Professional Cloud Security Engineer Free Practice Questions — Page 8
Question 71
Your application development team is releasing a new critical feature. To complete their final testing, they requested 10 thousand real transaction records. The new feature includes format checking on the primary account number (PAN) of a credit card. You must support the request and minimize the risk of unintended personally identifiable information (PII) exposure. What should you do?
A. Run the new application by using Confidential Computing to ensure PII and card PAN is encrypted in use.
B. Scan and redact PII from the records by using the Cloud Data Loss Prevention API. Perform format-preserving encryption on the card PAN.
C. Encrypt the records by using Cloud Key Management Service to protect the PII and card PAN.
D. Build a tool to replace the card PAN and PII fields with randomly generated values.
Show Answer
Correct Answer: B
Explanation: The goal is to provide realistic transaction records for testing while minimizing exposure of sensitive data. Cloud DLP can identify and redact other PII, and its format-preserving encryption (FPE) can tokenize the credit card PAN while preserving its format, allowing the application's PAN format validation to work without exposing the real card numbers. Confidential Computing protects data in use but does not sanitize the dataset shared with developers. Cloud KMS encryption would make the data unusable for application testing unless decrypted, exposing the original data. Randomly generated replacements are less suitable because they may not preserve valid PAN format or realistic data relationships unless significant custom logic is built.
Question 72
Your organization 1s developing a new SaaS application on Google Cloud. Stringent compliance standards require visibility into privileged account activity, and potentially unauthorized changes and misconfigurations to the application's infrastructure. You need to monitor administrative actions, log changes to IAM roles and permissions, and be able to trace potentially unauthorized configuration changes. What should you do?
A. Create log sinks to Cloud Storage for long-term retention. Set up log-based alerts in Cloud Logging based on relevant log types. Enable VPC Flow Logs for network visibility.
B. Deploy Cloud IDS and activate Firewall Rules Logging. Create a custom dashboard in Security Command Center to visualize potential intrusion attempts.
C. Detect sensitive administrative actions by using Cloud Logging with custom filters. Enable VPC Flow Logs with BigQuery exports for rapid analysis of network traffic patterns.
D. Enable Event Threat Detection and Security Health Analytics in Security Command Center. Set up detailed logging for IAM-related activity and relevant project resources by deploying Cloud Audit Logs.
Show Answer
Correct Answer: D
Explanation: The requirements are to monitor privileged administrative actions, track IAM role and permission changes, detect misconfigurations, and trace unauthorized configuration changes. Cloud Audit Logs provide the authoritative record of administrative activity and IAM/resource changes. Security Command Center's Security Health Analytics detects misconfigurations, and Event Threat Detection helps identify suspicious or potentially malicious activity. The other options either focus on log storage, networking, or intrusion detection without comprehensively addressing IAM auditing and configuration monitoring.
Question 73
You are responsible for a set of Cloud Functions running on your organization's Google Cloud environment. During the last annual security review, secrets were identified in environment variables of some of these Cloud Functions. You must ensure that secrets are identified in a timely manner. What should you do?
A. Implement regular peer reviews to assess the environment variables and identify secrets in your Cloud Functions. Raise a security incident if secrets are discovered.
B. Implement a Cloud Function that scans the environment variables multiple times a day, and creates a finding in Security Command Center if secrets are discovered.
C. Use Sensitive Data Protection to scan the environment variables multiple times per day, and create a finding in Security Command Center if secrets are discovered.
D. Integrate dynamic application security testing into the CI/CD pipeline that scans the application code for the Cloud Functions. Fail the build process if secrets are discovered.
Show Answer
Correct Answer: C
Explanation: Sensitive Data Protection has a managed secrets discovery capability that periodically scans Cloud Functions (Cloud Run functions) environment variables for secrets and automatically creates Security Command Center findings. This directly satisfies the requirement to identify secrets in environment variables in a timely manner without building custom scanners. Peer review is manual, a custom Cloud Function is unnecessary, and DAST/code scanning targets source code rather than deployed runtime environment variables.
Question 74
Your organization's use of the Google Cloud has grown substantially and there are many different groups using different cloud resources independently. You must identify common misconfigurations and compliance violations across the organization and track findings for remedial action in a dashboard. What should you do?
A. Create a filter set in Cloud Asset Inventory to identify service accounts with high privileges and IAM principals with Gmail domains.
B. Scan and alert vulnerabilities and misconfigurations by using Secure Health Analytics detectors in Security Command Center Premium.
C. Set up filters on Cloud Audit Logs to flag log entries for specific, risky API calls, and display the calls in a Cloud Log Analytics dashboard.
D. Alert and track emerging attacks detected in your environment by using Event Threat Detection detectors.
Show Answer
Correct Answer: B
Explanation: Security Command Center Premium's Secure Health Analytics is designed to continuously detect misconfigurations and compliance violations across Google Cloud resources, generate findings, and provide a centralized dashboard for tracking remediation. Cloud Asset Inventory can query assets but is not a comprehensive findings/remediation solution, Cloud Audit Logs focus on API activity rather than configuration compliance, and Event Threat Detection identifies active threats rather than configuration issues.
Question 75
You just implemented a Secure Web Proxy instance on Google Cloud for your organization. You were able to reach the internet when you tested this configuration on your test instance. However, developers cannot access the allowed URLs on the Secure Web Proxy instance from their Linux instance on Google Cloud. You want to solve this problem with developers. What should you do?
A. Configure a Cloud NAT gateway to enable internet access from the developer instance subnet.
B. Ensure that the developers have restarted their instance and HTTP service is enabled.
C. Ensure that the developers have explicitly configured the proxy address on their instance.
D. Configure a firewall rule to allow HTTP/S from the developer instance.
Show Answer
Correct Answer: C
Explanation: Secure Web Proxy operates as an explicit proxy. Client systems or applications must be configured to send HTTP/HTTPS traffic to the proxy's address and port. Since the proxy worked during testing, the most likely issue is that the developers' Linux instances are not configured to use the proxy. Cloud NAT is not required for using the proxy, restarting instances or enabling an HTTP service is unrelated, and generic firewall rules do not configure clients to route traffic through the proxy.
Question 76
You have just created a new log bucket to replace the _Default log bucket. You want to route all log entries that are currently routed to the _Default log bucket to this new log bucket, in the most efficient manner. What should you do?
A. Create exclusion filters for the _Default sink to prevent it from receiving new logs. Create a user-defined sink, and select the new log bucket as the sink destination.
B. Disable the _Default sink. Create a user-defined sink and select the new log bucket as the sink destination.
C. Create a user-defined sink with inclusion filters copied from the _Default sink. Select the new log bucket as the sink destination.
D. Edit the _Default sink, and select the new log bucket as the sink destination.
Show Answer
Correct Answer: D
Explanation: The _Default sink can be edited to change its destination. Updating the existing _Default sink to point to the new log bucket preserves its existing routing behavior and is the most efficient way to redirect all logs that were previously routed to the _Default bucket. Creating a new sink or adding exclusion filters is unnecessary for this scenario.
Question 77
Your organization has an application hosted in Cloud Run. You must control access to the application by using Cloud Identity-Aware Proxy (IAP) with these requirements:
• Only users from the AppDev group may have access.
• Access must be restricted to internal network IP addresses.
What should you do?
A. Deploy a VPN gateway and instruct the AppDev group to connect to the company network before accessing the application.
B. Create an access level that includes conditions for internal IP address ranges and AppDev groups. Apply this access level to the application's IAP policy.
C. Configure firewall rules to limit access to IAP based on the AppDev group and source IP addresses.
D. Configure IAP to enforce multi-factor authentication (MFA) for all users and use network intrusion detection systems (NIDS) to block unauthorized access attempts.
Show Answer
Correct Answer: B
Explanation: Cloud Identity-Aware Proxy integrates with Access Context Manager access levels. You can create an access level that requires requests to originate from internal IP address ranges and satisfy identity-based conditions, then apply that access level to the IAP-protected Cloud Run application. Grant IAP access only to the AppDev group, and enforce the access level in the IAP policy to restrict access by both group membership and network location. The other options do not implement IAP context-aware access correctly or rely on unrelated controls.
Question 78
Your organization operates a hybrid cloud environment and has recently deployed a private Artifact Registry repository in Google Cloud. On-premises developers cannot resolve the Artifact Registry hostname and therefore cannot push or pull artifacts. You've verified the following:
• Connectivity to Google Cloud is established by Cloud VPN or Cloud Interconnect.
• No custom DNS configurations exist on-premises.
• There is no route to the internet from the on-premises network.
You need to identify the cause and enable the developers to push and pull artifacts. What is likely causing the issue and what should you do to fix the issue?
A. On-premises DNS servers lack the necessary records to resolve private Google API domains. Create DNS records for restricted.googleapis.com or private.googleapis.com pointing to Google's published IP ranges.
B. Developers must be granted the artifactregistry.writer IAM role. Grant the relevant developer group this role.
C. Private Google Access is not enabled for the subnet hosting the Artifact Registry. Enable Private Google Access for the appropriate subnet.
D. Artifact Registry requires external HTTP/HTTPS access. Create a new firewall rule allowing ingress traffic on ports 80 and 443 from the developer's IP ranges.
Show Answer
Correct Answer: A
Explanation: The issue is DNS resolution, not IAM, firewalling, or Private Google Access on a subnet. In a hybrid environment with Cloud VPN/Interconnect, no internet route, and no custom on-prem DNS configuration, on-prem clients cannot resolve Google API hostnames for Artifact Registry unless DNS is configured for Private Google Access domains. Configure on-prem DNS to resolve private.googleapis.com or restricted.googleapis.com (per your organization's access model) to Google's published VIPs so Artifact Registry hostnames resolve and traffic is sent over the private connection.
Question 79
You work for a large organization that is using Cloud Identity as the identity provider (IdP) on Google Cloud. Your InfoSec team has mandated the enforcement of a strong password with a length between 12 and 16 characters for all users. After configuring this requirement, users are still able to access the Google Cloud console with passwords that are less than 12 characters. You need to fix this problem within the Admin console. What should you do?
A. Review each user's password configuration and reset existing passwords.
B. Review the organization password management setting and select Enforce password policy at the next sign-in.
C. Review each user's password configuration and select Enforce strong password.
D. Review the organization password management setting and select Enforce strong password.
Show Answer
Correct Answer: B
Explanation: Password policy changes (such as requiring 12–16 character passwords) generally apply to new or changed passwords and do not automatically invalidate existing passwords. To bring existing users into compliance, enable the organization setting to enforce the password policy at the next sign-in, which forces affected users to update their passwords to meet the new requirements.
Question 80
Your organization is preparing to build business services in Google Cloud for the first time. You must determine where to apply appropriate controls or policies. You must also identify what aspects of your cloud deployment are managed by Google. What should you do?
A. Model your deployment on the Google Enterprise foundations blueprint. Follow the blueprint exactly and rely on the blueprint to maintain the posture necessary for your business.
B. Use the Risk Manager tool in the Risk Protection Program to generate a report on your cloud security posture. Obtain cyber insurance coverage.
C. Subscribe to the Google Cloud release notes to keep up on product updates and when new services are available. Evaluate new services for appropriate use before enabling their API.
D. Study the shared responsibilities model. Depending on your business scenario, you might need to consider your responsibilities based on the location of your business offices, your customers, and your data.
Show Answer
Correct Answer: D
Explanation: The correct choice is D because the shared responsibility model defines which security, compliance, and operational responsibilities are managed by Google (security of the cloud) versus which remain with the customer (security in the cloud). This directly addresses determining where to apply controls and policies and identifying what Google manages. The other options are either supplemental best practices or specific services that do not answer the fundamental responsibility question.
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.