaining isolated from others. Syncing users and group memberships from the on‑premises directory to Cloud Identity with Google Cloud Directory Sync ensures that access is centrally managed, automatically updated when users move between units, and removed when users leave the company.
Question 171
You need to create a VPC that enables your security team to control network resources such as firewall rules. How should you configure the network to allow for separation of duties for network resources?
A. Set up multiple VPC networks, and set up multi-NIC virtual appliances to connect the networks.
B. Set up VPC Network Peering, and allow developers to peer their network with a Shared VPC.
C. Set up a VPC in a project. Assign the Compute Network Admin role to the security team, and assign the Compute Admin role to the developers.
D. Set up a Shared VPC where the security team manages the firewall rules, and share the network with developers via service projects.
Show Answer
Correct Answer: D
Explanation: A Shared VPC centralizes network control in a host project managed by the security team, allowing them to own and manage firewall rules and other network resources. Developers use separate service projects that attach to the Shared VPC, enabling clear separation of duties while still sharing the same network.
Question 172
You are backing up application logs to a shared Cloud Storage bucket that is accessible to both the administrator and analysts. Analysts should not have access to logs that contain any personally identifiable information (PII). Log files containing PII should be stored in another bucket that is only accessible to the administrator. What should you do?
A. Upload the logs to both the shared bucket and the bucket with PII that is only accessible to the administrator. Use the Cloud Data Loss Prevention API to create a job trigger. Configure the trigger to delete any files that contain PII from the shared bucket.
B. On the shared bucket, configure Object Lifecycle Management to delete objects that contain PII.
C. On the shared bucket, configure a Cloud Storage trigger that is only triggered when PII is uploaded. Use Cloud Functions to capture the trigger and delete the files that contain PII.
D. Use Pub/Sub and Cloud Functions to trigger a Cloud Data Loss Prevention scan every time a file is uploaded to the administrator's bucket. If the scan does not detect PII, have the function move the objects into the shared Cloud Storage bucket.
Show Answer
Correct Answer: D
Explanation: The requirement is to ensure analysts never gain access to logs containing PII, while administrators retain access to all logs. The safest pattern is to ingest logs into an administrator-only bucket first, scan them for PII, and only publish non-PII logs to the shared bucket. Option D does exactly this by triggering a Cloud DLP scan on upload and moving only files without PII to the shared bucket.
Option A temporarily exposes PII to the shared bucket before deletion, which violates the access requirement. Option B is not feasible because Cloud Storage lifecycle rules cannot inspect content for PII. Option C is also unsafe because it relies on detecting and deleting PII after upload to the shared bucket, again briefly exposing sensitive data. Therefore, D is the correct and secure solution.
$19
Get all 350 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.