Professional Cloud Security Engineer Free Practice Questions — Page 7
Question 61
Your organization operates in a highly regulated industry and uses multiple Google Cloud services. You need to identify potential risks to regulatory compliance. Which situation introduces the greatest risk?
A. The security team mandates the use of customer-managed encryption keys (CMEK) for all data classified as sensitive.
B. Sensitive data is stored in a Cloud Storage bucket with the uniform bucket-level access setting enabled.
C. The audit team needs access to Cloud Audit Logs related to managed services like BigQuery.
D. Principals have broad IAM roles allowing the creation and management of Compute Engine VMs without a pre-defined hardening process.
Show Answer
Correct Answer: D
Explanation: Broad IAM roles combined with no pre-defined VM hardening process present the greatest regulatory compliance risk. This violates least-privilege principles and allows deployment of potentially insecure or non-compliant Compute Engine instances. The other options describe security controls (CMEK, uniform bucket-level access) or a legitimate auditing need rather than an inherent compliance risk.
Question 62
Your organization heavily utilizes serverless applications while prioritizing security best practices. You are responsible for enforcing image provenance and compliance with security standards before deployment. You leverage Cloud Build as your continuous integration and continuous deployment (CI/CD) tool for building container images. You must configure Binary Authorization to ensure that only images built by your Cloud Build pipeline are deployed and that the images pass security standard compliance checks. What should you do?
A. Create a Binary Authorization attestor that uses a scanner to assess source code management repositories. Deploy images only if the attestor validates results against a security policy.
B. Create a Binary Authorization attestor that utilizes a scanner to evaluate container image build processes. Define a policy that requires deployment of images only if this attestation is present.
C. Create a Binary Authorization attestor that retrieves the Cloud Build build ID of the container image. Configure a policy to allow deployment only if there's a matching build ID attestation.
D. Utilize a custom Security Health Analytics module to create a policy. Enforce the policy through Binary Authorization to prevent deployment of images that do not meet predefined security standards.
Show Answer
Correct Answer: B
Explanation: Binary Authorization enforces deployment based on attestations, not build IDs alone. To satisfy both provenance and security compliance, configure an attestor that attests images after successful security evaluation in the trusted Cloud Build pipeline, then require that attestation in the Binary Authorization policy. A focuses on source repositories rather than built images, C emphasizes build ID provenance but not compliance attestation, and D misuses Security Health Analytics, which is not how Binary Authorization admission policies are defined.
Question 63
Your organization has an internet-facing application behind a load balancer. Your regulators require end-to-end encryption of user login credentials. You must implement this requirement. What should you do?
A. Generate a symmetric key with Cloud KMS. Encrypt client-side user credentials by using the symmetric key.
B. Concatenate the credential with a timestamp. Submit the timestamp and hashed value of credentials to the network.
C. Deploy the TLS certificate at Google Cloud Global HTTPs Load Balancer, and submit the user credentials through HTTPs.
D. Generate an asymmetric key with Cloud KMS. Encrypt client-side user credentials using the public key.
Show Answer
Correct Answer: C
Explanation: Use TLS (HTTPS) terminated at the Google Cloud HTTPS Load Balancer and configure HTTPS from the load balancer to the backend (TLS bridging) to provide encryption in transit across both segments. For Google Cloud architecture exam questions, this is the standard approach to satisfy end-to-end encryption in transit for an internet-facing application behind a load balancer. Cloud KMS is not used for client-side credential encryption in this scenario, and hashing credentials before transmission is not a replacement for transport encryption.
Question 64
You are implementing a new web application on Google Cloud that will be accessed from your on-premises network. To provide protection from threats like malware, you must implement transport layer security (TLS) interception for incoming traffic to your application. What should you do?
A. Configure Secure Web Proxy. Offload the TLS traffic in the load balancer, inspect the traffic, and forward the traffic to the web application.
B. Configure an internal proxy load balancer. Offload the TLS traffic in the load balancer inspect, the traffic and forward the traffic to the web application.
C. Configure a hierarchical firewall policy. Enable TLS interception by using Cloud Next Generation Firewall (NGFW) Enterprise.
D. Configure a VPC firewall rule. Enable TLS interception by using Cloud Next Generation Firewall (NGFW) Enterprise.
Show Answer
Correct Answer: C
Explanation: Cloud NGFW Enterprise provides TLS inspection capabilities for decrypting and inspecting encrypted traffic. TLS inspection is configured through hierarchical (or network/global) firewall policies, not standard VPC firewall rules. Secure Web Proxy is intended for secure web proxy use cases rather than inbound application TLS interception, and load balancers do not provide NGFW-style TLS inspection.
Question 65
Your organization has hired a small, temporary partner team for 18 months. The temporary team will work alongside your DevOps team to develop your organization's application that is hosted on Google Cloud. You must give the temporary partner team access to your application's resources on Google Cloud and ensure that partner employees lose access. If they are removed from their employer's organization. What should you do?
A. Create a temporary username and password for the temporary partner team members. Auto-clean the usernames and passwords after the work engagement has ended.
B. Create a workforce identity pool and federate the identity pool with the identity provider (IdP) of the temporary partner team.
C. Implement just-in-time privileged access to Google Cloud for the temporary partner team.
D. Add the identities of the temporary partner team members to your identity provider (IdP).
Show Answer
Correct Answer: B
Explanation: The best solution is to use Workforce Identity Federation by creating a workforce identity pool federated with the partner organization's IdP. This allows partner employees to authenticate using their existing corporate identities, avoids managing separate accounts, and automatically removes access when an employee is disabled or removed from the partner's IdP. Creating local accounts or adding users to your own IdP increases administrative overhead and does not automatically reflect employment changes. Just-in-time privileged access addresses temporary elevation of privileges rather than cross-organization identity lifecycle management.
Question 66
Your organization шs using a third-party identity and authentication provider to centrally manage users. You want to use this identity provider to grant access to the Google Cloud console without syncing identities to Google Cloud. Users should receive permissions based on attributes. What should you do?
A. Configure the central identity provider as a workforce identity pool provider in Workforce Identity Federation. Create an attribute mapping by using the Common Expression Language (CEL).
B. Configure a periodic synchronization of relevant users and groups with attributes to Cloud Identity. Activate single sign-on by using the Security Assertion Markup Language (SAML).
C. Set up the Google Cloud Identity Platform. Configure an external authentication provider by using OpenID Connect and link user accounts based on attributes.
D. Activate external identities on the Identity-Aware Proxy. Use the Security Assertion Markup Language (SAML) to configure authentication based on attributes to the central authentication provider.
Show Answer
Correct Answer: A
Explanation: Workforce Identity Federation is designed to let users from an external identity provider access the Google Cloud console and APIs without synchronizing identities into Google Cloud. Attribute mapping using Common Expression Language (CEL) enables attribute-based access control by mapping IdP claims to Google attributes. The other options either require identity synchronization, target application authentication rather than Google Cloud console access, or use services not intended for this use case.
Question 67
You are implementing communications restrictions for specific services in your Google Cloud organization. Your data analytics team works in a dedicated folder. You need to ensure that access to BigQuery is controlled for that folder and its projects. The data analytics team must be able to control the restrictions only at the folder level. What should you do?
A. Create an organization-level access policy with a service perimeter to restrict BigQuery access. Assign the data analytics team the Access Context Manager Editor role on the access policy to allow the team to configure the access policy.
B. Create a scoped policy on the folder with a service perimeter to restrict BigQuery access. Assign the data analytics team the Access Context Manager Editor role on the scoped policy to allow the team to configure the scoped policy.
C. Define a hierarchical firewall policy on the folder to deny BigQuery access. Assign the data analytics team the Compute Organization Firewall Policy Admin role to allow the team to configure rules for the firewall policy.
D. Enforce the Restrict Resource Service Usage organization policy constraint on the folder to restrict BigQuery access. Assign the data analytics team the Organization Policy Administrator role to allow the team to manage exclusions within the folder.
Show Answer
Correct Answer: B
Explanation: A scoped Access Context Manager policy allows delegation of VPC Service Controls management at the folder level. Creating a scoped policy with a service perimeter lets BigQuery access be restricted for that folder and its projects, while granting the data analytics team the Access Context Manager Editor role only for the scoped policy. An organization-level access policy would give broader scope than required, hierarchical firewall policies do not control BigQuery service access, and the Restrict Resource Service Usage organization policy is for enabling/disabling service usage rather than VPC Service Controls communications restrictions.
Question 68
Your organization is developing an application that will have both corporate and public end-users. You want to centrally manage those customers' identities and authorizations. Corporate end users must access the application by using their corporate user and domain name. What should you do?
A. Add the corporate and public end-user domains to domain restricted sharing on the organization.
B. Federate the customers' identity provider (IdP) with Workforce Identity Federation in your application's project.
C. Do nothing. Google Workspace identities will allow you to filter personal accounts and disable their access.
D. Use a customer identity and access management tool (CIAM) like Identity Platform.
Show Answer
Correct Answer: D
Explanation: Identity Platform is Google Cloud's Customer Identity and Access Management (CIAM) service designed for application end-users, including both public consumers and enterprise users via federation (SAML/OIDC). Workforce Identity Federation is intended to grant external workforce identities access to Google Cloud resources, not to serve as the authentication system for a public-facing application with mixed consumer and corporate users.
Question 69
You work for an organization that handles sensitive customer data. You must secure a series of Google Cloud Storage buckets housing this data and meet these requirements:
• Multiple teams need varying access levels (some read-only, some read-write).
• Data must be protected in storage and at rest.
• It's critical to track file changes and audit access for compliance purposes.
• For compliance purposes, the organization must have control over the encryption keys.
What should you do?
A. Create IAM groups for each team and manage permissions at the group level. Employ server-side encryption and Object Versioning by Google Cloud Storage. Configure cloud monitoring tools to alert on anomalous data access patterns.
B. Set individual permissions for each team and apply access control lists (ACLs) to each bucket and file. Enforce TLS encryption for file transfers. Enable Object Versioning and Cloud Audit Logs for the storage buckets.
C. Use predefined IAM roles tailored to each team's access needs, such as Storage Object Viewer and Storage Object User. Utilize customer-supplied encryption keys (CSEK) and enforce TLS encryption. Turn on both Object Versioning and Cloud Audit Logs for the storage buckets.
D. Assign IAM permissions for all teams at the object level. Implement third-party software to encrypt data at rest. Track data access by using network logs.
Show Answer
Correct Answer: C
Explanation: Option C best satisfies all stated requirements: predefined IAM roles provide least-privilege access for different teams; customer-supplied encryption keys (CSEK) ensure the organization controls the encryption keys; TLS protects data in transit; Object Versioning tracks file changes; and Cloud Audit Logs provide auditable access records. The other options either rely on less-recommended permission models, omit customer-controlled keys, or lack proper auditing/encryption controls.
Question 70
You work for a banking organization. You are migrating sensitive customer data to Google Cloud that is currently encrypted at rest while on-premises. There are strict regulatory requirements when moving sensitive data to the cloud. Independent of the cloud service provider, you must be able to audit key usage and be able to deny certain types of decrypt requests. You must choose an encryption strategy that will ensure robust security and compliance with the regulations. What should you do?
A. Utilize Google default encryption and Cloud IAM to keep the keys within your organization's control.
B. Implement Cloud External Key Manager (Cloud EKM) with Access Approval, to integrate with your existing on-premises key management solution.
C. Implement Cloud External Key Manager (Cloud EKM) with Key Access Justifications to integrate with your existing one premises key management solution.
D. Utilize customer-managed encryption keys (CMEK) created in a dedicated Google Compute Engine instance with Confidential Compute encryption, under your organization's control.
Show Answer
Correct Answer: C
Explanation: Cloud External Key Manager (Cloud EKM) keeps cryptographic keys outside Google Cloud, satisfying the requirement for independent key control. Key Access Justifications (KAJ) provides a justification with each external key access request, allowing the external key manager to audit requests and enforce policy by approving or denying specific decrypt operations. Access Approval is about approving Google personnel access to customer content, not controlling cryptographic key decrypt requests.
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.