Professional Cloud Security Engineer Free Practice Questions — Page 8
Question 68
Your organization is developing an application that will have both corporate and public end-users. You want to centrally manage those customers' identities and authorizations. Corporate end users must access the application by using their corporate user and domain name. What should you do?
A. Add the corporate and public end-user domains to domain restricted sharing on the organization.
B. Federate the customers' identity provider (IdP) with Workforce Identity Federation in your application's project.
C. Do nothing. Google Workspace identities will allow you to filter personal accounts and disable their access.
D. Use a customer identity and access management tool (CIAM) like Identity Platform.
Show Answer
Correct Answer: D
Explanation: Identity Platform is Google Cloud's Customer Identity and Access Management (CIAM) service designed for application end-users, including both public consumers and enterprise users via federation (SAML/OIDC). Workforce Identity Federation is intended to grant external workforce identities access to Google Cloud resources, not to serve as the authentication system for a public-facing application with mixed consumer and corporate users.
Question 69
You work for an organization that handles sensitive customer data. You must secure a series of Google Cloud Storage buckets housing this data and meet these requirements:
• Multiple teams need varying access levels (some read-only, some read-write).
• Data must be protected in storage and at rest.
• It's critical to track file changes and audit access for compliance purposes.
• For compliance purposes, the organization must have control over the encryption keys.
What should you do?
A. Create IAM groups for each team and manage permissions at the group level. Employ server-side encryption and Object Versioning by Google Cloud Storage. Configure cloud monitoring tools to alert on anomalous data access patterns.
B. Set individual permissions for each team and apply access control lists (ACLs) to each bucket and file. Enforce TLS encryption for file transfers. Enable Object Versioning and Cloud Audit Logs for the storage buckets.
C. Use predefined IAM roles tailored to each team's access needs, such as Storage Object Viewer and Storage Object User. Utilize customer-supplied encryption keys (CSEK) and enforce TLS encryption. Turn on both Object Versioning and Cloud Audit Logs for the storage buckets.
D. Assign IAM permissions for all teams at the object level. Implement third-party software to encrypt data at rest. Track data access by using network logs.
Show Answer
Correct Answer: C
Explanation: Option C best satisfies all stated requirements: predefined IAM roles provide least-privilege access for different teams; customer-supplied encryption keys (CSEK) ensure the organization controls the encryption keys; TLS protects data in transit; Object Versioning tracks file changes; and Cloud Audit Logs provide auditable access records. The other options either rely on less-recommended permission models, omit customer-controlled keys, or lack proper auditing/encryption controls.
Question 70
You work for a banking organization. You are migrating sensitive customer data to Google Cloud that is currently encrypted at rest while on-premises. There are strict regulatory requirements when moving sensitive data to the cloud. Independent of the cloud service provider, you must be able to audit key usage and be able to deny certain types of decrypt requests. You must choose an encryption strategy that will ensure robust security and compliance with the regulations. What should you do?
A. Utilize Google default encryption and Cloud IAM to keep the keys within your organization's control.
B. Implement Cloud External Key Manager (Cloud EKM) with Access Approval, to integrate with your existing on-premises key management solution.
C. Implement Cloud External Key Manager (Cloud EKM) with Key Access Justifications to integrate with your existing one premises key management solution.
D. Utilize customer-managed encryption keys (CMEK) created in a dedicated Google Compute Engine instance with Confidential Compute encryption, under your organization's control.
Show Answer
Correct Answer: C
Explanation: Cloud External Key Manager (Cloud EKM) keeps cryptographic keys outside Google Cloud, satisfying the requirement for independent key control. Key Access Justifications (KAJ) provides a justification with each external key access request, allowing the external key manager to audit requests and enforce policy by approving or denying specific decrypt operations. Access Approval is about approving Google personnel access to customer content, not controlling cryptographic key decrypt requests.
Question 71
Your application development team is releasing a new critical feature. To complete their final testing, they requested 10 thousand real transaction records. The new feature includes format checking on the primary account number (PAN) of a credit card. You must support the request and minimize the risk of unintended personally identifiable information (PII) exposure. What should you do?
A. Run the new application by using Confidential Computing to ensure PII and card PAN is encrypted in use.
B. Scan and redact PII from the records by using the Cloud Data Loss Prevention API. Perform format-preserving encryption on the card PAN.
C. Encrypt the records by using Cloud Key Management Service to protect the PII and card PAN.
D. Build a tool to replace the card PAN and PII fields with randomly generated values.
Show Answer
Correct Answer: B
Explanation: The goal is to provide realistic transaction records for testing while minimizing exposure of sensitive data. Cloud DLP can identify and redact other PII, and its format-preserving encryption (FPE) can tokenize the credit card PAN while preserving its format, allowing the application's PAN format validation to work without exposing the real card numbers. Confidential Computing protects data in use but does not sanitize the dataset shared with developers. Cloud KMS encryption would make the data unusable for application testing unless decrypted, exposing the original data. Randomly generated replacements are less suitable because they may not preserve valid PAN format or realistic data relationships unless significant custom logic is built.
Question 72
Your organization 1s developing a new SaaS application on Google Cloud. Stringent compliance standards require visibility into privileged account activity, and potentially unauthorized changes and misconfigurations to the application's infrastructure. You need to monitor administrative actions, log changes to IAM roles and permissions, and be able to trace potentially unauthorized configuration changes. What should you do?
A. Create log sinks to Cloud Storage for long-term retention. Set up log-based alerts in Cloud Logging based on relevant log types. Enable VPC Flow Logs for network visibility.
B. Deploy Cloud IDS and activate Firewall Rules Logging. Create a custom dashboard in Security Command Center to visualize potential intrusion attempts.
C. Detect sensitive administrative actions by using Cloud Logging with custom filters. Enable VPC Flow Logs with BigQuery exports for rapid analysis of network traffic patterns.
D. Enable Event Threat Detection and Security Health Analytics in Security Command Center. Set up detailed logging for IAM-related activity and relevant project resources by deploying Cloud Audit Logs.
Show Answer
Correct Answer: D
Explanation: The requirements are to monitor privileged administrative actions, track IAM role and permission changes, detect misconfigurations, and trace unauthorized configuration changes. Cloud Audit Logs provide the authoritative record of administrative activity and IAM/resource changes. Security Command Center's Security Health Analytics detects misconfigurations, and Event Threat Detection helps identify suspicious or potentially malicious activity. The other options either focus on log storage, networking, or intrusion detection without comprehensively addressing IAM auditing and configuration monitoring.
Question 73
You are responsible for a set of Cloud Functions running on your organization's Google Cloud environment. During the last annual security review, secrets were identified in environment variables of some of these Cloud Functions. You must ensure that secrets are identified in a timely manner. What should you do?
A. Implement regular peer reviews to assess the environment variables and identify secrets in your Cloud Functions. Raise a security incident if secrets are discovered.
B. Implement a Cloud Function that scans the environment variables multiple times a day, and creates a finding in Security Command Center if secrets are discovered.
C. Use Sensitive Data Protection to scan the environment variables multiple times per day, and create a finding in Security Command Center if secrets are discovered.
D. Integrate dynamic application security testing into the CI/CD pipeline that scans the application code for the Cloud Functions. Fail the build process if secrets are discovered.
Show Answer
Correct Answer: C
Explanation: Sensitive Data Protection has a managed secrets discovery capability that periodically scans Cloud Functions (Cloud Run functions) environment variables for secrets and automatically creates Security Command Center findings. This directly satisfies the requirement to identify secrets in environment variables in a timely manner without building custom scanners. Peer review is manual, a custom Cloud Function is unnecessary, and DAST/code scanning targets source code rather than deployed runtime environment variables.
Question 74
Your organization's use of the Google Cloud has grown substantially and there are many different groups using different cloud resources independently. You must identify common misconfigurations and compliance violations across the organization and track findings for remedial action in a dashboard. What should you do?
A. Create a filter set in Cloud Asset Inventory to identify service accounts with high privileges and IAM principals with Gmail domains.
B. Scan and alert vulnerabilities and misconfigurations by using Secure Health Analytics detectors in Security Command Center Premium.
C. Set up filters on Cloud Audit Logs to flag log entries for specific, risky API calls, and display the calls in a Cloud Log Analytics dashboard.
D. Alert and track emerging attacks detected in your environment by using Event Threat Detection detectors.
Show Answer
Correct Answer: B
Explanation: Security Command Center Premium's Secure Health Analytics is designed to continuously detect misconfigurations and compliance violations across Google Cloud resources, generate findings, and provide a centralized dashboard for tracking remediation. Cloud Asset Inventory can query assets but is not a comprehensive findings/remediation solution, Cloud Audit Logs focus on API activity rather than configuration compliance, and Event Threat Detection identifies active threats rather than configuration issues.
Question 75
You just implemented a Secure Web Proxy instance on Google Cloud for your organization. You were able to reach the internet when you tested this configuration on your test instance. However, developers cannot access the allowed URLs on the Secure Web Proxy instance from their Linux instance on Google Cloud. You want to solve this problem with developers. What should you do?
A. Configure a Cloud NAT gateway to enable internet access from the developer instance subnet.
B. Ensure that the developers have restarted their instance and HTTP service is enabled.
C. Ensure that the developers have explicitly configured the proxy address on their instance.
D. Configure a firewall rule to allow HTTP/S from the developer instance.
Show Answer
Correct Answer: C
Explanation: Secure Web Proxy operates as an explicit proxy. Client systems or applications must be configured to send HTTP/HTTPS traffic to the proxy's address and port. Since the proxy worked during testing, the most likely issue is that the developers' Linux instances are not configured to use the proxy. Cloud NAT is not required for using the proxy, restarting instances or enabling an HTTP service is unrelated, and generic firewall rules do not configure clients to route traffic through the proxy.
Question 76
You have just created a new log bucket to replace the _Default log bucket. You want to route all log entries that are currently routed to the _Default log bucket to this new log bucket, in the most efficient manner. What should you do?
A. Create exclusion filters for the _Default sink to prevent it from receiving new logs. Create a user-defined sink, and select the new log bucket as the sink destination.
B. Disable the _Default sink. Create a user-defined sink and select the new log bucket as the sink destination.
C. Create a user-defined sink with inclusion filters copied from the _Default sink. Select the new log bucket as the sink destination.
D. Edit the _Default sink, and select the new log bucket as the sink destination.
Show Answer
Correct Answer: D
Explanation: The _Default sink can be edited to change its destination. Updating the existing _Default sink to point to the new log bucket preserves its existing routing behavior and is the most efficient way to redirect all logs that were previously routed to the _Default bucket. Creating a new sink or adding exclusion filters is unnecessary for this scenario.
Question 77
Your organization has an application hosted in Cloud Run. You must control access to the application by using Cloud Identity-Aware Proxy (IAP) with these requirements:
• Only users from the AppDev group may have access.
• Access must be restricted to internal network IP addresses.
What should you do?
A. Deploy a VPN gateway and instruct the AppDev group to connect to the company network before accessing the application.
B. Create an access level that includes conditions for internal IP address ranges and AppDev groups. Apply this access level to the application's IAP policy.
C. Configure firewall rules to limit access to IAP based on the AppDev group and source IP addresses.
D. Configure IAP to enforce multi-factor authentication (MFA) for all users and use network intrusion detection systems (NIDS) to block unauthorized access attempts.
Show Answer
Correct Answer: B
Explanation: Cloud Identity-Aware Proxy integrates with Access Context Manager access levels. You can create an access level that requires requests to originate from internal IP address ranges and satisfy identity-based conditions, then apply that access level to the IAP-protected Cloud Run application. Grant IAP access only to the AppDev group, and enforce the access level in the IAP policy to restrict access by both group membership and network location. The other options do not implement IAP context-aware access correctly or rely on unrelated controls.
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.