Professional Cloud Security Engineer Free Practice Questions — Page 4
Question 28
Your organization deploys a large number of containerized applications on Google Kubernetes Engine (GKE). Node updates are currently applied manually. Audit findings show that a critical patch has not been installed due to a missed notification. You need to design a more reliable, cloud-first, and scalable process for node updates. What should you do?
A. Configure node auto-upgrades for node pools in the maintenance windows.
B. Develop a custom script to continuously check for patch availability, download patches, and apply the patches across all components of the cluster.
C. Migrate the cluster infrastructure to a self-managed Kubernetes environment for greater control over the patching process.
D. Schedule a daily reboot for all nodes to automatically upgrade.
Show Answer
Correct Answer: A
Explanation: GKE provides node auto-upgrades as a managed, cloud-native feature that automatically applies node updates. Combining auto-upgrades with maintenance windows ensures updates occur during approved periods, improving reliability and scalability while reducing operational risk. The other options either add unnecessary operational burden, reduce the benefits of managed GKE, or incorrectly assume reboots perform upgrades.
Question 29
Your organization is migrating its primary web application from on-premises to Google Kubernetes Engine (GKE). You must advise the development team on how to grant their applications access to Google Cloud services from within GKE according to security recommended practices. What should you advise the development team to do?
A. Configure the GKE nodes to use the default Compute Engine service account.
B. Enable Workload Identity for GKE. Assign a Kubernetes service account to the application and configure that Kubernetes service account to act as an Identity and Access Management (IAM) service account. Grant the required roles to the IAM service account.
C. Create a user-managed service account with only the roles required for the specific workload. Assign this service account to the GKE nodes.
D. Create an application-specific IAM service account and generate a user-managed service account key for it. Inject the key to the workload by storing it as a Kubernetes secret within the same namespace as the application.
Show Answer
Correct Answer: B
Explanation: Workload Identity for GKE is the recommended security practice for granting Google Cloud API access from GKE workloads. It maps a Kubernetes service account to an IAM service account, providing pod-level least-privilege access without long-lived service account keys. Using the node's service account grants overly broad permissions, assigning an IAM service account to all nodes lacks pod-level isolation, and injecting JSON keys as Kubernetes secrets is discouraged due to key management and leakage risks.
Question 30
Your organization’s application is being integrated with a partner application that requires read access to customer data to process customer orders. The customer data is stored in one of your Cloud Storage buckets. You have evaluated different options and determined that this activity requires the use of service account keys. You must advise the partner on how to minimize the risk of a compromised service account key causing a loss of data. What should you advise the partner to do?
A. Scan the Cloud Storage bucket with Sensitive Data Protection when new data is added, and automatically mask all customer data.
B. Define a VPC Service Controls perimeter, and restrict the Cloud Storage API. Add an ingress rule to the perimeter to allow access to the Cloud Storage API for the service account from outside of the perimeter.
C. Ensure that all data for the application that is accessed through the relevant service accounts is encrypted at rest by using customer-managed encryption keys (CMEK).
D. Implement a secret management service. Configure the service to frequently rotate the service account key. Configure proper access control to the key, and restrict who can create service account keys.
Show Answer
Correct Answer: D
Explanation: The primary risk with required service account keys is key compromise. The recommended mitigation is to store keys in a secure secret management system, rotate them frequently, apply least-privilege access to the secrets, and tightly restrict who can create and manage service account keys. The other options do not directly mitigate the impact or likelihood of a compromised service account key causing unauthorized access to Cloud Storage data.
Question 31
You are responsible for managing identities in your company’s Google Cloud organization. Employees are frequently using your organization's corporate domain name to create unmanaged Google accounts. You want to implement a practical and efficient solution to prevent employees from completing this action in the future. What should you do?
A. Create a Google Cloud identity for all users in your organization. Ensure that new users are added automatically.
B. Implement an automated process that scans all identities in your organization and disables any unmanaged accounts.
C. Register a new domain for your Google Cloud resources. Move all existing identities and resources to this domain.
D. Switch your corporate email system to another domain to avoid using the same domain for Google Cloud identities and corporate emails.
Show Answer
Correct Answer: A
Explanation: Creating managed Cloud Identity accounts for all users and automatically provisioning new users claims the corporate domain in Google identity management. This prevents employees from creating new unmanaged (consumer) Google accounts with the organization's email addresses because those identities are centrally managed. The other options are reactive, disruptive, or do not address the root cause.
Question 32
Your organization leverages folders to represent different teams within your Google Cloud environment. To support Infrastructure as Code (IaC) practices, each team receives a dedicated service account upon onboarding. You want to ensure that teams have comprehensive permissions to manage resources within their assigned folders while adhering to the principle of least privilege. You must design the permissions for these team-based service accounts in the most effective way possible. What should you do?
A. Grant each service account the folder administrator role on its respective folder.
B. Grant each service account the project creator role at the organization level and use folder-level IAM conditions to restrict project creation to specific folders.
C. Assign each service account the project editor role at the organization level and instruct teams to use IAM bindings at the folder level for fine-grained permissions.
D. Assign each service account the folder IAM administrator role on its respective folder to allow teams to create and manage additional custom roles if needed.
Show Answer
Correct Answer: A
Explanation: The Folder Administrator role (roles/resourcemanager.folderAdmin) scoped to the team's assigned folder gives broad administrative control over that folder and its descendants without granting organization-wide permissions. This aligns with least privilege by limiting authority to the relevant folder. Granting Project Creator at the organization level is broader than necessary even with conditions, Project Editor is overly broad and legacy, and Folder IAM Admin only manages IAM policies rather than full resource administration.
Question 33
Your organization manages a critical web application that serves international customers on Google Cloud. An increase in malicious traffic targeting this application has strained resources and caused periods of downtime. You need to design security measures to increase the application's resilience against web attacks, enhance perimeter protection, and provide access control. What should you do?
A. Employ network load balancing for traffic distribution. Update Identity-Aware Proxy (IAP) policies to allow only administrative access. Implement custom firewall rules on all external IP addresses.
B. Set up firewall rules on Compute Engine instances within the application's environment. Rely on load balancers for threat detection. Increase instance resources to cope with attack volume.
C. Configure firewall rules to block traffic from known malicious IP ranges. Set up Google Cloud Armor and implement Identity-Aware Proxy (IAP) for granular access control.
D. Add firewall rules that restrict all internal IP ranges. Establish Cloud DNS security policies. Disable external IP addresses to reduce the attack surface. Create user groups for access control.
Show Answer
Correct Answer: C
Explanation: Google Cloud Armor is the appropriate service for protecting web applications against DDoS and layer 7 web attacks, providing WAF capabilities and threat intelligence. Identity-Aware Proxy (IAP) adds identity-based, granular access control for protected applications. Firewall rules can complement this by blocking known malicious IP ranges, giving a layered defense. The other options either misuse services, omit Cloud Armor, or rely on measures that do not provide adequate web attack protection.
Question 34
Your organization is implementing a new Python application that will be deployed on Cloud Run. The application needs to connect to a MySQL database that runs on Cloud SQL in a different project in your Google Cloud organization. You must secure the connection from the application to the Cloud SQL instance while minimizing management overhead. What should you do?
A. Use a public IP address for the Cloud SQL instance. Integrate the Cloud SQL Python Connector into your application code to connect to the Cloud SQL instance.
B. Ensure that the Cloud SQL instance doesn’t have a public IP address. Configure Cloud Run to use Cloud SQL Auth Proxy to connect to the Cloud SQL instance.
C. Ensure that the Cloud SQL instance doesn't have a public IP address. Enforce SSL/TLS. Require the use of a trusted client certificate to connect to the Cloud SQL instance.
D. Ensure that the Cloud SQL instance doesn’t have a public IP address. Configure the application's IP address as an authorized network to connect to the Cloud SQL instance.
Show Answer
Correct Answer: A
Explanation: For Cloud Run applications written in Python, the recommended approach is to use the Cloud SQL Python Connector. It provides secure, IAM-authenticated, encrypted connections with minimal management overhead and supports cross-project access. Using a public IP with the connector is a supported and recommended pattern; the connector secures the connection without requiring the Cloud SQL Auth Proxy. Option B is less appropriate because Google recommends the language-specific connectors over the Auth Proxy for Python. Options C and D add management overhead or are not applicable to private-IP-only instances.
Sources:
https://docs.cloud.google.com/sql/docs/mysql/connect-run
Question 35
Your organization has Google Cloud applications that require access to external web services. You must monitor, control, and log access to these services. What should you do?
A. Set up a Secure Web Proxy that allows access to the specific external web services. Configure applications to use the proxy for the web service requests.
B. Set up a Cloud NAT instance to allow egress traffic from your VPC.
C. Configure VPC firewall rules to allow the services to access the IP addresses of required external web services.
D. Configure Google Cloud Armor to monitor and protect your applications by checking incoming traffic patterns for attack patterns.
Show Answer
Correct Answer: A
Explanation: Secure Web Proxy is designed for outbound (egress) web traffic control. It allows organizations to enforce access policies for external web services, monitor requests, and log access through Cloud Logging. Cloud NAT only provides outbound connectivity without policy enforcement or logging at the application/web level. VPC firewall rules filter by IP/port but do not provide URL-based control or comprehensive web access logging. Cloud Armor protects inbound application traffic, not outbound access to external services.
Question 36
Your organization strives to be a market leader in software innovation. You provided a large number of Google Cloud environments so developers can test the integration of Gemini in Vertex AI into their existing applications or create new projects. Your organization has 200 developers and a five-person security team. You must prevent and detect proper security policies across the Google Cloud environments. What should you do? (Choose two.)
A. Apply organization policy constraints. Detect and monitor drifts by using Security Health Analytics.
B. Publish internal policies and clear guidelines to securely develop applications.
C. Use Cloud Logging to create log filters to detect misconfigurations. Trigger Cloud Run functions to remediate misconfigurations.
D. Apply a predefined AI-recommended security posture template for Gemini in Vertex AI in Security Command Center Enterprise or Premium tiers.
E. Implement the least privileged access Identity and Access Management roles to prevent misconfigurations.
Show Answer
Correct Answer: A, D
Explanation: At organization scale with many developer environments and a small security team, organization policy constraints provide preventative guardrails, while Security Health Analytics detects configuration drift and policy violations. In addition, Security Command Center Enterprise/Premium includes a predefined Secure AI posture template for Gemini in Vertex AI that is specifically designed to enforce and monitor security posture for AI workloads. Publishing guidelines alone is not enforceable, custom logging/remediation is more operationally complex than built-in posture management, and least-privilege IAM is important but does not by itself satisfy the broad prevention-and-detection requirement across all environments.
Question 37
You are developing an application that runs on a Compute Engine VM. The application needs to access data stored in Cloud Storage buckets in other Google Cloud projects. The required access to the buckets is variable. You need to provide access to these resources while following Google- recommended practices. What should you do?
A. Limit the VMs access to the Cloud Storage buckets by setting the relevant access scope of the VM.
B. Create IAM bindings for the VM’s service account and the required buckets that allow appropriate access to the data stored in the buckets.
C. Grant the VM's service account access to the required buckets by using domain-wide delegation.
D. Create a group and assign IAM bindings to the group for each bucket that the application needs to access. Assign the VM's service account to the group.
Show Answer
Correct Answer: B
Explanation: Use the VM's service account as the workload identity and grant it the minimum required IAM roles on the specific Cloud Storage buckets across projects. This follows the principle of least privilege and Google-recommended practice of managing access with IAM rather than relying on access scopes. Access scopes are a legacy coarse-grained mechanism, domain-wide delegation is for Google Workspace user impersonation and is unrelated, and using groups for service accounts is not the recommended pattern for this use case.
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.