Professional Cloud Security Engineer Free Practice Questions — Page 2
Question 6
There is a vendor who needs access to your company's Google Cloud environment. The vendor uses a third-party identity provider (IdP). You need to integrate this IdP with your company's Google Cloud environment to enable single sign-on (SSO) for the vendor's users in the most secure way. You don't want to manage any of the vendor users' lifecycle management. What should you do?
A. Use Google Cloud Directory Sync to synchronize user accounts from the IdP to Google Workspace, and then configure SSO between Google Workspace and Google Cloud.
B. Develop a custom application that queries the IdP for user authentication and then programmatically creates Google Cloud user accounts.
C. Connect the vendor's IdP with Google Cloud using Workforce Identify Federation.
D. Create Google Cloud accounts for each user and synchronize their passwords with the third-party IdP.
Show Answer
Correct Answer: C
Explanation: This is a B2B access scenario where external users must access Google Cloud using their own IdP without managing their accounts. Workforce Identity Federation is designed for this: it federates an external IdP directly to Google Cloud, enables SSO, avoids user synchronization and lifecycle management, and is the most secure and modern approach.
Question 6
You work at a company in a regulated industry and are responsible for ongoing security of the Cloud environment. You need to prevent and detect misconfigurations in a particular folder based on specific compliance policies. You need to adhere to industry-specific compliance policies and policies that are internal to your company. What should you do?
A. Create a Posture file by using custom and predefined SHA or organization policies. Enforce the posture on the folder level.
B. Create custom organization policies that follow specific business requirements. Enforce the policies on the folder level.
C. Enable Assured Workloads on the folder level, with the specific control bundle appropriate for your industry’s regulations.
D. Use Workload Manager with custom Rego policies to continuously scan the environment for misconfigurations on the folder level.
Show Answer
Correct Answer: A
Explanation: You need both prevention and detection of misconfigurations, scoped at the folder level, while aligning with industry and internal compliance requirements. Security Health Analytics (SHA) postures are designed for this use case: they combine predefined (industry-aligned) and custom policies, continuously evaluate resources, and can be enforced at the folder level. Custom org policies alone lack detection and compliance reporting, Assured Workloads focuses on regulatory environment setup rather than ongoing misconfiguration detection, and Workload Manager is SAP-focused and does not broadly enforce cloud compliance across folders.
Question 7
Your organization is planning to deploy a large number of Google Kubernetes Engine (GKE) clusters to run business applications in different folders and projects. You must ensure that all GKE nodes always run the latest release to minimize vulnerability risk and administrative effort. What should you do?
A. After creating clusters, use the Google Cloud console gcloud container node-pools describe NODE_POOL_NAME --cluster=CLUSTER_NAME command. Examine the upgradeSettings and UpdateInfo output.
B. Create a custom organization policy constraint resource.management.autoUpgrade == true with an action type of ALLOW at the organization level before deployment.
C. Create a new node pool with the newer version for each cluster. Migrate the workload. Eliminate the outdated node pool.
D. Manually run the Google Cloud console gcloud container clusters upgrade CLUSTER_NAME--node-pool=NODE_POOL_NAME --cluster-version VERSION command on newly created clusters regularly.
Show Answer
Correct Answer: B
Explanation: The requirement is to ensure all GKE nodes always run the latest release with minimal administrative effort across many projects and folders. Enforcing node auto-upgrade at the organization level using an organization policy is a preventative, scalable, and automated control. It guarantees that all clusters and node pools are created and maintained with auto-upgrade enabled, reducing vulnerability risk without ongoing manual intervention. The other options are reactive, manual, or operationally heavy and do not scale.
Question 7
Your company’s storage team manages all product images within a specific Google Cloud project. To maintain control, you must isolate access to Cloud Storage for this project, allowing the storage team to manage restrictions at the project level. They must be restricted to using corporate computers. What should you do?
A. Use Identity and Access Management (IAM) roles at the project level within the storage team’s project. Grant the storage team granular permissions on the project’s Cloud Storage resources.
B. Employ organization-level firewall rules to block all traffic to Cloud Storage. Create exceptions for specific service accounts used by the storage team within their project.
C. Use Context-Aware Access Create an access level that defines the required context. Apply it as an organization policy specifically at the project level, restricting access to Cloud Storage based on that context.
D. Implement VPC Service Controls by establishing an organization-wide service perimeter with all projects. Configure ingress and egress rules to restrict access to Cloud Storage based on IP address ranges.
Show Answer
Correct Answer: C
Explanation: The requirement is to restrict access to Cloud Storage in a specific project so that only users on corporate computers can manage it, with controls applied at the project level. Context-Aware Access is designed for this exact use case: it allows you to define access levels based on device attributes (such as corporate-managed devices), user identity, and other context signals. These access levels can then be enforced via organization policies on Google Cloud services like Cloud Storage, scoped to a specific project.
Option A controls permissions but cannot enforce device-based restrictions. Option B uses firewall rules, which do not apply to Google-managed APIs like Cloud Storage in this way. Option D (VPC Service Controls) is meant to prevent data exfiltration and service boundary violations, not to enforce user device posture, and it is heavier than needed for this scenario.
Question 8
Your company is migrating a three-tier web application to Google Cloud. The application consists of a web frontend, an application backend, and a database. Due to regulatory requirements and existing on-premises infrastructure dependencies, you need to implement a hybrid cloud architecture. The web frontend will be hosted on Google Cloud, while the application backend and the database will remain on-premises initially. You need to ensure secure and efficient communication between the cloud-based frontend and the on-premises backend and database, minimizing latency and maximizing availability. What should you do?
A. Establish a Dedicated Interconnect connection between the Google Cloud VPC network and the on-premises network. Configure firewall rules to allow communication between the three tiers.
B. Establish a direct internet connection between the Google Cloud VPC network hosting the web frontend and the on-premises network that hosts the backend and database. Configure firewall rules to allow communication between the three tiers.
C. Replicate the on-premises backend and database to Google Cloud. Use a hybrid connectivity network endpoint group for the primary. Backup to the zonal network endpoint group.
D. Use a highly-available Cloud VPN connection over the public internet to connect the Google Cloud VPC network to the on-premises network.
Show Answer
Correct Answer: A
Explanation: A Dedicated Interconnect provides a private, high‑bandwidth, low‑latency connection between the on‑premises environment and Google Cloud, which best satisfies the requirements for secure, efficient communication, minimal latency, and high availability in a production hybrid architecture. It avoids the public internet and is the recommended solution when performance and reliability are critical. Cloud VPN (D) is less performant, B is insecure and unreliable, and C changes the architecture rather than enabling hybrid connectivity.
Question 8
Your organization uses Google Workspace as the primary identity provider for Google Cloud. Users in your organization initially created their passwords. You need to improve password security due to a recent security event. What should you do?
A. Conduct a security awareness training session, and set the password expiration settings to require more frequent updates.
B. Check the Enforce strong password box, and check Enforce password policy at the next sign-in.
C. Check the Enforce strong password box, and set the password expiration to occur more frequently.
D. Audit user activity for suspicious logins by using the audit and investigation tool.
Show Answer
Correct Answer: B
Explanation: Because Google Workspace is the identity provider and users originally set their own passwords, the most effective immediate improvement is to enforce Google’s strong password requirements and require users to comply at their next sign-in. This raises password complexity without forcing periodic expiration, which Google recommends avoiding. Auditing or training alone does not directly strengthen passwords.
Question 9
Your organization is building an application powered by generative AI that uses sensitive internal data lo train the AI model. The application is built using Vertex AI, which is generally available in your region. You must ensure Google does not use your sensitive data when tuning public models because it could result in your data being shared with other Google Cloud customers. What should you do?
A. Do not use Vertex AI for sensitive data. Use only public data with minimal privacy requirements.
B. Encrypt your data by using customer-managed encryption keys (CMEK) to have full control over encryption key access.
C. Do nothing. Vertex AI foundation models are frozen by default and do not use your data for model-tuning purposes.
D. Contact Google support to opt out of model tuning.
Show Answer
Correct Answer: C
Explanation: Vertex AI follows Google Cloud’s enterprise data governance and privacy policies. By default, customer data used with Vertex AI foundation models (including for tuning or inference) is not used to train, tune, or improve Google’s public models, and it is not shared with other customers. Therefore, no additional action is required to prevent Google from using sensitive data for public model tuning.
Question 10
Your organization is deploying a new web application on Compute Engine and needs robust perimeter security. You need to protect the application from common web attacks, including SQL injection and cross-site scripting (XSS), while also controlling network traffic based on the source IP address and user identity. What should you do?
A. Implement Cloud Load Balancing and Cloud DNS. Set up Cloud CDN to cache content and mitigate some DDoS attacks. Configure Cloud Armor to provide layer 7 protection.
B. Deploy Cloud Armor with its default WAF rules enabled. Configure network firewall rules on the Compute Engine instances to control all traffic based on source IP addresses. Use Cloud IAM to manage which users have roles granting access to the web application.
C. Use Google Cloud Armor with pre-configured WAF rules to filter malicious traffic. Implement VPC Service Controls to create a secure perimeter around the application's resources. Manage users with Cloud IAM.
D. Deploy Cloud Armor, and configure Cloud Firewall rules to control traffic based on source IP addresses. Integrate with Identity-Aware Proxy to control access based on user identity.
Show Answer
Correct Answer: D
Explanation: The requirements are: protect against common web attacks (SQL injection, XSS), control traffic by source IP, and control access by user identity. Cloud Armor provides layer 7 WAF protection against SQLi and XSS. VPC firewall rules are the correct mechanism to allow or deny traffic based on source IP addresses. Identity-Aware Proxy (IAP) is specifically designed to enforce access based on authenticated user identity and context in front of web applications. Other options either omit identity-based access control or misuse services like IAM or VPC Service Controls for application-level protection.
Question 11
Your company is in a regulated industry that requires low overhead encryption using private connectivity from on-premises data centers to Google Cloud. You need to establish connectivity and ensure high availability across multiple regions. What should you do?
A. Set up two pairs of HA VPNs using IPSec from the data centers in multiple regions.
B. Set up pairs of Cloud Interconnect connections to your data centers in multiple regions, and employ MACSec encryption.
C. Set up L2TP encryption over pairs of dedicated Cloud Interconnect connections from the data centers in multiple regions.
D. Set up IPSec encryption over Partner Interconnect connections from your data centers in multiple regions.
Show Answer
Correct Answer: B
Explanation: The requirements call for private connectivity, low-overhead encryption, and high availability across regions. Cloud Interconnect provides dedicated private connectivity, and MACsec delivers line-rate, low-overhead Layer 2 encryption suitable for regulated environments. Deploying paired Interconnects in multiple regions ensures high availability and regional redundancy.
Question 12
You manage the security logs within your cloud environment. You have configured a continuous export of security logs to Cloud Storage buckets for long-term retention. You need to provide auditors the ability to analyze the logs that were exported to Cloud Storage. Your solution must be cost-effective and quickly implemented.
What should you do?
A. Use a VM instance to download the data from Cloud Storage. Provide the auditors access to the VM and allow them to install their preferred analytics toolset.
B. Use the data in the Cloud Storage bucket as an external table in BigQuery. Provide the auditors access to the BigQuery dataset.
C. Use Dataflow to import the data from Cloud Storage into Elasticsearch. Provide the auditors with access to Elasticsearch.
D. Use a Cloud Run job to import the log data from Cloud Storage to Cloud Logging. Provide the auditors access through Log Analytics.
Show Answer
Correct Answer: B
Explanation: Using Cloud Storage data as an external table in BigQuery is the fastest and most cost-effective option. It requires no data movement or re-ingestion, is fully serverless, and lets auditors immediately analyze the logs using SQL. You only need to grant IAM access to the BigQuery dataset, avoiding the cost and operational overhead of VMs, Dataflow pipelines, or maintaining Elasticsearch or Log Analytics imports.
$19
Get all 350 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.