Professional Cloud Security Engineer Free Practice Questions — Page 4
Question 31
You are responsible for managing identities in your company’s Google Cloud organization. Employees are frequently using your organization's corporate domain name to create unmanaged Google accounts. You want to implement a practical and efficient solution to prevent employees from completing this action in the future. What should you do?
A. Create a Google Cloud identity for all users in your organization. Ensure that new users are added automatically.
B. Implement an automated process that scans all identities in your organization and disables any unmanaged accounts.
C. Register a new domain for your Google Cloud resources. Move all existing identities and resources to this domain.
D. Switch your corporate email system to another domain to avoid using the same domain for Google Cloud identities and corporate emails.
Show Answer
Correct Answer: A
Explanation: Creating managed Cloud Identity accounts for all users and automatically provisioning new users claims the corporate domain in Google identity management. This prevents employees from creating new unmanaged (consumer) Google accounts with the organization's email addresses because those identities are centrally managed. The other options are reactive, disruptive, or do not address the root cause.
Question 32
Your organization leverages folders to represent different teams within your Google Cloud environment. To support Infrastructure as Code (IaC) practices, each team receives a dedicated service account upon onboarding. You want to ensure that teams have comprehensive permissions to manage resources within their assigned folders while adhering to the principle of least privilege. You must design the permissions for these team-based service accounts in the most effective way possible. What should you do?
A. Grant each service account the folder administrator role on its respective folder.
B. Grant each service account the project creator role at the organization level and use folder-level IAM conditions to restrict project creation to specific folders.
C. Assign each service account the project editor role at the organization level and instruct teams to use IAM bindings at the folder level for fine-grained permissions.
D. Assign each service account the folder IAM administrator role on its respective folder to allow teams to create and manage additional custom roles if needed.
Show Answer
Correct Answer: A
Explanation: The Folder Administrator role (roles/resourcemanager.folderAdmin) scoped to the team's assigned folder gives broad administrative control over that folder and its descendants without granting organization-wide permissions. This aligns with least privilege by limiting authority to the relevant folder. Granting Project Creator at the organization level is broader than necessary even with conditions, Project Editor is overly broad and legacy, and Folder IAM Admin only manages IAM policies rather than full resource administration.
Question 33
Your organization manages a critical web application that serves international customers on Google Cloud. An increase in malicious traffic targeting this application has strained resources and caused periods of downtime. You need to design security measures to increase the application's resilience against web attacks, enhance perimeter protection, and provide access control. What should you do?
A. Employ network load balancing for traffic distribution. Update Identity-Aware Proxy (IAP) policies to allow only administrative access. Implement custom firewall rules on all external IP addresses.
B. Set up firewall rules on Compute Engine instances within the application's environment. Rely on load balancers for threat detection. Increase instance resources to cope with attack volume.
C. Configure firewall rules to block traffic from known malicious IP ranges. Set up Google Cloud Armor and implement Identity-Aware Proxy (IAP) for granular access control.
D. Add firewall rules that restrict all internal IP ranges. Establish Cloud DNS security policies. Disable external IP addresses to reduce the attack surface. Create user groups for access control.
Show Answer
Correct Answer: C
Explanation: Google Cloud Armor is the appropriate service for protecting web applications against DDoS and layer 7 web attacks, providing WAF capabilities and threat intelligence. Identity-Aware Proxy (IAP) adds identity-based, granular access control for protected applications. Firewall rules can complement this by blocking known malicious IP ranges, giving a layered defense. The other options either misuse services, omit Cloud Armor, or rely on measures that do not provide adequate web attack protection.
Question 34
Your organization is implementing a new Python application that will be deployed on Cloud Run. The application needs to connect to a MySQL database that runs on Cloud SQL in a different project in your Google Cloud organization. You must secure the connection from the application to the Cloud SQL instance while minimizing management overhead. What should you do?
A. Use a public IP address for the Cloud SQL instance. Integrate the Cloud SQL Python Connector into your application code to connect to the Cloud SQL instance.
B. Ensure that the Cloud SQL instance doesn’t have a public IP address. Configure Cloud Run to use Cloud SQL Auth Proxy to connect to the Cloud SQL instance.
C. Ensure that the Cloud SQL instance doesn't have a public IP address. Enforce SSL/TLS. Require the use of a trusted client certificate to connect to the Cloud SQL instance.
D. Ensure that the Cloud SQL instance doesn’t have a public IP address. Configure the application's IP address as an authorized network to connect to the Cloud SQL instance.
Show Answer
Correct Answer: A
Explanation: For Cloud Run applications written in Python, the recommended approach is to use the Cloud SQL Python Connector. It provides secure, IAM-authenticated, encrypted connections with minimal management overhead and supports cross-project access. Using a public IP with the connector is a supported and recommended pattern; the connector secures the connection without requiring the Cloud SQL Auth Proxy. Option B is less appropriate because Google recommends the language-specific connectors over the Auth Proxy for Python. Options C and D add management overhead or are not applicable to private-IP-only instances.
Sources:
https://docs.cloud.google.com/sql/docs/mysql/connect-run
Question 35
Your organization has Google Cloud applications that require access to external web services. You must monitor, control, and log access to these services. What should you do?
A. Set up a Secure Web Proxy that allows access to the specific external web services. Configure applications to use the proxy for the web service requests.
B. Set up a Cloud NAT instance to allow egress traffic from your VPC.
C. Configure VPC firewall rules to allow the services to access the IP addresses of required external web services.
D. Configure Google Cloud Armor to monitor and protect your applications by checking incoming traffic patterns for attack patterns.
Show Answer
Correct Answer: A
Explanation: Secure Web Proxy is designed for outbound (egress) web traffic control. It allows organizations to enforce access policies for external web services, monitor requests, and log access through Cloud Logging. Cloud NAT only provides outbound connectivity without policy enforcement or logging at the application/web level. VPC firewall rules filter by IP/port but do not provide URL-based control or comprehensive web access logging. Cloud Armor protects inbound application traffic, not outbound access to external services.
Question 36
Your organization strives to be a market leader in software innovation. You provided a large number of Google Cloud environments so developers can test the integration of Gemini in Vertex AI into their existing applications or create new projects. Your organization has 200 developers and a five-person security team. You must prevent and detect proper security policies across the Google Cloud environments. What should you do? (Choose two.)
A. Apply organization policy constraints. Detect and monitor drifts by using Security Health Analytics.
B. Publish internal policies and clear guidelines to securely develop applications.
C. Use Cloud Logging to create log filters to detect misconfigurations. Trigger Cloud Run functions to remediate misconfigurations.
D. Apply a predefined AI-recommended security posture template for Gemini in Vertex AI in Security Command Center Enterprise or Premium tiers.
E. Implement the least privileged access Identity and Access Management roles to prevent misconfigurations.
Show Answer
Correct Answer: A, D
Explanation: At organization scale with many developer environments and a small security team, organization policy constraints provide preventative guardrails, while Security Health Analytics detects configuration drift and policy violations. In addition, Security Command Center Enterprise/Premium includes a predefined Secure AI posture template for Gemini in Vertex AI that is specifically designed to enforce and monitor security posture for AI workloads. Publishing guidelines alone is not enforceable, custom logging/remediation is more operationally complex than built-in posture management, and least-privilege IAM is important but does not by itself satisfy the broad prevention-and-detection requirement across all environments.
Question 37
You are developing an application that runs on a Compute Engine VM. The application needs to access data stored in Cloud Storage buckets in other Google Cloud projects. The required access to the buckets is variable. You need to provide access to these resources while following Google- recommended practices. What should you do?
A. Limit the VMs access to the Cloud Storage buckets by setting the relevant access scope of the VM.
B. Create IAM bindings for the VM’s service account and the required buckets that allow appropriate access to the data stored in the buckets.
C. Grant the VM's service account access to the required buckets by using domain-wide delegation.
D. Create a group and assign IAM bindings to the group for each bucket that the application needs to access. Assign the VM's service account to the group.
Show Answer
Correct Answer: B
Explanation: Use the VM's service account as the workload identity and grant it the minimum required IAM roles on the specific Cloud Storage buckets across projects. This follows the principle of least privilege and Google-recommended practice of managing access with IAM rather than relying on access scopes. Access scopes are a legacy coarse-grained mechanism, domain-wide delegation is for Google Workspace user impersonation and is unrelated, and using groups for service accounts is not the recommended pattern for this use case.
Question 38
The InfoSec team has mandated that all new Cloud Run jobs and services in production must have Binary Authorization enabled. You need to enforce this requirement. What should you do?
A. Configure an organization policy to require Binary Authorization enforcement on images deployed to Cloud Run.
B. Configure a Security Health Analytics (SHA) custom rule that prevents the execution of Cloud Run jobs and services without Binary Authorization.
C. Ensure the Cloud Run admin role is not assigned to developers.
D. Configure a Binary Authorization custom policy that is not editable by developers and auto-attaches to all Cloud Run jobs and services.
Show Answer
Correct Answer: A
Explanation: Use the Organization Policy constraint that requires Binary Authorization for Cloud Run to enforce the requirement across production resources. Security Health Analytics detects issues rather than enforcing deployment, restricting IAM roles does not guarantee Binary Authorization, and Binary Authorization policies alone do not automatically attach to all Cloud Run services/jobs without organization-level enforcement.
Question 39
Your organization must store highly sensitive data within Google Cloud. You need to design a solution that provides the strongest level of security and control. What should you do?
A. Use Cloud Storage with customer-supplied encryption keys (CSEK), VPC Service Controls for network isolation, and Cloud DLP for data inspection.
B. Use Cloud Storage with customer-managed encryption keys (CMEK), Cloud DLP for data classification, and Secret Manager for storing API access tokens.
C. Use Cloud Storage with client-side encryption, Cloud KMS for key management, and Cloud HSM for cryptographic operations.
D. Use Cloud Storage with server-side encryption, BigQuery with column-level encryption, and IAM roles for access control.
Show Answer
Correct Answer: C
Explanation: Option C provides the strongest security and control because data is encrypted client-side before reaching Google Cloud, so Google never sees plaintext or holds the data encryption keys. Cloud KMS manages keys, and Cloud HSM provides hardware-backed protection for cryptographic key material and operations, offering the highest assurance among the choices. The other options rely on server-side encryption or include services (such as DLP or Secret Manager) that improve governance but do not surpass client-side encryption with HSM-backed key protection for maximum confidentiality.
Question 40
You work for a large organization that recently implemented a 100GB Cloud Interconnect connection between your Google Cloud and your on-premises edge router. While routinely checking the connectivity, you noticed that the connection is operational but there is an error message that indicates MACsec is operationally down. You need to resolve this error. What should you do?
A. Ensure that the Cloud Interconnect connection supports MACsec.
B. Ensure that the on-premises router is not down.
C. Ensure that the active pre-shared key created for MACsec is not expired on both the on-premises and Google edge routers.
D. Ensure that the active pre-shared key matches on both the on-premises and Google edge routers.
Show Answer
Correct Answer: D
Explanation: A Cloud Interconnect link can be operational while MACsec is operationally down if the MACsec security association cannot be established. A common cause is that the active pre-shared key (CAK/CKN configuration) does not match between the on-premises router and the Google edge. Option A is unlikely because MACsec is only available on supported connections; if unsupported, it would not be an operational troubleshooting scenario. Option B concerns physical connectivity, but the link is already operational. Option C is possible in general, but a key mismatch is the primary configuration issue indicated by an operational MACsec-down state.
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.