Professional Cloud Security Engineer Free Practice Questions — Page 7
Question 53
Your organization has an internet-facing application behind a load balancer. Your regulators require end-to-end encryption of user login credentials. You must implement this requirement. What should you do?
A. Generate a symmetric key with Cloud KMS. Encrypt client-side user credentials by using the symmetric key.
B. Concatenate the credential with a timestamp. Submit the timestamp and hashed value of credentials to the network.
C. Deploy the TLS certificate at Google Cloud Global HTTPs Load Balancer, and submit the user credentials through HTTPs.
D. Generate an asymmetric key with Cloud KMS. Encrypt client-side user credentials using the public key.
Show Answer
Correct Answer: C
Explanation: End-to-end encryption of user credentials in this context means encryption in transit from the client to the backend service. Using HTTPS with a Google Cloud Global HTTPS Load Balancer provides TLS from the client to the load balancer, and the load balancer can re-encrypt traffic (TLS bridging) to the backend, preserving encryption across all network hops. Client-side encryption with Cloud KMS keys is impractical for public clients and not a standard or required approach for this regulatory requirement.
Question 54
You are implementing a new web application on Google Cloud that will be accessed from your on-premises network. To provide protection from threats like malware, you must implement transport layer security (TLS) interception for incoming traffic to your application. What should you do?
A. Configure Secure Web Proxy. Offload the TLS traffic in the load balancer, inspect the traffic, and forward the traffic to the web application.
B. Configure an internal proxy load balancer. Offload the TLS traffic in the load balancer inspect, the traffic and forward the traffic to the web application.
C. Configure a hierarchical firewall policy. Enable TLS interception by using Cloud Next Generation Firewall (NGFW) Enterprise.
D. Configure a VPC firewall rule. Enable TLS interception by using Cloud Next Generation Firewall (NGFW) Enterprise.
Show Answer
Correct Answer: C
Explanation: TLS interception for incoming application traffic on Google Cloud requires a security service that can decrypt and inspect encrypted traffic at layer 7. Cloud Next Generation Firewall (NGFW) Enterprise provides native TLS inspection and threat prevention capabilities. These features are enabled and applied through network or hierarchical firewall policies. Secure Web Proxy is intended for outbound (egress) traffic, load balancers do not perform deep TLS inspection for malware, and basic VPC firewall rules cannot do TLS interception. Therefore, configuring a hierarchical firewall policy with NGFW Enterprise is the correct approach.
Question 55
Your organization has hired a small, temporary partner team for 18 months. The temporary team will work alongside your DevOps team to develop your organization's application that is hosted on Google Cloud. You must give the temporary partner team access to your application's resources on Google Cloud and ensure that partner employees lose access. If they are removed from their employer's organization. What should you do?
A. Create a temporary username and password for the temporary partner team members. Auto-clean the usernames and passwords after the work engagement has ended.
B. Create a workforce identity pool and federate the identity pool with the identity provider (IdP) of the temporary partner team.
C. Implement just-in-time privileged access to Google Cloud for the temporary partner team.
D. Add the identities of the temporary partner team members to your identity provider (IdP).
Show Answer
Correct Answer: B
Explanation: Workforce Identity Federation lets you grant Google Cloud access to external users based on their own employer’s identity provider. Access is automatically revoked when a partner employee is removed from their organization, and you avoid managing temporary local accounts. This fits a temporary partner team working alongside your DevOps team.
Question 56
Your organization шs using a third-party identity and authentication provider to centrally manage users. You want to use this identity provider to grant access to the Google Cloud console without syncing identities to Google Cloud. Users should receive permissions based on attributes. What should you do?
A. Configure the central identity provider as a workforce identity pool provider in Workforce Identity Federation. Create an attribute mapping by using the Common Expression Language (CEL).
B. Configure a periodic synchronization of relevant users and groups with attributes to Cloud Identity. Activate single sign-on by using the Security Assertion Markup Language (SAML).
C. Set up the Google Cloud Identity Platform. Configure an external authentication provider by using OpenID Connect and link user accounts based on attributes.
D. Activate external identities on the Identity-Aware Proxy. Use the Security Assertion Markup Language (SAML) to configure authentication based on attributes to the central authentication provider.
Show Answer
Correct Answer: A
Explanation: Workforce Identity Federation is specifically designed to let third-party identity providers grant access to Google Cloud resources without syncing users into Google Cloud. By configuring the external IdP as a workforce identity pool provider and using CEL attribute mappings, you can map external user attributes to IAM principals and grant permissions based on those attributes. The other options require syncing identities, are intended for application authentication, or apply only to IAP-protected apps rather than Google Cloud console access.
Question 57
You are implementing communications restrictions for specific services in your Google Cloud organization. Your data analytics team works in a dedicated folder. You need to ensure that access to BigQuery is controlled for that folder and its projects. The data analytics team must be able to control the restrictions only at the folder level. What should you do?
A. Create an organization-level access policy with a service perimeter to restrict BigQuery access. Assign the data analytics team the Access Context Manager Editor role on the access policy to allow the team to configure the access policy.
B. Create a scoped policy on the folder with a service perimeter to restrict BigQuery access. Assign the data analytics team the Access Context Manager Editor role on the scoped policy to allow the team to configure the scoped policy.
C. Define a hierarchical firewall policy on the folder to deny BigQuery access. Assign the data analytics team the Compute Organization Firewall Policy Admin role to allow the team to configure rules for the firewall policy.
D. Enforce the Restrict Resource Service Usage organization policy constraint on the folder to restrict BigQuery access. Assign the data analytics team the Organization Policy Administrator role to allow the team to manage exclusions within the folder.
Show Answer
Correct Answer: B
Explanation: The requirement is to restrict BigQuery access only for a specific folder and its projects, while delegating control of those restrictions to the data analytics team at the folder level. VPC Service Controls is the correct mechanism to restrict access to Google-managed services like BigQuery. Using a scoped access policy allows service perimeters to be defined and managed at the folder level without granting organization-wide control. Assigning the Access Context Manager Editor role on the scoped policy lets the team manage the restrictions themselves. Organization-level policies, firewall rules, or org policy constraints either scope too broadly or do not provide proper BigQuery service control.
Question 58
Your organization is developing an application that will have both corporate and public end-users. You want to centrally manage those customers' identities and authorizations. Corporate end users must access the application by using their corporate user and domain name. What should you do?
A. Add the corporate and public end-user domains to domain restricted sharing on the organization.
B. Federate the customers' identity provider (IdP) with Workforce Identity Federation in your application's project.
C. Do nothing. Google Workspace identities will allow you to filter personal accounts and disable their access.
D. Use a customer identity and access management tool (CIAM) like Identity Platform.
Show Answer
Correct Answer: D
Explanation: The application must support both corporate users and public end-users while centrally managing identities and authorizations. A Customer Identity and Access Management (CIAM) solution like Google Cloud Identity Platform is designed for application end-users, supports public sign-in methods, and can federate with corporate identity providers so corporate users authenticate with their existing corporate credentials. Workforce Identity Federation is intended for workforce access to Google Cloud resources, not public application users, making D the correct choice.
Question 59
You work for an organization that handles sensitive customer data. You must secure a series of Google Cloud Storage buckets housing this data and meet these requirements:
• Multiple teams need varying access levels (some read-only, some read-write).
• Data must be protected in storage and at rest.
• It's critical to track file changes and audit access for compliance purposes.
• For compliance purposes, the organization must have control over the encryption keys.
What should you do?
A. Create IAM groups for each team and manage permissions at the group level. Employ server-side encryption and Object Versioning by Google Cloud Storage. Configure cloud monitoring tools to alert on anomalous data access patterns.
B. Set individual permissions for each team and apply access control lists (ACLs) to each bucket and file. Enforce TLS encryption for file transfers. Enable Object Versioning and Cloud Audit Logs for the storage buckets.
C. Use predefined IAM roles tailored to each team's access needs, such as Storage Object Viewer and Storage Object User. Utilize customer-supplied encryption keys (CSEK) and enforce TLS encryption. Turn on both Object Versioning and Cloud Audit Logs for the storage buckets.
D. Assign IAM permissions for all teams at the object level. Implement third-party software to encrypt data at rest. Track data access by using network logs.
Show Answer
Correct Answer: C
Explanation: Option C best satisfies all requirements. Predefined IAM roles (e.g., Storage Object Viewer/User) support least‑privilege access for multiple teams. Customer‑supplied encryption keys (CSEK) ensure the organization retains full control over encryption keys, meeting compliance needs for data at rest. Enforcing TLS protects data in transit. Object Versioning enables tracking of file changes, and Cloud Audit Logs provide detailed auditing of access and administrative actions. The other options either lack customer‑controlled encryption keys or rely on less recommended access control models.
Question 60
You work for a banking organization. You are migrating sensitive customer data to Google Cloud that is currently encrypted at rest while on-premises. There are strict regulatory requirements when moving sensitive data to the cloud. Independent of the cloud service provider, you must be able to audit key usage and be able to deny certain types of decrypt requests. You must choose an encryption strategy that will ensure robust security and compliance with the regulations. What should you do?
A. Utilize Google default encryption and Cloud IAM to keep the keys within your organization's control.
B. Implement Cloud External Key Manager (Cloud EKM) with Access Approval, to integrate with your existing on-premises key management solution.
C. Implement Cloud External Key Manager (Cloud EKM) with Key Access Justifications to integrate with your existing one premises key management solution.
D. Utilize customer-managed encryption keys (CMEK) created in a dedicated Google Compute Engine instance with Confidential Compute encryption, under your organization's control.
Show Answer
Correct Answer: C
Explanation: The requirements state that encryption key control must be independent of Google, that all key usage must be auditable, and that specific decrypt requests must be allowed or denied. Cloud External Key Manager (EKM) keeps keys in an external, on‑premises HSM/KMS under your control. Key Access Justifications forces every decrypt request to include a justification that is passed to the external key manager, where it can be logged, audited, and programmatically approved or denied. Access Approval only governs Google personnel access and does not control or deny cryptographic operations, so it does not fully meet the requirement.
Question 61
Your application development team is releasing a new critical feature. To complete their final testing, they requested 10 thousand real transaction records. The new feature includes format checking on the primary account number (PAN) of a credit card. You must support the request and minimize the risk of unintended personally identifiable information (PII) exposure. What should you do?
A. Run the new application by using Confidential Computing to ensure PII and card PAN is encrypted in use.
B. Scan and redact PII from the records by using the Cloud Data Loss Prevention API. Perform format-preserving encryption on the card PAN.
C. Encrypt the records by using Cloud Key Management Service to protect the PII and card PAN.
D. Build a tool to replace the card PAN and PII fields with randomly generated values.
Show Answer
Correct Answer: B
Explanation: The team needs real transaction data while minimizing PII exposure, and the feature specifically validates PAN format. Cloud DLP can identify and redact other PII, and format-preserving encryption on the PAN replaces real card numbers with encrypted values that retain length and structure, allowing format checks to work without exposing real PANs. Other options either still expose real PANs during testing or break format validation.
Question 62
Your organization 1s developing a new SaaS application on Google Cloud. Stringent compliance standards require visibility into privileged account activity, and potentially unauthorized changes and misconfigurations to the application's infrastructure. You need to monitor administrative actions, log changes to IAM roles and permissions, and be able to trace potentially unauthorized configuration changes. What should you do?
A. Create log sinks to Cloud Storage for long-term retention. Set up log-based alerts in Cloud Logging based on relevant log types. Enable VPC Flow Logs for network visibility.
B. Deploy Cloud IDS and activate Firewall Rules Logging. Create a custom dashboard in Security Command Center to visualize potential intrusion attempts.
C. Detect sensitive administrative actions by using Cloud Logging with custom filters. Enable VPC Flow Logs with BigQuery exports for rapid analysis of network traffic patterns.
D. Enable Event Threat Detection and Security Health Analytics in Security Command Center. Set up detailed logging for IAM-related activity and relevant project resources by deploying Cloud Audit Logs.
Show Answer
Correct Answer: D
Explanation: The requirements focus on visibility into privileged/admin actions, IAM role and permission changes, and detection of misconfigurations. Cloud Audit Logs provide authoritative logs of administrative and IAM changes. Security Command Center’s Security Health Analytics detects misconfigurations, and Event Threat Detection identifies suspicious or unauthorized activity using threat intelligence. Together, they deliver comprehensive monitoring and traceability for compliance.
$19
Get all 350 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.