Professional Cloud Security Engineer Free Practice Questions — Page 3
Question 18
Your company is migrating a three-tier web application to Google Cloud. The application consists of a web frontend, an application backend, and a database. Due to regulatory requirements and existing on-premises infrastructure dependencies, you need to implement a hybrid cloud architecture. The web frontend will be hosted on Google Cloud, while the application backend and the database will remain on-premises initially. You need to ensure secure and efficient communication between the cloud-based frontend and the on-premises backend and database, minimizing latency and maximizing availability. What should you do?
A. Establish a Dedicated Interconnect connection between the Google Cloud VPC network and the on-premises network. Configure firewall rules to allow communication between the three tiers.
B. Establish a direct internet connection between the Google Cloud VPC network hosting the web frontend and the on-premises network that hosts the backend and database. Configure firewall rules to allow communication between the three tiers.
C. Replicate the on-premises backend and database to Google Cloud. Use a hybrid connectivity network endpoint group for the primary. Backup to the zonal network endpoint group.
D. Use a highly-available Cloud VPN connection over the public internet to connect the Google Cloud VPC network to the on-premises network.
Show Answer
Correct Answer: A
Explanation: Dedicated Interconnect provides private, dedicated connectivity between on-premises infrastructure and Google Cloud with the lowest and most consistent latency, high bandwidth, and high availability when properly deployed. It avoids the public internet, making it the best fit for a production hybrid architecture where minimizing latency and maximizing availability are key. HA Cloud VPN is secure and highly available but still traverses the public internet, so latency is less predictable. A direct internet connection is neither the recommended secure hybrid approach nor optimal for latency. Replicating the backend and database to Google Cloud changes the stated architecture rather than providing the required hybrid connectivity.
Question 19
Your organization is building an application powered by generative AI that uses sensitive internal data lo train the AI model. The application is built using Vertex AI, which is generally available in your region. You must ensure Google does not use your sensitive data when tuning public models because it could result in your data being shared with other Google Cloud customers. What should you do?
A. Do not use Vertex AI for sensitive data. Use only public data with minimal privacy requirements.
B. Encrypt your data by using customer-managed encryption keys (CMEK) to have full control over encryption key access.
C. Do nothing. Vertex AI foundation models are frozen by default and do not use your data for model-tuning purposes.
D. Contact Google support to opt out of model tuning.
Show Answer
Correct Answer: C
Explanation: Vertex AI enterprise generative AI services are designed so that customer prompts, responses, and tuning data are not used to train or improve Google's public foundation models. Tuned models remain private to the customer's project, so no opt-out action is required for this concern.
Question 20
Your organization is deploying a new web application on Compute Engine and needs robust perimeter security. You need to protect the application from common web attacks, including SQL injection and cross-site scripting (XSS), while also controlling network traffic based on the source IP address and user identity. What should you do?
A. Implement Cloud Load Balancing and Cloud DNS. Set up Cloud CDN to cache content and mitigate some DDoS attacks. Configure Cloud Armor to provide layer 7 protection.
B. Deploy Cloud Armor with its default WAF rules enabled. Configure network firewall rules on the Compute Engine instances to control all traffic based on source IP addresses. Use Cloud IAM to manage which users have roles granting access to the web application.
C. Use Google Cloud Armor with pre-configured WAF rules to filter malicious traffic. Implement VPC Service Controls to create a secure perimeter around the application's resources. Manage users with Cloud IAM.
D. Deploy Cloud Armor, and configure Cloud Firewall rules to control traffic based on source IP addresses. Integrate with Identity-Aware Proxy to control access based on user identity.
Show Answer
Correct Answer: D
Explanation: Cloud Armor provides WAF protection against common web attacks such as SQL injection and XSS. VPC firewall rules (Cloud Firewall) control network traffic based on source IP addresses. Identity-Aware Proxy (IAP) is the appropriate service to enforce application access based on authenticated user identity. Cloud IAM manages permissions to Google Cloud resources, not end-user access to the web application, and VPC Service Controls protect supported Google-managed services rather than acting as a web application perimeter.
Question 21
Your company is in a regulated industry that requires low overhead encryption using private connectivity from on-premises data centers to Google Cloud. You need to establish connectivity and ensure high availability across multiple regions. What should you do?
A. Set up two pairs of HA VPNs using IPSec from the data centers in multiple regions.
B. Set up pairs of Cloud Interconnect connections to your data centers in multiple regions, and employ MACSec encryption.
C. Set up L2TP encryption over pairs of dedicated Cloud Interconnect connections from the data centers in multiple regions.
D. Set up IPSec encryption over Partner Interconnect connections from your data centers in multiple regions.
Show Answer
Correct Answer: B
Explanation: The requirements are private connectivity, low-overhead encryption, regulatory compliance, and high availability across multiple regions. Dedicated or Partner Cloud Interconnect provides private connectivity, but only Dedicated Cloud Interconnect supports MACsec encryption, which offers line-rate Layer 2 encryption with much lower overhead than IPsec. Using paired Cloud Interconnect connections in multiple regions provides the required high availability. HA VPN uses IPsec with higher overhead, L2TP is not the appropriate solution here, and Partner Interconnect does not provide MACsec; adding IPsec over it increases overhead.
Question 22
You manage the security logs within your cloud environment. You have configured a continuous export of security logs to Cloud Storage buckets for long-term retention. You need to provide auditors the ability to analyze the logs that were exported to Cloud Storage. Your solution must be cost-effective and quickly implemented.
What should you do?
A. Use a VM instance to download the data from Cloud Storage. Provide the auditors access to the VM and allow them to install their preferred analytics toolset.
B. Use the data in the Cloud Storage bucket as an external table in BigQuery. Provide the auditors access to the BigQuery dataset.
C. Use Dataflow to import the data from Cloud Storage into Elasticsearch. Provide the auditors with access to Elasticsearch.
D. Use a Cloud Run job to import the log data from Cloud Storage to Cloud Logging. Provide the auditors access through Log Analytics.
Show Answer
Correct Answer: B
Explanation: Using Cloud Storage data as an external table in BigQuery is the fastest and most cost-effective approach. It avoids copying or re-ingesting log data, enables immediate SQL-based analysis over the exported logs, and only requires granting auditors appropriate BigQuery access. The other options require additional infrastructure or data movement, increasing cost and implementation effort.
Question 23
Your organization currently uses a third-party identity provider (IdP) that only requires a username and password for authentication. You need to enforce 2-step verification (2SV) for the Super admins in Cloud Identity. What should you do?
A. Create an organizational unit (OU) for Super admins, and enable 2SV within Cloud Identity for the OU.
B. Collaborate with the third-party IdP to enable 2SV for Super admins while maintaining the current Cloud Identity configuration.
C. Implement monitoring tools to track the authentication methods used by Super admins in Cloud Identity. Alert on those not using 2SV.
D. Evaluate the 2SV options for Super admins offered by both the third-party IdP and Cloud Identity. Implement the solution that provides the strongest second factor.
Show Answer
Correct Answer: A
Explanation: Cloud Identity best practices recommend creating a dedicated organizational unit (OU) for super admins and enforcing 2-step verification (2SV) on that OU. This directly satisfies the requirement to enforce 2SV for privileged accounts, even when using a third-party IdP.
Sources:
https://cloud.google.com/docs/security/security-best-practices-genai/cloud-identity-controls
Question 24
Your organization has a hybrid cloud environment with a data center connected to Google Cloud through a dedicated Cloud Interconnect connection. You need to configure private access from your on-premises hosts to Google APIs, specifically Cloud Storage and BigQuery, without exposing traffic to the public internet. What should you do?
A. Configure Shared VPC to extend your Google Cloud VPC network to your on-premises environment. Use Private Google Access to access Google APIs.
B. Establish VPC peering between your on-premises network and your Google Cloud VPC network. Configure Cloud Firewall rules to allow traffic to Google API IP ranges.
C. Use Private Google Access for on-premises hosts. Configure DNS resolution to point to the private.googleapis.com domain.
D. Configure Cloud NAT on your on-premises network. Configure DNS records in a private DNS zone to send requests to 199.36.153.8/30 to access Google APIs.
Show Answer
Correct Answer: C
Explanation: Private Google Access for on-premises hosts is the Google Cloud feature that enables privately routed access to supported Google APIs over Cloud Interconnect or Cloud VPN. It requires configuring DNS so that googleapis.com resolves to the private.googleapis.com endpoint. Shared VPC, VPC peering, and Cloud NAT do not provide this functionality for on-premises access.
Question 25
A batch job running on Compute Engine needs temporary write access to a Cloud Storage bucket. You want the batch job to use the minimum permissions necessary to complete the task. What should you do?
A. Create a service account with full Cloud Storage administrator permissions. Assign the service account to the Compute Engine instance.
B. Create a service account and embed a long-lived service account key file that has write permissions specified directly in the batch job script.
C. Create a service account with the storage.objectCreator role. Use service account impersonation in the batch job's code.
D. Grant the predefined storage.objectCreator role to the Compute Engine instance's default service account.
Show Answer
Correct Answer: C
Explanation: Use a dedicated service account with the minimal required IAM role, storage.objectCreator, so the job can only create objects. Avoid long-lived service account keys, and prefer service account impersonation or attached credentials over embedded keys. Full admin permissions violate least privilege, and granting the role to the default Compute Engine service account is broader than using a dedicated identity.
Question 26
Your organization uses a microservices architecture based on Google Kubernetes Engine (GKE). Recent security reviews recommend tighter controls around deployed container images to reduce potential vulnerabilities and maintain compliance. You need to implement an automated system by using managed services to ensure that only approved container images are deployed to the GKE clusters. What should you do?
A. Develop custom organization policies that restrict GKE cluster deployments to container images hosted within a specific Artifact Registry project where your approved images reside.
B. Enforce Binary Authorization in your GKE clusters. Integrate container image vulnerability scanning into the CI/CD pipeline and require vulnerability scan results to be used for Binary Authorization policy decisions.
C. Automatically deploy new container images upon successful CI/CD builds by using Cloud Build triggers. Set up firewall rules to limit and control access to instances to mitigate malware injection.
D. Build a system using third-party vulnerability databases and custom scripts to identify potential Common Vulnerabilities and Exposures (CVEs) in your container images. Prevent image deployment if the CVE impact score is beyond a specified threshold.
Show Answer
Correct Answer: B
Explanation: Binary Authorization is the managed Google Cloud service designed to enforce deploy-time policies so that only trusted container images can run on GKE. Integrating vulnerability scanning into the CI/CD pipeline and using attestations or policy decisions with Binary Authorization provides automated enforcement to reduce vulnerabilities and support compliance. Restricting registries alone does not ensure images are approved or secure, while the other options rely on incomplete or custom controls.
Question 27
Your organization has a workload that is regulated by European laws. You must restrict the creation of resources outside of the EU for this specific workload. You must find an effective way to implement this security control without disrupting the other global applications. What should you do?
A. Create a Cloud Function triggered at asset creation that detects and deletes resources outside of the EU.
B. Create all your workload’s assets in a regional subnet in the EU in one project or folder.
C. Segment your workload in the EU in one project or folder by using VPC Service Controls.
D. Implement an organization policy that only allows the EU as the location for your workload’s project or folder.
Show Answer
Correct Answer: D
Explanation: Use a Google Cloud Organization Policy with resource location constraints applied at the specific project or folder for the regulated workload. This restricts creation of supported resources to EU locations without affecting other global applications. The other options are reactive, do not enforce location restrictions, or address different security concerns.
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.