Professional Cloud Security Engineer Free Practice Questions — Page 6
Question 43
You are managing a Google Cloud environment that is organized into folders that represent different teams. These teams need the flexibility to modify organization policies relevant to their work. You want to grant the teams the necessary permissions while upholding Google-recommended security practices and minimizing administrative complexity. What should you do?
A. Create a custom IAM role with the organization policy administrator permission and grant the permission to each team’s folder. Limit policy modifications based on folder names within the custom role’s definition.
B. Assign the organization policy administrator role to a central service account and provide teams with the credentials to use the service account when needed.
C. Create an organization-level tag. Attach the tag to relevant folders. Use an IAM condition to restrict the organization policy administrator role to resources with that tag.
D. Grant each team the organization policy administrator role at the organization level.
Show Answer
Correct Answer: C
Explanation: Option C best meets all requirements. Using organization-level tags combined with IAM conditions allows you to grant the Organization Policy Administrator role only for folders that carry a specific tag. This follows Google-recommended best practices by enforcing least privilege, avoids over-broad org-level permissions, and scales cleanly without creating many custom roles or sharing service account credentials.
Option A is invalid because custom roles cannot restrict behavior based on folder names; role definitions only include permissions, not resource-scoping logic. Option B violates security best practices by sharing service account credentials. Option D grants excessive permissions at the organization level and does not follow least privilege.
Question 44
There is a threat actor that is targeting organizations like yours. Attacks are always initiated from a known IP address range. You want to deny-list those IPs for your website, which is exposed to the internet through an Application Load Balancer. What should you do?
A. Create a Cloud Armor policy with a deny-rule for the known IP address range. Attach the policy to the backend of the Application Load Balancer.
B. Activate Identity-Aware Proxy for the backend of the Application Load Balancer. Create a firewall rule that only allows traffic from the proxy to the application.
C. Create a log sink with a filter containing the known IP address range. Trigger an alert that detects when the Application Load Balancer is accessed from those IPs.
D. Create a Cloud Firewall policy with a deny-rule for the known IP address range. Associate the firewall policy to the Virtual Private Cloud with the application backend.
Show Answer
Correct Answer: A
Explanation: Cloud Armor is Google Cloud’s web application firewall that integrates directly with external HTTP(S) Application Load Balancers. Creating a security policy with a deny rule for the known malicious IP address range blocks the traffic at the edge before it reaches the load balancer backends. The other options either do not block traffic (logging/alerting), are meant for access control rather than IP blocking (IAP), or are ineffective for internet-facing load balancer traffic (VPC firewall rules).
Question 45
You manage a Google Cloud organization with many projects located in various regions around the world. The projects are protected by the same Access Context Manager access policy. You created a new folder that will host two projects that process protected health information (PHI) for US-based customers. The two projects will be separately managed and require stricter protections. You are setting up the VPC Service Controls configuration for the new folder. You must ensure that only US-based personnel can access these projects and restrict Google Cloud API access to only BigQuery and Cloud Storage within these projects. What should you do?
A. • Create a scoped access policy, add the new folder under “Select resources to include in the policy,” and assign an administrator under “Manage principals.” • For the service perimeter, specify the two new projects as “Resources to protect” in the service perimeter configuration. • Set “Restricted services” to “all services,” set “VPC accessible services” to “Selected services,” and specify only BigQuery and Cloud Storage under “Selected services.”
B. • Enable Identity Aware Proxy in the new projects. • Create an Access Context Manager access level with an “IP Subnetworks” attribute condition set to the US-based corporate IP range. • Enable the “Restrict Resource Service Usage” organization policy at the new folder level with an “Allow” policy type and set both “storage.googleapis.com” and “bigquery.googleapis.com” under “Custom values.”
C. • Edit the organization-level access policy and add the new folder under “Select resources to include in the policy.” • Specify the two new projects as “Resources to protect” in the service perimeter configuration. • Set “Restricted services” to “all services,” set “VPC accessible services” to “Selected services,” and specify only BigQuery and Cloud Storage. • Edit the existing access level to add a “Geographic locations” condition set to “US.”
D. • Configure a Cloud Interconnect connection or a Virtual Private Network (VPN) between the on-premises environment and the Google Cloud organization. • Configure the VPC firewall policies within the new projects to only allow connections from the on-premises IP address range. • Enable the Restrict Resource Service Usage organization policy on the new folder with an “Allow” policy type, and set both “storage.googleapis.com” and “bigquery.googleapis.com” under “Custom values.”
Show Answer
Correct Answer: A
Explanation: The requirement is to apply stricter, US-only access and service restrictions **only** to the new PHI folder without impacting existing global projects that already use the same access policy. The correct approach is to create a **scoped access policy** for the new folder so controls are isolated. Within that scoped policy, a service perimeter protects only the two projects, and restricting accessible services to BigQuery and Cloud Storage limits API usage. Editing the existing organization-level access policy (as in option C) would unintentionally apply US-only restrictions to all projects worldwide, which violates the scenario constraints.
Question 46
Your organization is implementing separation of duties in a Google Cloud project. A group of developers must deploy new code, but cannot have permission to change network firewall rules. What should you do?
A. Assign the network administrator IAM role to all developers. Tell developers not to change firewall settings.
B. Use Access Context Manager to create conditions that allow only authorized administrators to change firewall rules based on attributes such as IP address or device security posture.
C. Create and assign two custom IAM roles. Assign the deployer role to control Compute Engine and deployment-related permissions. Assign the network administrator role to manage firewall permissions.
D. Grant the editor IAM role to the developer group. Explicitly negate any firewall modification permissions by using IAM deny policies.
Show Answer
Correct Answer: C
Explanation: Separation of duties in Google Cloud is enforced by granting only the minimum required permissions. Creating and assigning a custom deployer IAM role allows developers to deploy and manage compute or application resources without including firewall permissions, while a separate network administrator role is assigned to a different group responsible for firewall rules. This enforces technical separation of duties. Other options are either overly permissive, rely on trust, misuse Access Context Manager, or introduce unnecessary risk.
Question 47
You work for an ecommerce company that stores sensitive customer data across multiple Google Cloud regions. The development team has built a new 3-tier application to process orders and must integrate the application into the production environment.
You must design the network architecture to ensure strong security boundaries and isolation for the new application, facilitate secure remote maintenance by authorized third-party vendors, and follow the principle of least privilege. What should you do?
A. Create separate VPC networks for each tier. Use VPC peering between application tiers and other required VPCs. Provide vendors with SSH keys and root access only to the instances within the VPC for maintenance purposes.
B. Create a single VPC network and create different subnets for each tier. Create a new Google project specifically for the third-party vendors and grant the network admin role to the vendors. Deploy a VPN appliance and rely on the vendors’ configurations to secure third-party access.
C. Create separate VPC networks for each tier. Use VPC peering between application tiers and other required VPCs. Enable Identity-Aware Proxy (IAP) for remote access to management resources, limiting access to authorized vendors.
D. Create a single VPC network and create different subnets for each tier. Create a new Google project specifically for the third-party vendors. Grant the vendors ownership of that project and the ability to modify the Shared VPC configuration.
Show Answer
Correct Answer: C
Explanation: Option C best meets all requirements. Using separate VPC networks for each application tier provides the strongest security boundaries and isolation, reducing lateral movement risk. VPC peering allows controlled, private connectivity only where required. Enabling Identity-Aware Proxy (IAP) for remote access supports secure, identity-based, zero-trust access for authorized third-party vendors without exposing SSH or granting excessive permissions, aligning with least privilege. Other options either grant overly broad access (root, network admin, or project ownership), rely on weaker controls, or provide insufficient isolation.
Question 48
You manage multiple internal-only applications that are hosted within different Google Cloud projects. You are deploying a new application that requires external internet access. To maintain security, you want to clearly separate this new application from internal systems. Your solution must have effective security isolation for the new externally-facing application. What should you do?
A. Deploy the application within the same project as an internal application. Use a Shared VPC model to manage network configurations.
B. Place the application in the same project as an existing internal application, and adjust firewall rules to allow external traffic.
C. Create a VPC Service Controls perimeter, and place the new application’s project within that perimeter.
D. Create a new project for the application, and use VPC Network Peering to access necessary resources in the internal projects.
Show Answer
Correct Answer: D
Explanation: Creating a new, dedicated project provides the strongest isolation boundary in Google Cloud (IAM, billing, quotas, and resource separation). This cleanly separates the externally-facing application from internal-only systems. If access to internal resources is required, VPC Network Peering can be used in a controlled manner without exposing internal networks directly to the internet. The other options weaken isolation by co-locating workloads or misuse VPC Service Controls, which focus on data exfiltration protection rather than network-level isolation of internet-facing apps.
Question 49
A security audit uncovered several inconsistencies in your project's Identity and Access Management (IAM) configuration. Some service accounts have overly permissive roles, and a few external collaborators have more access than necessary. You need to gain detailed visibility into changes to IAM policies, user activity, service account behavior, and access to sensitive projects. What should you do?
A. Configure Google Cloud Functions to be triggered by changes to IAM policies. Analyze changes by using the policy simulator, send alerts upon risky modifications, and store event details.
B. Enable the metrics explorer in Cloud Monitoring to follow the service account authentication events and build alerts linked on it.
C. Use Cloud Audit Logs. Create log export sinks to send these logs to a security information and event management (SIEM) solution for correlation with other event sources.
D. Deploy the OS Config Management agent to your VMs. Use OS Config Management to create patch management jobs and monitor system modifications.
Show Answer
Correct Answer: C
Explanation: You need comprehensive, authoritative visibility into IAM policy changes, user actions, service account behavior, and access to sensitive resources. Cloud Audit Logs are specifically designed to record administrative activity, data access, and system events across Google Cloud, including IAM changes and authentication events. Exporting these logs to a SIEM enables correlation, alerting, and long-term analysis. The other options are either too narrow, reactive, or unrelated to IAM auditing.
Question 50
Your multinational organization is undergoing rapid expansion within Google Cloud. New teams and projects are added frequently. You are concerned about the potential for inconsistent security policy application and permission sprawl across the organization. You must enforce consistent standards while maintaining the autonomy of regional teams. You need to design a strategy to effectively manage IAM and organization policies at scale, ensuring security and administrative efficiency. What should you do?
A. Create detailed organization-wide policies for common scenarios. Instruct teams to apply the policies carefully at the project and resource level as needed.
B. Delegate the creation of organization policies to regional teams. Centrally review these policies for compliance before deployment.
C. Define a small set of essential organization policies. Supplement these policies with a library of optional policy templates for teams to leverage as needed.
D. Use a hierarchical structure of folders. Implement template-based organization policies that cascade down, allowing limited customization by regional teams.
Show Answer
Correct Answer: D
Explanation: Using Google Cloud’s resource hierarchy (organization → folders → projects) with organization policies that inherit downward is the most scalable and secure approach. Central teams can enforce mandatory baseline policies at higher levels, ensuring consistency and preventing permission sprawl, while regional teams retain autonomy to apply more restrictive or customized policies within their folders. Template-based policies further standardize implementation and reduce operational overhead as the organization grows.
Question 51
Your organization operates in a highly regulated industry and uses multiple Google Cloud services. You need to identify potential risks to regulatory compliance. Which situation introduces the greatest risk?
A. The security team mandates the use of customer-managed encryption keys (CMEK) for all data classified as sensitive.
B. Sensitive data is stored in a Cloud Storage bucket with the uniform bucket-level access setting enabled.
C. The audit team needs access to Cloud Audit Logs related to managed services like BigQuery.
D. Principals have broad IAM roles allowing the creation and management of Compute Engine VMs without a pre-defined hardening process.
Show Answer
Correct Answer: D
Explanation: Granting principals broad IAM roles to create and manage Compute Engine VMs without a predefined hardening process creates the highest regulatory compliance risk. It violates the principle of least privilege and allows deployment of unmanaged, potentially insecure resources, increasing the likelihood of misconfigurations, security gaps, and non-compliant systems. The other options describe controls or normal audit requirements that generally improve or support compliance rather than undermine it.
Question 52
Your organization heavily utilizes serverless applications while prioritizing security best practices. You are responsible for enforcing image provenance and compliance with security standards before deployment. You leverage Cloud Build as your continuous integration and continuous deployment (CI/CD) tool for building container images. You must configure Binary Authorization to ensure that only images built by your Cloud Build pipeline are deployed and that the images pass security standard compliance checks. What should you do?
A. Create a Binary Authorization attestor that uses a scanner to assess source code management repositories. Deploy images only if the attestor validates results against a security policy.
B. Create a Binary Authorization attestor that utilizes a scanner to evaluate container image build processes. Define a policy that requires deployment of images only if this attestation is present.
C. Create a Binary Authorization attestor that retrieves the Cloud Build build ID of the container image. Configure a policy to allow deployment only if there's a matching build ID attestation.
D. Utilize a custom Security Health Analytics module to create a policy. Enforce the policy through Binary Authorization to prevent deployment of images that do not meet predefined security standards.
Show Answer
Correct Answer: B
Explanation: Binary Authorization works by requiring cryptographically signed attestations on container image digests. To meet both requirements—image provenance (only images built by Cloud Build) and security standard compliance—you integrate security checks (such as vulnerability or policy scans via Container Analysis or other scanners) into the Cloud Build pipeline and create an attestation only when those checks pass. A Binary Authorization policy then enforces that only images with this attestation can be deployed. Checking for a Cloud Build build ID alone does not directly enforce security compliance, and source-code–level checks or Security Health Analytics policies are not how Binary Authorization enforces deploy-time image trust.
$19
Get all 350 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.