Professional Cloud Security Engineer Free Practice Questions — Page 2
Question 11
Your organization has recently migrated sensitive customer data to Cloud Storage buckets. For compliance reasons, you must ensure that all vendor data access and administrative access by Google personnel is logged. What should you do?
A. Configure Data Access audit logs for Cloud Storage on the project hosting the Cloud Storage buckets.
B. Enable Access Transparency for the organization.
C. Configure Data Access audit logs for Cloud Storage at the organization level.
D. Enable Access Transparency for the project hosting the Cloud Storage buckets.
Show Answer
Correct Answer: B
Explanation: Access Transparency provides logs of actions taken by Google personnel when they access customer content or perform administrative operations for support or operational reasons. Enabling it at the organization level ensures coverage across all projects, aligning with compliance requirements for logging provider access. Data Access audit logs record customer and service account access to Cloud Storage but do not satisfy the requirement to log Google personnel access.
Question 12
Your organization is implementing a Zero Trust security model and using Chrome Enterprise Premium. The company is interested in governing access to sensitive data stored in Cloud Storage. You need to configure access controls that ensure only authorized users on managed devices can access this data, regardless of their network location. Access should be restricted based on the device's security posture. This requires up-to-date operating system patches and antivirus software. What should you do?
A. Grant access to specific users to the VPC Service Controls to create a perimeter to access the Cloud Storage buckets. Configure Identity-Aware Proxy (IAP) to authenticate users before they can access the data.
B. Configure IAM conditions based on IP address ranges. Require users to connect through a VPN. Implement endpoint verification software on user devices to check for basic compliance.
C. Create an access level in Access Context Manager that requires a device policy. Create a Context-Aware Access policy using this access level. Apply the policy to the VPC Service Controls perimeter that includes the Cloud Storage buckets.
D. Use Cloud Firewall rules to restrict access to the Cloud Storage buckets based on the source IP addresses. Require users to authenticate with a multi-factor authentication method.
Show Answer
Correct Answer: C
Explanation: Access Context Manager access levels with device policy enable Context-Aware Access based on device posture (such as managed device, OS patch level, and antivirus). Applying that access level to a VPC Service Controls perimeter protecting Cloud Storage enforces that only authorized users on compliant managed devices can access the data regardless of network location.
Question 13
Your organization is using AI to improve products through innovation. The developers want to use Gemini in Vertex AI on a project. You need to provide a secure Google Cloud environment to prevent and detect information leakages. What should you do?
A. Set up VPC Service Controls perimeters around the Vertex AI project. Enable Data Loss Prevention API for content inspection.
B. Grant the developers and AI engineers the Vertex AI User role. Monitor the audit trails with Cloud Logging.
C. Deploy Model Armor to protect the Vertex AI endpoint. Review Security Command Center findings to detect information leakages.
D. Implement a firewall rule that allows all traffic to and from the Vertex AI API endpoint.
Show Answer
Correct Answer: C
Explanation: Model Armor is designed to help protect generative AI applications by detecting and filtering sensitive data, prompt injection, and other risks at the Vertex AI endpoint, which helps prevent information leakage. Security Command Center provides centralized security findings and detection capabilities. VPC Service Controls protect against service-level data exfiltration but do not inspect or filter Gemini prompts and responses, while the other options either lack prevention capabilities or are insecure.
Question 14
You are responsible for configuring Identity and Access Management in your organization's Google Cloud environment. You need to restrict your organization's users from accessing Cloud Storage buckets in other Google Cloud organizations. What should you do?
A. Set a principal access boundary policy with the appropriate enforcement version. Bind the policy to the principals of your organization.
B. Configure organization restriction headers for your environment. Only include the organization ID of your organization in the list of allowed resources.
C. Create an IAM deny policy on the organization level that prevents access to Cloud Storage buckets outside the organization.
D. Enforce domain restricted sharing in your organization. Configure a managed constraint, and only include the principals in your organization.
Show Answer
Correct Answer: A
Explanation: Principal Access Boundary (PAB) policies are designed to limit the resources that specified principals can access, regardless of IAM permissions granted elsewhere. Binding a PAB to your organization's users and restricting the resource boundary to your organization prevents them from accessing Cloud Storage buckets in other organizations. Organization restriction headers are intended for API requests from controlled network environments and are not the primary IAM control for principals. IAM deny policies cannot generally express 'outside this organization' as a broad resource boundary in this way, and Domain Restricted Sharing restricts who can be added to IAM policies on your resources rather than preventing your users from accessing external resources.
Question 15
Your organization is storing regulated data in Cloud Storage. Data in Cloud Storage buckets is encrypted by Google-managed encryption keys. To meet compliance requirements, you need to update the existing data to use customer-managed encryption keys instead. What should you do?
A. Create a new key ring and key in the Cloud Key Management Service. In each Cloud Storage bucket configuration, change the encryption type to customer-managed encryption key.
B. Identify which projects contain Cloud Storage buckets with regulated data. Apply the restrictNonCmekServices organization policy constraint to the identified projects or parent folder.
C. Create a new key ring and key in the Cloud Key Management Service. Identify which projects contain Cloud Storage buckets with regulated data. Perform a write action on all existing objects in the buckets.
D. Create a customer-managed encryption key. Change the encryption type in each Cloud Storage bucket configuration to the newly created key. Perform a write action on all existing objects in the buckets.
Show Answer
Correct Answer: D
Explanation: Existing Cloud Storage objects encrypted with Google-managed keys are not automatically re-encrypted when you configure a bucket to use a customer-managed encryption key (CMEK). You must create/configure a CMEK, set it as the bucket's default encryption key for future writes, and rewrite (perform a write action on) existing objects so they are re-encrypted with the CMEK. Organization policy constraints do not retroactively re-encrypt existing data, and changing only the bucket setting is insufficient for existing objects.
Question 16
There is a vendor who needs access to your company's Google Cloud environment. The vendor uses a third-party identity provider (IdP). You need to integrate this IdP with your company's Google Cloud environment to enable single sign-on (SSO) for the vendor's users in the most secure way. You don't want to manage any of the vendor users' lifecycle management. What should you do?
A. Use Google Cloud Directory Sync to synchronize user accounts from the IdP to Google Workspace, and then configure SSO between Google Workspace and Google Cloud.
B. Develop a custom application that queries the IdP for user authentication and then programmatically creates Google Cloud user accounts.
C. Connect the vendor's IdP with Google Cloud using Workforce Identify Federation.
D. Create Google Cloud accounts for each user and synchronize their passwords with the third-party IdP.
Show Answer
Correct Answer: C
Explanation: Workforce Identity Federation is designed for external users from a third-party identity provider to access Google Cloud using their existing identities without creating or synchronizing Google accounts. This enables SSO while leaving user lifecycle management with the vendor, making it the most secure and appropriate solution for a B2B access scenario.
Question 17
Your organization is planning to deploy a large number of Google Kubernetes Engine (GKE) clusters to run business applications in different folders and projects. You must ensure that all GKE nodes always run the latest release to minimize vulnerability risk and administrative effort. What should you do?
A. After creating clusters, use the Google Cloud console gcloud container node-pools describe NODE_POOL_NAME --cluster=CLUSTER_NAME command. Examine the upgradeSettings and UpdateInfo output.
B. Create a custom organization policy constraint resource.management.autoUpgrade == true with an action type of ALLOW at the organization level before deployment.
C. Create a new node pool with the newer version for each cluster. Migrate the workload. Eliminate the outdated node pool.
D. Manually run the Google Cloud console gcloud container clusters upgrade CLUSTER_NAME--node-pool=NODE_POOL_NAME --cluster-version VERSION command on newly created clusters regularly.
Show Answer
Correct Answer: B
Explanation: The requirement is to ensure GKE nodes automatically stay on the latest supported releases across many clusters with minimal administrative effort. Enforcing automatic node auto-upgrade through an organization-level policy provides centralized governance and prevents non-compliant deployments. The other options are either observational (A) or require ongoing manual operations (C, D).
Question 18
Your company is migrating a three-tier web application to Google Cloud. The application consists of a web frontend, an application backend, and a database. Due to regulatory requirements and existing on-premises infrastructure dependencies, you need to implement a hybrid cloud architecture. The web frontend will be hosted on Google Cloud, while the application backend and the database will remain on-premises initially. You need to ensure secure and efficient communication between the cloud-based frontend and the on-premises backend and database, minimizing latency and maximizing availability. What should you do?
A. Establish a Dedicated Interconnect connection between the Google Cloud VPC network and the on-premises network. Configure firewall rules to allow communication between the three tiers.
B. Establish a direct internet connection between the Google Cloud VPC network hosting the web frontend and the on-premises network that hosts the backend and database. Configure firewall rules to allow communication between the three tiers.
C. Replicate the on-premises backend and database to Google Cloud. Use a hybrid connectivity network endpoint group for the primary. Backup to the zonal network endpoint group.
D. Use a highly-available Cloud VPN connection over the public internet to connect the Google Cloud VPC network to the on-premises network.
Show Answer
Correct Answer: A
Explanation: Dedicated Interconnect provides private, dedicated connectivity between on-premises infrastructure and Google Cloud with the lowest and most consistent latency, high bandwidth, and high availability when properly deployed. It avoids the public internet, making it the best fit for a production hybrid architecture where minimizing latency and maximizing availability are key. HA Cloud VPN is secure and highly available but still traverses the public internet, so latency is less predictable. A direct internet connection is neither the recommended secure hybrid approach nor optimal for latency. Replicating the backend and database to Google Cloud changes the stated architecture rather than providing the required hybrid connectivity.
Question 19
Your organization is building an application powered by generative AI that uses sensitive internal data lo train the AI model. The application is built using Vertex AI, which is generally available in your region. You must ensure Google does not use your sensitive data when tuning public models because it could result in your data being shared with other Google Cloud customers. What should you do?
A. Do not use Vertex AI for sensitive data. Use only public data with minimal privacy requirements.
B. Encrypt your data by using customer-managed encryption keys (CMEK) to have full control over encryption key access.
C. Do nothing. Vertex AI foundation models are frozen by default and do not use your data for model-tuning purposes.
D. Contact Google support to opt out of model tuning.
Show Answer
Correct Answer: C
Explanation: Vertex AI enterprise generative AI services are designed so that customer prompts, responses, and tuning data are not used to train or improve Google's public foundation models. Tuned models remain private to the customer's project, so no opt-out action is required for this concern.
Question 20
Your organization is deploying a new web application on Compute Engine and needs robust perimeter security. You need to protect the application from common web attacks, including SQL injection and cross-site scripting (XSS), while also controlling network traffic based on the source IP address and user identity. What should you do?
A. Implement Cloud Load Balancing and Cloud DNS. Set up Cloud CDN to cache content and mitigate some DDoS attacks. Configure Cloud Armor to provide layer 7 protection.
B. Deploy Cloud Armor with its default WAF rules enabled. Configure network firewall rules on the Compute Engine instances to control all traffic based on source IP addresses. Use Cloud IAM to manage which users have roles granting access to the web application.
C. Use Google Cloud Armor with pre-configured WAF rules to filter malicious traffic. Implement VPC Service Controls to create a secure perimeter around the application's resources. Manage users with Cloud IAM.
D. Deploy Cloud Armor, and configure Cloud Firewall rules to control traffic based on source IP addresses. Integrate with Identity-Aware Proxy to control access based on user identity.
Show Answer
Correct Answer: D
Explanation: Cloud Armor provides WAF protection against common web attacks such as SQL injection and XSS. VPC firewall rules (Cloud Firewall) control network traffic based on source IP addresses. Identity-Aware Proxy (IAP) is the appropriate service to enforce application access based on authenticated user identity. Cloud IAM manages permissions to Google Cloud resources, not end-user access to the web application, and VPC Service Controls protect supported Google-managed services rather than acting as a web application perimeter.
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.