Professional Cloud Security Engineer Free Practice Questions — Page 4
Question 23
Your organization manages a critical web application that serves international customers on Google Cloud. An increase in malicious traffic targeting this application has strained resources and caused periods of downtime. You need to design security measures to increase the application's resilience against web attacks, enhance perimeter protection, and provide access control. What should you do?
A. Employ network load balancing for traffic distribution. Update Identity-Aware Proxy (IAP) policies to allow only administrative access. Implement custom firewall rules on all external IP addresses.
B. Set up firewall rules on Compute Engine instances within the application's environment. Rely on load balancers for threat detection. Increase instance resources to cope with attack volume.
C. Configure firewall rules to block traffic from known malicious IP ranges. Set up Google Cloud Armor and implement Identity-Aware Proxy (IAP) for granular access control.
D. Add firewall rules that restrict all internal IP ranges. Establish Cloud DNS security policies. Disable external IP addresses to reduce the attack surface. Create user groups for access control.
Show Answer
Correct Answer: C
Explanation: Option C provides a layered, Google Cloud–native security design aligned with the requirements. Google Cloud Armor adds web application firewall (WAF) and DDoS protection at the edge, improving resilience against malicious web traffic. Firewall rules and threat intelligence can block known malicious IP ranges. Identity-Aware Proxy (IAP) delivers strong, identity-based, application-level access control. Together, these controls enhance perimeter protection, mitigate web attacks, and enforce secure access without relying solely on instance-level defenses or scaling resources.
Question 24
Your organization is implementing a new Python application that will be deployed on Cloud Run. The application needs to connect to a MySQL database that runs on Cloud SQL in a different project in your Google Cloud organization. You must secure the connection from the application to the Cloud SQL instance while minimizing management overhead. What should you do?
A. Use a public IP address for the Cloud SQL instance. Integrate the Cloud SQL Python Connector into your application code to connect to the Cloud SQL instance.
B. Ensure that the Cloud SQL instance doesn’t have a public IP address. Configure Cloud Run to use Cloud SQL Auth Proxy to connect to the Cloud SQL instance.
C. Ensure that the Cloud SQL instance doesn't have a public IP address. Enforce SSL/TLS. Require the use of a trusted client certificate to connect to the Cloud SQL instance.
D. Ensure that the Cloud SQL instance doesn’t have a public IP address. Configure the application's IP address as an authorized network to connect to the Cloud SQL instance.
Show Answer
Correct Answer: A
Explanation: For Cloud Run applications written in Python, Google recommends using the Cloud SQL Python Connector rather than the Cloud SQL Auth Proxy. The connector provides secure, IAM‑based authentication and automatic TLS without managing certificates or running a proxy sidecar, which minimizes management overhead. Although the Cloud SQL instance uses a public IP, the connection is still secure and does not require exposing the database via authorized networks.
Question 25
Your organization has Google Cloud applications that require access to external web services. You must monitor, control, and log access to these services. What should you do?
A. Set up a Secure Web Proxy that allows access to the specific external web services. Configure applications to use the proxy for the web service requests.
B. Set up a Cloud NAT instance to allow egress traffic from your VPC.
C. Configure VPC firewall rules to allow the services to access the IP addresses of required external web services.
D. Configure Google Cloud Armor to monitor and protect your applications by checking incoming traffic patterns for attack patterns.
Show Answer
Correct Answer: A
Explanation: The requirement is to monitor, control, and log outbound access from Google Cloud applications to external web services. Secure Web Proxy is specifically designed for controlled egress: it enforces access by URL/domain, provides centralized policy control, and logs traffic to Cloud Logging. Cloud NAT only enables outbound connectivity without control or logging, VPC firewall rules operate at the IP/port level and do not provide URL-based control or detailed logging, and Cloud Armor protects against incoming traffic, not outbound access.
Question 26
Your organization strives to be a market leader in software innovation. You provided a large number of Google Cloud environments so developers can test the integration of Gemini in Vertex AI into their existing applications or create new projects. Your organization has 200 developers and a five-person security team. You must prevent and detect proper security policies across the Google Cloud environments. What should you do? (Choose two.)
A. Apply organization policy constraints. Detect and monitor drifts by using Security Health Analytics.
B. Publish internal policies and clear guidelines to securely develop applications.
C. Use Cloud Logging to create log filters to detect misconfigurations. Trigger Cloud Run functions to remediate misconfigurations.
D. Apply a predefined AI-recommended security posture template for Gemini in Vertex AI in Security Command Center Enterprise or Premium tiers.
E. Implement the least privileged access Identity and Access Management roles to prevent misconfigurations.
Show Answer
Correct Answer: A, D
Explanation: You need scalable, centralized preventive and detective controls for many Google Cloud projects with a small security team. Organization Policy constraints provide guardrails to prevent insecure configurations, while Security Health Analytics detects drift and misconfigurations across environments. Additionally, using the predefined AI-recommended security posture template for Gemini in Vertex AI in Security Command Center directly addresses securing Gemini/Vertex AI workloads with built-in best practices, enabling efficient prevention and detection at scale.
Question 27
You are developing an application that runs on a Compute Engine VM. The application needs to access data stored in Cloud Storage buckets in other Google Cloud projects. The required access to the buckets is variable. You need to provide access to these resources while following Google- recommended practices. What should you do?
A. Limit the VMs access to the Cloud Storage buckets by setting the relevant access scope of the VM.
B. Create IAM bindings for the VM’s service account and the required buckets that allow appropriate access to the data stored in the buckets.
C. Grant the VM's service account access to the required buckets by using domain-wide delegation.
D. Create a group and assign IAM bindings to the group for each bucket that the application needs to access. Assign the VM's service account to the group.
Show Answer
Correct Answer: B
Explanation: The recommended practice is to grant access using IAM roles on the specific resources to the specific identity that needs them. Creating IAM bindings between the VM’s service account and the required Cloud Storage buckets allows precise, least-privilege access across projects and can be adjusted as requirements change. Access scopes are legacy and coarse-grained, domain-wide delegation is not appropriate for this use case, and using groups adds unnecessary indirection for a single application VM.
Question 28
The InfoSec team has mandated that all new Cloud Run jobs and services in production must have Binary Authorization enabled. You need to enforce this requirement. What should you do?
A. Configure an organization policy to require Binary Authorization enforcement on images deployed to Cloud Run.
B. Configure a Security Health Analytics (SHA) custom rule that prevents the execution of Cloud Run jobs and services without Binary Authorization.
C. Ensure the Cloud Run admin role is not assigned to developers.
D. Configure a Binary Authorization custom policy that is not editable by developers and auto-attaches to all Cloud Run jobs and services.
Show Answer
Correct Answer: A
Explanation: To enforce Binary Authorization for all new Cloud Run jobs and services in production, the control must be preventive and centrally enforced. An organization policy can require Binary Authorization on images deployed to Cloud Run, ensuring that deployments without it are blocked by the platform. Security Health Analytics rules are detective, not preventive; restricting roles does not guarantee enforcement; and Binary Authorization policies do not auto-attach themselves to all Cloud Run resources without an org-level requirement.
Question 29
Your organization must store highly sensitive data within Google Cloud. You need to design a solution that provides the strongest level of security and control. What should you do?
A. Use Cloud Storage with customer-supplied encryption keys (CSEK), VPC Service Controls for network isolation, and Cloud DLP for data inspection.
B. Use Cloud Storage with customer-managed encryption keys (CMEK), Cloud DLP for data classification, and Secret Manager for storing API access tokens.
C. Use Cloud Storage with client-side encryption, Cloud KMS for key management, and Cloud HSM for cryptographic operations.
D. Use Cloud Storage with server-side encryption, BigQuery with column-level encryption, and IAM roles for access control.
Show Answer
Correct Answer: C
Explanation: The requirement is the strongest possible security and control over highly sensitive data. Client-side encryption ensures data is encrypted before it ever reaches Google Cloud, so Google never has access to plaintext. Using Cloud KMS with Cloud HSM provides the highest assurance for key protection by storing and performing cryptographic operations in dedicated, tamper-resistant hardware under your control. Other options rely on server-side encryption or Google-managed processes, which provide strong security but less control than client-side encryption with HSM-backed keys.
Question 30
You work for a large organization that recently implemented a 100GB Cloud Interconnect connection between your Google Cloud and your on-premises edge router. While routinely checking the connectivity, you noticed that the connection is operational but there is an error message that indicates MACsec is operationally down. You need to resolve this error. What should you do?
A. Ensure that the Cloud Interconnect connection supports MACsec.
B. Ensure that the on-premises router is not down.
C. Ensure that the active pre-shared key created for MACsec is not expired on both the on-premises and Google edge routers.
D. Ensure that the active pre-shared key matches on both the on-premises and Google edge routers.
Show Answer
Correct Answer: D
Explanation: MACsec being operationally down while the physical Interconnect link is up typically indicates a keying issue rather than a link failure. MACsec requires that both ends use the same active pre-shared key. If the keys do not match, MACsec cannot establish secure communication even though the connection itself is operational. Therefore, verifying that the active pre-shared key matches on both the on-premises router and the Google edge router resolves the error.
Question 31
You want to set up a secure, internal network within Google Cloud for database servers. The servers must not have any direct communication with the public internet. What should you do?
A. Assign a private IP address to each database server. Use a NAT gateway to provide internet connectivity to the database servers.
B. Assign a static public IP address to each database server. Use firewall rules to restrict external access.
C. Create a VPC with a private subnet. Assign a private IP address to each database server.
D. Assign both a private IP address and a public IP address to each database server.
Show Answer
Correct Answer: C
Explanation: The requirement is to build a secure, internal network where database servers have no communication with the public internet. Creating a VPC with a private subnet and assigning only private IP addresses ensures the servers are isolated from the internet by default. Option A introduces a NAT gateway, which enables outbound internet access (indirect communication), something not requested. Options B and D expose the servers to the public internet via public IPs, which violates the security requirement.
Question 32
Your organization is building a real-time recommendation engine using ML models that process live user activity data stored in BigQuery and Cloud Storage. Each new model developed is saved to Artifact Registry. This new system deploys models to Google Kubernetes Engine, and uses Pub/Sub for message queues. Recent industry news have been reporting attacks exploiting ML model supply chains. You need to enhance the security in this serverless architecture, specifically against risks to the development and deployment pipeline. What should you do?
A. Enable container image vulnerability scanning during development and pre-deployment. Enforce Binary Authorization on images deployed from Artifact Registry to your continuous integration and continuous deployment (CVCD) pipeline.
B. Thoroughly sanitize all training data prior to model development to reduce risk of poisoning attacks. Use IAM for authorization, and apply role-based restrictions to code repositories and cloud services.
C. Limit external libraries and dependencies that are used for the ML models as much as possible. Continuously rotate encryption keys that are used to access the user data from BigQuery and Cloud Storage.
D. Develop strict firewall rules to limit external traffic to Cloud Run instances. Integrate intrusion detection systems (IDS) for real-time anomaly detection on Pub/Sub message flows.
Show Answer
Correct Answer: A
Explanation: The question targets ML model supply‑chain attacks affecting the development and deployment pipeline. Enabling container image vulnerability scanning addresses compromised or vulnerable artifacts early, and enforcing Binary Authorization ensures that only trusted, verified images from Artifact Registry can be deployed to GKE. This directly mitigates supply‑chain risks in CI/CD. The other options focus on data security, runtime/network protection, or general best practices, but they do not specifically secure the model build and deployment pipeline.
$19
Get all 350 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.