Professional Cloud Security Engineer Free Practice Questions — Page 3
Question 21
Your company is in a regulated industry that requires low overhead encryption using private connectivity from on-premises data centers to Google Cloud. You need to establish connectivity and ensure high availability across multiple regions. What should you do?
A. Set up two pairs of HA VPNs using IPSec from the data centers in multiple regions.
B. Set up pairs of Cloud Interconnect connections to your data centers in multiple regions, and employ MACSec encryption.
C. Set up L2TP encryption over pairs of dedicated Cloud Interconnect connections from the data centers in multiple regions.
D. Set up IPSec encryption over Partner Interconnect connections from your data centers in multiple regions.
Show Answer
Correct Answer: B
Explanation: The requirements are private connectivity, low-overhead encryption, regulatory compliance, and high availability across multiple regions. Dedicated or Partner Cloud Interconnect provides private connectivity, but only Dedicated Cloud Interconnect supports MACsec encryption, which offers line-rate Layer 2 encryption with much lower overhead than IPsec. Using paired Cloud Interconnect connections in multiple regions provides the required high availability. HA VPN uses IPsec with higher overhead, L2TP is not the appropriate solution here, and Partner Interconnect does not provide MACsec; adding IPsec over it increases overhead.
Question 22
You manage the security logs within your cloud environment. You have configured a continuous export of security logs to Cloud Storage buckets for long-term retention. You need to provide auditors the ability to analyze the logs that were exported to Cloud Storage. Your solution must be cost-effective and quickly implemented.
What should you do?
A. Use a VM instance to download the data from Cloud Storage. Provide the auditors access to the VM and allow them to install their preferred analytics toolset.
B. Use the data in the Cloud Storage bucket as an external table in BigQuery. Provide the auditors access to the BigQuery dataset.
C. Use Dataflow to import the data from Cloud Storage into Elasticsearch. Provide the auditors with access to Elasticsearch.
D. Use a Cloud Run job to import the log data from Cloud Storage to Cloud Logging. Provide the auditors access through Log Analytics.
Show Answer
Correct Answer: B
Explanation: Using Cloud Storage data as an external table in BigQuery is the fastest and most cost-effective approach. It avoids copying or re-ingesting log data, enables immediate SQL-based analysis over the exported logs, and only requires granting auditors appropriate BigQuery access. The other options require additional infrastructure or data movement, increasing cost and implementation effort.
Question 23
Your organization currently uses a third-party identity provider (IdP) that only requires a username and password for authentication. You need to enforce 2-step verification (2SV) for the Super admins in Cloud Identity. What should you do?
A. Create an organizational unit (OU) for Super admins, and enable 2SV within Cloud Identity for the OU.
B. Collaborate with the third-party IdP to enable 2SV for Super admins while maintaining the current Cloud Identity configuration.
C. Implement monitoring tools to track the authentication methods used by Super admins in Cloud Identity. Alert on those not using 2SV.
D. Evaluate the 2SV options for Super admins offered by both the third-party IdP and Cloud Identity. Implement the solution that provides the strongest second factor.
Show Answer
Correct Answer: A
Explanation: Cloud Identity best practices recommend creating a dedicated organizational unit (OU) for super admins and enforcing 2-step verification (2SV) on that OU. This directly satisfies the requirement to enforce 2SV for privileged accounts, even when using a third-party IdP.
Sources:
https://cloud.google.com/docs/security/security-best-practices-genai/cloud-identity-controls
Question 24
Your organization has a hybrid cloud environment with a data center connected to Google Cloud through a dedicated Cloud Interconnect connection. You need to configure private access from your on-premises hosts to Google APIs, specifically Cloud Storage and BigQuery, without exposing traffic to the public internet. What should you do?
A. Configure Shared VPC to extend your Google Cloud VPC network to your on-premises environment. Use Private Google Access to access Google APIs.
B. Establish VPC peering between your on-premises network and your Google Cloud VPC network. Configure Cloud Firewall rules to allow traffic to Google API IP ranges.
C. Use Private Google Access for on-premises hosts. Configure DNS resolution to point to the private.googleapis.com domain.
D. Configure Cloud NAT on your on-premises network. Configure DNS records in a private DNS zone to send requests to 199.36.153.8/30 to access Google APIs.
Show Answer
Correct Answer: C
Explanation: Private Google Access for on-premises hosts is the Google Cloud feature that enables privately routed access to supported Google APIs over Cloud Interconnect or Cloud VPN. It requires configuring DNS so that googleapis.com resolves to the private.googleapis.com endpoint. Shared VPC, VPC peering, and Cloud NAT do not provide this functionality for on-premises access.
Question 25
A batch job running on Compute Engine needs temporary write access to a Cloud Storage bucket. You want the batch job to use the minimum permissions necessary to complete the task. What should you do?
A. Create a service account with full Cloud Storage administrator permissions. Assign the service account to the Compute Engine instance.
B. Create a service account and embed a long-lived service account key file that has write permissions specified directly in the batch job script.
C. Create a service account with the storage.objectCreator role. Use service account impersonation in the batch job's code.
D. Grant the predefined storage.objectCreator role to the Compute Engine instance's default service account.
Show Answer
Correct Answer: C
Explanation: Use a dedicated service account with the minimal required IAM role, storage.objectCreator, so the job can only create objects. Avoid long-lived service account keys, and prefer service account impersonation or attached credentials over embedded keys. Full admin permissions violate least privilege, and granting the role to the default Compute Engine service account is broader than using a dedicated identity.
Question 26
Your organization uses a microservices architecture based on Google Kubernetes Engine (GKE). Recent security reviews recommend tighter controls around deployed container images to reduce potential vulnerabilities and maintain compliance. You need to implement an automated system by using managed services to ensure that only approved container images are deployed to the GKE clusters. What should you do?
A. Develop custom organization policies that restrict GKE cluster deployments to container images hosted within a specific Artifact Registry project where your approved images reside.
B. Enforce Binary Authorization in your GKE clusters. Integrate container image vulnerability scanning into the CI/CD pipeline and require vulnerability scan results to be used for Binary Authorization policy decisions.
C. Automatically deploy new container images upon successful CI/CD builds by using Cloud Build triggers. Set up firewall rules to limit and control access to instances to mitigate malware injection.
D. Build a system using third-party vulnerability databases and custom scripts to identify potential Common Vulnerabilities and Exposures (CVEs) in your container images. Prevent image deployment if the CVE impact score is beyond a specified threshold.
Show Answer
Correct Answer: B
Explanation: Binary Authorization is the managed Google Cloud service designed to enforce deploy-time policies so that only trusted container images can run on GKE. Integrating vulnerability scanning into the CI/CD pipeline and using attestations or policy decisions with Binary Authorization provides automated enforcement to reduce vulnerabilities and support compliance. Restricting registries alone does not ensure images are approved or secure, while the other options rely on incomplete or custom controls.
Question 27
Your organization has a workload that is regulated by European laws. You must restrict the creation of resources outside of the EU for this specific workload. You must find an effective way to implement this security control without disrupting the other global applications. What should you do?
A. Create a Cloud Function triggered at asset creation that detects and deletes resources outside of the EU.
B. Create all your workload’s assets in a regional subnet in the EU in one project or folder.
C. Segment your workload in the EU in one project or folder by using VPC Service Controls.
D. Implement an organization policy that only allows the EU as the location for your workload’s project or folder.
Show Answer
Correct Answer: D
Explanation: Use a Google Cloud Organization Policy with resource location constraints applied at the specific project or folder for the regulated workload. This restricts creation of supported resources to EU locations without affecting other global applications. The other options are reactive, do not enforce location restrictions, or address different security concerns.
Question 28
Your organization deploys a large number of containerized applications on Google Kubernetes Engine (GKE). Node updates are currently applied manually. Audit findings show that a critical patch has not been installed due to a missed notification. You need to design a more reliable, cloud-first, and scalable process for node updates. What should you do?
A. Configure node auto-upgrades for node pools in the maintenance windows.
B. Develop a custom script to continuously check for patch availability, download patches, and apply the patches across all components of the cluster.
C. Migrate the cluster infrastructure to a self-managed Kubernetes environment for greater control over the patching process.
D. Schedule a daily reboot for all nodes to automatically upgrade.
Show Answer
Correct Answer: A
Explanation: GKE provides node auto-upgrades as a managed, cloud-native feature that automatically applies node updates. Combining auto-upgrades with maintenance windows ensures updates occur during approved periods, improving reliability and scalability while reducing operational risk. The other options either add unnecessary operational burden, reduce the benefits of managed GKE, or incorrectly assume reboots perform upgrades.
Question 29
Your organization is migrating its primary web application from on-premises to Google Kubernetes Engine (GKE). You must advise the development team on how to grant their applications access to Google Cloud services from within GKE according to security recommended practices. What should you advise the development team to do?
A. Configure the GKE nodes to use the default Compute Engine service account.
B. Enable Workload Identity for GKE. Assign a Kubernetes service account to the application and configure that Kubernetes service account to act as an Identity and Access Management (IAM) service account. Grant the required roles to the IAM service account.
C. Create a user-managed service account with only the roles required for the specific workload. Assign this service account to the GKE nodes.
D. Create an application-specific IAM service account and generate a user-managed service account key for it. Inject the key to the workload by storing it as a Kubernetes secret within the same namespace as the application.
Show Answer
Correct Answer: B
Explanation: Workload Identity for GKE is the recommended security practice for granting Google Cloud API access from GKE workloads. It maps a Kubernetes service account to an IAM service account, providing pod-level least-privilege access without long-lived service account keys. Using the node's service account grants overly broad permissions, assigning an IAM service account to all nodes lacks pod-level isolation, and injecting JSON keys as Kubernetes secrets is discouraged due to key management and leakage risks.
Question 30
Your organization’s application is being integrated with a partner application that requires read access to customer data to process customer orders. The customer data is stored in one of your Cloud Storage buckets. You have evaluated different options and determined that this activity requires the use of service account keys. You must advise the partner on how to minimize the risk of a compromised service account key causing a loss of data. What should you advise the partner to do?
A. Scan the Cloud Storage bucket with Sensitive Data Protection when new data is added, and automatically mask all customer data.
B. Define a VPC Service Controls perimeter, and restrict the Cloud Storage API. Add an ingress rule to the perimeter to allow access to the Cloud Storage API for the service account from outside of the perimeter.
C. Ensure that all data for the application that is accessed through the relevant service accounts is encrypted at rest by using customer-managed encryption keys (CMEK).
D. Implement a secret management service. Configure the service to frequently rotate the service account key. Configure proper access control to the key, and restrict who can create service account keys.
Show Answer
Correct Answer: D
Explanation: The primary risk with required service account keys is key compromise. The recommended mitigation is to store keys in a secure secret management system, rotate them frequently, apply least-privilege access to the secrets, and tightly restrict who can create and manage service account keys. The other options do not directly mitigate the impact or likelihood of a compromised service account key causing unauthorized access to Cloud Storage data.
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.