Professional Cloud Security Engineer Free Practice Questions — Page 8
Question 63
You are responsible for a set of Cloud Functions running on your organization's Google Cloud environment. During the last annual security review, secrets were identified in environment variables of some of these Cloud Functions. You must ensure that secrets are identified in a timely manner. What should you do?
A. Implement regular peer reviews to assess the environment variables and identify secrets in your Cloud Functions. Raise a security incident if secrets are discovered.
B. Implement a Cloud Function that scans the environment variables multiple times a day, and creates a finding in Security Command Center if secrets are discovered.
C. Use Sensitive Data Protection to scan the environment variables multiple times per day, and create a finding in Security Command Center if secrets are discovered.
D. Integrate dynamic application security testing into the CI/CD pipeline that scans the application code for the Cloud Functions. Fail the build process if secrets are discovered.
Show Answer
Correct Answer: C
Explanation: The requirement is to automatically and timely identify secrets that already exist in Cloud Functions environment variables and surface them as security findings. Google Cloud Sensitive Data Protection (formerly DLP) natively supports secrets discovery for Cloud Functions/Cloud Run environment variables, runs on a schedule, and generates findings directly in Security Command Center. This precisely matches the use case. Peer reviews (A) are manual and not timely, a custom scanning function (B) is unnecessary and less reliable, and dynamic application security testing in CI/CD (D) scans code before deployment and does not detect secrets already present in runtime environment variables.
Question 64
Your organization's use of the Google Cloud has grown substantially and there are many different groups using different cloud resources independently. You must identify common misconfigurations and compliance violations across the organization and track findings for remedial action in a dashboard. What should you do?
A. Create a filter set in Cloud Asset Inventory to identify service accounts with high privileges and IAM principals with Gmail domains.
B. Scan and alert vulnerabilities and misconfigurations by using Secure Health Analytics detectors in Security Command Center Premium.
C. Set up filters on Cloud Audit Logs to flag log entries for specific, risky API calls, and display the calls in a Cloud Log Analytics dashboard.
D. Alert and track emerging attacks detected in your environment by using Event Threat Detection detectors.
Show Answer
Correct Answer: B
Explanation: The requirement is to centrally identify common misconfigurations and compliance violations across many Google Cloud projects and track findings in a dashboard for remediation. Security Command Center Premium with Security Health Analytics provides built-in detectors that continuously scan resources for misconfigurations, insecure settings, and compliance issues, and aggregates findings in a centralized dashboard. The other options focus on narrow checks (Asset Inventory), logging specific API calls, or detecting active threats rather than broad configuration and compliance posture.
Question 65
You just implemented a Secure Web Proxy instance on Google Cloud for your organization. You were able to reach the internet when you tested this configuration on your test instance. However, developers cannot access the allowed URLs on the Secure Web Proxy instance from their Linux instance on Google Cloud. You want to solve this problem with developers. What should you do?
A. Configure a Cloud NAT gateway to enable internet access from the developer instance subnet.
B. Ensure that the developers have restarted their instance and HTTP service is enabled.
C. Ensure that the developers have explicitly configured the proxy address on their instance.
D. Configure a firewall rule to allow HTTP/S from the developer instance.
Show Answer
Correct Answer: C
Explanation: Secure Web Proxy on Google Cloud is an explicit proxy service. Client VMs and applications must be configured to send their HTTP/HTTPS traffic to the proxy’s IP address and port. Since the proxy works in testing, the issue is that developers’ Linux instances are not explicitly configured to use it, so their traffic bypasses the proxy and fails to reach the allowed URLs.
Question 66
You have just created a new log bucket to replace the _Default log bucket. You want to route all log entries that are currently routed to the _Default log bucket to this new log bucket, in the most efficient manner. What should you do?
A. Create exclusion filters for the _Default sink to prevent it from receiving new logs. Create a user-defined sink, and select the new log bucket as the sink destination.
B. Disable the _Default sink. Create a user-defined sink and select the new log bucket as the sink destination.
C. Create a user-defined sink with inclusion filters copied from the _Default sink. Select the new log bucket as the sink destination.
D. Edit the _Default sink, and select the new log bucket as the sink destination.
Show Answer
Correct Answer: D
Explanation: The _Default sink already routes all logs that are not matched by other sinks into the _Default log bucket. To move those logs efficiently to a new log bucket, you can simply edit the existing _Default sink and change its destination to the new bucket. This avoids creating additional sinks, duplicating filters, or managing exclusions, and immediately reroutes all applicable logs.
Question 67
Your organization has an application hosted in Cloud Run. You must control access to the application by using Cloud Identity-Aware Proxy (IAP) with these requirements:
• Only users from the AppDev group may have access.
• Access must be restricted to internal network IP addresses.
What should you do?
A. Deploy a VPN gateway and instruct the AppDev group to connect to the company network before accessing the application.
B. Create an access level that includes conditions for internal IP address ranges and AppDev groups. Apply this access level to the application's IAP policy.
C. Configure firewall rules to limit access to IAP based on the AppDev group and source IP addresses.
D. Configure IAP to enforce multi-factor authentication (MFA) for all users and use network intrusion detection systems (NIDS) to block unauthorized access attempts.
Show Answer
Correct Answer: B
Explanation: Cloud Identity-Aware Proxy integrates with Access Context Manager access levels. An access level can combine multiple conditions, such as requiring the user to be a member of the AppDev group and originating from approved internal IP address ranges. Applying this access level to the Cloud Run service’s IAP policy enforces both identity-based and network-based restrictions as required. Other options either bypass IAP controls or do not provide the required group- and IP-based enforcement.
Question 68
Your organization operates a hybrid cloud environment and has recently deployed a private Artifact Registry repository in Google Cloud. On-premises developers cannot resolve the Artifact Registry hostname and therefore cannot push or pull artifacts. You've verified the following:
• Connectivity to Google Cloud is established by Cloud VPN or Cloud Interconnect.
• No custom DNS configurations exist on-premises.
• There is no route to the internet from the on-premises network.
You need to identify the cause and enable the developers to push and pull artifacts. What is likely causing the issue and what should you do to fix the issue?
A. On-premises DNS servers lack the necessary records to resolve private Google API domains. Create DNS records for restricted.googleapis.com or private.googleapis.com pointing to Google's published IP ranges.
B. Developers must be granted the artifactregistry.writer IAM role. Grant the relevant developer group this role.
C. Private Google Access is not enabled for the subnet hosting the Artifact Registry. Enable Private Google Access for the appropriate subnet.
D. Artifact Registry requires external HTTP/HTTPS access. Create a new firewall rule allowing ingress traffic on ports 80 and 443 from the developer's IP ranges.
Show Answer
Correct Answer: A
Explanation: The problem states that on‑premises developers cannot resolve the Artifact Registry hostname, not that they lack permissions or network connectivity. With no internet egress and no custom DNS configuration, on‑premises DNS servers cannot resolve Google API hostnames. Accessing Artifact Registry privately requires DNS resolution for private.googleapis.com or restricted.googleapis.com that maps Google APIs to Google’s private IP ranges so traffic flows over VPN/Interconnect. Creating the appropriate DNS records fixes hostname resolution and enables push/pull operations.
Question 69
You work for a large organization that is using Cloud Identity as the identity provider (IdP) on Google Cloud. Your InfoSec team has mandated the enforcement of a strong password with a length between 12 and 16 characters for all users. After configuring this requirement, users are still able to access the Google Cloud console with passwords that are less than 12 characters. You need to fix this problem within the Admin console. What should you do?
A. Review each user's password configuration and reset existing passwords.
B. Review the organization password management setting and select Enforce password policy at the next sign-in.
C. Review each user's password configuration and select Enforce strong password.
D. Review the organization password management setting and select Enforce strong password.
Show Answer
Correct Answer: B
Explanation: In Cloud Identity/Google Workspace, changing the password length or strength policy does not retroactively force existing users to update passwords that no longer comply. To fix users who can still sign in with shorter passwords, you must enforce the policy at the next sign-in. Selecting "Enforce password policy at the next sign-in" in the organization password management settings forces all noncompliant users to change their passwords on their next login.
Question 70
Your organization is preparing to build business services in Google Cloud for the first time. You must determine where to apply appropriate controls or policies. You must also identify what aspects of your cloud deployment are managed by Google. What should you do?
A. Model your deployment on the Google Enterprise foundations blueprint. Follow the blueprint exactly and rely on the blueprint to maintain the posture necessary for your business.
B. Use the Risk Manager tool in the Risk Protection Program to generate a report on your cloud security posture. Obtain cyber insurance coverage.
C. Subscribe to the Google Cloud release notes to keep up on product updates and when new services are available. Evaluate new services for appropriate use before enabling their API.
D. Study the shared responsibilities model. Depending on your business scenario, you might need to consider your responsibilities based on the location of your business offices, your customers, and your data.
Show Answer
Correct Answer: D
Explanation: When building services on Google Cloud for the first time, the key requirement is to understand where controls and policies must be applied by your organization versus what Google manages for you. This is defined by Google Cloud’s shared responsibility model. Studying this model clarifies customer responsibilities (such as IAM configuration, network security, data protection, and compliance) versus Google’s responsibilities (such as physical data center security and underlying infrastructure). The other options do not directly establish this foundational understanding.
Question 71
You are creating a secure network architecture. You must fully isolate development and production environments, and prevent any network traffic between the two environments. The network team requires that there is only one central entry point to the cloud network from the on-premises environment. What should you do?
A. Create one Virtual Private Cloud (VPC) network per environment. Add the on-premises entry point to the production VPC. Peer the VPCs with each other and create firewall rules to prevent traffic.
B. Create one shared Virtual Private Cloud (VPC) network and use it as the entry point to the cloud network. Create separate subnets per environment. Create firewall rules to prevent traffic.
C. Create one Virtual Private Cloud (VPC) network per environment. Create a VPC Service Controls perimeter per environment and add one environment VPC to each.
D. Create one Virtual Private Cloud (VPC) network per environment. Create one additional VPC for the entry point to the cloud network. Peer the entry point VPC with the environment VPCs.
Show Answer
Correct Answer: D
Explanation: You must both fully isolate dev and prod and have a single on‑premises entry point. Using separate VPCs per environment provides hard network isolation. Adding a dedicated entry‑point (hub) VPC and peering it with each environment VPC creates a hub‑and‑spoke design with one central ingress. VPC Network Peering is non‑transitive, so dev and prod cannot communicate with each other through the hub, satisfying the isolation requirement. Other options either rely on firewall rules within a shared or peered network or use VPC Service Controls, which do not provide network‑level isolation.
Question 72
Your EU-based organization stores both Personally Identifiable Information (PII) and non-PII data in Cloud Storage buckets across multiple Google Cloud regions. EU data privacy laws require that the PII data must not be stored outside of the EU. To help meet this compliance requirement, you want to detect if Cloud Storage buckets outside of the EU contain healthcare data. What should you do?
A. Create a Sensitive Data Protection job. Specify the infoType of data to be detected and run the job across all Google Cloud Storage buckets.
B. Create a log sink with a filter on resourceLocation.currentLocations. Trigger an alert if a log message appears with a non- EUcountry.
C. Activate Security Command Center Premium. Use compliance monitoring to detect resources that do not follow the applicable healthcare regulation.
D. Enforce the gcp.resourceLocations organization policy and add "EU" in a custom rule that only applies on resources with the tag "healthcare".
Show Answer
Correct Answer: A
Explanation: The requirement is to detect whether Cloud Storage buckets outside the EU contain healthcare or other PII data. Sensitive Data Protection (Cloud DLP) is the service designed to scan the *contents* of Cloud Storage buckets for specific infoTypes (such as healthcare-related identifiers). By running a DLP job across all buckets, you can identify which buckets—regardless of region—contain healthcare data and then determine if any are located outside the EU. The other options focus on logging, policy enforcement, or compliance reporting, but they do not directly inspect bucket contents for sensitive data.
$19
Get all 350 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.