Professional Cloud Security Engineer Free Practice Questions — Page 5
Question 38
The InfoSec team has mandated that all new Cloud Run jobs and services in production must have Binary Authorization enabled. You need to enforce this requirement. What should you do?
A. Configure an organization policy to require Binary Authorization enforcement on images deployed to Cloud Run.
B. Configure a Security Health Analytics (SHA) custom rule that prevents the execution of Cloud Run jobs and services without Binary Authorization.
C. Ensure the Cloud Run admin role is not assigned to developers.
D. Configure a Binary Authorization custom policy that is not editable by developers and auto-attaches to all Cloud Run jobs and services.
Show Answer
Correct Answer: A
Explanation: Use the Organization Policy constraint that requires Binary Authorization for Cloud Run to enforce the requirement across production resources. Security Health Analytics detects issues rather than enforcing deployment, restricting IAM roles does not guarantee Binary Authorization, and Binary Authorization policies alone do not automatically attach to all Cloud Run services/jobs without organization-level enforcement.
Question 39
Your organization must store highly sensitive data within Google Cloud. You need to design a solution that provides the strongest level of security and control. What should you do?
A. Use Cloud Storage with customer-supplied encryption keys (CSEK), VPC Service Controls for network isolation, and Cloud DLP for data inspection.
B. Use Cloud Storage with customer-managed encryption keys (CMEK), Cloud DLP for data classification, and Secret Manager for storing API access tokens.
C. Use Cloud Storage with client-side encryption, Cloud KMS for key management, and Cloud HSM for cryptographic operations.
D. Use Cloud Storage with server-side encryption, BigQuery with column-level encryption, and IAM roles for access control.
Show Answer
Correct Answer: C
Explanation: Option C provides the strongest security and control because data is encrypted client-side before reaching Google Cloud, so Google never sees plaintext or holds the data encryption keys. Cloud KMS manages keys, and Cloud HSM provides hardware-backed protection for cryptographic key material and operations, offering the highest assurance among the choices. The other options rely on server-side encryption or include services (such as DLP or Secret Manager) that improve governance but do not surpass client-side encryption with HSM-backed key protection for maximum confidentiality.
Question 40
You work for a large organization that recently implemented a 100GB Cloud Interconnect connection between your Google Cloud and your on-premises edge router. While routinely checking the connectivity, you noticed that the connection is operational but there is an error message that indicates MACsec is operationally down. You need to resolve this error. What should you do?
A. Ensure that the Cloud Interconnect connection supports MACsec.
B. Ensure that the on-premises router is not down.
C. Ensure that the active pre-shared key created for MACsec is not expired on both the on-premises and Google edge routers.
D. Ensure that the active pre-shared key matches on both the on-premises and Google edge routers.
Show Answer
Correct Answer: D
Explanation: A Cloud Interconnect link can be operational while MACsec is operationally down if the MACsec security association cannot be established. A common cause is that the active pre-shared key (CAK/CKN configuration) does not match between the on-premises router and the Google edge. Option A is unlikely because MACsec is only available on supported connections; if unsupported, it would not be an operational troubleshooting scenario. Option B concerns physical connectivity, but the link is already operational. Option C is possible in general, but a key mismatch is the primary configuration issue indicated by an operational MACsec-down state.
Question 41
You want to set up a secure, internal network within Google Cloud for database servers. The servers must not have any direct communication with the public internet. What should you do?
A. Assign a private IP address to each database server. Use a NAT gateway to provide internet connectivity to the database servers.
B. Assign a static public IP address to each database server. Use firewall rules to restrict external access.
C. Create a VPC with a private subnet. Assign a private IP address to each database server.
D. Assign both a private IP address and a public IP address to each database server.
Show Answer
Correct Answer: C
Explanation: The requirement is to create a secure internal network where database servers have no direct communication with the public internet. A VPC with a private subnet and only private IP addresses satisfies this by keeping the instances off the public internet. Option A introduces internet egress through Cloud NAT, which is unnecessary because the question does not require internet access. Options B and D assign public IP addresses, violating the intent of an internal-only deployment.
Question 42
Your organization is building a real-time recommendation engine using ML models that process live user activity data stored in BigQuery and Cloud Storage. Each new model developed is saved to Artifact Registry. This new system deploys models to Google Kubernetes Engine, and uses Pub/Sub for message queues. Recent industry news have been reporting attacks exploiting ML model supply chains. You need to enhance the security in this serverless architecture, specifically against risks to the development and deployment pipeline. What should you do?
A. Enable container image vulnerability scanning during development and pre-deployment. Enforce Binary Authorization on images deployed from Artifact Registry to your continuous integration and continuous deployment (CVCD) pipeline.
B. Thoroughly sanitize all training data prior to model development to reduce risk of poisoning attacks. Use IAM for authorization, and apply role-based restrictions to code repositories and cloud services.
C. Limit external libraries and dependencies that are used for the ML models as much as possible. Continuously rotate encryption keys that are used to access the user data from BigQuery and Cloud Storage.
D. Develop strict firewall rules to limit external traffic to Cloud Run instances. Integrate intrusion detection systems (IDS) for real-time anomaly detection on Pub/Sub message flows.
Show Answer
Correct Answer: A
Explanation: The question focuses on ML model supply chain attacks and securing the development and deployment pipeline. Enabling container image vulnerability scanning helps detect known vulnerabilities in build artifacts before deployment, while Binary Authorization enforces that only trusted, verified container images are deployed to GKE. This directly addresses software supply chain security for the CI/CD pipeline. The other options address related security concerns (data poisoning, IAM, key rotation, network controls, IDS) but do not specifically protect the model artifact and deployment supply chain.
Question 43
Your organization operates in a highly regulated environment and has a stringent set of compliance requirements for protecting customer data. You must encrypt data while in use to meet regulations. What should you do?
A. Enable the use of customer-supplied encryption keys (CSEK) keys in the Google Compute Engine VMs to give your organization maximum control over their VM disk encryption.
B. Establish a trusted execution environment with a Confidential VM.
C. Use a Shielded VM to ensure a secure boot with integrity monitoring for the application environment.
D. Use customer-managed encryption keys (CMEK) and Cloud KSM to enable your organization to control their keys for data encryption in Cloud SQL.
Show Answer
Correct Answer: B
Explanation: The requirement is to encrypt data while it is in use (data in memory during processing). Confidential VMs provide a trusted execution environment using confidential computing technologies that encrypt memory and protect data in use. CSEK and CMEK address encryption at rest, while Shielded VMs protect boot and runtime integrity rather than encrypting data in use.
Question 44
Your Google Cloud organization is subdivided into three folders: production, development, and networking, Networking resources for the organization are centrally managed in the networking folder. You discovered that projects in the production folder are attaching to Shared VPCs that are outside of the networking folder which could become a data exfiltration risk. You must resolve the production folder issue without impacting the development folder. You need to use the most efficient and least disruptive approach. What should you do?
A. Enable the Restrict Shared VPC Host Projects organization policy on the production folder. Create a custom rule and configure the policy type to Allow. In the Custom value section, enter under:folders/networking.
B. Enable the Restrict Shared VPC Host Projects organization policy on the networking folder only. Create a new custom rule and configure the policy type to Allow. In the Custom value section, enter under:organizations/123456739123.
C. Enable the Restrict Shared VPC Host Projects organization policy at the project level for each of the production projects. Create a custom rule and configure the policy type to Allow. In the Custom value section, enter under:folders/networking.
D. Enable the Restrict Shared VPC Host Projects organization policy at the organization level. Create a custom rule and configure the policy type to Allow. In the Custom value section, enter under:folders/networking.
Show Answer
Correct Answer: A
Explanation: The Restrict Shared VPC Host Projects organization policy should be applied at the production folder level so that only projects in that folder are restricted to attaching Shared VPC host projects under the networking folder. Using an allowlist value of under:folders/networking enforces the desired scope without affecting the development folder. Applying the policy at the organization level would also impact development, applying it only to the networking folder does not constrain service projects in production, and configuring every project individually is less efficient.
Question 45
A team at your organization collects logs in an on-premises security information and event management system (SIEM). You must provide a subset of Google Cloud logs for the SIEM, and minimize the risk of data exposure in your cloud environment. What should you do?
A. Create a new BigQuery dataset. Stream all logs to this dataset. Provide the on-premises SIEM system access to the data in BigQuery by using workload identity federation and let the SIEM team filter for the relevant log data.
B. Define a log view for the relevant logs. Provide access to the log view to a principal from your on-premises identity provider by using workforce identity federation.
C. Create a log sink for the relevant logs. Send the logs to Pub/Sub. Retrieve the logs from Pub/Sub and push the logs to the SIEM by using Dataflow.
D. Filter for the relevant logs. Store the logs in a Cloud Storage bucket. Grant the service account access to the bucket. Provide the service account key to the SIEM team.
Show Answer
Correct Answer: C
Explanation: Use a Cloud Logging log sink with an inclusion filter to export only the required subset of logs. Sending the filtered logs to Pub/Sub and using Dataflow to deliver them to the on-premises SIEM provides a secure, scalable export pipeline while minimizing data exposure by exporting only necessary logs. Log views control interactive access within Cloud Logging but are not an export mechanism for feeding an external SIEM. The other options either expose more data than necessary or rely on less secure credential handling.
Question 46
Your organization is worried about recent news headlines regarding application vulnerabilities in production applications that have led to security breaches. You want to automatically scan your deployment pipeline for vulnerabilities and ensure only scanned and verified containers can run in the environment. What should you do?
A. Use Kubernetes role-based access control (RBAC) as the source of truth for cluster access by granting “container.clusters.get” to limited users. Restrict deployment access by allowing these users to generate a kubeconfig file containing the configuration access to the GKE cluster.
B. Use gcloud artifacts docker images describe LOCATION-docker.pkg.dev/PROJECT_ID/REPOSITORY/IMAGE_ID@sha256:HASH --show-package-vulnerability in your CI/CD pipeline, and trigger a pipeline failure for critical vulnerabilities.
C. Enforce the use of Cloud Code for development so users receive real-time security feedback on vulnerable libraries and dependencies before they check in their code.
D. Enable Binary Authorization and create attestations of scans.
Show Answer
Correct Answer: D
Explanation: The requirement has two parts: automatically scan images in the deployment pipeline and ensure only scanned and verified containers can run. Binary Authorization enforces deployment policies so only trusted images are admitted, and attestations provide cryptographic proof that required vulnerability scanning or other verification steps have been completed. Option B only checks vulnerabilities in CI/CD but does not enforce runtime admission. Options A and C do not satisfy both scanning and deployment enforcement.
Question 47
You work for a financial organization in a highly regulated industry that is subject to active regulatory compliance. To meet compliance requirements, you need to continuously maintain a specific set of configurations, data residency, organizational policies, and personnel data access controls. What should you do?
A. Apply an organizational policy constraint at the organization level to limit the location of new resource creation.
B. Create an Assured Workloads folder for your required compliance program to apply defined controls and requirements.
C. Go to the Compliance page in Security Command Center. View the report for your status against the required compliance standard. Triage violations to maintain compliance on a regular basis.
D. Create a posture.yaml file with the required security compliance posture. Apply the posture with the gcloud scc postures create POSTURE_NAME --posture-from-file=posture.yaml command in Security Command Center Premium.
Show Answer
Correct Answer: B
Explanation: Assured Workloads is designed for regulated industries that require continuous enforcement of compliance controls, including data residency, organizational policy constraints, and Google personnel access controls for supported compliance regimes. Option A addresses only location constraints, C provides compliance reporting rather than enforcing the required environment, and D manages security posture but does not provide the comprehensive regulated environment and access controls described.
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.