Professional Cloud Security Engineer Free Practice Questions — Page 6
Question 51
You must ensure that the keys used for at-rest encryption of your data are compliant with your organization's security controls. One security control mandates that keys get rotated every 90 days. You must implement an effective detection strategy to validate if keys are rotated as required. What should you do?
A. Analyze the crypto key versions of the keys by using data from Cloud Asset Inventory. If an active key is older than 90 days, send an alert message through your incident notification channel.
B. Assess the keys in the Cloud Key Management Service by implementing code in Cloud Run. If a key is not rotated after 90 days, raise a finding in Security Command Center.
C. Define a metric that checks for timely key updates by using Cloud Logging. If a key is not rotated after 90 days, send an alert message through your incident notification channel.
D. Identify keys that have not been rotated by using Security Health Analytics. If a key is not rotated after 90 days, a finding in Security Command Center is raised.
Show Answer
Correct Answer: D
Explanation: Security Health Analytics includes a built-in detector for Cloud KMS keys that have not been rotated (KMS_KEY_NOT_ROTATED) and automatically raises findings in Security Command Center. This directly satisfies the requirement for an effective detection strategy without building custom monitoring or code. The other options require custom implementations or rely on services not intended for this specific managed compliance detection.
Question 52
Your organization is using Vertex AI Workbench Instances. You must ensure that newly deployed Instances are automatically kept up-to-date and that users cannot accidentally alter settings in the operating system. What should you do?
A. Enforce the disableRootAccesa and requireAutoUpgradeSchedule organization policies for newly deployed Instances.
B. Enable the VM Manager and ensure the corresponding Google Compute Engine instances are added.
C. Implement a firewall rule that prevents Secure Shell access to the corresponding Google Compute Engine instances by using tags.
D. Assign the AI Notebooks Runner and AI Notebooks Viewer roles to the users of the AI Workbench Instances.
Show Answer
Correct Answer: A
Explanation: Vertex AI Workbench supports organization policies such as disableRootAccess to prevent users from obtaining root access to the underlying VM, reducing the risk of OS configuration changes, and requireAutoUpgradeSchedule to enforce automatic upgrade scheduling for newly created instances. VM Manager can manage Compute Engine VMs but does not enforce these Vertex AI Workbench-specific requirements for new instances via organization policy.
Question 53
You are managing a Google Cloud environment that is organized into folders that represent different teams. These teams need the flexibility to modify organization policies relevant to their work. You want to grant the teams the necessary permissions while upholding Google-recommended security practices and minimizing administrative complexity. What should you do?
A. Create a custom IAM role with the organization policy administrator permission and grant the permission to each team’s folder. Limit policy modifications based on folder names within the custom role’s definition.
B. Assign the organization policy administrator role to a central service account and provide teams with the credentials to use the service account when needed.
C. Create an organization-level tag. Attach the tag to relevant folders. Use an IAM condition to restrict the organization policy administrator role to resources with that tag.
D. Grant each team the organization policy administrator role at the organization level.
Show Answer
Correct Answer: C
Explanation: Option C best matches Google Cloud's recommended least-privilege approach. You can grant the Organization Policy Administrator role with an IAM condition based on resource tags, allowing only tagged folders to be managed while avoiding organization-wide access. Option A is incorrect because custom roles only define permissions and cannot embed restrictions such as folder-name-based limits. Option B is insecure because sharing service account credentials is not a recommended practice. Option D grants excessive permissions across the entire organization.
Question 54
There is a threat actor that is targeting organizations like yours. Attacks are always initiated from a known IP address range. You want to deny-list those IPs for your website, which is exposed to the internet through an Application Load Balancer. What should you do?
A. Create a Cloud Armor policy with a deny-rule for the known IP address range. Attach the policy to the backend of the Application Load Balancer.
B. Activate Identity-Aware Proxy for the backend of the Application Load Balancer. Create a firewall rule that only allows traffic from the proxy to the application.
C. Create a log sink with a filter containing the known IP address range. Trigger an alert that detects when the Application Load Balancer is accessed from those IPs.
D. Create a Cloud Firewall policy with a deny-rule for the known IP address range. Associate the firewall policy to the Virtual Private Cloud with the application backend.
Show Answer
Correct Answer: A
Explanation: Cloud Armor is the correct control for blocking known source IP ranges in front of an external Application Load Balancer. Create a Cloud Armor security policy with a deny rule for the malicious IP range and attach it to the load balancer backend service so the traffic is blocked before reaching the application. Identity-Aware Proxy is for authenticated access, logging does not block traffic, and VPC firewall rules do not filter client IPs arriving through the external Application Load Balancer in the same way as Cloud Armor.
Question 55
You manage a Google Cloud organization with many projects located in various regions around the world. The projects are protected by the same Access Context Manager access policy. You created a new folder that will host two projects that process protected health information (PHI) for US-based customers. The two projects will be separately managed and require stricter protections. You are setting up the VPC Service Controls configuration for the new folder. You must ensure that only US-based personnel can access these projects and restrict Google Cloud API access to only BigQuery and Cloud Storage within these projects. What should you do?
A. • Create a scoped access policy, add the new folder under “Select resources to include in the policy,” and assign an administrator under “Manage principals.” • For the service perimeter, specify the two new projects as “Resources to protect” in the service perimeter configuration. • Set “Restricted services” to “all services,” set “VPC accessible services” to “Selected services,” and specify only BigQuery and Cloud Storage under “Selected services.”
B. • Enable Identity Aware Proxy in the new projects. • Create an Access Context Manager access level with an “IP Subnetworks” attribute condition set to the US-based corporate IP range. • Enable the “Restrict Resource Service Usage” organization policy at the new folder level with an “Allow” policy type and set both “storage.googleapis.com” and “bigquery.googleapis.com” under “Custom values.”
C. • Edit the organization-level access policy and add the new folder under “Select resources to include in the policy.” • Specify the two new projects as “Resources to protect” in the service perimeter configuration. • Set “Restricted services” to “all services,” set “VPC accessible services” to “Selected services,” and specify only BigQuery and Cloud Storage. • Edit the existing access level to add a “Geographic locations” condition set to “US.”
D. • Configure a Cloud Interconnect connection or a Virtual Private Network (VPN) between the on-premises environment and the Google Cloud organization. • Configure the VPC firewall policies within the new projects to only allow connections from the on-premises IP address range. • Enable the Restrict Resource Service Usage organization policy on the new folder with an “Allow” policy type, and set both “storage.googleapis.com” and “bigquery.googleapis.com” under “Custom values.”
Show Answer
Correct Answer: A
Explanation: A is the best fit because it uses a scoped Access Context Manager access policy for the new folder, allowing stricter controls to apply only to the PHI projects without impacting the rest of the organization that shares the existing access policy. The projects are then protected by a VPC Service Controls service perimeter, and VPC accessible services are limited to BigQuery and Cloud Storage. Option C incorrectly modifies the existing organization-wide access policy/access level, which would affect other globally distributed projects. Options B and D rely on organization policy or network controls rather than the required VPC Service Controls and do not correctly scope the access restrictions.
Sources:
https://cloud.google.com/security/compliance/gxp_systems_gcp_whitepaper
Question 56
Your organization is implementing separation of duties in a Google Cloud project. A group of developers must deploy new code, but cannot have permission to change network firewall rules. What should you do?
A. Assign the network administrator IAM role to all developers. Tell developers not to change firewall settings.
B. Use Access Context Manager to create conditions that allow only authorized administrators to change firewall rules based on attributes such as IP address or device security posture.
C. Create and assign two custom IAM roles. Assign the deployer role to control Compute Engine and deployment-related permissions. Assign the network administrator role to manage firewall permissions.
D. Grant the editor IAM role to the developer group. Explicitly negate any firewall modification permissions by using IAM deny policies.
Show Answer
Correct Answer: C
Explanation: Separation of duties is achieved by granting developers only the permissions required to deploy code while reserving firewall administration for a separate role. Creating a custom deployer role and a separate network administrator role enforces least privilege. Option A relies on policy rather than technical enforcement. Option B restricts access context, not authorization to manage firewall rules. Option D starts from the overly broad Editor role; although IAM deny policies exist, granting Editor contradicts least-privilege design and is not the appropriate solution for this requirement.
Question 57
You work for an ecommerce company that stores sensitive customer data across multiple Google Cloud regions. The development team has built a new 3-tier application to process orders and must integrate the application into the production environment.
You must design the network architecture to ensure strong security boundaries and isolation for the new application, facilitate secure remote maintenance by authorized third-party vendors, and follow the principle of least privilege. What should you do?
A. Create separate VPC networks for each tier. Use VPC peering between application tiers and other required VPCs. Provide vendors with SSH keys and root access only to the instances within the VPC for maintenance purposes.
B. Create a single VPC network and create different subnets for each tier. Create a new Google project specifically for the third-party vendors and grant the network admin role to the vendors. Deploy a VPN appliance and rely on the vendors’ configurations to secure third-party access.
C. Create separate VPC networks for each tier. Use VPC peering between application tiers and other required VPCs. Enable Identity-Aware Proxy (IAP) for remote access to management resources, limiting access to authorized vendors.
D. Create a single VPC network and create different subnets for each tier. Create a new Google project specifically for the third-party vendors. Grant the vendors ownership of that project and the ability to modify the Shared VPC configuration.
Show Answer
Correct Answer: C
Explanation: Separate VPC networks for each application tier provide stronger isolation boundaries than merely using subnets. VPC peering enables only the required connectivity between tiers and other networks. Identity-Aware Proxy (IAP) provides secure, identity-based administrative access without exposing SSH to the internet, supporting least privilege for authorized third-party vendors. The other options either rely on broad privileges (root access, Network Admin, Owner), weaker isolation, or vendor-managed security, all of which violate least-privilege principles.
Question 58
You manage multiple internal-only applications that are hosted within different Google Cloud projects. You are deploying a new application that requires external internet access. To maintain security, you want to clearly separate this new application from internal systems. Your solution must have effective security isolation for the new externally-facing application. What should you do?
A. Deploy the application within the same project as an internal application. Use a Shared VPC model to manage network configurations.
B. Place the application in the same project as an existing internal application, and adjust firewall rules to allow external traffic.
C. Create a VPC Service Controls perimeter, and place the new application’s project within that perimeter.
D. Create a new project for the application, and use VPC Network Peering to access necessary resources in the internal projects.
Show Answer
Correct Answer: D
Explanation: Creating a dedicated project provides the primary isolation boundary for an internet-facing application. If the application needs to reach resources in internal projects, VPC Network Peering provides private connectivity while keeping projects administratively separate. VPC Service Controls protect supported Google-managed services from data exfiltration, not general network isolation between an external application and internal workloads.
Sources:
https://docs.cloud.google.com/architecture/best-practices-vpc-design
Question 59
A security audit uncovered several inconsistencies in your project's Identity and Access Management (IAM) configuration. Some service accounts have overly permissive roles, and a few external collaborators have more access than necessary. You need to gain detailed visibility into changes to IAM policies, user activity, service account behavior, and access to sensitive projects. What should you do?
A. Configure Google Cloud Functions to be triggered by changes to IAM policies. Analyze changes by using the policy simulator, send alerts upon risky modifications, and store event details.
B. Enable the metrics explorer in Cloud Monitoring to follow the service account authentication events and build alerts linked on it.
C. Use Cloud Audit Logs. Create log export sinks to send these logs to a security information and event management (SIEM) solution for correlation with other event sources.
D. Deploy the OS Config Management agent to your VMs. Use OS Config Management to create patch management jobs and monitor system modifications.
Show Answer
Correct Answer: C
Explanation: Cloud Audit Logs provide detailed records of IAM policy changes, administrative actions, data access (where enabled), service account activity, and API usage. Exporting these logs via log sinks to a SIEM enables centralized correlation, alerting, investigation, and long-term analysis across projects. The other options are either too narrow (Monitoring metrics, Cloud Functions reacting to IAM changes) or unrelated (OS Config).
Question 60
Your multinational organization is undergoing rapid expansion within Google Cloud. New teams and projects are added frequently. You are concerned about the potential for inconsistent security policy application and permission sprawl across the organization. You must enforce consistent standards while maintaining the autonomy of regional teams. You need to design a strategy to effectively manage IAM and organization policies at scale, ensuring security and administrative efficiency. What should you do?
A. Create detailed organization-wide policies for common scenarios. Instruct teams to apply the policies carefully at the project and resource level as needed.
B. Delegate the creation of organization policies to regional teams. Centrally review these policies for compliance before deployment.
C. Define a small set of essential organization policies. Supplement these policies with a library of optional policy templates for teams to leverage as needed.
D. Use a hierarchical structure of folders. Implement template-based organization policies that cascade down, allowing limited customization by regional teams.
Show Answer
Correct Answer: D
Explanation: Google Cloud best practice for large organizations is to use the resource hierarchy (organization, folders, projects) to apply IAM and Organization Policy constraints through inheritance. Placing regional teams into folders allows centrally managed baseline policies to cascade while preserving delegated administration and limited customization at lower levels. This provides consistent security controls, reduces permission sprawl, and scales better than manually applying policies at the project level or decentralizing policy creation.
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.