Professional Cloud Security Engineer Free Practice Questions — Page 5
Question 33
Your organization operates in a highly regulated environment and has a stringent set of compliance requirements for protecting customer data. You must encrypt data while in use to meet regulations. What should you do?
A. Enable the use of customer-supplied encryption keys (CSEK) keys in the Google Compute Engine VMs to give your organization maximum control over their VM disk encryption.
B. Establish a trusted execution environment with a Confidential VM.
C. Use a Shielded VM to ensure a secure boot with integrity monitoring for the application environment.
D. Use customer-managed encryption keys (CMEK) and Cloud KSM to enable your organization to control their keys for data encryption in Cloud SQL.
Show Answer
Correct Answer: B
Explanation: The requirement is to encrypt data *while in use* (i.e., during processing in memory). Confidential VMs provide confidential computing by encrypting VM memory and creating a trusted execution environment, protecting data during runtime. The other options focus on encryption at rest (CSEK, CMEK/Cloud KMS) or boot integrity (Shielded VM), not data-in-use encryption.
Question 34
Your Google Cloud organization is subdivided into three folders: production, development, and networking, Networking resources for the organization are centrally managed in the networking folder. You discovered that projects in the production folder are attaching to Shared VPCs that are outside of the networking folder which could become a data exfiltration risk. You must resolve the production folder issue without impacting the development folder. You need to use the most efficient and least disruptive approach. What should you do?
A. Enable the Restrict Shared VPC Host Projects organization policy on the production folder. Create a custom rule and configure the policy type to Allow. In the Custom value section, enter under:folders/networking.
B. Enable the Restrict Shared VPC Host Projects organization policy on the networking folder only. Create a new custom rule and configure the policy type to Allow. In the Custom value section, enter under:organizations/123456739123.
C. Enable the Restrict Shared VPC Host Projects organization policy at the project level for each of the production projects. Create a custom rule and configure the policy type to Allow. In the Custom value section, enter under:folders/networking.
D. Enable the Restrict Shared VPC Host Projects organization policy at the organization level. Create a custom rule and configure the policy type to Allow. In the Custom value section, enter under:folders/networking.
Show Answer
Correct Answer: A
Explanation: Applying the Restrict Shared VPC Host Projects organization policy at the production folder level directly targets only production projects, preventing them from attaching to Shared VPCs outside the networking folder. This is the least disruptive and most efficient approach because it avoids impacting development projects and does not require per-project configuration, while still allowing approved Shared VPCs under folders/networking.
Question 35
A team at your organization collects logs in an on-premises security information and event management system (SIEM). You must provide a subset of Google Cloud logs for the SIEM, and minimize the risk of data exposure in your cloud environment. What should you do?
A. Create a new BigQuery dataset. Stream all logs to this dataset. Provide the on-premises SIEM system access to the data in BigQuery by using workload identity federation and let the SIEM team filter for the relevant log data.
B. Define a log view for the relevant logs. Provide access to the log view to a principal from your on-premises identity provider by using workforce identity federation.
C. Create a log sink for the relevant logs. Send the logs to Pub/Sub. Retrieve the logs from Pub/Sub and push the logs to the SIEM by using Dataflow.
D. Filter for the relevant logs. Store the logs in a Cloud Storage bucket. Grant the service account access to the bucket. Provide the service account key to the SIEM team.
Show Answer
Correct Answer: C
Explanation: The requirement is to export only a subset of Google Cloud logs to an external, on‑premises SIEM while minimizing data exposure. A log sink allows precise filtering so that only required logs are exported, satisfying least‑privilege principles. Pub/Sub provides a secure, scalable streaming mechanism for delivering those logs, and Dataflow enables managed, reliable processing and delivery to the on‑premises SIEM without exposing cloud credentials. The other options either expose broader log access (BigQuery), do not actually export logs externally (log views), or rely on long‑lived service account keys, which increase security risk.
Question 36
Your organization is worried about recent news headlines regarding application vulnerabilities in production applications that have led to security breaches. You want to automatically scan your deployment pipeline for vulnerabilities and ensure only scanned and verified containers can run in the environment. What should you do?
A. Use Kubernetes role-based access control (RBAC) as the source of truth for cluster access by granting “container.clusters.get” to limited users. Restrict deployment access by allowing these users to generate a kubeconfig file containing the configuration access to the GKE cluster.
B. Use gcloud artifacts docker images describe LOCATION-docker.pkg.dev/PROJECT_ID/REPOSITORY/IMAGE_ID@sha256:HASH --show-package-vulnerability in your CI/CD pipeline, and trigger a pipeline failure for critical vulnerabilities.
C. Enforce the use of Cloud Code for development so users receive real-time security feedback on vulnerable libraries and dependencies before they check in their code.
D. Enable Binary Authorization and create attestations of scans.
Show Answer
Correct Answer: D
Explanation: The requirement is to automatically scan containers and enforce that only scanned and verified images can be deployed. Binary Authorization integrates with vulnerability scanning and enforces deployment-time policies based on attestations, ensuring unverified or vulnerable containers cannot run. Other options do not provide enforceable, deployment-time control over container execution.
Question 37
You work for a financial organization in a highly regulated industry that is subject to active regulatory compliance. To meet compliance requirements, you need to continuously maintain a specific set of configurations, data residency, organizational policies, and personnel data access controls. What should you do?
A. Apply an organizational policy constraint at the organization level to limit the location of new resource creation.
B. Create an Assured Workloads folder for your required compliance program to apply defined controls and requirements.
C. Go to the Compliance page in Security Command Center. View the report for your status against the required compliance standard. Triage violations to maintain compliance on a regular basis.
D. Create a posture.yaml file with the required security compliance posture. Apply the posture with the gcloud scc postures create POSTURE_NAME --posture-from-file=posture.yaml command in Security Command Center Premium.
Show Answer
Correct Answer: B
Explanation: Assured Workloads is designed for highly regulated industries and enforces required compliance controls by default, including data residency, organizational policies, and Google personnel access restrictions. Creating an Assured Workloads folder applies these controls continuously, meeting active regulatory compliance needs more comprehensively than monitoring or individual policy configurations.
Question 38
Your development team is launching a new application. The new application has a microservices architecture on Compute Engine instances and serverless components, including Cloud Functions. This application will process financial transactions that require temporary, highly sensitive data in memory. You need to secure data in use during computations with a focus on minimizing the risk of unauthorized access to memory for this financial application. What should you do?
A. Enable Confidential VM instances for Compute Engine, and ensure that relevant Cloud Functions can leverage hardware-based memory isolation.
B. Use data masking and tokenization techniques on sensitive financial data fields throughout the application and the application's data processing workflows.
C. Use the Cloud Data Loss Prevention (Cloud DLP) API to scan and mask sensitive data before feeding the data into any compute environment.
D. Store all sensitive data during processing in Cloud Storage by using customer-managed encryption keys (CMEK), and set strict bucket-level permissions.
Show Answer
Correct Answer: A
Explanation: The requirement is to secure **data in use (in memory)** during computations and minimize the risk of unauthorized memory access. Confidential VM instances provide hardware-based memory encryption and isolation, protecting sensitive data even from the host or hypervisor. This directly addresses in-memory protection for microservices running on Compute Engine. The other options focus on data at rest or data transformation (masking/DLP), not protecting live data in memory. While Cloud Functions do not explicitly expose Confidential VM controls, option A is the only choice that targets hardware-enforced protection for data in use, which is the core requirement.
Question 39
Your organization wants to publish yearly reports of your website usage analytics. You must ensure that no data with personally identifiable information (PII) is published by using the Cloud Data Loss Prevention (Cloud DLP) API. Data integrity must be preserved. What should you do?
A. Detect all PII in storage by using the Cloud DLP API. Create a cloud function to delete the PII.
B. Discover and quarantine your PII data in your storage by using the Cloud DLP API.
C. Discover and transform PII data in your reports by using the Cloud DLP API.
D. Encrypt the PII from the report by using the Cloud DLP API.
Show Answer
Correct Answer: C
Explanation: Cloud DLP can discover PII and apply transformations (e.g., redaction, masking, tokenization, or generalization) directly to the reports. This removes or de-identifies PII while preserving the structure and usefulness of the analytics data, satisfying the requirement to publish reports without PII and maintain data integrity.
Question 40
Your organization is developing a sophisticated machine learning (ML) model to predict customer behavior for targeted marketing campaigns. The BigQuery dataset used for training includes sensitive personal information. You must design the security controls around the AI/ML pipeline. Data privacy must be maintained throughout the model’s lifecycle and you must ensure that personal data is not used in the training process. Additionally, you must restrict access to the dataset to an authorized subset of people only. What should you do?
A. De-identify sensitive data before model training by using Cloud Data Loss Prevention (DLP)APIs. and implement strict Identity and Access Management (IAM) policies to control access to BigQuery.
B. Implement Identity-Aware Proxy to enforce context-aware access to BigQuery and models based on user identity and device.
C. Implement at-rest encryption by using customer-managed encryption keys (CMEK) for the pipeline. Implement strict Identity and Access Management (IAM) policies to control access to BigQuery.
D. Deploy the model on Confidential VMs for enhanced protection of data and code while in use. Implement strict Identity and Access Management (IAM) policies to control access to BigQuery.
Show Answer
Correct Answer: A
Explanation: The requirements are to prevent use of personal data in training and restrict dataset access. De-identifying sensitive data with Cloud DLP ensures PII is removed before model training, satisfying privacy across the ML lifecycle. Strict IAM policies on BigQuery limit access to an authorized subset of users. Other options address only access context, encryption at rest, or protection in use, but do not ensure personal data is excluded from training.
Question 41
You must ensure that the keys used for at-rest encryption of your data are compliant with your organization's security controls. One security control mandates that keys get rotated every 90 days. You must implement an effective detection strategy to validate if keys are rotated as required. What should you do?
A. Analyze the crypto key versions of the keys by using data from Cloud Asset Inventory. If an active key is older than 90 days, send an alert message through your incident notification channel.
B. Assess the keys in the Cloud Key Management Service by implementing code in Cloud Run. If a key is not rotated after 90 days, raise a finding in Security Command Center.
C. Define a metric that checks for timely key updates by using Cloud Logging. If a key is not rotated after 90 days, send an alert message through your incident notification channel.
D. Identify keys that have not been rotated by using Security Health Analytics. If a key is not rotated after 90 days, a finding in Security Command Center is raised.
Show Answer
Correct Answer: D
Explanation: Security Health Analytics is a managed, built-in detection capability that continuously evaluates Cloud KMS configurations against security best practices. It includes a specific detector for KMS keys that have not been rotated within the required timeframe and automatically raises findings in Security Command Center. This provides an effective, low-effort, and auditable detection strategy without custom code, logging metrics, or manual analysis, directly satisfying the requirement to validate 90-day key rotation compliance.
Question 42
Your organization is using Vertex AI Workbench Instances. You must ensure that newly deployed Instances are automatically kept up-to-date and that users cannot accidentally alter settings in the operating system. What should you do?
A. Enforce the disableRootAccesa and requireAutoUpgradeSchedule organization policies for newly deployed Instances.
B. Enable the VM Manager and ensure the corresponding Google Compute Engine instances are added.
C. Implement a firewall rule that prevents Secure Shell access to the corresponding Google Compute Engine instances by using tags.
D. Assign the AI Notebooks Runner and AI Notebooks Viewer roles to the users of the AI Workbench Instances.
Show Answer
Correct Answer: A
Explanation: Vertex AI Workbench Instances support organization policies that directly address both requirements. Enforcing disableRootAccess prevents users from gaining root access to the underlying Compute Engine VM, which stops accidental or unauthorized OS-level changes. Enforcing requireAutoUpgradeSchedule ensures that newly deployed instances automatically receive operating system updates and patches. The other options do not reliably prevent OS modification or guarantee automatic OS upgrades for Workbench Instances.
$19
Get all 350 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.