Professional Cloud Security Engineer Free Practice Questions — Page 9
Question 81
You are creating a secure network architecture. You must fully isolate development and production environments, and prevent any network traffic between the two environments. The network team requires that there is only one central entry point to the cloud network from the on-premises environment. What should you do?
A. Create one Virtual Private Cloud (VPC) network per environment. Add the on-premises entry point to the production VPC. Peer the VPCs with each other and create firewall rules to prevent traffic.
B. Create one shared Virtual Private Cloud (VPC) network and use it as the entry point to the cloud network. Create separate subnets per environment. Create firewall rules to prevent traffic.
C. Create one Virtual Private Cloud (VPC) network per environment. Create a VPC Service Controls perimeter per environment and add one environment VPC to each.
D. Create one Virtual Private Cloud (VPC) network per environment. Create one additional VPC for the entry point to the cloud network. Peer the entry point VPC with the environment VPCs.
Show Answer
Correct Answer: D
Explanation: Use a hub-and-spoke design: create separate VPCs for development and production to ensure network isolation, plus a dedicated hub VPC that serves as the single on-premises entry point. Peer the hub VPC with each environment VPC. Because VPC Network Peering is non-transitive, the development and production VPCs cannot communicate with each other through the hub, satisfying the requirement to prevent traffic between environments while maintaining one central ingress.
Question 82
Your EU-based organization stores both Personally Identifiable Information (PII) and non-PII data in Cloud Storage buckets across multiple Google Cloud regions. EU data privacy laws require that the PII data must not be stored outside of the EU. To help meet this compliance requirement, you want to detect if Cloud Storage buckets outside of the EU contain healthcare data. What should you do?
A. Create a Sensitive Data Protection job. Specify the infoType of data to be detected and run the job across all Google Cloud Storage buckets.
B. Create a log sink with a filter on resourceLocation.currentLocations. Trigger an alert if a log message appears with a non- EUcountry.
C. Activate Security Command Center Premium. Use compliance monitoring to detect resources that do not follow the applicable healthcare regulation.
D. Enforce the gcp.resourceLocations organization policy and add "EU" in a custom rule that only applies on resources with the tag "healthcare".
Show Answer
Correct Answer: A
Explanation: Sensitive Data Protection (formerly Cloud DLP) is the service designed to inspect Cloud Storage contents for sensitive information such as PII and healthcare-related infoTypes. Running an inspection job across Cloud Storage buckets allows you to identify buckets outside the EU that contain sensitive data, which directly addresses the detection requirement. The other options either monitor resource configuration rather than inspect stored data, provide broader compliance posture rather than content discovery, or prevent future resource placement without detecting existing sensitive data in non-EU buckets.
Question 83
Your organization is migrating business critical applications to Google Cloud across multiple projects. You only have the required IAM permission at the Google Cloud organization level. You want to grant project access to support engineers from two partner organizations using their existing identity provider (IdP) credentials. What should you do?
A. Create two single sign-on (SSO) profiles for the internal and partner IdPs by using SSO for Cloud Identity.
B. Create users manually by using the Google Cloud console. Assign the users to groups.
C. Create two workforce identity pools for the partner IdPs.
D. Sync user identities from their existing IdPs to Cloud Identity by using Google Cloud Directory Sync (GCDS).
Show Answer
Correct Answer: C
Explanation: Use Workforce Identity Federation by creating separate workforce identity pools for each partner organization's external IdP. This allows partner users to authenticate with their existing credentials and be granted IAM access to Google Cloud resources without creating or synchronizing Google-managed identities. SSO for Cloud Identity is intended for your organization's users, GCDS synchronizes directories rather than enabling federated external workforce access, and manually creating users does not meet the requirement to use existing partner IdP credentials.
Question 84
You are working with developers to secure custom training jobs running on Vertex AI. For compliance reasons, all supported data types must be encrypted by key materials that reside in the Europe region and are controlled by your organization. The encryption activity must not impact the training operation in Vertex AI. What should you do?
A. Encrypt the code, training data, and metadata with Google default encryption. Use customer-managed encryption keys (CMEK) for the trained models exported to Cloud Storage buckets.
B. Encrypt the code, training data, metadata, and exported trained models with customer-managed encryption keys (CMEK).
C. Encrypt the code, training data, and exported trained models with customer-managed encryption keys (CMEK).
D. Encrypt the code, training data, and metadata with Google default encryption. Implement an organization policy that enforces a constraint to restrict the Cloud KMS location to the Europe region.
Show Answer
Correct Answer: C
Explanation: Vertex AI supports CMEK for custom training code/artifacts, training data, and exported trained models, but operational metadata is generally not encryptable with CMEK and remains encrypted with Google-managed encryption. Therefore the maximum compliant configuration among the options is to use CMEK for the supported resources (with keys in the Europe region under your organization's control). Option B incorrectly claims metadata can be encrypted with CMEK, while D relies on Google-managed encryption and does not satisfy the requirement for organizational control.
Question 85
You work for a global company. Due to compliance requirements, certain Compute Engine instances that reside within specific projects must be located exclusively in cloud regions within the European Union (EU). You need to ensure that existing non-compliant workloads are remediated and prevent future Compute Engine instances from being launched in restricted regions. What should you do?
A. Use a third-party configuration management tool to monitor the location of Compute Engine instances. Automatically delete or migrate non-compliant instances, including existing deployments.
B. Deploy a Security Command Center source to detect Compute Engine instances created outside the EU. Use a custom remediation function to automatically relocate the instances, run the function once a day.
C. Use organization policy constraints in Resource Manager to enforce allowed regions for Compute Engine instance creation within specific projects.
D. Set an organization policy that denies the creation of Compute Engine instances outside the EU. Apply the policy to the appropriate projects. Identify existing non-compliant instances and migrate the instances to compliant EU regions.
Show Answer
Correct Answer: D
Explanation: The requirement has two parts: remediate existing non-compliant Compute Engine instances and prevent future deployments outside EU regions. Organization Policy with the resource location constraint can enforce allowed locations for future resource creation when applied to the appropriate projects. It does not automatically move existing instances, so existing non-compliant workloads must be identified and migrated to EU regions. Option C only addresses prevention, while D covers both prevention and remediation.
Question 86
You work for a multinational organization that has systems deployed across multiple cloud providers, including Google Cloud. Your organization maintains an extensive on-premises security information and event management (SIEM) system. New security compliance regulations require that relevant Google Cloud logs be integrated seamlessly with the existing SIEM to provide a unified view of security events. You need to implement a solution that exports Google Cloud logs to your on-premises SIEM by using a push-based, near real-time approach. You must prioritize fault tolerance, security, and auto scaling capabilities. In particular, you must ensure that if a log delivery fails, logs are re-sent. What should you do?
A. Create a Pub/Sub topic for log aggregation. Write a custom Python script on a Cloud Function Leverage the Cloud Logging API to periodically pull logs from Google Cloud and forward the logs to the SIEM. Schedule the Cloud Function to run twice per day.
B. Collect all logs into an organization-level aggregated log sink and send the logs to a Pub/Sub topic. Implement a primary Dataflow pipeline that consumes logs from this Pub/Sub topic and delivers the logs to the SIEM. Implement a secondary Dataflow pipeline that replays failed messages.
C. Deploy a Cloud Logging sink with a filter that routes all logs directly to a syslog endpoint. The endpoint is based on a single Compute Engine hosted on Google Cloud that routes all logs to the on-premises SIEM. Implement a Cloud Function that triggers a retry action in case of failure.
D. Utilize custom firewall rules to allow your SIEM to directly query Google Cloud logs. Implement a Cloud Function that notifies the SIEM of a failed delivery and triggers a retry action.
Show Answer
Correct Answer: B
Explanation: An organization-level aggregated Cloud Logging sink exporting to Pub/Sub provides push-based, near real-time log delivery. Dataflow is managed, fault-tolerant, and auto-scaling for streaming logs to an on-premises SIEM. Using retry/dead-letter handling and a replay pipeline satisfies the requirement to resend failed log deliveries. The other options rely on polling, unsupported direct routing, or do not provide the required scalable, fault-tolerant streaming architecture.
Question 87
You work for a healthcare provider that is expanding into the cloud to store and process sensitive patient data. You must ensure the chosen Google Cloud configuration meets these strict regulatory requirements:
• Data must reside within specific geographic regions.
• Certain administrative actions on patient data require explicit approval from designated compliance officers.
• Access to patient data must be auditable.
What should you do?
A. Select a standard Google Cloud region. Restrict access to patient data based on user location and job function by using Access Context Manager. Enable both Cloud Audit Logging and Access Transparency.
B. Deploy an Assured Workloads environment in an approved region. Configure Access Approval for sensitive operations on patient data. Enable both Cloud Audit Logs and Access Transparency.
C. Deploy an Assured Workloads environment in multiple regions for redundancy. Utilize custom IAM roles with granular permissions. Isolate network-level data by using VPC Service Controls.
D. Select multiple standard Google Cloud regions for high availability. Implement Access Control Lists (ACLs) on individual storage objects containing patient data. Enable Cloud Audit Logs.
Show Answer
Correct Answer: B
Explanation: Assured Workloads helps enforce data residency and compliance requirements in approved regions. Access Approval provides explicit customer approval before certain Google support/administrative actions on covered resources. Cloud Audit Logs provide auditable access records, and Access Transparency logs Google's administrative access, satisfying the auditing requirement. The other options omit either Assured Workloads or Access Approval, which are key to the stated regulatory requirements.
Question 88
Your organization is using Security Command Center Premium as a central tool to detect and alert on security threats. You also want to alert on suspicious outbound traffic that is targeting domains of known suspicious web services. What should you do?
A. Create a DNS Server Policy in Cloud DNS and turn on logs. Attach this policy to all Virtual Private Cloud networks with internet connectivity.
B. Forward all logs to Chronicle Security Information and Event Management. Create an alert for suspicious egress traffic to the internet.
C. Create a Cloud Intrusion Detection endpoint. Connect this endpoint to all Virtual Private Cloud networks with internet connectivity.
D. Create an egress firewall policy with Threat Intelligence as the destination. Attach this policy to all Virtual Private Cloud networks with internet connectivity.
Show Answer
Correct Answer: D
Explanation: An egress firewall policy using Google Threat Intelligence as the destination is designed to detect or block outbound connections to known malicious or suspicious IPs/domains. When integrated with Security Command Center Premium, these events can generate findings and alerts. DNS logging alone does not provide threat matching, Cloud IDS focuses on intrusion detection rather than curated malicious destination intelligence, and forwarding logs to Chronicle is unnecessary for this stated requirement.
Question 89
Your organization has sensitive data stored in BigQuery and Cloud Storage. You need to design a solution that provides granular and flexible control authorization to read data. What should you do?
A. Deidentify sensitive fields within the dataset by using data leakage protection within the Sensitive Data Protection services.
B. Use Cloud External Key Manager (Cloud EKM) to encrypt the data in BigQuery and Cloud Storage.
C. Grant identity and access management (IAM) roles and permissions to principals.
D. Enable server-side encryption on the data in BigQuery and Cloud Storage.
Show Answer
Correct Answer: C
Explanation: IAM roles and permissions are the primary mechanism for granular and flexible authorization in Google Cloud. They allow assigning least-privilege read access to specific principals for BigQuery datasets, tables, and Cloud Storage buckets or objects. The other options focus on encryption or data masking rather than access authorization.
Question 90
Your organization must follow the Payment Card Industry Data Security Standard (PCI DSS). To prepare for an audit, you must detect deviations on an infrastructure-as-a-service level in your Google Cloud landing zone. What should you do?
A. Create a data profile covering all payment relevant data types. Configure Data Discovery and a risk analysis job in Google Cloud Sensitive Data Protection to analyze findings.
B. Use the Google Cloud Compliance Reports Manager to download the latest version of the PCI DSS report Analyze the report to detect deviations.
C. Create an Assured Workloads folder in your Google Cloud organization. Migrate existing projects into the folder and monitor for deviations in the PCI DSS.
D. Activate Security Command Center Premium. Use the Compliance Monitoring product to filter findings that may not be PCI DSS compliant.
Show Answer
Correct Answer: D
Explanation: Security Command Center Premium includes Compliance Monitoring, which continuously evaluates Google Cloud resources against supported compliance frameworks, including PCI DSS, and surfaces findings for control deviations. This is the appropriate service for detecting infrastructure-level compliance deviations in a Google Cloud landing zone. The other options either focus on sensitive data discovery (A), provide compliance documentation rather than environment assessment (B), or use Assured Workloads, which helps enforce certain compliance guardrails but is not the primary tool for detecting PCI DSS deviations across IaaS resources (C).
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.