Professional Cloud Security Engineer Free Practice Questions — Page 3
Question 13
Your organization currently uses a third-party identity provider (IdP) that only requires a username and password for authentication. You need to enforce 2-step verification (2SV) for the Super admins in Cloud Identity. What should you do?
A. Create an organizational unit (OU) for Super admins, and enable 2SV within Cloud Identity for the OU.
B. Collaborate with the third-party IdP to enable 2SV for Super admins while maintaining the current Cloud Identity configuration.
C. Implement monitoring tools to track the authentication methods used by Super admins in Cloud Identity. Alert on those not using 2SV.
D. Evaluate the 2SV options for Super admins offered by both the third-party IdP and Cloud Identity. Implement the solution that provides the strongest second factor.
Show Answer
Correct Answer: B
Explanation: When Cloud Identity is configured to use a third-party IdP for authentication, Google cannot enforce 2‑Step Verification itself. Authentication controls, including 2SV, must be implemented at the IdP. Since the IdP currently only uses username and password, you must work with the IdP to enable 2SV for Super admins. Creating OUs or enabling 2SV in Cloud Identity will not override third‑party authentication.
Question 14
Your organization has a hybrid cloud environment with a data center connected to Google Cloud through a dedicated Cloud Interconnect connection. You need to configure private access from your on-premises hosts to Google APIs, specifically Cloud Storage and BigQuery, without exposing traffic to the public internet. What should you do?
A. Configure Shared VPC to extend your Google Cloud VPC network to your on-premises environment. Use Private Google Access to access Google APIs.
B. Establish VPC peering between your on-premises network and your Google Cloud VPC network. Configure Cloud Firewall rules to allow traffic to Google API IP ranges.
C. Use Private Google Access for on-premises hosts. Configure DNS resolution to point to the private.googleapis.com domain.
D. Configure Cloud NAT on your on-premises network. Configure DNS records in a private DNS zone to send requests to 199.36.153.8/30 to access Google APIs.
Show Answer
Correct Answer: C
Explanation: To provide private access from on-premises hosts to Google APIs over a dedicated Cloud Interconnect, you must use Private Google Access for on-premises. This is achieved by configuring on-premises DNS to resolve Google API endpoints to private.googleapis.com, which maps to the special IP range 199.36.153.8/30. Traffic to these addresses is routed over the private interconnect and never traverses the public internet. Other options describe unsupported or incorrect mechanisms (Shared VPC, VPC peering with on-prem, or Cloud NAT) for this requirement.
Question 15
A batch job running on Compute Engine needs temporary write access to a Cloud Storage bucket. You want the batch job to use the minimum permissions necessary to complete the task. What should you do?
A. Create a service account with full Cloud Storage administrator permissions. Assign the service account to the Compute Engine instance.
B. Create a service account and embed a long-lived service account key file that has write permissions specified directly in the batch job script.
C. Create a service account with the storage.objectCreator role. Use service account impersonation in the batch job's code.
D. Grant the predefined storage.objectCreator role to the Compute Engine instance's default service account.
Show Answer
Correct Answer: C
Explanation: The job only needs to create objects in Cloud Storage, so the predefined storage.objectCreator role provides the minimum required permission. Using a service account without long‑lived keys and accessing it at runtime (via impersonation) avoids embedding credentials and follows least‑privilege and security best practices. The other options either grant excessive permissions or rely on insecure key handling.
Question 16
Your organization uses a microservices architecture based on Google Kubernetes Engine (GKE). Recent security reviews recommend tighter controls around deployed container images to reduce potential vulnerabilities and maintain compliance. You need to implement an automated system by using managed services to ensure that only approved container images are deployed to the GKE clusters. What should you do?
A. Develop custom organization policies that restrict GKE cluster deployments to container images hosted within a specific Artifact Registry project where your approved images reside.
B. Enforce Binary Authorization in your GKE clusters. Integrate container image vulnerability scanning into the CI/CD pipeline and require vulnerability scan results to be used for Binary Authorization policy decisions.
C. Automatically deploy new container images upon successful CI/CD builds by using Cloud Build triggers. Set up firewall rules to limit and control access to instances to mitigate malware injection.
D. Build a system using third-party vulnerability databases and custom scripts to identify potential Common Vulnerabilities and Exposures (CVEs) in your container images. Prevent image deployment if the CVE impact score is beyond a specified threshold.
Show Answer
Correct Answer: B
Explanation: Binary Authorization is a managed GKE feature specifically designed to ensure that only trusted, policy-compliant container images are deployed. By integrating vulnerability scanning into the CI/CD pipeline and enforcing Binary Authorization policies at deployment time, you get automated, centralized control that blocks unapproved or vulnerable images. This directly addresses the requirement for tighter image controls, reduced vulnerabilities, and compliance, without custom tooling. Other options either lack enforcement at deployment time or rely on custom or indirect controls.
Question 17
Your organization has a workload that is regulated by European laws. You must restrict the creation of resources outside of the EU for this specific workload. You must find an effective way to implement this security control without disrupting the other global applications. What should you do?
A. Create a Cloud Function triggered at asset creation that detects and deletes resources outside of the EU.
B. Create all your workload’s assets in a regional subnet in the EU in one project or folder.
C. Segment your workload in the EU in one project or folder by using VPC Service Controls.
D. Implement an organization policy that only allows the EU as the location for your workload’s project or folder.
Show Answer
Correct Answer: D
Explanation: Organization Policies can enforce location constraints (resource location restrictions) at the project or folder level, ensuring resources for this specific workload can only be created in EU regions. This is preventative, centrally managed, and does not affect other global applications outside the scoped project or folder, unlike reactive deletion, network-only controls, or VPC Service Controls which do not restrict resource creation locations.
Question 18
Your organization deploys a large number of containerized applications on Google Kubernetes Engine (GKE). Node updates are currently applied manually. Audit findings show that a critical patch has not been installed due to a missed notification. You need to design a more reliable, cloud-first, and scalable process for node updates. What should you do?
A. Configure node auto-upgrades for node pools in the maintenance windows.
B. Develop a custom script to continuously check for patch availability, download patches, and apply the patches across all components of the cluster.
C. Migrate the cluster infrastructure to a self-managed Kubernetes environment for greater control over the patching process.
D. Schedule a daily reboot for all nodes to automatically upgrade.
Show Answer
Correct Answer: A
Explanation: GKE provides managed node auto-upgrades that automatically apply security patches and version updates within defined maintenance windows. This is a cloud-native, scalable, and reliable solution that eliminates missed notifications and manual intervention. The other options add operational overhead, reduce managed benefits, or do not guarantee proper patching.
Question 19
Your organization is migrating its primary web application from on-premises to Google Kubernetes Engine (GKE). You must advise the development team on how to grant their applications access to Google Cloud services from within GKE according to security recommended practices. What should you advise the development team to do?
A. Configure the GKE nodes to use the default Compute Engine service account.
B. Enable Workload Identity for GKE. Assign a Kubernetes service account to the application and configure that Kubernetes service account to act as an Identity and Access Management (IAM) service account. Grant the required roles to the IAM service account.
C. Create a user-managed service account with only the roles required for the specific workload. Assign this service account to the GKE nodes.
D. Create an application-specific IAM service account and generate a user-managed service account key for it. Inject the key to the workload by storing it as a Kubernetes secret within the same namespace as the application.
Show Answer
Correct Answer: B
Explanation: The security‑recommended practice for GKE is to use Workload Identity. It provides pod‑level identity by binding a Kubernetes service account to an IAM service account, enforces least privilege, avoids granting permissions to all workloads on a node, and eliminates the need to create, store, and rotate service account keys. The other options either over‑privilege nodes or rely on static keys, which are discouraged.
Question 20
Your organization’s application is being integrated with a partner application that requires read access to customer data to process customer orders. The customer data is stored in one of your Cloud Storage buckets. You have evaluated different options and determined that this activity requires the use of service account keys. You must advise the partner on how to minimize the risk of a compromised service account key causing a loss of data. What should you advise the partner to do?
A. Scan the Cloud Storage bucket with Sensitive Data Protection when new data is added, and automatically mask all customer data.
B. Define a VPC Service Controls perimeter, and restrict the Cloud Storage API. Add an ingress rule to the perimeter to allow access to the Cloud Storage API for the service account from outside of the perimeter.
C. Ensure that all data for the application that is accessed through the relevant service accounts is encrypted at rest by using customer-managed encryption keys (CMEK).
D. Implement a secret management service. Configure the service to frequently rotate the service account key. Configure proper access control to the key, and restrict who can create service account keys.
Show Answer
Correct Answer: D
Explanation: Service account keys are long‑lived credentials; the primary risk is key compromise. Using a secret management service with strict access controls, limiting who can create keys, and frequently rotating keys reduces blast radius and exposure time. The other options do not directly mitigate the risk of a compromised service account key.
Question 21
You are responsible for managing identities in your company’s Google Cloud organization. Employees are frequently using your organization's corporate domain name to create unmanaged Google accounts. You want to implement a practical and efficient solution to prevent employees from completing this action in the future. What should you do?
A. Create a Google Cloud identity for all users in your organization. Ensure that new users are added automatically.
B. Implement an automated process that scans all identities in your organization and disables any unmanaged accounts.
C. Register a new domain for your Google Cloud resources. Move all existing identities and resources to this domain.
D. Switch your corporate email system to another domain to avoid using the same domain for Google Cloud identities and corporate emails.
Show Answer
Correct Answer: A
Explanation: Creating managed Google Cloud Identities for all users and automatically onboarding new users claims ownership of the corporate domain. Once the domain is managed, employees can no longer create unmanaged (consumer) Google accounts using the corporate email address, because those identities are centrally controlled by the organization. This is the most practical and preventative solution; the other options are reactive, disruptive, or unnecessarily complex.
Question 22
Your organization leverages folders to represent different teams within your Google Cloud environment. To support Infrastructure as Code (IaC) practices, each team receives a dedicated service account upon onboarding. You want to ensure that teams have comprehensive permissions to manage resources within their assigned folders while adhering to the principle of least privilege. You must design the permissions for these team-based service accounts in the most effective way possible. What should you do?
A. Grant each service account the folder administrator role on its respective folder.
B. Grant each service account the project creator role at the organization level and use folder-level IAM conditions to restrict project creation to specific folders.
C. Assign each service account the project editor role at the organization level and instruct teams to use IAM bindings at the folder level for fine-grained permissions.
D. Assign each service account the folder IAM administrator role on its respective folder to allow teams to create and manage additional custom roles if needed.
Show Answer
Correct Answer: A
Explanation: Granting the Folder Administrator role on the specific folder gives each team’s service account full control over projects and resources within that folder, including project creation and resource management, while keeping permissions tightly scoped to the team’s boundary. Organization-level roles (B, C) are overly broad, and Folder IAM Admin (D) only manages IAM, not the resources themselves, making A the most effective and least-privileged option.
$19
Get all 350 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.