Professional Cloud Security Engineer Free Practice Questions — Page 2
Question 7
You work at a company in a regulated industry and are responsible for ongoing security of the Cloud environment. You need to prevent and detect misconfigurations in a particular folder based on specific compliance policies. You need to adhere to industry-specific compliance policies and policies that are internal to your company. What should you do?
A. Create a Posture file by using custom and predefined SHA or organization policies. Enforce the posture on the folder level.
B. Create custom organization policies that follow specific business requirements. Enforce the policies on the folder level.
C. Enable Assured Workloads on the folder level, with the specific control bundle appropriate for your industry’s regulations.
D. Use Workload Manager with custom Rego policies to continuously scan the environment for misconfigurations on the folder level.
Show Answer
Correct Answer: A
Explanation: Security Command Center Enterprise Posture lets you define a posture using predefined security posture templates and custom policies (including Security Health Analytics detectors and organization policy constraints) and enforce it at the organization, folder, or project level to prevent and detect misconfigurations. This best matches the requirement to combine industry-specific compliance with internal policies at the folder level.
Question 8
Your company’s storage team manages all product images within a specific Google Cloud project. To maintain control, you must isolate access to Cloud Storage for this project, allowing the storage team to manage restrictions at the project level. They must be restricted to using corporate computers. What should you do?
A. Use Identity and Access Management (IAM) roles at the project level within the storage team’s project. Grant the storage team granular permissions on the project’s Cloud Storage resources.
B. Employ organization-level firewall rules to block all traffic to Cloud Storage. Create exceptions for specific service accounts used by the storage team within their project.
C. Use Context-Aware Access Create an access level that defines the required context. Apply it as an organization policy specifically at the project level, restricting access to Cloud Storage based on that context.
D. Implement VPC Service Controls by establishing an organization-wide service perimeter with all projects. Configure ingress and egress rules to restrict access to Cloud Storage based on IP address ranges.
Show Answer
Correct Answer: C
Explanation: Context-Aware Access can enforce access based on device and other contextual attributes, such as requiring managed corporate computers. Applying the access level to the relevant project allows the storage team to manage project-level Cloud Storage access while restricting use to corporate-managed devices. IAM alone cannot enforce device context, firewall rules do not control Cloud Storage access this way, and VPC Service Controls protect against data exfiltration rather than enforcing end-user managed-device access.
Question 9
Your organization uses Google Workspace as the primary identity provider for Google Cloud. Users in your organization initially created their passwords. You need to improve password security due to a recent security event. What should you do?
A. Conduct a security awareness training session, and set the password expiration settings to require more frequent updates.
B. Check the Enforce strong password box, and check Enforce password policy at the next sign-in.
C. Check the Enforce strong password box, and set the password expiration to occur more frequently.
D. Audit user activity for suspicious logins by using the audit and investigation tool.
Show Answer
Correct Answer: B
Explanation: Enforcing strong password requirements improves password quality, and forcing the password policy at the next sign-in ensures existing user-created passwords are updated immediately. Simply shortening password expiration is no longer considered a best practice and does not address weak existing passwords. Auditing logins is useful for detection, not for improving password security after the incident.
Question 10
Your global defense company is migrating top-secret classified data to BigQuery and Cloud Storage. National security regulations demand that master encryption key material never leaves the accredited on-premises cryptographic hardware. You must retain the unilateral ability to revoke data access, independent of any cloud provider. What should you do?
A. Use customer-managed encryption keys (CMEKs) for the BigQuery datasets and Cloud Storage buckets. Store the keys in Cloud Key Management Service (Cloud KMS).
B. Use customer-supplied encryption keys (CSEKs) by providing your own encryption keys with each data operation in Cloud Storage and BigQuery.
C. Import existing on-premises master encryption keys into Cloud Key Management Service (Cloud KMS). Use the imported keys for BigQuery and Cloud Storage encryption.
D. Configure Cloud External Key Manager (Cloud EKM) for the BigQuery datasets and Cloud Storage buckets. Integrate EKM with your existing on-premises hardware security modules (HSMs).
Show Answer
Correct Answer: D
Explanation: Cloud External Key Manager (Cloud EKM) is designed for scenarios where encryption key material must remain outside Google Cloud, such as in on-premises HSMs. It enables BigQuery and Cloud Storage to use externally managed keys while ensuring the master key material never leaves the accredited hardware. Because access depends on the external key service, you can unilaterally revoke key access independently of the cloud provider. CMEK and imported Cloud KMS keys place key material in Google Cloud, and CSEKs are not supported for BigQuery and do not satisfy the stated requirements across both services.
Question 12
Your organization is implementing a Zero Trust security model and using Chrome Enterprise Premium. The company is interested in governing access to sensitive data stored in Cloud Storage. You need to configure access controls that ensure only authorized users on managed devices can access this data, regardless of their network location. Access should be restricted based on the device's security posture. This requires up-to-date operating system patches and antivirus software. What should you do?
A. Grant access to specific users to the VPC Service Controls to create a perimeter to access the Cloud Storage buckets. Configure Identity-Aware Proxy (IAP) to authenticate users before they can access the data.
B. Configure IAM conditions based on IP address ranges. Require users to connect through a VPN. Implement endpoint verification software on user devices to check for basic compliance.
C. Create an access level in Access Context Manager that requires a device policy. Create a Context-Aware Access policy using this access level. Apply the policy to the VPC Service Controls perimeter that includes the Cloud Storage buckets.
D. Use Cloud Firewall rules to restrict access to the Cloud Storage buckets based on the source IP addresses. Require users to authenticate with a multi-factor authentication method.
Show Answer
Correct Answer: C
Explanation: Access Context Manager access levels with device policy enable Context-Aware Access based on device posture (such as managed device, OS patch level, and antivirus). Applying that access level to a VPC Service Controls perimeter protecting Cloud Storage enforces that only authorized users on compliant managed devices can access the data regardless of network location.
Question 13
Your organization is using AI to improve products through innovation. The developers want to use Gemini in Vertex AI on a project. You need to provide a secure Google Cloud environment to prevent and detect information leakages. What should you do?
A. Set up VPC Service Controls perimeters around the Vertex AI project. Enable Data Loss Prevention API for content inspection.
B. Grant the developers and AI engineers the Vertex AI User role. Monitor the audit trails with Cloud Logging.
C. Deploy Model Armor to protect the Vertex AI endpoint. Review Security Command Center findings to detect information leakages.
D. Implement a firewall rule that allows all traffic to and from the Vertex AI API endpoint.
Show Answer
Correct Answer: C
Explanation: Model Armor is designed to help protect generative AI applications by detecting and filtering sensitive data, prompt injection, and other risks at the Vertex AI endpoint, which helps prevent information leakage. Security Command Center provides centralized security findings and detection capabilities. VPC Service Controls protect against service-level data exfiltration but do not inspect or filter Gemini prompts and responses, while the other options either lack prevention capabilities or are insecure.
Question 14
You are responsible for configuring Identity and Access Management in your organization's Google Cloud environment. You need to restrict your organization's users from accessing Cloud Storage buckets in other Google Cloud organizations. What should you do?
A. Set a principal access boundary policy with the appropriate enforcement version. Bind the policy to the principals of your organization.
B. Configure organization restriction headers for your environment. Only include the organization ID of your organization in the list of allowed resources.
C. Create an IAM deny policy on the organization level that prevents access to Cloud Storage buckets outside the organization.
D. Enforce domain restricted sharing in your organization. Configure a managed constraint, and only include the principals in your organization.
Show Answer
Correct Answer: A
Explanation: Principal Access Boundary (PAB) policies are designed to limit the resources that specified principals can access, regardless of IAM permissions granted elsewhere. Binding a PAB to your organization's users and restricting the resource boundary to your organization prevents them from accessing Cloud Storage buckets in other organizations. Organization restriction headers are intended for API requests from controlled network environments and are not the primary IAM control for principals. IAM deny policies cannot generally express 'outside this organization' as a broad resource boundary in this way, and Domain Restricted Sharing restricts who can be added to IAM policies on your resources rather than preventing your users from accessing external resources.
Question 15
Your organization is storing regulated data in Cloud Storage. Data in Cloud Storage buckets is encrypted by Google-managed encryption keys. To meet compliance requirements, you need to update the existing data to use customer-managed encryption keys instead. What should you do?
A. Create a new key ring and key in the Cloud Key Management Service. In each Cloud Storage bucket configuration, change the encryption type to customer-managed encryption key.
B. Identify which projects contain Cloud Storage buckets with regulated data. Apply the restrictNonCmekServices organization policy constraint to the identified projects or parent folder.
C. Create a new key ring and key in the Cloud Key Management Service. Identify which projects contain Cloud Storage buckets with regulated data. Perform a write action on all existing objects in the buckets.
D. Create a customer-managed encryption key. Change the encryption type in each Cloud Storage bucket configuration to the newly created key. Perform a write action on all existing objects in the buckets.
Show Answer
Correct Answer: D
Explanation: Existing Cloud Storage objects encrypted with Google-managed keys are not automatically re-encrypted when you configure a bucket to use a customer-managed encryption key (CMEK). You must create/configure a CMEK, set it as the bucket's default encryption key for future writes, and rewrite (perform a write action on) existing objects so they are re-encrypted with the CMEK. Organization policy constraints do not retroactively re-encrypt existing data, and changing only the bucket setting is insufficient for existing objects.
Question 16
There is a vendor who needs access to your company's Google Cloud environment. The vendor uses a third-party identity provider (IdP). You need to integrate this IdP with your company's Google Cloud environment to enable single sign-on (SSO) for the vendor's users in the most secure way. You don't want to manage any of the vendor users' lifecycle management. What should you do?
A. Use Google Cloud Directory Sync to synchronize user accounts from the IdP to Google Workspace, and then configure SSO between Google Workspace and Google Cloud.
B. Develop a custom application that queries the IdP for user authentication and then programmatically creates Google Cloud user accounts.
C. Connect the vendor's IdP with Google Cloud using Workforce Identify Federation.
D. Create Google Cloud accounts for each user and synchronize their passwords with the third-party IdP.
Show Answer
Correct Answer: C
Explanation: Workforce Identity Federation is designed for external users from a third-party identity provider to access Google Cloud using their existing identities without creating or synchronizing Google accounts. This enables SSO while leaving user lifecycle management with the vendor, making it the most secure and appropriate solution for a B2B access scenario.
Question 17
Your organization is planning to deploy a large number of Google Kubernetes Engine (GKE) clusters to run business applications in different folders and projects. You must ensure that all GKE nodes always run the latest release to minimize vulnerability risk and administrative effort. What should you do?
A. After creating clusters, use the Google Cloud console gcloud container node-pools describe NODE_POOL_NAME --cluster=CLUSTER_NAME command. Examine the upgradeSettings and UpdateInfo output.
B. Create a custom organization policy constraint resource.management.autoUpgrade == true with an action type of ALLOW at the organization level before deployment.
C. Create a new node pool with the newer version for each cluster. Migrate the workload. Eliminate the outdated node pool.
D. Manually run the Google Cloud console gcloud container clusters upgrade CLUSTER_NAME--node-pool=NODE_POOL_NAME --cluster-version VERSION command on newly created clusters regularly.
Show Answer
Correct Answer: B
Explanation: The requirement is to ensure GKE nodes automatically stay on the latest supported releases across many clusters with minimal administrative effort. Enforcing automatic node auto-upgrade through an organization-level policy provides centralized governance and prevents non-compliant deployments. The other options are either observational (A) or require ongoing manual operations (C, D).
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.