Professional Cloud Security Engineer Free Practice Questions — Page 5
Question 41
You want to set up a secure, internal network within Google Cloud for database servers. The servers must not have any direct communication with the public internet. What should you do?
A. Assign a private IP address to each database server. Use a NAT gateway to provide internet connectivity to the database servers.
B. Assign a static public IP address to each database server. Use firewall rules to restrict external access.
C. Create a VPC with a private subnet. Assign a private IP address to each database server.
D. Assign both a private IP address and a public IP address to each database server.
Show Answer
Correct Answer: C
Explanation: The requirement is to create a secure internal network where database servers have no direct communication with the public internet. A VPC with a private subnet and only private IP addresses satisfies this by keeping the instances off the public internet. Option A introduces internet egress through Cloud NAT, which is unnecessary because the question does not require internet access. Options B and D assign public IP addresses, violating the intent of an internal-only deployment.
Question 42
Your organization is building a real-time recommendation engine using ML models that process live user activity data stored in BigQuery and Cloud Storage. Each new model developed is saved to Artifact Registry. This new system deploys models to Google Kubernetes Engine, and uses Pub/Sub for message queues. Recent industry news have been reporting attacks exploiting ML model supply chains. You need to enhance the security in this serverless architecture, specifically against risks to the development and deployment pipeline. What should you do?
A. Enable container image vulnerability scanning during development and pre-deployment. Enforce Binary Authorization on images deployed from Artifact Registry to your continuous integration and continuous deployment (CVCD) pipeline.
B. Thoroughly sanitize all training data prior to model development to reduce risk of poisoning attacks. Use IAM for authorization, and apply role-based restrictions to code repositories and cloud services.
C. Limit external libraries and dependencies that are used for the ML models as much as possible. Continuously rotate encryption keys that are used to access the user data from BigQuery and Cloud Storage.
D. Develop strict firewall rules to limit external traffic to Cloud Run instances. Integrate intrusion detection systems (IDS) for real-time anomaly detection on Pub/Sub message flows.
Show Answer
Correct Answer: A
Explanation: The question focuses on ML model supply chain attacks and securing the development and deployment pipeline. Enabling container image vulnerability scanning helps detect known vulnerabilities in build artifacts before deployment, while Binary Authorization enforces that only trusted, verified container images are deployed to GKE. This directly addresses software supply chain security for the CI/CD pipeline. The other options address related security concerns (data poisoning, IAM, key rotation, network controls, IDS) but do not specifically protect the model artifact and deployment supply chain.
Question 43
Your organization operates in a highly regulated environment and has a stringent set of compliance requirements for protecting customer data. You must encrypt data while in use to meet regulations. What should you do?
A. Enable the use of customer-supplied encryption keys (CSEK) keys in the Google Compute Engine VMs to give your organization maximum control over their VM disk encryption.
B. Establish a trusted execution environment with a Confidential VM.
C. Use a Shielded VM to ensure a secure boot with integrity monitoring for the application environment.
D. Use customer-managed encryption keys (CMEK) and Cloud KSM to enable your organization to control their keys for data encryption in Cloud SQL.
Show Answer
Correct Answer: B
Explanation: The requirement is to encrypt data while it is in use (data in memory during processing). Confidential VMs provide a trusted execution environment using confidential computing technologies that encrypt memory and protect data in use. CSEK and CMEK address encryption at rest, while Shielded VMs protect boot and runtime integrity rather than encrypting data in use.
Question 44
Your Google Cloud organization is subdivided into three folders: production, development, and networking, Networking resources for the organization are centrally managed in the networking folder. You discovered that projects in the production folder are attaching to Shared VPCs that are outside of the networking folder which could become a data exfiltration risk. You must resolve the production folder issue without impacting the development folder. You need to use the most efficient and least disruptive approach. What should you do?
A. Enable the Restrict Shared VPC Host Projects organization policy on the production folder. Create a custom rule and configure the policy type to Allow. In the Custom value section, enter under:folders/networking.
B. Enable the Restrict Shared VPC Host Projects organization policy on the networking folder only. Create a new custom rule and configure the policy type to Allow. In the Custom value section, enter under:organizations/123456739123.
C. Enable the Restrict Shared VPC Host Projects organization policy at the project level for each of the production projects. Create a custom rule and configure the policy type to Allow. In the Custom value section, enter under:folders/networking.
D. Enable the Restrict Shared VPC Host Projects organization policy at the organization level. Create a custom rule and configure the policy type to Allow. In the Custom value section, enter under:folders/networking.
Show Answer
Correct Answer: A
Explanation: The Restrict Shared VPC Host Projects organization policy should be applied at the production folder level so that only projects in that folder are restricted to attaching Shared VPC host projects under the networking folder. Using an allowlist value of under:folders/networking enforces the desired scope without affecting the development folder. Applying the policy at the organization level would also impact development, applying it only to the networking folder does not constrain service projects in production, and configuring every project individually is less efficient.
Question 45
A team at your organization collects logs in an on-premises security information and event management system (SIEM). You must provide a subset of Google Cloud logs for the SIEM, and minimize the risk of data exposure in your cloud environment. What should you do?
A. Create a new BigQuery dataset. Stream all logs to this dataset. Provide the on-premises SIEM system access to the data in BigQuery by using workload identity federation and let the SIEM team filter for the relevant log data.
B. Define a log view for the relevant logs. Provide access to the log view to a principal from your on-premises identity provider by using workforce identity federation.
C. Create a log sink for the relevant logs. Send the logs to Pub/Sub. Retrieve the logs from Pub/Sub and push the logs to the SIEM by using Dataflow.
D. Filter for the relevant logs. Store the logs in a Cloud Storage bucket. Grant the service account access to the bucket. Provide the service account key to the SIEM team.
Show Answer
Correct Answer: C
Explanation: Use a Cloud Logging log sink with an inclusion filter to export only the required subset of logs. Sending the filtered logs to Pub/Sub and using Dataflow to deliver them to the on-premises SIEM provides a secure, scalable export pipeline while minimizing data exposure by exporting only necessary logs. Log views control interactive access within Cloud Logging but are not an export mechanism for feeding an external SIEM. The other options either expose more data than necessary or rely on less secure credential handling.
Question 46
Your organization is worried about recent news headlines regarding application vulnerabilities in production applications that have led to security breaches. You want to automatically scan your deployment pipeline for vulnerabilities and ensure only scanned and verified containers can run in the environment. What should you do?
A. Use Kubernetes role-based access control (RBAC) as the source of truth for cluster access by granting “container.clusters.get” to limited users. Restrict deployment access by allowing these users to generate a kubeconfig file containing the configuration access to the GKE cluster.
B. Use gcloud artifacts docker images describe LOCATION-docker.pkg.dev/PROJECT_ID/REPOSITORY/IMAGE_ID@sha256:HASH --show-package-vulnerability in your CI/CD pipeline, and trigger a pipeline failure for critical vulnerabilities.
C. Enforce the use of Cloud Code for development so users receive real-time security feedback on vulnerable libraries and dependencies before they check in their code.
D. Enable Binary Authorization and create attestations of scans.
Show Answer
Correct Answer: D
Explanation: The requirement has two parts: automatically scan images in the deployment pipeline and ensure only scanned and verified containers can run. Binary Authorization enforces deployment policies so only trusted images are admitted, and attestations provide cryptographic proof that required vulnerability scanning or other verification steps have been completed. Option B only checks vulnerabilities in CI/CD but does not enforce runtime admission. Options A and C do not satisfy both scanning and deployment enforcement.
Question 47
You work for a financial organization in a highly regulated industry that is subject to active regulatory compliance. To meet compliance requirements, you need to continuously maintain a specific set of configurations, data residency, organizational policies, and personnel data access controls. What should you do?
A. Apply an organizational policy constraint at the organization level to limit the location of new resource creation.
B. Create an Assured Workloads folder for your required compliance program to apply defined controls and requirements.
C. Go to the Compliance page in Security Command Center. View the report for your status against the required compliance standard. Triage violations to maintain compliance on a regular basis.
D. Create a posture.yaml file with the required security compliance posture. Apply the posture with the gcloud scc postures create POSTURE_NAME --posture-from-file=posture.yaml command in Security Command Center Premium.
Show Answer
Correct Answer: B
Explanation: Assured Workloads is designed for regulated industries that require continuous enforcement of compliance controls, including data residency, organizational policy constraints, and Google personnel access controls for supported compliance regimes. Option A addresses only location constraints, C provides compliance reporting rather than enforcing the required environment, and D manages security posture but does not provide the comprehensive regulated environment and access controls described.
Question 48
Your development team is launching a new application. The new application has a microservices architecture on Compute Engine instances and serverless components, including Cloud Functions. This application will process financial transactions that require temporary, highly sensitive data in memory. You need to secure data in use during computations with a focus on minimizing the risk of unauthorized access to memory for this financial application. What should you do?
A. Enable Confidential VM instances for Compute Engine, and ensure that relevant Cloud Functions can leverage hardware-based memory isolation.
B. Use data masking and tokenization techniques on sensitive financial data fields throughout the application and the application's data processing workflows.
C. Use the Cloud Data Loss Prevention (Cloud DLP) API to scan and mask sensitive data before feeding the data into any compute environment.
D. Store all sensitive data during processing in Cloud Storage by using customer-managed encryption keys (CMEK), and set strict bucket-level permissions.
Show Answer
Correct Answer: A
Explanation: The requirement is to protect highly sensitive data 'in use' (while resident in memory during computation). Confidential VM instances are specifically designed to protect data in use through hardware-backed memory encryption and isolation on supported Compute Engine instances. The other options protect data at rest or transform data but do not secure memory during computation. Although Cloud Functions do not provide a configurable Confidential Computing mode, A is the only option that directly addresses the stated objective for the Compute Engine portion and is clearly the intended exam answer.
Question 49
Your organization wants to publish yearly reports of your website usage analytics. You must ensure that no data with personally identifiable information (PII) is published by using the Cloud Data Loss Prevention (Cloud DLP) API. Data integrity must be preserved. What should you do?
A. Detect all PII in storage by using the Cloud DLP API. Create a cloud function to delete the PII.
B. Discover and quarantine your PII data in your storage by using the Cloud DLP API.
C. Discover and transform PII data in your reports by using the Cloud DLP API.
D. Encrypt the PII from the report by using the Cloud DLP API.
Show Answer
Correct Answer: C
Explanation: The correct approach is to use Cloud DLP to discover and transform PII before publication. Transformation methods such as masking, tokenization, pseudonymization, or de-identification remove or obfuscate sensitive information while preserving the structure and usefulness of the data. Deleting PII (A) can unnecessarily damage data integrity, quarantining data (B) does not produce a publishable report, and encrypting PII (D) is intended for authorized recovery rather than publishing sanitized data.
Question 50
Your organization is developing a sophisticated machine learning (ML) model to predict customer behavior for targeted marketing campaigns. The BigQuery dataset used for training includes sensitive personal information. You must design the security controls around the AI/ML pipeline. Data privacy must be maintained throughout the model’s lifecycle and you must ensure that personal data is not used in the training process. Additionally, you must restrict access to the dataset to an authorized subset of people only. What should you do?
A. De-identify sensitive data before model training by using Cloud Data Loss Prevention (DLP)APIs. and implement strict Identity and Access Management (IAM) policies to control access to BigQuery.
B. Implement Identity-Aware Proxy to enforce context-aware access to BigQuery and models based on user identity and device.
C. Implement at-rest encryption by using customer-managed encryption keys (CMEK) for the pipeline. Implement strict Identity and Access Management (IAM) policies to control access to BigQuery.
D. Deploy the model on Confidential VMs for enhanced protection of data and code while in use. Implement strict Identity and Access Management (IAM) policies to control access to BigQuery.
Show Answer
Correct Answer: A
Explanation: The requirements are to prevent personal data from being used during model training and to restrict dataset access to only authorized users. De-identifying sensitive data with Cloud Data Loss Prevention (DLP) before training directly addresses the privacy requirement, while strict IAM policies on BigQuery satisfy the access control requirement. Identity-Aware Proxy is not used to secure BigQuery access in this way, CMEK only protects data at rest and does not prevent PII from being used for training, and Confidential VMs protect data in use but do not remove sensitive data from the training dataset or enforce least-privilege access.
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.